Financial data security risk assessment method and device

Abstract

The invention relates to the technical field of data security, and discloses a financial data security risk assessment method and device. The method comprises the following steps: determining an initial risk indicator set, wherein the initial risk indicator set comprises a plurality of risk indicators influencing financial data security; based on an approximate ideal solution sorting method, screening the initial risk index set, and determining a target risk index set; determining an initial weight set of the target risk index set based on a fuzzy analytic hierarchy process; correcting the initial weight set of the target risk index set by using the entropy weight of the target risk index set to obtain a target weight set of the target risk index set; and based on the fuzzy membership matrix of the evaluation factor set, the target weight set of the target risk index set and the assignment matrix of the comment set, calculating a fuzzy comprehensive evaluation result of the financial data security risk. The financial data security risk evaluation method and device can perform objective and accurate financial data security risk evaluation.

Description

Technical Field

[0001] The present disclosure relates to the field of data security, and in particular, to a method and device for assessing financial data security risks. Background Art

[0002] With the rapid growth of the digital economy, data security risks are increasing day by day, resulting in a deepening degree of harm. Data security incidents such as data leakage, data abuse, and data trafficking are frequent and showing a trend of continuous increase, posing a serious threat to national security, social stability, corporate rights and interests, and personal privacy security. Effectively responding to the current severe data security situation, preventing and dealing with data security issues brought about by new scenarios, new technologies, and new formats in the financial industry, and ensuring the safe development and utilization of data elements have become one of the important issues in the current social development.

[0003] Current data security risk assessment methods are mostly based on a simple transformation of information security risk assessment theory, ignoring the risk factors unique to data flow; and the assessment method mainly relies on manual interviews, document review, compliance benchmarking, etc. The risk assessment results are often given by experts based on their professional experience, which are highly subjective and have low overall assessment efficiency. Summary of the invention

[0004] In view of the above situation, the embodiments of the present application provide a financial data security risk assessment method and device, which aim to solve the above problems or at least partially solve the above problems.

[0005] In a first aspect, an embodiment of the present application provides a financial data security risk assessment method, the method comprising: determining an initial risk indicator set, the initial risk indicator set including multiple risk indicators that affect the security of financial data; based on the approximate ideal solution sorting method, screening the initial risk indicator set to determine a target risk indicator set, the target risk indicator set including n first-level risk indicators, and the n first-level risk indicators corresponding to n second-level risk indicator sets; determining an initial weight set of the target risk indicator set based on a fuzzy hierarchical analysis method, the weight set including the weight set of n first-level risk indicators and the weight set of each second-level risk indicator set; using the entropy weight of the target risk indicator set to correct the initial weight set of the target risk indicator set to obtain a target weight set of the target risk indicator set; based on the fuzzy membership matrix of the evaluation factor set, the target weight set of the target risk indicator set, and the assignment matrix of the comment set, calculating the fuzzy comprehensive evaluation result of the financial data security risk; wherein, the evaluation factor set includes factors that affect the financial data security risk assessment, and the comment set represents the assessment level of the financial data security risk.

[0006] In a second aspect, an embodiment of the present application also provides a financial data security risk assessment device, the device comprising: a determination module, used to determine an initial risk indicator set, the initial risk indicator set including multiple risk indicators that affect the security of financial data; a screening module, used to screen the initial risk indicator set based on an approximate ideal solution sorting method to determine a target risk indicator set, the target risk indicator set including n first-level risk indicators, and the n first-level risk indicators correspond to n second-level risk indicator sets; the determination module is also used to determine an initial weight set of the target risk indicator set based on a fuzzy hierarchical analysis method, the weight set including the weight set of n first-level risk indicators and the weight set of each second-level risk indicator set; a correction module, used to correct the initial weight set of the target risk indicator set using the entropy weight of the target risk indicator set to obtain a target weight set of the target risk indicator set; a calculation module, used to calculate a fuzzy comprehensive evaluation result of the financial data security risk based on a fuzzy membership matrix of an evaluation factor set, a target weight set of a target risk indicator set, and an assignment matrix of a comment set; wherein the evaluation factor set includes factors that affect the financial data security risk assessment, and the comment set represents the assessment level of the financial data security risk.

[0007] In a third aspect, an embodiment of the present application further provides an electronic device, comprising: a processor; and a memory arranged to store computer executable instructions, wherein the executable instructions, when executed, cause the processor to perform the steps of the first aspect described above.

[0008] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, which stores one or more programs. When the one or more programs are executed by an electronic device including multiple application programs, the electronic device executes the steps of the first aspect above.

[0009] At least one of the above technical solutions adopted in the embodiments of the present application can achieve the following beneficial effects: preliminarily determine the financial data security risk assessment indicators, and in order to ensure the accuracy of the assessment indicators, use the approximate ideal solution sorting method to screen the financial data security risk assessment indicators, determine the target risk indicator set, and construct a financial data security risk assessment indicator system. Secondly, the target risk indicator set is assigned weights through the fuzzy hierarchical analysis method and the entropy weight method to reduce the subjective interference in the expert decision-making process. Finally, the risk assessment value is determined through the comprehensive fuzzy evaluation method. Compared with the subjective financial data security risk assessment results given by experts, this application can conduct objective and accurate financial data security risk assessments, and can timely discover and deal with data security risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0011] Figure 1 A schematic diagram of a process for assessing financial data security risks provided by an embodiment of the present application is shown;

[0012] Figure 2 A schematic diagram showing the relative proximity of risk indicators provided by an embodiment of the present application;

[0013] Figure 3 A flowchart of a financial data security risk assessment method provided by another embodiment of the present application is shown;

[0014] Figure 4 A schematic diagram of the initial weights of the risk indicators provided in the embodiment of the present application is shown;

[0015] Figure 5 A schematic diagram of entropy weight provided in an embodiment of the present application is shown;

[0016] Figure 6 A schematic diagram of target weights provided in an embodiment of the present application is shown;

[0017] Figure 7 A structural diagram of a financial data security risk assessment device provided in an embodiment of the present application is shown;

[0018] Figure 8 A schematic structural diagram of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0019] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described below in combination with the specific embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0020] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that such use is interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the term "including" and its variants are to be interpreted as open-ended terms meaning "including but not limited to".

[0021] As described in the background technology, with the rapid growth of the digital economy, data security risks are increasing day by day, resulting in a deepening degree of harm. Data security incidents such as data leakage, data abuse, and data trafficking are frequent and present a trend of continuous increase, posing a serious threat to national security, social stability, corporate rights and interests, and personal privacy security. Effectively responding to the current severe data security situation, preventing and dealing with data security issues brought about by new scenarios, new technologies, and new formats in the financial industry, and ensuring the safe development and utilization of data elements have become one of the important topics of current social development.

[0022] Financial data security is a key component of national and social security, and is also the fundamental guarantee for the use and development of financial data. It occupies a core position in the process of data factorization. With the acceleration of financial digital transformation, financial institutions face higher challenges in their data security protection capabilities. In recent years, financial data security incidents have occurred frequently, and the security situation has become increasingly severe. On the one hand, the value of data has become increasingly prominent, and hacker intrusions, malware and other attacks and theft methods targeting data have been constantly updated, threatening the security of financial data; on the other hand, data application methods and scenarios continue to innovate, financial business processes and data circulation links have become more complex, and the exposure of financial data security risks has increased dramatically. At this important stage of transformation and innovative development of the financial industry, financial institutions urgently need to build a sound data security protection system to lay a solid foundation for the development of financial digitalization.

[0023] Conducting financial data security risk assessments can help financial institutions fully understand the data security situation, identify and resolve security risks in a timely manner, and then strengthen data security construction and system optimization in a targeted manner, improve security protection and risk prevention and control levels, and reduce the frequency and losses of data security incidents. By conducting data security risk assessments regularly, financial institutions can build a data security system that promotes construction, reform, quality improvement, continuous iteration, and continuous improvement through assessments.

[0024] Current data security risk assessment methods are mostly based on a simple transformation of information security risk assessment theory, ignoring the risk factors unique to data flow; and the assessment method mainly relies on manual interviews, document review, compliance benchmarking, etc. The risk assessment results are often given by experts based on their professional experience, which are highly subjective and have low overall assessment efficiency.

[0025] Based on this, the embodiment of the present application proposes a financial data security risk assessment method, preliminarily determines the data security risk assessment indicators, and in order to ensure the accuracy of the assessment indicators, uses the Technique for Order Preference by Similarity to Ideal Solution (TOPSIS) to screen the data security risk assessment indicators and determine the target risk indicator set to construct a data security risk assessment indicator system. Secondly, the target risk indicator set is assigned weights through the fuzzy analytic hierarchy process and the entropy weight method to reduce the subjective interference in the expert decision-making process. Finally, the risk assessment value is determined by the comprehensive fuzzy evaluation method, which can conduct an objective and accurate data security risk assessment, fully grasp the current data security management status and problems of the assessment object, and have good effectiveness, applicability and execution strength at the practical level.

[0026] The present application is described in detail below through specific embodiments.

[0027] Figure 1 The flowchart of the financial data security risk assessment method provided by the embodiment of the present application is shown. Figure 1 It can be seen that the present application at least includes steps S101 to S105:

[0028] Step S101: Determine an initial risk indicator set.

[0029] Among them, the initial risk indicator set includes multiple risk indicators that affect the security of financial data.

[0030] Step S102: Based on the approach to ideal solution sorting method, the initial risk indicator set is screened to determine the target risk indicator set.

[0031] Among them, the target risk indicator set includes n first-level risk indicators, and the n first-level risk indicators correspond to n second-level risk indicator sets.

[0032] That is, the target risk indicator set includes n first-level risk indicators, each first-level risk indicator includes a second-level risk indicator set, and each second-level risk indicator set includes multiple second-level risk indicators. For example, the target risk indicator set includes 3 first-level risk indicators: first-level risk indicator 1, first-level risk indicator 2, and first-level risk indicator 3. Among them, first-level risk indicator 1 includes second-level risk indicator 11 and second-level risk indicator 12, first-level risk indicator 2 includes second-level risk indicator 21, second-level risk indicator 22, and second-level risk indicator 23, and first-level risk indicator 3 includes second-level risk indicator 31 and second-level risk indicator 32.

[0033] Step S103: Determine the initial weight set of the target risk indicator set based on the fuzzy analytic hierarchy process.

[0034] The initial weight set includes the weight sets of n first-level risk indicators and the weight sets of each second-level risk indicator set. Specifically, the weight set of n first-level risk indicators includes the weights corresponding to the n first-level risk indicators, and the weight set of each second-level risk indicator set includes the weights corresponding to each second-level risk indicator.

[0035] Step S104: using the entropy weight of the target risk indicator set to modify the initial weight set of the target risk indicator set, to obtain the target weight set of the target risk indicator set.

[0036] Specifically, the entropy weight method is used to calculate the entropy weight of the first-level risk indicator set and the entropy weight of each second-level risk indicator set in the target risk indicator set, and the entropy weight of each indicator set is used to correct the initial weight set of each indicator set to obtain the target weight set of each indicator set.

[0037] Step S105: Calculate the fuzzy comprehensive evaluation result of the financial data security risk based on the fuzzy membership matrix of the evaluation factor set, the target weight set of the target risk indicator set, and the assignment matrix of the comment set.

[0038] The assessment factor set includes factors that affect the security risk of financial data. In one implementation, since the target risk indicator set includes multiple risk indicators that affect the security of financial data, the assessment factor set can be established based on the target risk indicator set. For example, the assessment factor set includes n first-level risk indicators, and each first-level risk indicator includes multiple second-level risk indicators.

[0039] Among them, the comment set represents the assessment level of financial data security risk.

[0040] from Figure 1 It can be seen from the method shown that this application preliminarily determines the financial data security risk assessment indicators. In order to ensure the accuracy of the assessment indicators, the TOPSIS method is used to screen the financial data security risk assessment indicators and determine the target risk indicator set to construct a financial data security risk assessment indicator system. Secondly, the target risk indicator set is weighted by the fuzzy analytic hierarchy process and the entropy weight method to reduce the subjective interference in the expert decision-making process. Finally, the risk assessment value is determined by the comprehensive fuzzy evaluation method. Compared with the data security risk assessment results given by experts subjectively, this application can conduct objective and accurate data security risk assessment, and can timely discover and deal with data security risks.

[0041] In some embodiments of the present application, in the above step S101, data security risk indicator items are identified by analyzing and studying literature, cases, etc., and the data security risk indicator items are summarized to determine an initial risk indicator set.

[0042] Specifically, starting from the core concept of data security, we filter keywords from the literature library or literature website to obtain relevant articles. By analyzing the relevant articles, we can obtain the literature on factors affecting data security risks. For example, using "finance*data security" as the keyword, the factors that were retrieved are shown in Table 1 below.

[0043] Table 1 Literature statistics on factors affecting financial data security risks

[0044]

[0045] Furthermore, financial data security risk indicators are identified through case analysis. By analyzing relevant data security cases and combining them with actual conditions, the main factors affecting financial data security risks are summarized.

[0046] For example, an employee unauthorizedly obtained personally identifiable information of more than 2.9 million members (including 2.7 million household users and 173,000 companies and related contacts) in the database, including names, dates of birth, phone numbers, emails, and personal financial management habits. Analysis of the incident showed that the data leak was caused by insufficient employee security awareness, lack of data security training, and an incomplete organizational data security management system. Based on this, it can be summarized that the main risk factors for financial data security include personnel education and training and data security management systems.

[0047] For example, a company suffered a cyber attack, which highlighted the lack of network security protection and the failure to timely check for security vulnerabilities. Based on this, the financial data security risk factors can be summarized as: network security protection, data security risk monitoring, and data leakage prevention.

[0048] For example, a company was fined for failing to fulfill its obligation to identify its customers and infringing on the rights of consumers. The basis for the punishment included failure to conduct effective identity verification of the subject of personal information and illegal provision of personal information. Based on this, the risk factors of financial data security can be summarized as: data quality control, legality and necessity, appropriateness of processing methods, and security of data provision.

[0049] Therefore, by analyzing the cases, we obtained a case analysis statistical table of factors affecting financial data security risks, as shown in Table 2 below.

[0050] Table 2 Case analysis statistics of factors affecting financial data security risks

[0051]

[0052] Furthermore, by summarizing and analyzing the data security influencing factors obtained based on literature analysis and case analysis, an initial risk indicator set was obtained, as shown in Table 3 below.

[0053] Table 3 Initial risk indicator set

[0054]

[0055]

[0056] Furthermore, by comprehensively considering and evaluating the interrelationships among various indicators, the embodiment of the present application summarizes the main risk categories of financial data security into seven aspects: data asset management risk, data security management risk, network security risk, data security operation risk, data behavior security risk, data flow security risk, and data application security risk. Combined with the initial risk indicator set shown in Table 3, the risk indicators in the initial risk indicator set are divided into the above risk categories, and the initial risk indicator set includes 7 first-level indicators, each of which includes multiple second-level indicators, for a total of 55 second-level indicators.

[0057] In the embodiments of the present application, by combing through and analyzing relevant literature and cases, key risk indicators that affect the security of financial data can be identified in combination with actual situations.

[0058] In some embodiments of the present application, in the above step S102, the initial risk indicator set is screened by the TOPSIS method to determine the target risk indicator set. Specifically, the relative proximity of each risk indicator is calculated by determining the distance between each risk indicator in the initial risk indicator set and the positive ideal solution, and the distance between each risk indicator and the negative ideal solution, so as to screen the initial risk indicator set based on the relative proximity of each risk indicator to obtain the target risk indicator set.

[0059] Specifically, the scoring results of the experts on each secondary risk indicator in the target risk indicator set are obtained. Taking the Likert five-level scale scoring method as an example, the scoring standards 1, 2, 3, 4, and 5 represent five levels: very small effect, small effect, average effect, large effect, and very large effect. The scoring results of the five experts on each indicator are shown in Table 4.

[0060] Table 4 Financial data security risk indicator score table

[0061]

[0062]

[0063] Furthermore, a weighted normalized decision matrix D is constructed according to the score table shown in Table 3:

[0064]

[0065] Among them, d nm It represents the score of the mth expert on the nth risk indicator.

[0066] Furthermore, the weighted normalized decision matrix is ​​normalized to obtain a normalized standard matrix Z.

[0067] Specifically, the matrix D is normalized based on the following formula:

[0068]

[0069] Among them, z ij represents the normalized score of the jth expert on the i-th risk indicator, d ij It represents the score given by the j-th expert to the i-th risk indicator.

[0070] Furthermore, the positive ideal solution and the negative ideal solution are determined. The positive ideal solution is the optimal solution, that is, the maximum value in the expert score; the negative ideal solution is the worst solution, that is, the minimum value in the expert score. The calculation formulas for the positive and negative ideal solutions are as follows:

[0071]

[0072] Among them, z nm It represents the score of the mth expert on the nth risk indicator in the matrix D.

[0073] Furthermore, the distance between each risk indicator and the positive ideal solution and the distance between each risk indicator and the negative ideal solution are calculated.

[0074] In one implementation, the distance between each risk indicator and the positive ideal solution and the distance between each solution and the negative ideal solution are calculated based on the following formula:

[0075]

[0076] in, represents the distance between the ith risk indicator and the positive ideal solution, represents the distance between the i-th risk indicator and the negative ideal solution, represents the positive ideal solution of the j-th risk indicator, represents the negative ideal solution of the j-th risk indicator, z ij It represents the score of the j-th expert on the i-th risk indicator in the matrix D.

[0077] Furthermore, the relative closeness of n risk indicators to the ideal solution is calculated according to the following formula:

[0078]

[0079] Among them, Q i Represents the relative proximity of the i-th risk indicator.

[0080] In the embodiment of the present application, the threshold is set to 0.5, and the risk index with a relative closeness greater than 0.5 is regarded as the target risk index, and the other risk indexes are ignored. Figure 2 As shown in the figure, there are 9 indicators with a proximity of less than 0.5, including data asset catalog, important data catalog, update and maintenance procedures, employee background investigation, personnel assessment and evaluation, complaint and reporting handling mechanism, appropriateness of handling methods, respect for social morality and ethics, and personal rights response. Therefore, these 9 indicators were deleted and 46 target risk indicators were finally determined. The financial data security risk assessment indicator system (target risk indicator set) constructed based on this includes 7 first-level indicators and 46 second-level indicators.

[0081] In an embodiment of the present application, the risk indicators obtained in step S101 are screened by the TOPSIS method, some risk indicators with little impact are screened out, and a target risk indicator set is obtained to form a scientific, convenient, accurate, and actual financial data security risk assessment indicator system that conforms to the financial institution scenario.

[0082] In some embodiments of the present application, when determining the initial indicator weight set of the target risk indicator set in step S103, the initial indicator weight set is determined by the fuzzy analytic hierarchy process. Specifically, the fuzzy judgment matrix of the target risk indicator set is determined, the fuzzy judgment matrix of the target risk indicator set is subjected to consistency check, and the fuzzy consistency matrix of the target risk indicator set is generated; based on the fuzzy consistency matrix of the target risk indicator set, the initial indicator weight set of the target risk indicator set is calculated.

[0083] Specifically, in the embodiment of the present application, N experts compare the risk indicators of the same level in pairs to obtain a fuzzy judgment matrix C=(c ij ) n×n , i,j∈(1,2,…,n), where n is the number of risk indicators at this level, c ij Indicates c i C j The relative importance of the value. Fuzzy matrix C = (c ij ) n×n Must satisfy 0≤c ij ≤1. If the fuzzy matrix C=(c ij ) n×n Meet c ij +c ji =1, then C is called a fuzzy complementary matrix. The fuzzy hierarchical analysis method marks the importance values ​​obtained by comparing the indicators pairwise with 0.1-0.9, thereby obtaining a fuzzy judgment matrix. The 0.1-0.9 scaling method is shown in Table 5:

[0084] Table 5 Relative importance scale of measurement levels

[0085]

[0086] Further, construct the fuzzy consistent matrix: If the fuzzy complementary matrix C = (c ij ) n×n Meet c ij =c ik -c jk +0.5(i,j,k=1,2,…,n), then C is called a fuzzy consistent matrix. The matrix constructed using the 0.1-0.9 scaling method is usually a fuzzy complementary matrix. To correct the fuzzy complementary matrix to a fuzzy consistent matrix, we first need to use the formula The fuzzy complementary matrix is ​​summed row by row and then transformed, as shown in formula a ij =(r i -r j ) / 2n+0.5, and finally construct the fuzzy consistent matrix A=(a ij ) n×n .

[0087] Furthermore, the initial index weights are calculated. For example, the weights of each index of the fuzzy consistency matrix are calculated by the least squares method:

[0088]

[0089] When α satisfies α≥(n-1) / 2, the larger the a value, the smaller the difference in weight value, and vice versa, the difference in weight value is large; when a=(n-1) / 2, the difference in weight value is the largest. In order to ensure the objectivity of the indicator difference, the value of a selected in this embodiment is α=(n-1) / 2.

[0090] In the embodiment of the present application, since the target risk indicator set includes the primary risk indicator and the secondary risk indicator, it is necessary to determine the fuzzy judgment matrix of the primary risk indicator set and each secondary risk indicator set in the embodiment of the present application, perform consistency check on the fuzzy judgment matrix of the primary risk indicator set and the secondary risk indicator set, generate the fuzzy consistency matrix of the primary risk indicator set and the secondary risk indicator set, and then calculate the initial weight of the primary risk indicator set and each secondary risk indicator set based on the fuzzy consistency matrix of the primary risk indicator set and the secondary risk indicator set. Taking the above-mentioned target risk indicator set including 7 primary risk indicators and 46 secondary risk indicators as an example, it is necessary to determine the initial weight set of 1 primary risk indicator set and the initial weight set of 7 secondary risk indicator sets.

[0091] In the embodiment of the present application, the initial weights of various risk indicators are calculated by fuzzy analytic hierarchy process, so as to avoid the subjectivity of direct weighting by experts and improve the accuracy of the weights.

[0092] In some embodiments of the present application, in step S104, the initial weight set is corrected using the entropy weight of the target risk indicator set, wherein the entropy weight of the target risk indicator set is determined based on an entropy weight method.

[0093] Specifically, the process of the entropy weight method is as follows: Based on the initial weight set, the entropy weight method original data matrix Y = (y ij ) m×n (i=1,2,…,m;j=1,2,…,n), m represents the number of risk indicators, n represents the number of experts, y ij It represents the subjective weight of expert j on risk indicator i. The information entropy is calculated based on the original data matrix of the entropy weight method, and the entropy weight is calculated based on the information entropy. The specific formula is as follows:

[0094]

[0095] Among them, E j represents the jth information entropy, ω j represents the jth entropy weight.

[0096] Finally, the initial weights calculated in step S103 are modified based on the entropy weight, as follows:

[0097]

[0098] in, represents the target weight of the mth risk indicator, ω n represents the nth entropy weight, Y T is the transposed matrix of the original matrix Y. The transposed matrix can be expressed as Y T =(y ji ) n×m (j=1,2,…,m; i=1,2,…,n).

[0099] In the embodiment of the present application, the initial weights obtained by the fuzzy hierarchical analysis method are corrected by the entropy weight method to further improve the accuracy of the weights.

[0100] In some embodiments of the present application, after obtaining the target weight of the target risk indicator set, a fuzzy comprehensive evaluation result is calculated based on a fuzzy comprehensive evaluation method, and the security of the data is evaluated based on the fuzzy comprehensive evaluation result.

[0101] Specifically, first determine the evaluation factor set. Financial data security risk is affected by multiple factors, all of which together constitute the evaluation factor set. In the embodiment of the present application, the evaluation factor set is constructed based on the target risk indicator set, denoted as U = (u 1 ,u 2 ,…,u n ). Divide the evaluation factor set U into s sub-factor sets U 1 ,U2 ,...,U s , where U i = {u i1 ,u i2 ,…,u im}(i∈s),u im Represents the mth risk indicator in the ith sub-factor set.

[0102] Then, the comment set is determined, and the polarity of the comments on financial data security risks is divided under the premise of ensuring that the evaluation method maintains the discrimination and stability, which is recorded as V = {v 1 ,v 2 ,…,v b}(b is the comment level number).

[0103] We further calculated U i = {u i1 ,u i2 ,…,u im}Indicator u im Fuzzy set of comment V in is the index u in the index concentration i1 For the review set element v j Membership degree of (j=1,2,…,b). Membership degree It can be expressed as: in Indicates the index u im have v j Rating comments.

[0104] To U i The fuzzy evaluation of each factor is carried out, and the fuzzy membership matrix is ​​obtained.

[0105]

[0106] Where m is the set U i (i∈1,2,…,n), i is the number of risk indicators in the evaluation factor set U, and b is the number of comment levels.

[0107] Firstly, fuzzy comprehensive evaluation is performed on each sub-factor set, that is, i The target weight C i and the fuzzy membership matrix R of the sub-factor set i Perform synthesis operation to obtain the fuzzy evaluation set of the sub-factor set:

[0108]

[0109] in Represents the synthesis rule, here we use Rules are used to protect the single-factor fuzzy evaluation information. Because the membership of the comment set is normalized, The operation rule is multiplication.

[0110] According to D i Compute the fuzzy membership matrix of the evaluation factor set:

[0111]

[0112] Then the fuzzy evaluation set of the evaluation factor set is:

[0113]

[0114] Among them, C represents the target indicator weight set of the first-level risk indicator set.

[0115] Comments Collection v j Assignment calculation to obtain fuzzy comprehensive evaluation results

[0116]

[0117] Among them, Q T represents the transposed matrix of Q, Q represents the review set v j The assignment matrix.

[0118] In the embodiments of the present application, firstly, relevant literature and cases are sorted out and analyzed, key risk indicators of financial data security are identified, and the TOPSIS method is used to screen the risk indicators, so as to construct a systematic and scientific financial data security risk assessment indicator system, and form a scientific, convenient, accurate, and actual data security risk assessment indicator system that conforms to the scenarios of financial institutions, laying the foundation for quantitative financial data security risk assessment; on this basis, based on the financial industry data security risk assessment indicator system, the fuzzy hierarchical analysis method and the entropy weight method are used to determine the subjective and objective weights, and then the fuzzy comprehensive evaluation method is used to calculate the data security risk value, so as to construct a financial data security risk assessment method, which can conduct objective and accurate data security risk assessment, fully grasp the current data security management status and problems of the assessment object, and have good effectiveness, applicability and execution strength at the practical level.

[0119] In some embodiments of the present application, the security of financial data is analyzed based on the fuzzy membership matrix and target weight set of the first-level risk indicator set to determine the first-level risk indicator with the highest security risk; the security of financial data is analyzed based on the fuzzy membership matrix and target weight set of the second-level risk indicator set to determine the second-level risk indicator with the highest security risk; and security measures to improve the security of financial data are formulated based on the first-level risk indicator with the highest security risk and the second-level risk indicator with the highest security risk.

[0120] In some embodiments of the present application, Figure 3 As shown, a complete flow chart of the financial data security risk assessment method provided by the present application is provided, and the specific process is as follows: first, the target risk indicator set is screened by the TOPSIS method: the initial risk indicator set is determined, the experts score the risk indicators in the initial security risk indicator set, the standard decision matrix is ​​calculated according to the scoring table, the standard decision matrix is ​​normalized to obtain the standard matrix, the positive ideal solution and the negative ideal solution are determined based on the scoring table, the distance between each risk indicator and the positive ideal solution and the negative ideal solution is calculated, the relative proximity of each risk indicator is calculated, and the target risk indicator set is screened based on the similar proximity. Then, the initial weight of the risk indicator is determined by the fuzzy hierarchical analysis method: the fuzzy judgment matrix of the target risk indicator set is determined, the fuzzy judgment matrix of the target risk indicator set is checked for consistency, the fuzzy consistency matrix of the target risk indicator set is generated, and the initial weight set of the target risk indicator set is calculated based on the fuzzy consistency matrix of the target risk indicator set. Further, the initial weight set is corrected based on the entropy weight: the entropy weight method original data matrix is ​​constructed based on the initial weight set, the information entropy is calculated, the entropy weight is calculated based on the information entropy, and the initial weight is corrected using the entropy weight to obtain the target weight. Finally, the risk value is calculated based on the fuzzy comprehensive evaluation method: the evaluation factor set and comment set are determined, the fuzzy membership matrix is ​​constructed, and the fuzzy comprehensive evaluation results are calculated based on the fuzzy membership matrix and target weights.

[0121] In the embodiment of the present application, the present application proposes a financial data security risk assessment method. First, the relevant literature and cases are sorted out and analyzed to identify the key risk indicators of financial data security, and the TOPSIS method is used to screen the risk indicators to build a systematic and scientific financial data security risk assessment indicator system to ensure its scientificity, convenience and accuracy, and to meet the actual scenario needs of financial institutions, laying the foundation for quantitative assessment of financial data security risks; on this basis, based on the financial industry data security risk assessment indicator system, the fuzzy hierarchical analysis method and the entropy weight method are used to determine the subjective and objective weights, and then the fuzzy comprehensive evaluation method is used to calculate the data security risk value, so as to construct a financial data security risk assessment method, which can conduct objective and accurate data security risk assessment and fully grasp the risk of financial data security risks. The present invention can grasp the current data security management status and problems of the assessment object, and has good effectiveness, applicability and execution strength at the practical level; the financial data security risk assessment method and device proposed in the present invention can well meet the work needs of data security planning, system construction, data security governance, data security utilization and other work of various financial institutions, and with the help of scientific, reasonable, feasible and effective data security risk assessment results, it can timely discover and deal with data security risks, clarify the key tasks, core technologies, weak links and other issues that need to be focused on and solved in the process of data security management and technical protection, provide strong support for financial institutions to further improve or enhance their own data security capabilities, and can effectively promote the reasonable formulation and effective implementation of financial institutions' data security management and control strategies and mechanisms.

[0122] A financial data security risk assessment method provided by the present application is described below through a specific embodiment.

[0123] A green loan service system of a company using big data technology was selected as an empirical case, and the financial data security risk assessment method proposed in this application was used to assess the company's data security risk. The assessment results were then analyzed to verify the effectiveness, applicability and enforcement of the method in actual operations.

[0124] 1. Determine the weight of indicator levels

[0125] The embodiment of the present application constructs a financial data security risk assessment index system (based on the full target risk index set mentioned in the above embodiment, through adaptation and optimization, to form the data security risk assessment index system of this embodiment), see Table 6 for details. Then, 6 data management experts of the company were invited to score the importance of the evaluation indicators in Table 6 according to the relative importance scaling rules in Table 5, and 48 fuzzy judgment matrices including 1 group of primary indicators and 7 groups of secondary indicators were constructed based on the expert scores.

[0126] Table 6 Index evaluation criteria

[0127]

[0128]

[0129] Taking the three secondary indicators in the first-level risk indicator data asset management C1 as an example, six experts were gathered to score the importance of the secondary indicators in the data asset management indicators. The specific data are shown in Table 7.

[0130] Table 7 Expert scoring table of the importance of data asset management risk indicators

[0131]

[0132]

[0133] According to the expert scores, a fuzzy judgment matrix is ​​constructed and normalized to form a fuzzy consistency matrix. Based on this, the subjective weights assigned by the six experts to the three risk indicators are calculated using formula (6), and the initial weight results of the three risk indicators are obtained as follows: Figure 4 Based on the entropy weight method, the entropy weight ω of risk indicators C11-C13 is calculated using formulas (7) and (8): 1 =(0.1639,0.3193,0.0239,0.0239,0.1639,0.3051), such as Figure 5 The subjective weights of C11-C13 are modified by entropy weight, and the target weights for determining the risk indicators of data asset management are obtained as follows:

[0134] Similarly, the target indicator weights of data security management risk indicators are calculated based on the expert scoring results: The target indicator weights of network security risk indicators are: The target indicator weights of data security operation risk indicators are: The target indicator weights of data behavior security risk indicators are: The target indicator weights of data flow security risk indicators are: The target indicator weights of data application security risk indicators are: The modified subjective weights of the secondary indicators are as follows: Figure 6 shown.

[0135] According to the analysis of the importance of the first-level risk indicators in the expert scoring table, the target indicator weight distribution of the first-level risk indicators is obtained as follows: *=(0.1286,0.1333,0.1306,0.1509,0.1392,0.1608,0.1567).

[0136] 2. Conduct data security risk assessment

[0137] 1) Determine the set of evaluation factors, comment sets and evaluation criteria

[0138] Based on Table 8, a financial data security risk assessment method is established, and then an evaluation factor set U = (u 1 ,u 2 ,…,u 7 On this basis, the evaluation factor comment set at each level is determined, and according to the risk level classification standard, combined with the evaluation accuracy and implementation scenario, the data security risk assessment level is subdivided into five levels: V = (v 1 ,v 2 ,v 3 ,v 4 ,v 5 )=(safe, relatively safe, general, relatively dangerous and very dangerous). To quantify the evaluation index system, the comprehensive evaluation results of the evaluation indicators are obtained through the comment set. This application adopts an expert scoring mechanism and quantifies the evaluation level in percentage. The score intervals of the five-level evaluation are set as [100, 80], [80, 60], [60, 40], [40, 20], [20, 0], and the middle value of each interval is selected as the evaluation value, that is, the comment set Q=(90, 70, 50, 30, 10).

[0139] In order to ensure that evaluators have clear references when evaluating indicators, the connotation of the evaluation indicators is supplemented with qualitative descriptions, as shown in Table 8.

[0140] Table 8 Index evaluation standard table

[0141]

[0142]

[0143]

[0144]

[0145] 2) Construct fuzzy membership matrix

[0146] This embodiment adopts a questionnaire survey method to construct a fuzzy membership matrix. In order to ensure the validity of the questionnaire survey results, 20 staff members were selected as survey subjects to obtain the evaluation level distribution table of the company's safety risk assessment indicators, as shown in Table 9.

[0147] Table 9 Financial data security risk indicator score table

[0148]

[0149]

[0150] 3) Construct fuzzy comprehensive evaluation based on weights

[0151] Taking the comprehensive evaluation of data management asset risk as an example, according to the financial data security risk index score table in Table 9, we can know that the evaluation factor set U 1 The fuzzy membership matrix R i for:

[0152]

[0153] Target indicator weight C 1 is (0.3277,0.3868,0.2855).

[0154] Fuzzy comprehensive evaluation set D 1 for:

[0155]

[0156] 4) Analysis of financial data security risk assessment results

[0157] By analogy, we can get the remaining fuzzy comprehensive evaluation set D 2 …D 7 , according to the fuzzy comprehensive evaluation set D 1 …D 7 , we can get the fuzzy membership matrix R of the comment set U as:

[0158]

[0159] Target index weight C = (0.1286, 0.1333, 0.1306, 0.1509, 0.1392, 0.1608, 0.1567)

[0160] The fuzzy comprehensive evaluation result S is: S = DQ T =69.08

[0161] 3. Analysis of financial data security risk assessment results

[0162] Using the financial industry data security risk assessment method, the department's data security score reached 69.08, which is at the "relatively safe" level, but there is still a gap with the "safe" standard. To ensure data security, the department urgently needs to strengthen the construction of the data security system.

[0163] Based on the fuzzy membership matrix and target weight set of the first-level risk indicator set, the first-level indicators are deeply analyzed. The results show that the data asset management risk and data behavior security risk assessment sets are (0.2441, 0.4378, 0.2660, 0.0521, 0.0000) and (0.1739, 0.4991, 0.1920, 0.1061, 0.0289), respectively. The evaluation is concentrated in the "relatively safe" and "general" intervals, with the "relatively safe" membership being the highest. The data security management risk and network security risk assessment sets are (0.4057, 0.3948, 0.1691, 0.0198, 0.0106) and (0.4890, 0.4036, 0.1001, 0.0073, 0.0000), respectively. The evaluation results are mainly in the "safe" and "relatively safe" intervals, among which "safe" has the highest membership. The data security operation risk and data flow security risk assessment sets are (0.2858, 0.5557, 0.1128, 0.0456, 0.0000) and (0.2037, 0.5061, 0.2028, 0.0788, 0.0086). The evaluation results are mainly in the "safe" and "relatively safe" intervals, among which the "relatively safe" has the highest membership. The data application security risk assessment set is (0.2214, 0.3847, 0.3153, 0.0786, 0.0000). The evaluation results are mainly distributed in the "relatively safe" and "general" intervals, among which the "relatively safe" interval has a higher membership, but the "general" membership is close to "relatively safe".

[0164] Based on the fuzzy membership matrix and target weight set of the secondary risk indicator set, the secondary indicators are deeply analyzed. According to the principle of maximum membership, the data application security risk assessment shows that the three indicators of data access security, data provision security, and data aggregation and fusion security perform the worst, and their evaluation results are mainly distributed at the "general" level. In terms of the degree of impact, the weights of data provision security and data aggregation and fusion security are as high as 0.4285 and 0.2928 respectively, ranking the top two, and have the greatest impact on the overall data application security risk. At the same time, the data asset management risk also has a high membership at the "general" level, among which the weights of data asset identification and classification and grading management are 0.3277 and 0.3868 respectively, becoming the main risk factors in data asset management.

[0165] Through the above analysis, it is concluded that data application security risks are the highest, and the department needs to focus on monitoring and prevention. Access control should be used to ensure data access security, and encryption, desensitization and watermarking technologies should be used to ensure the security of data transmission. At the same time, scope control and evaluation should be used to ensure the security of data aggregation and integration. The security risks of data security management, network security assurance, data security operation and data flow are relatively low, but they still need to be continuously strengthened. The security risks of data asset management and data behavior are in the "relatively safe" range, but the "general" risks account for a large proportion. In order to prevent potential risks, it is necessary to control the data intellectual property catalog of the institution, classify and identify the data, and verify the quality of the collected data.

[0166] The experiment shows that, combined with the actual situation of this case, the financial data security risk assessment method proposed in this application can scientifically, conveniently and accurately construct a data security risk assessment index system that conforms to the actual scenario of financial institutions, laying the foundation for the next step of quantitative financial data security risk assessment of the assessment object. On this basis, it is possible to objectively and accurately evaluate the data security risk of the system described in this case, fully grasp its current data security management status and problems, and further verify that the method described in this application has good effectiveness, applicability and execution strength at the practical level, and can well meet the data security planning, system construction, data security governance, data security utilization and other work needs of various financial institutions. With the help of scientific, reasonable, feasible and effective data security risk assessment results, it is possible to timely discover and deal with data security risks, clarify the key tasks, core technologies, weak links and other issues that need to be focused on and solved in the process of data security management and technical protection, and provide strong support for financial institutions to further improve or enhance their own data security capabilities, and can effectively promote the reasonable formulation and effective implementation of financial institutions' data security management strategies and mechanisms.

[0167] In some embodiments of the present application, a financial data security risk assessment device is provided, and the financial data security risk assessment device corresponds one-to-one to the financial data security risk assessment method in the above embodiment. Figure 7 As shown, the financial data security risk assessment device includes a determination module 101, a screening module 102, a correction module 103, a calculation module 104 and an analysis module 105. The functional modules are described in detail as follows:

[0168] A determination module 101 is used to determine an initial risk indicator set, wherein the initial risk indicator set includes a plurality of risk indicators that affect the security of financial data;

[0169] A screening module 102 is used to screen the initial risk indicator set based on the approximate ideal solution sorting method to determine a target risk indicator set, wherein the target risk indicator set includes n first-level risk indicators, and the n first-level risk indicators correspond to n second-level risk indicator sets;

[0170] The determination module 101 is further used to determine an initial weight set of a target risk indicator set based on a fuzzy analytic hierarchy process, wherein the weight set includes a weight set of n first-level risk indicators and a weight set of each second-level risk indicator set;

[0171] A correction module 103 is used to correct the initial weight set of the target risk indicator set by using the entropy weight of the target risk indicator set to obtain a target weight set of the target risk indicator set;

[0172] The calculation module 104 is used to calculate the fuzzy comprehensive evaluation result of the financial data security risk based on the fuzzy membership matrix of the evaluation factor set, the target weight set of the target risk indicator set and the assignment matrix of the comment set; wherein the evaluation factor set includes factors affecting the financial data security risk assessment, and the comment set represents the assessment level of the financial data security risk.

[0173] In some embodiments of the present application, the determination module 101 is specifically used to determine the distance between each risk indicator in the initial risk indicator set and the positive ideal solution, and the distance between each risk indicator and the negative ideal solution; based on the distance between each risk indicator and the positive ideal solution, and the distance between each risk indicator and the negative ideal solution, calculate the relative proximity of each risk indicator; and use the risk indicator whose relative proximity is higher than a threshold as the target risk indicator set.

[0174] In some embodiments of the present application, the determination module 101 is specifically used to determine the fuzzy judgment matrix of the target risk indicator set, perform consistency check on the fuzzy judgment matrix of the target risk indicator set, and generate a fuzzy consistency matrix of the target risk indicator set; based on the fuzzy consistency matrix of the target risk indicator set, calculate the initial weight set of the target risk indicator set.

[0175] In some embodiments of the present application, the determination module 101 is specifically used to determine the fuzzy judgment matrix of the primary risk indicator set and the fuzzy judgment matrices of n secondary risk indicator sets, perform consistency check on each fuzzy judgment matrix, and generate the fuzzy consistency matrix of the primary risk indicator set and the fuzzy consistency matrix of each secondary risk indicator set;

[0176] In some embodiments of the present application, the determination module 101 is specifically used to calculate the initial weight set of the first-level risk indicator set based on the fuzzy consistency matrix of the first-level risk indicator set, wherein the initial weight set of the first-level risk indicator set includes the initial weight of each first-level risk indicator; based on the fuzzy consistency matrix of n second-level risk indicator sets, calculate the initial weight set of each second-level risk indicator set.

[0177] In some embodiments of the present application, the entropy weight of the target risk indicator set is determined based on the following process: constructing an entropy weight method original data matrix based on the initial weight set of the target risk indicator set; determining the information entropy of each risk indicator based on the entropy weight method original data matrix; and calculating the entropy weight of each risk indicator based on the information entropy of each risk indicator.

[0178] In some embodiments of the present application, the correction module 103 is specifically used to correct the initial weight set of the first-level risk indicator set based on the entropy weight of the first-level risk indicator set to obtain the target weight set of the first-level risk indicator set; and to correct the initial weight set of each second-level risk indicator set based on the entropy weight of each second-level risk indicator set to obtain the target weight set of each second-level risk indicator set.

[0179] In some embodiments of the present application, the evaluation factor set is determined, and the evaluation factor set is divided into s sub-factor sets; wherein the evaluation factor set corresponds to a primary risk indicator set, and each sub-factor set corresponds to a secondary risk indicator set; each sub-factor set is fuzzy evaluated to determine a fuzzy evaluation set of each sub-factor set; based on the fuzzy evaluation set of each sub-factor set and the target indicator weight set of the corresponding secondary risk indicator set, a fuzzy comprehensive evaluation set of each sub-factor set is determined; based on the fuzzy comprehensive evaluation sets of the s sub-factor sets, a fuzzy membership matrix of the evaluation factor set is constructed.

[0180] In some embodiments of the present application, the fuzzy comprehensive evaluation result is calculated based on the following method:

[0181]

[0182] Among them, S represents the fuzzy comprehensive evaluation result, C represents the target indicator weight set of the first-level risk indicator set, R represents the fuzzy membership matrix of the evaluation factor set, Q T represents the transposed matrix of Q, and Q represents the assignment matrix of the comment set.

[0183] In some embodiments of the present application, the device also includes an analysis module 105, which is used to analyze the security of financial data based on the fuzzy membership matrix and target weight set of the first-level risk indicator set to determine the first-level risk indicator with the highest security risk; analyze the security of financial data based on the fuzzy membership matrix and target weight set of the second-level risk indicator set to determine the second-level risk indicator with the highest security risk; and formulate security measures to improve the security of financial data based on the first-level risk indicator with the highest security risk and the second-level risk indicator with the highest security risk.

[0184] It should be noted that any of the above-mentioned financial data security risk assessment devices can implement the above-mentioned financial data security risk assessment method one-to-one, which will not be repeated here.

[0185] Figure 8 FIG. 1 is a schematic diagram showing the structure of an electronic device provided in an embodiment of the present application. Figure 8 As shown, at the hardware level, the electronic device includes a processor, and optionally also includes an internal bus, a network interface, and a memory. Among them, the memory may include a memory, such as a high-speed random access memory (RAM), and may also include a non-volatile memory (non-volatile memory), such as at least one disk storage, etc. Of course, the electronic device may also include hardware required for other services.

[0186] The processor, network interface and memory can be interconnected through an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 8 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0187] The memory is used to store programs. Specifically, the program may include program code, and the program code includes computer operation instructions. The memory may include internal memory and non-volatile memory, and provides instructions and data to the processor.

[0188] The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it, forming a financial data security risk assessment device at the logical level. The processor executes the program stored in the memory and is specifically used to execute the above method.

[0189] The processor may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor or an instruction in the form of software. The above processor may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware decoding processor to be executed, or a combination of hardware and software modules in the decoding processor to be executed. The software module may be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0190] The electronic device can execute the financial data security risk assessment method provided by multiple embodiments of the present application, and realize a financial data security risk assessment device in Figure 7 The functions of the illustrated embodiment will not be described in detail in the embodiments of the present application.

[0191] An embodiment of the present application also proposes a computer-readable storage medium, which stores one or more programs, and the one or more programs include instructions. When the instructions are executed by an electronic device including multiple application programs, the electronic device can execute the financial data security risk assessment method provided by multiple embodiments of the present application.

[0192] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0193] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0194] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0195] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0196] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0197] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0198] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0199] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity or device including the element.

[0200] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0201] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A financial data security risk assessment method, characterized in that: The method comprises: Determining an initial risk indicator set, wherein the initial risk indicator set includes a plurality of risk indicators that affect financial data security; Based on the approximate ideal solution sorting method, the initial risk indicator set is screened to determine the target risk indicator set, wherein the target risk indicator set includes n first-level risk indicators, and the n first-level risk indicators correspond to n second-level risk indicator sets; Determine an initial weight set of the target risk indicator set based on the fuzzy analytic hierarchy process, wherein the weight set includes a weight set of n first-level risk indicators and a weight set of each second-level risk indicator set; The entropy weight of the target risk indicator set is used to modify the initial weight set of the target risk indicator set to obtain the target weight set of the target risk indicator set; Based on the fuzzy membership matrix of the evaluation factor set, the target weight set of the target risk indicator set and the assignment matrix of the comment set, the fuzzy comprehensive evaluation result of the financial data security risk is calculated; wherein, the evaluation factor set includes factors affecting the financial data security risk assessment, and the comment set represents the assessment level of the financial data security risk.

2. The method according to claim 1, characterized in that The method of sorting based on the approximate ideal solution is used to screen the initial risk indicator set to determine the target risk indicator set, including: Determine the distance between each risk indicator in the initial risk indicator set and the positive ideal solution, and the distance between each risk indicator and the negative ideal solution; Based on the distance between each risk indicator and the positive ideal solution, and the distance between each risk indicator and the negative ideal solution, the relative proximity of each risk indicator is calculated; The risk indicators whose relative proximity is higher than the threshold are used as the target risk indicator set.

3. The method according to claim 1, characterized in that: The initial weight set of the target risk indicator set is determined based on the fuzzy analytic hierarchy process, including: Determine the fuzzy judgment matrix of the target risk indicator set, perform consistency check on the fuzzy judgment matrix of the target risk indicator set, and generate the fuzzy consistency matrix of the target risk indicator set; Based on the fuzzy consistency matrix of the target risk indicator set, the initial weight set of the target risk indicator set is calculated.

4. The method according to claim 3, characterized in that The step of determining the fuzzy judgment matrix of the target risk indicator set, performing consistency check on the fuzzy judgment matrix of the target risk indicator set, and generating the fuzzy consistency matrix of the target risk indicator set includes: Determine the fuzzy judgment matrix of the first-level risk indicator set and the fuzzy judgment matrices of n second-level risk indicator sets, perform consistency check on each fuzzy judgment matrix, and generate the fuzzy consistency matrix of the first-level risk indicator set and the fuzzy consistency matrix of each second-level risk indicator set; The fuzzy consistency matrix based on the target risk indicator set is used to calculate the initial weight set of the target risk indicator set, including: Calculating an initial weight set of the first-level risk indicator set based on the fuzzy consistency matrix of the first-level risk indicator set, wherein the initial weight set of the first-level risk indicator set includes an initial weight of each first-level risk indicator; Based on the fuzzy consistency matrix of n secondary risk indicator sets, the initial weight set of each secondary risk indicator set is calculated.

5. The method according to claim 1, characterized in that The entropy weight of the target risk indicator set is determined based on the following process: Constructing an entropy weight method original data matrix based on the initial weight set of the target risk indicator set; Determine the information entropy of each risk indicator based on the original data matrix of the entropy weight method; The entropy weight of each risk indicator is calculated based on the information entropy of each risk indicator.

6. The method according to claim 4, characterized in that The method of using the entropy weight of the target risk indicator set to correct the initial weight set of the target risk indicator set to obtain the target weight set of the target risk indicator set includes: Based on the entropy weight of the first-level risk indicator set, the initial weight set of the first-level risk indicator set is modified to obtain the target weight set of the first-level risk indicator set; Based on the entropy weight of each secondary risk indicator set, the initial weight set of each secondary risk indicator set is modified to obtain the target weight set of each secondary risk indicator set.

7. The method according to claim 1, characterized in that The fuzzy membership matrix of the evaluation factor set is determined based on the following method: Determine an assessment factor set, and divide the assessment factor set into s sub-factor sets; wherein the assessment factor set corresponds to a primary risk indicator set, and each sub-factor set corresponds to a secondary risk indicator set; Perform fuzzy evaluation on each sub-factor set and determine the fuzzy evaluation set of each sub-factor set; Based on the fuzzy evaluation set of each sub-factor set and the target indicator weight set of the corresponding secondary risk indicator set, the fuzzy comprehensive evaluation set of each sub-factor set is determined; Based on the fuzzy comprehensive evaluation set of s sub-factor sets, the fuzzy membership matrix of the evaluation factor set is constructed.

8. The method according to claim 1, characterized in that The fuzzy comprehensive evaluation results are calculated based on the following method: Among them, S represents the fuzzy comprehensive evaluation result, C represents the target indicator weight set of the first-level risk indicator set, R represents the fuzzy membership matrix of the evaluation factor set, Q T represents the transposed matrix of Q, and Q represents the assignment matrix of the comment set.

9. The method according to any one of claims 1 to 8, characterized in that The method further comprises: Analyze the financial data security based on the fuzzy membership matrix and target weight set of the primary risk indicator set to determine the primary risk indicator with the highest security risk; Analyze the security of financial data based on the fuzzy membership matrix and target weight set of the secondary risk indicator set, and determine the secondary risk indicator with the highest security risk; Based on the first-level risk indicators with the highest security risks and the second-level risk indicators with the highest security risks, security measures to improve the security of financial data are formulated.

10. A financial data security risk assessment device, characterized in that: The device comprises: A determination module, used to determine an initial risk indicator set, wherein the initial risk indicator set includes a plurality of risk indicators that affect the security of financial data; A screening module is used to screen the initial risk indicator set based on the approximate ideal solution sorting method to determine a target risk indicator set, wherein the target risk indicator set includes n first-level risk indicators, and the n first-level risk indicators correspond to n second-level risk indicator sets; The determination module is further used to determine an initial weight set of the target risk indicator set based on the fuzzy analytic hierarchy process, wherein the weight set includes a weight set of n first-level risk indicators and a weight set of each second-level risk indicator set; A correction module, used to correct the initial weight set of the target risk indicator set by using the entropy weight of the target risk indicator set to obtain a target weight set of the target risk indicator set; A calculation module is used to calculate the fuzzy comprehensive evaluation result of the financial data security risk based on the fuzzy membership matrix of the evaluation factor set, the target weight set of the target risk indicator set and the assignment matrix of the comment set; wherein the evaluation factor set includes factors affecting the financial data security risk assessment, and the comment set represents the assessment level of the financial data security risk.

Images