A method and system for auditing information processing of enterprise data assets

Abstract

The present invention belongs to the field of data auditing technology and discloses an audit information processing method and system for enterprise data assets; the method comprises: collecting user behavior data; clustering the user behavior data using an improved clustering algorithm and constructing a baseline behavior model; constructing a behavior recognition model, integrating the baseline behavior model and the behavior recognition model, performing anomaly analysis on the user behavior data and identifying abnormal user behavior; analyzing abnormal user behavior, calculating the corresponding anomaly score and evaluating the risk level; automatically triggering an alarm according to the risk level, and generating and executing a personalized response strategy using an optimization algorithm; the present invention not only improves the efficiency of enterprise data security management and control, but also improves the accuracy of responding to data risks, achieving rapid response and precise prevention and control; adopts an intelligent algorithm to realize automated and intelligent data auditing, overcomes the limitations of traditional reliance on manual monitoring, and effectively protects the security of enterprise data assets.

Description

Technical Field

[0001] The present invention relates to the field of data auditing technology, and more specifically, to a method and system for processing audit informationization of enterprise data assets. Background Art

[0002] With the deepening of digital transformation, enterprises have generated a large amount of data assets in their daily operations. These data are not only an important basis for corporate decision-making, but also a core manifestation of their competitiveness. However, with the surge in data volume, problems such as data leakage, misuse and compliance risks have become increasingly prominent. In order to effectively protect corporate data assets and ensure data security and compliance, user behavior auditing has become a vital task. User behavior auditing mainly focuses on the user's operation records in the system, including access, modification and deletion of data. By monitoring and analyzing user behavior, enterprises can promptly detect abnormal operations, identify potential security threats, and track the compliance of data use. However, traditional user behavior auditing methods often rely on manual monitoring and manual recording, which is inefficient and prone to omissions, and cannot meet the needs of modern enterprises for real-time monitoring and rapid response. Therefore, there is an urgent need to develop an information-based user behavior auditing processing method.

[0003] The patent application with publication number CN112685768A discloses a data leakage prevention method and device based on software asset auditing; the method includes: in the collection management stage, configuring a data collection strategy; in the data collection stage, defining a data extraction strategy and collecting data according to the data collection strategy; analyzing the user's access behavior based on the collected data, and conducting a security incident audit on the user; auditing data assets and analyzing the collected data; using a report engine to customize the report structure and generate corresponding reports for various analyzed indicators; this invention can timely locate the source of hidden dangers and respond to alarms, greatly avoiding possible information security risks in the enterprise and ensuring the information security of the enterprise.

[0004] However, although the above-mentioned technologies involve user behavior auditing, they do not elaborate on the specific auditing methods and lack clear operating guidelines and monitoring frameworks, which makes enterprises face greater complexity and uncertainty when implementing user behavior auditing methods. This lack of systematic and standardized implementation methods cannot effectively prevent potential security threats, thereby leading to the formation of information security blind spots and reducing the accuracy and efficiency of abnormal behavior identification.

[0005] In view of this, the present invention proposes an audit information processing method and system for enterprise data assets to solve the above problems. Summary of the Invention

[0006] In order to overcome the above-mentioned defects of the prior art and achieve the above-mentioned objectives, the present invention provides the following technical solutions: a method for processing audit information of enterprise data assets, comprising:

[0007] Collect user behavior data;

[0008] The improved clustering algorithm is used to cluster the user behavior data into multiple benchmark sets, and a corresponding benchmark behavior model is constructed based on the user behavior data in each benchmark set.

[0009] Build a behavior recognition model based on deep learning technology, integrate the baseline behavior model and the behavior recognition model, perform anomaly analysis on user behavior data, and identify abnormal user behavior;

[0010] Perform multi-dimensional analysis on abnormal user behavior, calculate the corresponding anomaly score, and assess the corresponding risk level based on the preset level mapping table;

[0011] Automatically trigger alarms based on risk levels, and use optimization algorithms to iteratively analyze abnormal user behaviors and abnormal scores. During each iterative analysis, the response values ​​corresponding to different response strategies are quantified, and personalized response strategies are generated and executed based on the iterative analysis results.

[0012] Furthermore, the user behavior data includes historical behavior data and real-time behavior data; historical behavior data is user operation data collected at historical moments, and real-time behavior data is user operation data collected in real time; user operation data includes user account, operation object, operation type and operation time;

[0013] The steps to build a baseline behavioral model include:

[0014] Step S101: user operation data corresponding to the same user account in the historical behavior data is taken as a group of user sets, where the user sets correspond to the user accounts one-to-one;

[0015] Step S102: Different numerical labels are set for different operation objects and marked as object labels, and different numerical labels are set for different operation types and marked as type labels; the operation objects in each user set are replaced with corresponding object labels, and the operation types in each user set are replaced with corresponding type labels;

[0016] Step S103: Divide each user set into three time sets according to the operation time in each user set; divide the same type of data in each time set into a classification set;

[0017] Step S104: Set the number of categories ;

[0018] Step S105: cluster each classification set in turn according to the number of classifications to obtain the corresponding cluster set; wherein each cluster set includes Group data collection;

[0019] Step S106: , , The amount of data that is operated on for the user;

[0020] Step S107: Loop through steps S105 to S106 until When the loop ends, the process goes to step S108;

[0021] Step S108: Calculate the average distance corresponding to each cluster set, and take the cluster set with the largest average distance among all cluster sets corresponding to each time set as the optimal set;

[0022] Step S109: Counting the number of data in each data set in each optimal set and marking it as a benchmark number; and filtering out a benchmark set from the data sets in each optimal set according to the benchmark number;

[0023] Step S110: constructing a baseline behavior model for each user account according to the baseline set corresponding to the user account.

[0024] Furthermore, in step S103, the method of dividing each user set into three time sets is as follows: obtaining the operation time in each user set, and dividing each user set into three time sets according to the date corresponding to the operation time, wherein the three time sets correspond to weekdays, weekends, and holidays respectively;

[0025] In step S105, the method for clustering each classification set is consistent; wherein, the step of clustering a classification set corresponding to an object label includes:

[0026] Step S201: Each object label in the classification set is used as a sample point, and the sample point corresponds to the object label one-to-one;

[0027] Step S202: Random selection The sample points are taken as the center point, and each center point is marked as , ; Mark the sample points that are not the center points as distribution points, and mark each distribution point as , , is the number of object labels in the classification set;

[0028] Step S203: According to The center point establishes the corresponding Group data sets and calculate the point distance from each assigned point to each center point in turn;

[0029] Step S204: Allocate points The distance to each center point is compared and the points are assigned Assign to the data set corresponding to the center point with the minimum distance;

[0030] Step S205: Make ;

[0031] Step S206: Loop through steps S204 to S205 until When the loop ends, the process goes to step S207;

[0032] Step S207: recalculate the new center point corresponding to each data set;

[0033] Step S208: Loop through steps S203 to S207 until the new center point of each data set recalculated in step S207 is consistent with the new center point calculated in the previous loop, and the loop ends. A data set and the corresponding distribution points are used as cluster sets.

[0034] Furthermore, in step S203, the expression of point distance is: Where, For allocation point To center point The point distance;

[0035] In step S207, the method for calculating the new center point of each data set includes:

[0036] ;

[0037] Where, For the The data set corresponds to the new center point, For the In the data set distribution points, For the The number of distribution points in the data set, ;

[0038] In step S108, the method for calculating the average distance corresponding to each cluster set includes:

[0039] Calculate the distance coefficient corresponding to each sample point in each cluster set, add the distance coefficients corresponding to each cluster set in turn, and then divide by , get the average distance corresponding to each cluster set; the expression of the distance coefficient is: Where, For the The distance coefficient of the sample points, For the The external distance of the sample points, For the The internal distance of the sample points, is the maximum value function, ;

[0040] No. The calculation method of the internal distance of the sample points is: The data set corresponding to the sample point is marked as the current set, and the data set except the All sample points other than the sample points are marked as other points; calculate the The point distance from each sample point to each other point is marked as the intra-cluster distance; each intra-cluster distance is added in turn, and then divided by the number of intra-cluster distances to obtain the The internal distance of the sample points;

[0041] No. The calculation method of the external distance of the sample points is: Calculate the The point distance from each sample point to each center point is marked as the center distance; each center point is sorted from large to small according to the corresponding center distance, and the data set corresponding to the second center point is marked as the nearest set, and the sample points in the nearest set are marked as neighbor points; calculate the The point distance from each sample point to each neighbor point is marked as the out-cluster distance; each out-cluster distance is added in turn, and then divided by the number of out-cluster distances to obtain the The outer distance of the sample points.

[0042] Furthermore, in step S109, the method for selecting the benchmark set from the data sets in each optimal set is as follows: a quantity threshold is preset, and the benchmark quantity corresponding to each data set is compared with the quantity threshold; if the benchmark quantity is greater than the quantity threshold, the corresponding data set is marked as the benchmark set; if the benchmark quantity is less than or equal to the quantity threshold, the corresponding data set is not marked;

[0043] In step S110, the method for constructing a baseline behavior model for the user includes:

[0044] The benchmark set corresponding to the object label is marked as the object set, the benchmark set corresponding to the type label is marked as the type set, and the benchmark set corresponding to the operation time is marked as the time period set; the operation object corresponding to the object label in each object set is used as the benchmark object of the corresponding time set; the operation type corresponding to the type label in each type set is used as the benchmark type of the corresponding time set; the operation time in each time period set is compared, the earliest operation time is marked as the extremely early time, and the latest operation time is marked as the extremely late time; the extremely early time and the extremely late time of each time period set are used as the benchmark time period of the corresponding time set; the benchmark quantity corresponding to each object set is used as the benchmark object frequency of the corresponding time set; the benchmark quantity corresponding to each type set is used as the benchmark type frequency of the corresponding time set; according to the benchmark time period, benchmark object frequency and benchmark type frequency corresponding to the corresponding time set of each user, a benchmark behavior model of the corresponding user is constructed.

[0045] Furthermore, the method for identifying abnormal user behavior includes:

[0046] Mark the user account in the real-time behavior data as the identification account, and obtain the behavior data of the day corresponding to the identification account, which is the user operation data collected at historical moments within the day; use the user operation data corresponding to the same identification account in the behavior data of the day and the real-time behavior data as a set of analysis sets, and the analysis sets correspond to the identification accounts one-to-one; count the number of each operation object in the analysis set and mark it as the number of objects; count the number of each operation type in the analysis set and mark it as the number of types; compare the operation times in the analysis set, mark the earliest operation time as the very early time of the day, mark the latest operation time as the very late time of the day, and use the very early time and the very late time of the day as the operation time period;

[0047] The baseline behavior model of the user corresponding to the identified account is used as the analysis behavior model, and the baseline time period, baseline object frequency and baseline type frequency in the analysis behavior model are used as baseline data; the number of objects, number of types, operation period and baseline data are used as analysis data, and the analysis data is input into the trained behavior recognition model to identify the corresponding behavior label; the behavior label is a numerical label corresponding to the user's abnormal behavior, and different user abnormal behaviors have different numerical labels; based on the behavior label, the corresponding user abnormal behavior is obtained; the behavior recognition model is a deep neural network model.

[0048] Further, methods for assessing risk levels include:

[0049] The number of objects, the number of types, and the operation period are used as evaluation data; based on the user's abnormal behavior, the corresponding data in the evaluation data is obtained and marked as abnormal data; based on the abnormal data, the corresponding data in the benchmark data is obtained and marked as standard data; if the abnormal data is the number of objects, the corresponding object number is subtracted from the corresponding benchmark object frequency in the benchmark data, and the absolute value is taken to obtain the object difference; if the abnormal data is the number of types, the corresponding type number is subtracted from the corresponding benchmark type frequency in the benchmark data, and the absolute value is taken to obtain the type difference; if the abnormal data is the operation period, the extremely early time of the corresponding operation period is subtracted from the extremely early time of the corresponding benchmark period, and the absolute value is taken to obtain the extremely early difference; the extremely late time of the corresponding operation period is subtracted from the extremely late time of the corresponding benchmark period, and the absolute value is taken to obtain the extremely late difference; the extremely early difference is added to the extremely late difference to obtain the period difference;

[0050] A preset weight set includes a first set, a second set, and a third set; the first set includes weight coefficients corresponding to different operation objects, the second set includes weight coefficients corresponding to different operation types, and the third set includes weight coefficients corresponding to operation time; according to the operation object corresponding to the object difference, the corresponding weight coefficient is obtained from the first set and marked as the first coefficient; according to the operation type corresponding to the type difference, the corresponding weight coefficient is obtained from the second set and marked as the second coefficient; according to the time period difference, the weight coefficient in the third set is obtained and marked as the third coefficient; each object difference is multiplied by the corresponding first coefficient to obtain a first score; each type difference is multiplied by the corresponding second coefficient to obtain a second score; the time period difference is multiplied by the third coefficient to obtain a third score; all first scores, second scores, and third scores are added in sequence to obtain an abnormality score;

[0051] A preset level mapping table includes abnormal score segments corresponding to different risk levels; risk levels include high risk, medium risk and low risk; the calculated abnormal score is marked as the calculated score, and the calculated score is compared with the abnormal score segments corresponding to different risk levels in the level mapping table to obtain the risk level corresponding to the abnormal score segment in which the calculated score is located.

[0052] Furthermore, the steps of generating a response strategy include:

[0053] Step S301: setting different digital labels for different response strategies and marking them as strategy labels;

[0054] Step S302: Initialize the population, which includes n individuals. The individual positions correspond to the strategy labels one by one. The initial number of iterations is is 0;

[0055] Step S303: Define the response value function and iteration threshold ;

[0056] Step S304: determining the optimal individual in the population;

[0057] Step S305: Based on the optimal individual, determine the update method for each individual and perform the update;

[0058] Step S306: Determine whether If so, then , and return to step S304; if not, go to step S307;

[0059] Step S307: Obtain the response strategy corresponding to the optimal individual corresponding strategy label;

[0060] In step S302, the expression of individual position is: Where, is the position of the i-th individual, is the random coefficient of the i-th individual, , , is the number of strategy tags;

[0061] Define speed range values ; For each individual, the corresponding individual speed is defined, and the expression of individual speed is: ;

[0062] In step S303, the expression of the response value function is: Where, is the response value, Security is calculated by taking the behavior label, anomaly score and individual corresponding policy label as calculation data, inputting the calculation data into the trained security analysis model, and calculating the corresponding security; the security analysis model is a deep neural network model;

[0063] In step S304, the method for determining the best individual in the population is: calculating the response value of each individual in the population, sorting all the response values ​​from large to small, and taking the individual corresponding to the first response value as the best individual.

[0064] Furthermore, in step S305, the method for determining the update mode of each individual includes:

[0065] A response threshold is preset, and the response value of the optimal individual is subtracted from the response value of each individual, and the absolute value is taken to obtain the response difference; each response difference is compared with the response threshold, and individuals corresponding to response differences greater than or equal to the response threshold are marked as exploration individuals, and individuals corresponding to response differences less than the response threshold are marked as pursuit individuals; the update method corresponding to exploration individuals is exploration update, and the update method corresponding to pursuit individuals is pursuit update;

[0066] The methods for updating each individual include:

[0067] When the exploration individual is updated, the calculation method of the update individual speed includes:

[0068] ;

[0069] Where, is the updated individual speed of the i-th individual, is the individual speed of the i-th individual before updating, is the position of the i-th individual, is the position of the optimal individual, is a random number from the standard normal distribution, Both Random numbers in ;

[0070] The calculation method for updating individual positions includes:

[0071] ;

[0072] Where, is the updated position of the i-th individual, is the position of the global optimal individual, which is the individual with the largest response value in the entire iterative process;

[0073] When the pursuit individual is updated, the calculation method of the update individual speed includes:

[0074] ;

[0075] Where, for Random numbers in ;

[0076] The calculation method for updating individual positions includes:

[0077] ;

[0078] Where, is the position of the i-th individual before update in the last iteration, for Random numbers in .

[0079] An enterprise data asset audit information processing system implements the enterprise data asset audit information processing method, including:

[0080] Data collection module, used to collect user behavior data;

[0081] The benchmark modeling module uses an improved clustering algorithm to cluster user behavior data into multiple benchmark sets, and builds a corresponding benchmark behavior model based on the user behavior data in each benchmark set;

[0082] The behavior analysis module builds a behavior recognition model based on deep learning technology, integrates the baseline behavior model and the behavior recognition model, performs anomaly analysis on user behavior data, and identifies abnormal user behavior;

[0083] The risk assessment module is used to perform multi-dimensional analysis of abnormal user behavior, calculate the corresponding abnormality score, and assess the corresponding risk level based on a preset level mapping table;

[0084] The alarm response module automatically triggers alarms based on risk levels and uses optimization algorithms to iteratively analyze abnormal user behaviors and abnormal scores. During each iterative analysis, the response values ​​corresponding to different response strategies are quantified, and personalized response strategies are generated and executed based on the iterative analysis results.

[0085] The technical effects and advantages of the enterprise data asset audit information processing method and system of the present invention are as follows:

[0086] By collecting user behavior data and building a baseline behavior model, it is possible to accurately identify abnormal user behavior and promptly discover potential data security risks. In addition, it is able to conduct risk assessments on identified abnormal user behavior, automatically trigger alarms, and generate targeted response strategies. This not only improves the efficiency of enterprise data security management and control, but also improves the accuracy of responding to data risks, achieving rapid response and precise prevention and control. The use of intelligent algorithms to achieve automated and intelligent data auditing overcomes the limitations of traditional reliance on manual monitoring, and can effectively protect the security of enterprise data assets. It has important practical significance and application value for enterprise digital transformation and information management. BRIEF DESCRIPTION OF THE DRAWINGS

[0087] Figure 1 This is a schematic diagram of an enterprise data asset audit information processing system according to embodiment 1 of the present invention;

[0088] Figure 2 This is a flow chart of a method for constructing a baseline behavior model according to Example 1 of the present invention;

[0089] Figure 3This is a flow chart of an audit information processing method for enterprise data assets according to embodiment 2 of the present invention. DETAILED DESCRIPTION

[0090] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0091] Example 1

[0092] See also Figure 1 As shown, this embodiment provides an audit information processing system for enterprise data assets, including a data acquisition module, a benchmark modeling module, a behavior analysis module, a risk assessment module and an alarm response module; each module is connected by wired and / or wireless means to realize data transmission between modules.

[0093] Data collection module, used to collect user behavior data.

[0094] User behavior data includes historical behavior data and real-time behavior data. Historical behavior data refers to user operation data collected at historical moments, while real-time behavior data refers to user operation data collected in real time. User operation data includes user account, operation object, operation type, and operation time. User behavior data is obtained through the enterprise's database management system.

[0095] A user account is a credential that uniquely identifies each user, usually consisting of a user name or user ID. It is used to track all operations of a specific user in the system to ensure clear responsibilities. The operation object is the data in the enterprise data assets (such as customer data, financial data, employee information, etc.) operated by the user, which helps analyze the usage of enterprise data assets and identify potential security risks. The operation type is the operation performed by the user, such as viewing, modifying, deleting, uploading, downloading, etc., which helps monitor and manage user behavior to identify abnormal behavior. The operation time is the time when the user performs each operation, expressed in the form of a timestamp, which is used to track the time when the operation occurred, facilitating audit backtracking and behavior analysis.

[0096] The benchmark modeling module uses an improved clustering algorithm to cluster user behavior data, clusters the user behavior data into multiple benchmark sets, and builds a corresponding benchmark behavior model based on the user behavior data in each benchmark set.

[0097] like Figure 2 As shown, the steps to build a baseline behavior model include:

[0098] Step S101: user operation data corresponding to the same user account in the historical behavior data is taken as a group of user sets, where the user sets correspond to the user accounts one-to-one;

[0099] Step S102: Different numerical labels are set for different operation objects and marked as object labels, and different numerical labels are set for different operation types and marked as type labels; the operation objects in each user set are replaced with corresponding object labels, and the operation types in each user set are replaced with corresponding type labels;

[0100] Step S103: Divide each user set into three time sets according to the operation time in each user set; divide the same type of data in each time set into a classification set, and the classification set corresponds one-to-one with the data in the corresponding time set;

[0101] Step S104: Set the number of categories ;

[0102] Step S105: cluster each classification set in turn according to the number of classifications to obtain the corresponding cluster set, where the cluster set corresponds to the classification set one by one; wherein each cluster set includes Group data collection;

[0103] Step S106: Make , , The amount of data that is operated on for the user;

[0104] Step S107: Loop through steps S105 to S106 until When the loop ends, the process goes to step S108;

[0105] Step S108: Calculate the average distance corresponding to each cluster set, and take the cluster set with the largest average distance among all cluster sets corresponding to each time set as the optimal set;

[0106] Step S109: Counting the number of data in each data set in each optimal set and marking it as a benchmark number; and filtering out a benchmark set from the data sets in each optimal set according to the benchmark number;

[0107] Step S110: constructing a baseline behavior model for each user account according to the baseline set corresponding to the user account.

[0108] In the above step S103, the method of dividing each user set into three time sets includes:

[0109] The operation time in each user set is obtained, and each user set is divided into three time sets according to the date corresponding to the operation time. The three time sets correspond to weekdays, weekends, and holidays respectively.

[0110] In the above step S105, the method for clustering each classification set is consistent; wherein, the step of clustering a classification set corresponding to an object label includes:

[0111] Step S201: Each object label in the classification set is used as a sample point, and the sample point corresponds to the object label one-to-one;

[0112] Step S202: Random selection The sample points are taken as the center point, and each center point is marked as , ; Mark the first center point as , mark the second center point as , will The center point is marked as ; Mark the sample points that are not the center points as distribution points, and mark each distribution point as , , is the number of object labels in the classification set; that is, the first allocation point is marked as , mark the second allocation point as , will The center point is marked as ;

[0113] Step S203: According to The center point establishes the corresponding Group data sets and calculate the point distance from each assigned point to each center point in turn;

[0114] Step S204: Allocate points The distance to each center point is compared and the points are assigned Assign to the data set corresponding to the center point with the minimum distance;

[0115] Step S205: Make ;

[0116] Step S206: Loop through steps S204 to S205 until When the loop ends, the process goes to step S207;

[0117] Step S207: recalculate the new center point corresponding to each data set;

[0118] Step S208: Loop through steps S203 to S207 until the new center point of each data set recalculated in step S207 is consistent with the new center point calculated in the previous loop, and the loop ends. A data set and the corresponding distribution points are used as cluster sets.

[0119] In the above step S203, the expression of point distance is: Where, For allocation point To center point The point distance.

[0120] In the above step S207, the method for calculating the new center point of each data set includes:

[0121] ;

[0122] Where, For the The data set corresponds to the new center point, For the In the data set distribution points, For the The number of distribution points in the data set, .

[0123] In the above step S108, the method for calculating the average distance corresponding to each cluster set includes:

[0124] Calculate the distance coefficient corresponding to each sample point in each cluster set, add the distance coefficients corresponding to each cluster set in turn, and then divide by , get the average distance corresponding to each cluster set; the expression of the distance coefficient is: Where, For the The distance coefficient of the sample points, For the The external distance of the sample points, For the The internal distance of the sample points, is the maximum value function, .

[0125] No. The calculation method of the internal distance of the sample points is: The data set corresponding to the sample point is marked as the current set, and the data set except the All sample points other than the sample points are marked as other points; calculate the The point distance from each sample point to each other point is marked as the intra-cluster distance; each intra-cluster distance is added in turn, and then divided by the number of intra-cluster distances to obtain the The inner distance of the sample points.

[0126] No. The calculation method of the external distance of the sample points is: Calculate the The point distance from each sample point to each center point is marked as the center distance; each center point is sorted from large to small according to the corresponding center distance, and the data set corresponding to the second center point is marked as the nearest set, and the sample points in the nearest set are marked as neighbor points; calculate the The point distance from each sample point to each neighbor point is marked as the out-cluster distance; each out-cluster distance is added in turn, and then divided by the number of out-cluster distances to obtain the The outer distance of the sample points.

[0127] In the above step S109, the method for screening out the benchmark set from the data sets within each group of optimal sets is: presetting a quantity threshold, which is pre-set by technical personnel in this field according to actual conditions; comparing the benchmark quantity corresponding to each group of data sets with the quantity threshold respectively; if the benchmark quantity is greater than the quantity threshold, the corresponding data set is marked as the benchmark set; if the benchmark quantity is less than or equal to the quantity threshold, the corresponding data set is not marked.

[0128] In the above step S110, the method for constructing a baseline behavior model for the user includes:

[0129] The benchmark set corresponding to the object label is marked as the object set, the benchmark set corresponding to the type label is marked as the type set, and the benchmark set corresponding to the operation time is marked as the time period set; the operation object corresponding to the object label in each object set is used as the benchmark object of the corresponding time set; the operation type corresponding to the type label in each type set is used as the benchmark type of the corresponding time set; the operation time in each time period set is compared, the earliest operation time is marked as the extremely early time, and the latest operation time is marked as the extremely late time; the extremely early time and the extremely late time of each time period set are used as the benchmark time period of the corresponding time set; the benchmark quantity corresponding to each object set is used as the benchmark object frequency of the corresponding time set; the benchmark quantity corresponding to each type set is used as the benchmark type frequency of the corresponding time set; according to the benchmark time period, benchmark object frequency and benchmark type frequency corresponding to the corresponding time set of each user, a benchmark behavior model of the corresponding user is constructed.

[0130] For example, the baseline behavior model of user A is:

[0131] Time collection: working day;

[0132] Base period: 9:00-17:00;

[0133] Frequency of benchmark subjects: Data A: 10 times per day, Data B: 15 times per day;

[0134] Baseline type frequency: upload: 8 times per day, download: 20 times per day;

[0135] Time collection: weekend;

[0136] Base period: 14:00-16:00;

[0137] Baseline object frequency: Data C: 5 times a day, Data D: 3 times a day;

[0138] Benchmark type frequency: View: 7 times per day, Deletion: 2 times per day.

[0139] The behavior analysis module builds a behavior recognition model based on deep learning technology, integrates the baseline behavior model and the behavior recognition model, performs anomaly analysis on user behavior data, and identifies abnormal user behavior.

[0140] Methods for identifying abnormal user behavior include:

[0141] Mark the user account in the real-time behavior data as the identification account, and obtain the behavior data of the day corresponding to the identification account, which is the user operation data collected at historical moments within the day; use the user operation data corresponding to the same identification account in the behavior data of the day and the real-time behavior data as a set of analysis sets, and the analysis sets correspond to the identification accounts one-to-one; count the number of each operation object in the analysis set and mark it as the number of objects; count the number of each operation type in the analysis set and mark it as the number of types; compare the operation times in the analysis set, mark the earliest operation time as the very early time of the day, mark the latest operation time as the very late time of the day, and use the very early time and the very late time of the day as the operation time period;

[0142] The baseline behavior model of the user corresponding to the identified account is used as the analysis behavior model, and the baseline time period, baseline object frequency, and baseline type frequency in the analysis behavior model are used as the baseline data. The number of objects, number of types, operation time period, and baseline data are used as analysis data. The analysis data is input into the trained behavior recognition model to identify the corresponding behavior label. The behavior label is a numerical label corresponding to the user's abnormal behavior. Different user abnormal behaviors have different numerical labels. Abnormal user behaviors include large-scale data downloads, excessive frequency of data A operations, and access to data B outside the baseline period. Based on the behavior label, the corresponding user abnormal behavior is obtained.

[0143] The training process of the behavior recognition model includes:

[0144] Pre-collection Group analysis data, Each group analysis data is set with corresponding behavior labels. is an integer greater than 1, converting the analysis data and the corresponding behavior labels into a corresponding set of feature vectors; the behavior labels corresponding to the analysis data are collected by those skilled in the art in the process of historically identifying abnormal user behaviors. Analyze each set of analysis data in turn according to the actual situation, determine the abnormal user behavior corresponding to each set of analysis data, and The group analysis data is set with corresponding behavior labels in turn;

[0145] Each set of feature vectors is used as the input of the behavior recognition model. The behavior recognition model outputs a set of predicted behavior labels corresponding to each set of analysis data, and uses the actual behavior labels corresponding to each set of analysis data as the prediction target. The actual behavior labels are the pre-set behavior labels corresponding to the analysis data. The training goal is to minimize the sum of the prediction errors of all analysis data. The calculation formula for the prediction error is: ,in is the prediction error, is the group number of the eigenvector corresponding to the analyzed data, For the The predicted behavior labels corresponding to the group analysis data, For the The actual behavior labels corresponding to the group analysis data are trained on the behavior recognition model until the sum of the prediction errors reaches convergence.

[0146] The above-mentioned behavior recognition model is specifically a deep neural network model; it includes an input layer, a hidden layer and an output layer; each hidden layer includes multiple neurons, each neuron is connected to the neurons in the next layer, and the connection contains weights, which determine the importance and influence of data transmission in the neural network; an activation function is applied to each neuron between the hidden layer and the output layer. The activation function introduces nonlinearity, allowing the network to learn more complex patterns and features.

[0147] The risk assessment module is used to perform multi-dimensional analysis of user abnormal behavior, calculate the corresponding abnormality score, and evaluate the corresponding risk level based on a preset level mapping table.

[0148] Methods for assessing risk levels include:

[0149] The number of objects, the number of types and the operation period are used as evaluation data; according to the abnormal behavior of the user, the corresponding data in the evaluation data is obtained and marked as abnormal data; for example, if the abnormal behavior of the user is large-scale data downloading, the number of types corresponding to the operation type of download is obtained; if the abnormal behavior of the user is excessive frequency of data A operations, the number of objects corresponding to the operation object of data A is obtained; according to the abnormal data, the corresponding data in the benchmark data is obtained and marked as standard data; if the abnormal data is the number of objects, the corresponding benchmark object frequency in the benchmark data is subtracted from the corresponding object number, and the absolute value is taken to obtain the object difference; if the abnormal data is the number of types, the corresponding benchmark type frequency in the benchmark data is subtracted from the corresponding type number, and the absolute value is taken to obtain the type difference; if the abnormal data is the operation period, the extremely early time of the corresponding operation period is subtracted from the extremely early time of the corresponding benchmark period, and the absolute value is taken to obtain the extremely early difference; the extremely late time of the corresponding operation period is subtracted from the extremely late time of the corresponding benchmark period, and the absolute value is taken to obtain the extremely late difference; the extremely early difference is added to the extremely late difference to obtain the period difference.

[0150] A preset weight set includes a first set, a second set and a third set. The weight set is pre-set by technical personnel in this field according to actual conditions; the first set includes weight coefficients corresponding to different operation objects, the second set includes weight coefficients corresponding to different operation types, and the third set includes weight coefficients corresponding to operation time; according to the operation object corresponding to the object difference, the corresponding weight coefficient is obtained from the first set and marked as the first coefficient; according to the operation type corresponding to the type difference, the corresponding weight coefficient is obtained from the second set and marked as the second coefficient; according to the time period difference, the weight coefficient in the third set is obtained and marked as the third coefficient; each object difference is multiplied by the corresponding first coefficient to obtain the first score; each type difference is multiplied by the corresponding second coefficient to obtain the second score; the time period difference is multiplied by the third coefficient to obtain the third score; all first scores, second scores and third scores are added in sequence to obtain the abnormality score.

[0151] A preset level mapping table includes abnormal score segments corresponding to different risk levels. The level mapping table is pre-set by technical personnel in this field according to actual conditions; the risk levels include high risk, medium risk and low risk; the calculated abnormal score is marked as the calculated score, and the calculated score is compared with the abnormal score segments corresponding to different risk levels in the level mapping table to obtain the risk level corresponding to the abnormal score segment in which the calculated score is located.

[0152] The alarm response module automatically triggers alarms based on risk levels and uses optimization algorithms to iteratively analyze abnormal user behaviors and abnormal scores. During each iterative analysis, the response values ​​corresponding to different response strategies are quantified, and personalized response strategies are generated and executed based on the iterative analysis results.

[0153] When an alarm is triggered, the system automatically generates an alarm message, which includes the account identification, abnormal user behavior and risk level, and sends the alarm message to the mobile devices of relevant enterprise personnel in the form of email or text message; response strategies include temporarily disabling the account, reducing access rights, freezing user operations, isolating network access, etc.

[0154] The steps to generate a response strategy include:

[0155] Step S301: setting different digital labels for different response strategies and marking them as strategy labels;

[0156] Step S302: Initialize the population, which includes n individuals. The individual positions correspond to the strategy labels one by one. The initial number of iterations is is 0;

[0157] Step S303: Define the response value function and iteration threshold ;

[0158] Step S304: determining the optimal individual in the population;

[0159] Step S305: Based on the optimal individual, determine the update method for each individual and perform the update;

[0160] Step S306: Determine whether If so, then , and return to step S304; if not, go to step S307;

[0161] Step S307: Obtain the response strategy corresponding to the optimal individual corresponding strategy label.

[0162] In the above step S302, the expression of the individual position is: Where, is the position of the i-th individual, is the random coefficient of the i-th individual, , , is the number of strategy tags;

[0163] Define speed range values The speed range value is preset by those skilled in the art according to actual conditions; a corresponding individual speed is defined for each individual, and the expression of the individual speed is: .

[0164] In the above step S303, the expression of the response value function is: Where, is the response value, The security is calculated by taking the behavior label, anomaly score and individual corresponding strategy label as calculation data, inputting the calculation data into the trained security analysis model, and calculating the corresponding security; the training process of the security analysis model is consistent with the training process of the behavior recognition model, and both are deep neural network models; the security corresponding to the calculation data is collected by those skilled in the art when generating the response strategy historically. The group of calculation data, under the conditions of the behavior label and abnormal score in each group of calculation data, adopts the response strategy corresponding to the strategy label in the corresponding calculation data to perform risk management, and analyzes the security after risk management. The group calculation data sets the corresponding security in turn; the iteration threshold It is preset by those skilled in the art according to actual conditions.

[0165] In the above step S304, the method for determining the best individual in the population is: calculating the response value of each individual in the population, sorting all the response values ​​from large to small, and taking the individual corresponding to the first response value as the best individual.

[0166] In the above step S305, the method for determining the update mode of each individual includes:

[0167] A preset response threshold is preset by a person skilled in the art according to actual conditions; the response value of the optimal individual is subtracted from the response value of each individual, and the absolute value is taken to obtain a response difference; each response difference is compared with the response threshold, and the individuals corresponding to the response difference greater than or equal to the response threshold are marked as exploration individuals, and the individuals corresponding to the response difference less than the response threshold are marked as pursuit individuals; wherein, the update method corresponding to the exploration individual is exploration update, and the update method corresponding to the pursuit individual is pursuit update.

[0168] The methods for updating each individual include:

[0169] When the exploration individual is updated, the calculation method of the update individual speed includes:

[0170] ;

[0171] Where, is the updated individual speed of the i-th individual, is the individual speed of the i-th individual before updating, is the position of the i-th individual, is the position of the optimal individual, is a random number from the standard normal distribution, Both Random numbers in .

[0172] The calculation method for updating individual positions includes:

[0173] ;

[0174] Where, is the updated position of the i-th individual, is the position of the global optimal individual, and the global optimal individual is the individual with the largest response value in the entire iterative process.

[0175] When the pursuit individual is updated, the calculation method of the update individual speed includes:

[0176] ;

[0177] Where, for Random numbers in .

[0178] The calculation method for updating individual positions includes:

[0179] ;

[0180] Where, is the position of the i-th individual before update in the last iteration, for Random numbers in .

[0181] This embodiment collects user behavior data and constructs a baseline behavior model, which can accurately identify abnormal user behavior and promptly discover potential data security risks. In addition, it can conduct risk assessments on identified abnormal user behavior, automatically trigger alarms, and generate targeted response strategies, which not only improves the efficiency of enterprise data security management and control, but also improves the accuracy of responding to data risks, achieving rapid response and precise prevention and control. It uses intelligent algorithms to achieve automated and intelligent data auditing, overcoming the limitations of traditional reliance on manual monitoring, and can effectively protect the security of enterprise data assets. It has important practical significance and application value for enterprise digital transformation and information management.

[0182] Example 2

[0183] See also Figure 3 As shown, for the parts not described in detail in this embodiment, please refer to the description of Example 1. A method for auditing information processing of enterprise data assets is provided, and the method includes:

[0184] Collect user behavior data;

[0185] The improved clustering algorithm is used to cluster the user behavior data into multiple benchmark sets, and a corresponding benchmark behavior model is constructed based on the user behavior data in each benchmark set.

[0186] Build a behavior recognition model based on deep learning technology, integrate the baseline behavior model and the behavior recognition model, perform anomaly analysis on user behavior data, and identify abnormal user behavior;

[0187] Perform multi-dimensional analysis on abnormal user behavior, calculate the corresponding anomaly score, and assess the corresponding risk level based on the preset level mapping table;

[0188] Automatically trigger alarms based on risk levels, and use optimization algorithms to iteratively analyze abnormal user behaviors and abnormal scores. During each iterative analysis, the response values ​​corresponding to different response strategies are quantified, and personalized response strategies are generated and executed based on the iterative analysis results.

[0189] Example 3

[0190] The present application also provides an electronic device. The electronic device may include one or more processors and one or more memories. The memories may store computer-readable code that, when executed by the one or more processors, may execute the aforementioned method for processing enterprise data asset audit informatization.

[0191] The method or system according to the implementation manner of the present application can also be implemented with the help of the architecture of the electronic device shown in this application. The electronic device may include a bus, one or more CPUs, ROM, RAM, a communication port connected to a network, input / output, a hard disk, etc. The storage device in the electronic device, such as a ROM or a hard disk, can store an audit information processing method for enterprise data assets provided by this application. Furthermore, the electronic device may also include a user interface. Of course, the architecture shown in this application is only exemplary. When implementing different devices, one or more components in the electronic device shown in this application can be omitted according to actual needs.

[0192] Example 4

[0193] One embodiment of the present application discloses a computer-readable storage medium. The computer-readable storage medium stores computer-readable instructions. When the computer-readable instructions are executed by a processor, the audit information processing method for enterprise data assets according to the embodiment of the present application described with reference to the above figures can be executed. The storage medium includes, but is not limited to, volatile memory and / or non-volatile memory. Volatile memory may include, for example, random access memory (RAM) and cache memory. Non-volatile memory may include, for example, read-only memory (ROM), a hard disk, flash memory, etc.

[0194] In addition, according to embodiments of the present application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, the present application provides a non-transitory machine-readable storage medium storing machine-readable instructions capable of being executed by a processor to perform instructions corresponding to the steps of the method provided herein, such as a method for processing enterprise data asset audit informatization. When this computer program is executed by a central processing unit (CPU), the functions defined in the method of the present application are performed.

[0195] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

[0196] Finally: The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for processing enterprise data asset audit informationization, characterized in that: include: Collect user behavior data; The improved clustering algorithm is used to cluster the user behavior data into multiple benchmark sets, and a corresponding benchmark behavior model is constructed based on the user behavior data in each benchmark set. Build a behavior recognition model based on deep learning technology, integrate the baseline behavior model and the behavior recognition model, perform anomaly analysis on user behavior data, and identify abnormal user behavior; Perform multi-dimensional analysis on abnormal user behavior, calculate the corresponding anomaly score, and assess the corresponding risk level based on the preset level mapping table; Automatically trigger alerts based on risk levels, and use optimization algorithms to iteratively analyze abnormal user behavior and anomaly scores. Quantify the response values ​​corresponding to different response strategies during each iterative analysis process, and generate and execute personalized response strategies based on the iterative analysis results. The steps to generate a response strategy include: Step S301: setting different digital labels for different response strategies and marking them as strategy labels; Step S302: Initialize the population, which includes n individuals. The individual positions correspond to the strategy labels one by one. The initial number of iterations is is 0; Step S303: Define the response value function and iteration threshold ; Step S304: determining the optimal individual in the population; Step S305: Based on the optimal individual, determine the update method for each individual and perform the update; Step S306: Determine whether If so, then , and return to step S304; if not, go to step S307; Step S307: Obtain the response strategy corresponding to the optimal individual corresponding strategy label; In step S305, the method for determining the update mode of each individual includes: A response threshold is preset, and the response value of the optimal individual is subtracted from the response value of each individual, and the absolute value is taken to obtain the response difference; each response difference is compared with the response threshold, and individuals corresponding to response differences greater than or equal to the response threshold are marked as exploration individuals, and individuals corresponding to response differences less than the response threshold are marked as pursuit individuals; the update method corresponding to exploration individuals is exploration update, and the update method corresponding to pursuit individuals is pursuit update; The methods for updating each individual include: When the exploration individual is updated, the calculation method of the update individual speed includes: ； Where, is the updated individual speed of the i-th individual, is the individual speed of the i-th individual before updating, is the position of the i-th individual, is the position of the optimal individual, is a random number from the standard normal distribution, Both Random numbers in ; The calculation method for updating individual positions includes: ； Where, is the updated position of the i-th individual, is the position of the global optimal individual, which is the individual with the largest response value in the entire iterative process; When the pursuit individual is updated, the calculation method of the update individual speed includes: ； Where, for Random numbers in ; The calculation method for updating individual positions includes: ； Where, is the position of the i-th individual before update in the last iteration, for Random numbers in .

2. The audit information processing method for enterprise data assets according to claim 1 is characterized in that: The user behavior data includes historical behavior data and real-time behavior data; historical behavior data is user operation data collected at historical moments, and real-time behavior data is user operation data collected in real time; User operation data includes user account, operation object, operation type, and operation time; The steps to build a baseline behavioral model include: Step S101: user operation data corresponding to the same user account in the historical behavior data is taken as a group of user sets, where the user sets correspond to the user accounts one-to-one; Step S102: Different numerical labels are set for different operation objects and marked as object labels, and different numerical labels are set for different operation types and marked as type labels; the operation objects in each user set are replaced with corresponding object labels, and the operation types in each user set are replaced with corresponding type labels; Step S103: Divide each user set into three time sets according to the operation time in each user set; divide the same type of data in each time set into a classification set; Step S104: Set the number of categories ; Step S105: cluster each classification set in turn according to the number of classifications to obtain the corresponding cluster set; wherein each cluster set includes Group data collection; Step S106: Make , , The amount of data that is operated on for the user; Step S107: Loop through steps S105 to S106 until When the loop ends, the process goes to step S108; Step S108: Calculate the average distance corresponding to each cluster set, and take the cluster set with the largest average distance among all cluster sets corresponding to each time set as the optimal set; Step S109: Counting the number of data in each data set in each optimal set and marking it as a benchmark number; and filtering out a benchmark set from the data sets in each optimal set according to the benchmark number; Step S110: constructing a baseline behavior model for each user account according to the baseline set corresponding to the user account.

3. The audit information processing method for enterprise data assets according to claim 2 is characterized in that: In step S103, the method for dividing each user set into three time sets is as follows: obtaining the operation time in each user set, and dividing each user set into three time sets according to the date corresponding to the operation time, wherein the three time sets correspond to weekdays, weekends, and holidays respectively; In step S105, the method for clustering each classification set is consistent; wherein, the step of clustering a classification set corresponding to an object label includes: Step S201: Each object label in the classification set is used as a sample point, and the sample point corresponds to the object label one-to-one; Step S202: Random selection The sample points are taken as the center point, and each center point is marked as , ; Mark the sample points that are not the center points as distribution points, and mark each distribution point as , , is the number of object labels in the classification set; Step S203: According to The center point establishes the corresponding Group data sets and calculate the point distance from each assigned point to each center point in turn; Step S204: Allocate points The distance to each center point is compared and the points are assigned Assign to the data set corresponding to the center point with the minimum distance; Step S205: Make ; Step S206: Loop through steps S204 to S205 until When the loop ends, the process goes to step S207; Step S207: recalculate the new center point corresponding to each data set; Step S208: Loop through steps S203 to S207 until the new center point of each data set recalculated in step S207 is consistent with the new center point calculated in the previous loop, and the loop ends. A data set and the corresponding distribution points are used as cluster sets.

4. The audit information processing method for enterprise data assets according to claim 3 is characterized in that: In step S203, the expression of point distance is: Where, For allocation point To center point The point distance; In step S207, the method for calculating the new center point of each data set includes: ； Where, For the The data set corresponds to the new center point, For the In the data set distribution points, For the The number of distribution points in the data set, ; In step S108, the method for calculating the average distance corresponding to each cluster set includes: Calculate the distance coefficient corresponding to each sample point in each cluster set, add the distance coefficients corresponding to each cluster set in turn, and then divide by , get the average distance corresponding to each cluster set; the expression of the distance coefficient is: Where, For the The distance coefficient of the sample points, For the The external distance of the sample points, For the The internal distance of the sample points, is the maximum value function, ; No. The calculation method of the internal distance of the sample points is: The data set corresponding to the sample point is marked as the current set, and the data set except the All sample points other than the sample points are marked as other points; calculate the The point distance from each sample point to each other point is marked as the intra-cluster distance; each intra-cluster distance is added in turn, and then divided by the number of intra-cluster distances to obtain the The internal distance of the sample points; No. The calculation method of the external distance of the sample points is: Calculate the The point distance from each sample point to each center point is marked as the center distance; each center point is sorted from large to small according to the corresponding center distance, and the data set corresponding to the second center point is marked as the nearest set, and the sample points in the nearest set are marked as neighbor points; calculate the The point distance from each sample point to each neighbor point is marked as the out-cluster distance; each out-cluster distance is added in turn, and then divided by the number of out-cluster distances to obtain the The outer distance of the sample points.

5. The audit information processing method for enterprise data assets according to claim 4 is characterized in that: In step S109, the method of selecting the reference set from the data sets in each optimal set is as follows: presetting a quantity threshold, and comparing the reference quantity corresponding to each data set with the quantity threshold; If the number of benchmarks is greater than the threshold, the corresponding data set is marked as the benchmark set; If the benchmark quantity is less than or equal to the quantity threshold, the corresponding data set will not be marked; In step S110, the method for constructing a baseline behavior model for the user includes: The benchmark set corresponding to the object label is marked as the object set, the benchmark set corresponding to the type label is marked as the type set, and the benchmark set corresponding to the operation time is marked as the time period set; the operation object corresponding to the object label in each object set is used as the benchmark object of the corresponding time set; the operation type corresponding to the type label in each type set is used as the benchmark type of the corresponding time set; the operation time in each time period set is compared, the earliest operation time is marked as the extremely early time, and the latest operation time is marked as the extremely late time; the extremely early time and the extremely late time of each time period set are used as the benchmark time period of the corresponding time set; the benchmark quantity corresponding to each object set is used as the benchmark object frequency of the corresponding time set; the benchmark quantity corresponding to each type set is used as the benchmark type frequency of the corresponding time set; according to the benchmark time period, benchmark object frequency and benchmark type frequency corresponding to the corresponding time set of each user, a benchmark behavior model of the corresponding user is constructed.

6. The audit information processing method for enterprise data assets according to claim 5 is characterized in that: The method for identifying abnormal user behavior includes: Mark the user account in the real-time behavior data as the identification account, and obtain the behavior data of the day corresponding to the identification account, which is the user operation data collected at historical moments within the day; use the user operation data corresponding to the same identification account in the behavior data of the day and the real-time behavior data as a set of analysis sets, and the analysis sets correspond to the identification accounts one-to-one; count the number of each operation object in the analysis set and mark it as the number of objects; count the number of each operation type in the analysis set and mark it as the number of types; compare the operation times in the analysis set, mark the earliest operation time as the very early time of the day, mark the latest operation time as the very late time of the day, and use the very early time and the very late time of the day as the operation time period; The baseline behavior model of the user corresponding to the identified account is used as the analysis behavior model, and the baseline time period, baseline object frequency and baseline type frequency in the analysis behavior model are used as baseline data; the number of objects, number of types, operation period and baseline data are used as analysis data, and the analysis data is input into the trained behavior recognition model to identify the corresponding behavior label; the behavior label is a numerical label corresponding to the user's abnormal behavior, and different user abnormal behaviors have different numerical labels; based on the behavior label, the corresponding user abnormal behavior is obtained; the behavior recognition model is a deep neural network model.

7. The audit information processing method for enterprise data assets according to claim 6 is characterized in that: Methods for assessing risk levels include: The number of objects, the number of types, and the operation period are used as evaluation data; based on the user's abnormal behavior, the corresponding data in the evaluation data is obtained and marked as abnormal data; based on the abnormal data, the corresponding data in the benchmark data is obtained and marked as standard data; if the abnormal data is the number of objects, the corresponding object number is subtracted from the corresponding benchmark object frequency in the benchmark data, and the absolute value is taken to obtain the object difference; if the abnormal data is the number of types, the corresponding type number is subtracted from the corresponding benchmark type frequency in the benchmark data, and the absolute value is taken to obtain the type difference; if the abnormal data is the operation period, the extremely early time of the corresponding operation period is subtracted from the extremely early time of the corresponding benchmark period, and the absolute value is taken to obtain the extremely early difference; the extremely late time of the corresponding operation period is subtracted from the extremely late time of the corresponding benchmark period, and the absolute value is taken to obtain the extremely late difference; the extremely early difference is added to the extremely late difference to obtain the period difference; A preset weight set includes a first set, a second set, and a third set; the first set includes weight coefficients corresponding to different operation objects, the second set includes weight coefficients corresponding to different operation types, and the third set includes weight coefficients corresponding to operation time; according to the operation object corresponding to the object difference, the corresponding weight coefficient is obtained from the first set and marked as the first coefficient; according to the operation type corresponding to the type difference, the corresponding weight coefficient is obtained from the second set and marked as the second coefficient; according to the time period difference, the weight coefficient in the third set is obtained and marked as the third coefficient; each object difference is multiplied by the corresponding first coefficient to obtain a first score; each type difference is multiplied by the corresponding second coefficient to obtain a second score; the time period difference is multiplied by the third coefficient to obtain a third score; all first scores, second scores, and third scores are added in sequence to obtain an abnormality score; A preset level mapping table includes abnormal score segments corresponding to different risk levels; risk levels include high risk, medium risk and low risk; the calculated abnormal score is marked as the calculated score, and the calculated score is compared with the abnormal score segments corresponding to different risk levels in the level mapping table to obtain the risk level corresponding to the abnormal score segment in which the calculated score is located.

8. The audit information processing method for enterprise data assets according to claim 7 is characterized in that: In step S302, the expression of individual position is: Where, is the position of the i-th individual, is the random coefficient of the i-th individual, , , is the number of strategy tags; Define speed range values ; For each individual, the corresponding individual speed is defined, and the expression of individual speed is: ; In step S303, the expression of the response value function is: Where, is the response value, Security is calculated by taking the behavior label, anomaly score and individual corresponding policy label as calculation data, inputting the calculation data into the trained security analysis model, and calculating the corresponding security; the security analysis model is a deep neural network model; In step S304, the method for determining the best individual in the population is: calculating the response value of each individual in the population, sorting all the response values ​​from large to small, and taking the individual corresponding to the first response value as the best individual.

9. An enterprise data asset audit information processing system, used to implement the enterprise data asset audit information processing method according to any one of claims 1 to 8, characterized in that: include: Data collection module, used to collect user behavior data; The benchmark modeling module uses an improved clustering algorithm to cluster user behavior data into multiple benchmark sets, and builds a corresponding benchmark behavior model based on the user behavior data in each benchmark set; The behavior analysis module builds a behavior recognition model based on deep learning technology, integrates the baseline behavior model and the behavior recognition model, performs anomaly analysis on user behavior data, and identifies abnormal user behavior; The risk assessment module is used to perform multi-dimensional analysis of abnormal user behavior, calculate the corresponding abnormality score, and assess the corresponding risk level based on a preset level mapping table; The alarm response module automatically triggers alarms based on risk levels and uses optimization algorithms to iteratively analyze abnormal user behaviors and abnormal scores. During each iterative analysis, the response values ​​corresponding to different response strategies are quantified, and personalized response strategies are generated and executed based on the iterative analysis results.

Images