Enterprise data transmission risk level prediction method and system based on GNN and LSTM, electronic equipment and storage medium

Abstract

The invention discloses an enterprise data transmission risk level prediction method based on GNN and LSTM. The method comprises the following steps: obtaining enterprise transmission data traffic according to spot check frequency; dividing the enterprise transmission data traffic into input data of a plurality of time steps, inputting the input data into a GNN model for processing, and outputting embedded aggregation data; inputting the embedded aggregated data into an LSTM model for processing, and outputting a risk prediction result of the last time step; and inputting a risk prediction result into a full connection layer for classification, and outputting a risk level. According to the method, the GNN algorithm and the LSTM algorithm are used, so that the model can understand the current state and predict the future on the basis of the current state, abnormal behaviors of enterprise data transmission can be recognized, the risk level of a path is set to be high, corresponding safety measures are taken, and the safety of enterprise data transmission is improved. More comprehensive safety protection can be provided for cross-border data transmission, and the overall safety and reliability are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of data risk control, and in particular to a method, system, electronic device and storage medium for predicting enterprise data transmission risk level based on GNN and LSTM. Background Art

[0002] In the context of globalization, the development of enterprises has driven the cross-border flow of data, especially in cross-border cooperation and supply chain management. When data is transmitted across borders, it may involve different legal frameworks, industry standards, and compliance requirements. Therefore, any information leakage, attack or misuse may lead to serious legal and economic consequences. my country has introduced many laws to ensure the security of outbound data, including the Data Security Law, the Personal Information Protection Regulations, and the Data Outbound Security Assessment Measures, which all restrict enterprises and individuals to protect data during cross-border transmission. At present, cross-border data transmission is becoming increasingly important in the global context, but the security risks it faces cannot be ignored, especially in the process of data outbound, there are many threats and risks such as information leakage, data tampering, and illegal access, which may seriously leak state secrets and cause irreparable losses. Among them, enterprises, as the sender of data transmission, play a vital role. The violation of enterprises in the process of data outbound will cause serious and even irreparable losses to citizens, society and individuals. The risk level prediction of enterprise data outbound can effectively ensure the safety control of enterprises by regulatory authorities, which can be elaborated in detail from both the enterprise and regulatory authorities. From the perspective of enterprises, risk prediction helps enterprises to implement corresponding security protection measures for their outbound data in a targeted manner, so as to reduce data outbound expenses, optimize business management efficiency and improve data security.

[0003] Existing enterprise data outbound risk analysis is mostly based on the characteristics of the data and is not historical. The cross-border transmission of enterprise data is often not instantaneous, but changes dynamically over time. Since the amount of data in the process of cross-border data transmission is usually large, only analyzing the characteristics of the data may miss important information and trends hidden in historical data.

[0004] The data transmitted by enterprises during outbound transmission is usually diverse and related, and often includes highly structured, semi-structured and unstructured data types. Existing cross-border data transmission risk prediction technologies mostly analyze the differences between the transmitted data and the declared data, lacking the capture and learning of the characteristics of the data itself, and are inefficient in processing large amounts of data. Summary of the invention

[0005] In order to solve the above problems existing in the prior art, the present invention provides a method, system, electronic device and storage medium for predicting the risk level of enterprise data transmission based on GNN and LSTM. The technical problem to be solved by the present invention is achieved through the following technical solutions:

[0006] A first aspect of an embodiment of the present invention provides a method for predicting the risk level of enterprise data transmission based on GNN and LSTM, comprising the following steps:

[0007] Obtain the enterprise's data transmission volume based on the spot check frequency and the declared information; wherein the enterprise's data transmission volume includes: one or more of the following: the proportion of personal information, the proportion of important data, the total amount of data, the types of data included, the security level of the data receiver, and the historical transmission risk level of the data sender;

[0008] The enterprise transmission data flow is divided into input data of multiple time steps and input into the GNN model for processing, and the embedded aggregated data is output; wherein the input data of each time step is used as a time graph, the nodes in the time graph represent the sender and the receiver, the edges represent the transmission path, and the edge weight represents the historical transmission risk level of the sender;

[0009] The embedded aggregated data is input into the LSTM model for processing, and the risk prediction result of the last time step is output;

[0010] The risk prediction results are input into the fully connected layer for classification and the risk level is output.

[0011] In one embodiment of the present invention, the expression of the spot check frequency is:

[0012] p=e -Trust_index ;

[0013] Among them, p represents the frequency of spot checks, and Trust_index represents the historical trust index.

[0014] In one embodiment of the present invention, the input data of the enterprise transmission data flow is divided into multiple time steps and input into the GNN model for processing, and the embedded aggregated data is output, including:

[0015] Divide the enterprise transmission data flow into input data of multiple time steps and input them into the GNN model;

[0016] The GNN model performs a message passing operation on the input data of the node at each time step, aggregates the information of the node and its neighboring nodes for processing, and outputs embedded aggregated data.

[0017] In one embodiment of the present invention, the expression for embedding the aggregated data is:

[0018]

[0019] Among them, H t Represents embedded aggregate data, represents the normalized adjacency matrix, X t Represents the node feature matrix, W represents the weight matrix of the GNN model, and relu represents the Rectified Linear Unit activation function, which is a nonlinear function represented by the ramp function and its variants. Its formula is:

[0020] f(X)=max(0,X).

[0021] In one embodiment of the present invention, the step of inputting the embedded aggregated data into the LSTM model for processing and outputting the risk prediction result of the last time step includes:

[0022] Inputting the embedded aggregated data into the LSTM model;

[0023] Update the cell state according to the current input embedded aggregation data, forget gate and input gate to obtain the current cell state;

[0024] The output gate calculates the output effect of the current cell state on the hidden state;

[0025] The output gate updates the hidden state according to the current cell state and the output influence to obtain the current hidden state until the hidden state of the last time step is output as the risk prediction result.

[0026] In one embodiment of the present invention, the calculation formula of the current cell state is:

[0027]

[0028] Among them, c t represents the current cell state, f t represents the output of the forget gate, f t =σ(W xf H t +W hf h t-1 +b f ), σ represents the sigmoid activation function, W xf and W hf represents the weight of the forget gate, b f represents the first bias term, c t-1 represents the cell state at time t-1, i t Indicates the impact of the current input embedded aggregation data on the cell state, i t =σ(W xi H t +Whi h t-1 +b i ), W xi and W hi represents the weight of the input gate, b i represents the second bias term, h t-1 represents the hidden state at time t-1, represents the candidate cell state, W xc and W hc represents the weight of the candidate cell state, b c represents the third bias term.

[0029] In one embodiment of the present invention, the expression of the current hidden state is:

[0030] h t =o t ⊙tanh(c t );

[0031] Among them, h t Indicates the current hidden state, o t Indicates the output impact,

[0032] o t =σ(W xo H t +W ho h t-1 +b o ), where W xo and W ho represents the weight of the output gate, b o represents the fourth bias term,

[0033] A second aspect of an embodiment of the present invention provides a system for predicting enterprise data transmission risk level based on GNN and LSTM, including:

[0034] A collection module, used to obtain the enterprise transmission data flow according to the spot check frequency and the declared information; wherein the enterprise transmission data flow includes: one or more of the following: the proportion of personal information, the proportion of important data, the total amount of data, the types of data included, the security level of the data receiver, and the historical transmission risk level of the data sender;

[0035] An analysis module is used to divide the enterprise transmission data flow into input data of multiple time steps and input them into the GNN model for processing, and output embedded aggregated data; wherein the input data of each time step is used as a time graph, the nodes in the time graph represent the sender and the receiver, the edges represent the transmission path, and the edge weight represents the historical transmission risk level of the sender;

[0036] A prediction module, used for inputting the embedded aggregated data into the LSTM model for processing, and outputting the risk prediction result of the last time step;

[0037] The classification module is used to input the risk prediction results into the fully connected layer for classification and output the risk level.

[0038] A third aspect of an embodiment of the present invention provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, a method for predicting the risk level of enterprise data transmission based on GNN and LSTM provided in the first aspect of an embodiment of the present invention is implemented.

[0039] The fourth aspect of an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the method for predicting the risk level of enterprise data transmission based on GNN and LSTM provided by the first aspect of an embodiment of the present invention is implemented.

[0040] Beneficial effects of the present invention:

[0041] The present invention uses the LSTM algorithm, which is used to capture the time dependency of these features to predict the risk level of the company's outbound data and analyze the characteristics of the company's historical flow. LSTM processes time series data, uses memory units and forgetting mechanisms to capture long-term dependencies, and generates prediction results for each time step. Therefore, it is possible to conduct a comprehensive analysis of the risks of cross-border transmission based on the company's historical behavior. The present invention uses the GNN algorithm to process and analyze the data. In the scenario of cross-border data transmission, the data transmitted by the enterprise can be regarded as part of the graph. The nodes represent the sender and the receiver, the edges represent the transmission path, and the edge weights can reflect the amount or importance of the data. GNN processes the data, obtains the architectural connection in the cross-border transmission data, and then passes the processed results to the LSTM part, thereby ensuring that the characteristics of the data are fully learned and analyzed. GNN with multiple threads executed in parallel and then introducing LSTM can greatly improve efficiency.

[0042] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures particularly pointed out in the written description, claims, and drawings.

[0043] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0045] Figure 1 A flowchart of a method for predicting enterprise data transmission risk level based on GNN and LSTM provided in an embodiment of the present invention;

[0046] Figure 2 This is a schematic diagram of a system framework for predicting the risk level of enterprise data transmission based on GNN and LSTM;

[0047] Figure 3 A block diagram of a system for predicting enterprise data transmission risk level based on GNN and LSTM is provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0048] The present invention is further described in detail below with reference to specific embodiments, but the embodiments of the present invention are not limited thereto.

[0049] like Figure 1 As shown, the first aspect of the embodiment of the present invention provides a method for predicting the risk level of enterprise data transmission based on GNN and LSTM, comprising the following steps:

[0050] Step 11: Obtain the enterprise's transmission data traffic based on the spot check frequency and declared information.

[0051] Among them, the enterprise transmission data traffic includes one or more of: the proportion of personal information, the proportion of important data, the total amount of data, the types of data included, the security level of the data recipient, and the historical transmission risk level of the data sender.

[0052] Step 12, divide the enterprise transmission data traffic into multiple time steps of input data and input them into the GNN model for processing, and output embedded aggregated data.

[0053] The input data of each time step is used as a time graph, in which the nodes represent the sender and the receiver, the edges represent the transmission path, and the edge weight represents the historical transmission risk level of the sender.

[0054] Step 13: Input the embedded aggregated data into the LSTM model for processing and output the risk prediction result of the last time step.

[0055] Step 14: Input the risk prediction results into the fully connected layer for classification and output the risk level.

[0056] In this embodiment, the GNN and LSTM algorithms are used to predict the level of the enterprise's data link transmission, the data is input into the GNN for further processing and analysis, and then the time series is predicted through the LSTM. The LSTM will output the risk level and pass the analysis as a memory unit to the next moment. In the process of cross-border data transmission, the proposed scheme executes GNN operations of multiple nodes in parallel, and then executes LSTM in sequence to predict the risk level, which greatly improves the data processing efficiency. The proposed protocol realizes the quantitative assessment of the security risk of enterprise data outbound, and solves the risk assessment problem of enterprise data transmission in the data outbound scenario.

[0057] The second aspect of the embodiment of the present invention provides a method for predicting the risk level of enterprise data transmission based on GNN and LSTM. This embodiment is applied to the analysis of enterprise data by regulatory authorities during the cross-border transmission of enterprises. In the process of cross-border data transmission, enterprises should first declare the traffic to the relevant departments, and need to provide information such as the amount of data to be sent and the data category. For the declared traffic of the enterprise, the risk level of the actual transmitted data is predicted. When the enterprise transmits traffic, its traffic is first intercepted, the traffic is spot-checked, and the risk level of the enterprise's behavior is predicted to determine a risk level for the enterprise. The risk level prediction is composed of two algorithms, GNN and LSTM. The graph neural network (GNN) can indeed process the graph data independently at each time step, which means that in the topological coding stage, the graph data processing at each time step does not affect each other. Specifically, the graph convolution operation at each time step depends only on the node features and adjacency matrix of the time step, and does not directly depend on the data of other time steps. However, this independence mainly exists in the topological coding stage of the graph convolution network (GNN). In the temporal encoding stage, LSTM is used, and the information between different time steps is transmitted through hidden states, thereby introducing temporal dependencies. The system framework of this embodiment is as follows: Figure 2 shown.

[0058] Specifically, the steps include:

[0059] Step 21, obtaining the enterprise's transmission data traffic based on the spot check frequency and declared information.

[0060] In this step, the regulatory authorities first evaluate a trust index for the enterprise based on the risk information of the enterprise's past cross-border transmission, which is also called the historical trust index. The spot check frequency is determined based on the historical trust index. Based on this, spot checks are carried out on the enterprise data, and the data collection system is used to collect, analyze and process the data, and send it to the data outbound risk prediction level system. The system derives the enterprise's outbound risk based on the algorithm, evaluates a level, and submits it to the regulatory authorities, and then modifies the historical trust index.

[0061] The expression of sampling frequency is:

[0062] p=e -Trust_index ;

[0063] Among them, p represents the frequency of spot checks, and Trust_index represents the historical trust index. It can be found that as the trust index increases, the frequency of spot checks decreases, and vice versa.

[0064] The regulatory authorities will conduct random inspections on enterprises and hand over the outbound data of the random inspections to the enterprise data transmission risk level prediction system for processing. The system will analyze the enterprise's outbound data and use the algorithm model to obtain the enterprise's path risk level. Based on the comparison between the enterprise's historical risk level and the current risk level, the enterprise's trust index will be modified. The lower the trust index, the stricter the rectification measures for the enterprise.

[0065] The declared information includes one or more of the proportion of personal information, the proportion of important data, the total amount of data, the types of data included, the security level of the data receiver, and the historical transmission risk level of the data sender. Data is extracted from the data set transmitted by the enterprise according to the sampling frequency, and after the data is extracted, the data is analyzed according to the declared information declared by the enterprise. For example, if the enterprise declares the proportion of personal information, the proportion of important data, and the total amount of data, the proportion of personal information, the proportion of important data, and the total amount of data in the extracted data are analyzed.

[0066] Here, the proportion of personal information refers to the proportion of data involving personal information in cross-border data transmission. The types of personal information include name, ID number, contact information, etc., which are usually related to privacy and security. As the amount of personal information involved increases, the potential risk of data leakage increases.

[0067] The proportion of important data: the proportion of important or sensitive information contained in the data. Important data may involve business secrets, financial records, technical patents, national defense information, etc. The leakage or tampering of such data may cause serious economic losses, reputation damage, and even threaten national security. Therefore, the higher the proportion of important data, the higher the risk assessment level of cross-border transmission.

[0068] Total amount of data: The overall size of the amount of data transmitted across borders is also a key factor in assessing risks. The larger the amount of data, the higher the content it covers, even if the proportion of important data and sensitive data is relatively low. Therefore, the potential security risks and management difficulties may also be higher.

[0069] Data type: The type of data has a direct impact on its security level. Different types of data (such as financial data and medical data) have different risk levels in cross-border transmission due to the different impacts of the content they contain on society, the country, and individuals.

[0070] Security level of the data recipient: The type of data has a direct impact on its security level. Different types of data (such as financial data and medical data) have different risk levels during cross-border transmission.

[0071] The sender of the data will be given a security level based on its historical behavior: the sender's security level will be evaluated based on its past behavior. Senders with a good security record in history will be given a higher security level, thereby reducing the overall risk assessment.

[0072] Step 22, divide the enterprise transmission data traffic into multiple time steps of input data and input them into the GNN model for processing, and output embedded aggregated data.

[0073] The input data of each time step is used as a time graph, in which the nodes represent the sender and the receiver, the edges represent the transmission path, and the edge weight represents the historical transmission risk level of the sender.

[0074] Here, before the data is input into the GNN model and the LSTM model, the GNN model and the LSTM model are pre-trained for risk level prediction. After the training is completed, one or more characteristics of the input personal information proportion, important data proportion, total data, data inclusion type, data receiver's security level and data sender's historical transmission risk level can be processed, and the risk level prediction result is finally output. That is, when executing step 21, the two models have been trained.

[0075] The specific steps of step 22 include: step 221-step 222:

[0076] Step 221, divide the enterprise transmission data traffic into input data of multiple time steps and input them into the GNN model.

[0077] In this step, data is input into GNN to obtain the connection between nodes. Graph neural networks are designed to process data and are usually composed of nodes, edges and their corresponding features. In the scenario of cross-border data transmission, the data transmitted by enterprises can be regarded as part of the graph. Nodes represent senders and receivers, and edges represent transmission paths. At the very beginning of processing a data set, multiple processing processes are first generated. The input data of each process (each time step) of the data set is used as a time graph, and GNN processes these data in parallel.

[0078] In step 222, the GNN model performs a message passing operation on the input data of the node at each time step, aggregates the information of the node and its neighboring nodes for processing, and outputs embedded aggregated data.

[0079] In this step, the GNN operation is performed on the data of each time step. The GNN model performs message passing operations on the nodes, aggregates the information of the nodes and their neighboring nodes, captures the global graph structure information, and calculates the embedded representation of the enterprise (embedded aggregated data).

[0080] The expression for embedding aggregate data is:

[0081]

[0082] Among them, H t Represents embedded aggregate data, represents the normalized adjacency matrix, X t Represents the node feature matrix, W represents the weight matrix of the GNN model, and relu represents the Rectified Linear Unit activation function, which is a nonlinear function represented by the ramp function and its variants. Its formula is:

[0083] f(X)=max(0,X).

[0084] Here, X represents the input of relu.

[0085] Step 23, input the embedded aggregated data into the LSTM model for processing, and output the risk prediction result of the last time step.

[0086] Time series prediction is based on the various features of cross-border data transmission of enterprises. LSTM is used to capture the time dependency of these features to predict the risk level of enterprise outbound data. LSTM processes time series data, uses memory units and forgetting mechanisms to capture long-term dependencies, and generates prediction results for each time step.

[0087] Specifically, the specific steps of step 23 include steps 231 to 234:

[0088] Step 231, input the embedded aggregation data into the LSTM model.

[0089] Step 232, updating the cell state according to the currently input embedded aggregate data, forget gate and input gate to obtain the current cell state.

[0090] Here, c t The cell state is updated according to the selection of the forget gate and the input gate to maintain long-term dependency information. The calculation formula for the current cell state is:

[0091]

[0092] Among them, c t represents the current cell state, f t represents the output of the forget gate,

[0093] f t =σ(W xf H t +W hf h t-1 +b f ), σ represents the sigmoid activation function, which is used to generate the gating signal to ensure that the control of information flow is continuous and differentiable in a logical sense. The activation function of sigmoid is:

[0094]

[0095] The output range of this function is [0,1], and its curve is S-shaped. As the input value increases, the output approaches 1; when the input value is negative, the output gradually approaches 0. xf and W hf represents the weight of the forget gate, b f represents the first bias term, h t-1 represents the hidden state at time t-1. Here, t represents a moment or the current moment, that is, a time step, and time t-1 is the previous moment of time t, that is, the previous time step.

[0096] c t-1 represents the cell state at time t-1, i t Indicates the impact of the current input embedded aggregation data on the cell state, i t =σ(W xi H t +W hi h t-1 +b i ), W xi and W hi represents the weight of the input gate, b i represents the second bias term.

[0097] represents the candidate cell state, W xc and W hc represents the weight of the candidate cell state, b c represents the third bias term.

[0098] Step 233, the output gate calculates the output influence of the current cell state on the hidden state.

[0099] o t =σ(W xo H t +W ho h t-1 +b o )

[0100] The output gate calculates the output effect of the current cell state on the hidden state o t .W xo and W ho represents the weight of the output gate, b o represents the fourth bias term.

[0101] In step 234, the output gate updates the hidden state according to the current cell state and the output influence to obtain the current hidden state, until the hidden state of the last time step is output as the risk prediction result.

[0102] The expression of the current hidden state is:

[0103] h t =o t ⊙tanh(c t );

[0104] Among them, h t Represents the current hidden state. The tanh function is used to normalize the range of candidate information and hidden state. The tanh activation function is very similar to the sigmoid activation function, and its formula is:

[0105]

[0106] Another important role of LSTM is to perform nonlinear transformation on the output state value at this moment and output it to the next layer of the network or as the final model output.

[0107] Step 24, input the risk prediction results into the fully connected layer for classification, and output the risk level.

[0108] The risk level is divided into five levels: high, relatively high, medium, relatively low, and low. Different levels of rectification measures are taken for the behavior of enterprises according to different levels. For enterprises with low levels, the traffic of the enterprises is directly released. For enterprises with lower levels, the traffic transmitted by the enterprises is spot-checked again. If it is still at a lower level, the alarm treatment measure is taken. For medium-risk enterprises, the flow restriction measure is taken. For enterprises with higher risks and high risks, the treatment measures of IP disconnection and network disconnection are taken respectively.

[0109] The risk level assessment algorithm is obtained by combining GNN and LSTM. Based on the Euler framework, RNN is expanded to LSTM, thereby improving the model's ability to process long sequences and capture long-term dependencies. The data set is first processed by GNN to obtain the architectural connections in the cross-border transmission data, and then the processed results are passed to the LSTM part to analyze and predict the path risk level. The whole process is divided into two parts: graph embedding generation and time series prediction. GNN part: Data is input into GNN to obtain the connection between nodes. Time series prediction (LSTM part): The output obtained from GNN is used as input, processed by LSTM, and time series data is predicted to finally generate the risk level prediction result. The overall algorithm can be described as:

[0110] Z=f({G0,G1,...,G T})

[0111] =LSTM([GNN(X0,A0)],[GNN(X1,A1)],...,[GNN(X T , A T )])

[0112] Among them A t is the adjacency matrix representation of a snapshot at time t, containing information about the structure of the data and how it changes over time, X t is the node matrix at time t.

[0113] Step 25: Take corresponding corrective measures based on the risk level.

[0114] Different levels of behavioral constraints are imposed on enterprises according to the risk level results. The regulatory authorities will conduct spot checks on enterprises, and the regulatory authorities will process the outbound data of the spot checks in the system. The system will analyze the outbound data of the enterprises and use the risk path classification model to obtain the path risk level of the enterprise. According to the comparison between the historical risk level of the enterprise and the current risk level, the trust index of the enterprise will be modified. The lower the trust index, the stricter the rectification measures for the enterprise. In response to the risk disposal of enterprises by the regulatory authorities, a correlation formula between the trust index and the frequency of spot checks is proposed. Based on the prediction of the risk level and the modification of the trust index of the enterprise, the regulatory authorities adjust the intensity of spot checks on the enterprise, solving the problem of disposal measures for enterprises with different risk levels.

[0115] The present invention proposes to use but is not limited to the GNN algorithm to detect possible abnormal connections and potential security relationships in the data outbound process by building mutual dependencies between module data nodes; the present invention proposes to use LSTM to learn and analyze the characteristics of the enterprise's cross-border transmission process, so as to detect abnormal behavior in the enterprise's data outbound, and utilize the advantages of LSTM in processing time series data to capture abnormal trends by analyzing the patterns of historical data flows, and to warn of potential risks in the data outbound in advance; the present invention proposes to use but is not limited to the link risk level prediction model using the GNN algorithm and the LSTM algorithm model, which is different from using a binary network and only considering the risk gap when the destination address is overseas. The GNN learning data set features are used, and the overall link risk level analysis and prediction are combined with LSTM to achieve a quantitative assessment of the enterprise data outbound security risk, and solve the risk assessment problem of enterprise data transmission in the data outbound scenario; the present invention uses GNN operations performed in parallel by multiple threads, and introduces LSTM to predict the risk level, which greatly solves the problem of low efficiency caused by excessive data volume in the cross-border data transmission process. The present invention proposes to establish a trust index for enterprises by regulatory authorities, and dynamically adjust the trust index based on changes in the risk level of enterprises during cross-border transmission. Based on this, a relationship between the trust index and the frequency of spot checks is established, thereby dynamically adjusting the spot checks and disposal strategies of regulatory authorities on enterprises.

[0116] In the data analysis and processing stage, the present invention uses the GNN algorithm to analyze the data set, obtain the connection in the features, and improve the utilization rate of the data; GNN captures the relationship and interaction between nodes in the network through its graph structure, so that it performs well when processing data with complex connection patterns. LSTM effectively processes time series data through its memory mechanism and can capture the dynamic changes of data in the time dimension. This combination enables the model to not only understand the current state, but also predict the future on this basis, thereby achieving higher security in data transmission in a complex network environment and improving the availability of the system. The time series prediction ability of LSTM can help identify abnormal behavior and set the risk level of the path to a high level, so as to take corresponding security measures, which can provide more comprehensive security protection for cross-border data transmission and improve the overall security and reliability. The present invention does not stay at the theoretical level, but proposes a design for application implementation such as the collection, analysis, processing and risk level prediction of enterprise data by regulatory authorities during the cross-border transmission of enterprise data, which has strong practicality.

[0117] like Figure 3 As shown, the third aspect of the embodiment of the present invention provides a system for predicting enterprise data transmission risk level based on GNN and LSTM, including:

[0118] The collection module 31 is used to obtain the enterprise transmission data flow according to the spot check frequency and the declared information; wherein the enterprise transmission data flow includes: one or more of the following: the proportion of personal information, the proportion of important data, the total amount of data, the types of data included, the security level of the data receiver, and the historical transmission risk level of the data sender;

[0119] The analysis module 32 is used to divide the enterprise transmission data flow into input data of multiple time steps and input them into the GNN model for processing, and output embedded aggregated data; wherein the input data of each time step is used as a time graph, the nodes in the time graph represent the sender and the receiver, the edges represent the transmission path, and the edge weight represents the historical transmission risk level of the sender;

[0120] Prediction module 33, used for inputting the embedded aggregated data into the LSTM model for processing and outputting the risk prediction result of the last time step;

[0121] The classification module 34 is used to input the risk prediction results into the fully connected layer for classification and output the risk level.

[0122] In one embodiment of the present invention, the expression of the spot check frequency is:

[0123] p=e -Trust_index ;

[0124] Among them, p represents the frequency of spot checks, and Trust_index represents the historical trust index.

[0125] In one embodiment of the present invention, the enterprise transmission data traffic is divided into input data of multiple time steps and input into the GNN model for processing, and the embedded aggregated data is output, including:

[0126] Divide the enterprise transmission data traffic into multiple time steps of input data and input them into the GNN model;

[0127] The GNN model performs message passing operations on the input data of the node at each time step, aggregates the information of the node and its neighboring nodes for processing, and outputs embedded aggregated data.

[0128] In one embodiment of the present invention, the expression for embedding aggregate data is:

[0129]

[0130] Among them, H t Represents embedded aggregate data, represents the normalized adjacency matrix, X tRepresents the node feature matrix, W represents the weight matrix of the GNN model, and relu represents the Rectified Linear Unit activation function, which is a nonlinear function represented by the ramp function and its variants. Its formula is:

[0131] f(X)=max(0,X).

[0132] In one embodiment of the present invention, the embedded aggregated data is input into the LSTM model for processing, and the risk prediction result of the last time step is output, including:

[0133] Feed the embedded aggregated data into the LSTM model;

[0134] Update the cell state according to the current input embedded aggregation data, forget gate and input gate to obtain the current cell state;

[0135] The output gate calculates the output effect of the current cell state on the hidden state;

[0136] The output gate updates the hidden state according to the current cell state and output influence to obtain the current hidden state until the hidden state of the last time step is output as the risk prediction result.

[0137] In one embodiment of the present invention, the calculation formula of the current cell state is:

[0138]

[0139] Among them, c t represents the current cell state, f t represents the output of the forget gate, f t =σ(W xf H t +W hf h t-1 +b f ), σ represents the sigmoid activation function, W xf and W hf represents the weight of the forget gate, b f represents the first bias term, c t-1 represents the cell state at time t-1, i t Indicates the impact of the current input embedded aggregation data on the cell state, i t =σ(W xi H t +W hi h t-1 +b i ), W xi and W hi represents the weight of the input gate, b i represents the second bias term, h t-1represents the hidden state at time t-1, represents the candidate cell state, W xc and W hc represents the weight of the candidate cell state, b c represents the third bias term.

[0140] In one embodiment of the present invention, the expression of the current hidden state is:

[0141] h t =o t ⊙tanh(c t );

[0142] Among them, h t Indicates the current hidden state, o t Indicates output impact, o t =σ(W xo H t +W ho h t-1 +b o ), where W xo and W ho represents the weight of the output gate, b o represents the fourth bias term,

[0143] A fourth aspect of an embodiment of the present invention provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, a method for predicting the risk level of enterprise data transmission based on GNN and LSTM provided in the above-mentioned embodiment of the present invention is implemented.

[0144] The fifth aspect of an embodiment of the present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of a method for predicting the risk level of enterprise data transmission based on GNN and LSTM provided in the above-mentioned embodiment of the present invention are implemented.

[0145] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0146] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware systems.

[0147] The method provided in the embodiment of the present invention can be applied to electronic devices. Specifically, the electronic device can be: a desktop computer, a portable computer, an intelligent mobile terminal, a server, etc. This is not limited here, and any electronic device that can implement the present invention belongs to the protection scope of the present invention.

[0148] As for the system / electronic device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0149] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A system that specifies the functions of a box or multiple boxes.

[0150] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0151] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0152] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A method for predicting enterprise data transmission risk level based on GNN and LSTM, characterized in that: The following steps are involved: Obtain the enterprise's data transmission volume based on the spot check frequency and the declared information; wherein the enterprise's data transmission volume includes: one or more of the following: the proportion of personal information, the proportion of important data, the total amount of data, the types of data included, the security level of the data receiver, and the historical transmission risk level of the data sender; The enterprise transmission data flow is divided into input data of multiple time steps and input into the GNN model for processing, and the embedded aggregated data is output; wherein the input data of each time step is used as a time graph, the nodes in the time graph represent the sender and the receiver, the edges represent the transmission path, and the edge weight represents the historical transmission risk level of the sender; The embedded aggregated data is input into the LSTM model for processing, and the risk prediction result of the last time step is output; The risk prediction results are input into the fully connected layer for classification and the risk level is output.

2. The method according to claim 1, characterized in that The expression of the sampling frequency is: p=e -Trust_index ; Among them, p represents the frequency of spot checks, and Trust_index represents the historical trust index.

3. The method according to claim 1, characterized in that The enterprise transmission data flow is divided into input data of multiple time steps and input into the GNN model for processing, and the embedded aggregated data is output, including: Divide the enterprise transmission data flow into input data of multiple time steps and input them into the GNN model; The GNN model performs a message passing operation on the input data of the node at each time step, aggregates the information of the node and its neighboring nodes for processing, and outputs embedded aggregated data.

4. The method according to claim 3, characterized in that The expression for embedding the aggregated data is: Among them, H t Represents embedded aggregate data, represents the normalized adjacency matrix, X t Represents the node feature matrix, W represents the weight matrix of the GNN model, and relu represents the Rectified Linear Unit activation function, which is a nonlinear function represented by the ramp function and its variants. Its formula is: f(X)=max(0,X).

5. The method according to claim 1, characterized in that The embedded aggregated data is input into the LSTM model for processing, and the risk prediction result of the last time step is output, including: Inputting the embedded aggregated data into the LSTM model; Update the cell state according to the current input embedded aggregation data, forget gate and input gate to obtain the current cell state; The output gate calculates the output effect of the current cell state on the hidden state; The output gate updates the hidden state according to the current cell state and the output influence to obtain the current hidden state until the hidden state of the last time step is output as the risk prediction result.

6. The method according to claim 5, characterized in that The calculation formula of the current cell state is: Among them, c t represents the current cell state, f t represents the output of the forget gate, f t =σ(W xf H t +W hf h t-1 +b f ), σ represents the sigmoid activation function, W xf and W hf represents the weight of the forget gate, b f represents the first bias term, c t-1 represents the cell state at time t-1, i t Indicates the impact of the current input embedded aggregation data on the cell state, i t =σ(W xi H t +W hi h t-1 +b i ), W xi and w hi represents the weight of the input gate, b i represents the second bias term, h t-1 represents the hidden state at time t-1, represents the candidate cell state, W xc and W hc represents the weight of the candidate cell state, b c represents the third bias term.

7. The method according to claim 5, characterized in that The expression of the current hidden state is: h t =O t ⊙tanh(c t ); Among them, h t Indicates the current hidden state, o t Indicates the output impact, o t =σ(W xo H t +W ho h t-1 +b o ), where W xo and W ho represents the weight of the output gate, b o represents the fourth bias term, 8. A system for predicting enterprise data transmission risk level based on GNN and LSTM, characterized in that: include: A collection module, used to obtain the enterprise transmission data flow according to the spot check frequency and the declared information; wherein the enterprise transmission data flow includes: one or more of the following: the proportion of personal information, the proportion of important data, the total amount of data, the types of data included, the security level of the data receiver, and the historical transmission risk level of the data sender; An analysis module is used to divide the enterprise transmission data flow into input data of multiple time steps and input them into the GNN model for processing, and output embedded aggregated data; wherein the input data of each time step is used as a time graph, the nodes in the time graph represent the sender and the receiver, the edges represent the transmission path, and the edge weight represents the historical transmission risk level of the sender; A prediction module, used for inputting the embedded aggregated data into the LSTM model for processing, and outputting the risk prediction result of the last time step; The classification module is used to input the risk prediction results into the fully connected layer for classification and output the risk level.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, it implements the enterprise data transmission risk level prediction method based on GNN and LSTM as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it implements the enterprise data transmission risk level prediction method based on GNN and LSTM as described in any one of claims 1 to 7.

Images