An enterprise data transmission risk level prediction method and system based on GNN and LSTM, an electronic device, and a storage medium

Abstract

The application discloses an enterprise data transmission risk level prediction method based on GNN and LSTM, comprising the following steps: acquiring enterprise transmission data flow according to the frequency of spot check; inputting the enterprise transmission data flow into a GNN model for processing in multiple time steps to output embedded aggregated data; inputting the embedded aggregated data into an LSTM model for processing to output a risk prediction result of the last time step; inputting the risk prediction result into a full connection layer for classification to output a risk level. The application uses GNN algorithm and LSTM algorithm, and the combination enables the model to not only understand the current state, but also predict the future on the basis, which can help identify abnormal behavior of enterprise data transmission, set a high level for the risk level of the path, and thus take corresponding safety measures, can provide more comprehensive security protection for cross-border data transmission, and improve the overall security and reliability.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data risk control, and particularly relates to an enterprise data transmission risk level prediction method and system based on GNN and LSTM, an electronic device and a storage medium. BACKGROUND

[0002] Under the background of globalization, the development of enterprises drives cross-border data flow, especially in the aspects of cross-border cooperation and supply chain management. When data is transmitted across borders, it may involve different legal frameworks, industry standards, and compliance requirements, so any information leakage, attack or misuse may cause serious legal and economic consequences. China has introduced many laws to protect the safety of data exported, including the Data Security Law, the Personal Information Protection Regulations, and the Data Outbound Security Assessment Method, which restrict the protection of data by enterprises and individuals during cross-border transmission. At present, cross-border data transmission is increasingly important in the global context, but the security risks it faces cannot be ignored, especially during the data export process, there are many threats and risks such as information leakage, data tampering, and illegal access, which may seriously leak state secrets and cause irreparable losses. Among them, enterprises play a crucial role as the sender of data transmission. The illegal behavior of enterprises during data export will cause serious and even irreparable losses to citizens, society and individuals. Risk level prediction for enterprise data export can effectively protect the safety control of enterprises by regulatory authorities, and can be elaborated in detail from both the enterprise and the regulatory authorities. From the perspective of enterprises, risk prediction helps enterprises to implement appropriate security protection measures for their exported data to reduce data export costs, optimize business management efficiency, and improve data security.

[0003] Existing enterprise data export risk analysis is mostly based on the analysis of data characteristics, which is not historical. The behavior of enterprise data cross-border transmission is often not instantaneous, but dynamic over time. Since the data volume is usually large during the data cross-border transmission process, only analyzing the characteristics of the data may miss important information and trends hidden in historical data.

[0004] The data transmitted by enterprises during the export transmission process usually has diversity and correlation, often including highly structured, semi-structured and unstructured data types. Existing data cross-border transmission risk prediction techniques mostly analyze the differences between transmission data and declared data, lacking learning and capturing the characteristics of the data itself. And it is inefficient in processing large amounts of data. SUMMARY

[0005] In order to solve the above problems existing in the prior art, the application provides an enterprise data transmission risk level prediction method and system based on GNN and LSTM, an electronic device and a storage medium. The technical problems to be solved by the application are realized through the following technical solutions.

[0006] The application provides an enterprise data transmission risk level prediction method based on GNN and LSTM in the first aspect of the application, which comprises the following steps:

[0007] Obtain enterprise transmission data flow according to the sampling frequency and the declaration information; wherein the enterprise transmission data flow comprises one or more of the following: personal information proportion, important data proportion, total data amount, data containing type, security level of the data receiver and historical transmission risk level of the data sender;

[0008] The enterprise transmission data flow is divided into input data of multiple time steps, which is input into the GNN model for processing, and embedded aggregated data is output; wherein the input data of each time step is regarded as a time graph, the nodes in the time graph represent the sender and the receiver, the edges represent the transmission path, and the edge weight represents the historical transmission risk level of the sender;

[0009] The embedded aggregated data is input into the LSTM model for processing, and the risk prediction result of the last time step is output;

[0010] The risk prediction result is input into the full connection layer for classification, and the risk level is output.

[0011] In one embodiment of the application, the expression of the sampling frequency is:

[0012] ;

[0013] Wherein, p The sampling frequency is represented by f, Trust_index The historical trust index is represented by h.

[0014] In one embodiment of the application, the enterprise transmission data flow is divided into input data of multiple time steps, which is input into the GNN model for processing, and embedded aggregated data is output, comprising:

[0015] The enterprise transmission data flow is divided into input data of multiple time steps, which is input into the GNN model;

[0016] The GNN model performs a message passing operation on the input data of each time step node, aggregates and processes the information of the node and its neighbor nodes, and outputs embedded aggregated data.

[0017] In one embodiment of the application, the expression of the embedded aggregated data is:

[0018] ;

[0019] wherein, H t represents embedding aggregated data, represents a normalized adjacency matrix, represents a node feature matrix, represents a weight matrix of the GNN model, relu represents Rectified Linear Unit an activation function, which is a nonlinear function represented by a ramp function and its variants, and the formula is:

[0020] ;

[0021] wherein, represents relu input of the LSTM model.

[0022] In an embodiment of the present application, the embedding aggregated data is input into the LSTM model for processing, and the risk prediction result of the last time step is output, comprising:

[0023] inputting the embedding aggregated data into the LSTM model;

[0024] updating the cell state according to the current input embedding aggregated data, the forget gate and the input gate to obtain a current cell state;

[0025] the output gate calculates the output influence of the current cell state on the hidden state;

[0026] the output gate updates the hidden state according to the current cell state and the output influence to obtain a current hidden state, until the hidden state of the last time step is output as the risk prediction result.

[0027] In an embodiment of the present application, the calculation formula of the current cell state is:

[0028] ;

[0029] wherein, c t represents the current cell state, f t represents the output of the forget gate, , σ represents a sigmoid activation function, W xf and W hf represents the weight of the forget gate, b f represents a first bias term, c t-1denotes t a cell state at a -1 time, i t denotes an influence state of the inputted embedding aggregated data on the cell state, , and denotes a weight of the input gate, denotes a second bias term, denotes t a hidden state at a -1 time, denotes a candidate cell state, , W xc and W hc denotes a weight of the candidate cell state, b c denotes a third bias term.

[0030] In an embodiment of the present application, the expression of the current hidden state is:

[0031]

[0032] wherein, h t denotes a current hidden state, o t denotes an output influence, ; wherein, W xo and W ho denotes a weight of the output gate, b o denotes a fourth bias term; c t denotes a current cell state.

[0033] The second aspect of the embodiment of the present application provides a GNN and LSTM-based enterprise data transmission risk level prediction system, comprising:

[0034] The acquisition module is configured to obtain enterprise transmission data flow according to the frequency of spot checks and declaration information; wherein the enterprise transmission data flow comprises one or more of the following: personal information proportion, important data proportion, total data amount, data containing type, security level of the data receiver, and historical transmission risk level of the data sender;

[0035] The analysis module is used for inputting the enterprise transmission data flow into a GNN model for processing in multiple time steps to output embedded aggregated data; wherein the input data of each time step is taken as a time graph, nodes in the time graph represent senders and receivers, edges represent transmission paths, and edge weights represent historical transmission risk levels of the senders;

[0036] The prediction module is used for inputting the embedded aggregated data into an LSTM model for processing to output a risk prediction result of the last time step;

[0037] The classification module is used for inputting the risk prediction result into a full connection layer for classification to output a risk level.

[0038] The third aspect of the embodiment of the present application provides an electronic device, including a memory, a processor and a computer program stored in the memory and executable on the processor, and the processor executes the program to realize the method for predicting a risk level of enterprise data transmission based on GNN and LSTM provided in the first aspect of the embodiment of the present application.

[0039] The fourth aspect of the embodiment of the present application provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to realize the method for predicting a risk level of enterprise data transmission based on GNN and LSTM provided in the first aspect of the embodiment of the present application.

[0040] The beneficial effects of the present application are as follows:

[0041] The present application uses the LSTM algorithm to capture the time dependence of these features to realize the prediction of the risk level of enterprise outbound data, and analyzes the characteristics of the enterprise historical flow. The LSTM processes time series data, captures long time dependence by using memory cells and forgetting mechanisms, and generates a prediction result of each time step. Therefore, the risk of cross-border transmission can be comprehensively analyzed according to the historical behavior of the enterprise. The present application uses the GNN algorithm to process and analyze data. In the cross-border data transmission scenario, the data transmitted by the enterprise can be regarded as part of a graph. Nodes represent senders and receivers, edges represent transmission paths, and edge weights can reflect data volume or importance. GNN processes data to obtain the architecture relationship in cross-border transmission data, and then transmits the processed result to the LSTM part, thereby ensuring sufficient learning and analysis of the features of the data. Parallel execution of multiple threads of GNN and introduction of LSTM can greatly improve the efficiency.

[0042] Other features and advantages of the present application will be described in the subsequent description, and some will become apparent from the description, or will be understood by those skilled in the art through implementation of the present application. The purpose and other advantages of the present application can be achieved and obtained by the structure specifically pointed out in the written description, claims and drawings.

[0043] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0045] Figure 1 A flowchart of a method for predicting enterprise data transmission risk levels based on GNN and LSTM provided by an embodiment of the present invention;

[0046] Figure 2 A schematic diagram of the enterprise data transmission risk level prediction system framework based on GNN and LSTM;

[0047] Figure 3 A block diagram of a system for predicting enterprise data transmission risk levels based on GNN and LSTM is provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0048] The present invention will be further described in detail below with reference to specific examples, but the embodiments of the present invention are not limited thereto.

[0049] like Figure 1 As shown, the first aspect of the embodiment of the present invention provides a method for predicting the enterprise data transmission risk level based on GNN and LSTM, including the following steps:

[0050] Step 11: Obtain the enterprise's transmission data traffic based on the spot check frequency and declaration information.

[0051] Among them, the enterprise transmission data traffic includes one or more of: the proportion of personal information, the proportion of important data, the total amount of data, the types of data included, the security level of the data receiver, and the historical transmission risk level of the data sender.

[0052] In step 12, the enterprise transmission data traffic is divided into multiple time steps of input data and input into the GNN model for processing, and the embedded aggregated data is output.

[0053] The input data of each time step is used as a time graph, in which the nodes represent the sender and the receiver, the edges represent the transmission path, and the edge weight represents the historical transmission risk level of the sender.

[0054] In step 13, the embedded aggregated data is input into the LSTM model for processing, and the risk prediction result of the last time step is output.

[0055] Step 14, input the risk prediction result into a fully connected layer for classification, and output a risk level.

[0056] In this embodiment, the data link transmission of the enterprise is predicted by using the GNN and LSTM algorithms, the data is input into the GNN for further processing and analysis, and then the time sequence is predicted by using the LSTM, the LSTM takes the risk level as the output, and the analysis is transmitted to the next moment as a memory unit. The proposed scheme performs GNN operations on multiple nodes in parallel during data cross-border transmission, and then performs LSTM in sequence to predict the risk level, which greatly improves the processing efficiency of the data. The proposed protocol realizes the quantitative evaluation of the security risk of enterprise data export, and solves the problem of risk assessment of enterprise data transmission in the data export scenario.

[0057] The second aspect of the embodiment of the application provides a GNN and LSTM based enterprise data transmission risk level prediction method, which is applied to the analysis of the data of an enterprise by a regulatory department during the cross-border transmission process of the enterprise. During the cross-border data transmission process of the enterprise, the enterprise should first report the flow to the relevant department and provide information such as the amount of data to be sent and the data category. The risk level of the actual transmission data is predicted according to the reported flow of the enterprise, and the flow of the enterprise is intercepted and checked during the transmission of the flow of the enterprise, and the risk level of the behavior of the enterprise is predicted to determine a risk level for the enterprise. The risk level prediction is composed of two algorithms, GNN and LSTM. The graph neural network (GNN) can indeed process graph data independently at each time step, which means that the graph data processing at each time step is independent of each other during the topology encoding stage. Specifically, the graph convolution operation at each time step only depends on the node features and the adjacency matrix at the time step, and does not directly depend on the data at other time steps. However, this independence mainly exists in the topology encoding stage of the graph convolution network (GNN). In the time sequence encoding stage, the information between different time steps is transmitted through the hidden state, thereby introducing a time-dependent relationship. The system framework of the embodiment is as shown in Figure 2

[0058] Specifically, the following steps are included:

[0059] Step 21, obtaining the transmission data flow of the enterprise according to the checking frequency and the reported information.

[0060] ​In this step, the regulatory department first evaluates a trust index for the enterprise based on the risk information of the enterprise's past cross-border transmission, that is, the historical trust index. The historical trust index is used to determine the frequency of spot checks. Based on this, the enterprise data is spot-checked, and the data collection system is used to collect, analyze, and process the data, and send it to the data export risk prediction level system. The system determines the export risk of the enterprise based on the algorithm, evaluates a level, and gives it to the regulatory department, which modifies the historical trust index.

[0061] The expression of the spot check frequency is:

[0062] ;

[0063] Among them, p represents the spot check frequency, Trust_index represents the historical trust index. It can be found that as the trust index increases, the spot check frequency decreases, and vice versa.

[0064] The regulatory department spot-checks the enterprise, and the regulatory department gives the spot-checked export data to the enterprise data transmission risk level prediction system for processing. The system analyzes the enterprise's export data, uses an algorithm model to obtain the enterprise's path risk level, and compares the enterprise's historical risk level with the current risk level to modify the enterprise's trust index. The lower the trust index, the more stringent the rectification measures for the enterprise.

[0065] Among them, the declaration information includes one or more of the following: personal information proportion, important data proportion, total data amount, data type, security level of data receiver, and historical transmission risk level of data sender. According to the spot check frequency, the data set transmitted by the enterprise is extracted, and after the data is extracted, the data is analyzed according to the declaration information declared by the enterprise, for example, the enterprise declares the personal information proportion, important data proportion, and total data amount. The analysis of the extracted data includes the personal information proportion, important data proportion, and total data amount.

[0066] Here, the personal information proportion: the proportion of data involving personal information in cross-border data transmission. The types of personal information include name, ID number, contact information, etc. Generally, the amount of personal information involved increases, and the potential risk of data leakage increases,

[0067] Important data proportion: the proportion of important or sensitive information in the data. Important data may include business secrets, financial records, technical patents, and national defense information. The leakage or tampering of such data may cause serious economic losses, reputation damage, and even threaten national security. Therefore, the higher the proportion of important data, the higher the risk assessment level of cross-border transmission.

[0068] Data total amount: The overall size of the data amount in the cross-border transmission process of the enterprise is also a key factor in assessing risks. The larger the data amount, the higher the potential security risks and management difficulties, even if the proportion of important data and sensitive data is relatively low.

[0069] Data content type: The type of data has a direct impact on its security level. Different types of data (such as financial data and medical data) have different levels of risk in cross-border transmission due to the different content they contain and the different impact they have on society, the country, and individuals.

[0070] The security level of the recipient of the data: The type of data has a direct impact on its security level. Different types of data (such as financial data and medical data) have different levels of risk in cross-border transmission.

[0071] The historical behavior of the sender of the data, which is used to set a security level: The security level of the sender is assessed based on their past behavior. Senders with a good safety record in the past will be given a higher security level, thereby reducing the overall risk assessment.

[0072] Step 22: The enterprise transmission data flow is divided into multiple time step input data, which is input into the GNN model for processing, and the embedded aggregated data is output.

[0073] Each time step input data is a time graph, with nodes representing senders and recipients, edges representing transmission paths, and edge weights representing historical transmission risk levels of senders.

[0074] Here, the GNN model and the LSTM model are pre-trained for risk level prediction before the data is input. After training, one or more features such as the proportion of personal information, the proportion of important data, the total amount of data, the type of data, the security level of the recipient of the data, and the historical transmission risk level of the sender of the data can be processed, and the final prediction result of the risk level is output. That is, when step 21 is executed, the two models have been trained.

[0075] The specific steps of step 22 include steps 221-222:

[0076] Step 221: The enterprise transmission data flow is divided into multiple time step input data, which is input into the GNN model.

[0077] In this step, data is input into the GNN to obtain the connection between nodes. Graph neural networks are designed to process data, which is usually composed of nodes, edges and their corresponding features. In the context of cross-border data transmission, the data transmitted by enterprises can be regarded as part of a graph. The nodes represent the sender and the receiver, and the edges represent the transmission path. In the initial stage of processing the data set, multiple processing processes are first generated, and the input data of each process (each time step) of the data set is regarded as a time graph, and the GNN processes these data in parallel.

[0078] In step 222, the GNN model performs a message passing operation on the input data of each node at each time step, aggregates and processes the information of the node and its neighbor nodes, and outputs the embedding aggregated data.

[0079] In this step, GNN operation is performed on the data of each time step, and the GNN model performs a message passing operation on the nodes, aggregates the information of the nodes and their neighbor nodes, captures the global graph structure information, and calculates the embedding representation of the enterprise (embedding aggregated data).

[0080] The expression of the embedding aggregated data is:

[0081] ;

[0082] Wherein, H t The embedding aggregated data is represented by The normalized adjacency matrix is represented by The node feature matrix is represented by The weight matrix of the GNN model is represented by relu The activation function is represented by Rectified Linear Unit The activation function is a nonlinear function represented by a ramp function and its variants, and its formula is:

[0083] .

[0084] Here, X represents relu The input of the activation function.

[0085] In step 23, the embedding aggregated data is input into the LSTM model for processing, and the risk prediction result at the last time step is output.

[0086] Time series prediction is based on various features of enterprise cross-border data transmission, and LSTM is used to capture the time dependence of these features to predict the risk level of enterprise outbound data. LSTM processes time series data, uses memory cells and forgetting mechanisms to capture long-time dependencies, and generates prediction results at each time step.

[0087] Specifically, the specific steps of step 23 include steps 231-234:

[0088] Step 231, input the embedding aggregated data into the LSTM model.

[0089] Step 232, update the cell state according to the current input embedding aggregated data, the forget gate and the input gate to obtain the current cell state.

[0090] Here, c t The cell state is updated according to the selection of the forget gate and the input gate, thereby maintaining long-term dependency information. The calculation formula of the current cell state is:

[0091] ;

[0092] Where, c t represents the current cell state, f t represents the output of the forget gate, , σ represents a sigmoid activation function, which is used to generate a gating signal to ensure that the information flow is continuous and differentiable in a logical sense. The activation function of sigmoid is:

[0093]

[0094] The output range of this function is [0, 1], and its curve presents an S shape. As the input value increases, the output approaches 1; when the input value is negative, the output gradually approaches 0. W xf and W hf represents the weight of the forget gate, b f represents the first bias term, represents t the hidden state at time -1. Here, t represents a time or the current time, that is, the time step, t the time -1 is t the previous time of the time, that is, the previous time step.

[0095] c t-1 represents t the cell state at time -1, i t represents the influence state of the current input embedding aggregated data on the cell state, , and represents the weight of the input gate, represents the second bias term.

[0096] represents a candidate cell state, , W xc and W hc represents a weight of the candidate cell state, b c represents a third bias term.

[0097] Step 233, the output gate calculates the output influence of the current cell state on the hidden state.

[0098]

[0099] The output gate calculates the output influence of the current cell state on the hidden state o t . W xo and W ho represents a weight of the output gate, b o represents a fourth bias term.

[0100] Step 234, the output gate updates the hidden state according to the current cell state and the output influence to obtain a current hidden state, until the hidden state of the last time step is output as a risk prediction result.

[0101] The expression of the current hidden state is:

[0102]

[0103] wherein, h t represents the current hidden state, tanh The function is used to normalize the value range of the candidate information and the hidden state. tanh The activation function is very similar to sigmoid The formula of the activation function is:

[0104]

[0105] Another important role of it in LSTM is to perform nonlinear transformation on the output state value at this moment and output it to the next layer of the network or as the final model output.

[0106] Step 24, input the risk prediction result into a fully connected layer for classification, and output a risk level.

[0107] The risk level is divided into five levels: high, higher, medium, lower and low. Different levels of rectification measures are taken for the behavior of enterprises. For low-level enterprises, the enterprise traffic is directly released. For lower-level enterprises, the enterprise's transmitted traffic is checked again, and if it is still low, the warning disposal measure is taken. For medium-risk enterprises, flow limiting measures are taken. For high-risk and high-risk enterprises, IP and network interruption measures are taken respectively.

[0108] The risk level evaluation algorithm is obtained by combining GNN and LSTM. On the basis of Euler framework, RNN is expanded to LSTM, thereby improving the ability of the model to process long sequences and capture long-time dependencies. The dataset is first processed by GNN to obtain the architecture connection in cross-border transmission data, and then the processed results are transmitted to the LSTM part to realize the analysis and prediction of the path risk level. The whole process is divided into two parts: graph embedding generation and time series prediction. GNN part: data is input into GNN to obtain the connection between nodes. Time series prediction (LSTM part): the output obtained from GNN is input, and the time series data is predicted through LSTM processing, and finally the risk level prediction result is generated. The overall algorithm can be described as:

[0109]

[0110]

[0111] where A t is the adjacency matrix representation of the snapshot at time t, containing the information of the data structure and the dynamics of how to change over time, X t is the node matrix at time t.

[0112] Step 25, according to the risk level, take corresponding rectification measures.

[0113] According to the risk level result, different levels of behavior constraints are taken for enterprises. The regulatory department will check the enterprise, and the regulatory department will process the outbound data system. The system will analyze the outbound data of the enterprise, use the risk path classification model to get the path risk level of the enterprise, and compare the historical risk level of the enterprise with the present risk level to modify the trust index of the enterprise. The lower the trust index, the more strict the rectification measures for the enterprise. For the risk disposal of the regulatory department to the enterprise, the related formula of trust index and check frequency is proposed, according to the prediction of risk level, the modification of enterprise trust index, the regulatory department adjusts the check strength of the enterprise, solves the problem of disposal measures for enterprises with different risk levels.

[0114] The application proposes to use, but is not limited to, using a GNN algorithm to detect possible abnormal connections and potential security relationships in the data outbound process by constructing mutual dependence between module data nodes; the application proposes to use LSTM to learn and analyze the characteristics in the enterprise cross-border transmission process, thereby detecting abnormal behavior in the enterprise data outbound process, using the advantage of LSTM in processing time series data, capturing the trend of abnormality by analyzing the pattern of historical data flow, and warning potential risks in data outbound in advance; the application proposes to use, but is not limited to, using a link risk level prediction model of a GNN algorithm and an LSTM algorithm model, which is different from using a binary network and only considering the risk gap of the destination address being overseas, using GNN to learn the characteristics of the data nodes in the data set, and jointly using LSTM to analyze and predict the overall link risk level, thereby realizing quantitative evaluation of the security risk of enterprise data outbound, and solving the problem of risk assessment of enterprise transmission data in the data outbound scenario; the application uses GNN operation of multiple threads in parallel, and introduces LSTM for risk level prediction, thereby greatly solving the problem of low efficiency caused by too large data volume in the data cross-border transmission process. The application proposes to establish a trust index of the enterprise by the supervisory department, dynamically adjust the trust index according to the change of the risk level of the enterprise in the cross-border transmission process, and based on this, establish the relationship between the trust index and the frequency of spot checks, thereby dynamically adjusting the spot check and disposal strategy of the enterprise by the supervisory department.

[0115] In the data analysis and processing stage, the application uses a GNN algorithm to analyze the data set, obtains the connection in the characteristics, and improves the utilization rate of data; GNN captures the relationship and interaction between nodes in the network through its graph structure, and performs well in processing data with complex connection mode. The LSTM effectively processes time series data through its memory mechanism, and can capture the dynamic change of data in the time dimension. This combination enables the model not only to understand the current state, but also to predict the future based on this, thereby realizing higher security in data transmission. In a complex network environment, the time series prediction capability of LSTM can help identify abnormal behavior, set a high level for the risk level of the path, and thus take corresponding security measures, thereby providing more comprehensive security protection for cross-border data transmission and improving the overall security and reliability. The application does not stop at the theoretical level, and proposes a design for application implementation of data collection, analysis, processing and risk level prediction of the enterprise by the supervisory department in the process of enterprise cross-border data transmission, which has strong practicality.

[0116] As shown in Figure 3 The third aspect of the embodiment of the application provides a GNN and LSTM-based enterprise data transmission risk level prediction system, which comprises:

[0117] The collection module 31 is used for obtaining enterprise transmission data flow according to the sampling frequency and the declaration information; wherein the enterprise transmission data flow comprises one or more of the following: personal information proportion, important data proportion, total data amount, data containing type, security level of the data receiver and historical transmission risk level of the data sender;

[0118] The analysis module 32 is used for inputting the enterprise transmission data flow into a GNN model as time step input data for processing, and outputting embedded aggregated data; wherein the time step input data is taken as a time graph, the nodes in the time graph represent the sender and the receiver, the edges represent the transmission path, and the edge weight represents the historical transmission risk level of the sender.

[0119] The prediction module 33 is used for inputting the embedded aggregated data into an LSTM model for processing, and outputting a risk prediction result of the last time step.

[0120] The classification module 34 is used for inputting the risk prediction result into a full connection layer for classification, and outputting a risk level.

[0121] In an embodiment of the present application, the expression of the sampling frequency is as follows:

[0122] ;

[0123] Wherein, p represents the sampling frequency, Trust_index represents the historical trust index.

[0124] In an embodiment of the present application, the enterprise transmission data flow is inputted into a GNN model as time step input data for processing, and the embedded aggregated data is outputted, comprising:

[0125] The enterprise transmission data flow is inputted into a GNN model as time step input data;

[0126] The GNN model performs a message passing operation on the input data of each time step node, aggregates and processes the information of the node and its neighbor nodes, and outputs the embedded aggregated data.

[0127] In an embodiment of the present application, the expression of the embedded aggregated data is as follows:

[0128] ;

[0129] Wherein, H t represents the embedded aggregated data, represents a normalized adjacency matrix, represents a node feature matrix, represents a weight matrix of the GNN model,relu denotes Rectified Linear Unit an activation function, which is a nonlinear function represented by a ramp function and its variants, the formula of which is:

[0130] .

[0131] In an embodiment of the present application, the embedded aggregated data is input into the LSTM model for processing, and the risk prediction result of the last time step is output, including:

[0132] The embedded aggregated data is input into the LSTM model;

[0133] The current cell state is updated according to the current input embedded aggregated data, the forget gate and the input gate to obtain a current cell state;

[0134] The output gate calculates the output influence of the current cell state on the hidden state;

[0135] The output gate updates the hidden state according to the current cell state and the output influence to obtain a current hidden state, until the hidden state of the last time step is output as the risk prediction result.

[0136] In an embodiment of the present application, the formula for calculating the current cell state is:

[0137] ;

[0138] wherein, c t denotes the current cell state, f t denotes the output of the forget gate, , σ denotes a sigmoid activation function, W xf and W hf denotes the weight of the forget gate, b f denotes a first bias term, c t-1 denotes t the cell state at time -1, i t denotes the influence of the current input embedded aggregated data on the cell state, , and denotes the weight of the input gate, denotes a second bias term, denotes t the hidden state at time -1, denotes a candidate cell state, , Wxc and W hc a weight representing a candidate cell state, b c a third bias term.

[0139] In an embodiment of the present application, an expression of a current hidden state is:

[0140]

[0141] wherein, h t a current hidden state, o t an output influence, ; wherein, W xo and W ho a weight of an output gate, b o a fourth bias term, .

[0142] A fourth aspect of the embodiments of the present application provides an electronic device, comprising a memory, a processor and a computer program stored in the memory and executable on the processor, and the processor implements the above-mentioned enterprise data transmission risk level prediction method based on GNN and LSTM provided by the embodiments of the present application when executing the program.

[0143] The fifth aspect of the embodiments of the present application further provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the steps of the above-mentioned enterprise data transmission risk level prediction method based on GNN and LSTM provided by the embodiments of the present application.

[0144] The memory can include a random access memory (RAM) and can also include a non-volatile memory (NVM), for example, at least one disk memory. Optionally, the memory can also be at least one storage device located away from the aforementioned processor.

[0145] The processor described above can be a general processor, including a central processing unit (CPU), a network processor (NP), etc.; can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware system.

[0146] The method provided by the embodiments of the present application can be applied to an electronic device. Specifically, the electronic device can be a desktop computer, a portable computer, a smart mobile terminal, a server, etc. Herein, no limitation is made, and any electronic device that can implement the present application belongs to the protection scope of the present application.

[0147] For the system / electronic device embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the part of the description of the method embodiments.

[0148] The present application is described with reference to flowcharts and / or block diagrams of the method, device (system) and computer program product according to the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of the flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing devices to produce a machine, so that the instructions executed by the computer or other programmable data processing devices produce a device for implementing the functions specified in the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 a system for implementing the functions specified in one or more flows and / or blocks.

[0149] These computer program instructions can also be stored in a computer-readable memory to guide the computer or other programmable data processing devices to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including an instruction device, which implements the functions specified in the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 a system for implementing the functions specified in one or more flows and / or blocks.

[0150] These computer program instructions can also be loaded into a computer or other programmable data processing devices, so that a series of operational steps are performed on the computer or other programmable devices to generate computer-implemented processes, thus the instructions executed on the computer or other programmable devices provide processes for implementing the functions specified in the flowchart Figure 1 one or more flows and / or blocks Figure 1 one or more blocks or steps of the functions specified in the flowchart

[0151] Obviously, those skilled in the art can make various modifications and variations to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application belong to the scope of the claims of the present application and their equivalent technologies, the present application also intends to include these modifications and variations.

Claims

1. A method for predicting a risk level of enterprise data transmission based on GNN and LSTM, characterized in that, The method comprises the following steps: According to the sampling frequency and the declaration information, the enterprise transmission data flow is obtained; wherein, the enterprise transmission data flow comprises one or more of the following: personal information proportion, important data proportion, total data amount, data containing type, security level of data receiver, and historical transmission risk level of data sender; The enterprise transmission data flow is divided into input data of multiple time steps, which is input into a GNN model for processing, and embedded aggregated data is output; wherein, the input data of each time step is a time graph, the nodes in the time graph represent the sender and the receiver, the edges represent the transmission path, and the edge weight represents the historical transmission risk level of the sender; The embedded aggregated data is input into an LSTM model for processing, and the risk prediction result of the last time step is output; The risk prediction result is input into a full connection layer for classification, and the risk level is output.

2. The method of claim 1, wherein, The expression of the sampling frequency is: ； wherein, p represents a sampling frequency, Trust_index represents a historical trust index.

3. The method of claim 1, wherein, The enterprise transmission data flow is divided into input data of multiple time steps, which is input into a GNN model for processing, and embedded aggregated data is output; wherein, the input data of each time step is a time graph, the nodes in the time graph represent the sender and the receiver, the edges represent the transmission path, and the edge weight represents the historical transmission risk level of the sender. The expression of the embedded aggregated data is: relu 4. The method of claim 3, wherein, Rectified Linear Unit ； wherein, H t represents an embedding polymeric data, represents a normalized adjacency matrix, represents a node feature matrix, represents a weight matrix of the GNN model, The embedded aggregated data is input into an LSTM model for processing, and the risk prediction result of the last time step is output; wherein, the embedded aggregated data is input into an LSTM model; represents The current cell state is updated according to the current input embedded aggregated data, the forget gate and the input gate to obtain the current cell state; an activation function, which is a nonlinear function represented by a ramp function and its variants, whose formula is: ； wherein represents The output gate calculates the output influence of the current cell state on the hidden state; input.

5. The method of claim 1, wherein, The output gate updates the hidden state according to the current cell state and the output influence to obtain the current hidden state, until the hidden state of the last time step is output as the risk prediction result. The calculation formula of the current cell state is: σ The expression of the current hidden state is: It comprises:

6. The method of claim 5, wherein, The acquisition module is configured to obtain the enterprise transmission data flow according to the sampling frequency and the declaration information; wherein, the enterprise transmission data flow comprises one or more of the following: personal information proportion, important data proportion, total data amount, data containing type, security level of data receiver, and historical transmission risk level of data sender; ； wherein, c t denotes the current cell state, f t denotes the output of the forget gate, , The analysis module is configured to divide the enterprise transmission data flow into input data of multiple time steps, which is input into a GNN model for processing, and embedded aggregated data is output; wherein, the input data of each time step is a time graph, the nodes in the time graph represent the sender and the receiver, the edges represent the transmission path, and the edge weight represents the historical transmission risk level of the sender; denotes a sigmoid activation function, W xf and W hf denotes the weights of the forget gate, b f denotes the first bias term, c t-1 denotes t the cell state at -1 time step, i t denotes the influence of the current input embedding aggregated data on the cell state, , and denotes the weights of the input gate, denotes the second bias term, denotes t the hidden state at -1 time step, denotes the candidate cell state, , W xc and W hc denotes the weights of the candidate cell state, b c denotes the third bias term.

7. The method of claim 6, wherein, The prediction module is configured to input the embedded aggregated data into an LSTM model for processing, and output the risk prediction result of the last time step; wherein, h t denotes the current hidden state, o t denotes the output influence, ; wherein, W xo and W ho denotes the weight of the output gate, b o denotes a fourth bias term; c t denotes the current cell state.

8. A GNN and LSTM-based enterprise data transmission risk level prediction system, characterized in that, The risk prediction result is input into a full connection layer for classification, and the risk level is output. ​ ​ ​ A classification module is configured to input the risk prediction result into a full connection layer for classification, and output a risk level.

9. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor implements the program to implement the enterprise data transmission risk level prediction method based on GNN and LSTM according to any one of claims 1 to 7.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the enterprise data transmission risk level prediction method based on GNN and LSTM according to any one of claims 1 to 7.

Images