Financial data security risk assessment method and system based on data analysis

Abstract

The invention discloses a financial data security risk assessment method and system based on data analysis, and belongs to the technical field of financial management, and the method comprises the steps: 1, constructing a risk model library; 2, obtaining related data information generated by a financial institution system in real time, inputting the related data information into the constructed risk model library, and judging whether the system has a real-time security risk or not; 3, further analysis is carried out according to the obtained related data information, so that whether a potential safety risk exists in the system or not is judged; 4, performing risk assessment and alarm on the generated real-time safety risk; and step 5, carrying out risk assessment and updating on the generated potential safety risk. According to the invention, comprehensive analysis can be carried out according to the accumulation condition and the change condition of the risk deviation value within a period of time to generate the risk early warning value, and whether the system has potential safety risks or not is judged according to the risk early warning value, so that early warning planning can be carried out on the potential safety risks of the system as soon as possible.

Description

Technical Field

[0001] The present invention belongs to the technical field of financial management, and in particular relates to a financial data security risk assessment method and system based on data analysis. Background Art

[0002] As a core resource of the financial industry, financial data has extremely high commercial value. With the in-depth application of technologies such as big data and cloud computing, financial data has gradually transformed from an information asset to a financial production factor. However, security threats such as data leakage and abuse have also emerged, which will affect the reputation and interests of financial institutions. Therefore, it is particularly important to assess the security risks of financial data.

[0003] Traditional financial data security risk assessment mainly relies on expert experience and qualitative judgment criteria. Although it can identify obvious security risks to a certain extent, it is often difficult to fully cover potential risk factors. In addition, this method is inefficient and cannot adapt to the rapidly changing data environment. Summary of the invention

[0004] The purpose of the present invention is to provide a financial data security risk assessment method and system based on data analysis to solve the problems faced in the above-mentioned background technology.

[0005] The purpose of the present invention can be achieved through the following technical solutions: A financial data security risk assessment method based on data analysis, the assessment method comprising: Step 1: Use machine learning algorithms to build a risk model library based on historical data; Step 2: Real-time acquisition of relevant data information generated by financial institutions in the logged-in and non-logged-in states, and input into the constructed risk model library to determine whether the system has real-time security risks. If so, proceed to step 4, otherwise proceed to step 3; Step 3: Further analyze the relevant data information obtained to determine whether the system has potential security risks. If there are potential security risks, proceed to step 5, otherwise continue monitoring; Step 4: Conduct risk assessment on the real-time security risks generated and issue real-time alarms; Step 5: Conduct a risk assessment on potential security risks and update the system.

[0006] Furthermore, the method for determining whether the system has a real-time security risk in step 2 is: Obtain in real time the parameter values ​​of n items of data that financial institutions access when users log in , so that through the formula Obtain the risk deviation value of the financial institution in the logged-in state ; When the user is not logged in to the financial institution, obtain the parameter values ​​generated by various data , so that through the formula Obtain the risk deviation value of financial institutions in the non-logged-in state ; Will obtain as well as The risk deviation thresholds are respectively , To compare: when When or When the system is detected, it is judged that there is a real-time security risk; in, is the parameter value of the i-th data in the logged-in state, is the standard parameter value of the i-th data in the logged-in state, is the preset comparison value of the i-th data in the logged-in state, is the weight coefficient of the i-th data, and , is the parameter value of the i-th data in the non-login state, is the standard parameter value of the i-th data in the non-logged-in state, It is the preset comparison value of the i-th data in the non-logged-in state.

[0007] Furthermore, the method for determining whether the system has a real-time security risk in step 2 further includes: By formula Coefficient of deviation ; when When the system is detected, it is judged that there is a real-time security risk; in, is the preset deviation threshold.

[0008] Furthermore, the method for determining whether the system has potential security risks in step 3 is: When it is determined that there is no real-time security risk, the risk deviation value of the financial institution in the non-logged-in state is obtained at regular detection cycles. and the risk deviation value of the financial institution in the logged-in state , and respectively proposed the risk deviation value of financial institutions in the non-logged-in state and the logged-in state over time curve function , ; By formula Derive risk warning value ; when When the system is detected, it is judged that there is a potential security risk; in, as well as is the preset coefficient, is the start time of the detection cycle, is the end time of the detection cycle, It is the preset comparison reference value in the non-logged-in state. It is the preset comparison reference value in the logged-in state. It is the preset risk warning threshold.

[0009] Furthermore, the method for performing risk assessment in step 4 is: when When or When the safety risk is assessed as level one; when When or When the safety risk is assessed as level 2; when When or When or When the safety risk is assessed as level three; in, as well as , as well as These are the risk deviation thresholds set for the financial institution system in the logged-in state and the non-logged-in state respectively.

[0010] Furthermore, the method for performing risk assessment in step 5 is: when When the security risk is assessed as S level; when When the security risk is assessed as SS level; when , the security risk is assessed as SSS level; as well as Additional risk warning thresholds preset for the system.

[0011] Furthermore, the updating method in step 5 includes active updating and passive updating; when When the system reaches the specified update time, it will actively update. when When the system is updated, passive update is performed, that is, the system is updated immediately.

[0012] A financial data security risk assessment system based on data analysis, the system is executed by the financial data security risk assessment method based on data analysis, and the system includes: A data acquisition module, which is used to acquire relevant data information generated by the financial institution in a logged-in state and a non-logged-in state; A data analysis module, which analyzes the acquired relevant data information to determine whether there is a security risk in the system; An evaluation module is used to evaluate the existing security risk level.

[0013] Beneficial effects of the present invention: The present invention can obtain various monitoring data generated by the financial institution system in the non-logged-in state and the logged-in state, and then input them into the risk model library constructed based on historical data for comparison and calculation to obtain the deviation value of the financial institution system in the non-logged-in state and the logged-in state, so as to judge the security risk of the system according to the size of the deviation value, so that the security risk situation of the financial institution system can be more accurately and comprehensively detected in real time according to the data generated by the financial institution system; In addition, when the system does not generate real-time security risks, the present invention can generate a risk warning value based on a comprehensive analysis of the accumulation and changes of risk deviation values ​​over a period of time, and determine whether the system has potential security risks based on the size of the risk warning value. In this way, early warning planning can be made for potential security risks of the system, thereby ensuring the stability of the entire financial institution system.

[0014] Of course, any product implementing the present invention does not necessarily need to achieve all of the advantages described above at the same time. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for describing the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0016] Figure 1 is a flow chart of the method of the present invention; Figure 2 It is a system block diagram of the present invention. DETAILED DESCRIPTION

[0017] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0018] In one embodiment, a financial data security risk assessment method based on data analysis is disclosed, such as Figure 1 As shown, the evaluation method includes: Step 1: Use machine learning algorithms to build a risk model library based on historical data; Step 2: Real-time acquisition of relevant data information generated by financial institutions in the logged-in and non-logged-in states, and input into the constructed risk model library to determine whether the system has real-time security risks. If so, proceed to step 4, otherwise proceed to step 3; Step 3: Further analyze the relevant data information obtained to determine whether the system has potential security risks. If there are potential security risks, proceed to step 5, otherwise continue monitoring; Step 4: Conduct risk assessment on the real-time security risks generated and issue real-time alarms; Step 5: Conduct a risk assessment on potential security risks and update the system.

[0019] Through the above technical scheme, the present application can obtain various monitoring data generated by the financial institution system in the non-logged-in state and the logged-in state, and then input them into the risk model library constructed based on historical data for comparison and calculation to obtain the deviation value of the financial institution system in the non-logged-in state and the logged-in state, so as to judge the security risk of the system according to the size of the deviation value. In this way, the security risk situation of the financial institution system can be more accurately and comprehensively detected in real time according to the data generated by the financial institution system, and it can better adapt to the rapidly changing data environment; in addition, when the system does not generate real-time security risks, the present application can generate risk warning values ​​based on the accumulated deviations and changes over a period of time, and judge whether the system has potential security risks according to the size of the risk warning values. In this way, early warning plans can be made for potential security risks, thereby ensuring the stability of the entire financial institution system.

[0020] The method for determining whether the system has real-time security risks in step 2 is to obtain in real time the parameter values ​​of n items of data that the financial institution accesses when the user logs in. , so that through the formula Obtain the risk deviation value of the financial institution in the logged-in state ; When the user is not logged in to the financial institution, obtain the parameter values ​​generated by various data , so that through the formula Obtain the risk deviation value of financial institutions in the non-logged-in state ; Will obtain as well as The risk deviation thresholds are respectively , To compare: when When or When the system is detected, it is judged that there is a real-time security risk; in, is the parameter value of the i-th data in the logged-in state, is the standard parameter value of the i-th data in the logged-in state, is the preset comparison value of the i-th data in the logged-in state, is the weight coefficient of the i-th data, and , is the parameter value of the i-th data in the non-login state, is the standard parameter value of the i-th data in the non-logged-in state, is the preset comparison value of the i-th data in the non-logged-in state; The method for determining whether the system has real-time security risks in step 2 also includes: using the formula Coefficient of deviation ; when When the system is detected, it is judged that there is a real-time security risk; in, is the preset deviation threshold.

[0021] The above scheme provides several methods to determine whether the system has real-time security risks. First, when the system is not logged in by the user, obtain the parameter values ​​generated by various data. , such as changes in network traffic, the number of error codes and alarms in security logs, etc., and then through the formula Obtain the risk deviation value of financial institutions in the non-logged-in state , it can be seen that the greater the difference between the parameter value of the acquired project data and the standard parameter value preset for the project data, that is, The larger the value, the greater the possibility of security risks. Therefore, a comprehensive analysis based on the data of various monitoring projects is conducted to obtain the risk deviation value of financial institutions in the non-logged-in state. , when its value The larger the value, the greater the possibility of security risk. Therefore, the value is deviated from the preset risk deviation threshold. For comparison, when , it is determined that there is a real-time security risk in the financial institution system; similarly, when the system is logged in by a user, the parameter value of the n items of data logged in by the user is obtained. , so that through the formula Obtain the risk deviation value of the financial institution in the logged-in state , it can be known that The larger the value is, the greater the security risk of the system in the logged-in state is, so it is compared with the preset risk deviation threshold Compare, when it appears , it is judged that there is a real-time security risk in the financial institution system; in addition, if the risk deviation value obtained by the system in the non-logged-in state Smaller, while the risk deviation value obtained in the logged-in state is large, which indicates that the system is likely to be invaded, indicating that it has a greater security risk. Therefore, the formula Coefficient of deviation ,in, When the preset deviation threshold In this way, the data generated by the financial institution system can be monitored in real time in both the non-logged-in and logged-in states, so as to more accurately and comprehensively detect the security risk of the financial institution system, so that the system can better adapt to the rapidly changing data environment.

[0022] It should be noted that the standard parameter values ​​of various data in the logged-in state , Standard parameter values ​​of various data in non-logged-in state , preset deviation threshold , Risk Deviation Threshold , All can be determined based on historical data, and the preset comparison values ​​of each data in the logged-in state , preset comparison values ​​of various data in non-logged-in state And the weight coefficient This can be determined by combining historical data and empirical data, which will not be elaborated here.

[0023] The method for determining whether there is a potential security risk in the system in step 3 is: when it is determined that there is no real-time security risk, obtain the risk deviation value of the financial institution in the non-logged-in state at regular intervals. and the risk deviation value of the financial institution in the logged-in state , and respectively proposed the risk deviation value of financial institutions in the non-logged-in state and the logged-in state over time curve function , ; By formula Derive risk warning value ; when When the system is detected, it is judged that there is a potential security risk; in, as well as is the preset coefficient, is the start time of the detection cycle, is the end time of the detection cycle, It is the preset comparison reference value in the non-logged-in state. It is the preset comparison reference value in the logged-in state. is the preset risk warning threshold, During the detection period The maximum slope of During the detection period The minimum slope of During the detection period The maximum slope of During the detection period The minimum slope of .

[0024] The above scheme provides a specific method for determining whether the system has potential security risks. First, when it is determined that the system does not have real-time security risks, the risk deviation value of the financial institution in the non-logged-in state is obtained at regular intervals. and the risk deviation value of the financial institution in the logged-in state , and respectively proposed the risk deviation value of financial institutions in the non-logged-in state and the logged-in state over time curve function , ; Through the formula Derive risk warning value , in the formula as well as They respectively represent the accumulation of risk deviation values ​​in the non-logged-in state and the logged-in state during the detection period. If the risk deviation value does not exceed the preset threshold within a certain period of time, but it is always near the threshold, it means that there is a greater security risk. The formula as well as It represents the difference between the maximum slope and the minimum slope of the risk deviation value in the non-logged-in state and the logged-in state during the detection period. Obviously, the larger the difference, the greater the fluctuation of the risk deviation value during the detection period, indicating that the possibility of potential security risks is greater; therefore, combined with the formula Conduct comprehensive analysis to obtain risk warning values , and then compared with the preset risk warning threshold Compare, when it appears When the system is detected, it is judged that there is a potential security risk. In this way, a comprehensive analysis can be conducted on the accumulation and change of risk deviation values ​​of the financial institution system in a non-logged-in state and a certain period of time to generate a risk warning value. According to the size of the risk warning value, it is judged whether the system has a potential security risk. In this way, early warning planning can be made for potential security risks, thereby ensuring the stability of the entire financial institution system.

[0025] It should be noted that the preset comparison reference value in the non-logged-in state , Preset comparison reference value in the logged-in state , preset risk warning threshold , and preset coefficients as well as can be determined based on historical data combined with empirical data, and the start time of the detection cycle and end time It can be determined artificially according to actual conditions.

[0026] The method for risk assessment in step 4 is: When or When the safety risk is assessed as level one; when When or When the safety risk is assessed as level 2; when When or When or When the safety risk is assessed as level three; in, as well as , as well as These are the risk deviation thresholds set for the financial institution system in the logged-in state and the non-logged-in state respectively.

[0027] The above scheme provides a method for real-time risk assessment. When or When the safety risk is assessed as level 1, When or When the safety risk is assessed as level 2, When or When or When the security risk is assessed, it is divided into three levels; the security risk levels of level one, level two, and level three are getting higher and higher, so different levels of alarm reminders can be issued, so that managers can know the security risk level of the system and take corresponding measures. as well as , as well as It can be determined based on historical data and judgment experience.

[0028] The method for risk assessment in step 5 is: When When , the security risk is assessed as SS level; when , the security risk is assessed as SSS level; as well as Additional risk warning thresholds preset for the system; The updating methods in step 5 include active updating and passive updating. When the system reaches the specified update time, it will automatically update. when When the system is updated, passive update is performed, that is, the system is updated immediately.

[0029] The above scheme provides a method for risk assessment of potential security risks. When When , the security risk is assessed as SS level; when When the security risk is assessed as SSS level, the risk levels of S, SS and SSS levels gradually increase, which makes it easier for managers to understand the risk level of potential security risks in the system more clearly. When , it means that the potential security risk of the system is small at this time, and the system only needs to be actively updated, that is, the system can be actively updated when the specified update time is reached; when When the system is updated, it indicates that there is a potential security risk in the system. In order to ensure the security of the system, a passive update is performed and the system is updated immediately to ensure the security and stability of the system.

[0030] In one embodiment, a financial data security risk assessment system based on data analysis is also disclosed. The assessment system is executed by the above-mentioned financial data security risk assessment method based on data analysis. Figure 2 As shown, the system includes: A data acquisition module, which is used to acquire relevant data information generated by the financial institution in the logged-in state and the non-logged-in state; Data analysis module: The data analysis module analyzes the acquired relevant data information to determine whether there are security risks in the system; An assessment module, which assesses the existing security risk level.

[0031] The above contents are merely examples and explanations of the concept of the present invention. The technicians in this technical field may make various modifications or additions to the specific embodiments described or replace them in a similar manner. As long as they do not deviate from the concept of the invention or exceed the scope defined by the claims, they should all fall within the protection scope of the present invention.

Claims

1. A financial data security risk assessment method based on data analysis, characterized in that: The evaluation methods include: Step 1: Use machine learning algorithms to build a risk model library based on historical data; Step 2: Real-time acquisition of relevant data information generated by the financial institution system in the logged-in state and the non-logged-in state, and input into the constructed risk model library to determine whether the system has real-time security risks. If so, proceed to step 4, otherwise proceed to step 3; Step 3: Further analyze the relevant data information obtained to determine whether the system has potential security risks. If there are potential security risks, proceed to step 5, otherwise continue monitoring; Step 4: Conduct risk assessment on the real-time security risks generated and issue real-time alarms; Step 5: Conduct a risk assessment on potential security risks and update the system.

2. A financial data security risk assessment method based on data analysis according to claim 1, characterized in that: The method for determining whether the system has a real-time security risk in step 2 is: Obtain in real time the parameter values ​​of n items of data that financial institutions access when users log in , so that through the formula Obtain the risk deviation value of the financial institution in the logged-in state ; When the user is not logged in to the financial institution, obtain the parameter values ​​generated by various data , so that through the formula Obtain the risk deviation value of financial institutions in the non-logged-in state ; Will obtain as well as The risk deviation thresholds are respectively , To compare: when When or When the system is detected, it is judged that there is a real-time security risk; in, is the parameter value of the i-th data in the logged-in state, is the standard parameter value of the i-th data in the logged-in state, is the preset comparison value of the i-th data in the logged-in state, is the weight coefficient of the i-th data, and , is the parameter value of the i-th data in the non-login state, is the standard parameter value of the i-th data in the non-logged-in state, It is the preset comparison value of the i-th data in the non-logged-in state.

3. A financial data security risk assessment method based on data analysis according to claim 2, characterized in that: The method for determining whether the system has a real-time security risk in step 2 further includes: By formula Coefficient of deviation ; when When the system is detected, it is judged that there is a real-time security risk; in, is the preset deviation threshold.

4. A financial data security risk assessment method based on data analysis according to claim 2, characterized in that: The method for determining whether the system has potential security risks in step 3 is: When it is determined that there is no real-time security risk, the risk deviation value of the financial institution in the non-logged-in state is obtained at regular detection cycles. and the risk deviation value of the financial institution in the logged-in state , and respectively proposed the risk deviation value of financial institutions in the non-logged-in state and the logged-in state over time curve function , ; By formula Derive risk warning value ; when When the system is detected, it is judged that there is a potential security risk; in, as well as is the preset coefficient, is the start time of the detection cycle, is the end time of the detection cycle, It is the preset comparison reference value in the non-logged-in state. It is the preset comparison reference value in the logged-in state. is the preset risk warning threshold, During the detection period The maximum slope of During the detection period The minimum slope of During the detection period The maximum slope of During the detection period The minimum slope of .

5. A financial data security risk assessment method based on data analysis according to claim 3, characterized in that: The method for risk assessment in step 4 is: when When or When the safety risk is assessed as level one; when When or When the safety risk is assessed as level 2; when When or When or When the safety risk is assessed as level three; in, as well as , as well as These are the risk deviation thresholds set for the financial institution system in the logged-in state and the non-logged-in state respectively.

6. A financial data security risk assessment method based on data analysis according to claim 4, characterized in that: The method for risk assessment in step 5 is: when When the security risk is assessed as S level; when When the security risk is SS level, when , the security risk is assessed as SSS level; as well as Additional risk warning thresholds preset for the system.

7. A financial data security risk assessment method based on data analysis according to claim 6, characterized in that: The updating method in step 5 includes active updating and passive updating; when When the system reaches the specified update time, it will actively update. when When the system is updated, passive update is performed, that is, the system is updated immediately.

8. A financial data security risk assessment system based on data analysis, characterized in that: The system is executed by the financial data security risk assessment method based on data analysis according to any one of claims 1 to 7, and the system comprises: A data acquisition module, which is used to acquire relevant data information generated by the financial institution in a logged-in state and a non-logged-in state; A data analysis module, which analyzes the acquired relevant data information to determine whether there is a security risk in the system; An evaluation module is used to evaluate the existing security risk level.

Images