Financial data security management system and method thereof

Abstract

The invention relates to the technical field of data security, in particular to a financial data security management system and method, and the system comprises a data monitoring module, a vulnerability prediction module, a dynamic isolation module, a behavior analysis module and a security response module. According to the invention, through deep monitoring and analysis of financial data, the capability of identifying and processing abnormal operation is improved, so that the data security is enhanced, and through real-time collection of financial transaction and account behavior data and detailed analysis of fund flow frequency and account access frequency, risks are effectively identified and potential security vulnerabilities are predicted. By dynamically analyzing the association between the transaction node and the risk event, evaluating the risk level and automatically adjusting the data storage position and the access authority according to the risk evaluation, the security of the data in the transmission and storage process is remarkably improved, in addition, by monitoring the behavior mode change of the isolated account, the abnormal activity is further identified and corrected, and the safety of the data transmission and storage process is improved. And the overall safety and stability of the financial data environment are ensured.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a financial data security management system and method. Background Art

[0002] The field of data security technology includes information protection and management, which aims to prevent unauthorized access, use, disclosure, destruction, modification or interruption. It covers a wide range of technologies from physical security measures to encryption technology to protect data stored on digital media, including network security measures such as firewalls and intrusion detection systems, data encryption technology, and access control mechanisms to ensure that only authorized users can access sensitive information. Overall, the field of data security technology focuses on the development and application of various tools and strategies to combat data leakage, data theft and other forms of information security threats.

[0003] Among them, the financial data security management system refers to a system specially designed to protect and process sensitive financial-related data. The subject covers technical measures for specific security needs of financial data, such as implementing enhanced data encryption, specific access control policies and data integrity verification to ensure that only users with corresponding permissions can access or modify financial data, and implementing encryption of data during transmission and storage to prevent unauthorized access or leakage of data, including monitoring functions for data access and modification activities for security audits and compliance checks.

[0004] Existing technologies lack continuous monitoring of account behavior and permission changes, which limits their effectiveness in addressing internal risks and complex security threats. They lack sufficient flexibility to adapt to the rapidly changing threat environment, especially in the financial field with high data liquidity and frequent transactions. They are slow to respond to new or variant security threats, increasing the risk of data leakage or financial fraud. They lack deep integration of account behavior patterns and funds liquidity analysis, making it difficult to timely predict and prevent potential internal and external security threats, which may lead to unauthorized access or loss of important financial information. Summary of the invention

[0005] In order to solve the technical problems existing in the prior art, such as the lack of continuous monitoring of account behavior and permission changes, which limits its effectiveness in dealing with internal risks and complex security threats, lacks sufficient flexibility to adapt to the rapidly changing threat environment, especially in the financial field with high data liquidity and frequent transactions, and is slow to respond to new or variant security threats, increasing the risk of data leakage or financial fraud, lacks deep integration of account behavior patterns and fund liquidity analysis, and is difficult to timely predict and prevent potential internal and external security threats, thus leading to unauthorized access or loss of important financial information. The embodiments of the present invention provide a financial data security management system and method. The technical solution is as follows: In one aspect, a financial data security management system is provided, the system comprising: The data monitoring module collects transaction flows and account behaviors in the financial data stream, analyzes the frequency of changes in capital flows, calculates the frequency of account accesses, compares the frequency of changes in capital flows with the frequency of accesses, determines the risk of abnormal operations of accounts, and generates abnormal operation indicators; The vulnerability prediction module locates the transaction nodes of abnormal accounts based on the abnormal operation indicators, analyzes the matching relationship between the transaction nodes and risk events, evaluates the risk level of the nodes, calculates the correlation between the transaction frequency and the risk events, predicts the security vulnerabilities that appear in the transaction nodes, and generates vulnerability risk assessment results; Based on the vulnerability risk assessment results, the dynamic isolation module identifies risky data storage nodes, analyzes financial data distribution, calculates migration priorities, plans migration paths, migrates data to low-risk storage nodes, and obtains data node isolation configuration; Based on the data node isolation configuration, the behavior analysis module compares the data access frequency of the account before and after isolation, identifies abnormal account activities, determines the abnormal characteristics of the account behavior pattern, locates the source of the security vulnerability, and obtains the behavior characteristic analysis results.

[0006] On the other hand, the abnormal operation indicators include the frequency of account fund changes, access frequency differences and permission change frequencies; the vulnerability risk assessment results include node risk levels, transaction and event matching degrees and vulnerability identification results; the data node isolation configuration includes data migration priority, data migration path and permission update standards; the behavior feature analysis results include behavior pattern change indicators, access frequency comparison results and abnormal activity identification.

[0007] On the other hand, the data monitoring module includes: The fund flow analysis submodule collects transaction flows and account behaviors in the financial data stream, analyzes the time series of fund inflows and outflows in the transaction flows, calculates the time intervals between consecutive transactions, counts the frequency changes of fund flows, compares the ratio of fund inflows and outflows, identifies accounts with abnormal fund activities, and obtains fund liquidity indicators; The account access monitoring submodule retrieves access data of abnormal fund accounts based on the fund liquidity index, analyzes the distribution of access times in different time periods, calculates the access fluctuation degree of the account in a short period of time, determines whether there is abnormal access behavior in the account, and obtains the account access fluctuation index; The permission change statistics submodule calls the permission modification record of the account based on the account access fluctuation index, counts the number of permission changes, combines the account's capital flow and access monitoring data, calculates the abnormal degree of permission changes, and generates abnormal operation indicators.

[0008] On the other hand, the vulnerability prediction module includes: The abnormal transaction identification submodule screens the transaction data of abnormal accounts based on the abnormal operation indicators, analyzes the correlation between transaction time and amount and account operation mode, measures the distribution density of abnormal transactions and classifies them, identifies abnormal transaction nodes, and generates an abnormal transaction node set; The transaction node matching submodule calls the abnormal transaction node set, analyzes the transaction behavior characteristics, compares the patterns of the identified risk events, calculates the matching degree between the nodes and the risk events, evaluates the risk level of the transaction nodes, and generates a transaction risk matching index; The vulnerability risk assessment submodule analyzes the transaction frequency of abnormal nodes, extracts transaction time intervals, calculates the transaction fluctuation range within a short period, predicts the probability of security vulnerabilities according to the risk matching degree of the nodes, and generates vulnerability risk assessment results.

[0009] On the other hand, the matching degree between the computing node and the risk event is calculated using the formula: ; Evaluate the risk level of transaction nodes and generate a transaction risk matching index; Among them, M represents the matching degree between the transaction node and the risk event. represents the characteristic value of transaction node i, represents the reference feature value of risk event i, and n represents the total number of features involved in the transaction node.

[0010] On the other hand, the dynamic isolation module includes: The risk node identification submodule detects risk nodes in the data storage network based on the vulnerability risk assessment results, analyzes the type and sensitivity of financial data stored in the nodes, screens storage nodes with security vulnerabilities, determines the range of data nodes that need to be isolated, and obtains a risk node list; The data migration analysis submodule analyzes the data distribution in the affected nodes based on the risk node list, calculates the data association degree and interaction frequency between nodes, determines the impact scope and priority of data migration, and generates a data migration priority index; The data association degree and interaction frequency between the computing nodes are calculated using the formula: ; Determine the impact scope and priority of data migration and generate a data migration priority index; Calculate data interaction frequency , determine the impact scope and priority of data migration, and generate a data migration priority index; in, Represents the frequency of data interaction between node a and node b, Represents the data flow of node a in data dimension v, represents the data flow of node b in data dimension v, Represents the request frequency of node a on data dimension v, represents the request frequency of node b on data dimension v, and w represents the total number of data dimensions; The data storage reconstruction submodule analyzes the data flow path between storage nodes based on the data migration priority index, allocates storage resources, plans the optimal data migration path, and adjusts the access rights of the secure storage nodes to obtain the data node isolation configuration.

[0011] On the other hand, the behavior analysis module includes: The behavior pattern change analysis submodule calls the behavior records of the isolated account based on the data node isolation configuration, compares the account activity characteristics before and after isolation, analyzes the amplitude and frequency of the account behavior changes, calculates the degree of deviation of the behavior pattern, and obtains the behavior pattern deviation index; The data access frequency comparison submodule compares the data access frequency of the account before and after isolation based on the behavior pattern deviation index, analyzes the changes in access time point, access duration and access frequency, determines the fluctuation of access frequency, and generates an access frequency fluctuation index; The abnormal behavior identification submodule identifies account activities that deviate from normal patterns based on the access frequency fluctuation index, analyzes the characteristics of account abnormal behavior patterns, matches the relationship between account activity characteristics and known vulnerabilities, locates the source of security vulnerabilities, and generates behavior feature analysis results.

[0012] In another aspect, the system further comprises: The security response module determines abnormal transaction accounts based on the behavior feature analysis results, adjusts account access rights, allocates transaction quota ratios, updates account transaction verification methods, and generates security protection measures; The security protection measures specifically include account authority adjustment results, transaction limit configuration and updated verification methods.

[0013] On the other hand, the security response module includes: Based on the behavior feature analysis results, the account authority control submodule analyzes the frequency of risky operations of the account, calculates the impact scope of account authority changes, identifies accounts with frequent abnormal operations, reconfigures account access rights, imposes access restrictions on high-risk accounts, and generates account authority adjustment configurations; The transaction quota management submodule calls the account authority adjustment configuration, calls the transaction records of abnormal accounts, calculates the fluctuation range of transaction quotas, analyzes the trend of transaction quota changes in the short term, determines the degree of deviation between the transaction amount and the normal behavior of the account, adjusts the transaction quota upper limit of the account, allocates the transaction quota ratio, and generates the optimized transaction quota; The verification method optimization submodule screens accounts with abnormal transaction frequencies based on the optimized transaction amount, extracts the identity authentication records of the accounts, analyzes the security level of transaction verification of abnormal accounts, determines whether the transaction verification matches the account risk level, optimizes the transaction verification method of the accounts, and generates security protection measures.

[0014] On the other hand, a financial data security management method is provided, which is applied to a financial data security management system and includes the following steps: S1: Collect transaction flows and account behaviors in financial data streams, analyze the frequency of changes in capital flows, calculate the frequency of account accesses, compare the frequency of capital flow changes with the frequency of accesses, determine the abnormal operation risk of the account, and generate abnormal operation indicators; S2: Based on the abnormal operation indicators, locate the transaction nodes of abnormal accounts, analyze the matching relationship between transaction nodes and risk events, evaluate the risk level of nodes, calculate the correlation between transaction frequency and risk events, predict security vulnerabilities in transaction nodes, and generate vulnerability risk assessment results; S3: Based on the vulnerability risk assessment results, identify risky data storage nodes, analyze financial data distribution, calculate migration priorities, plan migration paths, migrate data to low-risk storage nodes, and obtain data node isolation configuration; S4: Based on the data node isolation configuration, compare the data access frequency of the account before and after isolation, identify abnormal account activities, determine the abnormal characteristics of the account behavior pattern, locate the source of the security vulnerability, and obtain the behavior characteristic analysis results; S5: Based on the behavior feature analysis results, determine abnormal transaction accounts, adjust account access rights, allocate transaction quota ratios, update account transaction verification methods, and generate security protection measures.

[0015] The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least: Through in-depth monitoring and analysis of financial data, the ability to identify and handle abnormal operations has been improved, thereby enhancing data security. By collecting financial transaction and account behavior data in real time, the frequency of fund flows and account access is analyzed in detail, effectively identifying risks and predicting potential security vulnerabilities. By dynamically analyzing the relationship between transaction nodes and risk events, the risk level is assessed, and the data storage location and access rights are automatically adjusted based on the risk assessment, significantly improving the security of data during transmission and storage. In addition, by monitoring changes in the behavioral patterns of isolated accounts, abnormal activities can be further identified and corrected, ensuring the overall security and stability of the financial data environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0017] Figure 1 It is a system schematic diagram of the present invention; Figure 2 It is a schematic diagram of the system framework of the present invention. DETAILED DESCRIPTION

[0018] The technical solution of the present invention is described below in conjunction with the accompanying drawings.

[0019] In the embodiments of the present invention, words such as "exemplarily" and "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "example" in the present invention should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of the word "example" is intended to present the concept in a specific way. In addition, in the embodiments of the present invention, the meaning expressed by "and / or" can be both, or it can be either of the two.

[0020] In the embodiments of the present invention, "image" and "picture" can sometimes be used interchangeably. It should be noted that when the difference between them is not emphasized, the meanings they intend to express are the same. "of", "corresponding, relevant" and "corresponding" can sometimes be used interchangeably. It should be noted that when the difference between them is not emphasized, the meanings they intend to express are the same.

[0021] In the embodiments of the present invention, sometimes a subscript such as W1 may be written as a non-subscript such as W1. When the difference is not emphasized, the meanings to be expressed are the same.

[0022] In order to make the technical problems, technical solutions and advantages to be solved by the present invention more clear, a detailed description will be given below with reference to the accompanying drawings and specific embodiments.

[0023] The embodiment of the present invention provides a financial data security management system, such as Figure 1 As shown, the system includes: The data monitoring module collects transaction flows and account behaviors in the financial data stream, analyzes the frequency of changes in capital flows, calculates the access frequency of each account, compares the frequency of changes in capital flows with the access frequency, and combines the number of account permission modifications to determine the abnormal operation risk of the account and generate abnormal operation indicators; The vulnerability prediction module locates the transaction nodes of abnormal accounts based on abnormal operation indicators, analyzes the matching relationship between transaction nodes and known risk events, evaluates the risk level of transaction nodes, calculates the correlation between transaction frequency and risk events, predicts security vulnerabilities in abnormal transaction nodes, and generates vulnerability risk assessment results; Based on the vulnerability risk assessment results, the dynamic isolation module identifies risky data storage nodes, analyzes the distribution of affected financial data, calculates the data migration priority between storage nodes, plans the data transfer path, migrates data to low-risk storage nodes, and adjusts the node access rights to obtain data node isolation configuration; The behavior analysis module analyzes the behavior pattern changes of isolated accounts based on the data node isolation configuration, compares the data access frequency of accounts before and after isolation, identifies account activities that deviate from normal behavior, determines the abnormal characteristics of account behavior patterns, locates the source of security vulnerabilities, and obtains behavior feature analysis results; The security response module determines abnormal transaction accounts based on the results of behavioral feature analysis, adjusts account access rights according to account risk levels, allocates transaction quota ratios, updates account transaction verification methods, optimizes account security protection, and generates security protection measures.

[0024] Abnormal operation indicators include the frequency of account fund changes, access frequency differences and permission change frequencies; vulnerability risk assessment results include node risk level, transaction and event matching degree and vulnerability identification results; data node isolation configuration includes data migration priority, data migration path and permission update standards; behavioral feature analysis results include behavioral pattern change indicators, access frequency comparison results and abnormal activity identification; security protection measures include account permission adjustment results, transaction limit configuration and updated verification method.

[0025] like Figure 2 As shown, the data monitoring module includes: The fund flow analysis submodule collects transaction flows and account behaviors in the financial data stream, analyzes the time series of fund inflows and outflows in the transaction flows, calculates the time interval between consecutive transactions, counts the frequency changes of fund flows, compares the ratio of fund inflows and outflows, identifies accounts with abnormal fund activities, and obtains fund liquidity indicators; Extract the capital inflow and outflow data from the transaction log and account behavior monitoring records. The capital inflow and outflow time series is obtained by parsing the timestamp field in the transaction log. After sorting each transaction in chronological order, the time interval between adjacent transactions is calculated. Assume that the transaction log data set contains the transaction time field , then the time interval between consecutive transactions is calculated as ,in Representative The time interval between the last transaction and the previous transaction. After calculating all the time interval values, the mean, variance and extreme value are counted to obtain the time distribution characteristics of trading activities. When calculating the frequency of capital flow, set the time window , count the number of transactions within the time window , then the calculation method of fund flow frequency is , if the number of transactions of an account in a 1-hour window is 25, then Transaction / hour, fund flow is calculated by comparing fund inflow and outflow separately, assuming the fund inflow amount is , the amount of funds outflow is , then the calculation method of capital flow ratio is For example, if the total inflow of funds in an account is 50,000 yuan and the total outflow is 40,000 yuan, then the capital flow ratio is , the capital flow ratio exceeding the set threshold may indicate abnormal capital operation. When identifying abnormal capital accounts, select the standard deviation of the transaction time interval Liquidity Ratio As a basis for judgment, if the standard deviation of the trading time interval of an account Minutes, cash flow ratio , and is higher than the system set abnormal threshold , then the account is determined to be an abnormal account, and the liquidity index is obtained based on the above calculation results.

[0026] The account access monitoring submodule retrieves access data of abnormal accounts based on fund liquidity indicators, analyzes the distribution of access times in different time periods, calculates the access fluctuation degree of accounts in a short period of time, determines whether there is abnormal access behavior in the account, and obtains the account access fluctuation indicator; Set time partition And the corresponding number of visits , then the access frequency distribution vector is ,The short-term visit fluctuation degree is measured by calculating the change rate of the number of visits, assuming that the time period and The number of visits is and , then the access volatility is calculated as , if an account is in a 10-minute period 15 visits in the time period The number of visits within 30 times, the visit volatility , that is, the number of visits increases by 100%, and the abnormal access behavior is judged based on the abnormal threshold of the access volatility If you set , then the account volatility 1.0 is higher than the threshold and is determined to be an abnormal access. The account access volatility index is obtained by integrating the access number distribution vector and the access volatility.

[0027] The permission change statistics submodule is based on the account access fluctuation index, calls the account's permission modification records, counts the number of permission changes, combines the account's capital flow and access monitoring data, calculates the abnormal degree of permission changes, and generates abnormal operation indicators.

[0028] Set up an account In the time window The number of permission modifications in , the number of permission changes is , combined with fund flow and access monitoring data, calculate the abnormal degree of permission change, and set fund liquidity index and account access volatility indicators , then the abnormal authority change score calculation method is ,in , , The adjustment coefficient is set according to the original data statistics. If an account In the past 24 hours, the permissions have been changed 5 times, the liquidity index is 3.2, the access volatility index is 1.8, and the adjustment coefficient is , , ,but , Abnormal Permission Change Score Exceeding the set threshold , then the account is judged as an abnormal account, and the abnormal operation indicator is calculated based on the number of permission changes, capital liquidity and access fluctuation data.

[0029] like Figure 2 As shown, the vulnerability prediction module includes: The abnormal transaction identification submodule screens the transaction data of abnormal accounts based on abnormal operation indicators, analyzes the correlation between transaction time and amount and account operation mode, measures the distribution density of abnormal transactions and classifies them, identifies abnormal transaction nodes, and generates a set of abnormal transaction nodes; Call the database log to extract account transaction details. Suppose the set of all transaction records of account P within time Q is , keep all the matching The transaction records of the transaction time and amount are analyzed by using the transaction data regression method. Suppose the transaction amount of account P at transaction time Q is , the time interval is , calculate its regression relationship and define the correlation calculation formula: ; in and are the mean of the transaction amount and transaction time interval of account P respectively. , then the transaction mode is highly correlated with the account operation mode. The calculation of abnormal transaction distribution density adopts the kernel density estimation method. Assuming the transaction amount density function is f(R), the calculation formula of abnormal transaction density is: , where h is the smoothing parameter, K(x) is the kernel function, and the transaction category with higher density value is classified as high-risk transaction type. The abnormal transaction node identification is obtained by calculating the degree of transaction abnormality. Let the transaction abnormality score be , calculated as ,in , is the weight parameter, if Exceeding the set threshold , then mark the transaction as an abnormal transaction and generate a set of abnormal transaction nodes.

[0030] The transaction node matching submodule calls the abnormal transaction node set, analyzes the transaction behavior characteristics, compares the patterns of identified risk events, calculates the matching degree between the node and the risk event, evaluates the risk level of the transaction node, and generates a transaction risk matching index; The matching degree between the calculation node and the risk event is calculated using the formula: ; Evaluate the risk level of transaction nodes and generate a transaction risk matching index; Among them, M represents the matching degree between the transaction node and the risk event. represents the characteristic value of transaction node i, represents the reference feature value of risk event i, and n represents the total number of features involved in the transaction node; Transaction node characteristic value The characteristic value of each transaction node is obtained by monitoring and statistical analysis of historical transaction data, including transaction amount, transaction frequency, number of counterparties, transaction time distribution and other dimensions. The characteristic value calculation adopts standardization processing to normalize the data of each dimension to The interval is standardized as follows: ; in, Represents the original transaction data value, min(X) and max(X) represent the minimum and maximum values ​​of the transaction feature in all transaction nodes respectively; Risk event reference characteristic value The transaction characteristics of known risk events are obtained by analysis and normalization using the same standardization method for comparative analysis. The calculation method is: ; in, Represents the characteristic value of the identified risk event, min(Y) and max(Y) represent the minimum and maximum value of the risk event among all known risk events respectively; For a set of transaction data, let n=4, and the four transaction features are transaction amount, transaction frequency, number of counterparties, and transaction time distribution. The collected transaction node feature data are as follows: ; Assume the maximum and minimum values ​​of this feature in all transaction nodes: , ; After normalization: ; Corresponding characteristics of known risk events: ; , ; After normalization: ; Calculate the matching degree between the eigenvalue and the risk event:

[0031]

[0032] Calculate the sum of squares of transaction characteristics:

[0033] Calculate the average value of risk event characteristics: ; ; Enter the calculation formula: ; Calculate the square root: ; Final calculation: ; The result shows that the matching degree between the transaction node and the identified risk event is 0.8793. The closer the value is to 1, the closer the transaction behavior of the transaction node is to the identified risk event and the higher the risk level. The matching index is used for risk level assessment.

[0034] The vulnerability risk assessment submodule analyzes the transaction frequency of abnormal nodes, extracts transaction time intervals, calculates the transaction fluctuation range within a short period, and predicts the probability of security vulnerabilities based on the risk matching degree of the nodes to generate vulnerability risk assessment results.

[0035] The vulnerability risk assessment submodule analyzes the transaction frequency of abnormal transaction nodes and extracts transaction time interval data. The number of transactions of node W in the time window X is , then the transaction frequency is calculated as When calculating the short-term trading fluctuation range, assume that the average trading time interval within the time window X is , the variance is , then the trading fluctuation range is calculated as ,in Represents the trading volatility range within the 95% confidence interval, trading risk matching index It is used to measure the similarity between the transaction pattern and known risky transactions. The calculation method is ,in is the average transaction frequency. Vulnerability risk prediction is based on transaction risk matching index and transaction fluctuation range. Let the vulnerability risk score be , calculated as ,in , is the adjustment factor, if Exceeding the set threshold , then it is predicted that the node has a security vulnerability and a vulnerability risk assessment result is generated.

[0036] like Figure 2 As shown, the dynamic isolation module includes: The risk node identification submodule detects risk nodes in the data storage network based on the vulnerability risk assessment results, analyzes the type and sensitivity of financial data stored in the nodes, screens storage nodes with security vulnerabilities, determines the range of data nodes that need to be isolated, and obtains a list of risk nodes; Call the system's built-in data monitoring log, read the log files of the storage nodes one by one, extract storage operations, read and write requests, and data access records, parse the access time, access frequency, data size and other parameters in the log content for each storage node, and compare them with historical access records. In this process, it is necessary to count the number of accesses to each storage node in the recent period of time, calculate the rate of change of its access frequency, set the time window to 24 hours, and record the number of accesses per hour as , then the access frequency calculation formula is as follows: ,in, represents the average access frequency of storage node L, if If the average daily change of exceeds a certain set threshold, it is preliminarily determined that the node may have abnormal access behavior. In addition, it is necessary to calculate the data flow of the storage node, including the amount of stored data. and the amount of data read , calculate its data flow ratio : ,like Obviously higher or lower than a certain benchmark value, such as setting the benchmark value to 1.2, then If , it may be an abnormal data extraction behavior. Further, the access distribution of storage nodes in different time periods is calculated, and the coefficient of variation is used Measuring fluctuations in visit behavior: ,in, is the standard deviation of the number of visits, is the mean of the number of visits, if , it indicates that the access behavior fluctuates greatly and there may be anomalies. Next, the data type of the storage node is analyzed, and the data storage type field is extracted from the log to determine whether it contains highly sensitive data, such as account information, transaction data, etc. The threshold of the proportion of sensitive data is set to 50%. If the proportion of sensitive data stored in a storage node exceeds 50%, the risk level of the node is increased. Finally, combined with all calculation results, storage nodes that meet one of the following conditions are selected as risk nodes: the access frequency change rate exceeds the set threshold; the data flow ratio is obviously abnormal (>1.2 or <0.8); the access fluctuation coefficient is greater than 1.5; the proportion of sensitive data exceeds 50%. Storage nodes that meet any of the above conditions will be included in the risk node list.

[0037] The data migration analysis submodule analyzes the data distribution in the affected nodes based on the risk node list, calculates the data correlation degree and interaction frequency between nodes, determines the impact scope and priority of data migration, and generates a data migration priority index; Calculate the data association degree and interaction frequency between nodes using the formula: ; Determine the impact scope and priority of data migration and generate a data migration priority index; in, Represents the frequency of data interaction between node a and node b, Represents the data flow of node a in data dimension v, represents the data flow of node b in data dimension v, Represents the request frequency of node a on data dimension v, represents the request frequency of node b on data dimension v, and w represents the total number of data dimensions; and Represents the data flow between nodes a and b in data dimension v, in MB / s. This parameter is obtained through the traffic monitoring system. The transmission rate of data packets is recorded during the monitoring period and calculated based on traffic integration. In actual data monitoring, node a is The measured throughput values ​​of node a on the same dimensions are 58.4MB / s, 69.7MB / s, and 63.5MB / s respectively, and the measured throughput values ​​of node b on the same dimensions are 53.2MB / s, 66.1MB / s, and 61.8MB / s respectively; and Represents the request frequency of node a and node b on data dimension v, in times / s. This parameter is obtained through server log analysis, which counts the number of requests during the monitoring period and classifies them by data dimension. Log analysis shows that node a The request frequencies of node a on the same dimension are 102 times / s, 118 times / s, and 109 times / s respectively, and the request frequencies of node b on the same dimension are 97 times / s, 123 times / s, and 113 times / s respectively; The total number of data dimensions w=3; Calculation process: The first part of the calculation: ; Calculate each term: 58.4×53.2=3107.68, 69.7×66.1=4610.17, 63.5×61.8=3928.30; Sum: ; Take the square root: ; The second part of the calculation: ; Calculate each term: 102×97=9894, 118×123=14514, 109×113=12317; Sum: 9894+14514+12317=36725; Take the average: ; Final calculation: ; Result analysis: Calculation results Represents the frequency of data interaction between node a and node b. The value reflects the comprehensive level of data transmission and access intensity. A higher value indicates that data interaction between nodes is more frequent and data flow is more active, which is suitable as an important basis for data migration analysis.

[0038] The data storage reconstruction submodule analyzes the data flow path between storage nodes based on the data migration priority index, allocates storage resources, plans the optimal data migration path, and adjusts the access rights of the secure storage nodes to obtain the data node isolation configuration.

[0039] Parse the risk node list, read the storage data flow of each risk node, calculate its data interaction intensity with other storage nodes, and set the data interaction frequency The calculation formula is as follows: ,in, Represents the data access amount of storage node e in data dimension u, is the access amount of storage node f on the same data dimension, V is the total number of data dimensions, if , it indicates that there is a strong data interaction between storage node e and node f, and they may need to be migrated together. In the data migration priority calculation, the load pressure of the storage node must also be calculated. Defined as: ,in, is the current storage utilization of the storage node, is the maximum storage capacity of the node, if , it indicates that the storage pressure of the node is large, and it is recommended to migrate it first. In addition, the number of access conflicts of the storage node needs to be calculated, that is, the situation where the storage node is accessed by multiple users at the same time in a certain period of time. Let the number of conflicts be ,like If the node has access bottlenecks, the data migration priority of the storage node is calculated based on the data interaction frequency, load pressure, and access conflicts. : ,in, , , are the weights of different factors, set , , , if the calculation result , then the storage node is migrated first. Next, based on the data migration priority index, the optimal data migration path is planned. The principle of the shortest path for data flow is adopted, that is, the path with the smallest data transmission volume in the migration path is selected first, and the data transmission path weight is calculated. : ,in, Representative path The amount of data transferred on represents the path bandwidth, H is the total number of optional paths, and The data is migrated along the shortest path. After the migration is completed, the access rights of the target storage node are adjusted, and the access rights update rules are set as follows: if the original node is a high-risk node, the target node is only allowed to be accessed by the administrator; if the number of access conflicts on the original node is high, the target node needs to be set with a single-user concurrent access restriction to complete the data node isolation configuration.

[0040] like Figure 2 As shown, the behavior analysis module includes: The behavior pattern change analysis submodule calls the behavior records of isolated accounts based on the data node isolation configuration, compares the account activity characteristics before and after isolation, analyzes the magnitude and frequency of account behavior changes, calculates the degree of deviation of the behavior pattern, and obtains the behavior pattern deviation index; The behavior records of isolated accounts are called up, and the account activity characteristics before and after isolation are compared. The data node isolation configuration defines the data access rights and transaction capabilities of the restricted account. The system extracts the access logs of isolated accounts, identifies the number of visits, access time intervals, transaction amount changes, account operation types and other data before and after isolation for each account, calculates the mean and standard deviation of the access time series through time series analysis methods, and sets the benchmark value of the transaction amount. is the transaction average of the account before isolation, and the average transaction amount before isolation is Yuan, average transaction value after quarantine Yuan, the change rate of the transaction amount is calculated as , set the reference value of access frequency is the average daily number of visits to the account before isolation. Assuming that the number of visits before isolation was 40 times / day and the number of visits after isolation dropped to 22 times / day, the change rate is calculated as (22-40) / 40=-45%. The threshold setting is used to determine whether there is an abnormal change in the account, such as setting a behavior change threshold. ,like , then the account behavior is marked as having significant changes. Combined with the account operation type, the number of operation instructions before and after isolation is counted. For example, if the average number of password changes per day before isolation is 2 times, and it increases to 5 times after isolation, then the increase is (5-2) / 2=150%, which exceeds the abnormal change threshold , and obtain the behavior mode deviation index.

[0041] The data access frequency comparison submodule compares the data access frequency of the account before and after isolation based on the behavior pattern deviation index, analyzes the changes in access time, access duration and access frequency, determines the fluctuation of access frequency, and generates access frequency fluctuation indicators; Extract data on access time, access duration, and access frequency. The system counts the access of isolated accounts in different time periods. Assume that the high-frequency access period of the account before isolation is 10:00-12:00, with 15 accesses per hour. After isolation, the number of accesses in the same time period drops to 6 times. Calculate the change in access frequency (6-15) / 15=-60%. Assume that the average access duration of the account before isolation is 30 minutes, which drops to 18 minutes after isolation. Calculate the change rate (18-30) / 30=-40%, and define the access frequency fluctuation index. The calculation formula is as follows: ;in and The average daily visit frequency before and after isolation, and Set a fluctuation threshold for access duration ,like , then the access frequency of the mark has abnormal fluctuations. The system analyzes the changes in the access time points. Suppose the access distribution of the account per hour before isolation is {12,15,18,14}, and the change after isolation is {5,8,6,7}. Calculate the mean square error ,like (Set the abnormal access fluctuation threshold to 5), then it is determined that the access pattern has fluctuated significantly and an access frequency fluctuation index is generated.

[0042] The abnormal behavior identification submodule identifies account activities that deviate from normal patterns based on access frequency fluctuation indicators, analyzes the characteristics of account abnormal behavior patterns, matches the relationship between account activity characteristics and known vulnerabilities, locates the source of security vulnerabilities, and generates behavioral feature analysis results.

[0043] Extract the account's access behavior records and construct access feature vectors , calculate the similarity between account behavior characteristics and known vulnerabilities, and set the vulnerability feature vector , using cosine similarity calculation: ,like (Set the risk threshold to 0.8), then the account is identified as having high-risk behavior. The system counts the frequency of abnormal activities of the account. Suppose the number of abnormal logins to the account before isolation is 3 times / day, and it increases to 9 times / day after isolation. The growth rate is calculated as (9-3) / 3=200%, which exceeds the abnormal threshold of 50%. The account behavior is determined to be abnormal. The system matches the account behavior characteristics with the known vulnerability pattern and sets the vulnerability matching threshold. ,If the account behavior matching degree is higher than the threshold, the source of the security vulnerability is located and the behavior feature analysis results are generated.

[0044] like Figure 2 As shown, the security response module includes: The account authority control submodule analyzes the frequency of risky operations of accounts based on the results of behavioral feature analysis, calculates the impact of account authority changes, identifies accounts with frequent abnormal operations, reconfigures account access rights, imposes access restrictions on high-risk accounts, and generates account authority adjustment configurations; Extract the account's operation records, analyze the account's risk operation frequency, and set the monitoring cycle The period is 30 days. The operation frequency of the account in this period is obtained from the log data. , including the number of logins, transaction submissions, permission changes, etc., to calculate the average operation frequency of the account in the past period and standard deviation , set the abnormal operation frequency threshold , if the current operation frequency of the account satisfy , the account is marked as a high-risk account, and the impact of the account permission change is further calculated, the account permission modification log is extracted, and the number of permission adjustments is counted. And calculate its mean and standard deviation , set the threshold for abnormal permission changes ,like , then the account has abnormal permission change behavior, combined with the account's risk score Calculate the overall risk level of the account and set the account access rights adjustment rules. (in If the risk threshold is high, access restrictions will be imposed on the account, including reducing data query permissions, adding multi-factor authentication steps, limiting transaction amounts, etc., and generating account permission adjustment configuration.

[0045] The transaction quota management submodule calls account authority adjustment configuration, calls transaction records of abnormal accounts, calculates the fluctuation range of transaction quotas, analyzes the trend of transaction quota changes in the short term, determines the degree of deviation between the transaction amount and the normal behavior of the account, adjusts the transaction quota upper limit of the account, allocates the transaction quota ratio, and generates the optimized transaction quota; Obtain the transaction permission range of the restricted account, call the transaction records of the abnormal account, and extract the transaction amount And calculate its mean and standard deviation Calculate the fluctuation range of the current transaction amount based on the transaction data of the past 30 days , set abnormal trading fluctuation threshold ,like , then the account transaction amount fluctuation is determined to be abnormal, and the transaction amount change trend in the short term is further analyzed to set the analysis window Days, calculate the average sequence of daily transaction amounts , calculate the regression slope of the series ,like Greater than the positive abnormal growth threshold Or less than the negative abnormal decline threshold , then the transaction amount trend is abnormal, calculate the transaction amount deviation , set the abnormal transaction amount threshold ,like , the transaction amount is judged to be significantly deviated from normal behavior, and the transaction limit of the account is adjusted and the adjustment rules are set. , and reallocate the transaction quota ratio, set different transaction quota adjustment ranges according to the risk level of the account, such as reducing the high-risk account quota by 50%, the medium-risk account quota by 30%, and the low-risk account quota by 10%, to generate the optimized transaction quota.

[0046] The verification method optimization submodule screens accounts with abnormal transaction frequencies based on the optimized transaction amount, extracts the account's identity authentication records, analyzes the security level of abnormal account transaction verification, determines whether the transaction verification matches the account risk level, optimizes the account's transaction verification method, and generates security protection measures.

[0047] Screen accounts with abnormal transaction frequency, extract account identity verification records, analyze transaction verification security levels of abnormal accounts, and set account transaction frequency detection windows Days, extract the transaction number sequence of the account in the past period , calculate the mean transaction frequency and standard deviation , set abnormal transaction frequency threshold , if the current transaction number of the account satisfy , then determine that the account transaction frequency is abnormal, further analyze the account's identity authentication security level, extract the account's identity authentication log, and count the number of times different authentication methods are used (such as password, fingerprint, SMS verification code, etc.), calculate the average of the verification methods and standard deviation , set the low security level verification times threshold , if the account uses a low security level authentication method satisfy , it is determined that the account has security risks. Finally, the transaction verification method is optimized according to the account risk level. High-risk accounts need to use multi-factor authentication (MFA), medium-risk accounts need to add biometric authentication, and low-risk accounts need to increase password complexity to generate security protection measures.

[0048] A financial data security management method comprises the following steps: S1: Collect transaction flows and account behaviors in financial data streams, analyze the frequency of changes in capital flows, calculate the frequency of account accesses, compare the frequency of capital flow changes with the frequency of accesses, determine the abnormal operation risk of the account, and generate abnormal operation indicators; S2: Based on abnormal operation indicators, locate the transaction nodes of abnormal accounts, analyze the matching relationship between transaction nodes and risk events, evaluate the risk level of nodes, calculate the correlation between transaction frequency and risk events, predict security vulnerabilities in transaction nodes, and generate vulnerability risk assessment results; S3: Based on the vulnerability risk assessment results, identify risky data storage nodes, analyze the financial data distribution, calculate the migration priority, plan the transfer path, migrate the data to low-risk storage nodes, and obtain the data node isolation configuration; S4: Based on the data node isolation configuration, compare the data access frequency of the account before and after isolation, identify abnormal account activities, determine the abnormal characteristics of the account behavior pattern, locate the source of the security vulnerability, and obtain the behavior characteristic analysis results; S5: Based on the results of behavioral feature analysis, identify abnormal trading accounts, adjust account access rights, allocate transaction quota ratios, update account transaction verification methods, and generate security protection measures.

[0049] It should be understood that the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. A and B can be singular or plural. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship, but it may also indicate an "and / or" relationship. Please refer to the context for specific understanding.

[0050] In the present invention, "at least one" means one or more, and "plurality" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0051] It should be understood that in various embodiments of the present invention, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0052] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different systems to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0053] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described equipment, devices and units can refer to the corresponding processes in the aforementioned system embodiments and will not be repeated here.

[0054] In the several embodiments provided by the present invention, it should be understood that the disclosed devices, apparatuses and systems can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of the units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0055] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0056] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0057] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the system described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc., various media that can store program codes.

[0058] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A financial data security management system, characterized in that: The system comprises: The data monitoring module collects transaction flows and account behaviors in the financial data stream, analyzes the frequency of changes in capital flows, calculates the frequency of account accesses, compares the frequency of changes in capital flows with the frequency of accesses, determines the risk of abnormal operations of accounts, and generates abnormal operation indicators; The vulnerability prediction module locates the transaction nodes of abnormal accounts based on the abnormal operation indicators, analyzes the matching relationship between the transaction nodes and risk events, evaluates the risk level of the nodes, calculates the correlation between the transaction frequency and the risk events, predicts the security vulnerabilities that appear in the transaction nodes, and generates vulnerability risk assessment results; Based on the vulnerability risk assessment results, the dynamic isolation module identifies risky data storage nodes, analyzes financial data distribution, calculates migration priorities, plans migration paths, migrates data to low-risk storage nodes, and obtains data node isolation configuration; Based on the data node isolation configuration, the behavior analysis module compares the data access frequency of the account before and after isolation, identifies abnormal account activities, determines the abnormal characteristics of the account behavior pattern, locates the source of the security vulnerability, and obtains the behavior characteristic analysis results.

2. The financial data security management system according to claim 1, characterized in that: The abnormal operation indicators include the frequency of account fund changes, access frequency differences and permission change frequencies; the vulnerability risk assessment results include node risk levels, transaction and event matching degrees and vulnerability identification results; the data node isolation configuration includes data migration priority, data migration path and permission update standards; the behavior feature analysis results include behavior pattern change indicators, access frequency comparison results and abnormal activity identification.

3. The financial data security management system according to claim 1, characterized in that: The data monitoring module includes: The fund flow analysis submodule collects transaction flows and account behaviors in the financial data stream, analyzes the time series of fund inflows and outflows in the transaction flows, calculates the time intervals between consecutive transactions, counts the frequency changes of fund flows, compares the ratio of fund inflows and outflows, identifies accounts with abnormal fund activities, and obtains fund liquidity indicators; The account access monitoring submodule retrieves access data of abnormal fund accounts based on the fund liquidity index, analyzes the distribution of access times in different time periods, calculates the access fluctuation degree of the account in a short period of time, determines whether there is abnormal access behavior in the account, and obtains the account access fluctuation index; The permission change statistics submodule calls the permission modification record of the account based on the account access fluctuation index, counts the number of permission changes, combines the account's capital flow and access monitoring data, calculates the abnormal degree of permission changes, and generates abnormal operation indicators.

4. The financial data security management system according to claim 1, characterized in that: The vulnerability prediction module includes: The abnormal transaction identification submodule screens the transaction data of abnormal accounts based on the abnormal operation indicators, analyzes the correlation between transaction time and amount and account operation mode, measures the distribution density of abnormal transactions and classifies them, identifies abnormal transaction nodes, and generates an abnormal transaction node set; The transaction node matching submodule calls the abnormal transaction node set, analyzes the transaction behavior characteristics, compares the patterns of the identified risk events, calculates the matching degree between the nodes and the risk events, evaluates the risk level of the transaction nodes, and generates a transaction risk matching index; The vulnerability risk assessment submodule analyzes the transaction frequency of abnormal nodes, extracts transaction time intervals, calculates the transaction fluctuation range within a short period, predicts the probability of security vulnerabilities according to the risk matching degree of the nodes, and generates vulnerability risk assessment results.

5. The financial data security management system according to claim 4, characterized in that: The matching degree between the calculation node and the risk event is calculated using the formula: ； Evaluate the risk level of transaction nodes and generate a transaction risk matching index; Among them, M represents the matching degree between the transaction node and the risk event. represents the characteristic value of transaction node i, represents the reference feature value of risk event i, and n represents the total number of features involved in the transaction node.

6. The financial data security management system according to claim 1, characterized in that: The dynamic isolation module comprises: The risk node identification submodule detects risk nodes in the data storage network based on the vulnerability risk assessment results, analyzes the type and sensitivity of financial data stored in the nodes, screens storage nodes with security vulnerabilities, determines the range of data nodes that need to be isolated, and obtains a risk node list; The data migration analysis submodule analyzes the data distribution in the affected nodes based on the risk node list, calculates the data association degree and interaction frequency between nodes, determines the impact scope and priority of data migration, and generates a data migration priority index; The data association degree and interaction frequency between the computing nodes are calculated using the formula: ； Determine the impact scope and priority of data migration and generate a data migration priority index; Calculate data interaction frequency , determine the impact scope and priority of data migration, and generate a data migration priority index; in, Represents the frequency of data interaction between node a and node b, Represents the data flow of node a in data dimension v, represents the data flow of node b in data dimension v, Represents the request frequency of node a on data dimension v, represents the request frequency of node b on data dimension v, and w represents the total number of data dimensions; The data storage reconstruction submodule analyzes the data flow path between storage nodes based on the data migration priority index, allocates storage resources, plans the optimal data migration path, and adjusts the access rights of the secure storage nodes to obtain the data node isolation configuration.

7. The financial data security management system according to claim 1, characterized in that: The behavior analysis module includes: The behavior pattern change analysis submodule calls the behavior records of the isolated account based on the data node isolation configuration, compares the account activity characteristics before and after isolation, analyzes the amplitude and frequency of the account behavior changes, calculates the degree of deviation of the behavior pattern, and obtains the behavior pattern deviation index; The data access frequency comparison submodule compares the data access frequency of the account before and after isolation based on the behavior pattern deviation index, analyzes the changes in access time point, access duration and access frequency, determines the fluctuation of access frequency, and generates an access frequency fluctuation index; The abnormal behavior identification submodule identifies account activities that deviate from normal patterns based on the access frequency fluctuation index, analyzes the characteristics of account abnormal behavior patterns, matches the relationship between account activity characteristics and known vulnerabilities, locates the source of security vulnerabilities, and generates behavior feature analysis results.

8. The financial data security management system according to claim 1, characterized in that: The system further comprises: The security response module determines abnormal transaction accounts based on the behavior feature analysis results, adjusts account access rights, allocates transaction quota ratios, updates account transaction verification methods, and generates security protection measures; The security protection measures specifically include account authority adjustment results, transaction limit configuration and updated verification methods.

9. The financial data security management system according to claim 8, characterized in that: The security response module includes: Based on the behavior feature analysis results, the account authority control submodule analyzes the frequency of risky operations of the account, calculates the impact scope of account authority changes, identifies accounts with frequent abnormal operations, reconfigures account access rights, imposes access restrictions on high-risk accounts, and generates account authority adjustment configurations; The transaction quota management submodule calls the account authority adjustment configuration, calls the transaction records of abnormal accounts, calculates the fluctuation range of transaction quotas, analyzes the trend of transaction quota changes in the short term, determines the degree of deviation between the transaction amount and the normal behavior of the account, adjusts the transaction quota upper limit of the account, allocates the transaction quota ratio, and generates the optimized transaction quota; The verification method optimization submodule screens accounts with abnormal transaction frequencies based on the optimized transaction amount, extracts the identity authentication records of the accounts, analyzes the security level of transaction verification of abnormal accounts, determines whether the transaction verification matches the account risk level, optimizes the transaction verification method of the accounts, and generates security protection measures.

10. A financial data security management method, the financial data security management method is used to implement the financial data security management system according to any one of claims 1 to 9, characterized in that: The following steps are involved: S1: Collect transaction flows and account behaviors in financial data streams, analyze the frequency of changes in capital flows, calculate the frequency of account accesses, compare the frequency of capital flow changes with the frequency of accesses, determine the abnormal operation risk of the account, and generate abnormal operation indicators; S2: Based on the abnormal operation indicators, locate the transaction nodes of abnormal accounts, analyze the matching relationship between transaction nodes and risk events, evaluate the risk level of nodes, calculate the correlation between transaction frequency and risk events, predict security vulnerabilities in transaction nodes, and generate vulnerability risk assessment results; S3: Based on the vulnerability risk assessment results, identify risky data storage nodes, analyze financial data distribution, calculate migration priorities, plan migration paths, migrate data to low-risk storage nodes, and obtain data node isolation configuration; S4: Based on the data node isolation configuration, compare the data access frequency of the account before and after isolation, identify abnormal account activities, determine the abnormal characteristics of the account behavior pattern, locate the source of the security vulnerability, and obtain the behavior characteristic analysis results; S5: Based on the behavior feature analysis results, determine abnormal transaction accounts, adjust account access rights, allocate transaction quota ratios, update account transaction verification methods, and generate security protection measures.

Images