A business data security management system and method based on big data

Abstract

The present application provides a business data security management system and method based on big data. Among them, it receives business activity data streams from the internal system of the enterprise; dynamically analyzes abnormal behavior patterns in the business activity data streams, and evaluates the risk level of the business activity data streams in real time according to preset security policies; automatically adjusts the data encryption strength according to the risk level, and implements fine-grained access control for high-risk data; encrypts the business activity data stream based on the data encryption strength; and automatically triggers an early warning mechanism and generates a report when a predefined threat scenario is detected, while executing corresponding protective measures according to the security policy. The technical solution provided by the present application not only enhances the security of business data, but also improves the efficiency and intelligence level of data management, providing enterprises with all-round data security protection.

Description

Technical Field

[0001] The embodiments of the present application relate to the technical field of business data security management based on big data, and in particular to a business data security management system and method based on big data. Background Art

[0002] As digital transformation deepens, the volume of business activity data generated by internal enterprise systems is growing exponentially. This data not only contains extensive business operation records but also sensitive information related to finance, customers, suppliers, and more. To ensure the security of this data, a system is required that can receive and analyze business activity data streams in real time and dynamically adjust data protection policies based on risk assessment results.

[0003] Currently, most companies' data protection measures mainly include static data encryption, fixed access control lists (ACLs), and rule-based intrusion detection systems (IDS). Although these systems can provide data protection to a certain extent, they are unable to cope with the dynamic data environment and complex security threats.

[0004] Existing data protection solutions have the following flaws: static data encryption cannot dynamically adjust the encryption strength according to the actual risk level of the data, resulting in consistent protection strength for data at different risk levels, causing waste of resources or insufficient protection; fixed access control lists are difficult to adapt to the ever-changing internal needs of the enterprise, especially when facing new threats, and cannot flexibly adjust access rights; rule-based intrusion detection systems rely on predefined rule libraries, have limited ability to detect unknown threats, and cannot be updated in real time to respond to emerging attack patterns. Summary of the Invention

[0005] The embodiments of the present application provide a business data security management system and method based on big data to solve the problem of limited unknown threat detection capabilities in the prior art.

[0006] In a first aspect, embodiments of the present application provide a business data security management system and method based on big data, including:

[0007] Receive business activity data streams from internal enterprise systems;

[0008] Dynamically analyze abnormal behavior patterns in the business activity data flow and evaluate the risk level of the business activity data flow in real time based on preset security policies;

[0009] Automatically adjust data encryption strength based on the risk level and implement fine-grained access control for high-risk data;

[0010] Encrypting the business activity data stream based on the data encryption strength, and distributing and storing the encrypted business activity data stream in multiple data centers at different physical locations through distributed storage technology;

[0011] When a predefined threat scenario is detected, the early warning mechanism is automatically triggered and a report is generated, and corresponding protective measures are executed according to the security policy.

[0012] Optionally, the dynamically analyzing abnormal behavior patterns in the business activity data stream and evaluating the risk level of the business activity data stream in real time according to a preset security policy includes:

[0013] Dynamically monitoring various activity indicators in the business activity data stream using a machine learning model to identify potential abnormal behavior patterns, wherein the machine learning model is capable of adjusting detection thresholds based on historical data and current environmental changes;

[0014] Based on the abnormal behavior pattern, applying a behavior analysis algorithm and combining it with a preset behavior feature library to generate a behavior score for the abnormal behavior pattern;

[0015] Processing the behavior score using a preset risk assessment framework to obtain a risk assessment result, wherein the risk assessment framework ensures the comprehensiveness and accuracy of the risk assessment of the business activity data flow;

[0016] The risk level of the business activity data flow is evaluated according to the behavior score and the risk assessment result.

[0017] Optionally, automatically adjusting data encryption strength according to the risk level and implementing fine-grained access control on high-risk data includes:

[0018] Distinguishing different types of business activity data flows through data classification technology;

[0019] Dynamically adjusting the encryption strength of different types of business activity data streams based on the risk level using an adaptive encryption algorithm, wherein the encryption strength includes the length of the encryption key, and the adaptive encryption algorithm is configured to automatically select an appropriate encryption key length based on changes in the risk level;

[0020] Business activity data flows with risk levels greater than a preset level are determined as high-risk data, and fine-grained access control is implemented on the high-risk data, where the fine-grained access control at least includes setting access authority rules.

[0021] Optionally, encrypting the business activity data stream based on the data encryption strength and distributing and storing the encrypted business activity data stream in multiple data centers at different physical locations through distributed storage technology includes:

[0022] Encrypting the business activity data stream based on the data encryption strength to generate an encrypted business activity data stream;

[0023] Using a data segmentation algorithm to split the encrypted business activity data stream into multiple data segments;

[0024] Determining the storage locations of the multiple data segments in the data center through a hash distribution strategy, and storing the multiple data segments in corresponding storage locations through distributed storage technology. 5. The method according to claim 1 is characterized in that when a predefined threat scenario is detected, an early warning mechanism is automatically triggered and a report is generated, and corresponding protective measures are executed according to the security policy, including:

[0025] Monitor various activity indicators in the business activity data stream in real time, and identify potential threatening behaviors in the business activity data stream through anomaly detection algorithms;

[0026] Setting a predefined threat scenario rule set, and when the potential threat behavior meets any condition in the threat scenario rule set, determining that the predefined threat scenario is detected;

[0027] When the predefined threat scenario is detected, the early warning mechanism is triggered, an immediate alarm notification is sent to the preset contact person or management system, and the occurrence time and specific circumstances of the threat scenario are recorded;

[0028] Generate a detailed threat report document, which includes the specific manifestation of the threat scenario, occurrence time, impact scope, and possible cause analysis;

[0029] Automatically select and execute corresponding protective measures based on the preset security policy, which at least include isolating affected data resources, suspending relevant account permissions, and initiating a data recovery process;

[0030] The protective measures are implemented through automated scripts or pre-configured workflow engines, and their execution status is monitored to ensure that the protective measures are effectively implemented.

[0031] Optionally, adjusting the encryption strength of different types of business activity data streams according to the risk level further includes:

[0032] defining an encryption strength factor, and adjusting the encryption strength of different types of business activity data flows based on the encryption strength factor and in combination with the risk level;

[0033] The encryption strength factor E(t) is determined based on the risk level R(t) of the business activity data flow, the importance factor I(t) of the business activity data flow, the sensitivity factor S(t) of the business activity data flow, the historical access frequency F(t) of the business activity data flow, the data volume V(t) of the business activity data flow, and the time t:

[0034] E(t)=f(R(t), I(t), S(t), F(t), V(t), t)

[0035] The encryption strength factor E(t) can be calculated as follows:

[0036]

[0037] Among them, x i (t) represents R(t), I(t), S(t), log(F(t)+1), w i (t) is the weight coefficient that changes with time and satisfies

[0038] Weight coefficient w i (t) Prediction obtained through machine learning model:

[0039] w i (t) = LSTM(historicaldataofw i )

[0040] Also includes:

[0041] Based on the preset time attenuation factor A(t), dynamic adjustment factor DAF(t), fluctuation factor V f (t) and the historical trend factor H f (t) modifying the encryption strength factor E(t);

[0042] The modified encryption strength factor E(t) is calculated using the following formula:

[0043]

[0044] in, It is the basic calculation part of the original encryption strength factor, which calculates the basic encryption strength factor by weighted summation; where w i (t) is the weight corresponding to factor i at time t, and x i (t) is the actual value of factor i at time t; x i (t) represents R(t), I(t), S(t), log(F(t)+1), That is, the risk level, importance factor, sensitivity factor, logarithmic transformation of historical access frequency, and square root transformation of data volume; A(t) represents the time decay factor, which decreases exponentially as the gap between time and the initial time point t0 increases, and the expression is Where α is a constant representing the time decay rate; DAF(t) stands for dynamic adjustment factor, which reflects the changing trend of encryption strength by calculating the average encryption strength at the last w time points. The expression is: V f (t) represents the volatility factor, which reflects the degree of fluctuation of encryption strength over time, and its expression is: in is the average value of encryption strength within w time points; H f (t) represents the historical trend factor, which measures the trend of encryption strength over time and is expressed as E is a constant; γ and θ represent adjustment coefficients, which are used to adjust the dynamic adjustment factor DAF(t) and the historical trend factor H f (t) The degree of impact on encryption strength.

[0045] Optionally, the method of using a data segmentation algorithm to segment the encrypted business activity data stream into multiple data segments includes:

[0046] defining a data segmentation factor, and dividing the encrypted business activity data stream into a plurality of data segments using a data segmentation algorithm based on the data segmentation factor;

[0047] The data segmentation factor D(t) is determined based on the total size T(t) of the business activity data stream, the importance factor I(t) of the business activity data stream, the sensitivity factor S(t) of the business activity data stream, the historical access frequency F(t) of the business activity data stream, the data volume V(t) of the business activity data stream, and time t:

[0048] D(t)=g(T(t), I(t), S(t), F(t), V(t), t)

[0049] The data segmentation factor D(t) is calculated as follows:

[0050]

[0051] Where n(t) represents the number of data segments into which the business activity data stream is divided at time t, x i (t) represents I(t), S(t), log(F(t)+1), w i (t) is the weight coefficient that changes with time and satisfies

[0052] Also includes:

[0053] Based on the preset redundancy factor R f (t), data distribution balance factor DBF(t), load fluctuation factor L f (t) and load trend factor LH f (t) modifying the data segmentation factor D(t);

[0054] The corrected data segmentation factor D(t) is calculated by the following formula:

[0055]

[0056] Wherein, T(t) represents the total size of the business activity data stream at time t; n(t) represents the number of data segments into which the business activity data stream is divided at time t; represents the result of weighted summation of different attributes (such as importance, sensitivity, logarithmic transformation of historical access frequency, square root transformation of data volume), where w i (t) is the weight coefficient that changes with time, x i (t) is the corresponding attribute at time t; R f (t) is the redundancy factor, which represents the number of additional data segments added at time t to improve data reliability. It is calculated as Where Lu(t) is a time-varying constant used to adjust the redundancy ratio; DBF(t) is the data distribution balance factor, which measures whether the data distribution between data centers is balanced. The calculation method is: Where K is the number of data centers, C k (t) is the load of the kth data center at time t, is the average load of all data centers at time t; L f (t) represents the load fluctuation factor, which indicates the degree of load fluctuation between data centers and is calculated as Among them LH f (t) is the load trend factor, which is used to measure the trend of data center load changes over time and is calculated as C(t) represents a reference load value at time t, which is usually taken as a small positive value to avoid the denominator being zero; δ and η are used to adjust DBF(t) and LH respectively. f (t) Adjustment coefficient of influence.

[0057] In a second aspect, an embodiment of the present application provides a business data security management system based on big data, including:

[0058] A receiving module is used to receive business activity data streams from the enterprise's internal system;

[0059] An analysis module, configured to dynamically analyze abnormal behavior patterns in the business activity data stream and assess the risk level of the business activity data stream in real time according to a preset security policy;

[0060] A control module, configured to automatically adjust data encryption strength according to the risk level and implement fine-grained access control for high-risk data;

[0061] The storage module uses distributed storage technology to store encrypted business activity data streams in multiple data centers with different physical locations;

[0062] The early warning module automatically triggers the early warning mechanism and generates a report when a predefined threat scenario is detected, and executes corresponding protective measures according to the security policy.

[0063] In a third aspect, an embodiment of the present application provides a computing device comprising a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement a business data security management method based on big data as described in the first aspect.

[0064] In a fourth aspect, an embodiment of the present application provides a computer storage medium storing a computer program. When the computer program is executed by a computer, it implements a business data security management method based on big data as described in the first aspect.

[0065] In an embodiment of the present application, a business activity data stream is received from an enterprise's internal system; abnormal behavior patterns in the business activity data stream are dynamically analyzed, and the risk level of the business activity data stream is assessed in real time based on a preset security policy; data encryption strength is automatically adjusted based on the risk level, and fine-grained access control is implemented for high-risk data; the business activity data stream is encrypted based on the data encryption strength; and when a predefined threat scenario is detected, an early warning mechanism is automatically triggered and a report is generated, while corresponding protective measures are implemented based on the security policy. The technical solution and system provided by the present application not only enhance the security of business data, but also improve the efficiency and intelligence level of data management, providing enterprises with comprehensive data security protection.

[0066] These and other aspects of the present application will become more readily apparent from the description of the following embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0068] Figure 1 A flowchart of a business data security management method based on big data provided in an embodiment of the present application;

[0069] Figure 2 A schematic diagram of the structure of a business data security management system based on big data provided in an embodiment of the present application;

[0070] Figure 3 A schematic diagram of the structure of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0071] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0072] In some of the processes described in the specification and claims of this application and the above-mentioned figures, multiple operations that appear in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this document or may be executed in parallel. The serial numbers of the operations, such as 101, 102, etc., are only used to distinguish between different operations, and the serial numbers themselves do not represent any order of execution. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this document are used to distinguish different messages, devices, modules, etc., and do not represent a sequential order, nor do they limit "first" and "second" to being different types.

[0073] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without making creative efforts are within the scope of protection of this application.

[0074] Figure 1 A flowchart of a business data security management method based on big data is provided for the embodiment of the present application. Figure 1 As shown, the method includes:

[0075] As digital transformation deepens, the volume of business activity data generated by internal enterprise systems is growing exponentially. This data not only contains extensive business operation records but also sensitive information related to finance, customers, suppliers, and more. To ensure the security of this data, a system is required that can receive and analyze business activity data streams in real time and dynamically adjust data protection policies based on risk assessment results.

[0076] Currently, most companies' data protection measures mainly include static data encryption, fixed access control lists (ACLs), and rule-based intrusion detection systems (IDS). Although these systems can provide data protection to a certain extent, they are unable to cope with the dynamic data environment and complex security threats.

[0077] Existing data protection solutions have the following flaws: static data encryption cannot dynamically adjust the encryption strength according to the actual risk level of the data, resulting in consistent protection strength for data at different risk levels, causing waste of resources or insufficient protection; fixed access control lists are difficult to adapt to the ever-changing internal needs of the enterprise, especially when facing new threats, and cannot flexibly adjust access rights; rule-based intrusion detection systems rely on predefined rule libraries, have limited ability to detect unknown threats, and cannot be updated in real time to respond to emerging attack patterns.

[0078] The embodiments of the present application provide a business data security management system and method based on big data to solve the problem of limited unknown threat detection capabilities in the prior art.

[0079] In a first aspect, embodiments of the present application provide a business data security management system and method based on big data, including:

[0080] 101. Receive business activity data streams from the enterprise's internal system;

[0081] This step involves collecting and receiving data related to business activities from various internal information systems of the enterprise (such as ERP system, CRM system, financial system, etc.). This data may include transaction records, order information, customer information, financial statements, and other data closely related to business operations.

[0082] The purpose of receiving these data streams is to conduct subsequent analysis, processing and protection to ensure the security and integrity of the data, while also providing valuable business insights for enterprises.

[0083] Imagine a company running an ERP system that records all business activities, including but not limited to purchase orders, sales orders, inventory changes, and financial transactions. To ensure the security and compliance of this data, the company decides to deploy a big data-based business data security management system. The ERP system transmits business activity data streams to the data security management system via an API or other data transmission protocol (such as FTP or SFTP). The data formats involved may include but are not limited to CSV files, XML files, JSON objects, or other structured data formats. The data security management system includes a dedicated data acquisition module that listens for data transfer requests from the ERP system or other internal systems. Upon receiving a data transfer request, the data acquisition module immediately begins receiving and buffering the incoming data stream. The received data stream may undergo preliminary cleansing and format conversion to ensure that the data meets the requirements of subsequent processing modules. Data preprocessing may include removing duplicate records, supplementing missing fields, and formatting uniformity. The preprocessed data is temporarily stored in a cache or temporary database pending further analysis and processing. The data security management system can schedule scheduled tasks to periodically import the cached data into a long-term storage solution.

[0084] 102. Dynamically analyze abnormal behavior patterns in the business activity data stream and evaluate the risk level of the business activity data stream in real time according to a preset security policy;

[0085] This step aims to monitor business activity data flows in real time, identify potential abnormal behavior patterns, and assess the risk level of these flows based on pre-set security policies. Through dynamic analysis, the system can promptly identify potential security threats and implement appropriate protective measures based on the risk level.

[0086] Imagine a retail company that records all customer purchases in its ERP system. To ensure data security, the company deploys a big data-based business data security management system to monitor these business activity data streams. The system receives real-time business activity data streams from the ERP system, including customer purchase records, login behaviors, refund requests, and more. The monitoring module analyzes this data in real time to identify any behavior that deviates from normal patterns. The system uses pre-trained machine learning models (such as anomaly detection algorithms and deep learning models) to dynamically monitor various activity indicators in the data stream. For example, if a customer's purchase amount suddenly surges within a certain period of time, or if a certain IP address frequently experiences failed login attempts, the system will flag these behaviors as potential anomalies. Based on the identified abnormal behavior patterns, the system combines a pre-defined behavioral feature library with historical data to generate a behavior score. The behavior score is then input into a pre-defined risk assessment framework, which considers multiple factors (such as the behavior score, historical behavior patterns, and current environmental changes) to assess the overall risk level of the data stream. The system adjusts the risk level in real time based on the risk assessment results and feeds this information back to subsequent data encryption and access control modules. If high-risk behavior is detected, the system will take immediate action, such as strengthening encryption or restricting access to sensitive data.

[0087] This application takes into account that in the existing business data security management system, although basic data flow monitoring and abnormal behavior identification can be achieved, there are certain limitations in dynamic adaptability and accuracy. Specifically, traditional monitoring systems often rely on fixed thresholds to judge abnormal behavior. This static threshold is prone to false positives or omissions when facing a dynamically changing business environment; it only relies on a single dimension (such as purchase amount) to assess risk, ignoring the combined impact of multiple factors (such as purchase frequency, login behavior, etc.), resulting in an incomplete risk assessment; the system cannot adjust its own detection strategy according to historical data and changes in the current environment, resulting in poor adaptability under long-term operation. In order to solve the above technical problems, the embodiment of the present invention proposes an optional solution, which achieves a more intelligent and comprehensive risk assessment by introducing a machine learning model and a multi-level behavior analysis algorithm.

[0088] The options are as follows:

[0089] Optionally, the “dynamically analyzing abnormal behavior patterns in the business activity data stream and evaluating the risk level of the business activity data stream in real time according to a preset security policy” in step 102 includes:

[0090] A machine learning model is used to dynamically monitor various activity indicators in the business activity data stream to identify potential abnormal behavior patterns. The machine learning model can adjust the detection threshold according to historical data and current environmental changes. Based on the abnormal behavior pattern, a behavior analysis algorithm is applied, combined with a preset behavior feature library, to generate a behavior score for the abnormal behavior pattern. The behavior score is processed using a preset risk assessment framework to obtain a risk assessment result. The risk assessment framework ensures the comprehensiveness and accuracy of the risk assessment of the business activity data stream. Based on the behavior score and the risk assessment result, the risk level of the business activity data stream is assessed.

[0091] Suppose a retail company deploys the improved business data security management system described above. Within a day, the system detects an abnormality in a customer's purchasing behavior: the system detects that the customer has made multiple large purchases within an hour, and these purchases triple the customer's average purchase amount over the past month. The machine learning model adjusts the detection threshold based on historical data and the current environment, marking this behavior as a potential abnormal pattern. The system applies a behavioral analysis algorithm, combined with a pre-set behavioral feature library, to generate a behavioral score of 85 / 100 (out of 100) for this abnormal behavior. The risk assessment framework comprehensively considers factors such as the behavioral score (85), historical behavioral patterns (the customer's purchase behavior over the past month), and current environmental changes (a sharp increase in purchase behavior over a short period of time), ultimately resulting in a risk assessment result of "high risk." Based on the risk assessment results, the system assesses the customer's purchase behavior as high risk, immediately strengthens the encryption strength of the relevant data, and implements fine-grained access control for sensitive data involving the customer.

[0092] Through these options, the system not only more accurately identifies potential security threats but also allows for timely adjustments to detection strategies based on the dynamic business environment, effectively improving the accuracy and comprehensiveness of risk assessments. Furthermore, the system automatically implements encryption and access control measures based on risk levels, further ensuring the security of business data.

[0093] 103. Automatically adjust data encryption strength according to the risk level and implement fine-grained access control for high-risk data;

[0094] The core of this step is to dynamically adjust the strength of data encryption based on the previously assessed risk level and implement stricter access control measures for high-risk data. In this way, the system can assign different protection levels based on the importance and sensitivity of the data, ensuring that high-risk data is better protected.

[0095] Consider a financial institution that needs to protect its customers' transaction records and other sensitive information. The institution deploys a big data-based business data security management system that dynamically adjusts data encryption strength based on risk levels and implements fine-grained access control for high-risk data. The system first classifies incoming business activity data streams, distinguishing between different types of data (such as transaction records, personal identity information, and financial statements). It then determines which data is high-risk based on the risk level assessed in the previous step. For data marked as high-risk, the system encrypts it using a higher-level encryption algorithm (such as AES-256 instead of AES-128) and a longer key length. The adaptive encryption algorithm automatically selects the appropriate encryption key length based on the risk level, ensuring a balance between data security and performance. For high-risk data, the system implements fine-grained access control, meaning that even authenticated users require further permission verification before accessing the data. For example, certain sensitive data may be accessible only to senior management in a specific department or require multi-factor authentication (such as two-factor authentication).

[0096] Although existing business data security management systems can provide basic encryption and access control based on different data types, some problems still exist in practical applications:

[0097] This application takes into account that traditional systems usually use a fixed encryption strength, and use the same encryption algorithm and key length regardless of the risk level of the data, resulting in either insufficient encryption strength or excessive performance overhead; existing systems can often only perform access control on entire categories of data, but cannot implement more refined access rights management for specific data items, which may result in sensitive data being accessed by unauthorized users; when the risk level of the data changes, manually adjusting the encryption strength and access control rules is time-consuming and error-prone. In order to solve the above technical problems, the embodiment of the present invention proposes an optional solution, which achieves more flexible and accurate data protection by introducing data classification technology, adaptive encryption algorithms and fine-grained access control.

[0098] The options are as follows:

[0099] Optionally, the “automatically adjusting the data encryption strength according to the risk level and implementing fine-grained access control on high-risk data” in step 103 includes:

[0100] Different types of business activity data streams are distinguished through data classification technology; the encryption strength of different types of business activity data streams is dynamically adjusted according to the risk level using an adaptive encryption algorithm, wherein the encryption strength includes the length of the encryption key, and the adaptive encryption algorithm is used to automatically select an appropriate encryption key length according to changes in the risk level; business activity data streams with a risk level greater than a preset level are determined as high-risk data, and fine-grained access control is implemented on the high-risk data, wherein the fine-grained access control at least includes setting access permission rules.

[0101] Imagine a financial institution needs to protect its customers' transaction records and other sensitive information. The institution deploys a business data security management system based on big data. The specific implementation steps are as follows:

[0102] The system first classifies the received business activity data stream and distinguishes different types of data such as transaction records, personal identity information, and financial statements. For example, transaction records may include a customer's purchase history, personal identity information may include name, ID number, etc., and financial statements may contain information such as financial status. The system determines the encryption strength of different data types based on the risk level previously assessed. For high-risk data (such as transaction records and personal identity information), the system uses the AES-256 encryption algorithm and automatically selects a longer key length (such as 256 bits) based on the risk level. For low-risk data (such as financial statements), the system uses the AES-128 encryption algorithm and selects a shorter key length (such as 128 bits). The system implements fine-grained access control for high-risk data. For transaction records, the system also sets access permission rules, which can only be viewed by strictly certified financial department personnel, and each access needs to be recorded and reviewed.

[0103] Through this optional solution, the system can not only dynamically adjust encryption strength based on the data's risk level, but also implement stricter, fine-grained access control for high-risk data. This not only improves data security but also ensures system performance and efficiency, effectively resolving the issues of static encryption strength and coarse-grained access control that exist in existing technologies.

[0104] Although existing business data security management systems can adjust encryption strength based on the risk level of different data, some problems still exist in practical applications:

[0105] Traditional encryption strength adjustment methods are typically static and cannot adjust encryption strength in real time based on dynamic changes in data streams. Existing methods may adjust encryption strength based on a single factor (such as risk level), ignoring other important factors (such as data importance, sensitivity, and historical access frequency). Existing systems lack a mechanism that can adaptively adjust encryption strength based on historical data and current environmental changes. To address these technical issues, the present invention proposes an alternative solution that introduces an encryption strength factor and its correction mechanism to achieve more intelligent and comprehensive data encryption strength adjustment.

[0106] The options are as follows:

[0107] Optionally, adjusting the encryption strength of different types of business activity data streams according to the risk level further includes:

[0108] An encryption strength factor is defined, and based on the encryption strength factor and in combination with the risk level, the encryption strength of different types of business activity data streams is adjusted; wherein the encryption strength factor E(t) is determined according to the risk level R(t) of the business activity data stream, the importance factor I(t) of the business activity data stream, the sensitivity factor S(t) of the business activity data stream, the historical access frequency F(t) of the business activity data stream, the data volume V(t) of the business activity data stream, and the time t:

[0109] E(t)=f(R(t), I(t), S(t), F(t), V(t), t)

[0110] The encryption strength factor E(t) can be calculated as follows:

[0111]

[0112] Among them, x i (t) represents R(t), I(t), S(t), log(F(t)+1), w i (t) is the weight coefficient that changes with time and satisfies

[0113] Weight coefficient w i (t) Prediction obtained through machine learning model:

[0114] w i (t) = LSTM(historicaldataofw i )

[0115] Also includes:

[0116] Based on the preset time attenuation factor A(t), dynamic adjustment factor DAF(t), fluctuation factor V f (t) and the historical trend factor H f (t) modifying the encryption strength factor E(t);

[0117] The modified encryption strength factor E(t) is calculated using the following formula:

[0118]

[0119] in, It is the basic calculation part of the original encryption strength factor, which calculates the basic encryption strength factor by weighted summation; where w i (t) is the weight corresponding to factor i at time t, and x i (t) is the actual value of factor i at time t; x i (t) represents R(t), I(t), S(t), log(F(t)+1), That is, the risk level, importance factor, sensitivity factor, logarithmic transformation of historical access frequency, and square root transformation of data volume; A(t) represents the time decay factor, which decreases exponentially as the gap between time and the initial time point t0 increases, and the expression is Where α is a constant representing the time decay rate; DAF(t) stands for dynamic adjustment factor, which reflects the changing trend of encryption strength by calculating the average encryption strength at the last w time points. The expression is: V f (t) represents the volatility factor, which reflects the degree of fluctuation of encryption strength over time, and its expression is: in is the average value of encryption strength within w time points; H f (t) represents the historical trend factor, which measures the trend of encryption strength over time and is expressed as E is a constant; γ and θ represent adjustment coefficients, which are used to adjust the dynamic adjustment factor DAF(t) and the historical trend factor H f (t) The degree of impact on encryption strength.

[0120] Imagine a financial institution needs to protect its customers' transaction records and other sensitive information. The institution deploys a business data security management system based on big data. The specific implementation steps are as follows:

[0121] Assume that the risk level of a business activity data flow at time t is R(t) = 0.8, the importance factor is I(t) = 0.7, the sensitivity factor is S(t) = 0.9, the historical access frequency is F(t) = 5, and the data volume is V(t) = 1000; calculate xi (t) obtains:

[0122]

[0123] Assume that the weight coefficient w i (t) is [0.2, 0.1, 0.3, 0.15, 0.25], then we get:

[0124]

[0125] Assume that the time decay factor A(t) = e -0.1(10-0) =e -1 ≈0.37; Assuming DAF(t)=10, V f (t) = 5, H f (t) = 15, γ = 0.5, θ = 0.5, then the modified encryption strength factor E(t) is:

[0126]

[0127] Based on the modified encryption strength factor E(t)≈5.72, the system can select the corresponding encryption algorithm and key length. For example, if E(t)>5, the AES256 encryption algorithm is used; otherwise, the AES-128 encryption algorithm is used. If E(t)>5, the AES-256 encryption algorithm is used, and the specific key length is determined based on E(t).

[0128] Through these options, the system not only adjusts encryption strength in real time based on dynamic changes in data streams, but also comprehensively considers multiple factors (such as risk level, importance, sensitivity, and historical access frequency), resulting in more intelligent and comprehensive data security protection. Furthermore, by introducing a time decay factor, a dynamic adjustment factor, a volatility factor, and a historical trend factor, the system can better adapt to changes in data streams and ensure the appropriateness of encryption strength.

[0129] 104. Encrypting the business activity data stream based on the data encryption strength, and distributing and storing the encrypted business activity data stream in multiple data centers at different physical locations using distributed storage technology;

[0130] This step mainly involves two parts: 1. Encrypting the business activity data stream according to the data encryption strength determined in the previous step to ensure that the data is not illegally accessed or tampered with during transmission and storage; and using distributed storage technology to disperse the encrypted data across multiple different data centers to improve data availability and security and reduce the risk of single point failures.

[0131] Imagine a multinational company needs to ensure the security and high availability of its business data. The company deploys a big data-based business data security management system and employs distributed storage technology to protect data. The implementation steps are as follows: The system determines the encryption strength required for different data streams based on previously assessed risk levels; encrypts the business data stream using an appropriate encryption algorithm (such as AES) and key length; the encrypted business data stream is further segmented into multiple data segments, each of which is stored in a distributed manner across different data centers using a hash allocation strategy. This not only improves data storage efficiency but also ensures that even if a data center fails, data can still be recovered from other data centers. Distributed storage technology is used to manage and store the encrypted data segments; and by distributing data across multiple data centers, physical redundancy and high availability are ensured.

[0132] This application takes into account that although the existing business data security management system can realize the basic functions of data encryption and distributed storage, there are still some problems in actual application; the existing system usually uses a fixed encryption algorithm and key length, and cannot dynamically adjust the encryption strength according to the risk level of the data, resulting in insufficient flexibility in data protection; data is usually stored in one or a few data centers. Once these centers fail, data may be lost or unavailable; the existing threat detection and response mechanism is often passive, and does not implement real-time monitoring and automated protection measures, resulting in slow threat response and poor results; in order to solve the above technical problems, the embodiment of the present invention proposes an optional solution, which achieves more intelligent and comprehensive data protection by introducing a data segmentation algorithm, a hash distribution strategy, and real-time monitoring and automated protection measures.

[0133] The options are as follows:

[0134] Optionally, the step 104 of “encrypting the business activity data stream based on the data encryption strength, and distributing and storing the encrypted business activity data stream in multiple data centers at different physical locations using distributed storage technology” includes:

[0135] The method according to claim 1 is characterized in that, when a predefined threat scenario is detected, an early warning mechanism is automatically triggered and a report is generated, and corresponding protective measures are executed according to the security policy, including:

[0136] Monitor various activity indicators in the business activity data stream in real time, and identify potential threat behaviors in the business activity data stream through anomaly detection algorithms; set a predefined threat scenario rule set, and when the potential threat behavior meets any condition in the threat scenario rule set, it is determined that a predefined threat scenario is detected; when the predefined threat scenario is detected, trigger the early warning mechanism, send an immediate alarm notification to the preset contact or management system, and record the occurrence time and specific circumstances of the threat scenario; generate a detailed threat report document, which includes the specific manifestation form, occurrence time, impact scope and possible cause analysis of the threat scenario; according to the preset security policy, automatically select and execute corresponding protection measures, which at least include isolating the affected data resources, suspending relevant account permissions and initiating data recovery processes; implement the protection measures through automated scripts or preconfigured workflow engines, and monitor their execution status to ensure that the protection measures are effectively implemented.

[0137] Consider a multinational company that needs to ensure the security and high availability of its business data. The company deploys a business data security management system based on big data. The specific implementation steps are as follows:

[0138] The system determines the data encryption strength based on the risk level. Assuming that the risk level of a business activity data stream is high, the system selects the AES-256 encryption algorithm and uses a 256-bit key length for encryption. The encrypted business activity data stream is divided into multiple data segments, each of which is approximately 1MB in size. The data segments are stored in a hash distribution strategy. Assuming there are three data centers (A, B, and C), data segment 1 is allocated to data center A, data segment 2 is allocated to data center B, and data segment 3 is allocated to data center C through hash function calculation. Using Hadoop HDFS distributed storage technology manages and stores these data segments, ensuring high data availability and redundancy. The system monitors various activity indicators in the business activity data stream in real time and identifies potential threat behaviors through anomaly detection algorithms. For example, if the system detects that an account has failed to log in more than five times within an hour, it will be marked as a potential threat. The system has predefined threat scenario rules. When a potential threat behavior meets any of the criteria, it will be considered a predefined threat scenario. In the above case, the system identified it as a threat scenario. When the system detects a predefined threat scenario, it triggers an alert mechanism, sending an immediate alert notification to a predefined contact or management system, and recording the time and specific circumstances of the threat scenario. The system automatically generates a detailed threat report document, including the specific manifestations of the threat scenario, the time of occurrence, the scope of impact, and possible causes. Based on pre-set security policies, the system automatically selects and executes appropriate protective measures, such as isolating affected data resources, suspending relevant account permissions, and initiating data recovery. In the above case, the system suspended the account's login permissions and initiated the data recovery process. Through automated scripts or pre-configured workflow engines, the system implements protective measures and monitors their execution status to ensure their effectiveness.

[0139] Through these options, the system not only dynamically adjusts encryption strength based on the data's risk level, improving data protection flexibility, but also achieves high data availability and redundancy through data segmentation and hash distribution strategies, ensuring that even if a data center fails, data can still be recovered from other data centers. Furthermore, the system monitors various activity indicators in business activity data streams in real time and, through anomaly detection algorithms, identifies potential threats, automatically triggers early warning mechanisms, and implements appropriate protective measures, ensuring data security while improving the speed and effectiveness of threat response.

[0140] This application takes into account that although the existing business data security management system can realize the basic functions of data encryption and distributed storage, there are still some problems in actual application: the existing system usually uses a fixed segmentation strategy to divide data segments and cannot flexibly segment according to the dynamic characteristics of the data flow (such as total size, importance, sensitivity, etc.); the distribution of data segments among different data centers is often not balanced enough, resulting in some data centers being overloaded and other data centers being underloaded; the existing system lacks consideration for data redundancy and cannot quickly recover data when a single data center fails.

[0141] In order to solve the above technical problems, an embodiment of the present invention proposes an optional solution, which implements a more intelligent and dynamic data segmentation and storage strategy by introducing a data segmentation factor and its correction mechanism.

[0142] The options are as follows:

[0143] Optionally, the method of using a data segmentation algorithm to segment the encrypted business activity data stream into multiple data segments includes:

[0144] defining a data segmentation factor, and dividing the encrypted business activity data stream into a plurality of data segments using a data segmentation algorithm based on the data segmentation factor;

[0145] The data segmentation factor D(t) is determined based on the total size T(t) of the business activity data stream, the importance factor I(t) of the business activity data stream, the sensitivity factor S(t) of the business activity data stream, the historical access frequency F(t) of the business activity data stream, the data volume V(t) of the business activity data stream, and time t:

[0146] D(t)=g(T(t), I(t), S(t), F(t), V(t), t)

[0147] The data segmentation factor D(t) is calculated as follows:

[0148]

[0149] Where n(t) represents the number of data segments into which the business activity data stream is divided at time t, x i (t) represents I(t), S(t), log(F(t)+1), w i (t) is the weight coefficient that changes with time and satisfies

[0150] Also includes:

[0151] Based on the preset redundancy factor R f(t), data distribution balance factor DBF(t), load fluctuation factor L f (t) and load trend factor LH f (t) modifying the data segmentation factor D(t);

[0152] The corrected data segmentation factor D(t) is calculated by the following formula:

[0153]

[0154] Wherein, T(t) represents the total size of the business activity data stream at time t; n(t) represents the number of data segments into which the business activity data stream is divided at time t; represents the result of weighted summation of different attributes (such as importance, sensitivity, logarithmic transformation of historical access frequency, square root transformation of data volume), where w i (t) is the weight coefficient that changes with time, x i (t) is the corresponding attribute at time t; R f (t) is the redundancy factor, which represents the number of additional data segments added at time t to improve data reliability. It is calculated as Where Lu(t) is a time-varying constant used to adjust the redundancy ratio; DBF(t) is the data distribution balance factor, which measures whether the data distribution between data centers is balanced. The calculation method is: Where K is the number of data centers, C k (t) is the load of the kth data center at time t, is the average load of all data centers at time t; L f (t) represents the load fluctuation factor, which indicates the degree of load fluctuation between data centers and is calculated as Among them LH f (t) is the load trend factor, which is used to measure the trend of data center load changes over time and is calculated as C(t) represents a reference load value at time t, which is usually taken as a small positive value to avoid the denominator being zero; δ and η are used to adjust DBF(t) and LH respectively. f (t) Adjustment coefficient of influence.

[0155] Consider a multinational company that needs to ensure the security and high availability of its business data. The company deploys a business data security management system based on big data. The specific implementation steps are as follows:

[0156] Assume that the total size of a business activity data stream at time t is T(t) = 1000MB, the importance factor I(t) = 0.8, the sensitivity factor S(t) = 0.9, the historical access frequency F(t) = 5, the data volume V(t) = 1000, and the number of data segments n(t) = 10. Assume that the weight coefficient w i (t) is [0.2, 0.1, 0.3, 0.15, 0.25], then we get:

[0157]

[0158] Then the data segmentation factor D(t) is:

[0159]

[0160] Modified data splitting factor D(t): Assuming redundancy factor R f (t) = 5, data distribution balance factor DBF(t) = 0.8, load fluctuation factor L f (t) = 0.5, load trend factor LH f (t) = 0.3, adjustment coefficient δ = 0.5, η = 0.5, then the corrected data segmentation factor D(t) is:

[0161]

[0162] Based on the corrected data segmentation factor D(t)≈165.14, the system divides the data stream into multiple data segments and determines the storage location through a hash allocation strategy; the data segments are stored in different data centers in a dispersed manner, ensuring that even if a data center fails, the data can still be recovered from other data centers.

[0163] Through these optional solutions, the system not only dynamically adjusts data segmentation strategies based on the dynamic characteristics of data streams (such as total size, importance, and sensitivity), but also ensures balanced data distribution and high availability across multiple data centers through redundancy factors, data distribution balance factors, load fluctuation factors, and load trend factors. Furthermore, by introducing these factors, the system can better adapt to changes in data streams, ensuring rational data segmentation and efficient storage, effectively resolving the problems of static segmentation and unbalanced storage that exist in existing technologies.

[0164] 105. When a predefined threat scenario is detected, the early warning mechanism is automatically triggered and a report is generated, and corresponding protective measures are executed according to the security policy.

[0165] The key to this step is that upon detecting a predefined threat scenario, the system automatically takes a series of actions, including triggering an early warning mechanism, generating a detailed threat report, and executing appropriate protective measures based on pre-set security policies. This process ensures that when a threat occurs, relevant personnel are promptly notified and effective actions are taken to mitigate or eliminate the risks posed by the threat.

[0166] Consider an online payment platform that needs to protect its users' transaction data and account information. The platform deploys a big data-based business data security management system that automatically triggers early warning mechanisms and implements protective measures when predefined threat scenarios are detected. The system monitors various activity indicators in the business activity data stream in real time and uses anomaly detection algorithms to identify potential threats. For example, if the system detects a large number of unusual login attempts within a short period of time for a particular account, or an unusually large transaction amount, these could be potential threats. The system also employs a predefined threat scenario rule set that includes various known threat patterns, such as consecutive failed login attempts, unusually large transactions, and operations performed during unusual time periods. When the detected potential threat behavior meets any of the conditions in the threat scenario rule set, the system will determine that a predefined threat scenario has been detected; when a predefined threat scenario is detected, the system will automatically trigger the early warning mechanism, send an immediate alert notification to the preset contact or management system, and record the time and specific circumstances of the threat scenario; for example, the system can send an email or SMS alert to the security team and generate a warning message in the console; the system will automatically generate a detailed threat report document, which includes the specific manifestation of the threat scenario, the time of occurrence, the scope of impact, and the possible cause analysis; the report will also include recommended handling measures and the next action plan so that the security team can respond quickly; according to the preset security policy, the system will automatically select and execute the corresponding protection measures; protection measures may include isolating the affected data resources, suspending relevant account permissions, initiating data recovery processes, etc.; through automated scripts or pre-configured workflow engines, the system ensures that protection measures are effectively implemented and continuously monitors their execution status.

[0167] Figure 2 The present invention provides a structural diagram of a business data security management system based on big data, such as Figure 2 As shown, the device includes:

[0168] Receiving module 21, for receiving business activity data stream from the enterprise internal system;

[0169] An analysis module 22 is configured to dynamically analyze abnormal behavior patterns in the business activity data stream and assess the risk level of the business activity data stream in real time according to a preset security policy;

[0170] A control module 23, configured to automatically adjust data encryption strength according to the risk level and implement fine-grained access control for high-risk data;

[0171] The storage module 24 stores the encrypted business activity data stream in multiple data centers at different physical locations through distributed storage technology;

[0172] The early warning module 25 automatically triggers the early warning mechanism and generates a report when a predefined threat scenario is detected, and executes corresponding protective measures according to the security policy.

[0173] Figure 2 The business data security management system based on big data can be executed Figure 1 The implementation principles and technical effects of the big data-based business data security management method described in the illustrated embodiment are not further elaborated. The specific manner in which each module and unit performs operations in the big data-based business data security management system described in the above embodiment has been described in detail in the relevant embodiments of the method and will not be further elaborated here.

[0174] In one possible design, Figure 2 The business data security management device based on big data of the embodiment shown can be implemented as a computing device, such as Figure 3 As shown, the computing device may include a storage component 31 and a processing component 32;

[0175] The storage component 31 stores one or more computer instructions, wherein the one or more computer instructions are called and executed by the processing component 32 .

[0176] The processing component 32 is used to: receive business activity data streams from the enterprise's internal system; dynamically analyze abnormal behavior patterns in the business activity data streams, and evaluate the risk level of the business activity data streams in real time based on preset security policies; automatically adjust data encryption strength based on the risk level, and implement fine-grained access control for high-risk data; encrypt business activity data streams based on the data encryption strength; and automatically trigger an early warning mechanism and generate a report when a predefined threat scenario is detected, and at the same time execute corresponding protective measures based on the security policy.

[0177] The processing component 32 may include one or more processors to execute computer instructions to perform all or part of the steps in the above method. Of course, the processing component may also be implemented as one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the above method.

[0178] The storage component 31 is configured to store various types of data to support operations at the terminal. The storage component can be implemented by any type of volatile or non-volatile memory device, or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk, or optical disk.

[0179] Of course, a computing device may also include other components, such as input / output interfaces, display components, communication components, etc.

[0180] The input / output interface provides an interface between the processing component and the peripheral interface module, which can be an output device, an input device, etc.

[0181] The communication component is configured to facilitate, among other things, wired or wireless communications between the computing device and other devices.

[0182] Among them, the computing device can be a physical device or an elastic computing host provided by a cloud computing platform, etc. In this case, the computing device can refer to a cloud server, and the above-mentioned processing components, storage components, etc. can be basic server resources rented or purchased from the cloud computing platform.

[0183] The present application also provides a computer storage medium storing a computer program, wherein the computer program can achieve the above-mentioned Figure 1 The illustrated embodiment provides a business data security management method based on big data.

[0184] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0185] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0186] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course, by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the existing technology can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiments.

[0187] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A business data security management method based on big data, characterized in that: include: Receive business activity data streams from internal enterprise systems; Dynamically analyze abnormal behavior patterns in the business activity data flow and evaluate the risk level of the business activity data flow in real time based on preset security policies; Automatically adjust data encryption strength based on the risk level and implement fine-grained access control for high-risk data; Encrypting the business activity data stream based on the data encryption strength, and distributing and storing the encrypted business activity data stream in multiple data centers at different physical locations through distributed storage technology; When a predefined threat scenario is detected, the early warning mechanism is automatically triggered and a report is generated, and corresponding protective measures are implemented according to the security policy; Automatically adjusting data encryption strength according to the risk level and implementing fine-grained access control for high-risk data include: Distinguishing different types of business activity data flows through data classification technology; Dynamically adjusting the encryption strength of different types of business activity data streams based on the risk level using an adaptive encryption algorithm, wherein the encryption strength includes the length of the encryption key, and the adaptive encryption algorithm is configured to automatically select an appropriate encryption key length based on changes in the risk level; Determine business activity data flows with risk levels greater than a preset level as high-risk data, and implement fine-grained access control on the high-risk data, wherein the fine-grained access control at least includes setting access permission rules; The step of adjusting the encryption strength of different types of business activity data streams according to the risk level includes: defining an encryption strength factor, and adjusting the encryption strength of different types of business activity data flows based on the encryption strength factor and in combination with the risk level; Wherein, the encryption strength factor According to the risk level of the business activity data flow , the importance factor of the business activity data flow , the sensitivity factor of the business activity data flow , the historical access frequency of the business activity data stream , the data volume of the business activity data flow and time Determined: Among them, the encryption strength factor It can be calculated by the following formula: in, represent is a weight coefficient that changes with time and satisfies , ; Weight coefficient Predictions from machine learning models: .

2. The method according to claim 1, characterized in that The dynamic analysis of abnormal behavior patterns in the business activity data stream and the real-time assessment of the risk level of the business activity data stream based on a preset security policy include: Dynamically monitoring various activity indicators in the business activity data stream using a machine learning model to identify potential abnormal behavior patterns, wherein the machine learning model is capable of adjusting detection thresholds based on historical data and current environmental changes; Based on the abnormal behavior pattern, applying a behavior analysis algorithm and combining it with a preset behavior feature library to generate a behavior score for the abnormal behavior pattern; Processing the behavior score using a preset risk assessment framework to obtain a risk assessment result, wherein the risk assessment framework ensures the comprehensiveness and accuracy of the risk assessment of the business activity data flow; The risk level of the business activity data flow is evaluated according to the behavior score and the risk assessment result.

3. The method according to claim 2, characterized in that The business activity data stream is encrypted based on the data encryption strength, and the encrypted business activity data stream is stored in multiple data centers with different physical locations through distributed storage technology, including: Encrypting the business activity data stream based on the data encryption strength to generate an encrypted business activity data stream; Using a data segmentation algorithm to split the encrypted business activity data stream into multiple data segments; The storage locations of the multiple data segments in the data center are determined by a hash distribution strategy, and the multiple data segments are respectively stored in corresponding storage locations by a distributed storage technology.

4. The method according to claim 1, wherein When a predefined threat scenario is detected, the early warning mechanism is automatically triggered and a report is generated. At the same time, corresponding protective measures are executed according to the security policy, including: Monitor various activity indicators in the business activity data stream in real time, and identify potential threatening behaviors in the business activity data stream through anomaly detection algorithms; Setting a predefined threat scenario rule set, and when the potential threat behavior meets any condition in the threat scenario rule set, determining that the predefined threat scenario is detected; When the predefined threat scenario is detected, the early warning mechanism is triggered, an immediate alarm notification is sent to the preset contact person or management system, and the occurrence time and specific circumstances of the threat scenario are recorded; Generate a detailed threat report document, which includes the specific manifestation of the threat scenario, occurrence time, impact scope, and possible cause analysis; Automatically select and execute corresponding protective measures based on the preset security policy, which at least include isolating affected data resources, suspending relevant account permissions, and initiating a data recovery process; The protective measures are implemented through automated scripts or pre-configured workflow engines, and their execution status is monitored to ensure that the protective measures are effectively implemented.

5. The method according to claim 1, wherein Also includes: Based on preset time decay factor , dynamic adjustment factor , volatility factor and historical trend factors Modify the encryption strength factor ; Modified encryption strength factor Calculated by the following formula: in, It is the basic calculation part of the original encryption strength factor, which calculates the basic encryption strength factor by weighted summation; It's in time Upper and lower factors The corresponding weights, The factor In time The actual value on ; represent , namely, risk level, importance factor, sensitivity factor, logarithmic transformation of historical access frequency, and square root transformation of data volume; Represents the time decay factor, which changes with time and the initial time point The gap increases and decreases exponentially, and the expression is ,in is a constant representing the time decay rate; Represents the dynamic adjustment factor, which is calculated by the most recent The average encryption strength at each time point reflects the changing trend of encryption strength, which is expressed as ; represents the volatility factor, which reflects the degree of fluctuation of encryption strength over time, and is expressed as ,in yes The average value of encryption strength at a time point; Represents the historical trend factor, which measures the trend of encryption strength over time and is expressed as ; is a constant; and Represents the adjustment coefficient, used to adjust the dynamic adjustment factor and historical trend factors The degree of impact on encryption strength.

6. The method according to claim 3, characterized in that The method of using a data segmentation algorithm to divide the encrypted business activity data stream into multiple data segments includes: defining a data segmentation factor, and dividing the encrypted business activity data stream into a plurality of data segments using a data segmentation algorithm based on the data segmentation factor; Among them, the data segmentation factor According to the total size of the business activity data flow , the importance factor of the business activity data flow , the sensitivity factor of the business activity data flow , the historical access frequency of the business activity data stream , the data volume of the business activity data flow and time Determined: Among them, the data split factor Calculated by the following formula: in, Represents the business activity data flow at time The number of data segments into which the above is divided, represent is a weight coefficient that changes with time and satisfies ; Also includes: Based on preset redundancy factor , data distribution balance factor , load fluctuation factor and load trend factor Modify the data split factor ; Corrected data split factor Calculated by the following formula: in, Indicates time The total size of the business activity data stream at that time; Indicates time The number of data segments into which the business activity data stream is divided; Represents the result of weighted summation of different attributes, where is the weight coefficient that changes with time, The corresponding attribute at time of; is the redundancy factor, indicating that The number of extra data segments added to improve data reliability; calculated as ⋅ ,in It is a constant that changes with time and is used to adjust the proportion of redundancy; Is the data distribution balance factor, which measures whether the data distribution between data centers is balanced; the calculation method is ,in is the number of data centers, It is Data centers at time The load, All data centers at time Average load; Represents the load fluctuation factor, which indicates the degree of load fluctuation between data centers and is calculated as ,in is the load trend factor, which is used to measure the trend of data center load changes over time and is calculated as ; Indicates time A certain reference load value; and They are used to adjust and The adjustment coefficient of influence.

7. A business data security management system based on big data, used to implement the business data security management method based on big data according to any one of claims 1 to 6, characterized in that: include: A receiving module is used to receive business activity data streams from the enterprise's internal system; An analysis module, configured to dynamically analyze abnormal behavior patterns in the business activity data stream and assess the risk level of the business activity data stream in real time according to a preset security policy; A control module, configured to automatically adjust data encryption strength according to the risk level and implement fine-grained access control for high-risk data; The storage module uses distributed storage technology to store encrypted business activity data streams in multiple data centers with different physical locations; The early warning module automatically triggers the early warning mechanism and generates a report when a predefined threat scenario is detected, and executes corresponding protective measures according to the security policy.

8. A computing device, characterized in that It includes a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement a business data security management method based on big data as described in any one of claims 1 to 6.

9. A computer storage medium, characterized in that A computer program is stored, and when the computer program is executed by a computer, a business data security management method based on big data as described in any one of claims 1 to 6 is implemented.

Images