A financial management system based on big data

Abstract

The invention discloses a financial management system based on big data, relates to the technical field of big data, and comprises: an identity matching verification module, a risk assessment module, an early warning module and a feedback optimization module; the identity matching verification module is used to confirm whether the identity information of the current visitor matches the identity information in a database when a user accesses sensitive data, and after confirming that the identity information of the current visitor matches the identity information in the database successfully, obtain the access rights required for accessing the current sensitive data, and determine whether the current visitor matches the access rights required for accessing the sensitive data according to pre-set rules; on the one hand, the situation that the current visitor requests to access sensitive data can be notified to the superior leader without alarming him; on the other hand, after the visitor's identity authentication is passed, the superior leader can confirm again, so that the protection of sensitive data can be strengthened through a double verification mechanism.

Description

Technical Field

[0001] The present invention relates to the field of big data technology, and more specifically, to a financial management system based on big data. Background Art

[0002] Financial management systems refer to software systems or platforms used to manage and monitor the business activities of financial institutions. These systems are designed to improve the operational efficiency, risk management and decision-making capabilities of financial institutions;

[0003] In the field of financial management, given the high sensitivity of certain data, financial systems need to implement sophisticated permission management for data access based on different roles and situations. However, in actual application, if permissions are not configured properly or permissions are not adjusted in a timely manner after employee responsibilities change, sensitive information may be inappropriately disclosed, thereby increasing the risk of serious data leakage. It is also difficult for visitors to achieve fine-grained rights confirmation, authentication and control over access to core data, which in turn poses a risk of data privacy leakage. Summary of the invention

[0004] To solve the above problems, the present invention provides a financial management system based on big data.

[0005] The present invention provides a financial management system based on big data, comprising: an identity matching verification module, a risk assessment module, an early warning module and a feedback optimization module;

[0006] The identity matching verification module is used to confirm whether the identity information of the current visitor matches the identity information in the database when a user accesses sensitive data, and after confirming that the identity information of the current visitor matches the identity information in the database, obtain the access rights required to access the current sensitive data, and determine whether the current visitor matches the access rights required to access the sensitive data according to pre-set rules;

[0007] If the identity information of the current visitor matches the access rights, the current user is allowed to access sensitive data;

[0008] If the identity information of the current visitor does not match the identity information in the database or the identity information of the current user does not match the access rights, a suspend wait operation is generated and the information is fed back to the risk assessment module;

[0009] The risk assessment module is used to assess the risk level of the current visitor's access to sensitive data during the execution of the suspend wait operation and generate corresponding risk information, and feed the risk information back to the early warning module;

[0010] The early warning module is used to generate early warning information after receiving risk information fed back by the risk assessment module;

[0011] After receiving the warning information from the warning module, the feedback optimization module determines whether the risk assessment module needs to be optimized based on the warning information.

[0012] Preferably, if the identity information of the current visitor matches the access rights, before the current user is allowed to access sensitive data, the operation process of the identity matching verification module further includes the following steps:

[0013] Send confirmation message to the current visitor's superior;

[0014] Generate a confirmation code based on the confirmation information of the current visitor's superior;

[0015] The confirmation code is sent to the current visitor, who then accesses sensitive data based on the confirmation code.

[0016] Preferably, the specific steps of the risk assessment module assessing the risk level and generating corresponding risk information are:

[0017] Determine a mismatch type according to mismatch information of the current visitor, wherein the mismatch type includes a first mismatch type and a second mismatch type;

[0018] Determine the risk level as the first level based on the first mismatch type, generate first warning information, perform a denial of access operation and send risk information to the warning module;

[0019] The risk level is determined to be a second level based on the second mismatch type, a second warning message is generated, and the risk assessment is re-executed.

[0020] Preferably, the specific method of determining the risk level as the second level based on the second mismatch type and re-performing the risk assessment is:

[0021] Confirm whether the current visitor's access rights have been adjusted in the past three months. If so, retrieve the current visitor's access rights before the adjustment and determine whether the access rights before the adjustment can access the current sensitive data;

[0022] If the access permission before adjustment of the current visitor allows access to the sensitive data, the first operation is performed;

[0023] If the access rights before adjustment of the current visitor cannot access the sensitive data, the second operation is performed.

[0024] Preferably, the specific steps of performing the first operation are:

[0025] Analyze the visitor's access time, frequency, operation path and sequence in the system;

[0026] Determine if there are similarities between the visitor's current actions and previous actions;

[0027] If there is similarity, it is marked as the first suspicious signal;

[0028] Check the correlation between the sensitive data accessed by the current visitor and their own business data;

[0029] If there is a correlation, it is marked as the second doubt signal;

[0030] Retrieve the completeness of the current visitor's access to sensitive data;

[0031] If the current user does not conduct a large-scale in-depth visit, it is marked as the third suspicious signal;

[0032] When there are at least two questionable signals, it is determined to be an erroneous operation, otherwise, the second operation is performed.

[0033] Preferably, the specific steps of performing the second operation are:

[0034] Automatically terminate any further operations of the visitor with sensitive data;

[0035] Temporarily lock the visitor's account or related permissions;

[0036] Check system logs and access records to see the visitor's recent login location, time, and operation behavior to determine whether there are any abnormalities;

[0037] Generate feedback information to the early warning module for early warning.

[0038] Preferably, the specific steps for the early warning module to generate early warning information after receiving the risk information fed back by the risk assessment module are:

[0039] Retrieve the IP information of the current visitor;

[0040] Retrieve all operations of the current visitor based on IP information;

[0041] All visitor operations will generate early warning information and send it to the security department for risk review.

[0042] Preferably, the step of generating warning information of all operations of the visitor and sending it to the security department for risk review is as follows:

[0043] Get the number n of risk factors of current warning information;

[0044] According to the formula Get the comprehensive risk value;

[0045] Among them, L i represents the probability of occurrence of the i-th risk factor;

[0046] C iIndicates the impact caused by the occurrence of the i-th risk factor;

[0047] W i It represents the weight of the i-th risk factor in the overall assessment, reflecting the importance of this factor relative to other factors.

[0048] Preferably, the step of generating warning information from all operations of the visitor and sending it to the security department for risk review also includes allocation of security resources, specifically:

[0049] According to the formula Get the amount of resources allocated to the i-th processing task or link at time t;

[0050] Among them, R t is the total amount of resources available for processing warning information at time t;

[0051] m is the total number of processing tasks or links;

[0052] P i Represents the priority coefficient of the i-th processing task;

[0053] S i is the complexity coefficient of the i-th processing task;

[0054] I i represents the correlation influence coefficient of the i-th processing task;

[0055] α, β, and γ are weight parameters corresponding to priority, complexity, and association impact, respectively.

[0056] Preferably, the specific content of the warning information includes at least predicting the type of sensitive data security incidents that may occur, clarifying the scope of sensitive data assets that may be affected, and the degree of harm based on the current security situation and risk assessment results.

[0057] Beneficial effects:

[0058] 1. After the visitor's identity information is successfully matched, confirmation is conducted with the current visitor's superior. On the one hand, the superior can be informed of the current visitor's request to access sensitive data without alerting the superior. On the other hand, by establishing a connection between the visitor and the superior, the superior can confirm again after the visitor's identity authentication is passed. In this way, the protection of sensitive data can be strengthened through a double verification mechanism.

[0059] 2. Analyze the visitor's recent permission adjustments to determine whether the access error was caused by the failure to notify relevant personnel in a timely manner of the permission adjustment. Based on the above situation, further analysis of the situation is needed to avoid such situations caused by permission adjustments without timely notification.

[0060] 3. The comprehensive risk assessment formula aims to comprehensively and accurately quantify risks and provide a basis for decision-making; the dynamic resource allocation formula is to reasonably allocate resources according to the risk situation to achieve effective control and response to risks, and jointly serve the overall goal of sensitive data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 It is a flow chart of the management system of the present invention. DETAILED DESCRIPTION

[0062] Application scenarios: In the field of financial management, given the high sensitivity of certain data, financial systems need to implement sophisticated permission management for data access based on different roles and situations. However, in actual application, if permissions are improperly configured or if permissions are not adjusted in a timely manner after employee responsibilities change, sensitive information may be inappropriately disclosed, thereby increasing the risk of serious data leakage. It is also difficult for visitors to achieve fine-grained rights confirmation, authentication, and control over access to core data, which in turn poses a risk of data privacy leakage.

[0063] like Figure 1 As shown: A financial management system based on big data, including: identity matching and verification module, risk assessment module, early warning module and feedback optimization module;

[0064] The identity matching and verification module is used to confirm whether the identity information of the current visitor matches the identity information in the database when a user accesses sensitive data, and after confirming that the identity information of the current visitor matches the identity information in the database, obtain the access rights required to access the current sensitive data, and determine whether the current visitor matches the access rights required to access the sensitive data based on pre-set rules; it should be noted that the identity matching and verification module verifies the data information provided by the visitor, such as identity information, fingerprints, etc., with the information in the database in the current management system to determine whether they match.

[0065] If the identity information of the current visitor matches the access rights, the current user is allowed to access sensitive data;

[0066] If the identity information of the current visitor does not match the identity information in the database or the identity information of the current user does not match the access rights, a suspend wait operation is generated and the information is fed back to the risk assessment module;

[0067] It should be noted that when the identity information of the current visitor fails to pass the verification match, a suspended waiting operation is temporarily generated on the access page, thereby buying time for subsequent verification and avoiding the visitor's early exit.

[0068] The risk assessment module is used to assess the risk level of the current visitor's access to sensitive data during the execution of the suspend wait operation and generate corresponding risk information, and feed the risk information back to the early warning module;

[0069] The early warning module is used to generate early warning information after receiving risk information fed back by the risk assessment module;

[0070] After receiving the warning information from the early warning module, the feedback optimization module determines whether the risk assessment module needs to be optimized based on the warning information; it should be noted that when the feedback optimization module receives the warning information from the early warning information module, it will immediately start the analysis program. It first analyzes the key elements of the warning information, such as the type, severity, and scope involved. Then, this information is compared with the pre-set risk assessment optimization trigger conditions. If the warning information indicates that there are loopholes in the current risk assessment system, such as the neglect of a new type of risk, the deviation of the assessment model in a specific situation, etc., the feedback optimization module will optimize and adjust the risk assessment module in a targeted manner based on the established optimization strategy and algorithm. This may include updating the evaluation indicator weights, introducing new evaluation variables, and modifying the calculation formula of the evaluation model to ensure that the risk assessment module can identify and evaluate risks more accurately and effectively, thereby providing a reliable basis for subsequent decision-making and risk response measures. Otherwise, no optimization is required.

[0071] It should be noted that in the financial management system, if a user accesses sensitive data, the identity information of the current visitor is first verified and matched through the identity matching and verification module to determine whether the access rights of the current visitor match the access rights required to access the current sensitive data. If the match is successful, the current visitor is allowed to access;

[0072] When the identity information does not match, a suspended waiting operation is temporarily generated on the access page to buy time for subsequent verification and avoid the visitor's premature exit. The risk level of the current visitor's access is assessed through the risk assessment module, and an early warning is issued through the early warning module to prevent data leakage.

[0073] As a further embodiment, if the identity information of the current visitor matches the access rights, before the current user is allowed to access sensitive data, the operation process of the identity matching verification module further includes the following steps:

[0074] Send confirmation message to the current visitor's superior;

[0075] Generate a confirmation code based on the confirmation information of the current visitor's superior;

[0076] Send the confirmation code to the current visitor, and the visitor accesses sensitive data based on the confirmation code;

[0077] It should be noted that after the visitor's identity information is successfully matched, confirmation is made with the current visitor's superior. On the one hand, the superior can be informed of the current visitor's request to access sensitive data without alerting the superior. On the other hand, by establishing a connection between the visitor and the superior, the superior can confirm again after the visitor's identity authentication is passed. In this way, the protection of sensitive data can be strengthened through a double verification mechanism.

[0078] As a further embodiment, the specific steps of the risk assessment module assessing the risk level and generating corresponding risk information are:

[0079] The mismatch type is determined based on the mismatch information of the current visitor, and the mismatch type includes a first mismatch type and a second mismatch type. It should be noted that the first mismatch type is that the identity information of the current visitor does not match the identity information in the database; the second mismatch type is that the identity information of the current user does not match the access rights.

[0080] The risk level is determined to be the first level based on the first mismatch type, a first warning message is generated, an access denial operation is performed, and risk information is sent to the warning module; it should be noted that the first level is that the risk of the current visitor accessing sensitive data is high.

[0081] Based on the second mismatch type, the risk level is determined to be the second level, a second warning message is generated, and the risk assessment is re-performed. It should be noted that when the risk level is the second level, a risk assessment needs to be performed again to further assess whether there is a corresponding risk in the current visitor accessing sensitive data;

[0082] It should be noted that by classifying risk levels through identity matching information and further processing after obtaining the corresponding risk levels, on the one hand, it is beneficial to reduce the leakage of sensitive data through multiple risk assessments, and on the other hand, by classifying risk levels to trigger corresponding different operations, it is beneficial to protect sensitive data. It should be noted that in this embodiment, the system will monitor the employee's responsibility change information regularly or in real time, which may come from the update of the human resources management system (HRMS) or directly from the instructions of the management; once a responsibility change is detected, the system will automatically trigger the permission adjustment process to ensure that the employee's access rights match his new responsibilities;

[0083] During the permissions adjustment process, the system will compare the employee’s new responsibilities with their current access rights and identify any mismatches;

[0084] If the first mismatch type is found (the identity information does not match the identity information in the database), the system will immediately set the risk level to the first level and generate the first warning information, while performing the access denial operation and sending the risk information to the warning module to prevent the leakage of sensitive data;

[0085] If the second mismatch type is found (identity information does not match access rights), the system will set the risk level to the second level, generate a second warning message, and then re-perform the risk assessment to further determine whether there is a risk of accessing sensitive data;

[0086] By assessing risks multiple times, the system can reduce the leakage of sensitive data caused by failure to adjust permissions in a timely manner;

[0087] In the second level of risk assessment, the system may take additional measures, such as temporarily restricting access, notifying administrators for manual review, or requiring employees to re-verify their identities to ensure that only authorized personnel can access sensitive data;

[0088] If it is found that the responsibilities have been changed but the permissions have not been adjusted accordingly, the security administrator and the relevant department heads will be automatically notified so that timely measures can be taken;

[0089] As a further embodiment, the specific method of determining the risk level as the second level based on the second mismatch type and re-performing the risk assessment is:

[0090] Confirm whether the current visitor's access rights have been adjusted in the last three months. If so, retrieve the current visitor's access rights before the adjustment and determine whether the access rights before the adjustment can access the current sensitive data. It should be noted that the time for confirming whether the current visitor's access rights have been adjusted in the last three months can be confirmed based on actual needs, for example, it can be adjusted to the last month or the last six months.

[0091] If the access permission before adjustment of the current visitor allows access to the sensitive data, the first operation is performed;

[0092] If the access rights before adjustment of the current visitor cannot access the sensitive data, the second operation is performed;

[0093] It should be noted that, assuming that there are three types of permissions within an enterprise, namely high permissions, medium permissions and low permissions, and corresponding high-sensitivity data, medium-sensitivity data and low-sensitivity data, it is limited that high permissions can access high-sensitivity data, and so on;

[0094] When the risk level is the second level, first confirm whether the visitor's access rights have been adjusted within three months. For example, if the current visitor requests to access highly sensitive data, the visitor's rights before the adjustment were high rights, and the visitor has access rights, but the current rights after the adjustment are medium rights, and the visitor has no access rights, then the first operation is performed;

[0095] If the visitor's permission before adjustment is low permission, and he does not have access rights, and the permission after adjustment is medium permission, and he still does not have access rights, then the second operation is performed;

[0096] By analyzing the visitor's recent permission adjustments, we can determine whether the access blunder is caused by the failure to notify relevant personnel in a timely manner of the permission adjustment. Based on the above situation, it is necessary to further analyze the situation to avoid such situations caused by permission adjustments without timely notification.

[0097] As a further embodiment, the specific steps of performing the first operation are:

[0098] Analyze the visitor's access time, frequency, operation path and sequence in the system; it should be noted that under normal circumstances, the visitor's access time and frequency in the system are that users' access to core data is usually during working hours and has a certain pattern. Frequent abnormal access during non-working hours or within a short period of time may indicate malicious behavior; if the visitor's operation path and sequence are very different from the normal business process, such as skipping key steps to directly access core data, it may be malicious behavior.

[0099] Determine whether there is any similarity between the visitor's current operation and the previous operation; it should be noted that by monitoring the visitor's operation before the adjustment, if there is similarity, similarity means that there is at least 80% repetition between the current visitor's operation of accessing sensitive data and the operation before the adjustment, then there is similarity.

[0100] If there is similarity, it is marked as the first suspicious signal;

[0101] Check the correlation between the sensitive data accessed by the current visitor and his own business data; it should be noted that if the accessed data has nothing to do with the data that the user usually processes, it may be malicious behavior, because if the currently accessed data is used for the needs of its own business, malicious operations may not be possible. On the contrary, if the core data accessed is not related to its own business, there is a high possibility of malicious intent.

[0102] If there is a correlation, it is marked as the second doubt signal;

[0103] Retrieve the completeness of the current visitor's access to sensitive data; it should be noted that if the user only accesses a small part of the core data and does not perform further operations, it may be a missed click; if a large-scale and in-depth access is performed, the possibility of erroneous operation is smaller.

[0104] If the current user does not conduct a large-scale in-depth visit, it is marked as the third suspicious signal;

[0105] When there are at least two doubtful signals, it is determined to be an erroneous operation, otherwise, the second operation is performed;

[0106] It should be noted that by comprehensively analyzing the user's behavioral characteristics and data access patterns, the visitor's true intentions can be revealed more accurately. This analysis helps to identify potential malicious access behaviors and thus strengthen the security protection of sensitive data.

[0107] And through multi-dimensional judgment, it helps to improve the accuracy of judgment and provide factual basis for the next step of operation.

[0108] It should be noted that the purpose is to improve the system's ability to monitor and analyze sensitive data access behaviors, so as to more accurately identify and prevent potential malicious behaviors, while reducing interference with normal business processes. This solution comprehensively analyzes the user's access patterns, behavioral characteristics, and specific circumstances of data access to assess whether each visitor's behavior is normal, thereby protecting sensitive data from unauthorized access or leakage;

[0109] For example:

[0110] Assume that an employee usually accesses the system between 9:00 and 18:00 on weekdays, and the access frequency is relatively stable. However, the system detects that the employee frequently accesses the system at 3:00 in the morning, and the access path does not match the daily workflow. The system skips the regular steps and directly accesses the core data.

[0111] Suppose an employee in the finance department usually only accesses data related to financial reports. The system finds that the employee suddenly starts accessing sensitive data related to human resources, and the access pattern is more than 80% repeated with previous operations, which indicates a possible internal threat.

[0112] Suppose an employee in the R&D department usually needs to access the complete project data set for analysis. The system detects that the employee has only accessed a small part of the data and has not taken any further action. This may be an error, but if the access is extensive and in-depth, it may be intentional.

[0113] By analyzing access time, frequency, and operation paths, the system can identify abnormal behaviors, such as access during non-working hours or directly accessing core data by skipping key steps, so as to provide early warning and take measures to reduce the risk of data leakage;

[0114] By comparing the similarity between the current operation and the previous operation, the system can distinguish between normal behavior and potential malicious behavior, reducing false positives caused by misjudging normal operations;

[0115] As a further embodiment, the specific steps of performing the second operation are:

[0116] Automatically terminate any further operations of the visitor with sensitive data;

[0117] Temporarily lock the visitor's account or related permissions;

[0118] Check system logs and access records to see the visitor's recent login location, time, and operation behavior to determine whether there are any abnormalities;

[0119] Generate feedback information to the early warning module for early warning.

[0120] It should be noted that when executing the second operation, it is confirmed that there is a greater risk of visitor's access at this time. At this time, it needs to be fed back to a higher-level department for review, and follow-up investigation should be carried out by locking the visitor's account and related permissions, so as to facilitate timely intervention to prevent further operations of the current account, thereby reducing the risk of data leakage.

[0121] As a further embodiment, the specific steps for the early warning module to generate early warning information after receiving the risk information fed back by the risk assessment module are:

[0122] Retrieve the IP information of the current visitor;

[0123] Retrieve all operations of the current visitor based on IP information;

[0124] Generate early warning information for all visitor operations and send it to the security department for risk review;

[0125] It should be noted that the generated warning information should include all operations of the current visitor to facilitate the security department to review the visitor's operations to rule out other risks, thereby helping to better protect sensitive data.

[0126] As a further embodiment, the generation of warning information of all operations of the visitor and sending it to the security department for risk review is specifically as follows:

[0127] Get the number n of risk factors of current warning information;

[0128] According to the formula Get the comprehensive risk value;

[0129] Among them, L irepresents the probability of occurrence of the i-th risk factor; it should be noted that L i The value range is usually set between 0 and 1, and can be obtained through comprehensive analysis of historical statistical data, related abnormal frequencies monitored by the current system, etc.

[0130] It should be noted that the specific calculation method can be to obtain historical statistical data and the relevant abnormal frequency monitored by the current system, and then divide them by 2 to obtain the probability L of the occurrence of the i-th risk factor. i , for example, historical statistics: risk event X occurred 15 times in the past 100 cases, so the historical probability is 0.15;

[0131] In the past month, the abnormal frequency monitored by the system indicates that the probability of risk event X is 0.20;

[0132] Finally, we get the probability L of the occurrence of the i-th risk factor i is 0.175.

[0133] C i Indicates the impact of the i-th risk factor once it occurs; it should be noted that C i The value range is also between 0 and 1, and needs to be determined based on the importance level of the core data (for example, different levels of importance are divided and quantified according to business secrets, key business data, general data, etc.), the size of the business scope involved, the depth of impact on organizational operations, etc.

[0134] It should be noted that the specific determination method may be:

[0135] According to the national standard GB / T43697-2024 "Data Security Technology Data Classification and Grading Rules", data is divided into three levels: general data, important data and core data;

[0136] We can quantify these three levels into numerical values: general data = 1, important data = 3, core data = 5;

[0137] The size of the business scope can be quantified based on the number of departments covered by the business or the complexity of the business processes;

[0138] For example, if a risk factor affects 1-3 departments, it can be assigned a value of 1; if it affects 4-6 departments, it can be assigned a value of 2; if it affects 7 or more departments, it can be assigned a value of 3;

[0139] The depth of impact can be quantified in terms of the duration of disruption to the organization’s operations, the cost of recovery, and the potential financial losses after a risk occurs.

[0140] For example, if the organization's operations are interrupted for no more than 1 day after the risk occurs, the value is assigned to 1; 1-3 days, the value is assigned to 2; more than 3 days, the value is assigned to 3;

[0141] Then add the above three quantitative values ​​and finally divide them by 3 to get the impact C caused by the occurrence of the i-th risk factor. i ; In general, the importance level of core data (for example, different importance levels and quantitative values ​​according to business secrets, key business data, general data, etc.), the business scope involved, and the depth of impact on organizational operations are the same, so they are divided by 3. If they are different, the staff needs to input the preset weight;

[0142] To facilitate understanding, we further explain through examples:

[0143] Assume that a company receives a core data security warning message, indicating that there may be a risk of data leakage. After analysis, the following three risk factors are taken into consideration: the possibility of external attack L1 = 0.6, the possibility of internal personnel misoperation L2 = 0.3, and the risk of system vulnerability L3 = 0.5;

[0144] Once a data leak occurs, the impact caused by external attacks is C1 = 0.8, the impact caused by internal personnel's misoperation is C2 = 0.6, and the impact caused by system vulnerabilities is C3 = 0.7;

[0145] After expert evaluation, the weights of each risk factor were determined to be W1 = 0.4, W2 = 0.3, and W3 = 0.3;

[0146] According to the comprehensive risk assessment formula We can get:

[0147] R=L1×C1×W1+L2×C2×W2+L3×C3×W3=0.351;

[0148] Based on the risk standards set in advance by the enterprise, the risk level can be obtained, and then response measures corresponding to the risk level can be initiated.

[0149] W i It represents the weight of the i-th risk factor in the overall assessment, reflecting the importance of this factor relative to other factors. It should be noted that The weight distribution can be determined by expert evaluation, hierarchical analysis method, etc. The specific value selection method can be:

[0150] Decompose the problem into three levels: target level (assessing the overall importance of risk factors), criterion level (various aspects of the impact of risk factors, such as the possibility of occurrence, degree of impact, etc.), and solution level (specific risk factors);

[0151] For each factor in the criteria layer, and the risk factors in the scenario layer, compare them two by two to determine their relative importance;

[0152] A 1-9 scale is often used to indicate relative importance, where 1 means that both factors are equally important and 9 means that one factor is extremely more important than the other;

[0153] According to the pairwise comparison matrix, the relative weight of each factor is calculated. The weight can be obtained by normalizing each column of the pairwise comparison matrix and then taking the average value;

[0154] It should be noted that by calculating the R value, the risk level corresponding to the warning information can be more accurately determined, and then response measures at different levels can be collected;

[0155] The comprehensive risk assessment formula aims to quantify risks comprehensively and accurately to provide a basis for decision-making; the dynamic resource allocation formula aims to rationally allocate resources according to the risk situation to achieve effective control and response to risks, and jointly serve the overall goal of sensitive data security.

[0156] As a further embodiment, the step of generating warning information of all operations of the visitor and sending it to the security department for risk review also includes allocation of security resources, specifically:

[0157] According to the formula Get the amount of resources allocated to the i-th processing task or link at time t;

[0158] Among them, R t is the total amount of resources available for processing warning information at time t;

[0159] m is the total number of processing tasks or links;

[0160] P i Represents the priority coefficient of the i-th processing task; specifically, it is assigned a value based on its urgency to ensure the security of core data and restore normal status as soon as possible (for example, 1 to 10 points, the higher the value, the higher the priority).

[0161] It should be noted that P i The specific value of can be to prioritize all processing tasks and then assign values ​​according to the order of ranking, with the first one getting 10 points, the second one getting 9 points, and so on. The specific ranking method can be sorted by the staff according to the impact on the security of the core data and the urgency of restoring the normal state;

[0162] S iis the complexity coefficient of the i-th processing task; specifically, the difficulty of task execution can be determined by past experience with similar tasks, technical difficulty assessment, etc. (a suitable score range can also be set). In this embodiment, the specific value can be obtained by scoring all complexity factors, calculating the comprehensive value, and finally dividing it by the number of complexity factors:

[0163] Assume we have three complexity factors: technical difficulty, required resources, and expected completion time. For the i-th task, the scores are 8, 6, and 7 respectively, then the complexity factor is 7. The specific scoring method can be:

[0164] Combining historical data analysis and expert evaluation, we can set a scoring range for each complexity factor, such as 1 to 10 points, where 1 means very simple or low risk, and 10 means very complex or high risk. Then, we score according to the following criteria: below the historical average: 1-3 points, close to the historical average: 4-6 points, above the historical average: 7-9 points, significantly above the historical average: 10 points;

[0165] I i It represents the correlation impact coefficient of the i-th processing task; it is the degree of influence of the execution of the task on other tasks and the overall business continuity (with corresponding quantitative assignment). The specific quantitative assignment method can be: scoring based on whether the task depends on the output of other tasks, which can be 1 to 5 points. The higher the score, the stronger the dependence; scoring based on the degree of influence of the task on the overall business process, which can be 1 to 5 points. The higher the score, the greater the impact; scoring based on the impact of failure to complete the task on time on business continuity, which can be 1 to 5 points. The higher the score, the greater the impact; scoring based on the degree of influence of the task on core data security, which can be 1 to 5 points. The higher the score, the greater the impact.

[0166] Then add up all the scores and divide by 4 to get the correlation influence coefficient of the i-th processing task;

[0167] α, β, and γ are weight parameters corresponding to priority, complexity, and correlation impact respectively; it should be noted that α+β+γ=1, and its value is set according to the different importance that the organization attaches to each factor. It should be noted that the initial values ​​of α, β, and γ are all one-third, and they are adjusted according to the staff in actual use;

[0168] Based on the above formula, resources can be dynamically and reasonably allocated according to actual conditions.

[0169] For example, suppose there are three main processing tasks when processing the warning information: investigating the source of the attack, strengthening internal personnel management, and repairing system vulnerabilities. The total amount of resources currently available for processing the warning information is R t= Take 100 people as an example;

[0170] After evaluation, the priority coefficient of the attack source investigation task is P1=8, the complexity coefficient is S1=6, and the correlation impact coefficient is I1=7;

[0171] Strengthening internal personnel management tasks P2 = 6, S2 = 4, I2 = 5;

[0172] The task of fixing system vulnerabilities has P3=7, S3=7, I3=6;

[0173] Assume further that the coefficients of α, β, and γ can be 0.4, 0.3, and 0.3 respectively, and calculate the amount of resources allocated to each task according to the formula;

[0174] Investigating the source of the attack:

[0175] Among them, the calculation method for strengthening internal personnel management and repairing system vulnerabilities is the same as above, and no examples are given here;

[0176] It should be noted that the comprehensive risk assessment formula derives the comprehensive level or value of risk through quantitative analysis of multiple factors such as the possibility of threat occurrence and the degree of impact. The dynamic resource allocation formula determines the priority and quantity of resource allocation based on these risk assessment results;

[0177] The comprehensive risk assessment results can identify the main risk types and key risk areas faced by core data. Dynamic resource allocation can focus resources on high-risk links based on this, such as allocating more protection resources to vulnerable data storage areas or key business systems found in risk assessment.

[0178] As a further embodiment, the specific content of the warning information at least includes, based on the current security situation and risk assessment results, predicting the type of sensitive data security incidents that may occur, clarifying the scope of sensitive data assets that may be affected and the degree of harm;

[0179] It should be noted that the types of sensitive data security incidents that may be predicted include data leakage, privacy tampering, malicious attacks, etc., and the scope of sensitive data assets that may be affected should be clarified, such as which databases, file systems, and storage devices with large amounts of data may be leaked, tampered with, or lost; the degree of harm includes data recovery costs, etc.

[0180] How it works

[0181] In the financial management system, if a user accesses sensitive data, the identity information of the current visitor is first verified and matched through the identity matching and verification module to determine whether the access rights of the current visitor match the access rights required to access the current sensitive data. If the match is successful, the current visitor is allowed to access;

[0182] When the identity information does not match, a suspended waiting operation is temporarily generated on the access page to buy time for subsequent verification and avoid the visitor's premature exit. The risk level of the current visitor's access is assessed through the risk assessment module, and an early warning is issued through the early warning module to prevent data leakage.

[0183] The above are only preferred implementations of the present invention. The protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technical staff in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of this template.

Claims

1. A financial management system based on big data, characterized in that: include: Identity matching and verification module, risk assessment module, early warning module and feedback optimization module; The identity matching verification module is used to confirm whether the identity information of the current visitor matches the identity information in the database when a user accesses sensitive data, and after confirming that the identity information of the current visitor matches the identity information in the database, obtain the access rights required to access the current sensitive data, and determine whether the current visitor matches the access rights required to access the sensitive data according to pre-set rules; If the identity information of the current visitor matches the access rights, the current user is allowed to access sensitive data; If the identity information of the current visitor does not match the identity information in the database or the identity information of the current user does not match the access rights, a suspend waiting operation is generated and the information is fed back to the risk assessment module; The risk assessment module is used to assess the risk level of the current visitor's access to sensitive data during the execution of the suspend wait operation and generate corresponding risk information, and feed the risk information back to the early warning module; The early warning module is used to generate early warning information after receiving risk information fed back by the risk assessment module; After receiving the warning information from the warning module, the feedback optimization module determines whether the risk assessment module needs to be optimized based on the warning information.

2. A financial management system based on big data according to claim 1, characterized in that: If the identity information of the current visitor matches the access rights, before the current user is allowed to access sensitive data, the operation process of the identity matching verification module further includes the following steps: Send confirmation message to the current visitor's superior; Generate a confirmation code based on the confirmation information of the current visitor's superior; The confirmation code is sent to the current visitor, who then accesses sensitive data based on the confirmation code.

3. A financial management system based on big data according to claim 2, characterized in that: The specific steps of the risk assessment module to assess the risk level and generate corresponding risk information are: Determine a mismatch type according to mismatch information of the current visitor, wherein the mismatch type includes a first mismatch type and a second mismatch type; Determine the risk level as the first level based on the first mismatch type, generate first warning information, perform a denial of access operation and send risk information to the warning module; The risk level is determined to be a second level based on the second mismatch type, a second warning message is generated, and the risk assessment is re-executed.

4. A financial management system based on big data according to claim 3, characterized in that: The specific method of determining the risk level as the second level based on the second mismatch type and re-performing the risk assessment is: Confirm whether the current visitor's access rights have been adjusted in the past three months. If so, retrieve the current visitor's access rights before the adjustment and determine whether the access rights before the adjustment can access the current sensitive data; If the access permission before adjustment of the current visitor allows access to the sensitive data, the first operation is performed; If the access rights before adjustment of the current visitor cannot access the sensitive data, the second operation is performed.

5. A financial management system based on big data according to claim 1, characterized in that: The specific steps of performing the first operation are: Analyze the visitor's access time, frequency, operation path and sequence in the system; Determine if there are similarities between the visitor's current actions and previous actions; If there is similarity, it is marked as the first suspicious signal; Check the correlation between the sensitive data accessed by the current visitor and their own business data; If there is a correlation, it is marked as the second doubt signal; Retrieve the completeness of the current visitor's access to sensitive data; If the current user does not conduct a large-scale in-depth visit, it is marked as the third suspicious signal; When there are at least two questionable signals, it is determined to be an erroneous operation, otherwise, the second operation is performed.

6. A financial management system based on big data according to claim 5, characterized in that: The specific steps of performing the second operation are: Automatically terminate any further operations of the visitor with sensitive data; Temporarily lock the visitor's account or related permissions; Check system logs and access records to see the visitor's recent login location, time, and operation behavior to determine whether there are any abnormalities; Generate feedback information to the early warning module for early warning.

7. A financial management system based on big data according to claim 6, characterized in that: The specific steps of the early warning module for generating early warning information after receiving the risk information fed back by the risk assessment module are: Retrieve the IP information of the current visitor; Retrieve all operations of the current visitor based on IP information; All visitor operations will generate early warning information and send it to the security department for risk review.

8. A financial management system based on big data according to claim 7, characterized in that: The warning information generated by all the visitor's operations is sent to the security department for risk review, specifically: Get the number n of risk factors of current warning information; According to the formula Get the comprehensive risk value; Among them, L i represents the probability of occurrence of the i-th risk factor; C i Indicates the impact caused by the occurrence of the i-th risk factor; W i It represents the weight of the i-th risk factor in the overall assessment, reflecting the importance of this factor relative to other factors.

9. A financial management system based on big data according to claim 8, characterized in that: The generation of early warning information from all operations of the visitor and sending it to the security department for risk review also includes allocation of security resources, specifically: According to the formula Get the amount of resources allocated to the i-th processing task or link at time t; Among them, R t is the total amount of resources available for processing warning information at time t; m is the total number of processing tasks or links; P i Represents the priority coefficient of the i-th processing task; S i is the complexity coefficient of the i-th processing task; I i represents the correlation influence coefficient of the i-th processing task; α, β, and γ are weight parameters corresponding to priority, complexity, and association impact, respectively.

10. A financial management system based on big data according to claim 9, characterized in that: The specific content of the warning information includes at least predicting the types of sensitive data security incidents that may occur, clarifying the scope of sensitive data assets that may be affected, and the degree of harm based on the current security situation and risk assessment results.

Images