Safety monitoring method and system for financial information service platform

Abstract

The invention provides a safety monitoring method and system for a financial information service platform. Wherein a collaborative encryption transmission channel between a budgeting unit and an auditing department is constructed, a joint key is generated based on a multi-party computing protocol, and the ciphertext operation authority of a sensitive field is dynamically configured; performing ciphertext variance calculation and regression analysis on the encrypted budget execution record through the security operation node, generating a verifiable statistical result, binding the authority, and synchronously updating the sensitive field access frequency; a hierarchical security threat baseline is generated in combination with permission, frequency and historical query records, and cross-project high-frequency query and data operation deviation are associated; and when the query deviates from the baseline, calculating the risk confidence coefficient according to the deviation, triggering multi-party verification path adjustment and collaborative alarm, and dynamically limiting the ciphertext permission of the abnormal query. According to the technical scheme provided by the invention, cross-department data security sharing and dynamic risk collaborative prevention and control are realized.

Description

Technical Field

[0001] This application relates to the technical field of security monitoring, and particularly to a security monitoring method and system for a financial information service platform. Background Art

[0002] In the scenario of cross-departmental budget audit, it is necessary to achieve encrypted sharing of multi-party sensitive data and dynamic permission adaptation. It is necessary to ensure the confidentiality and integrity of data during transmission and calculation, and also support risk perception and prevention and control of high-frequency cross-project query behaviors, so as to avoid data misuse or distortion of audit results caused by rigid permissions or lagging detection mechanisms. At the same time, it is necessary to solve the difficulties in integrated analysis caused by diverse data sources, as well as the flexible adaptation requirements for permission and risk monitoring in dynamic business scenarios.

[0003] The current mainstream solution is an intelligent contract audit framework based on blockchain technology. It ensures the immutability of data through a distributed ledger and uses predefined intelligent contract rules to manage permissions and monitor anomalies for encrypted data. For example, after the consensus layer nodes verify the authenticity of the data, the contract layer automatically performs audit analysis and triggers an early warning mechanism through a fixed threshold.

[0004] However, the permission policy completely depends on predefined intelligent contract rules and cannot dynamically adjust the access permissions of sensitive fields according to business scenarios; the anomaly monitoring mechanism only targets a single frequency dimension and lacks the correlation analysis of cross-project query behaviors and ciphertext calculation magnitudes, resulting in difficult identification of complex attack patterns. Summary of the Invention

[0005] This application provides a security monitoring method and system for a financial information service platform to solve the problems of insufficient dynamic collaborative encryption and lack of anomaly operation monitoring in the prior art.

[0006] In a first aspect, this application provides a security monitoring method for a financial information service platform, including:

[0007] Establish a collaborative encryption transmission channel between a budget unit and an audit department, and generate a joint key between the budget unit and the audit department to dynamically configure the ciphertext operation permissions of sensitive fields according to the joint key;

[0008] Transmit the pre-audit data of the budget unit to a security operation node through the collaborative encryption transmission channel, so that the security operation node performs variance calculation and regression analysis on the pre-audit data according to the joint key, generates a statistical result verifiable by the audit department, synchronously binds the statistical result with the ciphertext operation permissions, and updates the access frequency of the sensitive fields at the same time;

[0009] Generate a hierarchical security threat baseline based on the ciphertext operation permissions, the access frequency, and the obtained historical cross-departmental query records.

[0010] Through the collaborative encryption transmission channel, correlate the high-frequency query operations across projects requested by the audit department with the data operation deviation of the statistical results. After correlation, when it is detected that the query operation deviates from the hierarchical security threat baseline, calculate the risk confidence level based on the data operation deviation;

[0011] Perform multi-party verification on the transmission path corresponding to the query operation according to the risk confidence level, send collaborative warning information to the budget unit according to the verification result, and dynamically restrict the ciphertext operation permission of the sensitive fields associated with the abnormal query operation in the collaborative encryption transmission channel.

[0012] Optionally, generating the hierarchical security threat baseline based on the ciphertext operation permission, the access frequency, and the obtained historical cross-department query records includes:

[0013] Determine the operable range of each sensitive field according to the ciphertext operation permission, and extract the number of accesses of the corresponding sensitive field within a preset period as the basic access volume;

[0014] Classify the historical cross-department query records, count the number of queries involving each sensitive field in each type of query, and generate a field query frequency distribution;

[0015] Perform weighted fusion on the basic access volume and the field query frequency distribution, where the access frequency participates in the fusion calculation as a weight adjustment factor, and obtain the comprehensive access characteristic value of each sensitive field;

[0016] Establish a dynamic change curve with the time dimension as the horizontal axis and the comprehensive access characteristic value as the vertical axis, and extract the peak points and abnormal fluctuation points in the dynamic change curve as key nodes;

[0017] Generate a hierarchical security threat baseline including a normal operation interval and an abnormal warning threshold according to the distribution law of the key nodes of each sensitive field, in combination with the change record of the ciphertext operation permission, where the abnormal warning threshold is dynamically adjusted according to the deviation degree between the highest characteristic value and the average characteristic value among the key nodes.

[0018] Optionally, generating the hierarchical security threat baseline including a normal operation interval and an abnormal warning threshold according to the distribution law of the key nodes of each sensitive field, in combination with the change record of the ciphertext operation permission, includes:

[0019] Extract the key nodes of each sensitive field within a preset time period, and calculate the deviation amplitude between the comprehensive access characteristic value corresponding to each key node and the historical average value;

[0020] Sort the deviation amplitudes by magnitude, select the top pre-set proportion of deviation amplitudes as the baseline abnormal samples, and analyze the correlation between the baseline abnormal samples and the change records of the ciphertext operation permissions at the corresponding time points to determine the influence coefficient of the permission change on the deviation amplitude;

[0021] Adjust the baseline deviation amplitudes of each sensitive field according to the influence coefficient to generate dynamic adjustment parameters;

[0022] Based on the dynamic adjustment parameters and historical normal operation data, calculate the upper limit of the normal operation range and the lower limit of the abnormal warning threshold for each sensitive field respectively to generate a hierarchical security threat baseline including the normal operation range and the abnormal warning threshold; wherein the lower limit of the abnormal warning threshold decreases as the dynamic adjustment parameter increases, and a buffer transition zone is set between the upper limit of the normal operation range and the lower limit of the abnormal warning threshold.

[0023] Optionally, through the collaborative encryption transmission channel, associate the high-frequency cross-project query operations requested by the audit department with the data operation deviation of the statistical results, and after the association, when it is detected that the query operation deviates from the hierarchical security threat baseline, calculate the risk confidence level based on the data operation deviation, including:

[0024] Through the collaborative encryption transmission channel, obtain the query request sequence of the audit department for multiple budget projects within a unit time, and extract the sensitive fields involved in each query request and their access timestamps;

[0025] Match the query request sequence with the statistical results of the corresponding budget project, calculate the numerical difference between the query results corresponding to each query request in the query request sequence and the statistical results, and generate a query deviation record, where the query deviation record includes the query frequency and the query deviation value;

[0026] Establish a two-dimensional distribution diagram with the query frequency as the horizontal axis and the query deviation value as the vertical axis, and identify the abnormal query points that deviate from the preset normal range in the two-dimensional distribution diagram;

[0027] For each abnormal query point, calculate the initial risk value according to the degree of deviation of the abnormal query point from the hierarchical security threat baseline, and based on the ciphertext operation permission configuration of the sensitive field, configure the corresponding weight coefficient to correct the initial risk value to obtain the corrected risk value;

[0028] In the order of query time, cumulatively calculate the corrected risk values of multiple consecutive abnormal query points. When the cumulative value exceeds the dynamic threshold, generate the risk confidence level; wherein the dynamic threshold is adaptively adjusted according to the current activity of the collaborative encryption transmission channel and the historical risk records.

[0029] Optionally, perform multi-party verification on the transmission path corresponding to the query operation according to the risk confidence level, send collaborative alarm information to the budget unit according to the verification result, and dynamically restrict the ciphertext operation permission of the sensitive fields associated with the abnormal query operation in the collaborative encryption transmission channel, including:

[0030] Determine the number of budget units that need to participate in the verification according to the risk interval where the risk confidence level is located, where the higher the risk confidence level, the more budget units need to participate;

[0031] Send a verification request to the determined budget units, where the verification request includes the feature information of the abnormal query operation and the associated sensitive field identifier, and receive the verification responses returned by each budget unit, and count the proportion of confirmed abnormalities in the verification responses as the verification credibility;

[0032] When the verification credibility exceeds the preset threshold, generate collaborative alarm information including the detailed information of the abnormal query operation and send it to the relevant budget units;

[0033] Determine the range of sensitive fields that need to be restricted according to the combined value of the risk confidence level and the verification credibility, and adjust the operation permission identifier of the corresponding sensitive field in the joint key;

[0034] Real-time monitor the subsequent access behavior of the restricted fields, and gradually restore the operation permission of the restricted fields when the access behavior is detected to return to normal.

[0035] Optionally, the security operation node performs variance calculation and regression analysis on the pre-audited data according to the joint key to generate a statistical result that can be verified by the audit department, including:

[0036] Extract the numerical fields that are allowed to be operated in the pre-audited data according to the joint key, and classify the numerical fields into multiple data groups according to the budget items;

[0037] Calculate the deviation degree of all numerical fields in each data group from the average value of the corresponding budget item to obtain the first intermediate result;

[0038] Based on the first intermediate result, analyze the distribution trend of the numerical fields over time to obtain the second intermediate result;

[0039] Combine the first intermediate result and the second intermediate result according to the preset weight to generate the statistical sub-result of the data group;

[0040] Summarize the statistical sub-results of all data groups, and filter out the unauthorized fields in the statistical sub-results according to the permission range of the joint key to generate the statistical result that can be verified by the audit department.

[0041] Optionally, generate a joint key between the generated budget unit and the audit department to dynamically configure the ciphertext operation permissions of sensitive fields according to the joint key, including:

[0042] Obtain the first key component of the budget unit and the second key component of the audit department, splice the first key component and the second key component to generate an initial joint key;

[0043] Based on the budget item identifier of the budget unit and the audit authority identifier of the audit department, iteratively adjust the initial joint key to generate a joint key;

[0044] Extract sensitive fields from the pre-audit data according to the budget item identifier, and assign a field identifier to each sensitive field;

[0045] Bind the field identifier to the joint key to generate a ciphertext operation permission identifier corresponding to each sensitive field;

[0046] Dynamically adjust the ciphertext operation permission identifier according to the audit authority identifier, so that the audit department can only perform ciphertext operations on the sensitive fields permitted by the audit authority identifier.

[0047] In a second aspect, the present application provides a security monitoring system for a financial information service platform, including:

[0048] A construction module for establishing a collaborative encryption transmission channel between the budget unit and the audit department, and generating a joint key between the budget unit and the audit department to dynamically configure the ciphertext operation permissions of sensitive fields according to the joint key;

[0049] An operation module for transmitting the pre-audit data of the budget unit to a secure operation node through the collaborative encryption transmission channel, so that the secure operation node performs variance calculation and regression analysis on the pre-audit data according to the joint key, generates a statistical result verifiable by the audit department, and synchronously binds the statistical result to the ciphertext operation permission, and at the same time updates the access frequency of the sensitive field;

[0050] A generation module for generating a hierarchical security threat baseline based on the ciphertext operation permission, the access frequency, and the obtained historical cross-department query records;

[0051] An association module for associating the query operation with high frequency across projects requested by the audit department with the data operation deviation of the statistical result through the collaborative encryption transmission channel, and after the association, when it is detected that the query operation deviates from the hierarchical security threat baseline, calculating a risk confidence level based on the data operation deviation;

[0052] A verification module, configured to perform multi-party verification on the transmission path corresponding to the query operation according to the risk confidence level, send collaborative warning information to the budget unit according to the verification result, and dynamically restrict the ciphertext operation permission of sensitive fields associated with abnormal query operations in the collaborative encryption transmission channel.

[0053] In a third aspect, an embodiment of the present application provides a computing device, including a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement a security monitoring method for a financial information service platform as described in the first aspect above.

[0054] In a fourth aspect, an embodiment of the present application provides a computer storage medium, storing a computer program, and when the computer program is executed by a computer, it implements a security monitoring method for a financial information service platform as described in the first aspect.

[0055] In the embodiments of the present application, by establishing a collaborative encryption transmission channel between the budget unit and the audit department, and generating a joint key between the budget unit and the audit department to dynamically configure the ciphertext operation permission of sensitive fields according to the joint key, it is possible to realize the dynamic construction of an encrypted channel for cross-department data interaction and the precise adaptation of permissions; by transmitting the pre-audit data of the budget unit to the secure computing node through the collaborative encryption transmission channel, so that the secure computing node performs variance calculation and regression analysis on the pre-audit data according to the joint key, generates a statistical result verifiable by the audit department, and synchronously binds the statistical result with the ciphertext operation permission, and at the same time updates the access frequency of the sensitive fields, it is possible to complete trusted audit calculations while protecting data privacy and establish a dynamic association mechanism between permissions and statistical results; by generating a hierarchical security threat baseline based on the ciphertext operation permission, the access frequency, and the obtained historical cross-department query records, it is possible to integrate multi-dimensional security elements to construct a dynamic threat assessment model; by associating the data operation deviation between the cross-project high-frequency query operations requested by the audit department and the statistical results through the collaborative encryption transmission channel, and after the association, when it is detected that the query operation deviates from the hierarchical security threat baseline, calculating the risk confidence level based on the data operation deviation, it is possible to trace the source of abnormal behavior and quantify the risk through data consistency verification; by performing multi-party verification on the transmission path corresponding to the query operation according to the risk confidence level, sending collaborative warning information to the budget unit according to the verification result, and dynamically restricting the ciphertext operation permission of sensitive fields associated with abnormal query operations in the collaborative encryption transmission channel, it is possible to trigger a closed-loop security response mechanism and implement dynamic downgrade control of permissions.

[0056] The present application also includes constructing a hierarchical security baseline with time sensitivity and scenario adaptability by coupling dynamic permission configuration, real-time access frequency, and historical cross-departmental query behaviors. While ensuring the continuity of the audit service, the static permission rules are upgraded to a dynamic defense system based on behavioral characteristics and data association, effectively solving the core problems of high misjudgment rate and incomplete risk coverage caused by rigid permissions or historical pattern dependence in cross-departmental data sharing scenarios.

[0057] These aspects or other aspects of the present application will be more clearly understood in the following description of the embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] To more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are some embodiments of the present application. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0059] Figure 1 The flowchart of a security monitoring method for a financial information service platform provided by the present application is shown;

[0060] Figure 2 The schematic structural diagram of a security monitoring system for a financial information service platform provided by the present application is shown;

[0061] Figure 3 The schematic structural diagram of a computing device provided by the present application is shown. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0062] To enable those skilled in the art to better understand the solutions of the present application, the following will clearly and completely describe the technical solutions in the embodiments of the present application in conjunction with the drawings in the embodiments of the present application.

[0063] In some processes described in the specification, claims, and the above drawings of the present application, there are multiple operations that appear in a specific order. However, it should be clearly understood that these operations can be executed not in the order in which they appear herein or in parallel. The serial numbers of the operations, such as 101, 102, etc., are only used to distinguish different operations, and the serial numbers themselves do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations can be executed in sequence or in parallel. It should be noted that the descriptions such as "first" and "second" in this article are used to distinguish different messages, devices, modules, etc., and do not represent a sequence, nor do they limit that "first" and "second" are of different types.

[0064] Researchers found that there are problems in the cross-departmental data interaction of the current financial information service platform, such as the staticization of the encryption channel, the lag in the control of sensitive field permissions, and the insufficient accuracy in identifying abnormal query behaviors, resulting in the risk of overstepping operation permissions and the potential for data leakage in the budget audit scenario. Based on this, a security monitoring method for the financial information service platform is provided. This method can achieve fine-grained permission configuration for sensitive fields through dynamic joint keys, construct a verifiable statistical model by combining variance calculation and regression analysis, and build a multi-dimensional threat baseline based on access patterns and historical behaviors to realize the dynamic evaluation of the risk confidence level of high-frequency queries across projects. The technical solution of this application can be applied to the joint operation of ciphertext data and the real-time blocking of abnormal operations in the scenarios of enterprise department budget preparation, audit supervision, and collaborative operations, effectively improving the security monitoring ability of cross-domain transfer of financial information.

[0065] The entire R & D process reflects the deep integration of the dynamic key negotiation mechanism and multi-dimensional threat modeling, aiming to overcome the problems in the existing solutions, such as the rigidity of the encryption channel, the lag in the adjustment of sensitive field permissions, the dependence on a single threshold for identifying abnormal query behaviors, and the disconnection between cross-departmental audit data operation and verification.

[0066] Next, the technical solutions in the embodiments of the present application will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without creative efforts belong to the scope of protection of the present application.

[0067] Figure 1 The following is a flowchart of a security monitoring method for a financial information service platform provided by an embodiment of the present application, as Figure 1 shown, the method includes:

[0068] 101. Establish a collaborative encryption transmission channel between the budget unit and the audit department, and generate a joint key between the budget unit and the audit department to dynamically configure the ciphertext operation permissions of sensitive fields according to the joint key;

[0069] In this step, the collaborative encryption transmission channel refers to a data transmission link constructed using a multi-party secure computing protocol. The joint key refers to a distributed control key jointly generated by the budget unit and the audit department. The ciphertext operation permission refers to an authorization identifier that allows specific calculation operations to be performed on encrypted data.

[0070] In the embodiment of the present application, an end-to-end encrypted channel is first established through the TLS1.3 protocol, and a two-factor authentication mechanism is used to verify the identities of the budget unit and the audit department. Secondly, the threshold signature technology is used to generate the initial key component, the budget unit holds the ECC private key fragment, and the audit department keeps the RSA private key fragment. Then, the key synthesis is completed in the trusted execution environment, and the Shamir secret sharing algorithm is used to generate the joint control key. Finally, the permission policy is deployed through the smart contract, and the key is bound to the hash identifier of the sensitive field to realize the dynamic configuration of field-level operation permissions.

[0071] The finance group (budget unit) of a company needs to transmit project pre-audit data to the audit group. The finance group first generates an ECC-P256 private key, and the audit group provides an RSA public key. The two parties establish an encrypted channel through TLS two-way authentication. The finance group calls the ECDH algorithm to combine the private key with the audit group's public key to generate a joint key, and derives three sub-keys through HKDF: data encryption key (encrypted budget amount), authority control key (marking computable fields), and audit signature key (verifying data integrity). The finance group marks the "project amount" and "execution cycle" in the pre-audit data as sensitive fields, encrypts them with the data encryption key, and packages the ciphertext with the authority rules (such as only allowing the audit group to sum the amounts) for transmission. After receiving it, the audit group uses the joint key to decrypt the authority rules to verify whether it has the operation authority. Subsequently, it can only operate the data within the authorized scope.

[0072] 102. The pre-qualified data of the budget unit is transmitted to the security operation node through the collaborative encryption transmission channel, so that the security operation node performs variance calculation and regression analysis on the pre-qualified data according to the joint key, generates statistical results that can be verified by the audit department, and simultaneously binds the statistical results to the ciphertext operation authority, and updates the access frequency of the sensitive field;

[0073] In this step, the secure computing node refers to the computing module deployed in the trusted execution environment (TEE) that supports ciphertext data operations (such as homomorphic encryption). Variance calculation and regression analysis refer to performing statistical analysis on encrypted pre-qualified data to generate verifiable results (such as trend prediction values). Ciphertext operation permission binding refers to associating statistical results with permission tags derived from joint keys to ensure that only authorized parties can access specific results. Access frequency refers to the number of times and timestamps that sensitive fields are decrypted or operated.

[0074] In the embodiments of the present application, first, the encrypted pre-audit data stream is segmented into 128KB data blocks and transmitted to the security node through the IPSec tunnel. Secondly, the data is decrypted within the SGX enclaves, and the Spark distributed computing framework is applied to perform the following operations: perform Levene's test for equality of variances on numerical fields, and construct a multiple linear regression model to analyze the relationship between variables. Then, the zero-knowledge proof technology is used to generate verifiable statistical results, and the result hash value is written into the blockchain. Finally, the field access counter is updated, and the exponentially weighted moving average algorithm is used to calculate the real-time access frequency.

[0075] The finance group sends the encrypted pre-audit education data to the secure computing node based on Intel SGX. The node decrypts the "project amount" field with the joint key within the TEE, calculates the budget variance for each quarter using Paillier homomorphic encryption, and fits the expenditure trend line by the least squares method to generate a predicted value. The node signs the variance result (such as ±15%) and the trend coefficient (such as slope 0.8) with the permission control key, marks it as "viewable by the audit group", and at the same time records that the "project amount" field has been accessed 2 times during the calculation process. After receiving the result, the audit group can only view the data that matches its permissions (such as the variance value), and cannot obtain the original plaintext or perform unauthorized operations (such as the variance calculation process).

[0076] 103. Generate a hierarchical security threat baseline based on the ciphertext operation permissions, the access frequency, and the obtained historical cross-departmental query records;

[0077] In this step, the hierarchical security threat baseline refers to a dynamic risk assessment model constructed based on permission rules, access frequency, and historical query records. The historical cross-departmental query records refer to the access behaviors of the audit department to the data of other units in the past (such as the number of queries, time, associated projects).

[0078] In the embodiments of the present application, first, a three-dimensional feature matrix is constructed, including the field confidentiality level (0-1 normalization), the real-time access frequency (Z-score normalization), and the historical query risk value (log transformation). Secondly, the isolation forest algorithm is applied to detect abnormal feature combinations and generate an initial risk level. Then, the time series prediction model (Prophet) is used to analyze the periodic pattern of the access mode. Finally, the analytic hierarchy process is used to determine the weights of each dimension, and a three-level security baseline including the normal interval, the observation threshold, and the warning threshold is generated.

[0079] The query records of the education and medical projects by the security system analysis and audit team in the past three months show that they query an average of 12 times per month. In the current education budget, the "project amount" field has been accessed 5 times (more than 50% above the baseline) due to variance calculation. The system calls the Isolation Forest algorithm to identify this anomaly and, combined with the highly sensitive attribute of the "amount" field, raises the risk score to 85 points (out of 100), marking it as a "high-risk" threat baseline. At the same time, the system records the recent similar high-frequency queries of the audit team on medical projects and incorporates them as associated risk factors into the model.

[0080] 104. Through the collaborative encryption transmission channel, associate the data operation deviation between the cross-project high-frequency query operations requested by the audit department and the statistical results. After association, when it is detected that the query operation deviates from the hierarchical security threat baseline, calculate the risk confidence based on the data operation deviation;

[0081] In this step, the data operation deviation refers to the difference rate between the statistical results (such as variance values) and the query results of the audit department. The risk confidence refers to the abnormal probability calculated through the deviation value and threat level (such as in the range of 0 - 1).

[0082] In the embodiment of the present application, first, establish a cross-project query index and use Elasticsearch to real-time associate high-frequency (>5 times / minute) operation records. Secondly, design a dynamic deviation calculation engine: adopt the relative error algorithm (|query value - reference value| / reference value) for numerical fields and apply Jaccard similarity analysis for categorical fields. Then, construct an LSTM neural network model, input 10-dimensional data including deviation sequences, time intervals, operator characteristics, etc., and output the risk confidence in the range of 0 - 1. Finally, trigger a hierarchical response mechanism for operations with a confidence exceeding 0.7.

[0083] The audit team initiated 20 consecutive cross-project queries within a day, requesting the variance values of the education and medical budgets. The system detected that the actual value of the education variance was ±15%, but an abnormal value of ±25% appeared in the query results, with a deviation rate of 66%. Combining the current high-risk baseline and historical query patterns, the system calculated the confidence as 0.91 (threshold 0.8) through the Bayesian model and determined this operation as "suspected data tampering or unauthorized access".

[0084] 105. Multiply verify the transmission path corresponding to the query operation according to the risk confidence, send collaborative warning information to the budget unit according to the verification result, and dynamically restrict the ciphertext operation permissions of the sensitive fields associated with the abnormal query operation in the collaborative encryption transmission channel. The abnormal query operation refers to the query operation that deviates from the security threat baseline.

[0085] In this step, multi-party verification refers to the joint verification of the query legitimacy by the budget unit, third-party supervision node, and audit department superiors. Collaborative alarm information refers to encrypted alarm messages containing risk details and operation logs.

[0086] In the embodiment of the present application, the verification process is first started according to the risk confidence value: a confidence level of 0.7-0.8 requires verification by 2 related parties, and above 0.8 requires 4 verification parties. Secondly, a verification request is initiated through the blockchain smart contract, and the operation fingerprint and deviation evidence chain are attached. The BFT Byzantine Fault Tolerance algorithm is then used to reach a consensus on the verification results, and an alarm is generated when the confirmation rate is ≥75%. Finally, the permission policy is dynamically modified through key splitting technology: homomorphic operation downgrade (such as only allowing addition operations) or access frequency limiting (such as ≤3 times per minute) is implemented for abnormal fields.

[0087] In response to the audit team's abnormal query, the system requires verification by the finance team, the third-party supervision platform (such as the third-party audit center) and the audit department (superior department). The finance team confirmed that it did not authorize the cross-project data merger, the supervision platform detected the query IP abnormality, and the audit department rejected the legality of the operation. The system then froze the calculation permission of the "project amount" field and updated the permission label through the smart contract. The audit team will not be able to perform any calculations on this field until the risk is resolved.

[0088] In summary, steps 101 to 105 achieve dynamic permission control of pre-audit data through collaborative encryption channels and joint keys, and combine security computing nodes with statistical analysis to ensure the credibility of results; use hierarchical threat baselines and risk confidence models to detect abnormal queries in real time, and respond to risks quickly through multi-party verification mechanisms. Ultimately, fine-grained protection of data in the entire process of transmission, calculation, and access is achieved to prevent unauthorized operations and data leakage, while supporting the audit department to efficiently complete compliance analysis.

[0089] In order to build a dynamic and intelligent data security protection system, this research and development plan realizes the full-cycle risk control of sensitive data access through multi-dimensional behavior analysis and adaptive baseline generation technology. By analyzing the ciphertext operation permissions to clarify the legal operation boundaries, combined with the internal and external access mode feature fusion calculation, the field access risk value is accurately quantified; using spatiotemporal feature modeling to capture abnormal fluctuations, establish a hierarchical early warning mechanism that automatically evolves with business scenarios, and finally form a dynamic protection strategy that takes into account both permission constraints and access behaviors, effectively identifies unauthorized operations and abnormal attacks, and improves data leakage protection capabilities while ensuring business fluency, solving the security control problem of traditional static strategies lagging behind complex access scenarios.

[0090] In some embodiments, in step 103, generating a hierarchical security threat baseline based on the ciphertext operation authority, the access frequency, and the acquired historical cross-department query records includes:

[0091] 201. Determine the operable range of each sensitive field according to the ciphertext operation permission, and extract the access times of the corresponding sensitive field within a preset period as the basic access volume;

[0092] In step 201, the ciphertext operation permission refers to the authorization range for performing specific operations on encrypted data. The sensitive field refers to a data unit that contains personal privacy or business secrets and other data that needs to be protected. The operable range refers to the data boundary that allows access or processing divided according to roles or departments. The basic access volume refers to the statistical value of the actual access times to the specified sensitive field within a fixed time period.

[0093] In the embodiment of the present application, first, extract the ciphertext decryption and operation permissions of each user group in the current system through the access control list, and divide the set of operable fields and the allowed operation types according to different permission levels. Secondly, screen out all access events to sensitive fields within the target period (for example, the past 30 days) in the permission audit log, and aggregate the access records of the same field according to the department dimension. Then use the sliding time window algorithm to cumulatively count the access times of each field, and set the window interval to the standard unit of the business cycle (such as divided by natural week). Finally, attach an attenuation coefficient to the statistical result according to the security level of the field to generate a normalized basic access volume matrix, which contains three-dimensional data of field ID, department affiliation, and weekly access times, providing a quantitative benchmark for subsequent analysis.

[0094] 202. Classify the historical cross-departmental query records, count the query times of each sensitive field involved in each category of queries, and generate a field query frequency distribution;

[0095] In step 202, the historical cross-departmental query record refers to the operation log of sensitive data retrieval initiated between different organizations. The query frequency distribution refers to a graph structure that reflects the probability of a field being externally called in different business scenarios. The field query frequency refers to the proportion value of the number of times a single sensitive field is requested by an external department to the total query volume.

[0096] In the embodiment of the present application, first, extract all cross-departmental query transactions based on the database audit log, use the improved FP-growth algorithm to perform association rule mining on these transactions, identify frequently co-occurring field combinations and construct a query pattern tree. Secondly, divide the query records into preset categories (such as compliance review, risk assessment, etc.) according to the characteristics of the business scenario, and calculate the core degree index of each field in different categories through the weighted PageRank algorithm. Then introduce a time decay factor to assign higher weights to recently occurred queries, and use the exponentially weighted moving average method to generate a time-series related query frequency matrix. Finally, combine the field permission change events, apply the hierarchical clustering algorithm to generate a dynamic frequency distribution histogram in sub-periods, and mark the hot periods of cross-system calls for each field.

[0097] 203. Weightedly fuse the base access volume and the field query frequency distribution, where the access frequency participates in the fusion calculation as a weight adjustment factor, to obtain the comprehensive access feature values of each sensitive field;

[0098] In step 203, the base access volume refers to the access intensity index generated by routine operations within the department. The field query frequency distribution refers to the pressure distribution pattern formed by external system requests. The access frequency refers to the occurrence rate of access requests per unit time. The weight adjustment factor refers to a coefficient system used to dynamically balance the influence of internal and external accesses. The comprehensive access feature value refers to a risk assessment index formed by fusing multi-dimensional access features.

[0099] In the embodiment of the present application, first, a three-dimensional tensor data structure (field × department × time) including the base access volume within the department and the external query frequency is constructed, and dimensionality reduction processing is performed through the t-SNE algorithm to obtain superimposable feature vectors. Secondly, an adaptive weight allocation module is designed. This module uses a long short-term memory network (LSTM) to analyze historical access patterns and dynamically calculate the weight coefficients of each department at the current position, where the reference weight for internal access is set to 0.6 ± the dynamic adjustment amount. Then, a convolutional neural network is used to extract features from the two types of data, and a deep reinforcement learning model is used to automatically optimize the fusion parameters. Finally, feature interaction is achieved through a bilinear pooling layer, and a comprehensive access feature matrix including spatio-temporal characteristics is output. Each element of this matrix represents the risk quantification value of a specific field at a specific time period.

[0100] 204. Establish a dynamic change curve with the time dimension as the horizontal axis and the comprehensive access feature value as the vertical axis, and extract the peak points and abnormal fluctuation points in the dynamic change curve as key nodes;

[0101] In step 204, the time dimension refers to a continuous time series divided by a fixed unit (such as hours / days). The dynamic change curve refers to the visual representation of the fluctuation of the comprehensive access feature value over time. The peak point refers to the mutation point of the feature value that exceeds three standard deviations of the moving average. The abnormal fluctuation point refers to a time series segment with continuous oscillations and an amplitude exceeding a preset threshold.

[0102] In the embodiment of the present application, first, the comprehensive access feature matrix is unfolded into a time-series data stream along the time dimension, and wavelet transform is applied for denoising processing and multi-scale time-series features are extracted. Secondly, a peak detection mechanism with a dynamic threshold is constructed: a sliding window (the default window size is 24 time units) is created to calculate the local mean and standard deviation, and when the feature value exceeds (μ + 3σ), it is marked as a candidate peak; at the same time, morphological filtering is used to eliminate false peaks. Then, a variational autoencoder (VAE) is used to construct a time-series reconstruction model, and the sum of squared residuals between the original sequence and the reconstructed sequence is calculated. When the residuals exceed the confidence interval for 5 consecutive cycles, it is determined as an abnormal fluctuation point. Finally, key nodes are marked on the spectrogram through a time-series segmentation algorithm to form a feature map with time stamps and fluctuation intensity values.

[0103] 205. According to the distribution law of the key nodes of each sensitive field, combined with the change record of the ciphertext operation permission, a hierarchical security threat baseline including a normal operation interval and an abnormal warning threshold is generated.

[0104] Wherein the abnormal warning threshold is dynamically adjusted according to the deviation degree between the highest eigenvalue and the average eigenvalue in the key nodes.

[0105] In step 205, the distribution law refers to the aggregation pattern and periodic characteristics of the key nodes on the time axis. The change record refers to the historical trajectory of permission version iteration and policy adjustment. The normal operation interval refers to the statistical confidence range of the feature values generated by compliant access. The abnormal warning threshold refers to the risk critical value for triggering the security mechanism. The deviation degree refers to the standardized difference between the extreme value and the average value.

[0106] In the embodiment of the present application, first, a mixture Gaussian model is constructed to fit the key node distribution, and the active period cycle of each sensitive field is extracted (for example, 09:00 - 11:00 every day is the high-incidence period). Secondly, the permission change time axis is aligned with the feature map, and a causal inference model is used to analyze the influence coefficient of policy adjustment on the access pattern. Then, a quantile regression algorithm is used to calculate the upper and lower boundaries of the normal operation interval, and a dynamic confidence level is set (the initial value is 95%). For the abnormal threshold, an adaptive algorithm based on information entropy is designed: when the relative error between the highest eigenvalue and the cycle mean exceeds the entropy value boundary, an exponentially weighted adjustment mechanism is started. Finally, a multi-dimensional baseline model of field - department - time is constructed through knowledge graph technology. This model includes a normal mode template library and a threshold optimizer based on a deep Q-network (DQN) to realize the continuous evolution of the hierarchical warning rules.

[0107] The following is a specific example:

[0108] Taking the bank customer credit investigation and evaluation system as an example, it involves sensitive data such as the customer's income certificate (field A), credit record (field B), transaction flow (field C), etc. In step 201, the basic access volume statistics of the risk control department show that the average weekly access volume of field A is 120 times, B is 85 times, and C is 60 times. In step 202, it is analyzed that the queries of external cooperation institutions mainly focus on post-loan management (category X) and anti-money laundering verification (category Y), and the query frequency of field B in category X reaches 72%. When fusing in step 203, considering the peak period of post-loan management, a weight of 0.7 is given to external queries, and the comprehensive feature values are generated: A(155), B(198), C(86). In step 204, it is detected that field B has a periodic peak value (feature value 315) on the 25th of each month, and at the same time, an abnormal fluctuation (amplitude exceeding the limit for 4 hours) is detected on March 12th. In step 205, combined with the permission change records in the past six months, a normal range [120 - 260] is set for field B, and when the real-time feature value exceeds 300, a secondary warning is triggered. The system finds that the access to field B by a certain branch on March 12th has increased sharply but there is no corresponding permission change. After verification, there is an unauthorized crawling behavior. This case fully demonstrates the whole-link risk identification process from basic data collection to dynamic baseline generation.

[0109] In summary, steps 201 to 205 realize a three-dimensional risk assessment of sensitive data access behaviors by constructing a multi-dimensional spatio-temporal fusion analysis model. Combining static permission control with dynamic access patterns, using the feature fusion algorithm to depict the spatio-temporal correlation of data flow, an adaptive security baseline generation mechanism is formed. The system can intelligently distinguish the normal fluctuations and potential threats in business scenarios, significantly improving the recognition accuracy and response timeliness of abnormal access. Through dynamic weight adjustment and hierarchical warning strategies, while ensuring business continuity, the excessive permission risk can be effectively controlled. The established closed-loop baseline evolution system can continuously optimize the protection strategy with the change of access patterns, and is especially suitable for business scenarios with complex cross-system data interaction requirements, providing dynamic security protection capabilities for the full life cycle management of sensitive data.

[0110] In some embodiments, as described in step 205, according to the distribution law of the key nodes of each sensitive field, combined with the change records of the ciphertext operation permissions, a hierarchical security threat baseline including a normal operation range and an abnormal warning threshold is generated, including:

[0111] 301. Extract the key nodes of each sensitive field within a preset time period, and calculate the deviation amplitude between the comprehensive access feature value corresponding to each key node and the historical average value;

[0112] In step 301, the key node refers to the time point with significant feature changes in the dynamic change curve. The deviation amplitude refers to the calculated value of the difference degree between the comprehensive access feature value and the average value of the same period in history. The historical average value refers to the average access feature of this field in multiple past cycles under the same time dimension.

[0113] In the embodiment of the present application, first, the marked peak points and abnormal fluctuation points are extracted from the dynamic change curve as the initial key node set. Secondly, the time series alignment technology is used to match the data of the current cycle and the previous six cycles within the same time window, and the absolute deviation between the feature value corresponding to each key node and the historical mean value of this period is calculated. Then, the improved Z-score normalization method is used to normalize the deviation value to eliminate the dimension difference of different fields. Finally, the extreme deviation values are smoothed and corrected by the sliding window mean replacement method to generate an abnormal event list with timestamps and the corrected deviation amplitude.

[0114] 302. Sort the deviation amplitudes by size, select the deviation amplitudes of the top preset proportion as the benchmark abnormal samples, and analyze the correlation between the benchmark abnormal samples and the change records of the ciphertext operation permissions at the corresponding time points to determine the influence coefficient of the permission change on the deviation amplitude;

[0115] In step 302, the benchmark abnormal sample refers to the set of abnormal events in the top 20% of the deviation amplitude ranking. The influence coefficient refers to the quantitative influence index of the permission change operation on the deviation degree of the feature value. The correlation analysis refers to verifying the causal relationship between the permission change and the abnormal fluctuation through statistical methods.

[0116] In the embodiment of the present application, first, the deviation amplitudes are arranged in descending order, and a dynamic truncation threshold (default taking the 20% quantile) is set to screen out the benchmark abnormal samples. Secondly, a permission change timeline graph is constructed, and the time correlation degree between the permission change events and the abnormal samples is calculated by the time overlap analysis method. Then, the difference-in-differences model (DID) is used to quantify the change amount of the deviation amplitude before and after the permission adjustment, and the Bayesian probability value of the influence coefficient is calculated for each sensitive field. Finally, the high-frequency co-occurring permission operation types and abnormal type combinations are discovered through the association rule mining algorithm (Aprior i) to generate a risk conduction relationship matrix at the field level.

[0117] 303. Adjust the benchmark deviation amplitude of each sensitive field according to the influence coefficient to generate a dynamic adjustment parameter;

[0118] In step 303, the benchmark deviation amplitude refers to the calculated value of the original deviation amount without adjustment. The dynamic adjustment parameter refers to the deviation calibration coefficient corrected according to the influence of the permission change.

[0119] In the embodiments of the present application, first, a mapping relationship table between influence coefficients and the deviation amplitude from the benchmark is established, and the linear regression model of the two is fitted by the least squares method. Second, an exponential decay compensation mechanism is designed to apply a compensation weight (default coefficient of 1.2 - 1.5 times) to the fields where permission changes have occurred in the most recent three months. Then, the gradient descent algorithm is used to optimize and adjust the parameters to minimize the false alarm rate of the corrected deviation amplitude on the validation set. Finally, an incremental update file containing field IDs, timestamps, and adjusted parameters is generated and takes effect in real time through the hot loading mechanism.

[0120] 304. Based on the dynamic adjustment parameters and historical normal operation data, calculate the upper limit of the normal operation interval and the lower limit of the abnormal warning threshold for each sensitive field respectively to generate a hierarchical security threat baseline including the normal operation interval and the abnormal warning threshold; wherein the lower limit of the abnormal warning threshold decreases as the dynamic adjustment parameter increases, and a buffer transition zone is set between the upper limit of the normal operation interval and the lower limit of the abnormal warning threshold.

[0121] In step 304, the buffer transition zone refers to the risk gradual change area between the normal and abnormal states. The lower limit of the threshold refers to the lowest risk critical value for triggering a warning. The upper limit of the interval refers to the maximum characteristic fluctuation value allowed for compliant operations.

[0122] In the embodiments of the present application, first, a Gaussian kernel density estimation model is constructed based on historical normal data, and the 99% confidence interval of the eigenvalue distribution is calculated as the initial interval upper limit. Second, the dynamic adjustment parameter is input into the LSTM prediction network to generate the predicted values of the lower limit of the threshold for the next three cycles. Then, a dual - threshold trigger mechanism is designed: when the real - time eigenvalue exceeds the upper limit of the interval, an alarm is immediately issued, and the observation mode is started when entering the buffer zone. Finally, the stability of the baseline is verified through Monte Carlo simulation, and an adaptive shrinkage algorithm (adjusted by ±5% per week) is implemented for the range of the transition zone to form the final hierarchical security threat baseline configuration file.

[0123] The following is a specific example:

[0124] In the government affairs data sharing platform, sensitive information such as residents' social security records (field D), marriage registration (field E), and real estate registration (field F) is involved. In step 301, it is analyzed that field D shows a periodic peak at 9-10 am every Monday, and its deviation amplitude reaches 1.8 times the historical average. After screening out the top 20% of abnormal samples in step 302, it is found that 63% of the abnormal fluctuations of field E occur within 48 hours after batch permission granting. In step 303, a 1.3-fold adjustment parameter is assigned to such events to reduce misjudgment caused by relaxed permissions. When generating the baseline in step 304, the upper limit of the normal range of field D is set to 220, and the buffer zone is 220-250. When the real-time value exceeds 250, an early warning is triggered. During a certain monitoring, it is found that the eigenvalue of field F suddenly increases to 265 during non-working hours, and the system immediately starts a secondary response. After tracing, it is found that it is an unauthorized third-party interface call. This mechanism effectively distinguishes the marriage data synchronization of the Civil Affairs Bureau (normal value 230) from illegal crawling behavior and achieves precise prevention and control.

[0125] In summary, steps 301 to 304 achieve the intelligent evolution of the security baseline by establishing a quantitative model of permission impact and a dynamic parameter adjustment mechanism. The threshold generation method based on time correlation analysis and statistical modeling effectively improves the scenario adaptability of anomaly detection. The buffer transition zone design takes into account both the business fluctuation tolerance and security sensitivity, and the hierarchical response mechanism reduces the interference of misoperations. The dynamic calibration system enables the security policy to be automatically optimized with permission changes, forming a continuously evolving data protection ability to ensure the compliant use of sensitive data under a complex permission system.

[0126] In some embodiments, as described in step 104, through the collaborative encrypted transmission channel, the data operation deviation between the high-frequency cross-project query operations requested by the audit department and the statistical results is associated. After the association, when it is detected that the query operation deviates from the hierarchical security threat baseline, the risk confidence level is calculated based on the data operation deviation, including:

[0127] 401. Through the collaborative encrypted transmission channel, obtain the query request sequence of the audit department for multiple budget projects within a unit time, and extract the sensitive fields involved in each query request and their access timestamps;

[0128] In step 401, the collaborative encrypted transmission channel refers to a data transmission link using a multi-party secure computing protocol. The query request sequence refers to an ordered set of data retrieval operations initiated by the audit department within a specific time period. The sensitive field refers to a data item such as the fund details involved in the budget project that needs to be protected. The access timestamp refers to an accurate time mark recording the moment when the query operation occurs.

[0129] In the embodiments of the present application, first, an encrypted channel is established to connect to the audit system through TLS mutual authentication, and the streaming processing technology is used to capture query messages in JSON format in real time. Secondly, the header information of the message is parsed to obtain the department identifier and the query type, and the budget item codes involved in the request body and the list of associated sensitive fields are extracted. Then, a time window splitter (default sliced by 15 minutes) is used to normalize the timestamps, generating a field access trajectory with time sequence tags. Finally, after deduplication through a Bloom filter, a structured query sequence record set is output, including a triple of project number, field identifier, and timestamp accurate to milliseconds.

[0130] 402. Match the query request sequence with the statistical results of the corresponding budget item, calculate the numerical difference between the query result corresponding to each query request in the query request sequence and the statistical results, and generate a query deviation record, which includes the query frequency and the query deviation value.

[0131] In step 402, the statistical result refers to the official accounting value of the budget item after passing the legal approval process. The query deviation value refers to the absolute difference measurement value between the audit query result and the official statistical value. The query frequency refers to the number of repeated queries for a specific field per unit time.

[0132] In the embodiments of the present application, first, the query sequence is associated and matched with the pre-audit database by the primary key, and the distributed connector is used to obtain the official statistical value corresponding to each query. Secondly, a difference calculation engine is designed, and the relative error algorithm (|query value - statistical value| / statistical value) is used for numerical fields, and the cosine similarity metric is applied to categorical fields. Then, a sliding counter is constructed to count the query frequency of each field within the time window, and the frequency value and the deviation value are combined into a two-dimensional vector. Finally, the extreme deviations are filtered through an outlier correction module (using the MAD median absolute deviation method), generating a standardized deviation record table including the project number, deviation value, and frequency value.

[0133] 403. Establish a two-dimensional distribution graph with the query frequency as the horizontal axis and the query deviation value as the vertical axis, and identify the abnormal query points deviating from the preset normal interval in the two-dimensional distribution graph.

[0134] In step 403, the two-dimensional distribution graph refers to a spatial mapping visualization model reflecting the query behavior characteristics. The preset normal interval refers to the elliptical confidence region formed by historical compliant queries. The abnormal query points refer to the data distribution points beyond the boundary of the confidence region.

[0135] In the embodiments of the present application, first, the probability distribution surface of query behavior is constructed by using the Kernel Density Estimation (KDE) algorithm, and the boundary of the normal area is delimited at a 99% confidence level. Secondly, the Isolation Forest unsupervised learning algorithm is used to detect outliers in the distribution points and mark the candidate outliers. Then, the DBSCAN clustering algorithm is used to verify the spatial aggregation of the outliers and exclude isolated noise points. Finally, combined with time series analysis, the points that appear in the abnormal area for more than three window periods are intensively marked to generate a scatter plot matrix with risk levels.

[0136] 404. For each abnormal query point, calculate the initial risk value according to the degree of deviation of the abnormal query point from the hierarchical security threat baseline, and configure the corresponding weight coefficient based on the ciphertext operation permission of the sensitive field to correct the initial risk value to obtain the corrected risk value.

[0137] In step 404, the initial risk value refers to the basic risk assessment value calculated based on the degree of deviation. The weight coefficient refers to the risk amplification factor configured according to the field confidentiality level and operation permission. The corrected risk value refers to the final risk assessment index after permission weighting.

[0138] In the embodiments of the present application, first, determine the Euclidean distance between the abnormal point and the baseline according to the hierarchical security threat baseline, and map it to the initial risk value in the 0-1 interval through the Sigmoid function. Secondly, construct a permission weight matrix, set a weight coefficient of 1.5-3 times for high-confidentiality fields (such as those involving personal privacy), and set it to 1 time for ordinary business fields. Then, design a risk conduction model. When the query involves a combination of cross-permission fields, the multiplication rule is used to calculate the composite weight. Finally, a risk value limiter is used to prevent numerical overflow, and the exponential smoothing method is applied to buffer the suddenly increased risk value, and a corrected risk list with weight identification is output.

[0139] 405. Calculate the cumulative sum of the corrected risk values of multiple consecutive abnormal query points in the order of query time. When the cumulative value exceeds the dynamic threshold, generate a risk confidence level; wherein the dynamic threshold is adaptively adjusted according to the activity of the current collaborative encryption transmission channel and historical risk records.

[0140] In step 405, the cumulative value refers to the time-series superposition amount of the risk values of consecutive abnormal events. The dynamic threshold refers to the warning line that changes with the environmental risk index. The risk confidence level refers to the certainty evaluation level of the suspicious behavior chain.

[0141] In the embodiments of the present application, first, a sliding accumulator is created (the default window is 6 consecutive queries), and the corrected risk value is accumulated in real time and the moving average is calculated. Secondly, a channel activity index is constructed, and based on the current concurrent connection number and data traffic scale, the threshold baseline is predicted through a linear regression model. Then, a two-factor adjustment mechanism is designed: when the number of similar patterns in the historical risk records exceeds 3 times, the threshold is automatically reduced by 20%; when the channel encryption level is increased, the threshold is increased by 15%. Finally, the probability of the cumulative value exceeding the limit is calculated through Bayesian inference. When the probability exceeds 85%, a high-confidence warning is generated, triggering the audit review process.

[0142] The following is a specific example:

[0143] In the scenario of the municipal financial budget audit, the audit team queries the budget execution data such as education infrastructure construction (Project X) and medical subsidies (Project Y) through the collaborative channel. Step 401 captures an intensive query (7 visits within 10 minutes) for the "equipment procurement details" field in Project X. Step 402 compares and finds that the deviation between a certain query result and the statistical value reaches 38%, generating a high-deviation record. Step 403 identifies that the query point in the distribution map exceeds the normal area by 2.7 standard deviations. Step 404 calculates the initial risk value of 0.82. Since this field belongs to high-classified information, the corrected value is 1.64 after applying a weight of 2 times. Step 405 monitors and finds that the corrected values of the subsequent 3 queries are 1.55, 0.93, and 1.21 respectively, and the cumulative value reaches 4.33. At this time, the system lowers the dynamic threshold from 5.0 to 4.2 according to the channel activity (the current connection number surges by 50%), triggering a risk confidence warning. After verification, this abnormal sequence stems from unauthorized data scraping behavior, and the system promptly blocks the suspicious session.

[0144] In summary, steps 401 to 405 realize the deep risk perception of audit query behaviors by constructing a multi-dimensional association analysis model. The dynamic threshold adjustment mechanism effectively responds to complex environmental changes, and the continuous risk accumulation algorithm accurately identifies hidden attack chains. The permission weight system strengthens the protection of high-classified data, and the spatial distribution model improves the ability to discover abnormal patterns. The whole set of methods forms a complete risk control chain from single abnormal detection to continuous behavior judgment, significantly improving the data anti-disclosure ability in the budget audit scenario, and ensuring the secure circulation and use of sensitive financial information within the scope of compliance.

[0145] In some embodiments, as described in step 102, according to the risk confidence, multi-party verification is performed on the transmission path corresponding to the query operation, and according to the verification result, a collaborative warning message is sent to the budget unit, and the ciphertext operation permission of the sensitive field associated with the abnormal query operation in the collaborative encryption transmission channel is dynamically restricted, including:

[0146] 501. Determine the number of budget units that need to participate in the verification according to the risk interval of the risk confidence level, wherein the higher the risk confidence level, the more budget units that need to participate;

[0147] In step 501, the risk confidence level refers to the quantitative assessment value of the risk level of the suspicious operation by the system. The risk interval refers to the segmented intervals that divide the risk value into different levels. The budget unit refers to the enterprise department or related institution that participates in the budget audit.

[0148] In the embodiment of the present application, a risk level mapping table is first established, and the risk confidence is divided into three intervals of low (<30), medium (30-70), and high (>70) according to a score of 0-100. Secondly, a dynamic sampling algorithm is designed to automatically trigger the maximum verification range for the high-risk interval (the default is 80% associated units), stratified sampling (30%-50% units) for medium risk, and 10% of units are randomly selected for low risk. Then, the business correlation between budget units is analyzed through the organizational structure map, and units that have a direct business relationship with the checked field are given priority. Finally, a task distribution queue is generated that includes a list of units to be verified and a verification priority ranking.

[0149] 502. Send a verification request to the determined budget unit, the verification request including characteristic information of the abnormal query operation and the associated sensitive field identifier, and receive the verification response returned by each budget unit, and count the proportion of confirmed abnormalities in the verification response as the verification credibility;

[0150] In step 502, the verification request refers to a data packet containing abnormal behavior characteristics. The verification response refers to the confirmation feedback of the budget unit on the abnormal operation. The verification credibility refers to the proportion of the participating units confirming the abnormality.

[0151] In the embodiment of the present application, a multi-factor verification message is first constructed, which includes feature vectors such as anomaly timestamps, field fingerprints, and deviation value curves. Secondly, the threshold signature technology is used to encrypt and sign the request, and then send it to the selected unit through the government-specific network channel. Then a response incentive mechanism is designed to give credit points to units that provide feedback within 24 hours. Finally, the weighted statistical method is used to calculate the credibility: the feedback weight of directly related units is 1.5, and the weight of indirectly related units is 0.8. When (confirmed anomaly number × weight) / total feedback number ≥ 75%, the credibility is considered to meet the standard.

[0152] 503. When the verification credibility exceeds a preset threshold, a collaborative alarm message including detailed information of the abnormal query operation is generated and sent to the relevant budget unit;

[0153] In step 503, the coordinated alarm information refers to a composite early warning message after confirmation by multiple parties. The preset threshold refers to the minimum confirmation ratio for triggering a cross-department alarm.

[0154] In the embodiment of the present application, the feedback details of each unit are first integrated, and a multi-dimensional alarm report containing abnormal patterns, involved units, and risk levels is automatically written using natural language generation technology. Secondly, a blockchain evidence storage node is constructed to solidify the key feature values of the alarm information on the chain. Then, the alarm recipient is selected through an intelligent routing algorithm, and is pushed to the competent department of the field and the nearest operating unit first. Finally, a risk disposal knowledge graph is attached, and a reference to the disposal plan for similar historical cases is embedded in the alarm information.

[0155] 504. Determine the range of sensitive fields that need to be restricted according to the combined value of the risk confidence and the verification credibility, and adjust the operation permission identifier corresponding to the sensitive field in the joint key;

[0156] In step 504, the combined value refers to the weighted calculation result of the risk and the verification credibility. The joint key refers to the distributed authority control key maintained by multiple parties. The operation authority identifier refers to the mark bit in the key that controls the operability of the field.

[0157] In the embodiment of the present application, a risk-credibility matrix model is first designed. When the combined value exceeds the critical line (such as 70 points of risk + 80% of credibility), the three-level permission restriction strategy is triggered. Secondly, the Shamir secret sharing scheme is used to reconstruct the joint key, and the permission identifier of the target field is modified by bit operation. Then the smart contract is deployed to automatically execute the restriction rules: decryption operations are prohibited for core fields, and aggregate queries are restricted for general fields. Finally, the permission changes are synchronized to relevant units through zero-knowledge proof technology to ensure the consistency of the key status of each node.

[0158] 505. Monitor the subsequent access behavior of the restricted field in real time, and when it is detected that the access behavior returns to normal, gradually restore the operation permissions of the restricted field.

[0159] In step 505, gradual recovery refers to a progressive mechanism of relaxing authority restrictions in stages. Returning to normal means that no abnormal features appear during the continuous monitoring period.

[0160] In the embodiment of the present application, firstly, a sliding window of the observation period is established (the default is 7 days × 3 cycles), and a behavior scorecard is designed to score the compliance of each visit. Secondly, a reinforcement learning model is used to dynamically adjust the recovery rhythm: when the score reaches excellent (≥90 points) for 3 consecutive days, 50% of the permissions are restored, and an additional 25% is added every 2 days after the standard is met. Then a fuse mechanism is set up. If it is found that the single-day score is lower than 70 points during the recovery process, it will immediately fall back to the previous stage. Finally, full recovery is confirmed through multi-party voting, and at least 60% of the related units must agree to lift all restrictions.

[0161] Here is a specific example:

[0162] In the scenario of provincial medical insurance fund auditing, the system detected an abnormal query for the "special drug procurement" field (it was determined at step 501 that high risks required verification of 12 out of 15 local medical insurance bureaus). At step 502, a verification request was sent to 12 medical insurance bureaus, and 9 units confirmed the existence of unauthorized query behavior (verification credibility of 75%). At step 503, a collaborative alarm was generated, indicating that the anomaly involved system vulnerabilities in 3 cities. At step 504, since the combined value reached the warning line, the detailed query function for this field was immediately restricted, and only the aggregation statistics permission was retained. At step 505, after monitoring and discovering that the involved units had repaired the vulnerabilities, the behavior scores continuously met the standards for 8 consecutive days. First, 50% of the permissions were restored to allow monthly summary queries, and on the 15th day, detailed access was fully opened. The entire process formed a complete closed-loop of "detection - verification - handling - recovery", effectively blocking the risk of data leakage.

[0163] In summary, steps 501 to 505 achieve the precision and humanization of data security protection by constructing a multi-party collaborative verification mechanism and a dynamic permission recovery system. The intelligent sampling driven by risk confidence improves the verification efficiency, and the blockchain evidence storage ensures that the alarms cannot be tampered with. The flexible control of the joint key balances security and business requirements, and the progressive recovery mechanism promotes the implementation of rectification. The entire set of methods forms a complete closed-loop from risk identification to disposal optimization, minimizing the impact on compliance operations while ensuring data security, and is particularly applicable to complex scenarios such as cross-department collaborative auditing, significantly enhancing the collaborative governance ability of sensitive data protection.

[0164] In some embodiments, as described in step 103, the security operation node performs variance calculation and regression analysis on the pre-audit data according to the joint key to generate statistical results verifiable by the auditing department, including:

[0165] 601. Extract the numerical fields in the pre-audit data that allow operations according to the joint key, and classify the numerical fields into multiple data groups according to budget items;

[0166] In step 601, the joint key refers to a distributed decryption permission key jointly controlled by multiple parties. The numerical field refers to data items such as amounts and quantities in the pre-audit data that can perform mathematical calculations. The data group refers to a set of fields divided according to budget items.

[0167] In the embodiments of the present application, first, the joint key is activated through a threshold decryption mechanism, and the encrypted meta-information of the pre-audit data is parsed to obtain a whitelist of operable fields. Secondly, the regular expression matching technology is used to screen out the fields containing digital features and exclude text description information. Then, an improved K-means clustering algorithm is used to perform multi-dimensional grouping according to the budget item code and the fund flow label. Finally, a set of data groups with permission identifiers is generated, and each group contains the project number, a list of allowed operation fields, and the field value range constraint conditions.

[0168] 602. Calculate the deviation degree between all numerical fields in each of the said data groups and the average value of the corresponding budget item to obtain a first intermediate result;

[0169] In step 602, the deviation degree refers to the standardized difference between a single value and the average value of its belonging item. The first intermediate result refers to a set of quantitative indicators reflecting the distribution balance of field values.

[0170] In the embodiments of the present application, first, a temporary calculation sandbox is established for each data group, and a field value matrix is loaded. Secondly, a robust statistical method is used to calculate the anti-interference average value (the average value after removing the extreme values in the first 10% and the last 10%). Then, an improved Z-score algorithm is used to calculate the standardized deviation value of each field, and the outlier values beyond the 3σ range are marked. Finally, a three-dimensional intermediate result matrix containing field numbers, deviation values, and outlier marks is generated, and the result is ensured to be tamper-proof through digital signature.

[0171] 603. Analyze the distribution trend of the said numerical fields over time based on the first intermediate result to obtain a second intermediate result;

[0172] In step 603, the distribution trend refers to the change rule of the numerical fields in the time dimension. The second intermediate result refers to a composite data structure containing time series feature analysis.

[0173] In the embodiments of the present application, first, the data group is sliced and reorganized by quarter into a time series data set. Secondly, the STL decomposition algorithm (seasonal trend decomposition) is used to separate the trend term, periodic term, and residual term. Then, an LSTM neural network model is constructed to predict the numerical trend in the next three periods, and the dynamic deviation degree between the actual value and the predicted value is calculated. Finally, a second intermediate result with time series feature encoding is generated, including a 12-dimensional feature vector such as trend slope, periodic amplitude, and residual volatility.

[0174] 604. Combine the first intermediate result and the second intermediate result according to a preset weight to generate a statistical sub-result of the data group;

[0175] In step 604, the preset weight refers to a combination of balance coefficients set according to the importance of auditing. The statistical sub-result refers to an intermediate auditing indicator after multi-dimensional fusion.

[0176] In the embodiments of the present application, first, a dynamic weight allocator is designed to assign a base weight of 0.6 to recent data (within 3 months) and a weight of 0.4 to historical data. Secondly, a feature fusion model is constructed to perform Pearson correlation analysis on the deviation value of the first intermediate result and the trend slope of the second intermediate result to generate an adaptive combination coefficient. Then, the weighted Mahalanobis distance algorithm is used to calculate the comprehensive statistic, and a risk correction factor is applied to the values exceeding the confidence interval. Finally, a list of statistical sub-results including project numbers, comprehensive scores, and risk level labels is output.

[0177] 605. Aggregate the statistical sub-results of all data groups, and filter out unauthorized fields in the statistical sub-results according to the scope of authority of the joint key to generate the statistical results verifiable by the audit department.

[0178] In step 605, the scope of authority refers to the visualized data boundary defined in the joint key. The verifiable statistical result refers to the draft audit report confirmed by the multi-party consensus mechanism.

[0179] In the embodiments of the present application, first, a result filtering pipeline is established to remove unauthorized data items according to the field access permission bitmap in the key. Secondly, differential privacy protection is implemented to add Gaussian noise conforming to (ε,δ)-differential privacy to sensitive statistical values. Then, a Merkle tree is used to construct a verifiable data structure, enabling the audit department to verify the result integrity without accessing the original data. Finally, a multi-party electronic signature process is initiated through a smart contract to generate a final audit report with a timestamp and multi-party digital fingerprints.

[0180] The following is a specific example:

[0181] In the scenario of provincial education funds audit, there are 200 school infrastructure projects (Project G) and 500 teaching equipment procurement projects (Project H). After decrypting through the joint key in step 601, 18 numerical fields such as "project payment amount" (field M) in Project G and "equipment procurement unit price" (field N) in Project H are extracted. In step 602, it is calculated that there are 3 payments in field M deviating from the average by up to 65%, which are marked as abnormal payments. In step 603, the analysis shows that the unit price of Project H shows abnormal quarterly fluctuations (a sudden increase of 40% in Q3). In step 604, the deviation degree (weight 0.7) is combined with the trend anomaly (weight 0.3) to generate a risk score of 82 points (high risk) for Project G and a score of 68 points (medium risk) for Project H. After filtering out the unauthorized "supplier bank account" field in step 605 and adding privacy noise, the final statistical table is generated: the overspending rate of Project G is 23% ± 1.5%, and the price volatility of Project H is 37% ± 2.1%. After the audit department verifies the data integrity through Merkle proofs, 3 projects suspected of false reporting are locked for on-site verification.

[0182] In summary, steps 601 to 605 achieve the compliance processing of sensitive pre-reviewed data by constructing an intelligent analysis pipeline under permission constraints. The dynamic weight fusion mechanism enhances the spatio-temporal correlation of anomaly detection, and the differential privacy technology balances data utility and privacy protection. The multi-level filtering with joint key control ensures compliance throughout the data processing, and the verifiable data structure enhances the credibility of the audit results. The whole set of methods forms a secure closed-loop from data decryption to report generation, strictly protecting data privacy while meeting the cross-departmental audit requirements, and is particularly applicable to public fund supervision scenarios such as education and medical care, significantly improving the accuracy and credibility of budget audits.

[0183] In some embodiments, as described in step 101, generating a joint key between the budget unit and the audit department to dynamically configure the ciphertext operation permission of the sensitive field according to the joint key includes:

[0184] 701. Obtain the first key component of the budget unit and the second key component of the audit department, splice the first key component and the second key component to generate an initial joint key;

[0185] In step 701, the first key component refers to a partial key element held by the budget unit. The second key component refers to a complementary key element held by the audit department. The initial joint key refers to the unadjusted original key formed by key splicing.

[0186] In the embodiment of the present application, first, the ECC private key fragment of the budget unit and the RSA private key fragment of the audit department are respectively obtained through a secure hardware module. Secondly, threshold signature technology is used to fragment the two key components, and the Shamir secret sharing algorithm is used to generate spliceable key components. Then, the secure splicing of the key components is completed within a trusted execution environment, and bilinear pair operations are applied to verify the mathematical compatibility of the keys. Finally, an initial joint key seed is generated through the key derivation function HKDF, and a 256-bit initial key is output and stored in a tamper-proof security area.

[0187] 702. Based on the budget item identifier of the budget unit and the audit authority identifier of the audit department, iteratively adjust the initial joint key to generate a joint key;

[0188] In step 702, the budget item identifier refers to a coded string that uniquely identifies a specific budget item. The audit authority identifier refers to a digital certificate that represents the operation scope of the audit department. Iterative adjustment refers to the process of enhancing the key security through multiple cryptographic transformations.

[0189] In the embodiment of the present application, first, the budget item identifier is subjected to SM3 hashing operation to generate a 256-bit project feature digest. Second, the audit permission identifier generates a key stream through the national cryptography algorithm ZUC, and performs a bitwise exclusive OR operation with the initial combined key. Then, the Argon2d algorithm is applied for multiple rounds of iterative adjustment (default 3 rounds), and different segments of the project feature digest are introduced as salt values in each round. Finally, HMAC-SHA256 is used to generate the fingerprint verification code of the final combined key, completing the permission binding and strength enhancement of the key.

[0190] 703. Extract sensitive fields from the pre-audit data according to the budget item identifier, and assign a field identifier to each sensitive field;

[0191] In step 703, the sensitive field refers to a data unit that needs to be protected, such as a fund amount. The field identifier refers to an encrypted hash value that uniquely identifies a specific field.

[0192] In the embodiment of the present application, first, the meta-information description file of the pre-audit data is loaded, and regular expressions are used to match the amount fields (such as columns containing keywords such as "amount" and "unit price"). Second, the SHA-256 is applied to the matched fields to generate a fixed-length field fingerprint, and additional data classification labels (such as PII, financial data, etc.) are attached. Then, a Bloom filter is constructed to quickly retrieve the sensitive fields, generating a list of field identifiers with version numbers. Finally, the list of identifiers is protected against tampering through digital signature technology and stored in the blockchain evidence storage node.

[0193] 704. Bind the field identifier to the combined key to generate a ciphertext operation permission identifier corresponding to each sensitive field;

[0194] In step 704, the ciphertext operation permission identifier refers to a digital label that controls the computable attributes of the field. Binding refers to establishing a cryptographic association between the field identifier and the key permission.

[0195] In the embodiment of the present application, first, the combined key is decomposed into permission control bit segments, and each bit segment corresponds to a specific type of operation permission (such as additive homomorphism, aggregation statistics). Second, zero-knowledge proof technology is used to generate a proof of the correspondence between the field identifier and the key bit segment. Then, a smart contract is deployed to automatically verify the matching of the field identifier and the key permission when a legal operation request is detected. Finally, a time-lock permission token containing the field fingerprint, the allowed operation type, and the validity period is generated and encrypted with quantum random numbers and written into the distributed ledger.

[0196] 705. Dynamically adjust the ciphertext operation permission identifier according to the audit permission identifier, so that the audit department can only perform ciphertext operations on the sensitive fields allowed by the audit permission identifier.

[0197] In step 705, dynamic adjustment refers to a mechanism for modifying the scope of permissions in real time according to changes in the audit task.

[0198] In the embodiments of the present application, first, a permission policy engine is constructed to monitor the status change events of audit permission identifiers in real time. Secondly, an Attribute-Based Access Control (ABAC) model is designed, and when the audit task expires or the scope changes, the key renegotiation process is automatically triggered. Then, a forward-secure key update protocol is adopted to perform rolling updates on the permission identifiers of the affected fields. Finally, the permission policies of each node are synchronized through the Lightweight Directory Access Protocol (LDAP) to ensure the real-time and consistency of permission adjustment.

[0199] The following is a specific example:

[0200] In the scenario of central enterprise budget audit, a certain group's financial system (budget unit) holds the pre-audit data of project K. In step 701, the financial system provides the ECC key component, and the audit department provides the RSA component to generate the initial joint key. In step 702, the final joint key is iteratively generated by combining the identifier of project K (SM3 hash value) and the "degree of business audit" permission identifier of the audit department. In step 703, sensitive fields such as "overseas investment amount" (field P) and "R & D expenditure" (field Q) are extracted to generate field fingerprints. In step 704, field P is bound to the joint key to allow additive homomorphic operations. In step 705, when the audit scope changes to only R & D projects, the operation permission of field P is automatically revoked. During the audit process, when the system detects an unauthorized aggregation query request for field P, it immediately blocks and generates an audit log.

[0201] In summary, steps 701 to 705 achieve fine-grained ciphertext operation permission control by constructing a multi-party collaborative key management system. The dynamic key adjustment mechanism ensures the real-time matching of permissions and audit requirements, and the attribute-based access model improves the flexibility of the policy. The field-level permission binding and blockchain evidence storage technology form a traceable permission track, and quantum encryption enhances the protection intensity of core data. The whole method meets the audit compliance requirements while ensuring the confidentiality of pre-audit data, effectively preventing unauthorized operations, and is especially suitable for the cross-departmental audit scenario between government and enterprises, significantly improving the refined management level of sensitive data processing.

[0202] Figure 2 The following is a schematic structural diagram of a security monitoring system for a financial information service platform provided by the embodiments of the present application, as Figure 2 shown, the system includes:

[0203] A construction module 21, configured to establish a collaborative encryption transmission channel between the budget unit and the audit department, and generate a joint key between the budget unit and the audit department to dynamically configure the ciphertext operation permissions of sensitive fields according to the joint key;

[0204] An operation module 22 is configured to transmit the pre-audit data of the budget unit to a secure operation node through the collaborative encryption transmission channel, so that the secure operation node performs variance calculation and regression analysis on the pre-audit data according to the joint key, generates statistical results verifiable by the audit department, synchronously binds the statistical results with the ciphertext operation permission, and updates the access frequency of the sensitive fields at the same time;

[0205] A generation module 23 is configured to generate a hierarchical security threat baseline based on the ciphertext operation permission, the access frequency, and the obtained historical cross-department query records;

[0206] An association module 24 is configured to associate, through the collaborative encryption transmission channel, the query operations with high frequencies across projects requested by the audit department with the data operation deviation of the statistical results. After the association, when it is detected that the query operations deviate from the hierarchical security threat baseline, calculate the risk confidence level based on the data operation deviation;

[0207] A verification module 25 is configured to perform multi-party verification on the transmission path corresponding to the query operations according to the risk confidence level, send collaborative warning information to the budget unit according to the verification result, and dynamically restrict the ciphertext operation permission of the sensitive fields associated with the abnormal query operations in the collaborative encryption transmission channel.

[0208] Figure 2 The security monitoring system of the financial information service platform described above can execute Figure 1 The security monitoring method of the financial information service platform described in the embodiments shown. The implementation principle and technical effects will not be elaborated here. For the security monitoring system of the financial information service platform in the above embodiments, the specific manners in which each module and unit perform operations have been described in detail in the embodiments related to the method, and will not be elaborated here.

[0209] In a possible design, Figure 2 The security monitoring system of the financial information service platform described in the embodiments shown can be implemented as a computing device, as Figure 3 shown. The computing device can include a storage component 31 and a processing component 32;

[0210] The storage component 31 stores one or more computer instructions, where the one or more computer instructions are called and executed by the processing component 32.

[0211] The processing component 32 is used for the security monitoring method of the financial information service platform described in the above Figure 1 embodiments.

[0212] Among them, the processing component 32 may include one or more processors to execute computer instructions to complete all or part of the steps in the above-mentioned method. Of course, the processing component may also be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors or other electronic components for executing the above-mentioned method.

[0213] The storage component 31 is configured to store various types of data to support the operation of the terminal. The storage component can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0214] Of course, the computing device may also necessarily include other components, such as an input / output interface, a display component, a communication component, etc.

[0215] The input / output interface provides an interface between the processing component and the peripheral interface module, and the above-mentioned peripheral interface module may be an output device, an input device, etc.

[0216] The communication component is configured to facilitate communication between the computing device and other devices in a wired or wireless manner, etc.

[0217] Among them, the computing device may be a physical device or an elastic computing host provided by a cloud computing platform, etc. At this time, the computing device may refer to a cloud server, and the above-mentioned processing component, storage component, etc. may be basic server resources leased or purchased from a cloud computing platform.

[0218] The embodiment of the present application also provides a computer storage medium storing a computer program, and when the computer program is executed by a computer, it can implement the Figure 1 security monitoring method of a financial information service platform shown in the above-mentioned

[0219] Those skilled in the art can clearly understand that for the convenience and brevity of description, the specific working processes of the above-described systems, devices, and units can refer to the corresponding processes in the foregoing method embodiments and will not be elaborated herein.

[0220] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art can understand and implement it without creative efforts.

[0221] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on such an understanding, the essence of the above technical solution, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions for causing a computer device (which can be a personal computer, server, or network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0222] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, and are not intended to limit them. Although the present application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or perform equivalent replacements for some of the technical features. And these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A security monitoring method for a financial information service platform, characterized in that, Including: Establish a collaborative encryption transmission channel between the budget unit and the audit department, and generate a joint key between the budget unit and the audit department to dynamically configure the ciphertext operation permissions of sensitive fields according to the joint key; Transmit the pre-audit data of the budget unit to the secure operation node through the collaborative encryption transmission channel, so that the secure operation node performs variance calculation and regression analysis on the pre-audit data according to the joint key, generates a statistical result verifiable by the audit department, synchronously binds the statistical result with the ciphertext operation permission, and updates the access frequency of the sensitive field at the same time; Generate a hierarchical security threat baseline based on the ciphertext operation permission, the access frequency, and the obtained historical cross-department query records; Associate the query operation with high frequency across projects requested by the audit department through the collaborative encryption transmission channel with the data operation deviation of the statistical result. After association, when it is detected that the query operation deviates from the hierarchical security threat baseline, calculate the risk confidence level based on the data operation deviation; Perform multi-party verification on the transmission path corresponding to the query operation according to the risk confidence level, send collaborative alarm information to the budget unit according to the verification result, and dynamically restrict the ciphertext operation permissions of the sensitive fields associated with the abnormal query operation in the collaborative encryption transmission channel.

2. The method according to claim 1, characterized in that, The generating a hierarchical security threat baseline based on the ciphertext operation permission, the access frequency, and the obtained historical cross-department query records includes: Determine the operable range of each sensitive field according to the ciphertext operation permission, and extract the number of accesses of the corresponding sensitive field within a preset period as the basic access volume; Classify the historical cross-department query records, count the number of queries involving each sensitive field in each type of query, and generate a field query frequency distribution; Perform weighted fusion on the basic access volume and the field query frequency distribution, where the access frequency participates in the fusion calculation as a weight adjustment factor, and obtain the comprehensive access feature value of each sensitive field; Establish a dynamic change curve with the time dimension as the horizontal axis and the comprehensive access feature value as the vertical axis, and extract the peak points and abnormal fluctuation points in the dynamic change curve as key nodes; Generate a hierarchical security threat baseline including a normal operation interval and an abnormal warning threshold according to the distribution law of the key nodes of each sensitive field, combined with the change record of the ciphertext operation permission, where the abnormal warning threshold is dynamically adjusted according to the deviation degree between the highest feature value and the average feature value in the key nodes.

3. The method according to claim 2, wherein The generating a hierarchical security threat baseline including a normal operation interval and an abnormal warning threshold according to the distribution law of the key nodes of each sensitive field, combined with the change record of the ciphertext operation permission, includes: Extract the key nodes of each sensitive field within a preset time period, and calculate the deviation amplitude between the comprehensive access feature value corresponding to each key node and the historical average value; Sort the deviation amplitudes in descending order, select the deviation amplitudes of the first preset proportion as the reference abnormal samples, and analyze the correlation between the reference abnormal samples and the change record of the ciphertext operation permission at the corresponding time points to determine the influence coefficient of the permission change on the deviation amplitude; Adjust the baseline deviation amplitude of each sensitive field according to the influence coefficient to generate dynamic adjustment parameters; Based on the dynamic adjustment parameters and historical normal operation data, calculate the upper limit of the normal operation range and the lower limit of the abnormal warning threshold for each sensitive field respectively, so as to generate a hierarchical security threat baseline including the normal operation range and the abnormal warning threshold; wherein the lower limit of the abnormal warning threshold decreases as the dynamic adjustment parameter increases, and a buffer transition zone is set between the upper limit of the normal operation range and the lower limit of the abnormal warning threshold.

4. The method according to claim 1, characterized in that The method of associating the data operation deviation between the high-frequency cross-project query operations requested by the audit department and the statistical results through the collaborative encryption transmission channel, and when detecting that the query operation deviates from the hierarchical security threat baseline after association, calculating the risk confidence based on the data operation deviation includes: Through the collaborative encryption transmission channel, obtain the query request sequence of the audit department for multiple budget projects within a unit time, and extract the sensitive fields involved in each query request and their access timestamps; Match the query request sequence with the statistical results of the corresponding budget project, calculate the numerical difference between the query results corresponding to each query request in the query request sequence and the statistical results, and generate a query deviation record, where the query deviation record includes the query frequency and the query deviation value; Establish a two-dimensional distribution diagram with the query frequency as the horizontal axis and the query deviation value as the vertical axis, and identify the abnormal query points deviating from the preset normal range in the two-dimensional distribution diagram; For each abnormal query point, calculate the initial risk value according to the degree of deviation of the abnormal query point from the hierarchical security threat baseline, and based on the ciphertext operation permission of the sensitive field, configure the corresponding weight coefficient to correct the initial risk value to obtain the corrected risk value; In the order of query time, cumulatively calculate the corrected risk values of multiple consecutive abnormal query points. When the cumulative value exceeds the dynamic threshold, generate a risk confidence; wherein the dynamic threshold is adaptively adjusted according to the current activity of the collaborative encryption transmission channel and historical risk records.

5. The method according to claim 1, wherein The method of multi-party verifying the transmission path corresponding to the query operation according to the risk confidence, sending a collaborative warning message to the budget unit according to the verification result, and dynamically restricting the ciphertext operation permission of the sensitive field associated with the abnormal query operation in the collaborative encryption transmission channel includes: According to the risk interval where the risk confidence is located, determine the number of budget units that need to participate in the verification, where the higher the risk confidence, the more budget units need to participate; Send a verification request to the determined budget units, the verification request includes the characteristic information of the abnormal query operation and the associated sensitive field identifier, and receive the verification responses returned by each budget unit, and count the proportion of confirmed abnormalities in the verification responses as the verification credibility; When the verification credibility exceeds the preset threshold, generate a collaborative warning message including the detailed information of the abnormal query operation and send it to the relevant budget units; According to the combined value of the risk confidence and the verification credibility, determine the range of sensitive fields that need to be restricted, and adjust the operation permission identifier of the corresponding sensitive field in the joint key; Monitor the subsequent access behavior of the restricted fields in real time. When it is detected that the access behavior returns to normal, gradually restore the operation permissions of the restricted fields.

6. The method according to claim 1, characterized in that The security operation node performs variance calculation and regression analysis on the pre-audit data according to the joint key to generate statistical results verifiable by the audit department, including: Extract the numerical fields allowed for operation in the pre-audit data according to the joint key, and classify the numerical fields into multiple data groups according to the budget items; Calculate the deviation degree of all numerical fields in each data group from the average value of the corresponding budget item to obtain a first intermediate result; Based on the first intermediate result, analyze the distribution trend of the numerical fields over time to obtain a second intermediate result; Combine the first intermediate result and the second intermediate result according to a preset weight to generate a statistical sub-result of the data group; Summarize the statistical sub-results of all data groups, and filter out the unauthorized fields in the statistical sub-results according to the permission range of the joint key to generate the statistical results verifiable by the audit department.

7. The method according to claim 1, wherein Generate a joint key between the budget unit and the audit department to dynamically configure the ciphertext operation permissions of sensitive fields according to the joint key, including: Obtain the first key component of the budget unit and the second key component of the audit department, splice the first key component and the second key component to generate an initial joint key; Based on the budget item identifier of the budget unit and the audit authority identifier of the audit department, iteratively adjust the initial joint key to generate a joint key; Extract sensitive fields from the pre-audit data according to the budget item identifier, and assign a field identifier to each sensitive field; Bind the field identifier to the joint key to generate a ciphertext operation permission identifier corresponding to each sensitive field; Dynamically adjust the ciphertext operation permission identifier according to the audit authority identifier, so that the audit department can only perform ciphertext operations on the sensitive fields allowed by the audit authority identifier.

8. A security monitoring system for a financial information service platform, characterized in that, Include: A construction module for establishing a collaborative encryption transmission channel between the budget unit and the audit department, and generating a joint key between the budget unit and the audit department to dynamically configure the ciphertext operation permissions of sensitive fields according to the joint key; An operation module for transmitting the pre-audit data of the budget unit to the security operation node through the collaborative encryption transmission channel, so that the security operation node performs variance calculation and regression analysis on the pre-audit data according to the joint key to generate statistical results verifiable by the audit department, and synchronously bind the statistical results to the ciphertext operation permissions, and update the access frequency of the sensitive fields at the same time; A generation module for generating a hierarchical security threat baseline based on the ciphertext operation permissions, the access frequency, and the obtained historical cross-department query records; An association module for associating the query operations with high frequencies across projects requested by the audit department with the data operation deviation of the statistical results through the collaborative encryption transmission channel, and when it is detected that the query operation deviates from the hierarchical security threat baseline after the association, calculate the risk confidence level based on the data operation deviation; A verification module is used to perform multi-party verification on the transmission path corresponding to the query operation according to the risk confidence level, send collaborative warning information to the budget unit according to the verification result, and dynamically restrict the ciphertext operation permissions of sensitive fields associated with abnormal query operations in the collaborative encryption transmission channel.

9. A computing device, characterized in that, It includes a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement a security monitoring method for a financial information service platform according to any one of claims 1 to 7.

10. A computer storage medium, characterized in that, A computer program is stored, and when the computer program is executed by a computer, it implements a security monitoring method for a financial information service platform according to any one of claims 1 to 7.

Images