Security risk identification method and device

Abstract

The embodiment of the present application provides a method and device for identifying security risks, which obtains structured data and user data of a customer to be identified, inputs the structured data and user data into a deep learning model, obtains an influencing factor, obtains the security risk data of the customer to be identified based on the influencing factor, vulnerability factor, and defense capability factor, and determines the security risk level of the identified customer based on the security risk data and a preset risk level table. The present application considers structured data when predicting security risks through a deep learning model to improve the accuracy of the prediction results, and when determining the security risk level, comprehensively considers the prediction results as well as the vulnerability factor and defense capability factor, so that the security risk level finally obtained is more accurate, thereby improving the accuracy of security risk identification, providing better support for enterprises to go to the cloud, and reducing the workload of operation and maintenance personnel.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of Internet technology, and in particular, to a method and device for identifying security risks. Background Art

[0002] As Internet technology becomes more mature and the Internet environment becomes more perfect, in order to reduce the cost of information construction, optimize operation and management processes, and innovate business development models, more and more companies choose to migrate their business data, application services and other related resources to cloud platforms. This also leads to the relative openness of enterprise systems, and there are risks such as malicious attacks on the system, system data loss, and data tampering.

[0003] In order to ensure system security, enterprise systems need to be maintained and upgraded. Currently, most enterprises rely on operation and maintenance personnel to provide cloud support for enterprises. However, in the context of enterprise cloud migration, the network, server, and application components are huge, with numerous devices. Security upgrades and reinforcement equipment are numerous and upgrades are frequent. The workload of operation and maintenance personnel is heavy, making it difficult for operation and maintenance personnel to detect enterprise system failures in a timely manner, thus exposing enterprise systems to security risks.

[0004] Therefore, in order to improve operation and maintenance efficiency, the existing technology uses deep learning models to predict security risks of enterprise systems based on user behavior data. This method only considers the impact of user behavior on the security risks of enterprise systems, but does not consider the enterprise system itself, resulting in inaccurate prediction results and difficulty in timely discovering real security risks. Summary of the invention

[0005] The embodiments of the present application provide a security risk identification method and device for solving the technical problems mentioned in the background technology.

[0006] In a first aspect, an embodiment of the present application provides a security risk identification method, including:

[0007] Obtain structured data and user data of the customer to be identified, wherein the structured data includes: device asset information, network traffic data, security event logs, configuration and compliance data; the user data includes: user identity information, user behavior data, security activity data, feedback and history data;

[0008] Inputting the structured data and the user data into a trained deep learning model to obtain an impact factor, where the impact factor is the degree of impact of the structured data and the user data on the security risk of the customer to be identified;

[0009] Obtaining security risk data of the customer to be identified according to the impact factor, vulnerability factor, and defense capability factor, wherein the vulnerability factor is the probability of the customer to be identified being attacked externally, and the defense capability factor is the defense capability of the customer to be identified against external power;

[0010] The security risk level of the identified customer is determined according to the security risk data and a preset risk level table, wherein the preset risk level table is provided with a corresponding relationship between the security risk data and the security risk level.

[0011] Optionally, the security risk data is positively correlated with the impact factor, the security risk data is positively correlated with the vulnerability factor, and the security risk data is negatively correlated with the defense capability factor.

[0012] Optionally, obtaining the security risk information of the customer to be identified according to the influencing factor, the vulnerability factor, and the defense capability factor includes:

[0013]

[0014] Among them, f represents the security risk data, I represents the impact factor, C represents the vulnerability factor, and B represents the defense capability factor.

[0015] Optionally, before inputting the structured data and the user data into a trained deep learning model to obtain the impact factor, the method further includes:

[0016] Acquire historical data of multiple customers, the historical data including: historical structured data, historical user data, and historical security risk data;

[0017] Extracting features and selecting features from the historical data to obtain a training set;

[0018] Inputting the training set into a deep learning model, and adjusting model parameters of the deep learning model based on a loss function and a preset model optimization algorithm;

[0019] When the training index of the deep learning model meets the preset index, the trained deep learning model is obtained.

[0020] Optionally, an L1 regularization term and an L2 regularization term are set in the loss function.

[0021] Optionally, after determining the security risk level of the identified customer according to the security risk data and a preset risk level table, the method further includes:

[0022] According to the security risk level, a security risk warning strategy is output.

[0023] In a second aspect, an embodiment of the present application provides a security risk identification device, including:

[0024] An acquisition module, used to acquire structured data and user data of the customer to be identified, wherein the structured data includes: device asset information, network traffic data, security event logs, configuration and compliance data; the user data includes: user identity information, user behavior data, security activity data, feedback and history record data;

[0025] A processing module, configured to input the structured data and the user data into a trained deep learning model to obtain an impact factor, wherein the impact factor is the degree of impact of the structured data and the user data on the security risk of the customer to be identified; and to obtain security risk data of the customer to be identified according to the impact factor, the vulnerability factor, and the defense capability factor, wherein the vulnerability factor is the probability that the customer to be identified is attacked externally, and the defense capability factor is the defense capability of the customer to be identified against external power;

[0026] The security risk determination module is used to determine the security risk level of the identified customer based on the security risk data and a preset risk level table, wherein the preset risk level table is provided with a corresponding relationship between the security risk data and the security risk level.

[0027] Optionally, the security risk data is positively correlated with the impact factor, the security risk data is positively correlated with the vulnerability factor, and the security risk data is negatively correlated with the defense capability factor.

[0028] Optionally, obtaining the security risk information of the customer to be identified according to the influencing factor, the vulnerability factor, and the defense capability factor includes:

[0029]

[0030] Among them, f represents the security risk data, I represents the impact factor, C represents the vulnerability factor, and B represents the defense capability factor.

[0031] Optionally, the processing module inputs the structured data and the user data into a trained deep learning model before obtaining the impact factor, and the training module is used to:

[0032] Acquire historical data of multiple customers, the historical data including: historical structured data, historical user data, and historical security risk data;

[0033] Extracting features and selecting features from the historical data to obtain a training set;

[0034] Inputting the training set into a deep learning model, and adjusting model parameters of the deep learning model based on a loss function and a preset model optimization algorithm;

[0035] When the training index of the deep learning model meets the preset index, the trained deep learning model is obtained.

[0036] Optionally, an L1 regularization term and an L2 regularization term are set in the loss function.

[0037] Optionally, after determining the security risk level of the identified customer according to the security risk data and a preset risk level table, the security risk determination module is further configured to:

[0038] According to the security risk level, a security risk warning strategy is output.

[0039] In a third aspect, an embodiment of the present application provides an electronic device, including: a processor and a memory;

[0040] Memory stores computer-executable instructions;

[0041] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the method as described in any one of the first aspects.

[0042] In a fourth aspect, an embodiment of the present application provides a readable storage medium, including a program or an instruction. When the program or the instruction runs on a computer, any method of the above-mentioned first aspect is executed.

[0043] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which implements the method described in any one of the first aspects when executed by a processor.

[0044] The embodiment of the present application provides a method and device for identifying security risks, which obtains structured data and user data of a customer to be identified, wherein the structured data includes: equipment asset information, network traffic data, security event log, configuration and compliance data, and the user data includes: user identity information, user behavior data, security activity data, feedback and historical record data, inputs the structured data and user data into a trained deep learning model, obtains the influence factor, obtains the security risk data of the customer to be identified according to the influence factor, vulnerability factor, and defense capability factor, and determines the security risk level of the identified customer according to the security risk data and a preset risk level table, wherein the preset risk level table is provided with a corresponding relationship between the security risk data and the security risk level. In this way, when predicting security risks through a deep learning model, structured data is considered to improve the accuracy of the prediction results, and when determining the security risk level, the prediction results, vulnerability factors, and defense capability factors are comprehensively considered, so that the security risk level finally obtained is more accurate, thereby improving the accuracy of security risk identification, providing better support for enterprises to go to the cloud, and reducing the workload of operation and maintenance personnel. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0046] Figure 1 A flowchart of a security risk identification method provided in one embodiment of the present application;

[0047] Figure 2 A training flow chart of a deep learning model provided in one embodiment of the present application;

[0048] Figure 3 A schematic diagram of the structure of a security risk identification device provided in one embodiment of the present application;

[0049] Figure 4 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0051] As Internet technology matures and the Internet environment improves, more and more companies are migrating traditional local IT infrastructure, such as servers, storage devices, and databases, to cloud computing platforms through the Internet to reduce information construction costs, optimize operation and management processes, and innovate business development models. Among them, the main purpose of enterprises moving to the cloud is to improve the utilization of IT resources, reduce operation and maintenance costs, improve data processing and storage efficiency, and enhance the reliability and security of enterprise business. However, in contrast, the number of network attacks on enterprises will also increase, and there are risks such as malicious attacks on the system, system data loss, and data tampering.

[0052] At present, enterprises rely on operation and maintenance personnel to maintain and upgrade the system to ensure system security and provide support for enterprises to migrate to the cloud. However, in the context of enterprises migrating to the cloud, the network, servers, and applications are huge, with numerous devices, and there are many security upgrade and reinforcement devices, and the upgrades are frequent. These not only require a large number of operation and maintenance personnel, increasing enterprise costs, but also make it difficult for operation and maintenance personnel to detect enterprise system failures in a timely manner, reducing operation and maintenance efficiency, and even putting enterprise systems at risk of security risks.

[0053] Therefore, in order to improve the efficiency of operation and maintenance, the existing technology uses deep learning models to predict the security risks of enterprise systems based on user behavior data. This method only considers the impact of user behavior on the security risks of enterprise systems, but does not consider the enterprise system itself, resulting in inaccurate prediction results and difficulty in timely discovering real security risks.

[0054] Therefore, in order to solve the technical problems existing in the prior art, the present application provides a security risk identification method and device, which predicts through a deep learning model based on the structured data and user behavior data of the enterprise system itself, and then further calculates and processes the prediction results output by the deep learning model in combination with the vulnerability factor and the defense capability factor to obtain security risk data, and finally determines the security risk level of the enterprise system based on the security risk data. Since structured data can reflect the security characteristics of the enterprise system itself, the present application considers structured data when predicting security risks through a deep learning model, so that the prediction results are more realistic, and when determining the security risk level, the prediction results as well as the vulnerability factor and the defense capability factor are comprehensively considered, so that the final security risk level obtained is more accurate, thereby improving the accuracy of security risk identification, providing better support for enterprises to go to the cloud, and reducing the workload of operation and maintenance personnel.

[0055] Figure 1 A flowchart of a security risk identification method provided in an embodiment of the present application is shown in FIG. Figure 1 As shown, the method includes:

[0056] S101. Obtain structured data and user data of the customer to be identified.

[0057] Among them, structured data includes: device asset information, network traffic data, security event logs, configuration and compliance data; user data includes: user identity information, user behavior data, security activity data, feedback and history data.

[0058] In this step, the customer to be identified may be an enterprise, an organization, or a school, etc. This embodiment is described by taking an enterprise as an example:

[0059] Structured data refers to data stored in a fixed format, which is convenient for analysis and processing. One enterprise corresponds to one structured data, among which structured data includes:

[0060] Device asset information: device ID, device type (e.g., server, router, switch, etc.), operating system version, installed software and versions, device location (physical or virtual);

[0061] Network traffic data: packet size, source and destination IP addresses, transport protocols (TCP, UDP, etc.), port numbers, traffic timestamps, and the direction of data traffic (inbound or outbound);

[0062] Security event logs: failed logins, attack detection logs (e.g., intrusion detection system alerts), firewall logs, malware detection logs;

[0063] Configuration and compliance data: system configuration files, security policies and rules, compliance check results (such as compliance with GDPR, ISO standards, etc.).

[0064] User data refers to data related to user behavior and activities, which can help determine whether the user's network behavior is risky. In security risk prediction, the user data within the enterprise's preset time period is obtained, for example, the user data in the last six months. User data includes:

[0065] User identity information: user ID, user role (administrator, ordinary user, etc.), user registration time, user department or organization;

[0066] User behavior data: login time and frequency, resources and services accessed, files downloaded and uploaded, type of device used (PC, mobile device, etc.);

[0067] Security-related activities: user permission change records, user-initiated security events (such as reporting suspicious activities), user abnormal behaviors (such as logging in from a different location, multiple failed logins in a short period of time, etc.);

[0068] Feedback and History: Security issues or feedback submitted by users, user training and awareness raising records.

[0069] S102: Input the structured data and user data into the trained deep learning model to obtain the impact factor.

[0070] Among them, the influencing factor is the degree of influence of structured data and user data on the security risk of the customer to be identified.

[0071] In this step, since the deep learning model of this embodiment is applied to different enterprises, organizations and other customers, when training the deep learning model, the amount of data is diverse and extensive, and the amount of data is large, which makes the model training slow. Therefore, in this embodiment, the deep learning model selects the random forest algorithm and the gradient boosting tree, which can not only improve the model training speed, but also take into account the prediction effect of the deep learning model. Among them, the training process of the deep learning model is referred to below and will not be repeated here.

[0072] The structured data and user data are input into the trained deep learning model, and the deep learning model outputs the predicted value, which is the impact factor, indicating the impact of the current structured data and user data on the security risk of the enterprise. Among them, the impact factor is positively correlated with the security risk data.

[0073] S103. Obtain security risk data of the customer to be identified based on the influencing factors, vulnerability factors, and defense capability factors.

[0074] Among them, the vulnerability factor is the probability that the customer to be identified is attacked by external forces, and the defense capability factor is the defense capability of the customer to be identified against external forces.

[0075] In this step, the vulnerability factor represents the vulnerability of the enterprise system. It is evaluated based on the number of known vulnerabilities, risk level or historical attack records, and reflects the possibility of the enterprise being attacked from the outside. The vulnerability factor is positively correlated with the security risk data. The higher the vulnerability factor, the larger the security risk data, that is, the higher the risk.

[0076] The defense capability factor indicates the effectiveness of security measures such as firewalls, intrusion detection systems, and user education, and reflects the defense capability of the system or organization. Among them, the defense capability factor is negatively correlated with the security risk data.

[0077] Vulnerability factors and defense capability factors can be obtained from industry standards, and security risk data can be obtained based on the impact factors, vulnerability factors, and defense capability factors. Optionally, a calculation formula for security risk data is formula (1):

[0078]

[0079] Wherein, f represents the security risk data;

[0080] I represents the impact factor;

[0081] C represents the vulnerability factor;

[0082] B represents the defensive capability factor.

[0083] In formula (1), the defense capability factor B is used as the denominator to reduce the security risk level; 2 Used to increase the weight of influencing factors, thereby increasing the impact of structured data and user data on the security risk level.

[0084] S104. Determine and identify the security risk level of the customer based on the security risk data and a preset risk level table, wherein the preset risk level table is provided with a corresponding relationship between the security risk data and the security risk level.

[0085] In this step, the preset risk level table is pre-set and is used to set the corresponding relationship between the security risk data and the security risk level, so that after obtaining the security risk data, the security risk level can be automatically determined to improve the risk identification efficiency.

[0086] Optionally, after S104, the method further includes:

[0087] S105. Output a security risk warning strategy based on the security risk level.

[0088] Specifically, according to the security risk level, the corresponding security risk warning strategy is output. For example, when the risk level is low, the system can send an alarm prompt information to the operation and maintenance personnel, and the alarm prompt information includes the location of the risk and the security risk level; when the risk level is high, not only will the alarm prompt information be sent to the operation and maintenance personnel, but it can also automatically perform pre-processing according to the pre-set security strategy to reduce the probability of security risks and eliminate potential risks, for example, upgrading the system, adjusting the security configuration, and optimizing the system architecture.

[0089] In this embodiment, by obtaining structured data and user data of the customer to be identified, wherein the structured data includes: equipment asset information, network traffic data, security event log, configuration and compliance data, and the user data includes: user identity information, user behavior data, security activity data, feedback and historical record data, the structured data and user data are input into the trained deep learning model to obtain the influence factor, and the security risk data of the customer to be identified is obtained according to the influence factor, vulnerability factor, and defense capability factor, and the security risk level of the identified customer is determined according to the security risk data and the preset risk level table, and the preset risk level table is provided with a corresponding relationship between the security risk data and the security risk level. In this way, when predicting security risks through the deep learning model, the structured data is considered to improve the accuracy of the prediction results, and when determining the security risk level, the prediction results, vulnerability factors, and defense capability factors are comprehensively considered, so that the security risk level finally obtained is more accurate, thereby improving the accuracy of security risk identification, providing better support for enterprises to go to the cloud, and reducing the workload of operation and maintenance personnel.

[0090] Figure 2 This is a training flow chart of a deep learning model provided in one embodiment of the present application. Figure 2 As shown, the method in this implementation includes:

[0091] S201. Obtain historical data of multiple customers.

[0092] Among them, historical data includes: historical structured data, historical user data and historical security risk data.

[0093] In this step, a large amount of historical data is collected from different customers, and the historical data includes historical structured data, historical user data, and historical security risk data. Among the historical data, one set of historical structured data can correspond to multiple sets of historical user data and historical security risk data, and the historical user data and historical security risk data correspond one to one.

[0094] In order to improve the robustness and accuracy of deep learning models, when collecting data, not only the amount of data should be increased, but also the diversity and breadth of the data should be considered, and data should be collected from different companies, organizations and other customers.

[0095] S202: Extract features and select features from historical data to obtain a training set.

[0096] In this step, part of the historical data is used to form a training set, and part of the data is used to form a test set and a validation set. For the historical data used to form the training set, it is necessary to process the historical data before feature extraction, for example, data cleaning to reduce irrelevant data in the historical data.

[0097] Then, feature extraction is performed on the data. During feature extraction, feature engineering can be introduced to add or adjust features. For example, hardware failure rate, system update frequency, etc. can be introduced as additional features to improve the prediction accuracy of the deep learning model.

[0098] After extracting features, feature selection is performed through feature selection algorithms and feature dimension reduction algorithms to obtain a training set. For example, the principal component analysis (PCA) algorithm and the recursive feature elimination (RFE) algorithm are used to select features and perform feature dimension reduction to reduce feature dimensions, reduce computational complexity, and increase training speed.

[0099] S203: input the training set into the deep learning model, and adjust the model parameters of the deep learning model based on the loss function and the preset model optimization algorithm.

[0100] In this step, the training set is input into the deep learning model, and the model parameters of the deep learning model are adjusted according to the loss function and the preset model optimization algorithm. The loss function is shown in formula (2):

[0101] L=a1×x1+a2×x2+…+a n ×x+L1(|x1|+|x2|+…+|x n |+L2(x1 2 +x2 2 +…+x n 2 ))

[0102] Formula (2)

[0103] Where L represents the loss function;

[0104] a1, a2, a n Represents the weight of the model parameters in the loss function;

[0105] x1, x2, x n Represents model parameters.

[0106] Optionally, according to formula (2), the loss function is provided with an L1 regularization term and an L2 regularization term, wherein the L1 regularization term penalizes the sum of the absolute values ​​of the model parameters, which helps to generate a sparse solution, and the L2 regularization penalizes the sum of the squares of the model parameters, which helps to make the parameter value approach zero but not equal to zero, thereby preventing overfitting.

[0107] Optionally, this embodiment uses grid search, random search and other methods to tune the hyperparameters of the deep learning model to find the optimal parameter combination and improve the accuracy and generalization ability of the model. Specifically, one of the methods is shown in formula (3):

[0108]

[0109] Among them, x i represents the current value of the i-th model parameter;

[0110] x' i Represents the updated value of the i-th model parameter after update;

[0111] η is the learning rate.

[0112] Optionally, when the deep learning model is trained, when the safety level prediction result (i.e., impact factor) obtained based on a set of training data in the training set is significantly different from the corresponding historical safety risk data, the safety level prediction value (i.e., impact factor) output by the deep learning model can be corrected according to formula (4), and then the loss function is used to train the deep learning model by comparing the corrected impact factor with the corresponding historical safety risk data to obtain a loss value:

[0113]

[0114] Among them, I opt represents the corrected impact factor;

[0115] T represents the training speed, which can be measured by the time required for each round of training or the number of iterations;

[0116] A represents accuracy, which can be measured by the performance of the deep learning model on the validation set or test set;

[0117] λ1 and λ2 represent the weights of training speed and accuracy, respectively, which are used to balance the importance of the two in the optimization process.

[0118] S204: When the training indicators of the deep learning model meet the preset indicators, a trained deep learning model is obtained.

[0119] In this step, the preset indicator may be, for example, the number of iterations, or the degree of convergence of the deep learning model. When the number of iterations of the deep learning model reaches the preset number of iterations, or the model convergence satisfies the preset convergence degree, it indicates that the deep learning model training is completed and a trained deep learning model is obtained.

[0120] In this embodiment, by obtaining historical data of multiple customers, the historical data includes: historical structured data, historical user data and historical security risk data, feature extraction and feature selection are performed on the historical data respectively to obtain a training set; the training set is input into the deep learning model, and the model parameters of the deep learning model are adjusted based on the loss function and the preset model optimization algorithm; when the training indicators of the deep learning model meet the preset indicators, a trained deep learning model is obtained. Since historical structured data and historical user data are used when training the deep learning model, the trained deep learning model takes into account the structured data of the customer when predicting security risks, thereby improving the accuracy of security risk prediction.

[0121] Figure 3 This is a schematic diagram of the structure of a security risk identification device provided in one embodiment of the present application. Figure 3 As shown, the device includes: an acquisition module 301, a processing module 302 and a security risk determination module 303. Optionally, the device also includes: a training module 304.

[0122] The acquisition module 301 is used to acquire structured data and user data of the customer to be identified, wherein the structured data includes: device asset information, network traffic data, security event logs, configuration and compliance data; the user data includes: user identity information, user behavior data, security activity data, feedback and history record data;

[0123] The processing module 302 is used to input the structured data and the user data into the trained deep learning model to obtain an impact factor, where the impact factor is the impact degree of the structured data and the user data on the security risk of the customer to be identified; and obtain the security risk data of the customer to be identified according to the impact factor, the vulnerability factor, and the defense capability factor, wherein the vulnerability factor is the probability that the customer to be identified is attacked externally, and the defense capability factor is the defense capability of the customer to be identified against external power;

[0124] The security risk determination module 303 is used to determine the security risk level of the identified customer based on the security risk data and a preset risk level table, wherein the preset risk level table is provided with a corresponding relationship between the security risk data and the security risk level.

[0125] Optionally, the security risk data is positively correlated with the impact factor, the security risk data is positively correlated with the vulnerability factor, and the security risk data is negatively correlated with the defense capability factor.

[0126] Optionally, obtaining the security risk information of the customer to be identified according to the influencing factor, the vulnerability factor, and the defense capability factor includes:

[0127]

[0128] Among them, f represents the security risk data, I represents the impact factor, C represents the vulnerability factor, and B represents the defense capability factor.

[0129] Optionally, the processing module 302 inputs the structured data and the user data into a trained deep learning model before obtaining the impact factor. The training module 304 is used to:

[0130] Acquire historical data of multiple customers, the historical data including: historical structured data, historical user data, and historical security risk data;

[0131] Extracting features and selecting features from the historical data to obtain a training set;

[0132] Inputting the training set into a deep learning model, and adjusting model parameters of the deep learning model based on a loss function and a preset model optimization algorithm;

[0133] When the training index of the deep learning model meets the preset index, the trained deep learning model is obtained.

[0134] Optionally, an L1 regularization term and an L2 regularization term are set in the loss function.

[0135] Optionally, after determining the security risk level of the identified customer according to the security risk data and a preset risk level table, the security risk determination module 303 is further configured to:

[0136] According to the security risk level, a security risk warning strategy is output.

[0137] The security risk identification device provided in the embodiment of the present application can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0138] Figure 4 The hardware structure diagram of the electronic device provided in the embodiment of the present application is shown in FIG. Figure 4 As shown, the electronic device includes: a processor 401 and a memory 402 .

[0139] The processor 401 and the memory 402 are connected via a bus 403 .

[0140] In a specific implementation process, the processor 401 executes the computer execution instructions stored in the memory 402, so that the processor 401 executes the above method.

[0141] The specific implementation process of the processor 401 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0142] In the above Figure 4 In the illustrated embodiment, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. The general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc. The steps of the method disclosed in the application may be directly embodied as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0143] The memory may include high-speed RAM memory and may also include non-volatile storage NVM, such as disk storage.

[0144] The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0145] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above method is implemented.

[0146] The computer-readable storage medium mentioned above can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0147] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0148] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0149] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A security risk identification method, characterized in that: include: Obtain structured data and user data of the customer to be identified, wherein the structured data includes: device asset information, network traffic data, security event logs, configuration and compliance data; the user data includes: user identity information, user behavior data, security activity data, feedback and history data; Inputting the structured data and the user data into a trained deep learning model to obtain an impact factor, where the impact factor is the degree of impact of the structured data and the user data on the security risk of the customer to be identified; Obtaining security risk data of the customer to be identified according to the impact factor, vulnerability factor, and defense capability factor, wherein the vulnerability factor is the probability of the customer to be identified being attacked externally, and the defense capability factor is the defense capability of the customer to be identified against external power; The security risk level of the identified customer is determined according to the security risk data and a preset risk level table, wherein the preset risk level table is provided with a corresponding relationship between the security risk data and the security risk level.

2. The method according to claim 1, characterized in that The security risk data is positively correlated with the impact factor, the security risk data is positively correlated with the vulnerability factor, and the security risk data is negatively correlated with the defense capability factor.

3. The method according to claim 2, characterized in that The obtaining of the security risk information of the customer to be identified according to the influencing factor, the vulnerability factor, and the defense capability factor includes: Among them, f represents the security risk data, I represents the impact factor, C represents the vulnerability factor, and B represents the defense capability factor.

4. The method according to any one of claims 1 to 3, characterized in that: Before inputting the structured data and the user data into the trained deep learning model to obtain the impact factor, the method further includes: Acquire historical data of multiple customers, the historical data including: historical structured data, historical user data, and historical security risk data; Extracting features and selecting features from the historical data to obtain a training set; Inputting the training set into a deep learning model, and adjusting model parameters of the deep learning model based on a loss function and a preset model optimization algorithm; When the training index of the deep learning model meets the preset index, the trained deep learning model is obtained.

5. The method according to claim 4, characterized in that The loss function is provided with an L1 regularization term and an L2 regularization term.

6. The method according to claim 4, characterized in that After determining the security risk level of the identified customer according to the security risk data and the preset risk level table, the method further includes: According to the security risk level, a security risk warning strategy is output.

7. A security risk identification device, characterized in that: include: An acquisition module, used to acquire structured data and user data of the customer to be identified, wherein the structured data includes: device asset information, network traffic data, security event logs, configuration and compliance data; the user data includes: user identity information, user behavior data, security activity data, feedback and history record data; A processing module, configured to input the structured data and the user data into a trained deep learning model to obtain an impact factor, wherein the impact factor is the degree of impact of the structured data and the user data on the security risk of the customer to be identified; and to obtain security risk data of the customer to be identified according to the impact factor, the vulnerability factor, and the defense capability factor, wherein the vulnerability factor is the probability that the customer to be identified is attacked externally, and the defense capability factor is the defense capability of the customer to be identified against external power; The security risk determination module is used to determine the security risk level of the identified customer based on the security risk data and a preset risk level table, wherein the preset risk level table is provided with a corresponding relationship between the security risk data and the security risk level.

8. An electronic device, characterized in that: include: Processor and memory; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor performs the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and when the processor executes the computer-executable instructions, the method according to any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images