Data security risk assessment method based on unsupervised learning

Abstract

The invention discloses a data security risk assessment method based on unsupervised learning, and the method comprises the steps: firstly carrying out the analysis of typical marketing business scenes, such as user behavior portraits, directional activities, credit analysis, and the like, and obtaining a full-life-cycle security protection demand and a corresponding risk; and establishing an evaluation index set according to risk factor analysis, risk index selection and risk grade division. In consideration of low efficiency and limitation that a traditional fuzzy comprehensive evaluation method depends on expert scoring, the semantic similarity technology based on an improved Transform encoder is adopted, an interactive attention mechanism is combined, matching scoring of text service data and risk assessment elements is achieved, and a risk factor weight vector is effectively provided for the fuzzy comprehensive method. Then, a K-Means + + algorithm introducing a CLT (Center Limit Theorem) is utilized to optimize selection of a clustering center, unstable and inaccurate results caused by the defect of randomly selecting an initial center point are avoided, and finally, risk factor clustering is carried out according to the Euclidean distance. According to the method, the K-Means + + clustering algorithm introducing the CLT is adopted for risk assessment of the power business data to cluster risk factors, the clustering method that subjective and objective combination weight calculation is adopted for weighting the Euclidean distance is adopted for clustering instability, and the method can be effectively applied to safety risk assessment of the power business data.

Description

Technical Field

[0001] The present invention belongs to the field of data security under power marketing, and specifically relates to a K-Means clustering algorithm and a fuzzy comprehensive evaluation method. Background Art

[0002] In external cooperation channels, there are often risks of compliance, data leakage, eavesdropping, tampering, and illegal access to the system. Existing online cooperation channels rely on traditional network security means for protection, which only stay at the shallow analysis level of security risk value expert experience manual judgment, business process compliance, and data itself. There is no specific risk level classification of data, lack of risk identification control and early warning at the business level, and the efficiency of risk level classification is low.

[0003] Cluster analysis is an unsupervised machine learning method that refers to a group of data objects. It studies how to automatically divide data objects into different clusters so that objects in the same cluster have a higher degree of similarity to a certain extent, while data objects in different clusters have a lower degree of similarity. The characteristic of the K-means algorithm is that each iteration needs to re-judge whether each sample is assigned to the correct class. If the classification result does not meet the requirements, it will be corrected. After all sample classifications are corrected, it is considered that each sample is correctly divided into the corresponding class, and the cluster center is updated to start a new iteration. As a partition-based clustering algorithm, the K-means algorithm has a very low algorithm complexity, excellent clustering effect, and super high efficiency. It can effectively and accurately divide the risk level of risk factors in power marketing data. Summary of the invention

[0004] Purpose of the invention: This invention proposes a data security risk assessment method based on unsupervised learning that is unsupervised, highly efficient and accurate.

[0005] Technical solution: The data security risk assessment method based on unsupervised learning proposed in the present invention comprises the following steps:

[0006] (1) Analyze typical marketing business scenarios, obtain corresponding risks and needs, and establish a set of evaluation indicators.

[0007] (2) The fuzzy comprehensive evaluation method based on the improved Transformer encoder network is used to quantify the risk factor indicators.

[0008] (3) The K-Means++ algorithm with CLT (central limit theorem) is used to cluster risk factors and obtain the cluster centers.

[0009] The step (1) comprises the following steps:

[0010] (11) First, conduct a study on the security protection needs of the entire life cycle of scenario-based data openness, propose key points for data security protection throughout the entire life cycle, and use this as a basis to propose specific factors for the subsequent data risk assessment of power marketing business.

[0011] (12) Analyze the five stages of the life cycle and obtain the corresponding risk factors, such as Figure 3 shown.

[0012] (13) The risk assessment model divides risk factors into five subtypes from L1 to L5, with L1 representing the lowest risk level and L5 representing the highest risk level.

[0013] The definition and steps of quantifying various risk factor indicators using the fuzzy comprehensive evaluation method based on the improved Transformer encoder network in step (2) are as follows:

[0014] 1) Establish a comprehensive evaluation factor set

[0015] The factor set is a general set composed of various factors that affect the evaluation object. Figure 2 The 16 factors in the safety risk assessment index system are represented by U: U = (u1, u2, u3, ..., u m ), where element u i Represents the i-th factor that affects the evaluation object.

[0016] 2) Establish an evaluation set for comprehensive evaluation

[0017] The evaluation set is a set of various possible results that the evaluator may make on the evaluation object, represented by V: V = (v1, v2, v3, ..., v n ), where element v j Represents the j-th evaluation result. Here, the data is divided into five risk levels from L1 to L5, where L1 represents the lowest risk level and L5 represents the highest risk level.

[0018] 3) Carry out single factor fuzzy evaluation to obtain the evaluation matrix

[0019] The membership degree of the i-th element in the factor set U to the j-th element in the evaluation set V is r ij , then the result of the single factor evaluation of the i-th element is expressed by fuzzy set: R i =(r i1 ,r i2 , r i3 ,…,r in ), with m single factor evaluation sets R1, R2, …, R m The rows form the matrix R m*n, called the fuzzy comprehensive evaluation matrix. This membership matrix is ​​usually based on expert scoring. Since the influence of the factor set on the evaluation set is determined by the level of the corresponding indicator of each factor, this paper sets the membership of each element of the factor set to each element of the evaluation set as equal, that is, R m*n =R 16*5 is a matrix whose elements are all 1.

[0020] 4) Determine the risk factor weight vector

[0021] In the evaluation work, the risk contribution of each factor is different. Therefore, each factor is given i A weight a i , the fuzzy set of the weight set of each factor is represented by A: A = (a1, a2, a3, ..., a m ), through the improved Transformer network, each input data is semantically matched with the standard terms corresponding to each factor to obtain the matching contribution value. For factors 2 to 11, the larger the matching value, the larger the risk weight value, and here we directly draw an equal sign. For factors 1 and factors 12 to 16, the larger the matching value, the smaller the risk weight value, and here we use 1 minus the matching value to get the risk weight value, thereby obtaining the risk factor weight vector B, B = (b1, b2, b3, ..., b m ), the conversion is as follows:

[0022]

[0023] 5) Establish a comprehensive evaluation model

[0024] After determining the single factor evaluation matrix R and the factor weight vector B, the fuzzy vector B is transformed into a fuzzy vector C through fuzzy transformation, that is:

[0025] C=A 1*m *R m*n =(c1, c2, c3, ..., c n ) (1-2)

[0026] The value range of C is between (0, 1), which is the risk weight value of the input data at each risk level. The risk level corresponding to the maximum weight value is the risk status of the data.

[0027] 6) Establish a semantic similarity risk factor scoring model of a dual parallel twin network, which has a double twin structure. The overall twin structure is as follows Figure 4 As shown, it consists of 16 parallel sub-twin networks, which can simultaneously receive the same input data, compare it with the risk factors of 16 corresponding standard entries, and finally generate the risk factor weight vector of the data.

[0028] Specifically, data i and the standard entry k of security risks are input into the k-th sub-twin network simultaneously. First, operations such as text segmentation and punctuation removal are performed through the preprocessing layer; then, word embedding technology is used to map the words in the sentence into corresponding word vectors, converting data i into V i =(α1, α2, …, α l ), and the standard entry k is converted into V k =(β1, β2, …, β q ). Here, α l represents the word vector of the l-th word in data i, and β q represents the word vector of the q-th word in the standard entry k. Then, they enter their respective Transformer encoding layers respectively to obtain global semantic features, and the encoded word vectors are input into the interactive attention layer to obtain local semantic features. The feature fusion layer fuses and splices the global semantic features and local semantic features. Finally, text matching is performed through the fully connected layer, and the risk weight value of data i relative to the security risk factor k is output.

[0029] The step (3) includes the following steps:

[0030] K-Means++: Assume that n initial cluster centers have been selected (0 < n < K). Then, when selecting the (n + 1)-th cluster center, it is more inclined to select a point farther away from the currently selected n cluster centers. This can ensure that the distance between the new cluster center and the existing center points is relatively uniform, thus better representing the distribution of the data. By using the Euclidean distance method to measure the distance, K-Means++ can effectively optimize the selection of the initial cluster center, thereby improving the overall clustering effect.

[0031] The specific steps are as follows:

[0032] 1) Randomly select the first cluster center: Randomly select a sample from the dataset as the first cluster center C1

[0033] 2) Calculate the distance-weighted probability: For each sample, calculate the shortest distance from it to the selected cluster centers and use these distances as weights, and then normalize these weights into a probability distribution, where is the square of its Euclidean distance.

[0034] 3) Select the next cluster center according to the weighted probability distribution: For each sample point, calculate the probability that it is selected as the next cluster center, and this probability is proportional to the shortest distance from this point to the selected cluster centers.

[0035] 4) Repeat steps 2 - 3 until K cluster centers are selected.

[0036] 5) Designate the selected K cluster centers as the initial cluster centers, and then execute the standard K-Means clustering algorithm.

[0037] CLT (Central Limit Theorem) shows that: when n samples of equal size in a data set X are clustered, where k = 1, that is, when there is only one cluster center, the centroid of each sample can be obtained by estimating the centroid of the population. These n means are combined into a data set, and the centroid c is obtained by applying a clustering algorithm with k = 1. As the number of samples s and the sample size n increase, according to CLT, the centroid c will gradually approach the overall centroid μ.

[0038] In the present invention, if n samples are randomly selected from the data set X, each sample is divided into k parts with the centroid The centroids obtained by partitioning are then divided into k clusters. When n→∞, μ1, μ2, …, μ k Close to the true cluster center.

[0039] Here are the steps:

[0040] 1) Input data set X with n samples, number of clusters k, number of samples n, sample size s

[0041] 2) Create an empty set D, for i = 1, 2, ..., n, and randomly select n samples (S1, S2, ..., S1) of sample size s from the data set X. n )

[0042] 3) Use the above k-means++ algorithm to cluster the n samples into k clusters, and store the cluster centroids in C, that is, K-Means++ (S i ,k)→→(a i , c i )

[0043] 4) Run k-means++ on C to obtain the final cluster center set C final

[0044] 5) Finally, each factor in the data set X is assigned to the cluster where the nearest cluster center is located according to the weighted Euclidean distance

[0045] Beneficial effects: Compared with the traditional K-Means clustering algorithm, the beneficial effects of the present invention are: 1. Based on the business scenarios of power marketing data, the key points of data security protection throughout the life cycle are proposed, and relevant risk factors can be proposed more accurately. 2. Taking into account the inefficiency and limitations of the traditional fuzzy comprehensive evaluation method that relies on expert scoring, the present invention adopts the semantic similarity technology based on the improved Transformer encoder to achieve matching scores between text business data and risk assessment factors, and effectively provide risk factor weight vectors for the fuzzy comprehensive method, thereby achieving the classification of data security risks. Targeting the problem of low efficiency in large-scale data training. 3. The present invention introduces CLT (Central Limit Theorem) on the basis of K-Means++. Aiming at the situation where power marketing data is too complex, the efficiency of the algorithm operation is improved, and the clustering of risk indicators can be completed efficiently and in real time. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 Flow chart of the present invention

[0047] Figure 2 The algorithm flow chart of the present invention is

[0048] Figure 3 Data security risk assessment indicator system for power marketing business

[0049] Figure 4 The overall twin network architecture

[0050] Figure 5 shows the algorithm clustering results

[0051] Figure 6 shows the accuracy and F1-score graphs

[0052] Figure 7 UCI dataset used for the experiment

[0053] Figure 8 Comparison of clustering effects between the improved algorithm in this paper and K-Means++

[0054] Fig. 9 Comparison of performance indicators of this algorithm with other clustering algorithms

[0055] Fig.10 Marketing business data sample for a power company

[0056] Fig.11 Improve the model for text and compare the performance indicators of each model DETAILED DESCRIPTION

[0057] The present invention will be further described in detail below in conjunction with the accompanying drawings.

[0058] This paper starts with the business data of the marketing center of a provincial power company in May 2021, covering 23 business types such as payment, electricity application, electronic invoice, electricity subscription information, government convenience information, and government information certification through external channels such as electricity, finance, and government affairs. The clustering effect of the algorithm of the present invention is tested using the UCI machine learning database, which mainly includes the Iris dataset, the wine dataset, and the aggregation dataset. The dataset description is as follows Fig. 9 First, analyze the typical marketing business scenarios, obtain the corresponding needs and risks, and establish an evaluation indicator set, such as Figure 3 As shown. Then, the K-Means++ clustering algorithm introduced with CLT is used to obtain the cluster center C that is closest to the actual cluster center. i , cluster the risk indicators in the risk assessment system by weighted Euclidean distance to complete the risk assessment. Therefore, this paper proposes a power business data security assessment method based on unsupervised learning. The specific steps are as follows:

[0059] 1. Analyze typical marketing business scenarios, obtain corresponding risks and needs, and establish a set of evaluation indicators.

[0060] 2. Use the K-Means++ algorithm that introduces CLT (central limit theorem) to cluster risk factors and obtain the cluster center.

[0061] 1) According to the corresponding risks and requirements obtained from the above analysis, the appropriate number of clusters for the data set is determined to be k = 5

[0062] 2) Use K-Means++ introduced with CLT to obtain the final cluster center set C final , the steps are: input a data set X containing n samples, the number of clusters k, the number of samples n, and the sample size s.

[0063] 3) Create an empty set D, for i = 1, 2, ..., n, and randomly select n samples (S1, S2, ..., S1) of sample size s from the data set X. n )

[0064] 4) Use the above k-means++ algorithm to cluster these n samples into k clusters and cluster them

[0065] 5) The centroid is stored in C, i.e. K-Means++(S i ,k)-→(a i ,c i ), run k-means++ on C to obtain the final cluster center set C final .

[0066] Comparison of clustering indicators of different algorithms such as Figure 8 shown.

[0067] 3. In order to evaluate the rationality of the initial clustering center selected by the algorithm, the experiment used a clustering criterion function error square sum δ to evaluate the clustering effect. SSE The calculation formula is:

[0068]

[0069] Among them, ||||2 is the Euclidean norm, y j Q i The center of |Q i | is cluster Q i The number of samples included.

[0070] The error sum of squares δ SSE The smaller the value is, the closer the selected cluster center is to the real cluster center.

[0071] Figure 5 shows the clustering results of K-mean++ and the improved algorithm in this paper on the data set aggregation. The figures marked in each figure are each cluster, among which figure a is the clustering result of K-mean++, and figure b is the clustering result of the improved algorithm in this paper. When the clusters are clear, the clustering effects of the two are similar, but when the clusters are not clear, it can be seen that the cluster center of K-mean++ introduced with CLT is closer to the real cluster center. The comparison effect is as follows Fig. 9 As shown in the figure, its clustering accuracy is higher than that of traditional K-means, and the number of iterations is less than that of K-means++, which can complete risk assessment efficiently and accurately.

[0072] 4. In order to verify the effectiveness of the model proposed in this paper and the scalability of different business data, the present invention starts with the business data of the marketing center of a provincial power company in May 2022, and randomly selects the 223rd business data sample as follows Fig.10 shown.

[0073] In order to judge the effectiveness of the security risk assessment model, it is necessary to establish a complete and effective result evaluation index system. Here, we use the accuracy score (Precision) and F1-score as the final result evaluation index, and the formula is defined as follows:

[0074] Accuracy, also known as precision (P):

[0075]

[0076] F1-score:

[0077]

[0078] Among them, TP represents the number of positive examples whose true category is positive and whose predicted category is positive; FP represents the number of positive examples whose true category is negative; and FN represents the number of negative examples whose true category is positive.

[0079] In terms of experimental result analysis, we introduce the safety risk assessment model based on the conventional Transformer encoder (Transformer for short) and the fuzzy comprehensive evaluation method (FCE) respectively. We compare the experimental results of the first two improved methods with the fuzzy comprehensive evaluation model based on the dual parallel twin Transformer encoder network (S_Transformer for short) constructed in this paper. We visualize the accuracy score and F1-score of the 50 iteration results in a box plot, as shown in Figure 6(a) and Figure 6(b), and use the average value as Fig.11 exhibit.

Claims

1. A risk assessment method for power business marketing data based on unsupervised learning, characterized in that (1) Analyze typical marketing business scenarios to obtain corresponding risks and requirements, and establish an evaluation index set. (2) Quantify each risk factor index by using a fuzzy comprehensive evaluation method based on an improved Transformer encoder network. (3) Use the K-Means++ algorithm introduced with the CLT (Central Limit Theorem) to cluster risk factors and obtain the cluster centers.

2. According to claim 1, a method for risk assessment of power business marketing data based on unsupervised learning is characterized in that: The step (1) includes the following steps: (11) First, conduct research on the full-life cycle security protection requirements based on scenario-based data opening, propose the key points of data full-life cycle security protection, and based on this, put forward specific factors for the subsequent risk assessment of power marketing business data. (12) Analyze the five stages of the full life cycle to obtain corresponding risk factors, as shown in Figure 3. (13) The risk assessment model divides the risk factors into five subtypes from L1 to L5, where L1 represents the lowest risk level and L5 represents the highest risk level.

3. According to claim 1, a method for risk assessment of power business marketing data based on unsupervised learning is characterized in that: The quantification process and definition of each risk factor index by using the fuzzy comprehensive evaluation method based on the improved Transformer encoder network described in step (2) are as follows: 1) Establish a factor set for comprehensive evaluation The factor set is a general set composed of various factors that affect the evaluation object as elements, corresponding to the 16 factors in the safety risk assessment index system in Figure 2, represented by U: U = (u1, u2, u3, ..., u m ), where element u i Represents the i-th factor that affects the evaluation object. 2) Establish an evaluation set for comprehensive evaluation The evaluation set is a set of various possible results that the evaluator may make on the evaluation object, represented by V: V = (v1, v2, v3, ..., v n ), where element v j Represents the j-th evaluation result. Here, the data is divided into five risk levels from L1 to L5, where L1 represents the lowest risk level and L5 represents the highest risk level. 3) Conduct single-factor fuzzy evaluation to obtain an evaluation matrix The membership degree of the i-th element in the factor set U to the j-th element in the evaluation set V is r ij , then the result of the single factor evaluation of the i-th element is expressed by fuzzy set: R i =(r i1 ,r i2 , r i3 ,…,r in ), with m single factor evaluation sets R1, R2, …, R m The rows form the matrix R m*n , called the fuzzy comprehensive evaluation matrix. This membership matrix is ​​usually based on expert scoring. Since the influence of the factor set on the evaluation set is determined by the level of the corresponding indicator of each factor, this paper sets the membership of each element of the factor set to each element of the evaluation set as equal, that is, R m*n =R 16*5 is a matrix whose elements are all 1. 4) Determine the weight vector of risk factors In the evaluation work, the risk contribution of each factor is different. Therefore, each factor is given i A weight a i , the fuzzy set of the weight set of each factor is represented by A: A = (a1, a2, a3, ..., a m ), through the improved Transformer network, each input data is semantically matched with the standard terms corresponding to each factor to obtain the matching contribution value. For factors 2 to 11, the larger the matching value, the larger the risk weight value, and here they are directly equal. For factors 1 and factors 12 to 16, the larger the matching value, the smaller the risk weight value. Here, 1 minus the matching value is used to obtain the risk weight value, thereby obtaining the risk factor weight vector B, B = (b1, b2, b3, ..., b m ), the conversion is as follows: 5) Establish a comprehensive evaluation model After determining the single-factor judgment matrix R and the factor weight vector B, the fuzzy vector B is changed into a fuzzy vector C through fuzzy transformation, that is: C=A 1*m *R m*n =(c1,c2,c3,…,c n ) (1-2) The value range of C is between (0, 1), which is the risk weight value of the input data at each risk level. The risk level corresponding to the maximum weight value is the risk state of the data. 6) Establish a semantic similarity risk factor scoring model for the dual parallel siamese network, which has a two-fold siamese structure. The overall siamese structure is shown in Figure 3 and consists of 16 parallel sub-siamese networks. It can simultaneously receive the same input data, compare it with the risk factors of 16 corresponding standard entries, and finally generate the risk factor weight vector of the data. Specifically, data i and security risk standard term k are simultaneously input into the kth sub-twin network. First, the preprocessing layer performs text segmentation and punctuation removal. Then, the word embedding technology is used to map the words in the sentence into corresponding word vectors, so that data i is converted into V i =(ɑ1,ɑ2,…,ɑ l ), the standard entry k is converted to V k =(β1, β2, ..., β q ). Here, ɑ l Represents the word vector of the lth word in data i, β q The word vector represents the qth word in the standard term k. Then they enter their respective Transformer encoding layers to obtain global semantic features, and the encoded word vectors are input into the interactive attention layer to obtain local semantic features. The feature fusion layer fuses and splices the global semantic features and local semantic features. Finally, text matching is performed through the fully connected layer, and the risk weight value of data i relative to the security risk factor k is output.

4. The method for risk assessment of power business marketing data based on unsupervised learning according to claim 1 is characterized in that: The step (3) includes the following steps: K-Means++: Assume that n initial cluster centers have been selected (0 < n < K). When selecting the (n + 1)-th cluster center, it is more likely to select a point farther away from the currently selected n cluster centers. This can ensure that the distance between the new cluster center and the existing center points is relatively uniform, thus better representing the data distribution. By using the Euclidean distance method to measure the distance, K-Means++ can effectively optimize the selection of the initial cluster center, thereby improving the overall clustering effect. The specific steps are as follows: 1) Randomly select the first cluster center: Randomly select a sample from the dataset as the first cluster center C1 2) Calculate the distance weighted probability: For each sample, calculate the shortest distance from it to the selected cluster center These distances are used as weights, and then these weights are normalized into a probability distribution, where is the square of its Euclidean distance. 3) Weighted probability distribution to select the next cluster center: For each sample point, calculate the probability of it being selected as the next cluster center. This probability is related to the shortest distance from the point to the selected cluster center. Directly proportional. 4) Repeat steps 2 - 3 until K cluster centers are selected. 5) Designate the selected K cluster centers as the initial cluster centers, and then execute the standard K-Means clustering algorithm. CLT (Central Limit Theorem) shows that: when n samples of equal size in a data set X are clustered, where k = 1, that is, when there is only one cluster center, the centroid of each sample can be obtained by estimating the centroid of the population. These n means are combined into a data set, and the centroid c is obtained by applying a clustering algorithm with k = 1. As the number of samples s and the sample size n increase, according to CLT, the centroid c will gradually approach the overall centroid μ. In the present invention, if n samples are randomly selected from the data set X, each sample is divided into k parts with the centroid The centroids obtained by partitioning are then divided into k clusters. When n→∞, μ1, μ2, …, μ k Close to the true cluster center. Here are the steps: 1) Input data set X with n samples, number of clusters k, number of samples n, sample size s 2) Create an empty set D, for i = 1, 2, ..., n, and randomly select n samples (S1, S2, ..., S1) of sample size s from the data set X. n ) 3) Use the above k-means++ algorithm to cluster the n samples into k clusters, and store the cluster centroids in C, that is, K-Means++ (S i ,k)→(a i , c i ) 4) Run k-means++ on C to obtain the final cluster center set C final 5) Finally, each factor in the data set X is assigned to the cluster where the nearest cluster center is located according to the weighted Euclidean distance.

Images