Security risk analysis early warning method for multi-source data processing

Abstract

The invention relates to the technical field of data security monitoring, and provides a multi-source data processing security risk analysis early warning method, which comprises the following steps: acquiring multi-source data, and constructing an ecological environment data system; wherein different ecological environment data in the ecological environment data system are configured with unique calling permissions according to asset levels; constructing a risk analysis model based on an application scene, inputting the activity data in the ecological environment data system into the risk analysis model, and determining whether target activity data of data threat exists or not; and inputting the target activity data into a preset safety risk early warning model to generate an early warning signal. The method is used for multiple links of collection, processing, analysis, early warning and the like of ecological environment data, the ecological environment network condition is evaluated, and factors and events possibly causing damage or threat to the environment network are found, analyzed and prevented.

Description

Technical Field

[0001] The present invention relates to the field of network security monitoring, and in particular to a security risk analysis and early warning method for multi-source data processing. Background Art

[0002] Data security risk analysis and early warning is based on compliance and risk management perspectives. It evaluates the possible security risks of data processing activities involving important or critical data in business information flows, as well as sharing, trading, entrusted processing and other activities, and warns of possible data security risks.

[0003] The existing data security risk analysis and early warning in the ecological environment field adopts the traditional approach of targeting general data and data processing activities. It focuses on security risks that may affect the confidentiality and integrity of general data. The main technical means to achieve data security risk analysis and early warning are as follows: Sensitivity analysis: The process of identifying sensitive or important data from a large amount of data, classifying and evaluating it. Its purpose is to ensure that such sensitive data is properly protected and managed to prevent data leakage, abuse or illegal access.

[0004] Threat analysis: The process of identifying, classifying and evaluating various factors that may endanger data security. Its purpose is to fully understand the data security threats faced by the organization so that appropriate protective measures can be taken to ensure data security.

[0005] Vulnerability analysis: Conduct a comprehensive security review of systems and applications, and discover security holes and weaknesses through vulnerability scanning and penetration testing. The purpose is to identify and fix these holes in a timely manner to prevent attackers from using them to conduct illegal access, data theft, system damage and other malicious activities.

[0006] Compliance Assessments: Ensuring that your organization’s data processing activities comply with applicable regulations, laws, and industry standards.

[0007] The existing data security risk analysis and early warning methods have certain shortcomings in practical applications in the field of ecological environment, which may limit their effectiveness and accuracy. The following is a detailed summary of these shortcomings: 1. Insufficient data utilization and limitations of single indicator warning: Existing early warning methods are mostly based on single indicator early warnings based on causal relationship models among hazard state parameters, accident hazards, and safety risks.

[0008] This method does not fully consider the correlation between various risk factors in the massive data in the ecological environment, resulting in insufficient data utilization.

[0009] 2. The language of the text report is not standardized: The text reports in the field of production safety are not standardized in terms of language expression and have inconsistent data structures. They cannot be directly applied to database safety risk analysis and early warning scenarios in the field of ecological environment; This results in the inability of existing text mining tools and methods to accurately identify professional vocabulary for safe production in the field of ecological environment, and to effectively extract and analyze key information.

[0010] 3. The disconnect between early warning and risk management theory, and the lack of depth in early warning results: The application of data mining and text mining methods has not been closely integrated with the safety risk management theory in the ecological environment field.

[0011] This results in the analysis results being mostly simple descriptions of production safety conditions, with limited auxiliary role in risk identification, evaluation and early warning, and an inability to take timely and accurate response measures when data security risks occur.

[0012] 4. Limitations of Big Data Processing Technology: Existing big data analysis and processing technologies are not suitable for the characteristics of safety production data in the ecological environment field, especially when processing massive and heterogeneous data.

[0013] This may result in the inability to fully utilize all relevant data during the data security risk analysis and early warning process, thus affecting the accuracy and comprehensiveness of the early warning results. Summary of the invention

[0014] The present invention proposes a security risk analysis and early warning method for multi-source data processing, which is used to solve the problems of insufficient data utilization in network security, the limitation of single indicator early warning, non-standard text report language expression, disconnection between early warning and risk management theory, lack of depth in early warning results and limitations of big data processing technology.

[0015] The present invention proposes a security risk analysis and early warning method for multi-source data processing, comprising: Acquire multi-source data and build an ecological environment data system; different ecological environment data in the ecological environment data system are configured with unique calling permissions according to asset levels; Construct a risk analysis model based on application scenarios, and input the activity data in the ecological environment data system into the risk analysis model to determine whether there is target activity data with data threats; Input the target activity data into the preset safety risk warning model to generate a warning signal.

[0016] Preferably, before acquiring multi-source data, the step further includes: Determine the data life cycle of ecological and environmental data, and divide data application scenarios based on the life cycle; Determine the business information flow based on the data application scenario; each business information flow belongs to the data asset of the corresponding data application scenario; Evaluate and divide data assets and generate a data asset list; the data asset list includes key data and a data asset list.

[0017] Preferably, generating a data asset list further includes: Preset key data assignment mechanism; After data assets are divided, different data assets are assigned values ​​to determine data levels; Among them, data asset assignment includes a first assignment method and a second assignment method based on data application scenarios; The first assignment method is to assign external control based on business processes and data activities, and the second assignment method is to assign internal control based on data storage, data processing, data analysis and data management.

[0018] Preferably, the construction of the ecological environment data system includes: Preset to build an initial convolutional neural network model based on the ecological environment business process; Construct an ecological business logic mapping model using multi-source data in the form of a multi-dimensional matrix; The business logic mapping model and the initial convolutional neural network model are integrated, and at least one ecological environment characteristic among the data entities, data attributes and data structures of the ecological environment data is learned to generate an ecological environment data recognition model; According to the ecological environment data recognition model, determine the multimodal classification data of the ecological environment, and determine the first data system under different modes; Integrate the first data system under different modes into multiple systems in terms of business commonality, ecological environment data points and data characteristics to form an ecological environment data system; Among them, in the process of multi-system integration, ecological and environmental data of different modes are transformed into ecological integration areas based on ecological business logic mapping based on permutations and combinations.

[0019] Preferably, the construction of a risk analysis model based on an application scenario includes: According to the application scenarios, determine the training samples of different application scenarios and generate a training sample set; Extract sample features from the training sample set, determine scene features, and align related features of different scenes; Pre-configuring a multimodal analysis model, introducing scenario features into the multimodal analysis model, and forming a risk analysis model; wherein the multimodal analysis model includes a first analysis layer and a second analysis layer; The first analysis layer is configured with a hybrid weighted analysis network for outputting threat presence data; The second analysis layer is configured with a gated discrete network to monitor threat data and output threat attributes.

[0020] Preferably, the threat attributes include attack motivation, attack capability, threat occurrence frequency and threat occurrence probability; The threat attributes are determined based on the gated discrete network to conduct threat assessment on the business flow information of ecological data in the application scenario; among them, threat assessment includes data confidentiality assessment, data integrity assessment, data availability assessment and data controllability assessment.

[0021] Preferably, the construction of a risk analysis model based on an application scenario further includes: A first intelligent algorithm based on intelligent monitoring of activity data is configured; wherein the first intelligent algorithm is used to identify first activity information within the monitoring range, and the first activity information includes newly added activity information and expanded activity information; Configure a second intelligent algorithm based on ecological environment space data transmission monitoring; wherein, the second intelligent algorithm is used to determine risk data and change and construct a data threat identification table.

[0022] Preferably, the risk analysis model is also used for: Build a correlation network between data threats and data vulnerabilities, and determine the probability of security incidents through a data threat identification table; Based on the probability of security incidents, risk assessment is performed on threat data that exceeds the preset probability on the data threat identification table to determine the risk level.

[0023] Preferably, the security risk warning model is used to determine the security risk warning level, comprising the following steps: According to the target activity data, risk data matching is performed to obtain risk matching results; Among them, the risk matching results include mutual trust authentication based on the source, generating a trust factor; The risk analysis behavior database, risk matching results and trust factors are sent to the trusted third party, and an additional database with encrypted data is established at the trusted third party. The additional database is built based on the risk data matching results and trust factors, and the abnormal behavior warning model is established with the additional database and account behavior database and then synchronized to the inspection and warning system to determine the security risk assessment results.

[0024] Preferably, the risk assessment results are released to relevant departments and the public by letter, email, APP push, etc. to generate an early warning signal.

[0025] The beneficial effects of the present invention are: The present invention integrates data from multiple sources such as satellite remote sensing, ground monitoring stations, IoT sensor networks, social media and the Internet to build a comprehensive ecological environment data system. Through data cleaning and standardization, the accuracy and consistency of the data are ensured.

[0026] Ecological and environmental data threat identification adopts intelligent identification and artificial intelligence and machine learning technologies. Intelligent identification: For example, intelligent monitoring of important ecological and environmental activity data, through the built-in intelligent model algorithm, automatically identifies the new or expanded ecological and environmental data activity information within the monitoring scope, and provides support for the analysis and judgment of data destruction issues; artificial intelligence and machine learning: using artificial intelligence and machine learning technologies to discover important ecological and environmental spatial data transmission activities, automatically identify and analyze changes in ecological and environmental data transmission, and promptly discover data security risk issues.

[0027] During the identification process, various data about the ecological environment system are collected, including species composition, longitude and latitude, ecological functions, ecosystem services and environmental conditions, to construct an ecosystem vulnerability assessment model to assess the vulnerability of the ecosystem.

[0028] Vulnerability identification is mainly carried out from three aspects: data carrier, data security technology capability, and data security management system. Data carrier vulnerability identification mainly uses the output of technical test results such as baseline configuration verification, penetration testing, and leak scanning as the basis; data security technology capability and data security management system are mainly based on interview forms to inquire relevant personnel to see whether they meet various requirements. Finally, the inspection results of the three aspects are summarized. The security technology test results of carrier vulnerability identification need to be summarized according to the categories summarized in the data vulnerability identification table - data carrier.

[0029] After completing the identification of data assets, data application scenarios, data threats, vulnerabilities, and confirmation of existing security measures, appropriate methods and tools based on the ecological environment field are used to determine the possibility of ecological environment data threats exploiting vulnerabilities to cause security incidents, as well as the impact of security incidents on the organization, to obtain security risks.

[0030] Based on risk identification and analysis data and machine learning algorithms, an ecological environment data security risk early warning model is established. According to the security risks that data may face in existing data flow scenarios in the ecological environment field, corresponding early warning signals are given.

[0031] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures particularly pointed out in the written description and the accompanying drawings.

[0032] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings: Figure 1 A method flow chart of a security risk analysis and early warning method for multi-source data processing in an embodiment of the present invention; Figure 2 A system function visualization diagram of a security risk analysis and early warning method for multi-source data processing in an embodiment of the present invention; Figure 3 It is an asset risk assessment system in an embodiment of the present invention. DETAILED DESCRIPTION

[0034] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0035] Based on the original information security risk analysis and early warning theory, this ecological environment data security risk analysis and early warning method pays more attention to the security of data assets themselves, and presents the characteristics of focusing on data assets and emphasizing data application scenarios.

[0036] Data application scenarios are closely related to the data life cycle, which may include data collection or data generation, transmission, storage, data retrieval, transmission, processing, sharing and other processing activities, but a certain application scenario may not include all life cycles. Each data asset corresponds to multiple data application scenarios, and each application scenario also has multiple business links, which we call business information flows, and there are potential security risks and compliance risks behind them.

[0037] like Figure 1 As shown, this embodiment provides a security risk analysis and early warning method for multi-source data processing, including: Acquire multi-source data and build an ecological environment data system; different ecological environment data in the ecological environment data system are configured with unique calling permissions according to asset levels; Construct a risk analysis model based on application scenarios, and input the activity data in the ecological environment data system into the risk analysis model to determine whether there is target activity data with data threats; Input the target activity data into the preset safety risk warning model to generate a warning signal.

[0038] The principle of the above technical solution is: In the actual implementation process, the present invention integrates multi-source data from satellite remote sensing, ground monitoring stations, IoT sensor networks, social media and the Internet to build a comprehensive ecological environment data system. Through data cleaning and standardization, the accuracy and consistency of the data are ensured. Based on the data survey results and in accordance with the key data principle, the assessor can choose whether to assess data assets of medium or low importance according to actual needs.

[0039] According to the ecological environment data system, after determining the data objects to be evaluated, identify the various application scenarios involved for each type of data object to be evaluated. In this process, various data on the ecological environment system are collected, including species composition, longitude and latitude, ecological functions, ecosystem services, and environmental conditions, to build an ecosystem vulnerability assessment model to assess the vulnerability of the ecosystem.

[0040] After completing the identification of data assets, data application scenarios, data threats, vulnerabilities, and confirmation of existing security measures, appropriate methods and tools based on the ecological environment field are used to determine the possibility of ecological environment data threats exploiting vulnerabilities to cause security incidents, as well as the impact of security incidents on the organization, to obtain security risks.

[0041] Based on the basic elements and attributes of data security risks obtained in the above risk identification process as input, the risk value is obtained through the risk calculation process, and a description of how to evaluate the risk calculation results is given, and a risk assessment report document is output. To improve the efficiency of data security risk assessment work and the accuracy of the results, risk assessment work should be assisted by intelligent risk assessment tools.

[0042] The beneficial effects of the above technical solution are: The present invention integrates data from multiple sources such as satellite remote sensing, ground monitoring stations, IoT sensor networks, social media and the Internet to build a comprehensive ecological environment data system. Through data cleaning and standardization, the accuracy and consistency of the data are ensured.

[0043] Ecological and environmental data threat identification adopts intelligent identification and artificial intelligence and machine learning technologies. Intelligent identification: For example, intelligent monitoring of important ecological and environmental activity data, through the built-in intelligent model algorithm, automatically identifies the new or expanded ecological and environmental data activity information within the monitoring scope, and provides support for the analysis and judgment of data destruction issues; artificial intelligence and machine learning: using artificial intelligence and machine learning technologies to discover important ecological and environmental spatial data transmission activities, automatically identify and analyze changes in ecological and environmental data transmission, and promptly discover data security risk issues.

[0044] During the identification process, various data about the ecological environment system are collected, including species composition, longitude and latitude, ecological functions, ecosystem services and environmental conditions, to construct an ecosystem vulnerability assessment model to assess the vulnerability of the ecosystem.

[0045] Vulnerability identification is mainly carried out from three aspects: data carrier, data security technology capability, and data security management system. Data carrier vulnerability identification mainly uses the output of technical test results such as baseline configuration verification, penetration testing, and leak scanning as the basis; data security technology capability and data security management system are mainly based on interview forms to inquire relevant personnel to see whether they meet various requirements. Finally, the inspection results of the three aspects are summarized. The security technology test results of carrier vulnerability identification need to be summarized according to the categories summarized in the data vulnerability identification table - data carrier.

[0046] After completing the identification of data assets, data application scenarios, data threats, vulnerabilities, and confirmation of existing security measures, appropriate methods and tools based on the ecological environment field are used to determine the possibility of ecological environment data threats exploiting vulnerabilities to cause security incidents, as well as the impact of security incidents on the organization, to obtain security risks.

[0047] Based on risk identification and analysis data and machine learning algorithms, an ecological environment data security risk early warning model is established. According to the security risks that data may face in existing data flow scenarios in the ecological environment field, corresponding early warning signals are given.

[0048] As an embodiment of the present invention, before acquiring multi-source data, the following steps are further included: Determine the data life cycle of ecological and environmental data, and divide data application scenarios based on the life cycle; Determine the business information flow based on the data application scenario; each business information flow belongs to the data asset of the corresponding data application scenario; Evaluate and divide data assets and generate a data asset list; the data asset list includes key data and a data asset list.

[0049] The principle of the above technical solution is: In the actual implementation process, based on the scope of the assessment, when the relevant business or department establishes a list of key data assets, data research is carried out through the following methods: Identify the business logic, business functions, business process steps, etc. of the ecological environment, determine the life cycle of the data, and determine the data application scenarios. Identify the information systems related to each business function of the ecological environment. Investigate what business data the ecological environment information system collects, stores, and uses, and abstract it into a data asset name and category that can be understood by people, and supplement the location of the data, data volume, storage method (information system, terminal, document server), etc. Assign values ​​and levels to the ecological environment data assets, confirm which data should be focused on, and integrate the correspondence between data assets and information systems (1 to n), so as to realize the collection of data asset lists.

[0050] As an embodiment of the present invention: the generating of the data asset list further includes: Preset key data assignment mechanism; After data assets are divided, different data assets are assigned values ​​to determine data levels; Among them, data asset assignment includes a first assignment method and a second assignment method based on data application scenarios; The first assignment method is to assign external control based on business processes and data activities, and the second assignment method is to assign internal control based on data storage, data processing, data analysis and data management.

[0051] The principle of the above technical solution is: During the actual implementation process, key data need to be assigned values, and ecological environmental data assets need to be assigned values ​​and grades.

[0052] Assignment of external control, including: business process or use process of important data (focus on: sharing, transaction, entrusted processing, cross-border provision); related data activities: data extraction, data acquisition, data integration, data analysis, data storage, data download, data outbound, result display...; related participants: personnel: internal and external role classification: external users (users, customers, partners, project partners, suppliers, service providers...), internal users (sales, marketing, management personnel, IT service personnel...) data role classification: business (data) demanders, data analysts, business department personnel, third-party service personnel, IT service personnel...; Assignment of internal control includes: data storage system (database server, file server, cloud platform, employee storage terminal...); data processing and use system (business system, business background, mobile application terminal, employee office terminal...); data analysis system (big data analysis system, macro decision-making analysis system...); management system (unified identity authentication platform, data authority platform, middle-layer platform, VPN management system...) internal and external interfaces: the above-mentioned internal and external system interfaces, external system interfaces, external process interfaces (unified account management process, unified data authority management process...).

[0053] As an embodiment of the present invention: constructing an ecological environment data system includes: Preset to build an initial convolutional neural network model based on the ecological environment business process; Construct an ecological business logic mapping model using multi-source data in the form of a multi-dimensional matrix; The business logic mapping model and the initial convolutional neural network model are integrated, and at least one ecological environment characteristic among the data entities, data attributes and data structures of the ecological environment data is learned to generate an ecological environment data recognition model; According to the ecological environment data recognition model, determine the multimodal classification data of the ecological environment, and determine the first data system under different modes; Integrate the first data system under different modes into multiple systems in terms of business commonality, ecological environment data points and data characteristics to form an ecological environment data system; Among them, in the process of multi-system integration, ecological and environmental data of different modes are transformed into ecological integration areas based on ecological business logic mapping based on permutations and combinations.

[0054] The principle of the above technical solution is: In the actual implementation process, the construction of the ecological environment data system will be based on the neural network model, the team member data will be statistically analyzed in the form of a multi-dimensional matrix, and then processed through feature learning to construct a data system.

[0055] As an embodiment of the present invention: the construction of a risk analysis model based on an application scenario includes: According to the application scenarios, determine the training samples of different application scenarios and generate a training sample set; Extract sample features from the training sample set, determine scene features, and align related features of different scenes; Pre-configuring a multimodal analysis model, introducing scenario features into the multimodal analysis model, and forming a risk analysis model; wherein the multimodal analysis model includes a first analysis layer and a second analysis layer; The first analysis layer is configured with a hybrid weighted analysis network for outputting threat presence data; The second analysis layer is configured with a gated discrete network to monitor threat data and output threat attributes.

[0056] The principle of the above technical solution is: In the specific implementation process, first, for different application scenarios, we screened and sorted a large number of actual cases to form a representative set of training samples. The key to this step is to ensure that the training samples can fully reflect the characteristics and potential risk factors of each scenario. By analyzing these samples, we can extract scenario features and provide basic data for subsequent risk analysis.

[0057] Secondly, in the process of extracting sample features, advanced data processing technology is used to identify and extract sample features in the training sample set. These features include but are not limited to numerical, categorical, and time series. By determining the scene features, the associated features of different scenes are aligned to ensure that the model can accurately identify and assess the risks in each scene; Next, we pre-configure a multimodal analysis model. This model introduces scenario features to form a targeted risk analysis model. The multimodal analysis model is divided into two layers: the first analysis layer and the second analysis layer.

[0058] At the first analysis layer, we configured a hybrid weighted analysis network. The function of this network is to perform weighted processing on the input sample data, thereby improving the model's ability to identify threat data. Through hybrid weighted analysis, the network can output data with threats, providing a basis for subsequent monitoring.

[0059] The second analysis layer is equipped with a gated discrete network, which is mainly responsible for monitoring the threat data output by the first analysis layer. The gated discrete network learns the characteristics of threat data to accurately identify and classify threat attributes. In this process, the network can output threat attributes, providing strong support for risk prevention and response.

[0060] In summary, this risk analysis model extracts features from training samples of different application scenarios and aligns related features to construct a multimodal analysis model to identify and monitor threat data, thereby providing effective risk analysis and early warning for various application scenarios. This model has high flexibility and adaptability, can be widely used in various complex scenarios, and provides strong technical support for my country's risk management and security prevention.

[0061] As an embodiment of the present invention: the threat attributes include attack motivation, attack capability, threat occurrence frequency and threat occurrence probability; The threat attributes are determined based on the gated discrete network to conduct threat assessment on the business flow information of ecological data in the application scenario; among them, threat assessment includes data confidentiality assessment, data integrity assessment, data availability assessment and data controllability assessment.

[0062] The principle of the above technical solution is: Threats are potential factors that may cause damage to assets and exist objectively. For data assets, data threats refer to potential causes of security incidents that may endanger data confidentiality, integrity, availability, and controllability. Data threat identification mainly analyzes the types of threats that may affect data confidentiality, integrity, availability, and controllability in the flow of data in various business information flows in application scenarios, and further analyzes their attributes, including attack motivations, attack capabilities, and the frequency of threat occurrence, and assigns values ​​to their attributes.

[0063] As an embodiment of the present invention: the construction of a risk analysis model based on an application scenario further includes: A first intelligent algorithm based on intelligent monitoring of activity data is configured; wherein the first intelligent algorithm is used to identify first activity information within the monitoring range, and the first activity information includes newly added activity information and expanded activity information; Configure a second intelligent algorithm based on ecological environment space data transmission monitoring; wherein, the second intelligent algorithm is used to determine risk data and change and construct a data threat identification table.

[0064] The principle of the above technical solution is: In the actual implementation process, the ecological environment data threat identification adopts intelligent identification and artificial intelligence and machine learning technology. The first intelligent algorithm, namely intelligent identification: such as intelligent monitoring of important ecological environment activity data, through the built-in intelligent model algorithm, automatically identify the new or expanded ecological environment data activity information within the monitoring range, and provide support for the analysis and judgment of data destruction problems; the second intelligent algorithm, artificial intelligence and machine learning: using artificial intelligence and machine learning and other technologies, discover important ecological environment spatial data transmission activities, automatically identify and analyze changes in ecological environment data transmission, and promptly discover data security risk issues.

[0065] As an embodiment of the present invention: the risk analysis model is also used for: Build a correlation network between data threats and data vulnerabilities, and determine the probability of security incidents through a data threat identification table; Based on the probability of security incidents, risk assessment is performed on threat data that exceeds the preset probability on the data threat identification table to determine the risk level.

[0066] The principle of the above technical solution is: In the actual implementation process, during the identification process, various data about the ecological environment system are collected, including species composition, longitude and latitude, ecological functions, ecosystem services, and environmental conditions to construct an ecosystem vulnerability assessment model to assess the vulnerability of the ecosystem.

[0067] Based on the results of the data application scenario, analyze and determine the data vulnerabilities that exist in the data application scenario.

[0068] Vulnerability does not refer to the existence of data itself, but to the existence of data application scenarios. If it is not exploited by data threats, the vulnerability itself will not cause damage to data assets. If the information system involved in the data application scenario is sufficiently robust, the technical capabilities are perfect, and the management system is sound, data threats are unlikely to cause security incidents. On the contrary, if the threat does not have a vulnerability that can be exploited, it will not cause risks. Therefore, reducing the vulnerability of data application scenarios can effectively prevent or reduce the impact of threats.

[0069] Methods for identifying data vulnerabilities include vulnerability checks based on technical testing and interview surveys.

[0070] Vulnerability identification is mainly carried out from three aspects: data carrier, data security technology capability, and data security management system. Data carrier vulnerability identification mainly uses the output of technical test results such as baseline configuration verification, penetration testing, and leak scanning as the basis; data security technology capability and data security management system are mainly based on interview forms to inquire relevant personnel to see whether they meet various requirements. Finally, the inspection results of the three aspects are summarized. The security technology test results of carrier vulnerability identification need to be summarized according to the categories summarized in the data vulnerability identification table - data carrier.

[0071] As an embodiment of the present invention: the security risk warning model is used to determine the security risk warning level, including the following steps: According to the target activity data, risk data matching is performed to obtain risk matching results; Among them, the risk matching results include mutual trust authentication based on the source, generating a trust factor; The risk analysis behavior database, risk matching results and trust factors are sent to the trusted third party, and an additional database with encrypted data is established at the trusted third party. The additional database is built based on the risk data matching results and trust factors, and the abnormal behavior warning model is established with the additional database and account behavior database and then synchronized to the inspection and warning system to determine the security risk assessment results.

[0072] The principle of the above technical solution is: In actual implementation, the basic elements of data security risks and their attributes obtained in the risk identification process are used as input, the risk value is obtained through the risk calculation process, and a description of how to evaluate the risk calculation results is given, and a risk assessment report document is output.

[0073] In order to improve the efficiency and accuracy of data security risk assessment work, risk assessment work should be equipped with intelligent risk assessment tools to assist risk assessment work.

[0074] After completing the identification of data assets, data application scenarios, data threats, vulnerabilities, and confirmation of existing security measures, appropriate methods and tools based on the ecological environment field are used to determine the possibility of ecological environment data threats exploiting vulnerabilities to cause security incidents, as well as the impact of security incidents on the organization, to obtain security risks.

[0075] The main process of data security risk analysis is: determine the possibility of security incidents based on the relationship between data threats and vulnerability exploitation, combined with the possibility of data threats and the exploitability of vulnerabilities; determine the severity of the impact of security incidents based on the severity of the vulnerability impact and the importance of data; determine the risk of the assessed data assets in the application scenario based on the possibility of security incidents and the severity of the security incident impact; and determine the risks of data assets in data processing activities by comprehensively considering the risks of data assets in various application scenarios.

[0076] Analyze the possibility and impact of security incidents; determine the possibility of security incidents based on the relationship between data threats and vulnerability utilization, combining the possibility of data threats and the exploitability of vulnerabilities; determine the impact of security incidents based on the importance of vulnerability impact data; determine the risk of the assessed data assets in this application scenario based on the possibility of security incidents and the impact of security incidents.

[0077] For example, the following table: As an embodiment of the present invention: the risk assessment result is released to relevant departments and the public by letter, email, APP push, etc. to generate an early warning signal.

[0078] The principle of the above technical solution is: In the actual implementation process, an ecological environment data security risk warning model is established based on risk identification and analysis data and machine learning algorithms. According to the security risks that data may face in the existing data flow scenarios in the ecological environment field, corresponding warning signals are given. Once the ecological environment data is monitored to have security risks, warning information is immediately issued to relevant departments and the public through SMS, email, APP push, etc. The warning information should include key information such as risk type, scope of impact, possible consequences and response measures.

[0079] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A security risk analysis and early warning method for multi-source data processing, characterized in that: include: Acquire multi-source data and build an ecological environment data system; different ecological environment data in the ecological environment data system are configured with unique calling permissions according to asset levels; Construct a risk analysis model based on application scenarios, and input the activity data in the ecological environment data system into the risk analysis model to determine whether there is target activity data with data threats; Input the target activity data into the preset safety risk warning model to generate a warning signal.

2. A security risk analysis and early warning method for multi-source data processing as claimed in claim 1, characterized in that: The step of obtaining multi-source data also includes: Determine the data life cycle of ecological and environmental data, and divide data application scenarios based on the life cycle; Determine the business information flow based on the data application scenario; each business information flow belongs to the data asset of the corresponding data application scenario; Evaluate and divide data assets and generate a data asset list; wherein key data is marked in the data asset list to generate a data asset list.

3. A security risk analysis and early warning method for multi-source data processing as claimed in claim 2, characterized in that: The generating of the data asset list further includes: Preset key data assignment mechanism; After data assets are divided, different data assets are assigned values ​​to determine data levels; Among them, data asset assignment includes a first assignment method and a second assignment method based on data application scenarios; The first assignment method is to assign external control based on business processes and data activities, and the second assignment method is to assign internal control based on data storage, data processing, data analysis and data management.

4. The method for security risk analysis and early warning of multi-source data processing according to claim 1, characterized in that: The construction of the ecological environment data system includes: Preset to build an initial convolutional neural network model based on the ecological environment business process; Construct an ecological business logic mapping model using multi-source data in the form of a multi-dimensional matrix; The business logic mapping model and the initial convolutional neural network model are integrated, and at least one ecological environment characteristic among the data entities, data attributes and data structures of the ecological environment data is learned to generate an ecological environment data recognition model; According to the ecological environment data recognition model, determine the multimodal classification data of the ecological environment, and determine the first data system under different modes; Integrate the first data system under different modes into multiple systems in terms of business commonality, ecological environment data points and data characteristics to form an ecological environment data system; Among them, in the process of multi-system integration, ecological and environmental data of different modes are transformed into ecological integration areas based on ecological business logic mapping based on permutations and combinations.

5. The method for security risk analysis and early warning of multi-source data processing according to claim 1, characterized in that: The construction of a risk analysis model based on application scenarios includes: According to the application scenarios, determine the training samples of different application scenarios and generate a training sample set; Extract sample features from the training sample set, determine scene features, and align related features of different scenes; Pre-configuring a multimodal analysis model, introducing scenario features into the multimodal analysis model, and forming a risk analysis model; wherein the multimodal analysis model includes a first analysis layer and a second analysis layer; The first analysis layer is configured with a hybrid weighted analysis network for outputting threat presence data; The second analysis layer is configured with a gated discrete network to monitor threat data and output threat attributes.

6. A security risk analysis and early warning method for multi-source data processing as claimed in claim 5, characterized in that: The threat attributes include attack motivation, attack capability, threat occurrence frequency and threat occurrence probability; The threat attributes are determined based on the gated discrete network to conduct threat assessment on the business flow information of ecological data in the application scenario; among them, threat assessment includes data confidentiality assessment, data integrity assessment, data availability assessment and data controllability assessment.

7. The method for security risk analysis and early warning of multi-source data processing according to claim 1, characterized in that: The construction of the risk analysis model based on the application scenario also includes: A first intelligent algorithm based on intelligent monitoring of activity data is configured; wherein the first intelligent algorithm is used to identify first activity information within the monitoring range, and the first activity information includes newly added activity information and expanded activity information; Configure a second intelligent algorithm based on ecological environment space data transmission monitoring; wherein, the second intelligent algorithm is used to determine risk data and change and construct a data threat identification table.

8. A security risk analysis and early warning method for multi-source data processing as claimed in claim 7, characterized in that: The risk analysis model is also used to: Build a correlation network between data threats and data vulnerabilities, and determine the probability of security incidents through a data threat identification table; Based on the probability of security incidents, risk assessment is performed on threat data that exceeds the preset probability on the data threat identification table to determine the risk level.

9. The method for security risk analysis and early warning of multi-source data processing according to claim 1, characterized in that: The security risk warning model is used to determine the security risk warning level, and includes the following steps: According to the target activity data, risk data matching is performed to obtain risk matching results; Among them, the risk matching results include mutual trust authentication based on the source, generating a trust factor; The risk analysis behavior database, risk matching results and trust factors are sent to the trusted third party, and an additional database with encrypted data is established at the trusted third party. The additional database is built based on the risk data matching results and trust factors, and the abnormal behavior warning model is established with the additional database and account behavior database and then synchronized to the inspection and warning system to determine the security risk assessment results.

10. A security risk analysis and early warning method for multi-source data processing as claimed in claim 9, characterized in that: The risk assessment results are released to relevant departments and the public via letters, emails, APP push, etc. to generate early warning signals.

Images