Enterprise data security capability assessment method and system

Abstract

The invention relates to the field of enterprise safety assessment, in particular to an enterprise data safety capability assessment method and system. The method comprises the following steps of: obtaining an enterprise historical security log based on an enterprise information system, performing real-time data flow analysis and dynamic positioning of a storage position on the enterprise historical security log, and constructing an enterprise data flow mapping model; performing abnormal intrusion attack simulation on the enterprise data flow mapping model, performing enterprise security risk assessment, and marking potential risk nodes; performing historical normalized behavior analysis on the dynamic enterprise data flow model, and performing access behavior deviation detection on potential risk nodes to obtain abnormal intrusion behavior data of the enterprise system; and performing multi-time-window intrusion trajectory backstepping on abnormal intrusion behavior data of the enterprise system, and performing deep mining of abnormal attack features to obtain intrusion attack features. According to the invention, efficient and accurate enterprise data security assessment is realized, so that the enterprise is helped to make a targeted security protection decision.

Description

Technical Field

[0001] The present invention relates to the field of enterprise security assessment, and in particular to an enterprise data security capability assessment method and system. Background Art

[0002] With the continuous development of informatization and digitalization, the large amount of data generated and stored by enterprises during operations has gradually become one of the core assets. Enterprise data not only involves all aspects of business operations, but also carries key elements such as market competition and technological innovation. Therefore, ensuring the security and integrity of enterprise data has become an important task in modern enterprise management. With the increasing number of network security threats, the security challenges faced by enterprises have become more complex. Data leaks, hacker attacks, internal leaks and other incidents occur frequently, causing huge economic losses and credibility crises to enterprises.

[0003] In traditional data security management, enterprises often rely on static security measures, such as firewalls, intrusion detection systems (IDS), data encryption and other means. However, these traditional methods focus more on the security protection of the system itself, and often ignore the potential security risks that occur during the data flow process. The security of data in various links such as transmission, storage, and access is threatened by different behavior patterns and attack methods. In the face of ever-changing attack methods, traditional protection measures often seem powerless and cannot detect potential security risks in a timely manner.

[0004] In addition, existing data security assessment methods usually rely on manual monitoring and manual detection, which is not only inefficient, but also often fails to provide comprehensive security situation awareness. Traditional assessment methods are often unable to analyze and monitor the dynamic flow of enterprise data in real time, and lack comprehensive assessment of data security, data access behavior, data leakage, etc. Therefore, how to accurately and comprehensively assess the data security capabilities of enterprises in a dynamic and complex network environment has become an urgent problem to be solved. Summary of the invention

[0005] In order to solve the above technical problems, the present invention proposes an enterprise data security capability assessment method and system to solve at least one of the above technical problems.

[0006] To achieve the above object, the present invention provides a method for evaluating enterprise data security capabilities, comprising the following steps: Step S1: obtaining the enterprise historical security log based on the enterprise information system, performing real-time data flow analysis and dynamic storage location positioning on the enterprise historical security log, and building an enterprise data flow mapping model; Step S2: simulate abnormal intrusion attacks on the enterprise data flow mapping model, conduct enterprise security risk assessment, and mark potential risk nodes; Step S3: Perform historical normalized behavior analysis on the dynamic enterprise data flow model and detect access behavior deviations on potential risk nodes, thereby obtaining abnormal intrusion behavior data of the enterprise system; Step S4: reverse the intrusion trajectory of the enterprise system abnormal intrusion behavior data in multiple time windows, and conduct in-depth mining of abnormal attack features to obtain intrusion attack features; Step S5: Perform multi-level penetration testing on the enterprise information system based on the intrusion attack characteristics, and perform adaptive vulnerability repair to obtain multi-level vulnerability repair data; Step S6: Monitor the multi-level vulnerability repair data layer by layer, and conduct a comprehensive assessment of the dynamic risk situation to obtain a comprehensive assessment report on the enterprise risk situation.

[0007] The present invention analyzes historical security logs to accurately identify the flow tracks of various types of data in the enterprise information system, helping enterprises understand the flow paths of data in the system. Through real-time analysis of data flow, the storage location of data is determined in real time to ensure data security, especially data security in different storage areas or cloud services. By simulating the data flow mapping model, multiple potential attack methods are simulated, such as SQL injection, malicious code execution, etc., so that the performance and response capabilities of the system in the face of various intrusions can be detected. Through the simulation results, the enterprise accurately evaluates security vulnerabilities and determines the weak links of the system by analyzing different attack paths, helping managers to make targeted security improvement measures. Through the normalization analysis of historical data flows, the enterprise can identify the common normal behavior patterns in the system as a benchmark for subsequent comparisons, and perform deviation detection on the access behavior of potential risk nodes, which helps to promptly discover any access or operation that deviates from normal behavior, which helps to discover abnormal behavior or potential security incidents early. By reversely deducing the intrusion trajectory under multiple time windows, the various stages of the attack behavior are revealed, helping It helps security personnel track the evolution of attack sources and attack methods. By deeply mining the characteristics of abnormal attack behaviors, it can extract key information such as the attacker's attack methods, attack time windows, and attack modes, and provide data support for subsequent defense measures. By conducting multi-level penetration tests on the system, it can comprehensively evaluate the vulnerability of the system at different defense levels, ensuring that each layer of protection mechanism can effectively respond to potential attacks. According to the results of the penetration test, the enterprise quickly discovers vulnerabilities and repairs them. The repair process is dynamic and real-time, and responds to new attack modes in a timely manner. The layer-by-layer monitoring of the vulnerability repair process ensures that vulnerabilities at each level are effectively repaired and prevents any repair omissions, thereby improving the accuracy of the repair. The enterprise can dynamically track the security status of its information system and adjust the security protection strategy in real time according to the real-time effect of vulnerability repair and changes in the external threat environment. The comprehensive evaluation report provides the enterprise management with a detailed security status analysis, including existing risks, evaluation of the effectiveness of repair measures, and prediction of potential risks in the future. This helps senior decision makers understand the overall status of enterprise security and make corresponding decisions.

[0008] Preferably, step S1 comprises the following steps: Step S11: obtaining an enterprise historical security log based on the enterprise information system, and filtering the enterprise historical security log for abnormal outlier data to obtain an outlier filtered security log; Step S12: performing real-time data stream analysis on the outlier filtering security log to generate a real-time enterprise data stream; Step S13: Perform user dynamic behavior analysis on the enterprise real-time data stream to generate user dynamic behavior data; Step S14: identifying data flow paths according to user dynamic behavior data, and extracting multiple data flow paths; Step S15: dynamically locate the storage location of the enterprise real-time data stream to obtain the dynamic storage location of each data stream; Step S16: Perform dynamic data flow mapping on multiple data flow paths based on the dynamic storage location of each data flow, and construct an enterprise data flow mapping model.

[0009] The present invention removes these abnormal data that do not conform to the normal pattern by filtering outlier data, thereby reducing interference in the subsequent analysis process. The historical security log contains a large amount of irrelevant information or noise data. After filtering outlier data, the remaining logs will more concentratedly reflect the real abnormal behavior in the system, so as to more effectively carry out subsequent risk assessment and defense. Concentrating data on abnormal logs significantly improves the efficiency of analysis and helps the security team to quickly identify potential threats and loopholes. By real-time parsing of the filtered security logs, the data flow of the enterprise is generated in real time, which helps the enterprise to monitor the status of the system in real time. This is very important for quickly identifying and responding to security threats. Real-time data flow parsing helps enterprises visualize the flow and processing path of data in their information systems, which helps to identify any abnormal activities or potential security loopholes. By performing user dynamic behavior analysis on real-time data streams, enterprises can comprehensively track the operation behavior of each user in the system and clarify the user's behavior pattern. By analyzing user behavior, abnormal operation behaviors such as unauthorized access or abnormal login mode can be identified in time, which are potential security threats. By identifying the data flow path in user behavior data, enterprises can accurately locate the flow route of data in their information systems. This is very critical for tracking sensitive data and monitoring data flow. By extracting multiple data flow paths, enterprises can analyze the flow of data from multiple perspectives, which helps to discover potential security risks, such as whether there is unnecessary data access or illegal data transmission. Dynamically locating the storage location of each data flow can ensure that the enterprise can fully visualize the data storage and clearly understand the changes in the data storage location. When the storage location of the data is accurately located, the enterprise can monitor and take corresponding security measures in a timely manner to prevent data loss or illegal access. By mapping multiple data flow paths based on dynamic storage locations, the enterprise builds a comprehensive data flow model. The model can accurately reflect the flow, storage and flow direction of data in the enterprise information system. Through dynamic data flow mapping, enterprises can identify potential risk points in different paths and implement targeted security protection measures for these risk points to reduce the intrusion of attackers.

[0010] Preferably, step S2 comprises the following steps: Step S21: Perform multi-dimensional behavior scenario semantic analysis on the enterprise's historical security logs to obtain multiple behavior scenarios of the enterprise system; Step S22: performing multiple attack scenario fitting based on multiple behavior scenarios of the enterprise system, thereby obtaining multiple enterprise system attack scenarios; Step S23: performing abnormal intrusion attack simulation on the enterprise data flow mapping model according to multiple enterprise system attack scenarios to generate multi-scenario attack simulation data; Step S24: Conduct enterprise security risk assessment on multi-scenario attack simulation data and mark potential risk nodes.

[0011] The present invention analyzes historical security logs in multiple dimensions to gain an in-depth understanding of the operating status and user behavior patterns of enterprise information systems from different angles (such as time, user behavior, data access, network traffic, etc.), which helps to fully grasp the normalized behavior of the system. Through semantic analysis, it can extract the interactive behaviors between different users and different system components in the system, and identify multiple behavioral scenarios. These scenarios help understand the dynamic performance of the system under normal circumstances. By fitting multiple behavioral scenarios, it can generate multiple potential attack scenarios. These attack scenarios simulate the behavior of attackers in different situations and help enterprises predict attack paths. Through the fitting of multiple attack scenarios, enterprises have a better understanding of the performance of different attack methods and attacker behaviors, which enables enterprises to strengthen protection measures in advance for specific attack methods and improve defense prediction capabilities. By combining multiple attack scenarios with the enterprise data flow mapping model, abnormal intrusion attack simulation is performed to simulate attackers. The process of launching attacks on enterprise information systems through different paths can provide in-depth understanding of the performance of enterprise systems in different attack scenarios. Simulated attacks help enterprises comprehensively identify vulnerabilities or weak links exploited by attackers, including risk points in data flow paths, security issues of system components, etc. This process helps to identify and repair potential security vulnerabilities in advance. By evaluating multi-scenario attack simulation data, it is possible to accurately identify potential risk points in different attack scenarios and mark high-risk areas in the system. Enterprises can focus on these risk nodes and strengthen defense. Through multi-scenario attack simulation and risk assessment, enterprises evaluate the effectiveness of existing security protection measures, optimize security strategies based on evaluation results, fill in gaps in defense, and improve the comprehensiveness of protection. By comprehensively evaluating multiple attack scenarios, enterprises quantify their security situation and provide management with detailed security reports, which helps enterprises make scientific security investment decisions, staffing and security technology selection.

[0012] Preferably, the specific steps of step S24 are: Attack data flow nodes are identified for multi-scenario attack simulation data to obtain multiple attack data flow nodes; Analyze the changes in user access rights for multiple attack data flow nodes and obtain access rights change data for each node; Perform data transmission anomaly detection on multiple attack data flow nodes and extract data transmission anomaly features of the nodes; Perform intrusion defense response analysis on each node based on the access rights change data of each node and the abnormal data transmission characteristics of the node, thereby generating intrusion defense response data for each node; Calculate the defense failure time of each node's intrusion defense response data and extract the intrusion defense failure time of each node; Quantify the intrusion interception of each node on the multi-scenario attack simulation data to obtain the intrusion interception value of each node; Perform security risk assessment on each node based on the intrusion defense failure time of each node and the intrusion interception value of each node, so as to obtain the security risk assessment value of each node; Based on the preset multi-scenario attack security assessment threshold, the security risk assessment value of each node is used to identify risky nodes and mark potential risk nodes.

[0013] The present invention can identify the flow nodes of the attack data flow, clarify the attacker's activity path, and grasp the data flow direction during the attack process. Knowing this information helps to timely identify the actual impact range and intrusion point of the attack. By identifying the attack data flow nodes, the enterprise can more accurately understand the paths through which the attacker enters the system and how the data flows, so as to accurately detect the attack behavior. Analyzing the changes in access rights of each attack data flow node can help the enterprise identify whether the user has illegal privilege escalation during the attack process and timely discover the risk of privilege abuse. By carefully analyzing the changes in the permissions of the nodes, the enterprise detects the privilege escalation or crossing that occurs during the attack process, preventing the attacker from using privilege expansion to obtain higher access rights, thereby infiltrating more system areas. By detecting the transmission anomaly of the attack data flow node, the enterprise can find out whether abnormal behavior occurs in the data flow process, such as abnormal increase in data volume, abnormal transmission speed or data packets that do not conform to the normal mode. Through anomaly detection, potential data leakage or data tampering behaviors are discovered, such as abnormal transmission of sensitive data, unauthorized data access, etc., so as to identify and take protective measures as soon as possible. Combined with the access rights change data and data transmission anomaly characteristics of each node, a defense response strategy for each node is customized. Help enterprises take the most appropriate protection measures for each node, thereby enhancing the overall protection capabilities of the system. By analyzing the defense response of each node, it is ensured that the defense measures are not blind, but designed according to the actual risks and characteristics of each node. This makes the defense more accurate and helps to avoid waste of resources and improper defense strategies. By calculating the intrusion defense failure time of each node, the enterprise identifies the period of defense failure and finds out the risk of poor defense or defense bypass in certain time periods. This helps to strengthen the weak links of defense. The defense failure time calculation can help enterprises evaluate the continued effectiveness of existing defense measures and ensure that the defense measures are always effective within the attacker's active time window. Quantifying the intrusion interception capability of each node can clearly understand the defense level of each node, which nodes can effectively prevent attacks, and which nodes have weak defenses. The quantification of the intrusion interception value provides objective data support for security assessment, making the security assessment not only a qualitative judgment, but a quantitative analysis based on specific data. Taking into account the intrusion defense failure time and the intrusion interception value, a specific security risk value is evaluated for each node, helping enterprises to clarify the risk level of each node and make reasonable protection priority arrangements. Through security risk assessment, enterprises can identify which nodes in the system have higher security risks, strengthen protection measures for these nodes, and reduce the vulnerability to attacks. By comparing with the preset security assessment threshold, enterprises can quickly identify weak nodes that exceed the risk threshold, thereby marking them as high-risk areas and giving priority to strengthening security protection.After marking potential risk nodes, enterprises can promptly adjust defense strategies for these nodes and take necessary reinforcement measures, such as strengthening access control, deploying intrusion detection systems, and increasing data encryption.

[0014] Preferably, step S3 specifically comprises the following steps: Step S31: Perform historical normalized behavior analysis on the dynamic enterprise data flow model to build a normalized behavior baseline; Step S32: monitoring the access behavior of potential risk nodes in real time to obtain real-time access behavior data of risk nodes; Step S33: performing access behavior deviation detection on the real-time access behavior data of the risk node based on the normalized behavior baseline, and marking each access behavior data that deviates from the baseline; Step S34: performing abnormal intrusion behavior identification on each access behavior data with baseline deviation, thereby obtaining abnormal intrusion behavior data of the enterprise system.

[0015] By identifying the flow nodes of the attack data flow, the present invention can clarify the attacker's activity path and grasp the data flow direction during the attack process. Understanding this information is helpful to timely identify the actual impact range and intrusion point of the attack. By analyzing the changes in access rights of each attack data flow node, it can help enterprises identify whether users have illegal authority upgrades during the attack process and timely discover the risk of authority abuse. By carefully analyzing the authority changes of the nodes, the enterprise detects the authority upgrade or leap that occurs during the attack process, preventing attackers from using authority expansion to obtain higher access rights and thus infiltrating more system areas. By detecting transmission anomalies of the attack data flow nodes, the enterprise can discover whether abnormal behavior occurs in the data flow process, such as abnormal increase in data volume, abnormal transmission speed or data packets that do not conform to normal patterns. Through anomaly detection, potential data leakage or data tampering behaviors are discovered, such as abnormal transmission of sensitive data, unauthorized data access, etc., so as to identify and take measures as early as possible. Take protective measures, combine the access permission change data and data transmission anomaly characteristics of each node, customize the defense response strategy for each node, help enterprises take the most appropriate protection measures for each node, thereby enhancing the overall protection capability of the system, and conduct defense response analysis on each node to ensure that the defense measures are not blind, but designed according to the actual risks and characteristics of each node, which makes the defense more accurate and helps avoid waste of resources and improper defense strategies. By calculating the intrusion defense failure time of each node, the enterprise identifies the period of defense failure and finds out the risks of poor defense or defense bypass in certain time periods, which helps to strengthen the weak links of defense. The defense failure time calculation can help enterprises evaluate the continued effectiveness of existing defense measures and ensure that the defense measures are always effective within the attacker's active time window. The intrusion interception capability of each node is quantified, so that the defense level of each node can be clearly understood, which nodes can effectively prevent attacks and which nodes have weak defenses.

[0016] Preferably, the specific steps of step S31 are: Identify normalized user access behaviors for dynamic enterprise data flow models and extract normalized user access behavior data; Perform data access path analysis on normalized user access behavior data and extract multiple normalized data access paths; Performing data transmission volume statistics based on multiple normal data access paths to obtain the data transmission volume of each access path; Perform multi-time point data transmission trend analysis on the amount of data transmitted on each access path, and extract the data transmission trend characteristics of each access path; Calculate the data access frequency of normalized user access behavior data to obtain the normalized user data access frequency; Perform data flow topology analysis based on the normalized user data access frequency to generate normalized user data flow topology data; Based on the data transmission trend characteristics of each access path and the normalized user data flow topology data, the normal flow status of the enterprise system is fitted to build a normalized behavior baseline.

[0017] By performing normalized behavioral analysis on the enterprise's historical data flow model, the present invention can build a clear behavioral baseline, which represents the normal operating status of the system and the user's regular behavior pattern, and provides a reference standard for subsequent deviation detection. By performing real-time access behavior monitoring on potential risk nodes, the enterprise can immediately understand the operating status of these nodes and promptly discover any abnormal behavior or unusual access requests. By comparing with the normalized behavior baseline, it can accurately detect access behaviors that deviate from the normal pattern, such as abnormal logins, abnormal access times, cross-authority access, etc., which helps to discover potential intrusion behaviors in advance. Based on the access behavior data of baseline deviations, specific abnormal intrusion behaviors are further analyzed and identified. Through this analysis, it is possible to accurately judge whether there is an intrusion attempt and determine the nature and scope of the attack. Through further analysis of the deviation, abnormal behaviors can be effectively classified, thereby reducing missed reports and false alarms, and ensuring the quality and credibility of the alarm.

[0018] Preferably, the specific steps of step S4 are: Step S41: defining an intrusion tracing window length, and performing multi-time window intrusion trajectory reverse calculation on abnormal intrusion behavior data of the enterprise system according to the intrusion tracing window length, thereby obtaining intrusion trajectories in multiple time periods; Step S42: reconstructing the full-cycle intrusion attack chain for the intrusion trajectories in multiple time periods to generate a full-cycle intrusion attack topology map; Step S43: tracing the initial attack point of the full-cycle intrusion attack topology graph to obtain the initial node of the intrusion attack; Step S44: Deeply mine abnormal attack features based on the initial intrusion attack node to obtain intrusion attack features.

[0019] By defining the length of the intrusion tracing window, the present invention enables enterprises to trace back to the specific time period when the attack occurred, and obtain the attack trajectories of different time periods through multiple time windows, which makes the tracing of the intrusion behavior more accurate and can cover the entire attack process. The full-cycle intrusion attack chain reconstruction can help enterprises fully restore the attacker's intrusion path, intrusion means, attack stages, etc., from the initial attack to the final attack result, presenting a full picture of the entire attack. The reconstruction of the attack chain not only helps identify the attacker's path, but also reveals the tools, strategies, vulnerability exploits, etc. used by the attacker, which helps enterprises better understand potential attack patterns and provide a basis for future defense. By tracing the initial attack point in the attack topology map, the enterprise identifies the initial source of the attack. The enterprise can identify the source of the attack, such as a certain loophole, a stolen user account, an attacked entrance, etc. This can help enterprises strengthen protection from the source and reduce the possibility of similar attacks in the future. Once the source of the attack is determined, the enterprise immediately takes defensive measures, such as blocking loopholes, revoking stolen accounts, isolating infected areas, etc., to prevent the attack from spreading or further expanding to other systems. Based on the mining of abnormal attack features of the initial node, the enterprise understands the specific behavioral characteristics of the attacker in the system, what attack techniques the attacker uses, what loopholes he exploits, whether there are repetitive attack patterns, etc. By deeply mining the characteristics of intrusion attacks, the enterprise provides a more detailed attack feature library for future intrusion detection systems, improves the intelligence and sensitivity of the detection system, and thus more accurately identifies future attacks.

[0020] Preferably, the specific steps of step S5 are: Step S51: performing attack diffusion prediction based on the intrusion attack characteristics, thereby obtaining an intrusion attack diffusion prediction path; Step S52: Perform multi-level penetration testing on the enterprise information system according to the predicted path of intrusion attack diffusion, and generate penetration testing data of the enterprise information system; Step S53: marking risk vulnerabilities of the penetration test data of the enterprise information system, thereby obtaining enterprise risk vulnerabilities at different levels; Step S54: Adaptively repair the enterprise risk vulnerabilities at different levels to obtain multi-level vulnerability repair data.

[0021] The present invention helps enterprises understand how attacks spread in the system by analyzing the identified intrusion attack features and predicting the attack diffusion path. In this way, enterprises can take preventive measures to prevent attacks from expanding in a larger range and ensure the security of key resources. The attack diffusion prediction path can reveal the potential spread channel of the attack, thereby helping enterprises optimize the network and system architecture and reduce the risk of attack diffusion. The predicted attack path is dealt with by adjusting network access rights, strengthening border defense and other strategies. By performing multi-level penetration testing according to the predicted attack diffusion path, enterprises can fully simulate the attacker's attack path, thereby deeply detecting potential security vulnerabilities and weaknesses in the system. This multi-level test covers multiple attack surfaces and can effectively evaluate the overall security of the system. By marking the risk vulnerabilities of the penetration test data, enterprises can clearly understand the risk levels of different vulnerabilities. For high-risk vulnerabilities, measures are taken immediately to repair them, while for low-risk vulnerabilities, subsequent monitoring and evaluation are carried out, which helps to optimize the vulnerability management strategy. The adaptive vulnerability repair technology can automatically repair the vulnerabilities according to different risk levels and repair priorities, thereby ensuring the security of the enterprise information system. For high-risk vulnerabilities, enterprises quickly implement repair measures, while for low-risk vulnerabilities, they are gradually processed through automated tools or delayed repair, thereby improving repair efficiency.

[0022] Preferably, the specific steps of step S6 are: Step S61: monitoring the multi-level vulnerability repair data layer by layer to identify unrepaired vulnerabilities at each layer; Step S62: performing global vulnerability iterative repair on the enterprise information system according to the unrepaired vulnerabilities at each level, thereby generating global vulnerability iterative repair data; Step S63: Perform a dynamic risk situation comprehensive assessment based on the global vulnerability iterative repair data to obtain a comprehensive enterprise risk situation assessment report.

[0023] The present invention monitors the vulnerability repair progress of each level in the enterprise information system level by level, and effectively identifies the vulnerabilities that have not been repaired in each level. This hierarchical management method can help enterprises track each link of vulnerability repair more finely to avoid omissions. Through global vulnerability iterative repair, enterprises can centrally manage and coordinate vulnerability repairs at different levels to ensure that vulnerabilities at all levels can be repaired in a timely manner, rather than just a single level. This helps to improve the overall security of the system and avoid security problems of the entire system caused by unrepaired vulnerabilities at a certain level. Vulnerability repair is not a one-time job, but requires continuous iterative optimization. The global vulnerability iterative repair method can continuously evaluate the vulnerability repair effect, and continuously optimize according to newly discovered vulnerabilities or system feedback after repair, improve the quality of repair, and based on the global vulnerability iterative repair data Conduct dynamic risk assessment to comprehensively and comprehensively analyze the security situation of the enterprise at different repair stages. This enables the enterprise to dynamically understand the security effect after vulnerability repair, promptly discover new risks, and adjust security strategies according to actual conditions. Dynamic risk situation assessment enables enterprises to continuously monitor security conditions. It does not only rely on regular vulnerability repairs, but also evaluates the actual impact of vulnerability repairs on system security in real time, helping enterprises to detect potential security issues in a timely manner after repairs, and avoid new vulnerabilities or attack surfaces caused by repairs. Through the generated enterprise risk situation comprehensive assessment report, management obtains more comprehensive security situation feedback to help it make timely security decisions. The report content not only includes the current risk situation, but also provides security improvements after repairs, ensuring that management can make the best security decisions based on the latest situation.

[0024] In this specification, a system for evaluating enterprise data security capability is provided, which is used to execute the enterprise data security capability evaluation method as described above, including: A data flow analysis module is used to obtain the enterprise's historical security logs based on the enterprise information system, perform real-time data flow analysis and dynamic storage location positioning on the enterprise's historical security logs, and build an enterprise data flow mapping model; The intrusion attack simulation module is used to simulate abnormal intrusion attacks on the enterprise data flow mapping model, conduct enterprise security risk assessment, and mark potential risk nodes; The behavior deviation detection module is used to perform historical normalized behavior analysis on the dynamic enterprise data flow model and perform access behavior deviation detection on potential risk nodes, thereby obtaining abnormal intrusion behavior data of the enterprise system; The intrusion trajectory reverse inference module is used to reverse the intrusion trajectory of abnormal intrusion behavior data of the enterprise system in multiple time windows, and conduct in-depth mining of abnormal attack features to obtain intrusion attack features; The adaptive vulnerability repair module is used to conduct multi-level penetration testing on the enterprise information system based on the intrusion attack characteristics, and to perform adaptive vulnerability repair to obtain multi-level vulnerability repair data; The comprehensive assessment module is used to monitor the vulnerability repair of multi-level vulnerability repair data layer by layer, and conduct a comprehensive assessment of the dynamic risk situation to obtain a comprehensive assessment report on the enterprise's risk situation.

[0025] By parsing historical security logs in the enterprise information system and constructing a data flow mapping model, the present invention can clearly show how data flows, is stored, and interacts with other systems within the enterprise. This is a clear security situation map for enterprise managers and can effectively guide security decisions. Dynamic positioning of storage locations can help enterprises quickly identify data storage areas and security risks, and reduce security risks caused by unclear data storage locations. By simulating different attack scenarios, the intrusion attack simulation module can help enterprises predict potential attack paths and intrusion methods, thereby strengthening defense in advance. By simulating attacks, potential weak links in the enterprise system can be identified, helping the IT security team to reinforce in advance to prevent attackers from invading the system through these weak links. By detecting deviant behaviors, the system can identify access behaviors or data operations that are not in line with the norm, and promptly discover potential internal or external threats. It can continuously monitor the access mode of the enterprise system and issue real-time alarms based on deviation detection, helping the security team to discover and respond to potential intrusion behaviors as early as possible. By reversing the intrusion trajectory, it can help enterprises clearly understand how attackers enter the system, how they move, and How the attack behavior evolves is crucial for subsequent defense and repair work. By deeply mining the characteristics of intrusion attacks, it can help the security team understand the attacker's behavior patterns and even identify potential attack tools and means to improve the ability to respond to future attacks. Adaptive vulnerability repair can customize the repair strategy according to the characteristics of intrusion attacks to ensure that the most critical vulnerabilities are repaired first. This process adjusts the repair strategy in real time based on attack data to make the repair more in line with the needs of current security threats. Through multi-level penetration testing, different attack surfaces can be fully tested, and vulnerabilities at all levels in the system can be repaired one by one to ensure the comprehensiveness and depth of the repair measures. By comprehensively evaluating the progress of vulnerability repairs at all levels, a comprehensive risk assessment report is provided to help management and security teams fully understand the security status of the enterprise. Through dynamic analysis of vulnerability repair data, the comprehensive assessment module can provide real-time risk assessment to help enterprises adjust security strategies and repair plans in a timely manner. The comprehensive assessment report on risk situation not only provides enterprises with feedback on repair effects, but also helps decision-makers understand the current security status of the enterprise and support them in formulating reasonable security development strategies in the future. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1A schematic diagram of the steps of a method for evaluating enterprise data security capabilities according to the present invention; Figure 2 Detailed implementation flow chart of step S1; Figure 3 Detailed implementation flow chart of step S2; Figure 4 Detailed implementation flow chart of step S3. DETAILED DESCRIPTION

[0027] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0028] The present application example provides a method and system for evaluating enterprise data security capabilities. The execution subjects of the method and system for evaluating enterprise data security capabilities include but are not limited to: mechanical equipment, data processing platform, cloud server node, network upload device, etc. equipped with the system can be regarded as the general computing node of the present application, and the data processing platform includes but is not limited to: at least one of an audio and image management system, an information management system, and a cloud data management system.

[0029] See also Figures 1 to 4 The present invention provides an enterprise data security capability evaluation method, the enterprise data security capability evaluation method comprising the following steps: Step S1: obtaining the enterprise historical security log based on the enterprise information system, performing real-time data flow analysis and dynamic storage location positioning on the enterprise historical security log, and building an enterprise data flow mapping model; Step S2: simulate abnormal intrusion attacks on the enterprise data flow mapping model, conduct enterprise security risk assessment, and mark potential risk nodes; Step S3: Perform historical normalized behavior analysis on the dynamic enterprise data flow model and detect access behavior deviations on potential risk nodes, thereby obtaining abnormal intrusion behavior data of the enterprise system; Step S4: reverse the intrusion trajectory of the enterprise system abnormal intrusion behavior data in multiple time windows, and conduct in-depth mining of abnormal attack features to obtain intrusion attack features; Step S5: Perform multi-level penetration testing on the enterprise information system based on the intrusion attack characteristics, and perform adaptive vulnerability repair to obtain multi-level vulnerability repair data; Step S6: Monitor the multi-level vulnerability repair data layer by layer, and conduct a comprehensive assessment of the dynamic risk situation to obtain a comprehensive assessment report on the enterprise risk situation.

[0030] In the embodiment of the present invention, refer to Figure 1, is a schematic flow chart of the steps of a method for evaluating enterprise data security capabilities of the present invention. In this example, the steps of the method for evaluating enterprise data security capabilities include: Step S1: obtaining the enterprise historical security log based on the enterprise information system, performing real-time data flow analysis and dynamic storage location positioning on the enterprise historical security log, and building an enterprise data flow mapping model; In this embodiment, historical security logs are extracted from enterprise information systems (such as SIEM systems, application servers, network devices, etc.). These logs usually include user activity logs, system event logs, and network traffic logs. Set the time range for data collection. It is recommended to collect logs for at least the past 6 months to ensure the representativeness and comprehensiveness of the data. Standardize the format of the collected logs to ensure that all logs follow a unified format (such as JSON, CSV, or XML) for subsequent parsing and analysis. Use tools (such as Logstash or Fluentd) to preprocess the logs, remove irrelevant information and duplicate records, and retain key information. Define real-time parsing rules based on the format and key information of the logs. For user activity logs, extract fields such as user ID, timestamp, operation type, and access object. Use tools such as regular expressions or JSON parsers to ensure that the required information can be accurately extracted. Select a suitable real-time stream processing framework (such as Apache Kafka, Apache Flink, or Apache Spark Streaming) to process real-time data streams. Set stream processing parameters such as batch size (such as 1000 records) and window size (such as 5 minutes) to optimize performance. Input the real-time log stream into the selected stream processing framework, apply the defined parsing rules, extract key information in real time, and store it in memory or temporary database. Monitor performance indicators during the parsing process, such as latency and throughput, to ensure that the system can efficiently handle large-scale data streams. Design the enterprise's storage architecture and clarify the location of data storage, including relational databases (such as MySQL, PostgreSQL), NoSQL databases (such as MongoDB, Cassandra), and data warehouses (such as Amazon Redshift, Google BigQuery). According to the characteristics of the data, choose the appropriate storage solution, such as using relational databases for structured data and NoSQL databases for unstructured data. Develop dynamic positioning capabilities to automatically identify data storage locations and record data flow through metadata management or data catalog tools (such as Apache Atlas or AWS Glue). Set monitoring frequency (such as every hour) and update mechanism to ensure the dynamic and real-time nature of data storage locations. Based on the parsed log information and storage location, design a data flow mapping model to graphically display the flow path of data in the enterprise information system. Choose an appropriate modeling tool (such as Graphviz or Neo4j) to visualize the data flow model for subsequent analysis and monitoring. Verify the accuracy and effectiveness of the data flow mapping model by comparing the actual data flow and the model prediction. Randomly extract some logs to check whether their flow paths in the model are consistent. Generate a report on the data flow mapping model, detailing the model construction process, key findings, and future optimization directions.

[0031] Step S2: simulate abnormal intrusion attacks on the enterprise data flow mapping model, conduct enterprise security risk assessment, and mark potential risk nodes; In this embodiment, a suitable attack model, such as the MITRE ATT&CK framework, is selected as the basis for simulation, covering a variety of attack techniques and strategies. The framework can help identify attack paths and potential attacker behaviors, define attack scenarios, including targets, attack methods, attack timing, and attacker identity characteristics, design a SQL injection attack scenario for a database, determine the parameters of the simulated attack, such as attack frequency (such as once per hour), attack duration (such as 1 day), and attack intensity (such as low, medium, and high), use historical data (such as past attack events) to set attack parameters to ensure the authenticity and rationality of the simulation results, create an isolated test environment, simulate the actual operation of the enterprise information system, including application servers, databases, and network devices, etc., use virtualization technology (such as Docker or VMware) to quickly deploy the test environment, thereby ensuring the flexibility and controllability of the simulation process, and select a suitable simulation tool (such as Cyborg Security or Core Impact), which can simulate various attack behaviors and record the results, configure the parameters of the simulation tool, such as attack type, target system and attack path, to facilitate the execution of attack simulation, execute the set attack scenario, simulate the attacker's behavior through the simulation tool, record the results and impact of each attack step, monitor the system's response, including log records, system resource usage and the effectiveness of security protection measures, define risk assessment standards, including risk level (such as high, medium, low), impact range (such as single system or multiple systems) and attack success rate, etc., according to industry standards (such as ISO 27001 or NISTSP 800-30) Develop a risk assessment framework to ensure the professionalism and systematicness of the assessment process, analyze the simulation results, identify potential risk nodes, including attacked systems, exploited vulnerabilities, and affected users, etc., record detailed information for each risk node, including risk type, potential impact, and repair suggestions, and form a preliminary risk assessment report. Mark the identified potential risk nodes and classify them using color coding (such as red for high risk, yellow for medium risk, and green for low risk) to facilitate subsequent management. Integrate risk nodes into the enterprise data flow mapping model to form a complete risk situation map for easy visual analysis.

[0032] Step S3: Perform historical normalized behavior analysis on the dynamic enterprise data flow model and detect access behavior deviations on potential risk nodes, thereby obtaining abnormal intrusion behavior data of the enterprise system; In this embodiment, historical behavior data is extracted from the enterprise information system, including user access logs, system event logs, and network traffic data. These data should cover a reasonable time range, and it is recommended that at least 6 months should be covered to ensure the representativeness of the sample. The parameters for data extraction, such as time period, user type, and access object, are set to ensure that the acquired data is comprehensive and meaningful. The collected data is cleaned to remove irrelevant or redundant information, and the data format is standardized (such as timestamp format, user ID format, etc.) to facilitate subsequent analysis. Data processing tools (such as Pandas or Apache Spark) to ensure data consistency and integrity, establish a normalized model of user behavior by analyzing historical data, use cluster analysis (such as K-means clustering) to identify the pattern of normal user behavior, set the parameters of the normalized model, such as the number of clusters (based on the different types of user behavior, set to 5 clusters) and similarity thresholds to determine the boundaries of normal behavior, define the deviation detection criteria for access behavior, including the type of deviation (such as access frequency, access time, access object, etc.), and set the corresponding threshold (such as the access frequency exceeds 3 times the normal), consider using a variety of detection methods, such as statistical methods (such as Z-score analysis) and machine learning methods (such as anomaly detection algorithms) to improve the accuracy of detection, monitor the access behavior of potential risk nodes, record the user's access pattern in real time, including information such as access time, access object and access frequency, compare the real-time monitored data with the historical normalized behavior model, and identify behavioral deviations. Difference, use similarity calculation (such as cosine similarity) to judge the difference between current behavior and normalized behavior, identify access behaviors with deviations, record relevant information, including user ID, timestamp, deviation type and degree of deviation, etc., generate deviation detection report, record the detected abnormal behavior and its potential impact in detail, provide a basis for subsequent analysis and response, integrate the identified abnormal behavior data into a structured data set for subsequent storage and analysis. The data set should include fields such as user ID, access time, access object, deviation type and degree of deviation, use a database management system (such as MySQL or MongoDB) to store abnormal behavior data, ensure data security and accessibility, analyze abnormal behavior data, identify potential intrusion behavior patterns, record the characteristics and impact of each pattern, generate abnormal intrusion behavior data report, describe the identified abnormal behavior in detail, including the intrusion path and attack method, and help the security management team formulate countermeasures.

[0033] Step S4: reverse the intrusion trajectory of the enterprise system abnormal intrusion behavior data in multiple time windows, and conduct in-depth mining of abnormal attack features to obtain intrusion attack features; In this embodiment, abnormal intrusion behavior data, including timestamp, user ID, access object, deviation type, etc., are collected to ensure the integrity and accuracy of the data. The data are integrated into a structured database (such as PostgreSQL or MongoDB), and time window parameters are set. For example, the data is divided into multiple time windows (such as 1 hour, 3 hours, and 6 hours) to facilitate the analysis of intrusion behaviors in different time periods. The model parameters of trajectory inversion are set, including an inversion algorithm (such as a graph-based inversion algorithm or a sequence pattern mining algorithm) to reconstruct the attacker's behavior path. A graph analysis tool (such as Gephi or NetworkX) is used to construct an intrusion trajectory graph. The nodes represent users or systems, and the edges represent behavior paths. By analyzing the abnormal behavior data, abnormal access sequences are identified and intrusion trajectories are reconstructed. Timestamps and access objects are used to connect paths to form a complete attack path. The attack activities in each time window are monitored, the intrusion trajectory in each time window is recorded, and a corresponding trajectory data set is generated. Feature engineering is performed on the reconstructed intrusion trajectory to extract key features, such as attack path length, access frequency, target system type, and attack method. Data analysis tools (such as Pandas and NumPy) are used to perform statistical analysis on the features and calculate the feature distribution. and correlation to identify key attack features, apply machine learning algorithms (such as random forests, support vector machines, or deep learning models) to train the extracted features, identify abnormal attack features, set model parameters, such as the ratio of training sets to test sets (such as 80% training, 20% testing), and use cross-validation to optimize model performance, use deep learning frameworks (such as TensorFlow or PyTorch) to build deep learning models, perform deep feature mining, consider using time series models such as LSTM or GRU to analyze attack sequence features, generate feature importance reports, and record in detail the impact of each feature on the intrusion behavior to help understand the attacker's behavior pattern, integrate the identified attack features into a structured data set for subsequent analysis, and the data set should include fields such as attack method, attack path, target system, and attack frequency, use visualization tools (such as Tableau or Matplotlib) to visualize the attack features, help the security team understand the attack mode and features, perform feature analysis, identify common attack modes and strategies, record the description, potential impact, and protection suggestions of each attack feature, generate an intrusion attack feature report, describe the identified attack features in detail, and provide a basis for the formulation of enterprise security policies.

[0034] Step S5: Perform multi-level penetration testing on the enterprise information system based on the intrusion attack characteristics, and perform adaptive vulnerability repair to obtain multi-level vulnerability repair data; In this embodiment, according to the previously identified intrusion attack features, a penetration test plan is formulated to clarify the scope of the test (such as the network layer, application layer, and database layer), and set specific test objectives (such as identifying the vulnerabilities of key assets). Determine the time frame for the test, such as setting it to a week for multiple rounds of testing to cover different attack scenarios and time windows. Select appropriate penetration testing tools, such as Metasploit, Burp Suite, and Nessus, to ensure that these tools can cover the testing requirements at all levels. Build a penetration testing environment to ensure that the test does not affect the production environment. Use virtualization technology (such as VMware or Docker) to create an isolated test environment. According to the formulated penetration testing plan, implement multi-level penetration testing. First, perform network layer testing to identify network vulnerabilities (such as open ports, unencrypted communications, etc.). Next, perform application layer testing, use the identified intrusion attack features (such as SQL injection, cross-site scripting, etc.) to attack the application, and record the test results of each step. Record the results of each test link, including information such as the vulnerabilities found, the severity of the vulnerabilities, the scope of impact, and the availability of the vulnerabilities. Classify the test results and generate a preliminary vulnerability report, recording in detail the characteristics, repair suggestions and priority of each vulnerability. Develop corresponding vulnerability repair strategies based on the penetration test results. For high-risk vulnerabilities, set priorities for immediate repair; for medium- and low-risk vulnerabilities, develop regular repair plans. Set repair plans, including patch updates, configuration adjustments, or security policy optimization, and ensure that the repair measures do not affect the normal operation of the system. Select appropriate repair tools (such as Ansible, Chef) for automated repairs to ensure the efficiency and accuracy of the repair process. According to the formulated repair plan, implement vulnerability repairs step by step, and record the detailed steps and results of each repair process. Record the repair status of each vulnerability, including repair time, repair measures, verification results and other information, to form multi-level vulnerability repair data. Integrate repair data into a database (such as MySQL or MongoDB) to ensure data traceability and accessibility.

[0035] Step S6: Monitor the multi-level vulnerability repair data layer by layer, and conduct a comprehensive assessment of the dynamic risk situation to obtain a comprehensive assessment report on the enterprise risk situation.

[0036] In this embodiment, a vulnerability repair monitoring system is formulated, and monitoring standards and indicators are set. These indicators include the number of unrepaired vulnerabilities, repair rate, vulnerability severity level (such as high, medium, and low), repair time, and vulnerability recurrence rate. The setting of monitoring frequency is also crucial. It is recommended to monitor the vulnerability status daily and generate a detailed report once a week to detect problems in a timely manner. Suitable vulnerability monitoring tools (such as Qualys, Nessus, or OpenVAS) are selected to ensure that these tools can cover vulnerability monitoring needs at all levels, ensure the integration of monitoring tools with enterprise information systems, facilitate real-time acquisition of vulnerability data, and perform automated monitoring. Multi-level vulnerability repair data is collected, including the repair status, repair measures, repair time, verification results, etc. of each level. These data should come from the records of penetration testing and adaptive vulnerability repair stages. The data format (such as JSON or CSV) is set to ensure the readability and consistency of the data for subsequent analysis. The collected data is analyzed to identify unrepaired vulnerabilities and their impact range, evaluate the security status of each level, and use statistical analysis tools (such as R or Python) to analyze the data. Pandas library) for data processing and visualization. The monitoring results should be displayed in the form of charts, such as using bar charts to show the number of unrepaired vulnerabilities and the changes in the repair rate, to help management quickly understand the current security situation and select an appropriate risk assessment model, such as a quantitative risk assessment model (such as the FAIR model) or a qualitative risk assessment model, comprehensively consider the vulnerability repair status and external threat factors, set risk assessment parameters, including the number of vulnerabilities, threat level, potential impact and attack probability, so as to conduct a comprehensive assessment. Based on the monitored vulnerability data, analyze the risk status of each level and evaluate its impact on the overall information system. Use multi-dimensional assessment methods, such as SWOT analysis or PEST analysis, comprehensively consider internal and external factors, generate risk assessment results, record the risk level, main risk factors, impact and improvement suggestions of each level, integrate the monitoring results and risk assessment results, and generate a comprehensive assessment report on the enterprise risk situation. The report should include vulnerability monitoring results, risk assessment results, potential risk nodes, recommended repair measures, etc. Use visualization tools (such as Tableau or Power BI) to display the risk situation to help management quickly understand the security status of the enterprise.

[0037] In this embodiment, refer to Figure 2 , is a flowchart of detailed implementation steps of step S1. In this embodiment, the detailed implementation steps of step S1 include: Step S11: obtaining an enterprise historical security log based on the enterprise information system, and filtering the enterprise historical security log for abnormal outlier data to obtain an outlier filtered security log; Step S12: performing real-time data stream analysis on the outlier filtering security log to generate a real-time enterprise data stream; Step S13: Perform user dynamic behavior analysis on the enterprise real-time data stream to generate user dynamic behavior data; Step S14: identifying data flow paths according to user dynamic behavior data, and extracting multiple data flow paths; Step S15: dynamically locate the storage location of the enterprise real-time data stream to obtain the dynamic storage location of each data stream; Step S16: Perform dynamic data flow mapping on multiple data flow paths based on the dynamic storage location of each data flow, and construct an enterprise data flow mapping model.

[0038] In this embodiment, historical security logs are extracted from the enterprise information system to ensure the integrity and coverage of the data. Generally, historical logs include information such as access records, system warnings, and security events, and the amount of data reaches millions of records. Set the time range for data collection, such as the past year, for comprehensive analysis. Preprocess the collected historical security logs, including removing duplicate records, standardizing field formats (such as timestamp format, IP address format), etc., to ensure data consistency and availability. Record basic statistical information of the data, such as the total number of records, the number of fields, and missing values, for subsequent analysis. Select a suitable anomaly detection algorithm, such as Isolation Forest, DBSCAN (Density-Based Spatial Clustering of Applications with Noise), or Z-score method. These algorithms can effectively identify outliers in the data. Set the parameters of the algorithm, such as the number of trees and thresholds in the isolation forest, to ensure that the algorithm can adapt to the characteristics of the data. Run the selected outlier detection algorithm to analyze the historical security logs and identify abnormal behaviors or data records. Record the characteristic values ​​of each outlier for subsequent analysis. Remove the detected outlier data from the original log to form an outlier filtered security log to ensure that subsequent analysis is based on valid and reliable data. Generate a statistical report of the outlier filtered security log to record the data changes before and after filtering, including the number of remaining records, the type of abnormal events and their frequency. Use visualization tools (such as Matplotlib or Tableau) to display the results of outlier detection to facilitate analysis and understanding of the characteristics of outlier phenomena. Choose a suitable real-time data stream processing framework, such as Apache Kafka, Apache Flink, or Apache Spark Streaming. These tools can handle high-throughput data streams and support real-time data processing and analysis. Configure the data stream system to ensure that it can receive real-time log data from the enterprise information system. Use the outlier filtered security log as the input source of the data stream, set the format and transmission protocol of the data stream (such as JSON, XML), and ensure that the data can be correctly parsed and processed. Set the processing frequency of the data stream, usually thousands of records per second, to meet the needs of real-time analysis. Develop a data stream parser to parse the input security log data in real time, extract important fields (such as timestamp, user ID, event type, etc.), and convert them into structured data. Realize data cleaning and formatting, remove irrelevant information and noise data, and ensure the accuracy and consistency of analysis results. Generate real-time enterprise data streams and record the results of real-time analysis, including the structure of the analyzed data and its storage location. Store the real-time data stream in a database or data warehouse for subsequent analysis and query.Use NoSQL databases (such as MongoDB) or relational databases (such as PostgreSQL) for storage. Monitor the data stream parsing process in real time to ensure the normal operation of the system and handle any faults in a timely manner. Use visualization tools to display the changes in real-time data streams, such as real-time user activity charts, to facilitate monitoring of the security status of the enterprise. Extract user-related information from the real-time data stream, including user ID, access time, operation type, access module, etc., to form a data set for user dynamic behavior analysis. Ensure that the data integration can reflect the user's interactive behavior and behavior pattern. Select a suitable user behavior analysis model, such as cluster analysis, association rule analysis, or time series analysis. These models can effectively capture the user's behavior characteristics and trends. Set the model parameters, such as the number of clusters and time window, to better adapt to the characteristics of user behavior data. Use the selected behavior analysis model to analyze the integrated user data to identify the user's behavior patterns and dynamic changes. Record the behavior characteristics of each user, including access frequency, operation duration, and access path. Identify normal and abnormal behaviors by labeling user behaviors and generate user dynamic behavior data. Generate a user dynamic behavior analysis report to record the behavior characteristics and change trends of each user in detail, including behavior classification and frequency statistics. Use visualization tools to display the results of user behavior analysis, such as user behavior heat maps, so that enterprise managers can understand user dynamics. Path identification method selection: Select an appropriate data flow path identification method, such as a graph algorithm (such as Dijkstra algorithm, A* algorithm) or a sequence pattern mining algorithm (such as PrefixSpan). These methods can effectively identify the user's flow path in the data stream. Determine the key parameters for path identification, such as the minimum path length and the maximum number of hops, so as to filter out valid paths. Based on the user's dynamic behavior data, use the selected path identification method to analyze the user's operation sequence and extract multiple data flow paths. Record the starting point, end point and operation steps of each path. Identify common flow paths and abnormal paths and analyze their impact on enterprise security. Generate a data flow path identification report, which records the characteristics of each path in detail, including access frequency, number of mobile users and path length. Use visualization tools to display the distribution of data flow paths to help enterprises analyze user interaction behavior. Select an appropriate storage system architecture, such as a distributed file system (such as HDFS) or object storage (such as AWS S3) to support the storage of dynamic data streams. Determine the structure and format of data storage to facilitate fast retrieval and access to data. Implement dynamic positioning of storage locations based on the characteristics of real-time data streams. Record the storage path of each data stream, including the data storage node, storage time, and storage format. Use a metadata management system to ensure that the storage information of each data stream can be quickly queried and accessed.Generate a dynamic storage location report to record the dynamic storage location of each data flow in detail, including information such as storage time, node location, and storage capacity. Use visualization tools to display the distribution of storage locations to help enterprises understand the storage strategy of data flows. Select an appropriate data flow mapping model, such as a graph database (such as Neo4j) or a flow graph model to support dynamic mapping of multiple data flow paths. Determine the key parameters of the mapping model, such as the definition of nodes and edges, the direction and intensity of data flow. Build an enterprise data flow mapping model based on the collected storage location and data flow path information. Ensure that the flow direction, storage nodes, and dynamic characteristics of each path can be clearly represented. Use visualization tools to display the data flow mapping results to facilitate enterprises to analyze the efficiency and security of data flow. Generate a data flow mapping model report to record the flow path, storage location, and flow characteristics of each data flow in detail. Update the mapping model regularly to reflect changes in enterprise data flow and ensure that the model remains accurate and effective.

[0039] In this embodiment, refer to Figure 3 , is a flowchart of detailed implementation steps of step S2. In this embodiment, the detailed implementation steps of step S2 include: Step S21: Perform multi-dimensional behavior scenario semantic analysis on the enterprise's historical security logs to obtain multiple behavior scenarios of the enterprise system; Step S22: performing multiple attack scenario fitting based on multiple behavior scenarios of the enterprise system, thereby obtaining multiple enterprise system attack scenarios; Step S23: performing abnormal intrusion attack simulation on the enterprise data flow mapping model according to multiple enterprise system attack scenarios to generate multi-scenario attack simulation data; Step S24: Conduct enterprise security risk assessment on multi-scenario attack simulation data and mark potential risk nodes.

[0040] In this embodiment, historical security logs are extracted from the enterprise information system, including user behavior records, system events, and security alerts. To ensure the integrity and diversity of log data, the collection time range is set to the past year, and the data volume reaches millions of records. The data is preprocessed to remove duplicate records, handle missing values, and standardize fields such as timestamps and user IDs to ensure data consistency and quality. Select appropriate semantic analysis techniques, such as natural language processing (NLP) technology, combined with topic models (such as LDA) and sentiment analysis to extract semantic information and behavioral features from logs. Set analysis parameters, such as the number of topics and sentiment analysis thresholds, to ensure that the model can effectively identify different behavioral scenarios. Use the selected semantic analysis technology to analyze historical security logs and identify multidimensional behavioral scenarios, including normal behavior scenarios and potential abnormal behavior scenarios. Classify behavioral scenarios and record the characteristics and key indicators of each scenario (such as event frequency, user engagement, etc.). Generate a behavioral scenario report that describes the characteristics of each scenario in detail, including information such as scenario name, description, frequency of occurrence, and related user IDs. Based on the analysis results of multi-dimensional behavior scenarios, identify attack types, such as SQL injection, DDoS attack, malware propagation, etc., and establish an attack type library. Set the characteristics of the attack type, including attack methods, targets and potential impacts. Select appropriate attack scenario fitting methods, such as case-based learning methods or simulation generation methods, to build attack scenarios that match user behavior scenarios. Use random generation algorithms combined with actual attack cases for fitting. Set fitting parameters, such as scenario complexity, attack intensity and attack frequency, to facilitate the generation of multiple attack scenarios. Use the selected fitting method to generate multiple enterprise system attack scenarios based on the identified attack types and multi-dimensional behavior scenarios, and record the characteristics and triggering conditions of each attack scenario. Generate an attack scenario report that details the attack type, path, impact range and potential targets of each scenario. Confirm the structure and data flow path of the enterprise data flow mapping model to ensure that the model can reflect the dynamic changes and potential risk points of the enterprise data flow. The model should include data storage location, flow path and key nodes. Select appropriate attack simulation tools, such as Metasploit or Cyborg, which can simulate different types of attack scenarios and evaluate their impact on enterprise systems. Configure the simulation tool to ensure that it can be combined with the enterprise data flow mapping model. Implement abnormal intrusion attack simulation based on the generated multiple enterprise system attack scenarios. Simulate the data flow and system response during the attack, and record the impact of the attack on data flow and storage location. Generate an attack simulation data report, which records in detail the data flow changes, system response, and potential losses under each attack scenario. Use data analysis tools to perform statistical analysis on the simulation data, evaluate the impact of different attack scenarios on the enterprise system, and identify potential security vulnerabilities and risk points.Select appropriate security risk assessment indicators, such as attack success rate, data loss, system response time and recovery time, and establish a risk assessment model. Set the weight of each indicator to comprehensively assess the security risk of the enterprise. Use the selected risk assessment model to analyze the multi-scenario attack simulation data and evaluate the security risks under different attack scenarios. Calculate the value of each risk indicator and mark the potential risk nodes according to the set threshold. Record the characteristics of each risk node, including the scope of impact, risk level and recommended countermeasures. Generate a security risk assessment report, which records the information of each potential risk node in detail, including attack scenarios, risk levels and recommended defense measures. Use visualization tools to display risk assessment results to help enterprise management intuitively understand security risks and formulate corresponding security strategies.

[0041] In this embodiment, the specific steps of step S24 are: Attack data flow nodes are identified for multi-scenario attack simulation data to obtain multiple attack data flow nodes; Analyze the changes in user access rights for multiple attack data flow nodes and obtain access rights change data for each node; Perform data transmission anomaly detection on multiple attack data flow nodes and extract data transmission anomaly features of the nodes; Perform intrusion defense response analysis on each node based on the access rights change data of each node and the abnormal data transmission characteristics of the node, thereby generating intrusion defense response data for each node; Calculate the defense failure time of each node's intrusion defense response data and extract the intrusion defense failure time of each node; Quantify the intrusion interception of each node on the multi-scenario attack simulation data to obtain the intrusion interception value of each node; Perform security risk assessment on each node based on the intrusion defense failure time of each node and the intrusion interception value of each node, so as to obtain the security risk assessment value of each node; Based on the preset multi-scenario attack security assessment threshold, the security risk assessment value of each node is used to identify risky nodes and mark potential risk nodes.

[0042] In this embodiment, a flow analysis method based on graph theory, such as Dijkstra algorithm or graph traversal algorithm, is used to analyze the data flow path and identify the nodes to which the attack data flows. Analysis parameters, such as maximum path length and minimum data volume, are set to ensure that valid attack data flow nodes are identified. Using the selected flow analysis method, the attack simulation data is traversed to identify multiple attack data flow nodes, including attack sources, victim nodes, and intermediate forwarding nodes. The characteristic information of each node is recorded, including node type, flow direction, and data flow, etc., for subsequent analysis. Relevant user access rights data is extracted from the enterprise user management system to ensure that the data can reflect the changes in access rights of each node. The permission data is preprocessed to remove redundant information and standardize the permission level (such as administrator, user, visitor, etc.). A time series analysis method or a comparative analysis method is used to analyze the changes in access rights of each node before and after the attack. Analysis parameters, such as time window and change threshold, are set to ensure that significant permission changes can be identified. Each attack data flow node is analyzed, the changes in its access rights are recorded, and a permission change data report is generated, including information such as permission level before and after the change, user ID, and change time. Identify nodes with elevated or reduced permissions and analyze their potential impact on data security. Select appropriate anomaly detection algorithms, such as statistical methods (such as Z-score) or machine learning methods (such as isolation forest) to identify data transmission anomalies. Set algorithm parameters, such as anomaly thresholds and training samples, to ensure that the model can adapt to the characteristics of the data. Extract data transmission features from the attack data flow to the node, including information such as packet size, transmission frequency, and transmission time, as model input. Normalize the feature data to ensure that different features are compared at the same scale. Use the selected anomaly detection algorithm to analyze the data transmission features of each node and identify abnormal transmission behavior. Record the abnormal features of each node, including the type of anomaly, frequency, and impact, for subsequent analysis. Select appropriate intrusion prevention strategies, such as traffic monitoring, access control restrictions, and intrusion detection systems (IDS), and design corresponding defense responses for each node. Set the trigger conditions of the defense strategy, such as the magnitude of permission changes and abnormal transmission frequency, to ensure that potential intrusions can be responded to quickly. For each attack data flow to the node, analyze the intrusion defense response effect based on the access permission changes and data transmission anomaly features. Record the defense response data of each node, including response time, response measures, effect evaluation, etc. Generate a node intrusion defense response report, record the intrusion defense response of each node in detail, and use visualization tools to display the response effect.

[0043] Define the calculation method of intrusion defense failure time, such as the time period from the start of the attack to the failure of the defense measures, and use the event-driven model for analysis. Determine the calculation parameters of the failure time, such as the time window and the duration of the attack behavior. For each node, calculate the failure time of its defense measures based on the intrusion defense response data, and record the failure time of each node and its influencing factors. Identify the nodes with failed defenses and analyze their potential impact on enterprise security. Generate a defense failure time report, record the failure time and impact range of each node in detail, and use visualization tools to display the distribution of failure times. Intrusion interception quantification Determine the indicators for intrusion interception quantification, such as interception success rate, number of interceptions, and interception type. Set the weight of each indicator to facilitate the comprehensive evaluation of the defense capabilities of the node. According to the attack simulation data and defense response data, quantify the intrusion interception of each node, and record the intrusion interception value of each node. Identify the nodes with poor interception effect and analyze the reasons. Generate an intrusion interception quantification report, record the interception value and related indicators of each node in detail, and use visualization tools to display the interception effect. Determine the indicators for security risk assessment, including defense failure time, intrusion interception value, and node importance. Set the weight of each indicator to facilitate the comprehensive assessment of the security risk of the node. For each node, calculate the security risk assessment value based on the intrusion defense failure time and the intrusion interception value, and record the risk level of each node. Identify the nodes with higher risks and analyze their potential impact. Generate a security risk assessment report, record the risk assessment value and related indicators of each node in detail, and use visualization tools to display the risk assessment results. According to historical data and industry standards, set the threshold of security risk assessment. For example, nodes with a risk value exceeding 0.7 are considered high-risk nodes. Verify the set threshold with experimental data to ensure its rationality and effectiveness. According to the set threshold, analyze the security risk assessment value of each node and mark the risky nodes. Record the characteristics of each marked node, including risk assessment value, intrusion interception value, defense failure time and other information. Generate a risky node identification report, record the information of high-risk nodes in detail, use visualization tools to display the distribution of risky nodes, and help enterprises formulate corresponding security strategies.

[0044] In this embodiment, refer to Figure 4 , is a flowchart of detailed implementation steps of step S3. In this embodiment, the detailed implementation steps of step S3 include: Step S31: Perform historical normalized behavior analysis on the dynamic enterprise data flow model to build a normalized behavior baseline; Step S32: monitoring the access behavior of potential risk nodes in real time to obtain real-time access behavior data of risk nodes; Step S33: performing access behavior deviation detection on the real-time access behavior data of the risk node based on the normalized behavior baseline, and marking each access behavior data that deviates from the baseline; Step S34: performing abnormal intrusion behavior identification on each access behavior data with baseline deviation, thereby obtaining abnormal intrusion behavior data of the enterprise system.

[0045] In this embodiment, key behavioral features are determined, such as access frequency, data request volume, access time period, and user role. These features are used as input for normalization analysis. Statistical analysis is performed on each feature, and indicators such as mean and standard deviation are calculated for subsequent modeling. Select a suitable modeling method, such as cluster analysis (such as K-means) or a statistical model (such as a Gaussian mixture model), to build a normalized behavioral baseline. Set model parameters, such as the number of clusters and thresholds, to ensure that the model can effectively adapt to the characteristics of the data. Using the selected modeling method, the extracted behavioral features are analyzed to generate a normalized behavioral baseline, and the characteristics and indicators of each behavioral pattern are recorded. Generate a normalized behavioral baseline report, and record the mean, standard deviation, and frequency of occurrence of each behavioral pattern in detail. Select a suitable real-time monitoring tool, such as ELK Stack (Elasticsearch, Logstash, Kibana) or Splunk, which can collect, analyze, and visualize data streams in real time. Configure the monitoring system to ensure that it can receive real-time access data from risk nodes. Use the access behavior data of risk nodes as the input source for monitoring, and set the format of the data stream (such as JSON) for subsequent analysis. Set the monitoring frequency, such as collecting thousands of records per minute, to ensure that changes in access behavior can be captured in a timely manner. Implement real-time data collection to monitor the access behavior of risk nodes, including user access time, access content, access method and other characteristics. Store real-time monitoring data in a database (such as a NoSQL database) for subsequent analysis and query. Monitor data flow in real time to ensure the normal operation of the system and handle any failures in a timely manner. Use visualization tools to display changes in real-time access behavior, such as user access heat maps, to help managers understand the access status of risk nodes in a timely manner. Select appropriate deviation detection methods, such as Z-score analysis, outlier detection algorithms (such as isolation forests), or control chart methods to identify deviation behaviors. Set model parameters, such as deviation thresholds and sample sizes, to ensure that the model can effectively identify deviations in access behavior. Use the selected detection method to analyze real-time access behavior data and calculate the degree of deviation of each access behavior from the normalized behavior baseline. Mark the access behavior data for each baseline deviation and record its characteristics, including deviation value, access time, user ID, and access content.

[0046] Generate an access behavior deviation detection report that records in detail the characteristics and impact of each deviation behavior, including the deviation type and security risk. Use visualization tools to display deviation detection results to help managers understand the abnormal access behavior of risky nodes. Select appropriate abnormal behavior recognition algorithms, such as support vector machines (SVM), random forests, or deep learning models (such as LSTM) to identify abnormal intrusion behaviors. Set the model's training parameters, such as the training sample ratio and cross-validation method, to ensure the accuracy and robustness of the model. Use the labeled baseline deviation access behavior data to train the selected recognition algorithm and generate an abnormal intrusion behavior recognition model. Evaluate the performance of the model through cross-validation to ensure that it can effectively identify abnormal behavior. Use the trained model to analyze the access behavior data of each baseline deviation to identify abnormal intrusion behaviors. Record the characteristics of each identified abnormal behavior, including the type of behavior, scope of impact, and potential risks.

[0047] In this embodiment, the specific steps of step S31 are: Identify normalized user access behaviors for dynamic enterprise data flow models and extract normalized user access behavior data; Perform data access path analysis on normalized user access behavior data and extract multiple normalized data access paths; Performing data transmission volume statistics based on multiple normal data access paths to obtain the data transmission volume of each access path; Perform multi-time point data transmission trend analysis on the amount of data transmitted on each access path, and extract the data transmission trend characteristics of each access path; Calculate the data access frequency of normalized user access behavior data to obtain the normalized user data access frequency; Perform data flow topology analysis based on the normalized user data access frequency to generate normalized user data flow topology data; Based on the data transmission trend characteristics of each access path and the normalized user data flow topology data, the normal flow status of the enterprise system is fitted to build a normalized behavior baseline.

[0048] In this embodiment, user access logs are extracted from the enterprise information system, including user ID, access timestamp, access content (such as files, database tables, etc.) and access methods (such as direct access, API calls, etc.). It is recommended to collect data for at least the past 6 months to ensure the representativeness of the sample. Preprocess the data, remove duplicate records and incomplete access logs, and standardize the time format and user ID to ensure data consistency. Determine key access behavior characteristics, such as access frequency, access period, access object type, and user role. Use these characteristics as the basis for normalized behavior analysis. Perform statistical analysis on each feature and calculate indicators such as mean and standard deviation for subsequent modeling. Select a suitable modeling method, such as cluster analysis (K-means or DBSCAN) or a statistical model (Gaussian mixture model), to construct a normalized user access behavior model. Set model parameters, such as the number of clusters (it is recommended to be initially set to 5-10) and thresholds to ensure that the model can effectively capture the user's normal access behavior. Use the selected modeling method to analyze the extracted behavioral features, generate normalized user access behavior data, and record the characteristics and indicators of each behavior pattern. Generate a normalized behavior report, recording in detail the mean, standard deviation, and frequency of each access behavior. Set access path identification criteria, such as a specific access sequence (such as from the database to the application server) or a specific access type (such as focusing only on file reading). According to the set criteria, extract access paths from the normalized user access behavior data, and record the source node, target node, and access sequence of each access path. Organize the extracted paths into a structured data format (such as a graph structure or table) for subsequent analysis. Use graph theory analysis methods or sequence pattern mining algorithms (such as GSP or PrefixSpan) to analyze user access paths and identify multiple representative normalized data access paths. Set analysis parameters, such as support and confidence, to ensure that the extracted paths are meaningful. Record the characteristics of each extracted normalized data access path, such as access frequency, path length, and participating users. Use visualization tools (such as Graphviz or Cytoscape) to display normalized data access paths to help managers intuitively understand the flow of data. Determine statistical indicators for the amount of data transmitted, such as the total amount of data transmitted (bytes), average transmission, and maximum transmission for each path. Use data aggregation methods to summarize the size of each data in the access log and calculate the amount of data transmitted for each normal data access path. Set a statistical time window, such as hourly, daily, or weekly statistics, to observe the changing trend of data transmission. Perform data transmission statistics for each normal data access path, and record the total amount of data transmitted, the average amount of data transmitted, and the peak amount of data transmitted for each path. Organize the statistical results into a format that is easy to analyze (such as a table or chart) for subsequent analysis.Select an appropriate trend analysis method, such as time series analysis (ARIMA model) or moving average method, to analyze the change trend of the amount of data transmitted for each access path over time. Set analysis parameters, such as time window size (such as 7 days or 30 days) and prediction period, to ensure that the model can capture the change of trend. Organize the amount of data transmitted for each access path into time series data according to timestamps for trend analysis. Record the amount of data transmitted at each time point, including date, time and amount of data transmitted. Use the selected trend analysis method to analyze the time series data and extract the trend characteristics of each access path, such as rising, falling or stable trend. Generate a trend characteristic report to record the transmission trend characteristics of each access path in detail, including trend type, change amplitude and duration. Determine the indicators for calculating access frequency, such as the access frequency of each user, the access frequency of each path and the total access frequency. Use simple statistical methods to calculate the access frequency of each user and the access frequency of each access path. Record the access frequency of each user and each path, and generate a frequency statistics report to record the access frequency of each access path in detail. Use visualization tools to show the changing trend of access frequency to help managers understand the access behavior of users. Determine the structure of the data flow topology, including nodes (users, data sources, data targets) and edges (data flow paths). Use graph theory methods, such as network analysis tools (such as Gephi), to build a normalized user data flow topology and record the characteristics of each node and edge. Set analysis parameters, such as node weight (based on access frequency) and edge weight (based on data transmission volume) to ensure the accuracy of the topology structure. Generate a normalized user data flow topology and record the characteristics of each node and edge, including access frequency, data transmission volume, and connection strength. Generate a topology analysis report that records the topology structure and the characteristics of each node in detail to help managers understand the overall structure of data flow. Select an appropriate behavioral baseline model, such as a statistical model (such as a control chart) or a machine learning model (such as supervised learning), to fit the normal flow state. Integrate the features extracted from the data transmission trend analysis and data flow topology analysis as model inputs for model training. Set training parameters, such as learning rate and training cycle, to ensure the accuracy and robustness of the model. Generate a normalized behavioral baseline and record the characteristics of each behavioral pattern, including data transmission trends and flow topology characteristics. Generate a normalized behavioral baseline report that records in detail the constructed baseline status and its characteristics.

[0049] In this embodiment, step S4 includes the following steps: Step S41: defining an intrusion tracing window length, and performing multi-time window intrusion trajectory reverse calculation on abnormal intrusion behavior data of the enterprise system according to the intrusion tracing window length, thereby obtaining intrusion trajectories in multiple time periods; Step S42: reconstructing the full-cycle intrusion attack chain for the intrusion trajectories in multiple time periods to generate a full-cycle intrusion attack topology map; Step S43: tracing the initial attack point of the full-cycle intrusion attack topology graph to obtain the initial node of the intrusion attack; Step S44: Deeply mine abnormal attack features based on the initial intrusion attack node to obtain intrusion attack features.

[0050] In this embodiment, the intrusion tracing window length is set according to the enterprise's security policy and data analysis of past attack behaviors. Select time periods such as 30 minutes, 1 hour or 2 hours, and make preliminary settings based on the time characteristics of historical intrusion behaviors. Conduct experiments to analyze the impact of different window lengths on intrusion trajectory identification and select the optimal window length. Calculate the intrusion event recognition rate under different window lengths through statistical analysis tools (such as Python's Pandas library). Collect abnormal intrusion behavior data of the enterprise system, including timestamp, user ID, access path, and abnormal type information to ensure that the data set is complete. Preprocess the data to remove irrelevant information and standardize the time format for subsequent analysis. Use sliding window technology to gradually advance and intercept intrusion behavior data according to the defined intrusion tracing window length to form intrusion trajectories for multiple time periods. Set the sliding step size, such as 1 minute or 5 minutes, to obtain a more fine-grained intrusion trajectory. Use the sliding window to reverse the intrusion trajectory in the abnormal intrusion behavior data and record the intrusion behavior in each time period, including the time when the intrusion event occurred, the participating users and behavior characteristics. Generate an intrusion trajectory data set, record the intrusion behavior and its characteristics in detail for each time period, and ensure the integrity and accuracy of the data. Select a commonly used attack chain model, such as the MITRE ATT&CK model or the Lockheed Martin kill chain model, as the framework for reconstructing the attack chain. Set model parameters, such as the attack phase (initial access, execution, persistence, etc.), to ensure that all aspects of the intrusion behavior are fully covered. Integrate intrusion trajectory data from multiple time periods to identify potential attack paths and attack events, and form a graph structure for analysis. Record the characteristics of each attack event, including information such as the attack type, target node, affected system and user. Use graph theory methods (such as Dijkstra algorithm or depth-first search) to analyze the intrusion trajectory, reconstruct the full-cycle intrusion attack chain, and record the relationship between each attack link. Generate a full-cycle intrusion attack topology diagram, which details each link of the attack chain, the attacker's behavior path and the target node. Generate an attack chain reconstruction report, record the reconstructed attack chain characteristics and topology in detail, and use visualization tools (such as Visio or Lucidchart) to display the attack topology diagram to help managers understand the attack process. Set traceability standards, such as the characteristics of the initial attack point (such as the first access time, the starting point of the attack path, etc.), to ensure that the source of the attack can be effectively identified. Combine historical data to define available attack feature indicators, such as the attacker's IP address, user account, and attack tool. Use the backtracking analysis method, combined with the structure of the attack chain, to identify the initial attack node in the full-cycle intrusion attack topology. Set analysis parameters, such as the tracing depth (usually set to level 1 or 2), to ensure that the initial attack point can be accurately captured. Use data mining technology to analyze the full-cycle intrusion attack topology, trace back to the initial attack source, and record the feature information of the initial attack node.Generate an initial attack point identification report, record the characteristics of the attack source and its impact in detail, and help managers develop corresponding defense strategies. Select appropriate feature mining algorithms, such as decision trees, random forests, or deep learning (such as convolutional neural networks) to conduct in-depth mining of attack features. Set mining parameters, such as sample division ratio (such as 80% training set, 20% test set), to ensure the reliability and generalization ability of the model. Collect abnormal behavior data related to the initial attack node, including access path, behavior characteristics, and timestamps, and build a feature data set. Preprocess the data, remove noise data, and perform standardization and normalization to ensure data quality. Use the selected mining algorithm to train the feature data set, generate an abnormal attack feature recognition model, and record the model's performance indicators, such as accuracy, recall, and F1-score. Evaluate the performance of the model through cross-validation methods to ensure that it can effectively identify abnormal attack features. Use the trained model to analyze the initial attack node, identify abnormal attack features, and record the type, frequency, and impact of the features. Generate an abnormal attack feature mining report, record the identified features and their potential risks in detail, and provide a basis for subsequent security protection and response measures.

[0051] In this embodiment, the specific steps of step S5 are: Step S51: performing attack diffusion prediction based on the intrusion attack characteristics, thereby obtaining an intrusion attack diffusion prediction path; Step S52: Perform multi-level penetration testing on the enterprise information system according to the predicted path of intrusion attack diffusion, and generate penetration testing data of the enterprise information system; Step S53: marking risk vulnerabilities of the penetration test data of the enterprise information system, thereby obtaining enterprise risk vulnerabilities at different levels; Step S54: Adaptively repair the enterprise risk vulnerabilities at different levels to obtain multi-level vulnerability repair data.

[0052] In this embodiment, a suitable attack diffusion prediction model is selected, such as a graph-based propagation model (such as an SIR model) or a machine learning model (such as a random forest, a support vector machine, etc.), and a deep learning model (such as a neural network) is considered to process complex network structures and attack features. Data related to the attack are collected, including attack paths, behavioral characteristics of attackers, affected nodes and timestamps, etc., to ensure the comprehensiveness of the data, and data cleaning and preprocessing are performed, including removing redundant data, standardizing feature values, extracting key attack features, such as attack type, attack frequency, length of attack path, etc., to form a feature set for model training, using correlation analysis methods (such as the Pearson correlation coefficient) to evaluate the relationship between features and attack diffusion, screening out important features, and preparing feature data. The data set is divided into a training set and a test set (e.g. 80% for training and 20% for testing), cross-validation is used to optimize model parameters, appropriate performance evaluation indicators (such as accuracy, F1-score, etc.) are selected to evaluate the performance of the model, and the trained model is used to predict the attack diffusion path, generate a predicted path, record the diffusion probability and affected nodes of each path, generate an attack diffusion prediction report, and record each predicted path and its characteristics in detail to provide a basis for subsequent penetration testing, determine the scope of the penetration test, including the network architecture, applications, and databases of the enterprise information system, clarify the test objectives, identify key assets and potential vulnerabilities based on the attack diffusion prediction path, develop a detailed test plan, and select appropriate penetration testing tools, such as Metasploit and Burp Suite and Nessus, etc., to ensure that the tools can cover the testing requirements at all levels, configure the tools according to the test objectives and environment, ensure that they have the latest vulnerability library and attack modules, implement multi-level penetration testing according to the formulated plan, including network layer, application layer and database layer, record the test results of each step, use automated tools to perform preliminary scanning, identify potential vulnerabilities, and conduct in-depth verification in combination with manual testing, record each vulnerability found during the penetration test and its impact, including vulnerability type, severity score and exploitability, generate a penetration test report, record the results of each test link and the risk vulnerabilities found in detail, provide a basis for subsequent analysis, and determine the standard for vulnerability annotation , including the severity of the vulnerability (such as high, medium, and low), the scope of impact (such as a single system, multiple systems), and the difficulty of exploitation. Consider using industry standards (such as the CVSS scoring system) to evaluate and annotate vulnerabilities. According to the results of the penetration test, analyze each vulnerability, assess its risk level, and annotate it. Record detailed information for each vulnerability, including vulnerability description, conditions for occurrence, affected systems, and repair suggestions. Organize the annotated vulnerability data into a structured format (such as a database table) for subsequent query and management. Generate a risk vulnerability report that records vulnerabilities at different levels and their characteristics in detail to help managers conduct risk assessments and make decisions. According to the vulnerability type and risk level, formulate corresponding repair strategies.For example, for patch updates, configuration adjustments, or system isolation, consider using automated repair tools (such as Ansible, Chef, etc.) to improve repair efficiency. Implement corresponding repair measures for vulnerabilities at different levels, record the detailed steps and results of each repair process, conduct post-repair verification tests to ensure that the vulnerability has been successfully repaired and no new problems have been introduced. Record the repair status of each vulnerability, including repair time, repair measures, and verification results, form multi-level vulnerability repair data, generate vulnerability repair reports, and record the repair process and results in detail to provide a basis for subsequent audits and compliance checks.

[0053] In this embodiment, the specific steps of step S6 are: Step S61: monitoring the multi-level vulnerability repair data layer by layer to identify unrepaired vulnerabilities at each layer; Step S62: performing global vulnerability iterative repair on the enterprise information system according to the unrepaired vulnerabilities at each level, thereby generating global vulnerability iterative repair data; Step S63: Perform a dynamic risk situation comprehensive assessment based on the global vulnerability iterative repair data to obtain a comprehensive enterprise risk situation assessment report.

[0054] In this embodiment, the standards for vulnerability monitoring are determined, including monitoring frequency (such as daily, weekly) and monitoring indicators (such as the number of unrepaired vulnerabilities, repair rate, etc.), monitoring indicators are set according to industry standards (such as NIST or OWASP) to ensure compliance with best practices, multi-level vulnerability repair data are collected, including information on repaired and unrepaired vulnerabilities, the integrity and accuracy of the data are ensured, the data is pre-processed, redundant information is removed, and the data format is ensured to be consistent, vulnerability management tools (such as Qualys, Nessus) are used for vulnerability monitoring, monitoring parameters and scanning tasks are configured, and a monitoring cycle is set, such as performing a comprehensive scan once a week to identify unrepaired vulnerabilities, performing monitoring tasks, recording unrepaired vulnerabilities at each level, assessing their risk level and impact range, generating a vulnerability monitoring report, and recording in detail the number and characteristics of unrepaired vulnerabilities to help managers develop a repair plan, and a global vulnerability repair plan is developed according to the level and number of unrepaired vulnerabilities, including vulnerabilities to be repaired first, repair strategies and schedules, and repair priorities are set, such as giving priority to high-risk vulnerabilities, and appropriate repair tools and methods are selected, such as automated repair tools (such as Ansible, Puppet) or manual repair procedures to ensure that the repair process is efficient and accurate, and repair schedules are set. Strategies, such as gradual repair or batch repair, to ensure that the stability of the system is not affected; implement global vulnerability iterative repair according to the established repair plan; record the detailed steps and results of each repair process; conduct verification tests on each unrepaired vulnerability to ensure that the vulnerability has been successfully repaired and no new problems have been introduced; record the repair status of each vulnerability, including repair time, repair measures and verification results, etc.; form global vulnerability iterative repair data; generate a global vulnerability repair report; record the repair process and results in detail to provide a basis for subsequent audits and compliance checks; select an appropriate risk assessment model, such as a quantitative risk assessment model (such as the FAIR model) or a qualitative risk assessment model to comprehensively assess the risk situation of the enterprise information system; set assessment indicators, such as the number of vulnerabilities, repair rate, potential impact and attack probability; collect global vulnerability iterative repair data and other related data (such as system configuration, user behavior and network traffic), integrate them into a comprehensive assessment data set, pre-process the data to ensure data consistency and integrity; use the selected assessment model to analyze the comprehensive assessment data, assess the risk situation of the enterprise information system, derive the risk level and impact range, generate a risk assessment report, and record the assessment results in detail, including risk level, main risk factors and improvement suggestions.

[0055] In this embodiment, a system for evaluating enterprise data security capability is provided, which is used to execute the above-mentioned method for evaluating enterprise data security capability, including: A data flow analysis module is used to obtain the enterprise's historical security logs based on the enterprise information system, perform real-time data flow analysis and dynamic storage location positioning on the enterprise's historical security logs, and build an enterprise data flow mapping model; The intrusion attack simulation module is used to simulate abnormal intrusion attacks on the enterprise data flow mapping model, conduct enterprise security risk assessment, and mark potential risk nodes; The behavior deviation detection module is used to perform historical normalized behavior analysis on the dynamic enterprise data flow model and perform access behavior deviation detection on potential risk nodes, thereby obtaining abnormal intrusion behavior data of the enterprise system; The intrusion trajectory reverse inference module is used to reverse the intrusion trajectory of abnormal intrusion behavior data of the enterprise system in multiple time windows, and conduct in-depth mining of abnormal attack features to obtain intrusion attack features; The adaptive vulnerability repair module is used to conduct multi-level penetration testing on the enterprise information system based on the intrusion attack characteristics, and to perform adaptive vulnerability repair to obtain multi-level vulnerability repair data; The comprehensive assessment module is used to monitor the vulnerability repair of multi-level vulnerability repair data layer by layer, and conduct a comprehensive assessment of the dynamic risk situation to obtain a comprehensive assessment report on the enterprise's risk situation.

[0056] Therefore, the embodiments should be regarded as illustrative and non-restrictive from all points, and the scope of the present invention is limited by the appended claims rather than the above description, and it is therefore intended that all changes falling within the meaning and range of equivalent elements of the application documents are included in the present invention.

[0057] What has been described above is only a specific implementation mode of the present invention, so that those skilled in the art can understand or implement the present invention. Various modifications to these embodiments will be obvious to those skilled in the art. The general principles defined in this article can be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown in this article, but will conform to the widest scope consistent with the principles and novel features invented in this article.

Claims

1. A method for evaluating enterprise data security capabilities, characterized in that: The following steps are involved: Step S1: obtaining the enterprise historical security log based on the enterprise information system, performing real-time data flow analysis and dynamic storage location positioning on the enterprise historical security log, and building an enterprise data flow mapping model; Step S2: simulate abnormal intrusion attacks on the enterprise data flow mapping model, conduct enterprise security risk assessment, and mark potential risk nodes; Step S3: Perform historical normalized behavior analysis on the dynamic enterprise data flow model and detect access behavior deviations on potential risk nodes, thereby obtaining abnormal intrusion behavior data of the enterprise system; Step S4: reverse the intrusion trajectory of the enterprise system abnormal intrusion behavior data in multiple time windows, and conduct in-depth mining of abnormal attack features to obtain intrusion attack features; Step S5: Perform multi-level penetration testing on the enterprise information system based on the intrusion attack characteristics, and perform adaptive vulnerability repair to obtain multi-level vulnerability repair data; Step S6: Monitor the multi-level vulnerability repair data layer by layer, and conduct a comprehensive assessment of the dynamic risk situation to obtain a comprehensive assessment report on the enterprise risk situation.

2. The enterprise data security capability assessment method according to claim 1, characterized in that: The specific steps of step S1 are: Step S11: obtaining an enterprise historical security log based on the enterprise information system, and filtering the enterprise historical security log for abnormal outlier data to obtain an outlier filtered security log; Step S12: performing real-time data stream analysis on the outlier filtering security log to generate a real-time enterprise data stream; Step S13: Perform user dynamic behavior analysis on the enterprise real-time data stream to generate user dynamic behavior data; Step S14: identifying data flow paths according to user dynamic behavior data, and extracting multiple data flow paths; Step S15: dynamically locate the storage location of the enterprise real-time data stream to obtain the dynamic storage location of each data stream; Step S16: Perform dynamic data flow mapping on multiple data flow paths based on the dynamic storage location of each data flow, and construct an enterprise data flow mapping model.

3. The enterprise data security capability assessment method according to claim 1, characterized in that: The specific steps of step S2 are: Step S21: Perform multi-dimensional behavior scenario semantic analysis on the enterprise's historical security logs to obtain multiple behavior scenarios of the enterprise system; Step S22: performing multiple attack scenario fitting based on multiple behavior scenarios of the enterprise system, thereby obtaining multiple enterprise system attack scenarios; Step S23: performing abnormal intrusion attack simulation on the enterprise data flow mapping model according to multiple enterprise system attack scenarios to generate multi-scenario attack simulation data; Step S24: Conduct enterprise security risk assessment on multi-scenario attack simulation data and mark potential risk nodes.

4. The enterprise data security capability assessment method according to claim 3, characterized in that: The specific steps of step S24 are: Attack data flow nodes are identified for multi-scenario attack simulation data to obtain multiple attack data flow nodes; Analyze the changes in user access rights for multiple attack data flow nodes and obtain access rights change data for each node; Perform data transmission anomaly detection on multiple attack data flow nodes and extract data transmission anomaly features of the nodes; Perform intrusion defense response analysis on each node based on the access rights change data of each node and the abnormal data transmission characteristics of the node, thereby generating intrusion defense response data for each node; Calculate the defense failure time of each node's intrusion defense response data and extract the intrusion defense failure time of each node; Quantify the intrusion interception of each node on the multi-scenario attack simulation data to obtain the intrusion interception value of each node; Perform security risk assessment on each node based on the intrusion defense failure time of each node and the intrusion interception value of each node, so as to obtain the security risk assessment value of each node; Based on the preset multi-scenario attack security assessment threshold, the security risk assessment value of each node is used to identify risky nodes and mark potential risk nodes.

5. The enterprise data security capability assessment method according to claim 1, characterized in that: The specific steps of step S3 are: Step S31: Perform historical normalized behavior analysis on the dynamic enterprise data flow model to build a normalized behavior baseline; Step S32: monitoring the access behavior of potential risk nodes in real time to obtain real-time access behavior data of risk nodes; Step S33: performing access behavior deviation detection on the real-time access behavior data of the risk node based on the normalized behavior baseline, and marking each access behavior data that deviates from the baseline; Step S34: performing abnormal intrusion behavior identification on each access behavior data with baseline deviation, thereby obtaining abnormal intrusion behavior data of the enterprise system.

6. The enterprise data security capability assessment method according to claim 5, characterized in that: The specific steps of step S31 are: Identify normalized user access behaviors for dynamic enterprise data flow models and extract normalized user access behavior data; Perform data access path analysis on normalized user access behavior data and extract multiple normalized data access paths; Performing data transmission volume statistics based on multiple normal data access paths to obtain the data transmission volume of each access path; Perform multi-time point data transmission trend analysis on the amount of data transmitted on each access path, and extract the data transmission trend characteristics of each access path; Calculate the data access frequency of normalized user access behavior data to obtain the normalized user data access frequency; Perform data flow topology analysis based on the normalized user data access frequency to generate normalized user data flow topology data; Based on the data transmission trend characteristics of each access path and the normalized user data flow topology data, the normal flow status of the enterprise system is fitted to build a normalized behavior baseline.

7. The enterprise data security capability assessment method according to claim 1, characterized in that: The specific steps of step S4 are: Step S41: defining an intrusion tracing window length, and performing multi-time window intrusion trajectory reverse calculation on abnormal intrusion behavior data of the enterprise system according to the intrusion tracing window length, thereby obtaining intrusion trajectories in multiple time periods; Step S42: reconstructing the full-cycle intrusion attack chain for the intrusion trajectories in multiple time periods to generate a full-cycle intrusion attack topology map; Step S43: tracing the initial attack point of the full-cycle intrusion attack topology graph to obtain the initial node of the intrusion attack; Step S44: Deeply mine abnormal attack features based on the initial intrusion attack node to obtain intrusion attack features.

8. The enterprise data security capability assessment method according to claim 1, characterized in that: The specific steps of step S5 are: Step S51: performing attack diffusion prediction based on the intrusion attack characteristics, thereby obtaining an intrusion attack diffusion prediction path; Step S52: Perform multi-level penetration testing on the enterprise information system according to the predicted path of intrusion attack diffusion, and generate penetration testing data of the enterprise information system; Step S53: marking risk vulnerabilities of the penetration test data of the enterprise information system, thereby obtaining enterprise risk vulnerabilities at different levels; Step S54: Adaptively repair the enterprise risk vulnerabilities at different levels to obtain multi-level vulnerability repair data.

9. The enterprise data security capability assessment method according to claim 1, characterized in that: The specific steps of step S6 are: Step S61: monitoring the multi-level vulnerability repair data layer by layer to identify unrepaired vulnerabilities at each layer; Step S62: performing global vulnerability iterative repair on the enterprise information system according to the unrepaired vulnerabilities at each level, thereby generating global vulnerability iterative repair data; Step S63: Perform a dynamic risk situation comprehensive assessment based on the global vulnerability iterative repair data to obtain a comprehensive enterprise risk situation assessment report.

10. An enterprise data security capability assessment system, characterized in that: The method for evaluating enterprise data security capability according to claim 1 comprises: A data flow analysis module is used to obtain the enterprise's historical security logs based on the enterprise information system, perform real-time data flow analysis and dynamic storage location positioning on the enterprise's historical security logs, and build an enterprise data flow mapping model; The intrusion attack simulation module is used to simulate abnormal intrusion attacks on the enterprise data flow mapping model, conduct enterprise security risk assessment, and mark potential risk nodes; The behavior deviation detection module is used to perform historical normalized behavior analysis on the dynamic enterprise data flow model and perform access behavior deviation detection on potential risk nodes, thereby obtaining abnormal intrusion behavior data of the enterprise system; The intrusion trajectory reverse inference module is used to reverse the intrusion trajectory of abnormal intrusion behavior data of the enterprise system in multiple time windows, and conduct in-depth mining of abnormal attack features to obtain intrusion attack features; The adaptive vulnerability repair module is used to conduct multi-level penetration testing on the enterprise information system based on the intrusion attack characteristics, and to perform adaptive vulnerability repair to obtain multi-level vulnerability repair data; The comprehensive assessment module is used to monitor the vulnerability repair of multi-level vulnerability repair data layer by layer, and conduct a comprehensive assessment of the dynamic risk situation to obtain a comprehensive assessment report on the enterprise's risk situation.

Images