Data security risk assessment method based on big data analysis

Abstract

The invention discloses a data security risk assessment method based on big data analysis, and particularly relates to the technical field of data security, the processing method comprises the following steps: monitoring and collecting historical data of a target enterprise and related information before and after application of an association standard detailed rule model, a target enterprise data source is evaluated by constructing an enterprise data security risk degree evaluation model, the target enterprise data security risk degree is preliminarily judged, and an enterprise data association standard detailed rule model is constructed by a support vector machine algorithm according to an obtained enterprise data security risk degree evaluation index. The method comprises the following steps: matching the standard and the detailed rule number of an application, and finally constructing an influence evaluation model based on the matched standard and detailed rule number, evaluating the influence caused by the change of the standard and the detailed rule, and determining whether the standard and the detailed rule number need to be adjusted again when the content of the standard and the detailed rule is changed.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and more specifically, to a data security risk assessment method based on big data analysis. Background Art

[0002] With the rapid development of digitalization and informatization, enterprises and organizations are facing the challenge of managing and protecting massive amounts of data. With the diversification of data volume, data type and data transmission path, traditional data security protection methods can no longer meet emerging needs. Therefore, data security risk assessment methods based on big data analysis are not only necessary but also of great significance. Its role is specifically reflected in the following aspects: dynamic identification and prediction of potential risks, improving the accuracy and efficiency of security defense, comprehensiveness of data security assessment, adaptation to complex regulatory requirements and compliance reviews, automated risk management and decision support, and enhanced system and network adaptability.

[0003] Of course, the development of data security risk assessment methods based on big data analysis is not achieved overnight. From traditional static analysis tools to today's intelligent risk assessment platforms based on big data analysis and artificial intelligence technology, with the improvement of computing power and the maturity of big data technology, data security risk assessment methods based on big data analysis are gradually becoming intelligent and automated. At present, they have supported large-scale real-time data stream analysis and provided continuous security monitoring in highly dynamic and distributed IT environments. Representative platforms include: Splunk platform, which provides powerful data collection and analysis capabilities and is widely used in security information and event management; Darktrace platform, which uses artificial intelligence and machine learning algorithms, based on data stream behavior analysis, real-time monitoring of abnormal behavior in the network, and can automatically respond to potential security threats; and IBM QRadar platform, which integrates data security information and event management and big data analysis capabilities, can help enterprises achieve comprehensive data security risk assessment, and provide more intelligent threat detection and response through machine learning algorithms.

[0004] However, the existing data security risk assessment methods based on big data analysis still face many challenges such as high cost, complexity, false positives and omissions, and integration problems. Therefore, it is necessary to build a data security risk assessment method based on big data analysis so that enterprises can better cope with increasingly complex data security threats and compliance requirements, and enhance their proactive protection capabilities and overall competitiveness in data management. Summary of the invention

[0005] In order to overcome the above-mentioned defects of the prior art, an embodiment of the present invention provides a data security risk assessment method based on big data analysis, which evaluates the data source of the target enterprise by constructing an enterprise data security risk level assessment model, preliminarily judges the data security risk level of the target enterprise, and constructs an enterprise data association standard and rule model based on historical data and the acquired enterprise data security risk level assessment index using a support vector machine algorithm, matches the number of applied standards and rules, and finally constructs an impact assessment model based on the matched number of standards and rules, evaluates the impact of changes in standards and rules, and determines whether it is necessary to readjust the number of standards and rules when the content of the standards and rules changes.

[0006] To achieve the above object, the present invention provides the following technical solutions:

[0007] A data security risk assessment method based on big data analysis includes the following steps:

[0008] Step S1, monitoring and collecting historical data of the target enterprise and information on changes in compliance coverage, cost changes, and risk score changes before and after the application of the associated standard rules model;

[0009] Step S2, constructing an enterprise data security risk assessment model to preliminarily determine the target enterprise data security risk level;

[0010] Step S3, collecting historical data and enterprise data security risk assessment index to build an enterprise data association standard and rule model using a support vector machine algorithm, and matching the number of applied standards and rules;

[0011] Step S4, construct an impact assessment model to assess the impact of changes in standards and rules, and decide whether the number of standards and rules needs to be readjusted when the content of the standards and rules changes.

[0012] Specifically, in step S1, the enterprise data association standard specification model constructed by the support vector machine algorithm is used for data collection and processing software by ETL tools, data preprocessing and feature extraction software by MATLAB, and support vector machine modeling and training by Scikit-learn in the Python library. In actual use, due to factors such as equipment cost and complexity of real-time monitoring, the present invention is based on the continuous operation of the target enterprise and the relatively stable monitoring environment, and is carried out under the premise of continuously monitoring the target enterprise and changes in standards and specifications, which may lead to the phenomenon of rationality changes at a certain monitoring moment.

[0013] In step S2, by evaluating the target enterprise data source, the target enterprise data security risk level is preliminarily determined, thereby determining the number of standards and rules to be applied in the subsequent processing of the enterprise data. The specific process is to collect the target enterprise input structure information, data flow information and accident probability information, where the input structure information includes the manual and automatic comparison coefficient, calibrated as D sz , data flow information includes the data flow coefficient, denoted as S ld The accident probability information includes the accident probability coefficient, calibrated as G sf ;

[0014] Manual automatic contrast coefficient D sz The data input sensor detects the data input method and calibrates the amount of data manually input into the system as L s , get the text accuracy of manually input data, calibrated as Z s , and the amount of data automatically input into the system is calibrated as L z , get the text accuracy of the automatically input data, calibrated as Z z , then the manual and automatic contrast coefficient D sz =L s ×Z s ÷(L z ×Z z );

[0015] Data flow coefficient S ld The number of times the target company changes its data encryption method and type during data transmission is collected and marked as M. b , count the number of target company data leaks in the past year, denoted as X s , then the data flow coefficient S ld =M b ÷X s ;

[0016] Accident probability coefficient G sf The number of data mismatches that occurred in the past six months from the source websites, sensors, and base stations that collected data from the target company is marked as C. n , n is the number of different source websites, sensors, and base stations, n = 1, 2, 3, ..., m, m is a positive integer, data mismatch refers to the phenomenon in big data analysis that data segments are misclassified due to similar beginnings, which is common in classification algorithms or clustering algorithms based on feature similarity. The amount of data obtained by the target company from source websites, sensors, and base stations in the past six months is counted and calibrated as J n , then the accident probability coefficient

[0017] The enterprise data security risk assessment model is constructed by weighting the input structure information, data flow information and accident probability information to generate the enterprise data security risk assessment index QA pg The corresponding coefficients are manual and automatic contrast coefficients D sz , data flow coefficient S ld and the accident probability coefficient G sf , the formula is QA pg =a1×D sz +a2×S ld -a3×G sf ;

[0018] At the same time, a1, a2, and a3 are set according to actual conditions. For example, the expert empowerment method is adopted, that is, experts in related fields are invited to determine the weights of various indicators through professional opinion surveys and comprehensive evaluations to ensure that the weight coefficients can accurately reflect the importance of various indicators in the enterprise data security risk assessment. In addition, the use of multiple methods such as hierarchical analysis method and fuzzy comprehensive evaluation method to determine the weight coefficients can also be considered to ensure the objectivity and scientificity of the weight coefficients. I will not elaborate on this here.

[0019] In step S2, the enterprise data security risk assessment index obtained in the enterprise data security risk assessment model is used to reflect the security risk level of the target enterprise data in terms of its source. The larger its value is, the higher the proportion of automatically and correctly input data of the target company is, the safer the data flow process is, the smaller the probability of data mismatch problems, and the lower the target enterprise data security risk level is.

[0020] In step S2, when the enterprise data security risk assessment index QA pg When the value is greater than or equal to the set risk threshold, it indicates that the target enterprise data security risk level is low, and the number of standards and rules applied in the subsequent processing of enterprise data is reduced, the results are output, and the subsequent steps are carried out;

[0021] When enterprise data security risk assessment index QA pg When it is less than the set danger threshold, it indicates that the target enterprise data security risk level is high, and the number of standards and rules applied in the subsequent processing of enterprise data is increased, the results are output, and subsequent steps are carried out.

[0022] In step S3, a support vector machine algorithm is used to construct a standard and detailed model for enterprise data association, and historical data is collected as a factor for constructing the standard and detailed model for enterprise data association, so as to avoid the waste of resources caused by too many standards and detailed rules, the decline in efficiency caused by high complexity, the increase in operational risks, and the limitation of innovation and flexibility, while ensuring the legality and compliance of data, reducing leakage and security risks, and avoiding data management chaos;

[0023] Furthermore, the method for constructing the data association standard specification model of the present invention is as follows:

[0024] Step S3.1, data preprocessing and feature determination, collect the enterprise's risk score data and the corresponding number of security standards and regulations actually used, unify the data into a numerical format, perform deduplication and normalization processing to reduce the impact of feature range differences on the model, and select multiple key risk assessment features, such as: network security risk score, user behavior risk score, system vulnerability risk score, and set the target variable y, that is, the number of processing standards and regulations;

[0025] Step S3.2, training the support vector machine model, using support vector machine regression to map the risk score to a value, the obtained value is the number of standards and details to be adjusted, specifically: let the feature vector be X = {x1, x2, ..., x n}, where x i represents the risk score feature, and defines the loss function as L(y, f(X)) = max(0, |yf(X)|-∈), where f(X) is the predicted value of the model, and ∈ means that the error in the insensitive area is not included in the loss. The formula to be solved is Among them, W is the weight of the support vector, b is the bias term, and C is the regularization parameter used to balance the loss and model complexity;

[0026] Step S3.3, result output. After the training is completed, the model is used to give appropriate processing standards and the number of details according to the risk score, and the output of the model is used to dynamically adjust the number of processing standards and details. The final adjusted number of standards and details N adjusted =round(f(X)), where f(X) is the predicted value output by the model, and round() indicates the rounding operation;

[0027] Step S3.4, evaluation and optimization, construct a test set with 30% of the original data to evaluate the model, and use the mean square error to measure the prediction effect of the model: where y i is the actual number of standards and regulations, is the number of predictions of the model.,According to the test results, the model parameters, such as,C,∈,are adjusted to optimize the prediction,performance of the model.

[0028] In step S4, after the target enterprise applies the enterprise data association standard detail model to match the number of standards and details, in order to avoid major changes in the content of one or more standards and details and the failure to adjust the number of standards and details synchronously, or only minor changes in the content of one or more standards and details, there is no need to synchronously adjust the number of standards and details. However, the system automatically adjusts the number of standards and details. It is necessary to evaluate the impact of the changes in standards and details and decide whether to adjust the number of standards and details.

[0029] In step S4, an impact assessment model is constructed. The specific process is to collect compliance coverage change information, cost change information and risk score change range information after the standards and rules are changed. The compliance coverage change information includes the compliance coverage change coefficient, which is calibrated as F hg , the cost change information includes the cost change coefficient, denoted as B cb , the risk score change range information includes the risk score change range coefficient, denoted as P fx ;

[0030] Compliance coverage variation coefficient F hg The number of standard specifications that meet the requirements before collection and adjustment is calibrated as Q bx , collect the number of standard specifications that meet the adjustment, calibrated as H bx , then the compliance coverage change coefficient F hg =(H bx -Q bx )÷Q bx ;

[0031] Cost variation coefficient B cb By collecting the operating cost before adjustment, denoted as Y tq , calculate the operating cost required to change the number of standards and regulations, denoted as Y bg , estimate the adjusted operating cost, denoted as Y th , then the cost variation coefficient B cb =Y tq ÷(Y bg +Y th );

[0032] Risk score change coefficient P fx The enterprise data security risk assessment index obtained in step S2 is collected, and the enterprise data security risk assessment index before adjustment is calibrated as S th , obtain the danger threshold before adjustment, calibrated as W th , the adjusted enterprise data security risk assessment index is calibrated as S tq , get the adjusted danger threshold, calibrated as W tq , then the risk score variation coefficient Pfx =(W tq -S tq )÷(W th -S th );

[0033] The impact assessment model is constructed by weighting the compliance coverage change information, cost change information and risk score change range information to generate the impact assessment index YX pg , and the corresponding coefficients are the compliance coverage change coefficient F hg , Cost variation coefficient B cb , Risk score variation coefficient P fx , the formula is YX pg =β1×F hg +β2×B cb -β3×P fx ;

[0034] At the same time, β1, β2, and β3 are all greater than 0 and are set according to actual conditions. For example, the expert weighting method is adopted, that is, experts in related fields are invited to determine the weights of various indicators through professional opinion surveys and comprehensive evaluations to ensure that the weight coefficients can accurately reflect the importance of various indicators in the evaluation of the impact of changes in standards and rules. In addition, the use of various methods such as hierarchical analysis method and fuzzy comprehensive evaluation method to determine the weight coefficients can also be considered to ensure the objectivity and scientificity of the weight coefficients. I will not go into details here.

[0035] In step S4, the impact assessment index obtained from the impact assessment model is used to reflect the impact caused by changes in standards and regulations. The larger its value is, the higher the compliance coverage of the adjusted standards and regulations is, the lower the cost is, and the more the enterprise data security risk assessment index exceeds the danger threshold.

[0036] In step S4, when the impact assessment index YXpg is greater than or equal to the set change threshold, it means that the impact caused by the change of standards and details is large, and the number of standards and details matching the enterprise data needs to be adjusted synchronously, and then return to step S3, re-build the algorithm model, and output the result;

[0037] When the impact assessment index YX pg When it is less than the set change threshold, it means that the impact of the change in standards and details is small, and there is no need to synchronously adjust the number of standards and details matching the enterprise data, and the results can be output directly.

[0038] Technical effects and advantages of the present invention:

[0039] In order to overcome the above-mentioned defects of the prior art, an embodiment of the present invention provides a data security risk assessment method based on big data analysis, which evaluates the data source of the target enterprise by constructing an enterprise data security risk level assessment model, preliminarily judges the data security risk level of the target enterprise, and constructs an enterprise data association standard and rule model based on the obtained enterprise data security risk level assessment index using a support vector machine algorithm, matches the number of applied standards and rules, and finally constructs an impact assessment model based on the matched number of standards and rules, evaluates the impact of changes in standards and rules, and determines whether it is necessary to readjust the number of standards and rules when the content of the standards and rules changes. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 This is a flow chart of a data security risk assessment method based on big data analysis in the present invention. DETAILED DESCRIPTION

[0041] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0042] The present invention provides a data security risk assessment method based on big data analysis. The method evaluates the data source of a target enterprise by constructing an enterprise data security risk degree assessment model, preliminarily determines the data security risk degree of the target enterprise, constructs an enterprise data association standard detail model with a support vector machine algorithm according to the acquired enterprise data security risk degree assessment index, matches the number of applied standards and details, and finally constructs an impact assessment model based on the matched number of standards and details, evaluates the impact caused by changes in standards and details, and determines whether it is necessary to readjust the number of standards and details when the content of the standards and details changes.

[0043] Example

[0044] like Figure 1 As shown, a data security risk assessment method based on big data analysis has the following steps:

[0045] Step S1, monitoring and collecting historical data of the target enterprise and information on changes in compliance coverage, cost changes, and risk score changes before and after the application of the associated standard rules model;

[0046] Step S2, constructing an enterprise data security risk assessment model to preliminarily determine the target enterprise data security risk level;

[0047] Step S3, collecting historical data and enterprise data security risk assessment index to build an enterprise data association standard and rule model using a support vector machine algorithm, and matching the number of applied standards and rules;

[0048] Step S4, construct an impact assessment model to assess the impact of changes in standards and rules, and decide whether the number of standards and rules needs to be readjusted when the content of the standards and rules changes.

[0049] Specifically, in step S1, the enterprise data association standard specification model constructed by the support vector machine algorithm is used for data collection and processing software by ETL tools, data preprocessing and feature extraction software by MATLAB, and support vector machine modeling and training by Scikit-learn in the Python library. In actual use, due to factors such as equipment cost and complexity of real-time monitoring, the present invention is based on the continuous operation of the target enterprise and the relatively stable monitoring environment, and is carried out under the premise of continuously monitoring the target enterprise and changes in standards and specifications, which may lead to the phenomenon of rationality changes at a certain monitoring moment.

[0050] In step S2, by evaluating the target enterprise data source, the target enterprise data security risk level is preliminarily determined, thereby determining the number of standards and rules to be applied in the subsequent processing of the enterprise data. The specific process is to collect the target enterprise input structure information, data flow information and accident probability information, where the input structure information includes the manual and automatic comparison coefficient, calibrated as D sz , data flow information includes the data flow coefficient, denoted as S ld The accident probability information includes the accident probability coefficient, calibrated as G sf ;

[0051] Manual automatic contrast coefficient D sz The data input sensor detects the data input method and calibrates the amount of data manually input into the system as L s , get the text accuracy of manually input data, calibrated as Z s , and the amount of data automatically input into the system is calibrated as L z , get the text accuracy of the automatically input data, calibrated as Z z , then the manual and automatic contrast coefficient D sz =L s ×Z s ÷(L z ×Z z );

[0052] Data flow coefficient S ld The number of times the target company changes its data encryption method and type during data transmission is collected and marked as M.b , count the number of target company data leaks in the past year, denoted as X s , then the data flow coefficient S ld =M b ÷X s ;

[0053] Accident probability coefficient G sf The number of data mismatches that occurred in the past six months from the source websites, sensors, and base stations that collected data from the target company is marked as C. n , n is the number of different source websites, sensors, and base stations, n = 1, 2, 3, ..., m, m is a positive integer, data mismatch refers to the phenomenon in big data analysis that data segments are misclassified due to similar beginnings, which is common in classification algorithms or clustering algorithms based on feature similarity. The amount of data obtained by the target company from source websites, sensors, and base stations in the past six months is counted and calibrated as J n , then the accident probability coefficient

[0054] The enterprise data security risk assessment model is constructed by weighting the input structure information, data flow information and accident probability information to generate the enterprise data security risk assessment index QA pg The corresponding coefficients are manual and automatic contrast coefficients D sz , data flow coefficient S ld and the accident probability coefficient G sf , the formula is QA pg =a1×D sz +a2×S ld -a3×G sf ;

[0055] At the same time, a1, a2, and a3 are set according to actual conditions. For example, the expert empowerment method is adopted, that is, experts in related fields are invited to determine the weights of various indicators through professional opinion surveys and comprehensive evaluations to ensure that the weight coefficients can accurately reflect the importance of various indicators in the enterprise data security risk assessment. In addition, the use of multiple methods such as hierarchical analysis method and fuzzy comprehensive evaluation method to determine the weight coefficients can also be considered to ensure the objectivity and scientificity of the weight coefficients. I will not elaborate on this here.

[0056] In step S2, the enterprise data security risk assessment index obtained in the enterprise data security risk assessment model is used to reflect the security risk level of the target enterprise data in terms of its source. The larger its value is, the higher the proportion of automatically and correctly input data of the target company is, the safer the data flow process is, the smaller the probability of data mismatch problems, and the lower the target enterprise data security risk level is.

[0057] In step S2, when the enterprise data security risk assessment index QA pg When the value is greater than or equal to the set risk threshold, it indicates that the target enterprise data security risk level is low, and the number of standards and rules applied in the subsequent processing of enterprise data is reduced, the results are output, and the subsequent steps are carried out;

[0058] When enterprise data security risk assessment index QA pg When it is less than the set danger threshold, it indicates that the target enterprise data security risk level is high, and the number of standards and rules applied in the subsequent processing of enterprise data is increased, the results are output, and subsequent steps are carried out.

[0059] In step S3, a support vector machine algorithm is used to construct a standard and detailed model for enterprise data association, and historical data is collected as a factor for constructing the standard and detailed model for enterprise data association, so as to avoid the waste of resources caused by too many standards and detailed rules, the decline in efficiency caused by high complexity, the increase in operational risks, and the limitation of innovation and flexibility, while ensuring the legality and compliance of data, reducing leakage and security risks, and avoiding data management chaos;

[0060] Furthermore, the method for constructing the data association standard specification model of the present invention is as follows:

[0061] Step S3.1, data preprocessing and feature determination, collect the enterprise's risk score data and the corresponding number of security standards and regulations actually used, unify the data into a numerical format, perform deduplication and normalization processing to reduce the impact of feature range differences on the model, and select multiple key risk assessment features, such as: network security risk score, user behavior risk score, system vulnerability risk score, and set the target variable y, that is, the number of processing standards and regulations;

[0062] Step S3.2, training the support vector machine model, using support vector machine regression to map the risk score to a value, the obtained value is the number of adjusted standards and details, specifically: let the feature vector be X = {x1, x2, ..., x n}, where x i represents the risk score feature, and defines the loss function as L(y, f(X)) = max(0, |yf(X)|-∈), where f(X) is the predicted value of the model, and ∈ means that the error in the insensitive area is not included in the loss. The formula to be solved is Among them, W is the weight of the support vector, b is the bias term, and C is the regularization parameter used to balance the loss and model complexity;

[0063] Step S3.3, result output. After the training is completed, the model is used to give appropriate processing standards and the number of details according to the risk score, and the output of the model is used to dynamically adjust the number of processing standards and details. The final adjusted number of standards and details N adjusted =round(f(X)), where f(X) is the predicted value output by the model, and round() indicates the rounding operation;

[0064] Step S3.4, evaluation and optimization, construct a test set with 30% of the original data to evaluate the model, and use the mean square error to measure the prediction effect of the model: where y i is the actual number of standards and regulations, is the number of predictions of the model.,According to the test results, the model parameters, such as,C,∈,are adjusted to optimize the prediction,performance of the model.

[0065] In step S4, after the target enterprise applies the enterprise data association standard detail model to match the number of standards and details, in order to avoid major changes in the content of one or more standards and details and the failure to adjust the number of standards and details synchronously, or only minor changes in the content of one or more standards and details, there is no need to synchronously adjust the number of standards and details. However, the system automatically adjusts the number of standards and details. It is necessary to evaluate the impact of the changes in standards and details and decide whether to adjust the number of standards and details.

[0066] In step S4, an impact assessment model is constructed. The specific process is to collect compliance coverage change information, cost change information and risk score change range information after the standards and rules are changed. The compliance coverage change information includes the compliance coverage change coefficient, which is calibrated as F h,g , the cost change information includes the cost change coefficient, denoted as B cb , the risk score change range information includes the risk score change range coefficient, calibrated as p fx ;

[0067] Compliance coverage variation coefficient F hg The number of standard specifications that meet the requirements before collection and adjustment is calibrated as Q bx , collect the number of standard specifications that meet the adjustment, calibrated as H bx , then the compliance coverage change coefficient F hg =(H bx -Q bx )÷Q bx ;

[0068] Cost variation coefficient B cb By collecting the operating cost before adjustment, denoted as Y tq , calculate the operating cost required to change the number of standards and regulations, denoted as Ybg , estimate the adjusted operating cost, denoted as Y th , then the cost variation coefficient B cb =Y tq ÷(Y bg +Y th );

[0069] Risk score change coefficient P fx The enterprise data security risk assessment index obtained in step S2 is collected, and the enterprise data security risk assessment index before adjustment is calibrated as S th , obtain the danger threshold before adjustment, calibrated as W th , the adjusted enterprise data security risk assessment index is calibrated as S tq , get the adjusted danger threshold, calibrated as W tq , then the risk score variation coefficient P fx =(W tq -S tq )÷(W th -S th );

[0070] The impact assessment model is constructed by weighting the compliance coverage change information, cost change information and risk score change range information to generate the impact assessment index YX pg , and the corresponding coefficients are the compliance coverage change coefficient F hg , Cost variation coefficient B cb , Risk score variation coefficient P fx , the formula is YX pg =β1×F hg +β2×B cb -β3×P fx ;

[0071] At the same time, β1, β2, and β3 are all greater than 0 and are set according to actual conditions. For example, the expert weighting method is adopted, that is, experts in related fields are invited to determine the weights of various indicators through professional opinion surveys and comprehensive evaluations to ensure that the weight coefficients can accurately reflect the importance of various indicators in the evaluation of the impact of changes in standards and rules. In addition, the use of various methods such as hierarchical analysis method and fuzzy comprehensive evaluation method to determine the weight coefficients can also be considered to ensure the objectivity and scientificity of the weight coefficients. I will not go into details here.

[0072] In step S4, the impact assessment index obtained from the impact assessment model is used to reflect the impact caused by changes in standards and regulations. The larger its value is, the higher the compliance coverage of the adjusted standards and regulations is, the lower the cost is, and the more the enterprise data security risk assessment index exceeds the danger threshold.

[0073] In step S4, when the impact assessment index YX pg If it is greater than or equal to the set change threshold, it means that the change in standards and details has a great impact, and the number of standards and details matching the enterprise data needs to be adjusted synchronously, and the process returns to step S3, the algorithm model is rebuilt, and the result is output;

[0074] When the impact assessment index YX pg When it is less than the set change threshold, it means that the impact of the change in standards and details is small, and there is no need to synchronously adjust the number of standards and details matching the enterprise data, and the results can be output directly.

[0075] The above formulas are all dimensionless and calculated numerically. Specific dimension removal can be achieved by various means such as standardization, which will not be elaborated here. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters in the formula are set by technicians in this field according to actual conditions.

[0076] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented using software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, an ATA hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state ATA hard disk.

[0077] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0078] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0079] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0080] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, and may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0081] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0082] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage media include: U disk, mobile ATA hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk, and other media that can store program codes.

[0083] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A data security risk assessment method based on big data analysis, characterized in that: The steps include: Step S1, monitoring and collecting historical data of the target enterprise and information on changes in compliance coverage, cost changes, and risk score changes before and after the application of the associated standard rules model; Step S2, constructing an enterprise data security risk assessment model to preliminarily determine the target enterprise data security risk level; Step S3, collecting historical data and enterprise data security risk assessment indexes to build an enterprise data association standard and rule model using a support vector machine algorithm, and matching the number of applied standards and rules; Step S4, construct an impact assessment model to assess the impact of changes in standards and rules, and determine whether the number of standards and rules needs to be readjusted when the content of the standards and rules changes.

2. According to claim 1, a data security risk assessment method based on big data analysis is characterized in that: In step S2, by evaluating the target enterprise data source, the target enterprise data security risk level is preliminarily determined, thereby determining the number of standards and rules to be applied in the subsequent processing of the enterprise data. The specific process is to collect the target enterprise input structure information, data flow information and accident probability information, where the input structure information includes the manual and automatic comparison coefficient, calibrated as D sz , data flow information includes the data flow coefficient, denoted as S ld The accident probability information includes the accident probability coefficient, calibrated as G sf ; Manual automatic contrast coefficient D sz The data input sensor detects the data input method and calibrates the amount of data manually input into the system as L s , get the text accuracy of manually input data, calibrated as Z s , and the amount of data automatically input into the system is calibrated as L z , get the text accuracy of the automatically input data, calibrated as Z z , then the manual and automatic contrast coefficient D sz =L s ×Z s ÷(L z ×Z z ); Data flow coefficient S ld The number of times the target company changes its data encryption method and type during data transmission is collected and marked as M. b , count the number of target company data leaks in the past year, denoted as X s , then the data flow coefficient S ld =M b ÷X s ; Accident probability coefficient G sf The number of data mismatches that occurred in the past six months from the source websites, sensors, and base stations that collected data from the target company is marked as C. n , n is the number of different source websites, sensors, and base stations, n = 1, 2, 3, ..., m, m is a positive integer, and the amount of data obtained by the target company from source websites, sensors, and base stations in the past six months is counted and calibrated as J n , then the accident probability coefficient 3. The data security risk assessment method based on big data analysis according to claim 2 is characterized by: The enterprise data security risk assessment model is constructed by weighting the input structure information, data flow information and accident probability information to generate the enterprise data security risk assessment index QA pg The corresponding coefficients are manual and automatic contrast coefficients D sz , data flow coefficient S ld and the accident probability coefficient G sf , the formula is QA pg =a1×D sz +a2×S ld -a3×G sf , a1, a2, and a3 are the weight coefficients of the corresponding indicators, all of which are greater than 0.

4. The data security risk assessment method based on big data analysis according to claim 3 is characterized by: In step S2, when the enterprise data security risk assessment index QA pg When the risk is greater than or equal to the set danger threshold, the number of standards and rules applied in the subsequent processing of enterprise data is reduced, the results are output and the subsequent steps are carried out; When enterprise data security risk assessment index QA pg When it is less than the set danger threshold, the number of standards and rules applied in the subsequent processing of enterprise data is increased, the results are output and the subsequent steps are carried out.

5. The data security risk assessment method based on big data analysis according to claim 1 is characterized by: In step S3, a support vector machine algorithm is used to construct a standard model for enterprise data association, and historical data is collected as a factor for constructing the standard model for enterprise data association; Furthermore, the method for constructing the data association standard details model is as follows: Step S3.1, data preprocessing and feature determination, collect the enterprise's risk score data and the corresponding number of safety standards and regulations actually used, unify the data into a numerical format, remove duplicates and normalize them to reduce the impact of feature range differences on the model, and select multiple key risk assessment features; Step S3.2, training a support vector machine model, using support vector machine regression to map the risk score to a numerical value, and the obtained numerical value is the number of adjusted standards and details; Step S3.3, result output: after the training is completed, the model is used to give appropriate processing standards and the number of details according to the risk score, and the output of the model is used to dynamically adjust the processing standards and the number of details to obtain the final adjusted standards and the number of details; Step S3.4, evaluation and optimization, construct a test set with 30% of the original data to evaluate the model, and use the mean square error to measure the prediction effect of the model.

6. The data security risk assessment method based on big data analysis according to claim 5 is characterized by: In step S4, an impact assessment model is constructed. The specific process is to collect compliance coverage change information, cost change information and risk score change range information after the standards and rules are changed. The compliance coverage change information includes the compliance coverage change coefficient, which is calibrated as F hg , the cost change information includes the cost change coefficient, denoted as B cb , the risk score change range information includes the risk score change range coefficient, denoted as P fx ; Compliance coverage variation coefficient F hg The number of standard specifications that meet the requirements before collection and adjustment is calibrated as Q bx , collect the number of standard specifications that meet the adjustment, calibrated as H bx , then the compliance coverage change coefficient F hg =(H bx -Q bx )÷Q bx ; Cost variation coefficient B cb By collecting the operating cost before adjustment, denoted as Y tq , calculate the operating cost required to change the number of standards and regulations, denoted as Y bg , estimate the adjusted operating cost, denoted as Y th , then the cost variation coefficient B cb =Y tq ÷(Y bg +Y th ); Risk score change coefficient P fx The enterprise data security risk assessment index obtained in step S2 is collected, and the enterprise data security risk assessment index before adjustment is calibrated as S th , obtain the danger threshold before adjustment, calibrated as W th , the adjusted enterprise data security risk assessment index is calibrated as S tq , get the adjusted danger threshold, calibrated as W tq , then the risk score variation coefficient P fx =(W tq -S tq )÷(W th -S th ).

7. The data security risk assessment method based on big data analysis according to claim 6 is characterized by: The impact assessment model is constructed by weighting the compliance coverage change information, cost change information and risk score change range information to generate the impact assessment index YX pg , and the corresponding coefficients are the compliance coverage change coefficient F hg , Cost variation coefficient B cb , Risk score variation coefficient P fx , the formula is YX pg =β1×F hg +β2×B cb -β3×P fx , β1, β2, and β3 are the weight coefficients of the corresponding indicators, all of which are greater than 0.

8. The data security risk assessment method based on big data analysis according to claim 7 is characterized by: In step S4, when the impact assessment index YX pg When the value is greater than or equal to the set change threshold, the number of standards and rules for matching enterprise data needs to be adjusted synchronously, and the process returns to step S3 to re-build the algorithm model and output the result. When the impact assessment index YX pg When the change value is less than the set threshold, there is no need to adjust the number of standards and rules for matching enterprise data synchronously, and the results can be output directly.

Images