Data security management system and method based on multistage classification

Abstract

The invention relates to the technical field of data management, and particularly discloses a data security management system and method based on multistage classification, and the system comprises a grading module which is used for recognizing and checking all data, carrying out the classification according to a checking result, obtaining first data sets, carrying out the grading processing of the data in each first data set, and obtaining a second data set; a plurality of levels of second data sets are obtained; the management module is used for setting the sensitivity of each piece of data and formulating a corresponding security management strategy, and the security management strategy comprises management sub-strategies of a plurality of management processes; and the construction module is used for performing application evaluation on the management sub-strategy of the corresponding data based on the attack behavior and judging whether the management sub-strategy is corrected or not, if so, generating a security management strategy according to the corrected management sub-strategy, constructing a data security management model, timely discovering and optimizing the security management strategy, and outputting the data security management strategy. The data asset security management process is enhanced, and the data asset value is better played.

Description

Technical Field

[0001] The present application relates to the technical field of data management, and in particular to a data security management system and method based on multi-level classification. Background Art

[0002] In the era of data explosion, data asset management has become an indispensable part of enterprises. Due to the huge amount of data and the wide variety of types, different types of data may have different security requirements and sensitivities. Therefore, there is an urgent need for a data security management system and method based on multi-level classification to prevent sensitive data leakage, unauthorized access, etc., strengthen the data asset security management process, and better play the value of data assets. Summary of the invention

[0003] To solve the above technical problems, the present application provides a data security management system and method based on multi-level classification, which obtains a second data set of multiple levels by identifying and counting all data and classifying and grading them, calculates the sensitivity of each data in the second data set, formulates a corresponding security management strategy based on the sensitivity, simulates attacks on the data based on the attack behavior, generates application evaluation results of the corresponding security management strategy based on the simulation results, formulates reasonable security management strategies based on data of different sensitivities, timely discovers and optimizes security management strategies, strengthens the data asset security management process, and better leverages the value of data assets.

[0004] In some embodiments of the present application, a data security management system based on multi-level classification is provided, including: A grading module is used to identify and count all data, classify them according to the count results to obtain a first data set, and grade the data in each first data set to obtain a second data set of multiple levels; A management module, used to set the sensitivity of each data in the second data set, and formulate a security management strategy for the corresponding data according to the sensitivity, wherein the security management strategy includes management sub-strategies of multiple management processes; A construction module is used to pre-set attack behaviors, conduct application evaluation on the management sub-strategies of the corresponding data based on the attack behaviors, and determine whether to revise the management sub-strategies based on the application evaluation results. If so, a security management strategy is generated based on the revised management sub-strategies. A data security management model is constructed based on the sensitivity of each data and the corresponding security management strategy.

[0005] In some embodiments of the present application, data in each first data subset is hierarchically processed to obtain second data sets of multiple levels, including: Identify and inventory all data, classify the data according to the data source, data purpose and data type in the inventory result, obtain multiple first data sets, and calculate the set coefficient of each first data set; Obtaining a historical abnormality log of each data in each first data set, extracting a historical evaluation factor in each historical abnormality log, and generating a data quality evaluation value of the data in the corresponding historical abnormality log according to a plurality of historical evaluation factors; Obtaining a first impact degree of a data quality evaluation value of each data in different historical abnormal logs on a plurality of preset indicators of corresponding business purposes, and calculating a first comprehensive impact degree, wherein the preset indicators include economic indicators, operation indicators, efficiency indicators, and safety indicators; Generate a first important coefficient of the corresponding data according to different data quality evaluation values ​​of each data and the corresponding first comprehensive impact degree; Obtaining a second influence degree of different data quality evaluation values ​​of each data on multiple historical evaluation factors of other data in the same first data set and a third influence degree of different data quality evaluation values ​​on multiple historical evaluation factors of other data in different first data sets, and calculating a second comprehensive influence degree and a third comprehensive influence degree; generating a first correlation coefficient according to a second comprehensive influence degree of different data quality evaluation values ​​of each data on other data in the same first data set; generating a second correlation coefficient according to a third comprehensive influence degree of different data quality evaluation values ​​of each data on other data in different first data sets; If the first correlation coefficient is greater than the preset first correlation coefficient threshold, it is determined that there is a correlation relationship, and the first correlation coefficient difference between the first correlation coefficient and the preset first correlation coefficient threshold is calculated, and the second important coefficient of the corresponding data is generated according to the number of data that have a correlation relationship with the same first data set and the corresponding first correlation coefficient difference; If the second correlation coefficient is greater than the preset second correlation coefficient threshold, it is determined that there is a correlation relationship, and the second correlation coefficient difference between the second correlation coefficient and the preset second correlation coefficient threshold is calculated, and the third important coefficient of the corresponding data is generated according to the number of data having a correlation relationship between each data and different first data sets, the second correlation coefficient difference and the set coefficient of the corresponding first data set; Generate a fourth important coefficient of the corresponding data according to the first important coefficient, the second important coefficient and the third important coefficient of each data; The data are graded according to the fourth important coefficient of each data in the same first data set to obtain second data sets of different levels.

[0006] In some embodiments of the present application, generating a fourth important coefficient of corresponding data according to the first important coefficient, the second important coefficient, and the third important coefficient of each data includes: Determine, according to the plurality of data quality evaluation values ​​and the corresponding first comprehensive influence degrees, the degree of change of the first comprehensive influence degree as the data quality evaluation value changes, and match the first important coefficient of the corresponding data based on the change degree-importance coefficient mapping table and the corresponding change degree; The calculation formula of the fourth important coefficient is: ; Among them, Q is the fourth important coefficient, b1 is the weight coefficient of the first important coefficient, q1 is the first important coefficient, b2 is the weight coefficient of the second important coefficient, g1 is the first important conversion coefficient, w1 is the number of data that are associated with the current data in the same first data set, w2 is the total number of data in the same first data set as the current data, is the z1th first correlation coefficient difference, b3 is the weight coefficient of the third important coefficient, g2 is the second important conversion coefficient, is the number of data associated with the jth different first data set of the current data, is the total number of data in the jth different first data set from the current data, hj is the set coefficient of the jth different first data set, is the z2th second correlation coefficient difference in the jth different first data set, j=1, 2…, k, k is the total number of different third data sets.

[0007] In some embodiments of the present application, setting the sensitivity of each data in the second data set includes: Generate a comprehensive significance coefficient of the corresponding data according to the fourth significance coefficient of each data in each second data set and the set coefficient of the corresponding first data set; According to the relationship between the comprehensive importance coefficient of each data and the preset importance coefficient range, the sensitivity of the corresponding data is set; Presetting a first preset important coefficient interval, a second preset important coefficient interval, a third preset important coefficient interval and a fourth preset important coefficient interval; When the comprehensive importance coefficient of each data is within the first preset importance coefficient interval, the sensitivity of the corresponding data is set to the first preset sensitivity; When the comprehensive importance coefficient of each data is within the second preset importance coefficient interval, setting the sensitivity of the corresponding data to the second preset sensitivity; When the comprehensive importance coefficient of each data is within the third preset importance coefficient interval, the sensitivity of the corresponding data is set to the third preset sensitivity; When the comprehensive importance coefficient of each data is within the four preset importance coefficient intervals, the sensitivity of the corresponding data is set to the fourth preset sensitivity.

[0008] In some embodiments of the present application, a security management policy for corresponding data is formulated according to the sensitivity, including: Calculating the sensitivity difference between different data, and constructing a third data set based on the data whose sensitivity difference is less than a preset difference threshold; Comprehensively analyzing the data in the same third data set to obtain historical abnormality characteristics of each data, wherein the historical abnormality characteristics include the number of abnormalities, the abnormality frequency, and the abnormality degree; Generate a historical application evaluation value of the historical security management policy of the corresponding data according to the historical abnormal characteristics of each data, and set the historical security management policy whose historical application evaluation value is greater than a preset application evaluation value threshold as the pending security management policy corresponding to the data in the third data set; Pre-set multiple management processes, including desensitization process, encryption process, authorization process, and backup process; Dividing each pending security management policy of the same third data set into pending management sub-policies of multiple management processes, and coordinating and optimizing the multiple pending management sub-policies of the same management process to obtain management sub-policies corresponding to the management process; Constructing a security management policy corresponding to each data in the third data set according to the management sub-policy of the entire management process; A security management policy for each data in each third data set is generated in sequence.

[0009] In some embodiments of the present application, the attack behavior is preset, including: Obtaining a historical attack log of each data in each second data set, and extracting historical abnormal data of the corresponding data in each historical attack log, matching the historical abnormal data in a preset attack simulation reference library of the corresponding data to obtain a corresponding preset attack feature, wherein the preset attack feature includes an attack point, an attack type, an attack intensity, and an attack frequency; Generate attack behaviors for corresponding data based on historical abnormal data of each data and corresponding preset attack features; The correlation degree between each attack behavior and each management process in the security management policy of the corresponding data is calculated, and the management process with a correlation degree greater than a preset correlation degree threshold is set as the concerned management process of the corresponding attack behavior.

[0010] In some embodiments of the present application, application evaluation of management sub-strategies of corresponding data based on attack behaviors includes: Build a simulation application environment for each data; Perform attack simulation on the simulation application environment of each data according to the preset attack behavior, obtain the simulation log of the attack simulation process of each attack behavior, capture and analyze the simulation change values ​​of multiple evaluation factors of the corresponding data according to the simulation log, and generate the simulation change coefficient of the corresponding evaluation factor according to the simulation change value; Performing application evaluation on the management sub-strategy of the attention management process of the corresponding attack behavior according to the simulation variation coefficients of the multiple evaluation factors, and obtaining a first application evaluation value of the management sub-strategy of the corresponding attention management process; The calculation formula of the first application evaluation value is: ; Among them, Y1 is the first application evaluation value, y0 is the first application evaluation conversion coefficient, n is the total number of evaluation factors, fi is the simulation change coefficient of the i-th evaluation factor, and ai is the weight coefficient of the i-th evaluation factor; Generate a first application evaluation value of the management process concerned with each attack behavior in turn; Generating a second application evaluation value of a management sub-strategy corresponding to the management process of interest according to a plurality of first application evaluation values ​​of the same management process of interest; The calculation formula of the second application evaluation value is: ; Among them, Y2 is the second application evaluation value, m is the total number of attack behaviors associated with the current management process, Y1s is the first application evaluation value of the management process after the sth attack behavior, and ds is the sth weight coefficient.

[0011] In some embodiments of the present application, whether to modify the management sub-policy is determined according to the application evaluation result, and if so, generating a security management policy according to the modified management sub-policy includes: Pre-set application evaluation value thresholds; If the second application evaluation value is less than the application evaluation value threshold, the management sub-policy of the corresponding management process is modified, the management sub-policy of the corresponding management process is replaced according to the modified management sub-policy, and a security management policy for the corresponding data is generated; If the second application evaluation value is greater than the application evaluation value threshold, the management sub-policy of the corresponding focus management process is not modified.

[0012] In some embodiments of the present application, a data security management model is constructed according to the sensitivity of each data and the corresponding security management policy, including: According to the sensitivity of each data as training input data, the management sub-strategy of each management process in the security management strategy corresponding to each data is used as training output data, and neural network training is performed to obtain a data security management model; Wherein, the data security management model includes multiple management sub-models.

[0013] In some embodiments of the present application, a data security management method based on multi-level classification is also included: Identify and inventory all data, classify them according to the inventory results to obtain a first data set, and perform hierarchical processing on the data in each first data set to obtain a second data set of multiple levels; Setting the sensitivity of each data in the second data set, and formulating a security management strategy for the corresponding data according to the sensitivity, wherein the security management strategy includes management sub-strategies of multiple management processes; Pre-set attack behaviors, and perform application evaluation on the management sub-strategies of corresponding data based on the attack behaviors. Determine whether to modify the management sub-strategies based on the application evaluation results. If so, generate a security management strategy based on the modified management sub-strategies, and build a data security management model based on the sensitivity of each data and the corresponding security management strategy.

[0014] Compared with the prior art, the data security management system and method based on multi-level classification in the embodiment of the present application have the following beneficial effects: By identifying and counting all data and classifying and grading them, we obtain a second data set of multiple levels, calculate the sensitivity of each data in the second data set, formulate corresponding security management strategies based on the sensitivity, simulate attacks on the data based on the attack behavior, and generate application evaluation results of the corresponding security management strategies based on the simulation results. We formulate reasonable security management strategies based on data of different sensitivities, discover and optimize security management strategies in a timely manner, strengthen the data asset security management process, and better leverage the value of data assets. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 is a schematic diagram of a data security management system based on multi-level classification in an embodiment of the present application; Figure 2 It is a flow chart of a data security management method based on multi-level classification in an embodiment of the present application. DETAILED DESCRIPTION

[0016] The specific implementation methods of the present application are further described in detail below in conjunction with the accompanying drawings and examples. The following examples are used to illustrate the present application but are not intended to limit the scope of the present application.

[0017] In the description of the present application, it should be understood that the terms "center", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc., indicating orientations or positional relationships, are based on the orientations or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as a limitation on the present application.

[0018] The terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of this application, unless otherwise specified, "plurality" means two or more.

[0019] In the description of this application, it should be noted that, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in this application can be understood according to specific circumstances.

[0020] like Figure 1 As shown, a data security management system based on multi-level classification in an embodiment of the present application includes: A grading module is used to identify and count all data, classify them according to the count results to obtain a first data set, and grade the data in each first data set to obtain a second data set of multiple levels; A management module, used to set the sensitivity of each data in the second data set, and formulate a security management strategy for the corresponding data according to the sensitivity, wherein the security management strategy includes management sub-strategies of multiple management processes; A construction module is used to pre-set attack behaviors, conduct application evaluation on the management sub-strategies of the corresponding data based on the attack behaviors, and determine whether to revise the management sub-strategies based on the application evaluation results. If so, a security management strategy is generated based on the revised management sub-strategies. A data security management model is constructed based on the sensitivity of each data and the corresponding security management strategy.

[0021] In some embodiments of the present application, data in each first data subset is hierarchically processed to obtain second data sets of multiple levels, including: Identify and inventory all data, classify the data according to the data source, data purpose and data type in the inventory result, obtain multiple first data sets, and calculate the set coefficient of each first data set; Obtaining a historical abnormality log of each data in each first data set, extracting a historical evaluation factor in each historical abnormality log, and generating a data quality evaluation value of the data in the corresponding historical abnormality log according to a plurality of historical evaluation factors; Obtaining a first impact degree of a data quality evaluation value of each data in different historical abnormal logs on a plurality of preset indicators of corresponding business purposes, and calculating a first comprehensive impact degree, wherein the preset indicators include economic indicators, operation indicators, efficiency indicators, and safety indicators; Generate a first important coefficient of the corresponding data according to different data quality evaluation values ​​of each data and the corresponding first comprehensive impact degree; Obtaining a second influence degree of different data quality evaluation values ​​of each data on multiple historical evaluation factors of other data in the same first data set and a third influence degree of different data quality evaluation values ​​on multiple historical evaluation factors of other data in different first data sets, and calculating a second comprehensive influence degree and a third comprehensive influence degree; generating a first correlation coefficient according to a second comprehensive influence degree of different data quality evaluation values ​​of each data on other data in the same first data set; generating a second correlation coefficient according to a third comprehensive influence degree of different data quality evaluation values ​​of each data on other data in different first data sets; If the first correlation coefficient is greater than the preset first correlation coefficient threshold, it is determined that there is a correlation relationship, and the first correlation coefficient difference between the first correlation coefficient and the preset first correlation coefficient threshold is calculated, and the second important coefficient of the corresponding data is generated according to the number of data that have a correlation relationship with the same first data set and the corresponding first correlation coefficient difference; If the second correlation coefficient is greater than the preset second correlation coefficient threshold, it is determined that there is a correlation relationship, and the second correlation coefficient difference between the second correlation coefficient and the preset second correlation coefficient threshold is calculated, and the third important coefficient of the corresponding data is generated according to the number of data having a correlation relationship between each data and different first data sets, the second correlation coefficient difference and the set coefficient of the corresponding first data set; Generate a fourth important coefficient of the corresponding data according to the first important coefficient, the second important coefficient and the third important coefficient of each data; The data are graded according to the fourth important coefficient of each data in the same first data set to obtain second data sets of different levels.

[0022] In this embodiment, the data source refers to the data distribution location, including but not limited to within the enterprise, outside, and on the client side, etc. The data usage refers to different business purposes, including but not limited to procurement business, financial business, product business, etc. The data type refers to structured data, streaming data, unstructured data, etc.

[0023] In this embodiment, each data source, data purpose and data type is mapped with a corresponding first coefficient, second coefficient and third coefficient. A set coefficient is generated according to the first coefficient, second coefficient and third coefficient corresponding to each first data set. The set coefficient refers to the importance of the data category to which each first data set belongs, which lays the foundation for the subsequent calculation of the data sensitivity of the data of the second data sets of different levels in each first data set, improves the calculation accuracy of the data sensitivity, and thus formulates reasonable security management strategies and improves the efficiency of data asset management.

[0024] In this embodiment, historical evaluation factors include evaluation factors such as consistency, accuracy, timeliness, completeness, and reliability of the data, and standard evaluation factors for each data are set in advance. The standard evaluation factors and the historical evaluation factors in each historical exception log are compared to obtain the degree of factor deviation and generate a data quality evaluation value. The greater the degree of factor deviation, the smaller the data quality evaluation value.

[0025] In this embodiment, when the data quality evaluation value is smaller and the corresponding first comprehensive impact degree is larger, it means that the corresponding data has a greater impact on the corresponding business purpose, and thus the corresponding first important coefficient is larger, and vice versa.

[0026] In this embodiment, the second degree of influence and the third degree of influence respectively refer to the degree of change in historical evaluation factors of other data in the same first data set and different first data sets caused by different data quality evaluation values ​​of each data. When the historical evaluation factors of other data change with the change of the data quality evaluation value of the corresponding data, and the greater the degree of change, it indicates that there is a correlation between the two data, and the first correlation coefficient and the second correlation coefficient, as well as the second importance coefficient and the third importance coefficient are calculated respectively.

[0027] In this embodiment, the first importance coefficient, the second importance coefficient and the third importance coefficient respectively represent the evaluation index of each data for business purpose, the influence of other data in the same first data set and other data in different data sets, so as to calculate the fourth importance coefficient of each data, and the data in the same first data set are graded according to the fourth importance coefficient to obtain second data sets of different levels, thereby laying the foundation for subsequent data sensitivity assessment, formulation of security management strategies and construction of data security management models, strengthening the data asset security management process and better leveraging the value of data assets.

[0028] In some embodiments of the present application, generating a fourth important coefficient of corresponding data according to the first important coefficient, the second important coefficient, and the third important coefficient of each data includes: Determine, according to the plurality of data quality evaluation values ​​and the corresponding first comprehensive influence degrees, the degree of change of the first comprehensive influence degree as the data quality evaluation value changes, and match the first important coefficient of the corresponding data based on the change degree-importance coefficient mapping table and the corresponding change degree; The calculation formula of the fourth important coefficient is: ; Among them, Q is the fourth important coefficient, b1 is the weight coefficient of the first important coefficient, q1 is the first important coefficient, b2 is the weight coefficient of the second important coefficient, g1 is the first important conversion coefficient, w1 is the number of data that are associated with the current data in the same first data set, w2 is the total number of data in the same first data set as the current data, is the z1th first correlation coefficient difference, b3 is the weight coefficient of the third important coefficient, g2 is the second important conversion coefficient, is the number of data associated with the jth different first data set of the current data, is the total number of data in the jth different first data set from the current data, hj is the set coefficient of the jth different first data set, is the z2th second correlation coefficient difference in the jth different first data set, j=1, 2…, k, k is the total number of different third data sets.

[0029] In this embodiment, the change degree-importance coefficient mapping table is set in advance, and the greater the change degree, the greater the corresponding first important coefficient.

[0030] In this embodiment, the first important conversion coefficient and the second important conversion coefficient refer to the values ​​obtained by converting the corresponding multiple first correlation coefficient differences and second correlation coefficient differences into the same dimension as the important coefficients.

[0031] In some embodiments of the present application, setting the sensitivity of each data in the second data set includes: Generate a comprehensive significance coefficient of the corresponding data according to the fourth significance coefficient of each data in each second data set and the set coefficient of the corresponding first data set; According to the relationship between the comprehensive importance coefficient of each data and the preset importance coefficient range, the sensitivity of the corresponding data is set; Presetting a first preset important coefficient interval, a second preset important coefficient interval, a third preset important coefficient interval and a fourth preset important coefficient interval; When the comprehensive importance coefficient of each data is within the first preset importance coefficient interval, the sensitivity of the corresponding data is set to the first preset sensitivity; When the comprehensive importance coefficient of each data is within the second preset importance coefficient interval, the sensitivity of the corresponding data is set to the second preset sensitivity; When the comprehensive importance coefficient of each data is within the third preset importance coefficient interval, the sensitivity of the corresponding data is set to the third preset sensitivity; When the comprehensive importance coefficient of each data is within the four preset importance coefficient intervals, the sensitivity of the corresponding data is set to the fourth preset sensitivity.

[0032] In this embodiment, the first preset important coefficient interval < the second preset important coefficient interval < the third preset important coefficient interval < the fourth preset important coefficient interval, and the first preset sensitivity < the second preset sensitivity < the third preset sensitivity < the fourth preset sensitivity.

[0033] In this embodiment, the larger the preset importance coefficient interval of the comprehensive importance coefficient of each data is, the greater the importance of the corresponding data and the required security, and therefore the greater the sensitivity of the corresponding data, which lays the foundation for subsequently formulating reasonable security management strategies based on sensitivity, thereby improving the security management effect of each data and the value of data assets.

[0034] In some embodiments of the present application, a security management policy for corresponding data is formulated according to the sensitivity, including: Calculating the sensitivity difference between different data, and constructing a third data set based on the data whose sensitivity difference is less than a preset difference threshold; Comprehensively analyzing the data in the same third data set to obtain historical abnormality characteristics of each data, wherein the historical abnormality characteristics include the number of abnormalities, the abnormality frequency, and the abnormality degree; Generate a historical application evaluation value of the historical security management policy of the corresponding data according to the historical abnormal characteristics of each data, and set the historical security management policy whose historical application evaluation value is greater than a preset application evaluation value threshold as the pending security management policy corresponding to the data in the third data set; Pre-set multiple management processes, including desensitization process, encryption process, authorization process, and backup process; Dividing each pending security management policy of the same third data set into pending management sub-policies of multiple management processes, and coordinating and optimizing the multiple pending management sub-policies of the same management process to obtain management sub-policies corresponding to the management process; Constructing a security management policy corresponding to each data in the third data set according to the management sub-policy of the entire management process; A security management policy for each data in each third data set is generated in sequence.

[0035] In this embodiment, coordinated optimization of multiple pending management sub-strategies of the same management process refers to making the optimization results of the multiple pending management sub-strategies consistent to obtain the optimal management sub-strategy, that is, the management sub-strategy with the highest security performance for data of current sensitivity.

[0036] In some embodiments of the present application, the attack behavior is preset, including: Obtaining a historical attack log of each data in each second data set, and extracting historical abnormal data of the corresponding data in each historical attack log, matching the historical abnormal data in a preset attack simulation reference library of the corresponding data to obtain a corresponding preset attack feature, wherein the preset attack feature includes an attack point, an attack type, an attack intensity, and an attack frequency; Generate attack behaviors for corresponding data based on historical abnormal data of each data and corresponding preset attack features; The correlation degree between each attack behavior and each management process in the security management policy of the corresponding data is calculated, and the management process with a correlation degree greater than a preset correlation degree threshold is set as the concerned management process of the corresponding attack behavior.

[0037] In this embodiment, attack behavior refers to the act of illegally obtaining, tampering, deleting or destroying each data. Different attack behaviors are set according to historical attack logs to simulate attacks on data of different sensitivities, and the application evaluation results of the security management policies of the corresponding data are obtained. The corresponding security management policies are discovered and optimized in time to strengthen the data asset security management process.

[0038] In some embodiments of the present application, application evaluation of management sub-strategies of corresponding data based on attack behaviors includes: Build a simulation application environment for each data; Perform attack simulation on the simulation application environment of each data according to the preset attack behavior, obtain the simulation log of the attack simulation process of each attack behavior, capture and analyze the simulation change values ​​of multiple evaluation factors of the corresponding data according to the simulation log, and generate the simulation change coefficient of the corresponding evaluation factor according to the simulation change value; Performing application evaluation on the management sub-strategy of the attention management process of the corresponding attack behavior according to the simulation variation coefficients of the multiple evaluation factors, and obtaining a first application evaluation value of the management sub-strategy of the corresponding attention management process; The calculation formula of the first application evaluation value is: ; Among them, Y1 is the first application evaluation value, y0 is the first application evaluation conversion coefficient, n is the total number of evaluation factors, fi is the simulation change coefficient of the i-th evaluation factor, and ai is the weight coefficient of the i-th evaluation factor; Generate a first application evaluation value of the management process concerned with each attack behavior in turn; Generating a second application evaluation value of a management sub-strategy corresponding to the management process of interest according to a plurality of first application evaluation values ​​of the same management process of interest; The calculation formula of the second application evaluation value is: ; Among them, Y2 is the second application evaluation value, m is the total number of attack behaviors associated with the current management process, Y1s is the first application evaluation value of the management process after the sth attack behavior, and ds is the sth weight coefficient.

[0039] In this embodiment, the smaller the simulation change value, the larger the corresponding simulation change coefficient. When the simulation change coefficient is larger, the corresponding first application evaluation value is larger, that is, the application effect of the management sub-strategy corresponding to the management process is better, and the security management effect of the data is better.

[0040] In this embodiment, ds is calculated based on the degree of correlation between the corresponding attack behavior and the current management process and the weight coefficient of the corresponding attack behavior. The degree of correlation is converted into a coefficient of the same dimension as the weight coefficient of the attack behavior. The greater the degree of correlation and the greater the weight coefficient of the attack behavior, the greater the corresponding ds.

[0041] In this embodiment, the simulation application environment refers to a test scenario that simulates the actual application scenario of each data. By constructing a simulation application scenario, the business scenario of the corresponding data is restored to the greatest extent and attack simulation is performed. The application evaluation results of the management sub-strategies that focus on the management process are evaluated based on the simulation results, thereby improving the accurate assessment of the security management strategy of the data and improving the security management effect of data assets.

[0042] In some embodiments of the present application, whether to modify the management sub-policy is determined according to the application evaluation result, and if so, generating a security management policy according to the modified management sub-policy includes: Pre-set application evaluation value thresholds; If the second application evaluation value is less than the application evaluation value threshold, the management sub-policy of the corresponding management process is modified, the management sub-policy of the corresponding management process is replaced according to the modified management sub-policy, and a security management policy for the corresponding data is generated; If the second application evaluation value is greater than the application evaluation value threshold, the management sub-policy of the corresponding focus management process is not modified.

[0043] In some embodiments of the present application, a data security management model is constructed according to the sensitivity of each data and the corresponding security management policy, including: According to the sensitivity of each data as training input data, the management sub-strategy of each management process in the security management strategy corresponding to each data is used as training output data, and neural network training is performed to obtain a data security management model; Wherein, the data security management model includes multiple management sub-models.

[0044] In some embodiments of the present application, Figure 2 As shown, a data security management method based on multi-level classification is also included: Step S201: Identify and inventory all data, classify them according to the inventory results to obtain a first data set, and perform hierarchical processing on the data in each first data set to obtain a second data set of multiple levels; Step S202: setting the sensitivity of each data in the second data set, and formulating a security management strategy for the corresponding data according to the sensitivity, wherein the security management strategy includes management sub-strategies of multiple management processes; Step S203: pre-set attack behaviors, perform application evaluation on the management sub-strategies of corresponding data based on the attack behaviors, determine whether to modify the management sub-strategies according to the application evaluation results, and if so, generate a security management strategy based on the modified management sub-strategies, and build a data security management model based on the sensitivity of each data and the corresponding security management strategy.

[0045] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and substitutions can be made without departing from the technical principles of the present application. These improvements and substitutions should also be regarded as the scope of protection of the present application.

Claims

1. A data security management system based on multi-level classification, characterized in that: include: A grading module is used to identify and count all data, classify them according to the count results to obtain a first data set, and grade the data in each first data set to obtain a second data set of multiple levels; A management module, used to set the sensitivity of each data in the second data set, and formulate a security management strategy for the corresponding data according to the sensitivity, wherein the security management strategy includes management sub-strategies of multiple management processes; A construction module is used to pre-set attack behaviors, conduct application evaluation on the management sub-strategies of the corresponding data based on the attack behaviors, and determine whether to revise the management sub-strategies based on the application evaluation results. If so, a security management strategy is generated based on the revised management sub-strategies. A data security management model is constructed based on the sensitivity of each data and the corresponding security management strategy.

2. The data security management system based on multi-level classification as claimed in claim 1, characterized in that: The data in each first data subset is processed hierarchically to obtain a second data set of multiple levels, including: Identify and inventory all data, classify the data according to the data source, data purpose and data type in the inventory result, obtain multiple first data sets, and calculate the set coefficient of each first data set; Obtaining a historical abnormality log of each data in each first data set, extracting a historical evaluation factor in each historical abnormality log, and generating a data quality evaluation value of the data in the corresponding historical abnormality log according to a plurality of historical evaluation factors; Obtaining a first impact degree of a data quality evaluation value of each data in different historical abnormal logs on a plurality of preset indicators of corresponding business purposes, and calculating a first comprehensive impact degree, wherein the preset indicators include economic indicators, operation indicators, efficiency indicators, and safety indicators; Generate a first important coefficient of the corresponding data according to different data quality evaluation values ​​of each data and the corresponding first comprehensive impact degree; Obtaining a second influence degree of different data quality evaluation values ​​of each data on multiple historical evaluation factors of other data in the same first data set and a third influence degree of different data quality evaluation values ​​on multiple historical evaluation factors of other data in different first data sets, and calculating a second comprehensive influence degree and a third comprehensive influence degree; generating a first correlation coefficient according to a second comprehensive influence degree of different data quality evaluation values ​​of each data on other data in the same first data set; generating a second correlation coefficient according to a third comprehensive influence degree of different data quality evaluation values ​​of each data on other data in different first data sets; If the first correlation coefficient is greater than the preset first correlation coefficient threshold, it is determined that there is a correlation relationship, and the first correlation coefficient difference between the first correlation coefficient and the preset first correlation coefficient threshold is calculated, and the second important coefficient of the corresponding data is generated according to the number of data that have a correlation relationship with the same first data set and the corresponding first correlation coefficient difference; If the second correlation coefficient is greater than the preset second correlation coefficient threshold, it is determined that there is a correlation relationship, and the second correlation coefficient difference between the second correlation coefficient and the preset second correlation coefficient threshold is calculated, and the third important coefficient of the corresponding data is generated according to the number of data having a correlation relationship between each data and different first data sets, the second correlation coefficient difference and the set coefficient of the corresponding first data set; Generate a fourth important coefficient of the corresponding data according to the first important coefficient, the second important coefficient and the third important coefficient of each data; The data are graded according to the fourth important coefficient of each data in the same first data set to obtain second data sets of different levels.

3. The data security management system based on multi-level classification as claimed in claim 2, characterized in that: Generating a fourth important coefficient of corresponding data according to the first important coefficient, the second important coefficient and the third important coefficient of each data includes: Determine, according to the plurality of data quality evaluation values ​​and the corresponding first comprehensive influence degrees, the degree of change of the first comprehensive influence degree as the data quality evaluation value changes, and match the first important coefficient of the corresponding data based on the change degree-importance coefficient mapping table and the corresponding change degree; The calculation formula of the fourth important coefficient is: ； Among them, Q is the fourth important coefficient, b1 is the weight coefficient of the first important coefficient, q1 is the first important coefficient, b2 is the weight coefficient of the second important coefficient, g1 is the first important conversion coefficient, w1 is the number of data that are associated with the current data in the same first data set, w2 is the total number of data in the same first data set as the current data, is the z1th first correlation coefficient difference, b3 is the weight coefficient of the third important coefficient, g2 is the second important conversion coefficient, is the number of data associated with the jth different first data set of the current data, is the total number of data in the jth different first data set from the current data, hj is the set coefficient of the jth different first data set, is the z2th second correlation coefficient difference in the jth different first data set, j=1, 2…, k, k is the total number of different third data sets.

4. The data security management system based on multi-level classification as claimed in claim 3, characterized in that: Setting the sensitivity of each data in the second data set includes: Generate a comprehensive significance coefficient of the corresponding data according to the fourth significance coefficient of each data in each second data set and the set coefficient of the corresponding first data set; According to the relationship between the comprehensive importance coefficient of each data and the preset importance coefficient range, the sensitivity of the corresponding data is set; Presetting a first preset important coefficient interval, a second preset important coefficient interval, a third preset important coefficient interval and a fourth preset important coefficient interval; When the comprehensive importance coefficient of each data is within the first preset importance coefficient interval, the sensitivity of the corresponding data is set to the first preset sensitivity; When the comprehensive importance coefficient of each data is within the second preset importance coefficient interval, the sensitivity of the corresponding data is set to the second preset sensitivity; When the comprehensive importance coefficient of each data is within the third preset importance coefficient interval, the sensitivity of the corresponding data is set to the third preset sensitivity; When the comprehensive importance coefficient of each data is within the four preset importance coefficient intervals, the sensitivity of the corresponding data is set to the fourth preset sensitivity.

5. The data security management system based on multi-level classification as claimed in claim 4, characterized in that: Develop security management strategies for corresponding data based on sensitivity, including: Calculating the sensitivity difference between different data, and constructing a third data set based on the data whose sensitivity difference is less than a preset difference threshold; Comprehensively analyzing the data in the same third data set to obtain historical abnormality characteristics of each data, wherein the historical abnormality characteristics include the number of abnormalities, the abnormality frequency, and the abnormality degree; Generate a historical application evaluation value of the historical security management policy of the corresponding data according to the historical abnormal characteristics of each data, and set the historical security management policy whose historical application evaluation value is greater than a preset application evaluation value threshold as the pending security management policy corresponding to the data in the third data set; Pre-set multiple management processes, including desensitization process, encryption process, authorization process, and backup process; Dividing each pending security management policy of the same third data set into pending management sub-policies of multiple management processes, and coordinating and optimizing the multiple pending management sub-policies of the same management process to obtain management sub-policies corresponding to the management process; Constructing a security management policy corresponding to each data in the third data set according to the management sub-policy of the entire management process; A security management policy for each data in each third data set is generated in sequence.

6. The data security management system based on multi-level classification as claimed in claim 5, characterized in that: Pre-set attack behaviors, including: Obtaining a historical attack log of each data in each second data set, and extracting historical abnormal data of the corresponding data in each historical attack log, matching the historical abnormal data in a preset attack simulation reference library of the corresponding data to obtain a corresponding preset attack feature, wherein the preset attack feature includes an attack point, an attack type, an attack intensity, and an attack frequency; Generate attack behaviors for corresponding data based on historical abnormal data of each data and corresponding preset attack features; The correlation degree between each attack behavior and each management process in the security management policy of the corresponding data is calculated, and the management process with a correlation degree greater than a preset correlation degree threshold is set as the concerned management process of the corresponding attack behavior.

7. The data security management system based on multi-level classification as claimed in claim 6, characterized in that: Based on the attack behavior, the management sub-strategies of the corresponding data are evaluated, including: Build a simulation application environment for each data; Perform attack simulation on the simulation application environment of each data according to the preset attack behavior, obtain the simulation log of the attack simulation process of each attack behavior, capture and analyze the simulation change values ​​of multiple evaluation factors of the corresponding data according to the simulation log, and generate the simulation change coefficient of the corresponding evaluation factor according to the simulation change value; Performing application evaluation on the management sub-strategy of the attention management process of the corresponding attack behavior according to the simulation variation coefficients of the multiple evaluation factors, and obtaining a first application evaluation value of the management sub-strategy of the corresponding attention management process; The calculation formula of the first application evaluation value is: ； Among them, Y1 is the first application evaluation value, y0 is the first application evaluation conversion coefficient, n is the total number of evaluation factors, fi is the simulation change coefficient of the i-th evaluation factor, and ai is the weight coefficient of the i-th evaluation factor; Generate a first application evaluation value of the management process concerned with each attack behavior in turn; Generating a second application evaluation value of a management sub-strategy corresponding to the management process of interest according to a plurality of first application evaluation values ​​of the same management process of interest; The calculation formula of the second application evaluation value is: ； Among them, Y2 is the second application evaluation value, m is the total number of attack behaviors associated with the current management process, Y1s is the first application evaluation value of the management process after the sth attack behavior, and ds is the sth weight coefficient.

8. The data security management system based on multi-level classification as claimed in claim 7, characterized in that: Determine whether to modify the management sub-strategy based on the application evaluation results. If so, generate a security management strategy based on the modified management sub-strategy, including: Pre-set application evaluation value threshold; If the second application evaluation value is less than the application evaluation value threshold, the management sub-policy of the corresponding management process is modified, the management sub-policy of the corresponding management process is replaced according to the modified management sub-policy, and a security management policy for the corresponding data is generated; If the second application evaluation value is greater than the application evaluation value threshold, the management sub-policy of the corresponding focus management process is not modified.

9. The data security management system based on multi-level classification as claimed in claim 8, characterized in that: Build a data security management model based on the sensitivity of each data and the corresponding security management strategy, including: According to the sensitivity of each data as training input data, the management sub-strategy of each management process in the security management strategy corresponding to each data is used as training output data, and neural network training is performed to obtain a data security management model; Wherein, the data security management model includes multiple management sub-models.

10. A data security management method based on multi-level classification, characterized in that: include: Identify and inventory all data, classify them according to the inventory results to obtain a first data set, and perform hierarchical processing on the data in each first data set to obtain a second data set of multiple levels; Setting the sensitivity of each data in the second data set, and formulating a security management strategy for the corresponding data according to the sensitivity, wherein the security management strategy includes management sub-strategies of multiple management processes; Pre-set attack behaviors, and perform application evaluation on the management sub-strategies of corresponding data based on the attack behaviors. Determine whether to modify the management sub-strategies based on the application evaluation results. If so, generate a security management strategy based on the modified management sub-strategies, and build a data security management model based on the sensitivity of each data and the corresponding security management strategy.

Images