Autonomous response trusted data hierarchical fusing control method and system

Abstract

The invention provides an autonomous response trusted data hierarchical fusing control method and system. The method comprises the following steps: constructing a dynamic risk monitoring data set; performing real-time calculation on the dynamic risk monitoring data set, and outputting a dynamic risk score; according to the dynamic risk threshold interval, dividing the dynamic risk score into a low risk, a medium risk or a high risk, and activating a corresponding fusing strategy; fusing operation is automatically executed through the intelligent contract, and a fusing event voucher is generated and written into the alliance chain for evidence storage; and when the risk score in the continuous monitoring period is continuously lower than a recovery threshold value, gradually relaxing the access restriction according to a stepped recovery strategy. The technical problem that in the prior art, access control based on a static rule is difficult to deal with complex and changeable data security threats is solved, and the technical effects that intelligent protection and autonomous response of data access security are achieved, and credible evidence storage and audit tracing of the fusing process are ensured through the block chain technology are achieved.

Description

Technical Field

[0001] The present invention relates to the field of information security, and particularly to a method and system for trusted data hierarchical fusing control with autonomous response. Background Art

[0002] Traditional data access control is mainly based on predefined static rules, such as role-based access control and attribute-based access control, etc. Although these mechanisms ensure the security of data access to a certain extent, they show obvious limitations when facing increasingly complex and changeable data security threats. Traditional access control mechanisms pre-configure permission rules at the design stage and are difficult to dynamically adjust according to the changes in real-time access behavior once deployed. This static rule design cannot effectively cope with abnormal access behaviors, such as security risks that may be indicated by off-site logins, frequent requests, unconventional operation sequences, etc. When encountering new attack methods or internal threats, it is often impossible to identify and take effective protection measures in time, resulting in security incidents such as data leakage, tampering, or abuse. Summary of the Invention

[0003] Aiming at the technical problem that the access control based on static rules in the prior art is difficult to cope with complex and changeable data security threats, the present invention provides a method and system for trusted data hierarchical fusing control with autonomous response to solve this problem.

[0004] The technical solutions of the present invention to solve the above technical problems are as follows:

[0005] In a first aspect, the present invention provides a method for trusted data hierarchical fusing control with autonomous response, including: collecting multi-dimensional features of data access behavior in real time, including access frequency, access source location, and operation sequence, and constructing a dynamic risk monitoring data set; based on a hierarchical risk assessment model, performing real-time calculation on the dynamic risk monitoring data set and outputting a dynamic risk score; according to a predefined dynamic risk threshold interval, dividing the dynamic risk score into low risk or medium risk or high risk, and activating corresponding fusing strategies: low risk triggers real-time alarm notification, medium risk triggers a sliding window current limiting mechanism, and high risk triggers session token revocation; automatically executing the fusing operation through a smart contract, generating a fusing event certificate, and writing it into a consortium blockchain for evidence storage; when the risk score continuously remains lower than the recovery threshold within a continuous monitoring period, gradually relax the access restriction according to a step-by-step recovery strategy.

[0006] In the second aspect, the present invention provides an autonomously responsive trusted data hierarchical fuse control system, including: a data acquisition module, which is used to collect multi-dimensional characteristics of data access behavior in real time, including access frequency, access source location and operation sequence, and construct a dynamic risk monitoring data set; a risk assessment module, which is used to perform real-time calculations on the dynamic risk monitoring data set based on a hierarchical risk assessment model, and output a dynamic risk score; a hierarchical response module, which is used to divide the dynamic risk score into low risk, medium risk or high risk according to a predefined dynamic risk threshold interval, and activate the corresponding fuse strategy: low risk triggers real-time alarm notification, medium risk triggers a sliding window current limiting mechanism, and high risk triggers session token revocation; a blockchain evidence storage module, which is used to automatically execute fuse operations through smart contracts, generate fuse event credentials, and write them into the alliance chain for evidence storage; a recovery management module, which is used to gradually relax access restrictions according to a step-by-step recovery strategy when the risk score continues to be lower than the recovery threshold during a continuous monitoring period.

[0007] The beneficial effects of the present invention are:

[0008] Real-time collection of multi-dimensional features of data access behavior, including access frequency, access source location, and operation sequence, builds a dynamic risk monitoring data set, provides a comprehensive data foundation for subsequent risk assessment, and ensures that various abnormal access patterns can be perceived. Based on the hierarchical risk assessment model, the dynamic risk monitoring data set is calculated in real time, and the dynamic risk score is output to achieve accurate measurement of the risk level of access behavior. According to the predefined dynamic risk threshold interval, the dynamic risk score is divided into low risk, medium risk, or high risk, and the corresponding fuse strategy is activated: low risk triggers real-time alarm notification, medium risk triggers sliding window current limiting mechanism, and high risk triggers session token revocation. By taking differentiated security controls for different levels of risk, data security is guaranteed and excessive intervention in normal business processes is avoided. The fuse operation is automatically executed through the smart contract, and the fuse event certificate is generated and written into the alliance chain for evidence storage. This step uses the tamper-proof characteristics of blockchain technology to ensure the credible record and transparent audit of the fuse event, providing a reliable basis for the traceability analysis of security events. When the risk score continues to be lower than the recovery threshold during the continuous monitoring period, access restrictions will be gradually relaxed according to the step-by-step recovery strategy to implement a self-recovery mechanism. Security restrictions will be automatically lifted after the risk is eliminated, ensuring business continuity while maintaining necessary security protections to achieve a balance between security and efficiency.

[0009] Through the above technical solutions, the transformation of data access control from static rules to dynamic perception, from passive defense to active response, and from binary judgment to hierarchical disposal is realized, which effectively solves the technical problem that static rule-based access control in the existing technology is difficult to cope with complex and changeable data security threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Figure 1 Schematic flow diagram of the autonomous response-based trusted data hierarchical fusing control method provided by the present invention;

[0011] Figure 2 Schematic structural diagram of the autonomous response-based trusted data hierarchical fusing control system provided by the present invention.

[0012] In the accompanying drawings, the components represented by the respective reference numerals are as follows:

[0013] Data acquisition module 11, risk assessment module 12, hierarchical response module 13, blockchain evidence storage module 14, recovery management module 15. Specific implementation manners

[0014] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative efforts fall within the protection scope of the present invention.

[0015] In the description of the present invention, the terms "first" and "second" are only used for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly specifying the quantity of the indicated technical features. Thus, the features defined with "first" and "second" may explicitly or implicitly include one or more of the described features. In the description of the present invention, "a plurality of" means two or more unless otherwise specifically defined.

[0016] In the description of the present invention, the term "for example" is used to mean "serving as an example, illustration, or explanation". Any embodiment described as "for example" in the present invention is not necessarily construed as being more preferred or having more advantages than other embodiments. In order to enable any person skilled in the art to implement and use the present invention, the following description is given. In the following description, details are set forth for purposes of explanation. It should be understood that those skilled in the art can recognize that the present invention can be implemented without using these specific details. In other instances, well-known structures and processes are not described in detail to avoid unnecessary details from obscuring the description of the present invention. Therefore, the present invention is not intended to be limited to the embodiments shown, but is to be accorded the widest scope consistent with the principles and features disclosed herein.

[0017] Embodiment 1, as Figure 1 shown, the embodiment of the present invention provides an autonomous response-based trusted data hierarchical fusing control method, including:

[0018] S100: Collect multi-dimensional features of real-time data access behaviors, including access frequency, access source location, and operation sequence, and construct a dynamic risk monitoring data set.

[0019] Specifically, first, through the monitoring unit set at the data access interface, obtain the behavior features generated when the user accesses the data resource in real time, and obtain multi-dimensional features. Among them, the data access interface refers to the entry point for providing users or application programs to access protected data resources, including but not limited to API interfaces, database connection points, and application layer access ports; the monitoring unit refers to the security plug-in component deployed at the data access interface, which can capture, record, and analyze all data access requests and their context information passing through the data access interface.

[0020] The multi-dimensional features include access frequency, access source location, and operation sequence. Among them, the access frequency refers to the number of data access requests initiated by the user within a unit of time; the access source location refers to the geographical location or network location information where the user initiates the access request; the operation sequence refers to the sequential combination of a series of operation commands executed by the user on the data resource.

[0021] Structurally process the above-collected multi-dimensional features in a predetermined format to form a dynamic risk monitoring data set, which serves as the basic data source for subsequent risk assessment and provides support for real-time risk analysis of access behaviors.

[0022] S200: Based on the hierarchical risk assessment model, perform real-time calculations on the dynamic risk monitoring data set and output a dynamic risk score.

[0023] Specifically, after obtaining the dynamic risk monitoring data set, input the dynamic risk monitoring data set into a pre-trained hierarchical risk assessment model, and through the calculation and analysis of the model, obtain a quantified dynamic risk score. Among them, the hierarchical risk assessment model refers to a machine learning model with a multi-layer structure, which can automatically extract the risk indication factors of the multi-dimensional features in the dynamic risk monitoring data set and calculate the risk level of the current access behavior according to the learning results of historical risk data. The hierarchical risk assessment model adopts a hierarchical structure design, which can extract feature information layer by layer, combine low-level features to form high-level semantic features, and finally output a dynamic risk score between 0 and 100.

[0024] The dynamic risk score refers to the quantitative representation of the risk level of the user's current data access behavior, with a score range of 0-100. The higher the score, the higher the risk level. This dynamic risk score is calculated in real time, can dynamically reflect the risk changes of the user's access behavior, and provides a decision-making basis for subsequent circuit breaker strategies.

[0025] S300: Divide the dynamic risk score into low risk, medium risk, or high risk according to a predefined dynamic risk threshold range, and activate the corresponding circuit breaker strategy: low risk triggers real-time alarm notifications, medium risk triggers a sliding window flow control mechanism, and high risk triggers session token revocation.

[0026] Specifically, divide the calculated dynamic risk score into three levels: low risk, medium risk, or high risk according to a predefined dynamic risk threshold range, and activate the corresponding circuit breaker strategy according to different risk levels.

[0027] Pre-set a dynamic risk threshold range, and divide the dynamic risk score range of 0 - 100 into three ranges: low risk range, medium risk range, and high risk range. When the dynamic risk score falls into different ranges, the corresponding circuit breaker strategy is automatically triggered. Specifically, when the dynamic risk score falls into the low risk range, trigger the real-time alarm notification mechanism to send a risk warning message to the system administrator or relevant responsible person, indicating possible security risks, but do not restrict the normal access of users; when the dynamic risk score falls into the medium risk range, trigger the sliding window flow control mechanism to reduce potential security risks by controlling the access frequency of users, while ensuring the basic access needs of users, reducing the system burden and preventing the expansion of risks; when the dynamic risk score falls into the high risk range, trigger the session token revocation strategy, immediately interrupt the user's current access session, revoke the user's access token, and force the user to re-authenticate, thereby effectively blocking possible malicious access behaviors.

[0028] Through the hierarchical circuit breaker mechanism, corresponding protection measures can be taken according to different risk levels, which not only ensures system security but also avoids excessive interference with normal access behaviors, achieving refined access control.

[0029] S400: Automatically execute the circuit breaker operation through a smart contract, generate a circuit breaker event certificate, and write it into the consortium blockchain for evidence storage.

[0030] Specifically, after determining the risk level and selecting the corresponding circuit breaker strategy, the smart contract automatically triggers and executes the corresponding circuit breaker operation. A smart contract is a self-executing computing program deployed on a blockchain network that can automatically execute according to a preset logic and has the characteristics of immutability and trusted execution.

[0031] When the circuit breaker operation is executed, a circuit breaker event certificate is generated. The circuit breaker event certificate contains key information related to the circuit breaker event, such as risk score, trigger time, circuit breaker level, and executed circuit breaker strategy. The circuit breaker event certificate uses digital signature technology for tamper-proof protection to ensure the authenticity and integrity of the certificate. The generated circuit breaker event certificate is written into the alliance chain network as transaction data for evidence storage. The alliance chain refers to a blockchain network jointly maintained by multiple organizations, with the characteristics of efficient consensus, controllable access rights, and data privacy protection.

[0032] By writing the circuit breaker event credentials into the alliance chain, a trusted record and tamper-proof evidence of the circuit breaker operation is achieved, providing reliable technical support for subsequent tracing.

[0033] S500: When the risk score continues to be lower than the recovery threshold during the continuous monitoring period, the access restrictions are gradually relaxed according to the step-by-step recovery strategy.

[0034] Specifically, when the user's risk score is continuously monitored to be lower than the recovery threshold within the preset monitoring period, it indicates that the user's access behavior no longer has obvious risk characteristics, and the fuse release process is initiated. The recovery threshold refers to a pre-set risk score value. When the user's dynamic risk score is lower than the recovery threshold and remains stable, it is determined that the previous fuse measures can be lifted.

[0035] The specific recovery process adopts a step-by-step recovery strategy, that is, instead of completely restoring all user permissions at once, the access restrictions on users are gradually relaxed in the order of permission levels from low to high and from simple to complex. This gradual permission recovery mechanism can prevent a sudden rebound in risks on the one hand, and also provide a sufficient observation period to ensure that the user's access behavior has indeed returned to normal on the other hand.

[0036] Through an orderly fuse release mechanism, the impact on users' normal business is minimized while ensuring data security, achieving a balance between security and efficiency.

[0037] Furthermore, based on the hierarchical risk assessment model, the dynamic risk monitoring data set is calculated in real time to output a dynamic risk score, including:

[0038] S210: Using a sliding time window to count the historical baseline value of the access frequency, and calculating the standard deviation multiple of the access frequency deviating from the historical baseline value of the access frequency based on Poisson distribution as the first risk factor;

[0039] S220: Statistically analyze the user's historical frequent activity locations and the user's historical activity radius, calculate the first distance between the user's historical frequent activity location and the access source location. When the first distance is less than or equal to the user's historical activity radius, set 0 as the second risk factor. When the first distance is greater than the user's historical activity radius, calculate the difference between the first distance and the user's historical activity radius, and then calculate the ratio of the difference to the user's historical activity radius, and set it as the second risk factor;

[0040] S230: Use the Hidden Markov Model to detect the deviation of the transfer probability between the operation sequence and the normal operation sequence as the third risk factor;

[0041] S240: Input the first risk factor, the second risk factor, and the third risk factor into the hierarchical risk assessment model to output the dynamic risk score.

[0042] In a feasible implementation, first, use the sliding time window method to statistically analyze the historical baseline value of the user's access frequency, and calculate the standard deviation multiple of the current access frequency deviating from the historical baseline value based on the Poisson distribution principle, and set this multiple as the first risk factor. The sliding time window refers to a dynamic statistical method that realizes continuous analysis of time series data by moving the statistical point within a fixed-length time window. According to the user's access frequency data over a period of time, such as calculating the mean of the access frequency data over a period of time, calculate the user's normal access frequency pattern as the historical baseline value of the access frequency. When it is detected that there is a deviation between the current access frequency and this baseline value, calculate the significance of the deviation, that is, the standard deviation multiple, based on the Poisson distribution model as the risk factor for evaluating the abnormality degree of the access frequency. Then, statistically analyze the user's historical frequent activity locations and the user's historical activity radius, and calculate the first distance between the user's historical frequent activity location and the current access source location. When the first distance is less than or equal to the user's historical activity radius, it indicates that the user's current access location is within its normal activity range, and set the second risk factor to 0, indicating a low location risk. When the first distance is greater than the user's historical activity radius, it indicates that the user's current access location exceeds its normal activity range, calculate the difference between the first distance and the user's historical activity radius, and then calculate the ratio of the difference to the user's historical activity radius, and set the calculation result as the second risk factor to quantify the risk brought by the location abnormality.

[0043] Next, use the Hidden Markov Model to detect the deviation of the transition probability between the user's current operation sequence and the normal operation sequence, and use this deviation value as the third risk factor. Among them, the normal operation sequence refers to the standard operation flow sequence pre-matched according to the permissions requested by the user. The Hidden Markov Model is a statistical model that can describe a Markov process with hidden unknown parameters and is suitable for analyzing data sequences with time series characteristics. Calculate the difference degree of the state transition probability between the user's current operation sequence and the normal operation sequence through this Hidden Markov Model as the risk factor for evaluating the abnormality degree of the operation behavior. Then, input the above-mentioned first risk factor, second risk factor, and third risk factor obtained by calculation into the hierarchical risk assessment model. After comprehensive calculation and analysis by the model, output a dynamic risk score ranging from 0 to 100. The higher this score value, the higher the risk degree of the user's current data access behavior.

[0044] Through the above steps, it is possible to comprehensively analyze the user's data access behavior from three dimensions: access frequency, access location, and operation sequence, and achieve an accurate quantitative assessment of the access risk.

[0045] Furthermore, trigger the sliding window flow control mechanism, including:

[0046] S310: When the risk level is medium risk, obtain the user's historical average access rate;

[0047] S320: Use 0.5 times the user's historical average access rate as the lower limit of the sliding window, and increase it at a gradient of 10% per minute until 0.8 times the user's historical average access rate;

[0048] S330: Continuously monitor the risk score during the flow control period. If the score rises to the high-risk interval, immediately switch to the session token revocation policy. If the score drops to the low-risk interval, lift the flow control in advance.

[0049] In a feasible implementation manner, when it is determined that the risk level is medium risk, obtain the user's historical average access rate. Among them, the user's historical average access rate refers to the number of data access requests initiated by the user per unit time on average in the normal state, and this value reflects the user's regular data access behavior pattern. Then, use 0.5 times the user's historical average access rate as the lower limit of the sliding window, and increase it at a gradient of 10% per minute until 0.8 times the user's historical average access rate. Specifically, first limit the user's access rate to half of its historical average access rate, and then gradually relax the limit at a speed of increasing the historical average access rate by 10% per minute until it reaches 80% of the historical average access rate. This progressive flow control strategy can not only effectively control risks but also minimize the impact on the user's normal business to the greatest extent.

[0050] During the current limiting period, continuously monitor the risk score and dynamically adjust the current limiting strategy according to the change of the risk score. If the risk score rises to the high-risk range, indicating that the risk of the user's access behavior further increases, immediately switch to the session token revocation strategy to interrupt the user's current access session; if the risk score drops to the low-risk range, indicating that the user's access behavior has returned to normal, lift the current limiting measure in advance and restore the user's normal access permission.

[0051] Through the above sliding window current limiting mechanism, it is possible to flexibly adjust the access restrictions on users according to the dynamic changes of the risk score, which can not only effectively prevent and control the data access risk, but also minimize the interference to the user's normal business, achieving the balance between security and efficiency.

[0052] Furthermore, the fuse operation is automatically executed through a smart contract to generate a fuse event certificate, which is written into the consortium blockchain for evidence storage, including:

[0053] S410: Generate a fuse event certificate containing the risk feature hash, decision rule version number, execution node ID, and timestamp;

[0054] S420: Invoke the pre-deployed evidence storage smart contract and submit the fuse event certificate as a transaction payload to the consortium blockchain network;

[0055] S430: In the consortium blockchain network, after completing the transaction verification of at least 3 accounting nodes by using the Byzantine fault tolerance consensus mechanism, return the evidence storage result.

[0056] In a preferred implementation manner, first, generate a fuse event certificate containing the risk feature hash, decision rule version number, execution node ID, and timestamp. Among them, the risk feature hash refers to the result of hashing the risk feature data that triggers the fuse, which is used to uniquely identify the risk feature; the decision rule version number refers to the version number of the decision rule that triggers the current fuse, which is used to trace the decision basis; the execution node ID refers to the node identifier that executes the fuse operation; the timestamp refers to the exact time when the fuse operation is executed. These information together constitute the fuse event certificate, providing complete supporting materials for the fuse operation. Then, invoke the pre-deployed evidence storage smart contract and submit the fuse event certificate as a transaction payload to the consortium blockchain network. The evidence storage smart contract refers to a smart contract that is pre-deployed on the consortium blockchain and is specifically used for data evidence storage, which can automatically execute the data storage and verification logic; the transaction payload refers to the data content included in the blockchain transaction, which specifically refers to the fuse event certificate in this embodiment.

[0057] After that, in the consortium blockchain network, after using the Byzantine Fault Tolerance (BFT) consensus mechanism to complete the transaction verification of at least 3 accounting nodes, the evidence storage result is returned. The Byzantine Fault Tolerance consensus mechanism refers to a distributed consensus algorithm that can reach an agreement even when some nodes have malicious behaviors; the accounting node refers to the node in the consortium blockchain network responsible for verifying transactions and recording the ledger; the evidence storage result refers to the confirmation information returned after the fuse event certificate is successfully written into the blockchain, including information such as transaction hash and block height.

[0058] Through the above steps, the automatic execution and trusted evidence storage of the fuse operation are realized, providing technical support for subsequent audit traceability and liability determination, and at the same time ensuring the transparency and immutability of the fuse operation.

[0059] Furthermore, when the risk score continuously remains below the recovery threshold within consecutive monitoring periods, the access restrictions are gradually relaxed according to the stepped recovery strategy, including:

[0060] S510: In the first stage, the basic read-only permission is restored. If no risk event occurs during the continuously monitored preset period, it enters the second stage;

[0061] S520: In the second stage, the low-frequency write permission is opened. If no risk event occurs during the continuously monitored preset period, it enters the end stage;

[0062] S530: In the end stage, the original permissions are fully restored, and the disposal process log is archived.

[0063] In a feasible implementation manner, when the risk score continuously remains below the recovery threshold within consecutive monitoring periods, the access restrictions are gradually relaxed according to the stepped recovery strategy, and this process includes the first stage, the second stage, and the end stage.

[0064] First, implement the first-stage recovery, that is, restore the user's basic read-only permission. Among them, the basic read-only permission refers to the access permission that allows users to view data but not modify, delete, or add data. After restoring the basic read-only permission, continuously monitor the user access behavior within the preset period. If no risk event is detected within this preset period, enter the second-stage recovery. The preset period refers to a preset continuous period of time used to observe whether the user access behavior returns to normal.

[0065] When no risk event occurs during the continuous monitoring of the preset period in the first stage, implement the second-stage recovery, that is, open the user's low-frequency write permission. The low-frequency write permission refers to the access permission that allows users to modify, delete, or add data at a restricted frequency. After opening the low-frequency write permission, continue to continuously monitor the user access behavior within the preset period. If no risk event is still detected within this preset period, enter the end-stage recovery.

[0066] When there are no risk events during the continuous monitoring in the second stage for the preset period, the final stage recovery is implemented, that is, the user's original permissions are fully restored, and the logs of the entire fuse handling process are archived. The original permissions refer to all the data access permissions that the user had before the fuse was triggered; the handling process logs refer to the complete process information recording from risk detection, fuse trigger to permission restoration, including key data such as risk scores, fuse strategies, recovery stages, etc.

[0067] Through the above stepped recovery strategy, the progressive recovery of the user's access permissions is achieved, which not only ensures data security but also minimizes the interference to the user's normal business to the greatest extent.

[0068] Furthermore, the determination process of the preset period includes:

[0069] S541: According to the user's historical risk records, count the proportion of the risk recurrence frequency, and set it as the risk recurrence coefficient;

[0070] S542: Set the basic monitoring period;

[0071] S543: Calculate the product of the basic monitoring period and the risk recurrence coefficient, and add the basic monitoring period, and set it as the preset period.

[0072] In a preferred implementation manner, the preset period is determined by a dynamic setting method. First, according to the user's historical risk records, count the proportion of the risk recurrence frequency, and set it as the risk recurrence coefficient. The user's historical risk records refer to the risk event data recorded by the user in the past; the proportion of the risk recurrence frequency refers to the ratio of the frequency of the risk event occurring again within a certain period after the risk is lifted to the total risk events, and this value reflects the persistence and recurrence possibility of the user's risk behavior. At the same time, set the basic monitoring period. The basic monitoring period is a preset standard monitoring duration, which is used as the basic value for calculating the preset period and is usually determined according to business characteristics and security policies.

[0073] Subsequently, calculate the product of the basic monitoring period and the risk recurrence coefficient, and add the basic monitoring period, and set it as the preset period. The specific calculation formula is: Preset period = Basic monitoring period + (Basic monitoring period × Risk recurrence coefficient). Through this calculation method, the length of the monitoring period can be dynamically adjusted according to the user's risk recurrence tendency. The higher the risk recurrence coefficient, the longer the preset period, thereby improving the effectiveness of security protection.

[0074] Through the above dynamic determination of the preset period, personalized monitoring periods can be set according to the risk characteristics of different users, which not only avoids a unified standard but also improves the accuracy of risk control, realizing the intelligence and refinement in risk management.

[0075] Further, the steps for constructing the hierarchical risk assessment model include:

[0076] S241: Configure multiple groups of data, where any one of the multiple groups of data includes historical dynamic risk data and a label indicating the true value of the dynamic risk score.

[0077] S242: Calculate the first historical data risk factor, the second historical data risk factor, and the third historical data risk factor of the historical dynamic risk data.

[0078] S243: Using the label indicating the true value of the dynamic risk score as supervision, and using the first historical data risk factor, the second historical data risk factor, and the third historical data risk factor as inputs, train at least three basic units with different topological structures through the multiple groups of data.

[0079] S244: Using the label indicating the true value of the dynamic risk score as supervision, and using the multiple output feature values of the multiple basic units as inputs, train the correction unit through random forest.

[0080] S245: Fuse the output nodes of the multiple basic units with the input nodes of the correction unit to obtain the hierarchical risk assessment model.

[0081] In a preferred embodiment, to construct a hierarchical risk assessment model, first, configure multiple groups of data, where any one of the multiple groups of data includes historical dynamic risk data and a label indicating the true value of the dynamic risk score. Among them, the historical dynamic risk data refers to the characteristic data of various data access behaviors collected in history; the label indicating the true value of the dynamic risk score refers to the risk score determined after expert evaluation or verification by actual risk events, serving as the supervision signal for model training. Then, calculate the first historical data risk factor, the second historical data risk factor, and the third historical data risk factor of the historical dynamic risk data. Specifically, use the same calculation methods as in steps S210, S220, and S230 to calculate the access frequency risk factor (the first historical data risk factor), the location risk factor (the second historical data risk factor), and the operation sequence risk factor (the third historical data risk factor) in the historical data respectively, to prepare the input features for subsequent model training.

[0082] Subsequently, using the label identifying the true value of the dynamic risk score as the supervision signal, and using the first risk factor of historical data, the second risk factor of historical data, and the third risk factor of historical data as input features, at least three basic units with different topological structures are trained through multiple groups of data. Different topological structures mean that these basic units adopt different network structures or algorithm frameworks, such as convolutional neural networks, recurrent neural networks, decision trees, etc., to capture risk characteristics from different angles. Then, using the label identifying the true value of the dynamic risk score as the supervision signal, and using the multiple output feature values of multiple basic units as input, a correction unit is trained through the random forest algorithm. Random forest refers to an ensemble learning method that improves the accuracy and stability of the model by constructing multiple decision trees and fusing the prediction results of each decision tree; the correction unit refers to a model component that corrects and fuses the output of the basic unit. After that, the output nodes of multiple basic units are fused with the input nodes of the correction unit to obtain a hierarchical risk assessment model. Through this multi-level model structure design, the advantages of different models can be fully utilized to improve the accuracy and robustness of risk assessment.

[0083] Through the above construction process of the hierarchical risk assessment model, the comprehensive analysis and accurate assessment of multi-dimensional risk characteristics are realized, providing reliable technical support for the trusted data hierarchical fusing control of autonomous response.

[0084] Embodiment 2, as Figure 2 shown, based on the same inventive concept as the trusted data hierarchical fusing control method for autonomous response provided in Embodiment 1, the embodiment of the present invention further provides a trusted data hierarchical fusing control system for autonomous response, including:

[0085] A data acquisition module 11, configured to collect multi-dimensional characteristics of data access behavior in real time, including access frequency, access source location, and operation sequence, and construct a dynamic risk monitoring data set;

[0086] A risk assessment module 12, configured to perform real-time calculation on the dynamic risk monitoring data set based on the hierarchical risk assessment model, and output a dynamic risk score;

[0087] A hierarchical response module 13, configured to divide the dynamic risk score into low risk or medium risk or high risk according to a predefined dynamic risk threshold interval, and activate the corresponding fusing strategy: low risk triggers a real-time alarm notification, medium risk triggers a sliding window flow limiting mechanism, and high risk triggers session token revocation;

[0088] A blockchain evidence storage module 14, configured to automatically execute the fusing operation through a smart contract, generate a fusing event certificate, and write it into the consortium chain for evidence storage;

[0089] The recovery management module 15 is used to gradually relax the access restrictions according to the stepped recovery strategy when the risk score continuously falls below the recovery threshold within consecutive monitoring periods.

[0090] Furthermore, the risk assessment module 12 includes the following execution steps:

[0091] Adopt a sliding time window to statistically calculate the historical baseline value of the access frequency, and calculate the standard deviation multiple of the deviation of the access frequency from the historical baseline value of the access frequency based on the Poisson distribution as the first risk factor;

[0092] Statistically calculate the user's historical frequent activity locations and the user's historical activity radius, calculate the first distance between the user's historical frequent activity locations and the access source location. When the first distance is less than or equal to the user's historical activity radius, set 0 as the second risk factor. When the first distance is greater than the user's historical activity radius, calculate the difference between the first distance and the user's historical activity radius, and then calculate the ratio of the difference to the user's historical activity radius as the second risk factor;

[0093] Use a hidden Markov model to detect the deviation of the transition probability between the operation sequence and the normal operation sequence as the third risk factor;

[0094] Input the first risk factor, the second risk factor, and the third risk factor into the hierarchical risk assessment model to output the dynamic risk score.

[0095] Furthermore, the hierarchical response module 13 includes the following execution steps:

[0096] When the risk level is medium risk, obtain the user's historical average access rate;

[0097] Use 0.5 times the user's historical average access rate as the lower limit of the sliding window, and increment it at a gradient of 10% per minute until 0.8 times the user's historical average access rate;

[0098] Continuously monitor the risk score during the flow limiting period. If the score rises to the high-risk interval, immediately switch to the session token revocation policy. If the score drops to the low-risk interval, lift the flow limit in advance.

[0099] Furthermore, the blockchain evidence storage module 14 includes the following execution steps:

[0100] Generate a fuse event certificate containing the risk feature hash, decision rule version number, execution node ID, and timestamp;

[0101] Call the pre-deployed evidence storage smart contract and submit the fuse event certificate as a transaction payload to the consortium blockchain network;

[0102] In the federated blockchain network, after at least three bookkeeping nodes complete transaction verification by using the Byzantine fault tolerance consensus mechanism, the deposit result is returned.

[0103] Further, the recovery management module 15 includes the following execution steps:

[0104] In the first stage, the basic read-only permission is restored. If no risk events are detected during continuous monitoring for a preset period, it enters the second stage;

[0105] In the second stage, the low-frequency write permission is opened. If no risk events are detected during continuous monitoring for a preset period, it enters the final stage;

[0106] In the final stage, the original permissions are fully restored, and the disposal process log is archived.

[0107] Further, the determination process of the preset period includes:

[0108] According to the user's historical risk records, the proportion of risk recurrence frequency is statistically calculated and set as the risk recurrence coefficient;

[0109] Set the basic monitoring period;

[0110] Calculate the product of the basic monitoring period and the risk recurrence coefficient, and add the basic monitoring period, which is set as the preset period.

[0111] Further, the steps for constructing the hierarchical risk assessment model include:

[0112] Configure multiple groups of data. Any one of the multiple groups of data includes dynamic risk historical data and a label indicating the true value of the dynamic risk score;

[0113] Calculate the first risk factor of historical data, the second risk factor of historical data, and the third risk factor of historical data for the dynamic risk historical data;

[0114] Using the label indicating the true value of the dynamic risk score as the supervision, and using the first risk factor of historical data, the second risk factor of historical data, and the third risk factor of historical data as the input, train at least three basic units with different topological structures through the multiple groups of data;

[0115] Using the label indicating the true value of the dynamic risk score as the supervision, and using the multiple output feature values of the multiple basic units as the input, train the correction unit through random forest;

[0116] Fuse the output nodes of the multiple basic units with the input nodes of the correction unit to obtain the hierarchical risk assessment model.

[0117] It should be noted that in the above embodiments, the descriptions of the various embodiments have their own emphases. For parts not described in detail in a certain embodiment, reference may be made to the relevant descriptions of other embodiments.

[0118] Those skilled in the art should understand that the embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0119] The present invention is described with reference to the flowcharts and / or block diagrams of methods, apparatuses (systems), and computer program products according to the embodiments of the present invention. It should be understood that each flow and / or block in the flowchart and / or block diagram, and the combination of flows and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded computer, or other programmable data processing devices to generate a machine, such that the instructions executed by the processor of the computer or other programmable data processing devices generate means for implementing the functions specified in Figure 1 one or more of the flows Figure 1 or blocks or combinations of blocks.

[0120] These computer program instructions can also be stored in a computer-readable memory capable of guiding a computer or other programmable data processing device to work in a specific manner, such that the instructions stored in the computer-readable memory generate a manufactured article including instruction means, and the instruction means implement the functions specified in Figure 1 one or more of the flows Figure 1 or blocks or combinations of blocks.

[0121] These computer program instructions can also be loaded onto a computer or other programmable data processing device, such that a series of operation steps are executed on the computer or other programmable device to generate a computer-implemented process, and thus the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in Figure 1 one or more of the flows Figure 1 or blocks or combinations of blocks.

[0122] Although the preferred embodiments of the present invention have been described, those skilled in the art can make additional changes and modifications to these embodiments once they know the basic inventive concept.

[0123] Obviously, those skilled in the art can make various modifications and variations to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the present invention and its equivalent technologies, the present invention also intends to include these modifications and variations.

Claims

1. An autonomous response-based trusted data classification and fusing control method, characterized in that, Including: Collecting multi-dimensional features of real-time data access behaviors, including access frequency, access source location, and operation sequence, to construct a dynamic risk monitoring dataset; Based on a hierarchical risk assessment model, performing real-time calculation on the dynamic risk monitoring dataset and outputting a dynamic risk score; According to a predefined dynamic risk threshold interval, classifying the dynamic risk score into low risk, medium risk, or high risk, and activating corresponding fusing strategies: low risk triggers real-time alarm notifications, medium risk triggers a sliding window flow-limiting mechanism, and high risk triggers session token revocation; Automatically executing fusing operations through a smart contract, generating a fusing event certificate, and writing it into the consortium blockchain for evidence storage; When the risk score continuously remains below the recovery threshold within consecutive monitoring periods, gradually relax access restrictions according to a stepped recovery strategy.

2. The method according to claim 1, wherein, Based on a hierarchical risk assessment model, performing real-time calculation on the dynamic risk monitoring dataset and outputting a dynamic risk score, including: Adopting a sliding time window to statistically calculate the historical baseline value of access frequency, and calculating the standard deviation multiple of the access frequency deviating from the historical baseline value of access frequency based on the Poisson distribution as the first risk factor; Statistically calculating the user's historical frequent activity locations and the user's historical activity radius, calculating the first distance between the user's historical frequent activity location and the access source location, when the first distance is less than or equal to the user's historical activity radius, setting 0 as the second risk factor, when the first distance is greater than the user's historical activity radius, calculating the difference between the first distance and the user's historical activity radius, and then calculating the ratio of the difference to the user's historical activity radius as the second risk factor; Using a hidden Markov model to detect the deviation of the transfer probability between the operation sequence and the normal operation sequence as the third risk factor; Inputting the first risk factor, the second risk factor, and the third risk factor into the hierarchical risk assessment model and outputting the dynamic risk score.

3. The method according to claim 1, characterized in that, Triggering a sliding window flow-limiting mechanism, including: When the risk level is medium risk, obtaining the user's historical average access rate; Taking 0.5 times the user's historical average access rate as the lower limit of the sliding window, and increasing it at a gradient of 10% per minute until 0.8 times the user's historical average access rate; Continuously monitoring the risk score during the flow-limiting period. If the score rises to the high-risk interval, immediately switch to the session token revocation strategy. If the score drops to the low-risk interval, lift the flow limit in advance.

4. The method according to claim 1, wherein Automatically executing fusing operations through a smart contract, generating a fusing event certificate, and writing it into the consortium blockchain for evidence storage, including: Generating a fusing event certificate containing a risk feature hash, a decision rule version number, an execution node ID, and a timestamp; Invoking a pre-deployed evidence storage smart contract and submitting the fusing event certificate as a transaction payload to the consortium blockchain network; In the consortium blockchain network, after completing transaction verification by at least 3 accounting nodes using the Byzantine fault-tolerant consensus mechanism, returning the evidence storage result.

5. The method according to claim 1, wherein When the risk score continuously remains below the recovery threshold within consecutive monitoring periods, gradually relax access restrictions according to a stepped recovery strategy, including: In the first stage, the basic read-only permission is restored. If no risk events are detected during continuous monitoring within the preset period, it enters the second stage; In the second stage, the low-frequency write permission is opened. If no risk events are detected during continuous monitoring within the preset period, it enters the final stage; In the final stage, the original permissions are fully restored, and the disposal process log is archived.

6. The method according to claim 5, wherein The determination process of the preset period includes: Based on the user's historical risk records, the proportion of the risk recurrence frequency is statistically calculated and set as the risk recurrence coefficient; Set the basic monitoring period; Calculate the product of the basic monitoring period and the risk recurrence coefficient, and add the basic monitoring period, which is set as the preset period.

7. The method according to claim 2, characterized in that, The steps for constructing the hierarchical risk assessment model include: Configure multiple groups of data, where any one of the multiple groups of data includes dynamic risk historical data and a label indicating the true value of the dynamic risk score; Calculate the first risk factor of historical data, the second risk factor of historical data, and the third risk factor of historical data for the dynamic risk historical data; Using the label indicating the true value of the dynamic risk score as supervision, and using the first risk factor of historical data, the second risk factor of historical data, and the third risk factor of historical data as inputs, train at least three basic units with different topological structures through the multiple groups of data; Using the label indicating the true value of the dynamic risk score as supervision, and using the multiple output feature values of the multiple basic units as inputs, train the correction unit through random forest; Fuse the output nodes of the multiple basic units with the input nodes of the correction unit to obtain the hierarchical risk assessment model.

8. An autonomous response trusted data classification and fusing control system, characterized in that For implementing the method according to any one of claims 1 to 7, the system includes: A data acquisition module for real-time collecting multi-dimensional features of data access behaviors, including access frequency, access source location, and operation sequence, and constructing a dynamic risk monitoring data set; A risk assessment module for performing real-time calculations on the dynamic risk monitoring data set based on the hierarchical risk assessment model and outputting a dynamic risk score; A hierarchical response module for classifying the dynamic risk score into low risk or medium risk or high risk according to a predefined dynamic risk threshold interval, and activating the corresponding fusing strategy: low risk triggers a real-time alarm notification, medium risk triggers a sliding window current limiting mechanism, and high risk triggers session token revocation; A blockchain evidence storage module for automatically executing the fusing operation through a smart contract, generating a fusing event certificate, and writing it into the consortium chain for evidence storage; A recovery management module for gradually relaxing access restrictions according to a stepped recovery strategy when the risk score continuously remains below the recovery threshold within consecutive monitoring periods.

Images