Network security compliance risk assessment method and device, equipment and storage medium

Abstract

The invention relates to a network security compliance risk assessment method and device, equipment and a storage medium. The method comprises the following steps: acquiring network security compliance characteristics and time sequence characteristics corresponding to each network node in a network environment; inputting the network security compliance features and the time sequence features into a risk classification model to obtain a compliance risk classification result; determining a comprehensive risk assessment result of the network environment according to the risk score values of the multiple dimensions in the network environment and the compliance risk classification result; inputting the comprehensive risk assessment result into a strategy generation model to obtain a risk disposal strategy; the strategy generation model is obtained by adopting a corresponding candidate risk disposal strategy for a historical comprehensive risk assessment result and training according to a return value after the candidate risk disposal strategy is adopted. By adopting the method, the accuracy of network security compliance risk assessment can be improved.

Description

Technical Field

[0001] This application relates to the field of network security technologies, and particularly to a network security compliance risk assessment method, apparatus, computer device, computer-readable storage medium, and computer program product. Background Art

[0002] With the increasing emphasis on network security by people, network security compliance management tools are often used to help enterprises or organizations ensure the security and compliance of their information systems, and ensure compliance with relevant national and industry laws, regulations, and security standards.

[0003] The basic functions of network security compliance management tools include compliance checking, compliance risk assessment, vulnerability scanning, audit log analysis, etc. Among them, compliance checking can refer to detecting whether the configuration of the system conforms to the specified standards through pre-set security rules, and whether there are any violations or potential security vulnerabilities. At the same time, compliance risk assessment is also an important function of network security compliance management tools. Compliance risk assessment can refer to evaluating potential security risks in the system, helping enterprises understand possible security vulnerabilities, potential attack surfaces, and weak links in security protection.

[0004] Traditional network security compliance management tools generally comprehensively evaluate the security of networks, systems, and devices through means such as vulnerability scanning, traffic monitoring, and log analysis. They classify the detected vulnerabilities according to certain scoring criteria, and then conduct a compliance risk assessment of the overall security situation. However, in the face of an increasingly complex network security environment, these traditional compliance risk assessment methods, due to the use of static rules, manual configuration, and manual analysis, result in a low accuracy of network security compliance risk assessment. Summary of the Invention

[0005] Based on this, it is necessary to provide a network security compliance risk assessment method, apparatus, computer device, computer-readable storage medium, and computer program product that can improve the accuracy of network security compliance risk assessment for the above technical problems.

[0006] In a first aspect, this application provides a network security compliance risk assessment method, including:

[0007] Obtain network security compliance features and temporal features corresponding to each network node in the network environment; the network security compliance features include features extracted from network security compliance data, and the temporal features include features extracted from at least one type of temporal data among network traffic data, system log data, and system configuration data of the network node;

[0008] Input the network security compliance features and the timing features into a risk classification model to obtain a compliance risk classification result; the risk classification model is trained based on sample data and sample labels, the sample data includes sample network security compliance features and sample timing features, and the sample labels include sample compliance risk classification results;

[0009] Determine the comprehensive risk assessment result of the network environment according to the risk score values of multiple dimensions in the network environment and the compliance risk classification result;

[0010] Input the comprehensive risk assessment result into a policy generation model to obtain a risk handling policy; the policy generation model is trained by taking corresponding candidate risk handling policies for historical comprehensive risk assessment results and according to the return values after taking the candidate risk handling policies.

[0011] In one embodiment, the determining the comprehensive risk assessment result of the network environment according to the risk score values of multiple dimensions in the network environment and the compliance risk classification result includes:

[0012] Determine the weights corresponding to the risk score values of multiple dimensions in the network environment according to the latest values of the network security compliance data and the timing data;

[0013] Determine the weighted summation result of each risk score value according to the risk score value and the weight, and determine the comprehensive risk assessment result of the network environment according to the weighted summation result and the compliance risk classification result.

[0014] In one embodiment, the inputting the network security compliance features and the timing features into a risk classification model to obtain a compliance risk classification result includes:

[0015] Input the network security compliance features into the text processing channel of the risk classification model to obtain a text semantic feature vector;

[0016] Input the timing features into the numerical processing channel of the risk classification model to obtain a global timing feature vector;

[0017] Fuse the text semantic feature vector and the global timing feature vector to obtain a fused feature vector, and determine the compliance risk classification result according to the fused feature vector.

[0018] In one embodiment, the sample compliance risk classification results include sample compliance risk level classification, sample compliance risk key elements, and sample compliance risk handling suggestions; the determining the compliance risk classification result according to the fused feature vector includes:

[0019] Input the fused feature vector into the multi-task learning framework of the risk classification model to obtain the compliance risk level classification, key elements of compliance risk, and compliance risk handling suggestions, which are used as the compliance risk classification result.

[0020] In one embodiment, the obtaining of the network security compliance features and the time series features corresponding to each network node in the network environment includes:

[0021] Obtain the network security compliance data and the time series data;

[0022] Extract semantic information from the network security compliance data and extract time series information from the time series data;

[0023] Fuse the semantic information and the time series information according to the topological relationship information between the network nodes to obtain the fused information;

[0024] Screen out the key features associated with the compliance risk assessment from the fused information, and determine the network security compliance features and the time series features according to the key features.

[0025] In one embodiment, after inputting the comprehensive risk assessment result into the policy generation model to obtain the risk handling policy, the method further includes:

[0026] Determine the effectiveness score of adopting the risk handling policy according to the difference between the updated comprehensive risk assessment result and the original comprehensive risk assessment result; the updated comprehensive risk assessment result is the comprehensive risk assessment result after implementing the risk handling policy in the network environment, and the original comprehensive risk assessment result is the comprehensive risk assessment result before implementing the risk handling policy in the network environment;

[0027] Construct the return value according to the effectiveness score and the updated comprehensive risk assessment result, and optimize the model parameters of the policy generation model with the goal of maximizing the return value to obtain the updated policy generation model.

[0028] In a second aspect, the present application also provides a network security compliance risk assessment device, including:

[0029] An acquisition module, configured to acquire network security compliance features and time series features corresponding to each network node in the network environment; the network security compliance features include features extracted from network security compliance data, and the time series features include features extracted from at least one of the network traffic data, system log data, and system configuration data of the network nodes.

[0030] A classification module for inputting the network security compliance features and the timing features into a risk classification model to obtain a compliance risk classification result; the risk classification model is trained based on sample data and sample labels, the sample data includes sample network security compliance features and sample timing features, and the sample labels include sample compliance risk classification results;

[0031] An evaluation module for determining a comprehensive risk assessment result of the network environment according to risk score values of multiple dimensions in the network environment and the compliance risk classification result;

[0032] A policy module for inputting the comprehensive risk assessment result into a policy generation model to obtain a risk handling policy; the policy generation model is trained by taking corresponding candidate risk handling policies for historical comprehensive risk assessment results and according to the return values after taking the candidate risk handling policies.

[0033] In a third aspect, the present application further provides a computer device, including a memory and a processor, the memory stores a computer program, and when the processor executes the computer program, the steps of the above method are implemented.

[0034] In a fourth aspect, the present application further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above method are implemented.

[0035] In a fifth aspect, the present application further provides a computer program product, including a computer program, and when the computer program is executed by a processor, the steps of the above method are implemented.

[0036] The above-mentioned network security compliance risk assessment method, device, computer equipment, computer-readable storage medium and computer program product obtain network security compliance features and temporal features corresponding to each network node in the network environment. Among them, the network security compliance features include features extracted from network security compliance data, and the temporal features include features extracted from at least one of the temporal data of network traffic data, system log data and system configuration data of network nodes; input the network security compliance features and temporal features into the risk classification model to obtain the compliance risk classification result. Among them, the risk classification model is trained according to sample data and sample labels. The sample data includes sample network security compliance features and sample temporal features, and the sample labels include sample compliance risk classification results; determine the comprehensive risk assessment result of the network environment according to the risk score values of multiple dimensions in the network environment and the compliance risk classification result; input the comprehensive risk assessment result into the policy generation model to obtain the risk handling policy. Among them, the policy generation model is trained by taking corresponding candidate risk handling policies for historical comprehensive risk assessment results and according to the return values after taking the candidate risk handling policies. By simultaneously obtaining network security compliance features and temporal features including multi-source data such as traffic, logs and configurations, the defect that traditional methods rely on static rules and cannot capture the real-time changes of the network environment is solved; secondly, a risk classification model trained by samples is used to jointly analyze multi-dimensional features, accurately evaluate the compliance risk classification result, and generate a more comprehensive comprehensive risk assessment result by integrating multi-dimensional risk scores and the risk level classification output by the model; finally, a policy generation model is introduced to optimize the policy for the risk assessment result. Through the return feedback mechanism of historical handling policies, the system can dynamically adjust the handling plan to adapt to new attack means and complex network topology changes, and finally form an intelligent compliance risk assessment system from feature extraction, risk identification to handling decision-making, improving the accuracy of network security compliance risk assessment. Brief Description of the Drawings

[0037] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the following will briefly introduce the drawings required for the description of the embodiments of the present application or related technologies. Obviously, the drawings in the following description are only some embodiments of the present application. For those of ordinary skill in the art, other related drawings can be obtained without creative efforts based on these drawings.

[0038] Figure 1 It is an application environment diagram of a network security compliance risk assessment method in an embodiment;

[0039] Figure 2 It is a schematic flowchart of a network security compliance risk assessment method in an embodiment;

[0040] Figure 3 Schematic diagram of a three-dimensional risk situation display diagram in an embodiment;

[0041] Figure 4 Structural block diagram of a network security compliance risk assessment device in an embodiment;

[0042] Figure 5 Internal structure diagram of a computer device in an embodiment. Detailed implementation manners

[0043] In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0044] The network security compliance risk assessment method provided by the embodiments of the present application can be applied to, for example Figure 1In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or can be placed on the cloud or other network servers. The terminal 102 obtains the network security compliance features and the timing features corresponding to each network node in the network environment; the network security compliance features include the features extracted from the network security compliance data, and the timing features include the features extracted from at least one of the timing data of the network traffic data, system log data, and system configuration data of the network node; the terminal 102 inputs the network security compliance features and the timing features into the risk classification model to obtain the compliance risk classification result; the risk classification model is trained according to the sample data and sample labels, the sample data includes the sample network security compliance features and sample timing features, and the sample labels include the sample compliance risk classification results; the terminal 102 determines the comprehensive risk assessment result of the network environment according to the risk score values of multiple dimensions in the network environment and the compliance risk classification result; the terminal 102 inputs the comprehensive risk assessment result into the policy generation model to obtain the risk handling policy; the policy generation model is trained by taking the corresponding candidate risk handling policies for the historical comprehensive risk assessment results and according to the return values after taking the candidate risk handling policies. Among them, the terminal 102 can be, but is not limited to, various personal computers, laptop computers, smart phones, tablet computers, Internet of Things devices, and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart in-vehicle devices, projection devices, etc. The portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The head-mounted devices can be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc. The server 104 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0045] In an exemplary embodiment, as Figure 2 shown, a network security compliance risk assessment method is provided. Taking the method applied to Figure 1 the terminal 102 in

[0046] Step S202, obtain the network security compliance features and the timing features corresponding to each network node in the network environment.

[0047] Among them, the network security compliance features include the features extracted from the network security compliance data, and the timing features include the features extracted from at least one of the timing data of the network traffic data, system log data, and system configuration data of the network node.

[0048] The terminal can first collect multi-source data such as network security compliance data, network traffic data, system log data, and system configuration data, and then extract features from these multi-source data to obtain network security compliance features and time-series features corresponding to each network node in the network environment.

[0049] In specific implementation, the terminal collects network security compliance data, which can be obtained from compliance documents (regulatory documents such as network security level protection requirements and regulations). Optionally, a compliance knowledge graph of network security compliance data can also be constructed based on the above compliance documents to achieve hierarchical management and correlative expression of compliance articles.

[0050] In specific implementation, the way for the terminal to collect network traffic data can be a high-speed traffic collection solution based on DPDK (Data Plane Development Kit) technology, which can capture network packets in real time under the conditions of high efficiency and low latency, so as to obtain network traffic data. DPDK is an open-source software library optimized for data plane performance, which can make full use of the processing capabilities of modern hardware acceleration devices to achieve the collection and processing of high-speed network traffic. In this process, DPDK technology bypasses the operating system kernel and directly interacts with hardware devices, greatly improving data processing efficiency and ensuring the stability and real-time performance of the system under high load. Through this technology, the data stream transmitted in the network can be captured and analyzed in real time, including the communication content of common protocols such as TCP / IP protocol packets, HTTP, and DNS, providing important data support for subsequent network security risk analysis.

[0051] In specific implementation, the way for the terminal to collect system log data and system configuration data can be to automatically collect system logs and configuration information through standard protocols such as Syslog (System Logging) and SNMP (Simple Network Management Protocol) to obtain system log data and system configuration data. System log data and system configuration data record various events and configuration states during the operation of the system, which are important bases for diagnosing system operation problems and conducting security audits. The Syslog protocol is widely used in the log collection of various network devices, servers, and terminals, and can provide information about device operation status, warnings, errors, etc. The SNMP protocol is used to collect performance data and configuration parameters from devices, which is crucial for evaluating the security and compliance of devices. Through these protocols, centralized collection of system logs and configuration information can be achieved, providing comprehensive data support for subsequent anomaly detection and risk assessment.

[0052] In specific implementation, the terminal can perform data fusion on the multi-source data such as the above-mentioned network security compliance data, network traffic data, system log data, and system configuration data, etc., to provide multi-dimensional and multi-level data sources for the training of the deep learning model. Since in practical applications, data from different sources often have different structures and formats, the terminal can also use a data preprocessing module to format and standardize different types of data through a unified standard, ensuring the consistency and integrity of the multi-source data. In addition, during the data preprocessing process, operations such as denoising and filling missing values are also performed on the data, maximizing the retention of valid information in the data and ensuring the superiority of data quality during model training.

[0053] It can be seen that the terminal can collect multi-source data such as network security compliance data, network traffic data, system log data, and system configuration data, etc., to ensure the diversity, comprehensiveness, and real-time nature of the data. Then, through the construction of a compliance knowledge base, the efficient capture of network traffic, and the collection of system logs and configuration information, the problems of scattered data sources and diverse data types are effectively solved, providing a solid foundation for the subsequent deep learning model. In addition, the application of data preprocessing and fusion technologies ensures the quality and consistency of the data, laying a solid technical foundation for the intelligent processing of the system.

[0054] After completing the data collection stage, the terminal can enter the data preprocessing and feature engineering stage, where it is necessary to extract valuable information from multi-source data such as network security compliance data, network traffic data, system log data, and system configuration data, etc., to obtain network security compliance features and the corresponding time-series features of each network node in the network environment, providing high-quality input data for the subsequent deep learning model.

[0055] In specific implementation, for network security compliance data, since network security compliance data includes a large amount of unstructured data (such as legal provisions, specification documents, etc.), the terminal can adopt natural language processing technology based on deep learning, such as the BERT (Bidirectional Encoder Representations from Transformers) model to perform text semantic parsing on the network security compliance data, convert the specification provisions into structured data that can be understood by a computer, and obtain network security compliance features. Among them, the BERT model utilizes the Transformer structure and can capture the deep semantics in the text based on context information, thereby converting the unstructured network security compliance data into a vector representation with rich semantic features. Specifically, the pre-training process of BERT includes unsupervised learning through a large amount of corpora, enabling the model to learn the context relationships of words. In practical applications, with network security compliance data as the input, after passing through the BERT model, the semantic information of each word or sentence is embedded into a high-dimensional vector space.

[0056] In specific implementation, for time series data such as network traffic data, system log data, and system configuration data, since there are time series relationships implicit in these time series data, the terminal can adopt a long short-term memory network (LSTM) model to extract features from the time series data and obtain time series features. LSTM is a special type of recurrent neural network (RNN) that can effectively capture long-term dependencies. In system logs and network traffic data, there are often the persistence and continuity of certain events and behaviors over time, and the LSTM network can extract the time-dependent features in these time series data. For example, certain specific network attack behaviors are usually periodic, and the LSTM model can identify this pattern, thereby enhancing the model's prediction ability on time series data. By training the LSTM network, the patterns in the time series data can be effectively captured, and then features such as the occurrence time and duration of events can be modeled, thus improving the processing ability of log data and traffic data.

[0057] Step S204: Input the network security compliance features and the time series features into a risk classification model to obtain a compliance risk classification result.

[0058] Among them, the risk classification model is trained based on sample data and sample labels. The sample data includes sample network security compliance features and sample time series features, and the sample labels include sample compliance risk classification results.

[0059] In one embodiment, the network security compliance features and temporal features are input into a risk classification model to obtain a compliance risk classification result, including: inputting the network security compliance features into the text processing channel of the risk classification model to obtain a text semantic feature vector; inputting the temporal features into the numerical processing channel of the risk classification model to obtain a global temporal feature vector; fusing the text semantic feature vector and the global temporal feature vector to obtain a fused feature vector, and determining the compliance risk classification result based on the fused feature vector.

[0060] In a specific implementation, for the network security compliance features, the network security compliance features can be input into a text processing channel based on Transformer and BiGRU (Bidirectional Gated Recurrent Unit) to obtain a text semantic feature vector. As a network architecture with a self-attention mechanism, Transformer can effectively capture the global dependencies between words in a sentence when processing natural language. Compared with traditional recurrent neural networks (RNNs) and their variants, it has better parallel computing capabilities and long-distance dependency modeling capabilities. Therefore, Transformer is used to perform context modeling and semantic extraction on compliance texts to capture implicit legal clauses and regulatory requirements in the texts. Specifically, the Transformer architecture calculates the correlation between each word and other words through a series of self-attention layers, and transforms the entire input text into a context-related representation vector.

[0061] Further optionally, to enhance the understanding of text sequence information, BiGRU (Bidirectional Gated Recurrent Unit) can be added on the basis of the above Transformer architecture. BiGRU is an extension of GRU (Gated Recurrent Unit) and can consider the dependencies of the context before and after in a text sequence at the same time. Different from traditional RNNs, GRU controls the flow of information through "reset gates" and "update gates", avoiding the problem of gradient disappearance and being suitable for processing sequence information in long text data. In the present invention, BiGRU generates the context information before and after each word in the whole text through bidirectional recursion, and then generates a text representation containing rich semantic information. After the text data is jointly processed by Transformer and BiGRU, a high-dimensional feature vector, that is, a text semantic feature vector, can be generated, and this feature vector can accurately represent the semantic features of the compliance text and support subsequent compliance risk assessments.

[0062] In a specific implementation, for temporal features, the temporal features can be input into a numerical processing channel based on TCN (Temporal Convolutional Network) to obtain a global temporal feature vector. TCN is a network structure that captures the temporal dependencies of sequential data through one-dimensional convolutional operations. Different from traditional RNNs and LSTMs, TCN can effectively perform parallel computations through extended convolutional operations and has strong long-sequence modeling capabilities. Specifically, TCN ensures that the prediction at the current moment depends only on the information at the current moment and previous moments through causal convolution operations, making it more suitable for processing numerical data with temporal dependencies. The core idea of the TCN model is to extract features at different time steps through convolutional layers, thereby forming a global understanding of the entire temporal features. Through multiple layers of convolutional operations, TCN can gradually extract the temporal dependencies in the sequential data and output a high-dimensional temporal feature vector, that is, the global temporal feature vector, at the final layer of the network.

[0063] To process network security compliance features and temporal features simultaneously in the same risk classification model, the text processing channel of Transformer+BiGRU is fused with the numerical processing channel of TCN to construct a dual-channel hybrid network architecture. This architecture can process network security compliance features and temporal features separately within a unified model framework and integrate the features through subsequent fusion layers, not only making full use of the advantages of each model in processing text data and temporal data but also ensuring the efficiency and accuracy of the model. In the feature fusion stage, through concatenation operations, the text semantic feature vector from the text processing channel and the global temporal feature vector from the numerical processing channel are fused to form a richer joint representation, obtaining the fused feature vector. The fused feature vector is then processed through the fully connected layer of the risk classification model to generate the final compliance risk classification result.

[0064] In one embodiment, the sample compliance risk classification result includes the sample compliance risk level classification, sample compliance risk key elements, and sample compliance risk handling suggestions; determining the compliance risk classification result based on the fused feature vector includes: inputting the fused feature vector into the multi-task learning framework of the risk classification model to obtain the compliance risk level classification, compliance risk key elements, and compliance risk handling suggestions as the compliance risk classification result.

[0065] Among them, the risk classification model can be a deep learning model, including a neural network architecture and a multi-task learning framework, which can effectively process various types of input data and achieve efficient network security compliance risk monitoring and assessment. By designing a reasonable model architecture and leveraging the powerful feature extraction and learning capabilities of deep learning, automatic generation of multi-task results such as accurate classification of compliance risks, identification of key risk factors, and disposal suggestions can be achieved. Exemplarily, the risk classification model can adopt a dual-channel hybrid network architecture, a text processing channel combining Transformer and BiGRU, a numerical processing channel of TCN (Temporal Convolutional Network), and a multi-task learning framework, so as to solve multiple tasks in a unified model.

[0066] In specific implementation, the risk classification model can include a multi-task learning framework, and this multi-task learning framework can design two main tasks: the main task is the classification of compliance risk levels, and the auxiliary tasks include the generation of key elements of compliance risks and compliance risk disposal suggestions. The core idea of the multi-task learning framework is to solve multiple related tasks by sharing underlying feature representations, thereby improving the generalization ability of the model. The main task classifies the compliance risks through a softmax classification layer, and the specific classification results can be "high risk", "medium risk", or "low risk", and subsequent disposal strategies are guided based on these classification results. The auxiliary tasks include identifying the key elements of compliance risks (such as key vulnerabilities, lack of compliance, etc.) and generating corresponding disposal suggestions, and these tasks can be trained through additional output layers.

[0067] During the model training process, the main task and the auxiliary tasks are jointly optimized through the weighted sum of loss functions, and the form of the loss function can be expressed as:

[0068] ;

[0069] where, is the loss function of the main task, and are the loss functions of auxiliary task 1 and auxiliary task 2 respectively, , and are hyperparameters used to control the importance of each task. Through joint optimization, the model can share information during the multi-task learning process, thereby improving the overall performance.

[0070] Finally, in order to improve the training efficiency of the model and prevent overfitting, the present invention adopts various common regularization techniques, such as Dropout, Batch Normalization, etc. At the same time, GPU acceleration is used during the model training process to ensure efficient training on large-scale datasets.

[0071] In summary, as a deep learning model, the risk classification model effectively integrates text data and time series data through a dual-channel hybrid network architecture, and realizes multiple tasks such as compliance risk level classification, risk factor identification, and disposal suggestion generation through a multi-task learning framework. By using Transformer + BiGRU to process network security compliance features and TCN to process time series features, and then combining with the multi-task learning framework, not only the accuracy and robustness of the model are improved, but also the intelligent level of risk assessment and disposal suggestion generation is significantly enhanced, providing strong technical support for network security compliance management.

[0072] Step S206: Determine the comprehensive risk assessment result of the network environment according to the risk score values of multiple dimensions in the network environment and the compliance risk classification result.

[0073] In practical applications, during the network security compliance risk assessment process, risk factors usually have multi-dimensional characteristics, and the risk characteristics of different dimensions can be characterized by risk score values. Exemplarily, the risk score values of multiple dimensions can include risk score values of multiple dimensions such as the compliance dimension, the technology dimension, and the management dimension. Among them, the compliance dimension is mainly based on the rule matching results in the compliance knowledge base, the technology dimension is mainly obtained through means such as vulnerability scanning and network traffic analysis of the system, and the management dimension mainly reflects the situation of the organization's security management strategy, personnel training, etc.

[0074] By performing weighted summation on these risk score values of different dimensions, a weighted summation result can be obtained. At the same time, using the compliance risk classification result output by the risk classification model as auxiliary information to adjust the weighted summation result, a comprehensive risk assessment result is obtained.

[0075] In one embodiment, determining the comprehensive risk assessment result of the network environment according to the risk score values of multiple dimensions in the network environment and the compliance risk classification result includes: determining the weights corresponding to the risk score values of multiple dimensions in the network environment according to the latest values of network security compliance data and time series data; determining the weighted summation result of each risk score value according to the risk score value and the weight, and determining the comprehensive risk assessment result of the network environment according to the weighted summation result and the compliance risk classification result.

[0076] In specific implementation, a dynamic weight scoring algorithm can be used to comprehensively evaluate various risk factors. The terminal can respond in real time to various changing factors, including changing factors of network security compliance data and time series data such as new compliance requirements, system configuration changes, and network traffic changes, and adjust the weights of the risk score values of each dimension according to the latest values of network security compliance data and time series data in these changing factors, and then generate a comprehensive risk assessment result by performing weighted summation on the risk score values of each dimension.

[0077] Exemplarily, the formula for calculating the comprehensive risk assessment result can be expressed as:

[0078] ;

[0079] where, represents the comprehensive risk assessment result, is the weight corresponding to the risk score value of the th dimension, is a function of the risk score value of the th dimension, is a regulation term used to control the weight of the output of the risk classification model, is the compliance risk classification result output by the risk classification model. The weights and the regulation term in this formula will be dynamically adjusted according to the actual situation. By weighted adjustment of the output of the risk classification model, it is possible to more accurately evaluate the current compliance and security risk situation.

[0080] Step S208, input the comprehensive risk assessment result into the policy generation model to obtain a risk handling policy.

[0081] Among them, the policy generation model is trained by taking corresponding candidate risk handling policies for historical comprehensive risk assessment results and according to the return values after taking the candidate risk handling policies.

[0082] Among them, the policy generation model can be a reinforcement learning model. Reinforcement learning is a learning method in which an agent interacts with the environment and optimizes the policy according to the feedback. Reinforcement learning technology can be applied to the generation process of risk handling policies. Through real-time analysis of the comprehensive risk assessment result, the reinforcement learning model can automatically generate a risk handling policy suitable for the current environment and maximize the effect of the risk handling policy through intelligent optimization. Specifically, the agent in reinforcement learning takes actions (i.e., selects appropriate handling measures) according to the environmental state (i.e., the comprehensive risk assessment result), and optimizes the decision-making policy according to the environmental feedback (such as the degree of risk reduction, handling effect, etc.) after taking the action, so as to obtain an optimized risk handling policy.

[0083] Suppose the candidate risk handling policies in the policy generation model can be represented by an action set. Each action in the action set corresponds to a different risk handling policy, such as blocking non-compliant IPs, adjusting firewall policies, pushing compliance repair suggestions, etc. The training objective of the policy generation model is to continuously try and optimize the candidate risk handling policies corresponding to the historical comprehensive risk assessment results, so as to maximize the total long-term return (i.e., the reduced risk). The return function used to calculate the return value in the policy generation model can be defined as:

[0084] ;

[0085] Among them, is the comprehensive risk assessment result after disposal, that is, the updated comprehensive risk assessment result; is the effectiveness score of the disposal action (such as the proportion of risk reduction), and are the adjustment coefficients of the reward function, which control the impact of risk mitigation and disposal effectiveness on the overall reward. The goal of the system is to maximize this reward value, so as to achieve the optimal risk control effect by selecting appropriate risk disposal strategies.

[0086] Policy optimization in the reinforcement learning algorithm is usually carried out through Q-learning or Deep Q-Network (DQN). After each round of risk assessment, the policy generation model updates the policy parameters and selects the optimal disposal action according to the current state and historical experience. In this way, the policy generation model can continuously adjust the risk disposal strategy to achieve the optimal response to risks, so that it can generate disposal strategies according to the real-time risk assessment results and can quickly respond to the current risk situation.

[0087] In the above network security compliance risk assessment method, network security compliance features and temporal features corresponding to each network node in the network environment are obtained. Among them, the network security compliance features include features extracted from network security compliance data, and the temporal features include features extracted from at least one of the temporal data of the network traffic data, system log data, and system configuration data of the network node; the network security compliance features and temporal features are input into a risk classification model to obtain a compliance risk classification result. Among them, the risk classification model is trained according to sample data and sample labels. The sample data includes sample network security compliance features and sample temporal features, and the sample labels include sample compliance risk classification results; according to the risk score values of multiple dimensions in the network environment and the compliance risk classification result, the comprehensive risk assessment result of the network environment is determined; the comprehensive risk assessment result is input into a policy generation model to obtain a risk handling policy. Among them, the policy generation model is trained by taking corresponding candidate risk handling policies for historical comprehensive risk assessment results and according to the return values after taking the candidate risk handling policies. By simultaneously obtaining network security compliance features and temporal features including multi-source data such as traffic, logs, and configurations, the defect that the traditional method depends on static rules and cannot capture the real-time changes of the network environment is solved; secondly, a risk classification model trained by samples is used to jointly analyze multi-dimensional features, accurately evaluate the compliance risk classification result, and generate a more comprehensive comprehensive risk assessment result by integrating multi-dimensional risk scores and the risk level classification output by the model; finally, a policy generation model is introduced to optimize the policy for the risk assessment result. Through the return feedback mechanism of historical handling policies, the system can dynamically adjust the handling plan to adapt to new attack methods and complex network topology changes, and finally form an intelligent compliance risk assessment system from feature extraction, risk identification to handling decision-making, improving the accuracy of network security compliance risk assessment.

[0088] In another embodiment, obtaining network security compliance features and temporal features corresponding to each network node in the network environment includes: obtaining network security compliance data and temporal data; extracting semantic information from the network security compliance data and extracting temporal information from the temporal data; according to the topological relationship information between each network node, fusing the semantic information and the temporal information to obtain the fused information; screening out key features associated with the compliance risk assessment from the fused information, and determining the network security compliance features and temporal features according to the key features.

[0089] In specific implementation, the terminal can perform text semantic parsing on the network security compliance data through a BERT (Bidirectional Encoder Representations from Transformers) model to extract semantic information from the network security compliance data.

[0090] In specific implementation, the terminal can capture the time dependence of time-series data such as network traffic data, system log data, and system configuration data through the LSTM model, so as to extract time-series information from the time-series data.

[0091] In order to effectively integrate heterogeneous data from different devices, systems, and networks in a complex environment involving multiple devices and multiple networks, the semantic information and time-series information can be fused according to the topological relationship information between each network node to obtain the fused information.

[0092] In specific implementation, the terminal can generate the topological relationship information between each network node through the Graph Neural Network (GNN) technology, and fuse the semantic information and time-series information according to the topological relationship information to obtain the fused information. The graph neural network can model the dependence between heterogeneous data through the relationship between nodes. For example, the connection relationship between devices, the traffic path in the network, etc. Through the graph neural network, devices, networks, users, etc. can be regarded as nodes in the graph, the connection relationship between nodes is represented by edges, and each node and edge carry specific feature information. In the analysis of network traffic, the GNN can automatically learn the relationship between nodes and edges based on the network topology structure, obtain the topological relationship information between each network node, and effectively integrate the feature information from different devices and networks through graph convolution operations. Through multiple convolution operations of the graph neural network, the semantic information and time-series information of each network node can be gradually fused, thereby effectively constructing the association relationship between devices and networks, and extracting effective information through this process to obtain the fused information.

[0093] In specific implementation, the terminal screens out the key features associated with compliance risk assessment from the fused information, and determines the network security compliance features and time-series features based on the key features. It can be to automatically screen out the most critical features for compliance risk assessment through feature selection algorithms (such as information gain, chi-square test, etc.), and use these key features as the network security compliance features and time-series features provided to the risk classification model, so as to select the features that have a greater impact on the model prediction results from high-dimensional information, thereby reducing the complexity of the model and improving the calculation efficiency, and optimizing the data input of the model.

[0094] Optionally, the terminal can also combine existing information to generate new high-order information, thereby further enhancing the expression ability of the model. For example, statistics such as the change rate and peak value of time-series data can be used as new information to be fused with semantic information and time-series information to obtain the fused information, and key features are extracted from the fused information, enhancing the sensitivity of the model to anomaly detection.

[0095] The technical solution of this embodiment successfully converts the original complex, multi-source, and multi-type data into structured data that can be effectively processed by deep learning models through a series of data preprocessing and feature engineering techniques. Whether it is through the BERT model for semantic parsing of text data, or through the LSTM model to capture the time dependence of time series data, or through the graph neural network to fuse heterogeneous data, it can ensure that each type of data is fully utilized, thereby providing accurate feature inputs for subsequent compliance risk assessment and ensuring the efficient and intelligent operation of the system.

[0096] In another embodiment, after inputting the comprehensive risk assessment result into the policy generation model to obtain the risk handling policy, it further includes: determining the effectiveness score of adopting the risk handling policy according to the difference between the updated comprehensive risk assessment result and the original comprehensive risk assessment result; the updated comprehensive risk assessment result is the comprehensive risk assessment result after implementing the risk handling policy in the network environment, and the original comprehensive risk assessment result is the comprehensive risk assessment result before implementing the risk handling policy in the network environment; constructing a return value according to the effectiveness score and the updated comprehensive risk assessment result, and taking maximizing the return value as the optimization goal to optimize the model parameters of the policy generation model to obtain the updated policy generation model.

[0097] In specific implementation, in order to ensure the long-term effectiveness and continuous optimization of the risk handling policy, a disposal effect feedback closed-loop mechanism can be designed. Under this mechanism, not only the disposal policy is generated according to the immediate comprehensive risk assessment result, but also the effect after each disposal is evaluated to form a closed-loop feedback, and the evaluation result is used to optimize the next round of disposal policy. Specifically, the disposal effect feedback mechanism includes the following key steps:

[0098] Risk mitigation effect assessment: After each disposal measure is implemented, the change of the risk can be monitored in real time, and the actual effect of the disposal measure can be evaluated. This effect evaluation is achieved by comparing with historical data and the benchmark model. Suppose that after the system implements the disposal measure, the updated comprehensive risk assessment result is , and the difference from the original comprehensive risk assessment result represents the risk mitigation effect, that is:

[0099] ;

[0100] This value reflects the effectiveness of the disposal measure within a certain period of time. If the risk score drops significantly, it means that the disposal measure has achieved the expected effect; otherwise, it means that the disposal policy needs to be adjusted.

[0101] Feedback on the effectiveness of handling actions: The system quantifies the effects of each handling measure to form a handling effectiveness score. Each handling strategy (such as blocking a certain IP, adjusting firewall rules, etc.) has a corresponding effectiveness score, indicating the effect of the handling action on reducing specific risks. The effectiveness score can be calculated using the following formula:

[0102] ;

[0103] The higher the score, the more effective the handling measure. In long-term operation, the system optimizes the selection and execution of handling strategies through cumulative evaluation of multiple handling effects, thereby improving the overall compliance risk management ability.

[0104] Closed-loop effect of the feedback mechanism: The feedback on the handling effect will be used to adjust the system's risk assessment model and handling strategy generation model. Specifically, the system will perform incremental training on the policy network in reinforcement learning based on historical handling results, enabling the policy to make timely adjustments according to changes in the environment. The effectiveness of each feedback will be used to update the weight parameters in the model, gradually optimizing the selection of handling strategies.

[0105] According to the expression of the above reward function: , a reward value can be constructed based on the effectiveness score and the updated comprehensive risk assessment result, and the model parameters of the policy generation model can be optimized with the goal of maximizing the reward value to obtain an updated policy generation model. Through this feedback closed-loop mechanism, the system can accumulate experience in continuous operations and continuously adjust its handling strategies, making the effects of handling measures more accurate and the risk control ability gradually improving in practical applications.

[0106] To adapt to the dynamic changes in the network environment, an online incremental learning module can also be introduced, enabling the system to continuously self-optimize and update its model when facing the ever-changing network security situation. Online incremental learning is a learning method that gradually absorbs new data and optimizes the model during the model training process. Different from traditional batch training methods, incremental learning allows the system to quickly adjust the existing model when new data arrives, without having to retrain from scratch. Among them, the online incremental learning module can be used in two aspects: on the one hand, the system can update the parameters in the deep learning model in real time through newly collected compliance data and risk assessment results, so as to maintain sensitivity to new types of network security threats; on the other hand, the system can adjust the policy parameters in reinforcement learning according to real-time feedback on handling effects, enabling the handling strategy to adapt to the ever-changing security threats.

[0107] The key to incremental learning is how to effectively update on the basis of the original model without losing the existing knowledge. For this purpose, an incremental update method based on gradient descent is adopted. That is, each time an update is made, the gradient is calculated according to the new data and fine-tuned on the basis of the existing model parameters. Suppose the existing model parameters are , and the gradient of the new data is , then the new model parameters can be updated through the following formula:

[0108] ;

[0109] where is the learning rate, which controls the amplitude of the update. Through this incremental learning strategy, the system can continuously accumulate experience, adapt to the changing network environment, and improve the accuracy and flexibility of the disposal strategy.

[0110] In the automated disposal and optimization stage, a closed-loop risk disposal system is constructed by adopting a policy generation model, a disposal effect feedback mechanism, and an online incremental learning module of reinforcement learning technology to achieve efficient and automated management of network security compliance risks. The core goal of this stage is to generate disposal policies according to real-time risk assessment results through intelligent means and improve the system's risk response ability through continuous optimization. The key to this process is to ensure that the disposal policy can not only quickly respond to the current risk situation, but also continuously optimize the policy according to historical data and disposal feedback, making the system gradually tend to the optimal risk control state.

[0111] In another embodiment, in order to make the comprehensive risk assessment results more intuitive and easy to understand, a three-dimensional risk situation display diagram can be designed. Traditional risk assessment results are usually presented in two-dimensional tables or simple charts, but in multi-dimensional network security compliance risk assessment, single-dimensional display often fails to reflect the overall risk situation. Therefore, through three-dimensional visualization technology, risk score values in multiple dimensions such as compliance dimension, technical dimension, and management dimension can be combined to form a dynamic, three-dimensional risk display model.

[0112] For the convenience of understanding by those skilled in the art, Figure 3 an exemplary schematic diagram of a three-dimensional risk situation display diagram is provided.

[0113] Specifically, each dimension of the three-dimensional risk situation display represents the status of compliance, technical, and management risks. By mapping these dimensions into a three-dimensional coordinate system, the system can display the specific values of each risk point in different dimensions. For example, the compliance dimension can be measured by the situation of compliance with regulations, the technical dimension can be evaluated by technical means such as vulnerability scanning and traffic monitoring, and the management dimension is reflected by information such as the organization's security management measures and personnel training.

[0114] In the three-dimensional risk situation display diagram, different risk levels can be represented by marks of different colors, sizes, and shapes. For example, high-risk areas can be shown using red and larger marks, while low-risk areas are presented using green and smaller marks. Users can, through interactive operations, view the detailed information of each dimension in real time and analyze the interrelationships between the various dimensions. Through the dynamically updated three-dimensional display, users can quickly identify areas with higher risks and take corresponding risk control measures in a timely manner.

[0115] In addition, to enhance the effect of the visual display, the present invention also introduces auxiliary graphics such as heat maps and surface diagrams to help users more accurately identify and understand the risk distribution under different dimensions. For example, through a heat map, the compliance distribution of all devices and systems under a certain compliance dimension can be shown, while a surface diagram can show the risk change trend at different time points. Through the combination of these graphics, users can more comprehensively evaluate the current risk situation and provide a scientific basis for subsequent decision-making.

[0116] In network security compliance risk monitoring, to ensure the timeliness of risk assessment, a dynamic assessment mechanism based on real-time data streams can be designed. The terminal can receive data from various data sources (such as network traffic, system logs, compliance inspection results, etc.) in real time and, by dynamically adjusting the weights of risk assessment, update the risk scores and situation displays in a timely manner. Through a dynamic update mechanism based on time windows, updates are triggered regularly (such as every minute, every hour) or when the data changes to ensure the real-time nature of risk assessment. For example, each time there is a change in network traffic or a system configuration update, the risk scores are recalculated based on the new data and the risk situation display diagram is updated. Through this dynamic update mechanism, potential compliance risks can be monitored and evaluated in real time in a constantly changing network environment, ensuring the accuracy and timeliness of risk assessment results. In addition to displaying the risk situation, attention can also be paid to the interpretability of risk assessment results. In practical applications, network security managers often need to understand the sources and bases of assessment results in order to make more reasonable decisions. Therefore, a feedback mechanism based on model interpretability can be designed to provide detailed sources of risk factors and scoring bases in the visual display of risk assessment results. Through this interpretable information, managers can better understand which factors lead to high risk scores and take corresponding improvement measures.

[0117] For example, attach a detailed risk report to the three-dimensional risk situation display chart. The report not only includes the specific scores of each dimension but also lists the calculation basis and relevant data support for each scoring item, helping managers understand the root causes of each risk point more deeply. In this way, the system not only provides an intuitive risk situation chart but also helps decision-makers comprehensively grasp the risk situation, thus managing and responding to compliance risks more efficiently.

[0118] In the above-mentioned embodiments, in the risk assessment and visualization stage, the compliance risk can be quantified through the dynamic weight scoring algorithm, and combined with the three-dimensional risk situation display technology, the complex compliance risk information is presented to users in an intuitive and easy-to-understand manner. By comprehensively considering the risk characteristics of the compliance dimension, technology dimension, and management dimension, and dynamically updating the risk scores and displays, it provides scientific and real-time decision support for network security compliance management. On this basis, the system also enhances the interpretability of the risk assessment results, ensuring the transparency of the assessment process and the credibility of the results. The innovative design in this stage makes the network security compliance risk monitoring and assessment more intelligent and efficient, greatly improving the risk control ability and response speed.

[0119] In summary, the above-mentioned network security compliance risk assessment method, by introducing means such as deep learning technology, reinforcement learning algorithms, multi-dimensional data fusion, and dynamic risk assessment, completely solves many defects of existing network security compliance risk assessment methods in aspects such as intelligence, real-time performance, automated disposal, data processing, and cross-institutional collaboration. The comprehensive application of these innovative technical means enables the above method to provide more accurate, automated, flexible, and intelligent risk monitoring and assessment capabilities when facing complex and changing network environments, unknown security threats, and dynamically changing compliance requirements, and greatly improves the real-time performance and adaptability of the system.

[0120] First, the multi-source data acquisition technology can be used to capture data in multiple dimensions such as network traffic, system logs, configuration files, and device status in real time, and process them through an efficient data preprocessing module. Through deep learning models such as deep neural networks and long short-term memory networks, the present invention can extract potential feature information from a large amount of unstructured data and automatically identify key factors related to network security and compliance. For example, in the face of network traffic data, the LSTM network can effectively capture the temporal features of the data, identify the time series of attack patterns or abnormal behaviors, and thus predict potential security threats. For system logs and configuration information, the BERT model is used for semantic parsing, and natural language processing technology is used to understand compliance terms, and the core elements that meet the compliance requirements are extracted from them to help determine whether the system complies with the latest security regulations.

[0121] Then, in the data processing and feature engineering stage, by combining multiple deep learning algorithms and data fusion technologies, the information from different data sources is efficiently integrated and analyzed. The graph neural network is used to fuse heterogeneous data and construct the association relationships between devices, so as to conduct global association analysis on devices, nodes, traffic, etc. in the network environment, which not only improves the accuracy of data processing, but also enhances the adaptability of the system in complex environments. Through the deep learning and mining of data, potential security risks can be intelligently identified, compliance issues can be predicted, and precise feature inputs can be provided for subsequent risk assessment.

[0122] Secondly, in the deep learning model construction stage, the present invention adopts a dual-channel hybrid network architecture to construct a risk classification model, separates the processing of text data and numerical data, and gives full play to the advantages of different models. The text data is processed by combining a Transformer-based model with BiGRU, which can efficiently parse compliance clauses and text data and extract the core elements that meet the compliance requirements. For numerical data, such as network traffic and system configuration data, a temporal convolutional network can be used to process time series data. When dealing with time series data, TCN can better capture the long-term dependencies and has higher training efficiency, and can respond to the dynamic changes of the system in real time. The design of this innovative model architecture can not only conduct static analysis on compliance, but also dynamically predict and react in real time to security events, greatly improving the accuracy and real-time performance of compliance monitoring and risk assessment.

[0123] Next, in terms of risk assessment and visualization, a dynamic weight scoring algorithm is used to achieve a quantitative assessment of network security risks. Specifically, through a comprehensive assessment of multiple dimensions such as compliance, technology, and management, a dynamic weighting method is adopted to adjust the weights according to the risk status of different dimensions to reflect the security situation of the network environment in real time. Based on the results output by deep learning and combined with the risk scoring formula, the system can conduct quantitative analysis on risks and generate corresponding assessment reports. For each potential security issue, the system not only gives the risk level, but also provides detailed risk sources and possible impact paths. To facilitate user understanding and operation, the system also adopts a three-dimensional risk situation display method to comprehensively display from the compliance dimension, technology dimension, and management dimension, enabling users to intuitively view the overall situation of network security. This risk assessment method is more accurate and dynamic compared with the traditional rule-based assessment method, and can timely discover potential security threats in a real-time changing network environment and accurately assess their risk levels.

[0124] Finally, in terms of automated handling and optimization, by introducing reinforcement learning technology, it is possible to automatically generate optimal handling strategies based on real-time security risk assessment results. The core advantage of reinforcement learning lies in its continuous training and feedback, constantly optimizing its decision-making process. When facing new types of attacks or complex security issues, the system can learn through "trial and error" and select the most suitable handling method, thus improving the response speed and handling effect of network security incidents. In addition, a feedback closed-loop mechanism for handling effects is designed to ensure that the effects after each handling operation can be reflected in the system, providing data support for the next round of risk assessment and decision-making, and ensuring the continuous optimization of handling measures.

[0125] In summary, the intelligent network security compliance risk monitoring and assessment method based on deep learning of the present invention overcomes the defects of traditional network security compliance products in terms of intelligence, real-time performance, automated handling, data processing capabilities, and cross-institutional collaboration by adopting technical means such as deep learning, reinforcement learning, graph neural networks, and federated learning. Its innovative working principle not only improves the accuracy and timeliness of network security compliance risk monitoring and assessment, but also greatly enhances the adaptability and flexibility of the system, enabling it to effectively cope with dynamically changing network security threats and compliance requirements, and promoting network security compliance management into a new era of greater intelligence and automation.

[0126] It should be understood that although the steps in the flowcharts involved in the above-described embodiments are shown in sequence according to the arrows, these steps do not necessarily have to be executed in the order indicated by the arrows. Unless there is a clear indication in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least some of the steps in the flowcharts involved in the above-described embodiments may include multiple steps or multiple stages. These steps or stages do not necessarily have to be executed at the same time, but can be executed at different times. The execution order of these steps or stages does not necessarily have to be sequential, but can be executed alternately or in turn with at least some of the steps or steps or stages in other steps.

[0127] Based on the same inventive concept, the embodiments of the present application also provide a network security compliance risk assessment device for implementing the network security compliance risk assessment method described above. The solution provided by this device for solving problems is similar to the solution described in the above method. Therefore, the specific limitations in one or more embodiments of the network security compliance risk assessment device provided below can refer to the limitations on the network security compliance risk assessment method in the above text, and will not be repeated here.

[0128] In an exemplary embodiment, as Figure 4As shown, a network security compliance risk assessment device is provided, including:

[0129] An acquisition module 410, configured to acquire network security compliance features and temporal features corresponding to each network node in the network environment; the network security compliance features include features extracted from network security compliance data, and the temporal features include features extracted from at least one of the temporal data of the network traffic data, system log data, and system configuration data of the network node.

[0130] A classification module 420, configured to input the network security compliance features and the temporal features into a risk classification model to obtain a compliance risk classification result; the risk classification model is trained according to sample data and sample labels, the sample data includes sample network security compliance features and sample temporal features, and the sample labels include sample compliance risk classification results.

[0131] An evaluation module 430, configured to determine a comprehensive risk assessment result of the network environment according to risk score values of multiple dimensions in the network environment and the compliance risk classification result.

[0132] A policy module 440, configured to input the comprehensive risk assessment result into a policy generation model to obtain a risk handling policy; the policy generation model is trained by taking corresponding candidate risk handling policies for historical comprehensive risk assessment results and according to the return values after taking the candidate risk handling policies.

[0133] In one embodiment, the evaluation module 430 is specifically configured to determine weights corresponding to risk score values of multiple dimensions in the network environment according to the latest values of the network security compliance data and the temporal data; determine a weighted sum result of each risk score value according to the risk score value and the weight, and determine the comprehensive risk assessment result of the network environment according to the weighted sum result and the compliance risk classification result.

[0134] In one embodiment, the classification module 420 is specifically configured to input the network security compliance features into a text processing channel of the risk classification model to obtain a text semantic feature vector; input the temporal features into a numerical processing channel of the risk classification model to obtain a global temporal feature vector; fuse the text semantic feature vector and the global temporal feature vector to obtain a fused feature vector, and determine the compliance risk classification result according to the fused feature vector.

[0135] In one embodiment, the sample compliance risk classification result includes sample compliance risk level classification, sample compliance risk key elements, and sample compliance risk handling suggestions; the classification module 420 is specifically configured to input the fused feature vector into the multi-task learning framework of the risk classification model to obtain the compliance risk level classification, compliance risk key elements, and compliance risk handling suggestions as the compliance risk classification result.

[0136] In one embodiment, the acquisition module 410 is specifically configured to acquire the network security compliance data and the time series data; extract semantic information from the network security compliance data, and extract time series information from the time series data; fuse the semantic information and the time series information according to the topological relationship information between the network nodes to obtain fused information; screen out key features associated with the compliance risk assessment from the fused information, and determine the network security compliance features and the time series features according to the key features.

[0137] In one embodiment, the policy module 440 is specifically configured to determine the effectiveness score of adopting the risk handling strategy according to the difference between the updated comprehensive risk assessment result and the original comprehensive risk assessment result; the updated comprehensive risk assessment result is the comprehensive risk assessment result after the risk handling strategy is implemented in the network environment, and the original comprehensive risk assessment result is the comprehensive risk assessment result before the risk handling strategy is implemented in the network environment; construct the return value according to the effectiveness score and the updated comprehensive risk assessment result, and optimize the model parameters of the policy generation model with the goal of maximizing the return value to obtain the updated policy generation model.

[0138] Each module in the above network security compliance risk assessment device can be implemented in whole or in part by software, hardware, and their combination. The above modules can be embedded in the processor of the computer device in hardware form or be independent of it, or can be stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to the above modules.

[0139] In an exemplary embodiment, a computer device is provided. The computer device can be a terminal, and its internal structure diagram can be as Figure 5As shown in the figure. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit, and an input device. Among them, the processor, the memory, and the input / output interface are connected through a system bus, and the communication interface, the display unit, and the input device are connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and external devices. The communication interface of the computer device is used to communicate with external terminals in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, near field communication (NFC), or other technologies. When the computer program is executed by the processor, it implements a network security compliance risk assessment method. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen. The input device of the computer device can be a touch layer covering the display screen, or a button, a trackball, or a touchpad provided on the outer shell of the computer device, or an external keyboard, a touchpad, or a mouse, etc.

[0140] Those skilled in the art can understand that Figure 5 the structure shown in the figure is only a block diagram of some structures related to the solution of this application, and does not constitute a limitation on the computer device to which the solution of this application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine some components, or have different component arrangements.

[0141] In an exemplary embodiment, a computer device is provided, including a memory and a processor. A computer program is stored in the memory, and when the processor executes the computer program, the steps in the above method embodiments are implemented.

[0142] In an embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by the processor, the steps in the above method embodiments are implemented.

[0143] In an embodiment, a computer program product is provided, including a computer program, and when the computer program is executed by the processor, the steps in the above method embodiments are implemented.

[0144] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in this application are all information and data that have been authorized by the user or fully authorized by all parties, and the collection, use, and processing of relevant data need to comply with relevant regulations.

[0145] Those of ordinary skill in the art can understand that all or part of the processes in the methods of the above embodiments can be completed by instructing relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above methods. Among them, any reference to a memory, database, or other medium used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc. The databases involved in the embodiments provided in this application can include at least one of relational databases and non-relational databases. Non-relational databases can include distributed databases based on blockchain, etc., without limitation. The processors involved in the embodiments provided in this application can be general-purpose processors, central processors, graphics processors, digital signal processors, programmable logic devices, data processing logics based on quantum computing, artificial intelligence (AI) processors, etc., without limitation.

[0146] The technical features of the above embodiments can be combined arbitrarily. For the sake of concise description, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, it should be considered as the scope recorded in this application.

[0147] The above-described embodiments merely represent several implementation manners of this application. The description is relatively specific and detailed, but it should not be construed as a limitation on the scope of the patent of this application. It should be noted that for those of ordinary skill in the art, without departing from the concept of this application, several modifications and improvements can still be made, and these all belong to the protection scope of this application. Therefore, the protection scope of this application shall be subject to the appended claims.

Claims

1. A network security compliance risk assessment method, characterized in that The method includes: Obtaining network security compliance features and temporal features corresponding to each network node in the network environment; the network security compliance features include features extracted from network security compliance data, and the temporal features include features extracted from at least one of the temporal data of the network traffic data, system log data, and system configuration data of the network node; Inputting the network security compliance features and the temporal features into a risk classification model to obtain a compliance risk classification result; the risk classification model is trained according to sample data and sample labels, the sample data includes sample network security compliance features and sample temporal features, and the sample labels include sample compliance risk classification results; Determining a comprehensive risk assessment result of the network environment according to the risk score values of multiple dimensions in the network environment and the compliance risk classification result; Inputting the comprehensive risk assessment result into a policy generation model to obtain a risk handling policy; the policy generation model is trained by taking corresponding candidate risk handling policies for historical comprehensive risk assessment results and according to the return values after taking the candidate risk handling policies.

2. The method according to claim 1, characterized in that, The determining the comprehensive risk assessment result of the network environment according to the risk score values of multiple dimensions in the network environment and the compliance risk classification result includes: Determining the weights corresponding to the risk score values of multiple dimensions in the network environment according to the latest values of the network security compliance data and the temporal data; Determining the weighted sum result of each risk score value according to the risk score value and the weight, and determining the comprehensive risk assessment result of the network environment according to the weighted sum result and the compliance risk classification result.

3. The method according to claim 1, wherein The inputting the network security compliance features and the temporal features into a risk classification model to obtain a compliance risk classification result includes: Inputting the network security compliance features into the text processing channel of the risk classification model to obtain a text semantic feature vector; Inputting the temporal features into the numerical processing channel of the risk classification model to obtain a global temporal feature vector; Fusing the text semantic feature vector and the global temporal feature vector to obtain a fused feature vector, and determining the compliance risk classification result according to the fused feature vector.

4. The method according to claim 3, characterized in that, The sample compliance risk classification result includes sample compliance risk level classification, sample compliance risk key elements, and sample compliance risk handling suggestions; The determining the compliance risk classification result according to the fused feature vector includes: Inputting the fused feature vector into the multi-task learning framework of the risk classification model to obtain a compliance risk level classification, compliance risk key elements, and compliance risk handling suggestions as the compliance risk classification result.

5. The method according to claim 1, wherein The obtaining the network security compliance features and the temporal features corresponding to each network node in the network environment includes: Obtaining the network security compliance data and the temporal data; Extracting semantic information from the network security compliance data and extracting temporal information from the temporal data; Fuse the semantic information and the timing information according to the topological relationship information among the network nodes to obtain the fused information; Screen out the key features associated with the compliance risk assessment from the fused information, and determine the network security compliance features and the timing features according to the key features.

6. The method according to claim 1, characterized in that, After inputting the comprehensive risk assessment result into the policy generation model to obtain the risk handling policy, the method further includes: Determine the effectiveness score of adopting the risk handling policy according to the difference between the updated comprehensive risk assessment result and the original comprehensive risk assessment result; the updated comprehensive risk assessment result is the comprehensive risk assessment result after the risk handling policy is implemented in the network environment, and the original comprehensive risk assessment result is the comprehensive risk assessment result before the risk handling policy is implemented in the network environment; Construct the return value according to the effectiveness score and the updated comprehensive risk assessment result, and optimize the model parameters of the policy generation model with the goal of maximizing the return value to obtain the updated policy generation model.

7. A network security compliance risk assessment device, characterized in that, The device includes: An acquisition module, configured to acquire network security compliance features and timing features corresponding to each network node in the network environment; the network security compliance features include features extracted from network security compliance data, and the timing features include features extracted from at least one of the timing data of the network traffic data, system log data, and system configuration data of the network nodes; A classification module, configured to input the network security compliance features and the timing features into a risk classification model to obtain a compliance risk classification result; the risk classification model is trained according to sample data and sample labels, the sample data includes sample network security compliance features and sample timing features, and the sample labels include sample compliance risk classification results; An evaluation module, configured to determine the comprehensive risk assessment result of the network environment according to the risk score values of multiple dimensions in the network environment and the compliance risk classification result; A policy module, configured to input the comprehensive risk assessment result into a policy generation model to obtain a risk handling policy; the policy generation model is trained by adopting corresponding candidate risk handling policies for historical comprehensive risk assessment results and according to the return values after adopting the candidate risk handling policies.

8. A computer device, comprising a memory and a processor, the memory storing a computer program, characterized in that, When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images