A detection method based on data asset risk assessment

Abstract

The present application discloses a detection method based on data asset risk assessment, which relates to the field of monitoring and analysis technology, and includes a data acquisition module for collecting data asset data corresponding to a target user from multiple data sources; a data processing module for processing and analyzing the data asset data corresponding to the target user, and performing security analysis on the target user's data assets based on the results of the processing and analysis, and then formulating an early warning strategy based on the results of the security analysis; an early warning module for responding to the early warning strategy, and outputting a warning signal to the target user, and outputting notification information; a risk estimation module for estimating the risk value of the target user's data assets in the future. The present application has the effect of providing user data asset security.

Description

Technical Field

[0001] The present application relates to the field of monitoring and analysis technology, and in particular to a detection method based on data asset risk assessment. Background Art

[0002] With the rapid development of information technology, data assets have become an important resource for enterprises and organizations. The diversity and complexity of data continue to increase, including structured data, unstructured data, and semi-structured data. At the same time, the data security threats faced by enterprises are becoming increasingly severe, such as data leakage, unauthorized access, and network attacks. In order to protect these data assets, organizations need a detection system that can effectively identify and assess risks. The existing solutions on the market usually rely on static security rules and manual configuration, which are difficult to adapt to the rapidly changing threat environment and complex compliance requirements.

[0003] In the related technologies, the existing data asset risk assessment detection methods have low efficiency in data collection and processing, and are unable to analyze large amounts of data in real time, resulting in delayed risk assessment. In addition, the data is not analyzed from multiple angles, which limits the analysis process and reduces the security of user data assets. There is room for improvement. Summary of the invention

[0004] In view of the deficiencies of the prior art, the present application provides a detection method based on data asset risk assessment.

[0005] In the first aspect, the present application provides a detection system based on data asset risk assessment, which adopts the following technical solutions: A detection system based on data asset risk assessment, comprising: A data collection module is used to collect data asset data corresponding to target users from multiple data sources; The data processing module is used to process and analyze the data assets corresponding to the target user, and to perform security analysis on the data assets of the target user based on the results of the processing and analysis, and then formulate an early warning strategy based on the results of the security analysis; An early warning module is used to respond to the early warning strategy and output a warning signal to the target user and output notification information; The risk estimation module is used to estimate the risk value of the target user's data assets in the future.

[0006] Preferably, the data processing module includes a data identification unit, a data analysis unit and an abnormality marking unit; The data identification unit is used to obtain data sensitivity data, access frequency data and tag data corresponding to the data asset according to the data asset data corresponding to the target user; The data analysis unit is used to perform comprehensive analysis on the data sensitivity data, the access frequency data and the tag data; The abnormality marking unit is used to analyze the abnormal conditions of data assets and mark the abnormal data assets based on the analysis results.

[0007] Preferably, the process of comprehensively analyzing the data sensitivity data, the access frequency data and the tag data specifically includes: Evaluate the risk of potential security risks in target user data assets. The evaluation process is as follows: By formula , confirm the risk value of security risks in the target user data assets ; in, Expressed as the data sensitivity coefficient corresponding to the data asset, Expressed as the access frequency coefficient corresponding to the data asset, Indicates the number of times the data asset is marked; The risk value of security risks in the target user's data assets Compared with the preset risk threshold Make a comparison; If the target user's data assets have security risks, the risk value , then there is no need to conduct security analysis on the target user’s data assets; If the target user's data assets have security risks, the risk value , it is necessary to conduct a security analysis of the target user’s data assets.

[0008] Preferably, the process of performing security analysis on the target user's data assets specifically includes: Obtaining attack information and vulnerability information corresponding to the target user data asset, wherein the attack information includes the number of attacks and the severity of each attack, and the vulnerability information includes the number of vulnerabilities, the severity of each vulnerability, and the exploitation coefficient; By formula , confirm the threat assessment coefficient corresponding to the target user data assets ; in, It is represented by the number corresponding to the number of attacks. , Expressed as The severity coefficient corresponding to the attack, It is expressed as the preset license attack severity coefficient, Indicates the number corresponding to each vulnerability. , Respectively indicated as number The severity coefficient and exploitation coefficient of the vulnerability corresponding to Expressed as a preset license vulnerability severity coefficient, Expressed as weight coefficient; The threat assessment coefficient corresponding to the target user data assets Preset threat assessment thresholds Make a comparison; If the threat assessment coefficient of the target user data asset , then there is no need to develop an early warning strategy; If the threat assessment coefficient of the target user data asset , an early warning strategy needs to be developed.

[0009] Preferably, the process of formulating an early warning strategy specifically includes: By formula , identify the comprehensive assessment coefficient of security risks in the target user data assets ; in, Expressed as weight coefficient; The comprehensive assessment coefficient of the security risks of the target user's data assets Compared with the preset comprehensive evaluation threshold Enter the comparison; Comprehensive assessment coefficient if there are security risks in the target user data assets , then a warning message is output to the target user's data assets; Comprehensive assessment coefficient if there are security risks in the target user data assets , the target user’s data assets are managed based on preset adjustment measures.

[0010] Preferably, the process of obtaining the number of markings corresponding to the data asset specifically includes: The number of exceptions corresponding to the target user data asset is obtained, and the number of exceptions is set as the marking number.

[0011] Preferably, the risk value of the target user data assets in the future is estimated, specifically including: In the preset time period, the comprehensive evaluation coefficient of the security risks of the target user data assets is collected in real time, and the curve of the change of the comprehensive evaluation coefficient over time is constructed. ; By formula , confirm the change coefficient corresponding to the comprehensive evaluation coefficient ,in, Indicates a preset time period; The coefficient of change corresponding to the comprehensive evaluation coefficient The preset change threshold Make a comparison; If the change coefficient corresponding to the comprehensive evaluation coefficient , it is determined that the risk value of the target user's data assets will increase in the future, and a notification message will be output to the target user.

[0012] In the second aspect, the present application provides a detection method based on data asset risk assessment, which adopts the following technical solution: A detection method based on data asset risk assessment includes the following steps: Collect data asset data corresponding to target users from multiple data sources; Process and analyze the data assets corresponding to the target users, and conduct security analysis on the data assets of the target users based on the results of the processing and analysis, and then formulate early warning strategies based on the results of the security analysis; Responding to the early warning strategy, and outputting a warning signal to the target user, and outputting notification information; Estimate the risk value of target user data assets in the future.

[0013] In a third aspect, the present application provides a computer-readable storage medium storing instructions, which, when executed on a computer, enables the computer to execute any one of the above-described detection systems based on data asset risk assessment.

[0014] In summary, the present application includes at least one of the following beneficial technical effects: 1. The present invention provides a detection system based on data asset risk assessment, which effectively improves the efficiency of data collection and processing by collecting, processing and analyzing the data asset data corresponding to the target user, and then performs security analysis on the data assets of the target user based on the results of the processing and analysis, and formulates an early warning strategy based on the results of the security analysis, thereby effectively analyzing a large amount of data, reducing the occurrence of risk assessment lags, and analyzing data from multiple angles, thereby effectively providing the security of user data assets; 2. By collecting the comprehensive assessment coefficient of security risks in the target user data assets in real time and constructing a curve of the change of the comprehensive assessment coefficient over time, the change coefficient corresponding to the comprehensive assessment coefficient is confirmed, and the change coefficient corresponding to the comprehensive assessment coefficient is compared with the preset change threshold, and the risk value of the target user data assets in the future is confirmed based on the comparison results, thereby effectively providing the security of user data assets. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for describing the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0016] Figure 1 It is a system diagram of detection based on data asset risk assessment in an embodiment of the present application.

[0017] Figure 2 It is a flow chart of a method for detection based on data asset risk assessment in an embodiment of the present application. DETAILED DESCRIPTION

[0018] The following is combined with Figure 1-2 This application is described in further detail. Example

[0019] An embodiment of the present application discloses a detection system based on data asset risk assessment.

[0020] Reference Figure 1 , a detection system based on data asset risk assessment, comprising: A data collection module is used to collect data asset data corresponding to target users from multiple data sources; The data processing module is used to process and analyze the data assets corresponding to the target user, and to perform security analysis on the data assets of the target user based on the results of the processing and analysis, and then formulate an early warning strategy based on the results of the security analysis; An early warning module is used to respond to the early warning strategy and output a warning signal to the target user and output notification information; The risk estimation module is used to estimate the risk value of the target user's data assets in the future.

[0021] Specifically, data assets refer to data collections that are valuable to an organization, including structured data (such as database records), unstructured data (such as documents, emails), semi-structured data (such as JSON / XML files), and the systems and devices that store these data. They typically include customer information, financial records, intellectual property, business process data, etc., and have commercial value and sensitivity.

[0022] It should be noted that the data processing module includes a data identification unit, a data analysis unit and an abnormality marking unit; The data identification unit is used to obtain data sensitivity data, access frequency data and tag data corresponding to the data asset according to the data asset data corresponding to the target user; The data analysis unit is used to perform comprehensive analysis on the data sensitivity data, the access frequency data and the tag data; The abnormality marking unit is used to analyze the abnormal conditions of data assets and mark the abnormal data assets based on the analysis results.

[0023] It should be noted that the process of comprehensive analysis of data sensitivity data, access frequency data and tag data specifically includes: Evaluate the risk of potential security risks in target user data assets. The evaluation process is as follows: By formula , confirm the risk value of security risks in the target user data assets ; in, Expressed as the data sensitivity coefficient corresponding to the data asset, Expressed as the access frequency coefficient corresponding to the data asset, Indicates the number of times the data asset is marked; The risk value of security risks in the target user's data assets Compared with the preset risk threshold Make a comparison; If the target user's data assets have security risks, the risk value , then there is no need to conduct security analysis on the target user’s data assets; If the target user's data assets have security risks, the risk value , it is necessary to conduct a security analysis of the target user’s data assets.

[0024] Specifically, by comprehensively analyzing data sensitivity, access frequency, and tagged data to confirm the security risk value of the target user's data assets, a comprehensive risk view can be provided. Data sensitivity analysis can reveal the importance and confidentiality of information, thereby determining protection priorities. Access frequency data can reveal data usage patterns and access behaviors, helping to detect abnormal activities, such as abnormally frequent access that may indicate potential security threats. Tagged data (such as user tags or access rights) can provide key clues about the identity and permissions of data accessors, ensuring that only authorized users can access sensitive information. By combining the above factors, risks can be assessed more accurately and more effective security strategies can be formulated. The above comprehensive analysis method can also improve the real-time and accuracy of risk assessment, helping management to take timely measures to reduce the probability of potential security incidents and protect the company's core data assets.

[0025] It should be noted that the process of security analysis of the target user's data assets specifically includes: Obtaining attack information and vulnerability information corresponding to the target user data asset, wherein the attack information includes the number of attacks and the severity of each attack, and the vulnerability information includes the number of vulnerabilities, the severity of each vulnerability, and the exploitation coefficient; By formula , confirm the threat assessment coefficient corresponding to the target user data assets ; in, It is represented by the number corresponding to the number of attacks. , Expressed as The severity coefficient corresponding to the attack is It is expressed as the preset license attack severity coefficient, Indicates the number corresponding to each vulnerability. , Respectively indicated as number The severity coefficient and exploitation coefficient of the vulnerability corresponding to Expressed as a preset license vulnerability severity coefficient, Expressed as weight coefficient; The threat assessment coefficient corresponding to the target user data assets Preset threat assessment thresholds Make a comparison; If the threat assessment coefficient of the target user data asset , then there is no need to develop an early warning strategy; If the threat assessment coefficient of the target user data asset , an early warning strategy needs to be developed.

[0026] Specifically, the severity of each attack, the severity of each vulnerability, and the exploitation coefficient are all obtained through machine learning technology.

[0027] Specifically, by analyzing the number of attacks and their severity, the number of vulnerabilities, the severity of each vulnerability, and the exploitation coefficient to confirm the threat assessment coefficient of the target user's data assets, it has many advantages. The above method provides a refined threat analysis framework that can comprehensively assess the risks faced by data assets. The number of attacks and the corresponding severity can reveal the system's vulnerabilities and the attacker's interests, helping to identify high-risk areas. The number of vulnerabilities and their severity provide important information about the weak links in the system's security, while the exploitation coefficient measures the possibility of these vulnerabilities being exploited by attackers. By combining these factors, the current security situation can be more accurately assessed and the most pressing security threats can be identified. The above method also helps to optimize the allocation of security resources, ensure that the most critical risks are prioritized, and reduce potential losses. Real-time threat assessment also supports dynamic adjustment of security policies, improves response speed and decision-making accuracy, and ultimately enhances overall security protection capabilities to protect data assets and business continuity.

[0028] It should be noted that the process of formulating early warning strategies specifically includes: By formula , identify the comprehensive assessment coefficient of security risks in the target user data assets ; in, Expressed as weight coefficient; The comprehensive assessment coefficient of the security risks of the target user's data assets Compared with the preset comprehensive evaluation threshold Enter the comparison; Comprehensive assessment coefficient if there are security risks in the target user data assets , then a warning message is output to the target user's data assets; Comprehensive assessment coefficient if there are security risks in the target user data assets , the target user’s data assets are managed based on preset adjustment measures.

[0029] Furthermore, the process of obtaining the number of markings corresponding to the data asset specifically includes: The number of exceptions corresponding to the target user data asset is obtained, and the number of exceptions is set as the marking number.

[0030] It should be noted that estimating the risk value of target user data assets in the future specifically includes: collecting the comprehensive assessment coefficient of security risks of target user data assets in real time within the preset time period, and constructing a curve of the change of the comprehensive assessment coefficient over time. ; By formula , confirm the change coefficient corresponding to the comprehensive evaluation coefficient ,in, Indicates a preset time period; The coefficient of change corresponding to the comprehensive evaluation coefficient The preset change threshold Make a comparison; If the change coefficient corresponding to the comprehensive evaluation coefficient , it is determined that the risk value of the target user's data assets will increase in the future, and a notification message will be output to the target user. Example

[0031] The embodiment of the present application also discloses a detection method based on data asset risk assessment.

[0032] Reference Figure 2 , a detection method based on data asset risk assessment, comprising the following steps: Collect data asset data corresponding to target users from multiple data sources; Process and analyze the data assets corresponding to the target users, and conduct security analysis on the data assets of the target users based on the results of the processing and analysis, and then formulate early warning strategies based on the results of the security analysis; Responding to the early warning strategy, and outputting a warning signal to the target user, and outputting notification information; Estimate the risk value of target user data assets in the future.

[0033] The above contents are merely examples and explanations of the concept of the present invention. Those skilled in the art may make various modifications or additions to the specific embodiments described or replace them in a similar manner. As long as they do not deviate from the concept of the invention, they should all fall within the protection scope of the present invention.

[0034] In the description of this specification, the description with reference to the terms "one embodiment", "example", "specific example", etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0035] The preferred embodiments of the present invention disclosed above are only used to help explain the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to specific implementation methods. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well.

Claims

1. A detection system based on data asset risk assessment, characterized in that: include: A data collection module is used to collect data asset data corresponding to target users from multiple data sources; The data processing module is used to process and analyze the data assets corresponding to the target user, and to perform security analysis on the data assets of the target user based on the results of the processing and analysis, and then formulate an early warning strategy based on the results of the security analysis; An early warning module is used to respond to the early warning strategy and output a warning signal to the target user and output notification information; The risk estimation module is used to estimate the risk value of the target user's data assets in the future.

2. A detection system based on data asset risk assessment according to claim 1, characterized in that: The data processing module includes a data identification unit, a data analysis unit and an abnormality marking unit; The data identification unit is used to obtain data sensitivity data, access frequency data and tag data corresponding to the data asset according to the data asset data corresponding to the target user; The data analysis unit is used to perform comprehensive analysis on the data sensitivity data, the access frequency data and the tag data; The abnormality marking unit is used to analyze the abnormal conditions of data assets and mark the abnormal data assets based on the analysis results.

3. A detection system based on data asset risk assessment according to claim 2, characterized in that: The process of comprehensive analysis of data sensitivity data, access frequency data, and tag data includes: Evaluate the risk of potential security risks in target user data assets. The evaluation process is as follows: By formula , confirm the risk value of security risks in the target user data assets ; in, Expressed as the data sensitivity coefficient corresponding to the data asset, Expressed as the access frequency coefficient corresponding to the data asset, Indicates the number of times the data asset is marked; The risk value of security risks in the target user's data assets Compared with the preset risk threshold Make a comparison; If the target user's data assets have security risks, the risk value , then there is no need to conduct security analysis on the target user’s data assets; If the target user's data assets have security risks, the risk value , it is necessary to conduct a security analysis of the target user’s data assets.

4. A detection system based on data asset risk assessment according to claim 3, characterized in that: The process of conducting security analysis on the target user's data assets includes: Obtaining attack information and vulnerability information corresponding to the target user data asset, wherein the attack information includes the number of attacks and the severity of each attack, and the vulnerability information includes the number of vulnerabilities, the severity of each vulnerability, and the exploitation coefficient; By formula , confirm the threat assessment coefficient corresponding to the target user data assets ; in, It is represented by the number corresponding to the number of attacks. , Expressed as The severity coefficient corresponding to the attack is It is expressed as the preset license attack severity coefficient, Indicates the number corresponding to each vulnerability. , Respectively indicated as number The severity coefficient and exploitation coefficient of the vulnerability corresponding to Expressed as a preset license vulnerability severity coefficient, Expressed as weight coefficient; The threat assessment coefficient corresponding to the target user data assets Preset threat assessment thresholds Make a comparison; If the threat assessment coefficient of the target user data asset , then there is no need to develop an early warning strategy; If the threat assessment coefficient of the target user data asset , an early warning strategy needs to be developed.

5. A detection system based on data asset risk assessment according to claim 4, characterized in that: The process of developing an early warning strategy includes: By formula , identify the comprehensive assessment coefficient of security risks in the target user data assets ; in, Expressed as weight coefficient; The comprehensive assessment coefficient of the security risks of the target user's data assets Compared with the preset comprehensive evaluation threshold Enter the comparison; Comprehensive assessment coefficient if there are security risks in the target user data assets , then a warning message is output to the target user's data assets; Comprehensive assessment coefficient if there are security risks in the target user data assets , the target user’s data assets are managed based on preset adjustment measures.

6. A detection system based on data asset risk assessment according to claim 3, characterized in that: The process of obtaining the number of marks corresponding to the data asset includes: The number of exceptions corresponding to the target user data asset is obtained, and the number of exceptions is set as the marking number.

7. A detection system based on data asset risk assessment according to claim 5, characterized in that: Estimate the risk value of the target user's data assets in the future, including: In the preset time period, the comprehensive evaluation coefficient of the security risks of the target user data assets is collected in real time, and the curve of the change of the comprehensive evaluation coefficient over time is constructed. ; By formula , confirm the change coefficient corresponding to the comprehensive evaluation coefficient ,in, Indicates a preset time period; The coefficient of change corresponding to the comprehensive evaluation coefficient The preset change threshold Make a comparison; If the change coefficient corresponding to the comprehensive evaluation coefficient , it is determined that the risk value of the target user's data assets will increase in the future, and a notification message will be output to the target user.

8. A detection method based on data asset risk assessment, applied to a detection system based on data asset risk assessment as described in any one of claims 1 to 7, characterized in that: The following steps are involved: Collect data asset data corresponding to target users from multiple data sources; Process and analyze the data assets corresponding to the target users, and conduct security analysis on the data assets of the target users based on the results of the processing and analysis, and then formulate early warning strategies based on the results of the security analysis; Responding to the early warning strategy, and outputting a warning signal to the target user, and outputting notification information; Estimate the risk value of target user data assets in the future.

9. A computer-readable storage medium, characterized in that: Instructions are stored, and when the instructions are executed on a computer, the computer executes a detection system based on data asset risk assessment as described in any one of claims 1 to 7.

Images