A data security analysis and processing system and method based on multi-directional supervision

Abstract

The present invention discloses a data security analysis and processing system and method based on multi-directional supervision, which relates to the field of data security and solves the problem that dynamic security risks cannot be effectively analyzed during the use of data files. The system includes an initial analysis module, a multi-directional supervision module, a permission configuration module, an exposure analysis module, a risk analysis module and a comprehensive analysis module. The initial analysis module is used to perform an initial analysis of the importance of data files, the permission configuration module is used to configure permissions for different data files, the exposure analysis module is used to analyze the exposure value of data files, the risk analysis module is used to analyze the risk of data files, and the comprehensive analysis module is used to analyze the overall security of data files in the data platform. The present invention realizes effective analysis of dynamic security risks during the use of data files.

Description

Technical Field

[0001] The present invention belongs to the field of data security technology, and specifically relates to a data security analysis and processing system and method based on multi-directional supervision. Background Art

[0002] With the rapid development of information technology, data has become a core asset driving corporate decision-making and innovation. Data security management is becoming increasingly important across various industries. With the explosive growth of data and the increasing complexity of data application scenarios, data security faces unprecedented challenges. Scientifically assessing data importance, properly configuring access permissions, and monitoring data risks in real time have become key technical issues in ensuring data security.

[0003] Most existing technologies focus on boundary protection or static protection of data files, making it difficult to effectively monitor and analyze dynamic security risks of data files in real time. For example, it is impossible to implement differentiated and refined permission management for different data files based on their importance and sensitivity. Furthermore, it is difficult to detect abnormal behavior during data file access in real time, including unauthorized access, unauthorized operations, and operations at abnormal times. As a result, risks such as data file leakage and tampering cannot be discovered and prevented in a timely manner. Furthermore, there is a lack of comprehensive quantitative assessment methods for the exposure and risk status of data files.

[0004] To this end, the present invention proposes a data security analysis and processing system and method based on multi-directional supervision. Summary of the Invention

[0005] In view of the shortcomings of the existing technology, the purpose of the present invention is to provide a data security analysis and processing system and method based on multi-directional supervision.

[0006] The technical problems to be solved by the present invention are:

[0007] It is impossible to effectively analyze dynamic security risks during the use of data files.

[0008] In order to achieve the above object, the present invention adopts the following technical solutions:

[0009] In a first aspect, a data security analysis and processing system based on multi-directional supervision includes an initial analysis module, a multi-directional supervision module, a permission configuration module, an exposure analysis module, a risk analysis module, and a comprehensive analysis module; the multi-directional supervision module is used to collect the number of times data files are used in different data platforms and send the number to the initial analysis module; the initial analysis module is used to perform an initial analysis of the importance of data files, generate importance levels of different data files through analysis, and send the numbers to the permission configuration module; the permission configuration module is used to configure permissions for different data files based on the importance levels, generate permission configuration results, and send the results to the exposure analysis module and the risk analysis module; the multi-directional supervision module is also used to collect in real time the device codes of data access terminals and the operating behaviors of different data access terminals on data files, and send the results to the exposure analysis module;

[0010] The exposure analysis module is used to analyze the exposure value of the data file based on the operating authority of the data access terminal and the access volume of the data file, and the analysis generates the exposure value or authorization signal of the data file. If the exposure value of the data file is generated, it is sent to the comprehensive analysis module; if the authorization signal is generated, it is sent to the risk analysis module; the risk analysis module is used to analyze the risk of the data file based on the operating behavior of the authorized terminal after receiving the authorization signal, and the risk value of the data file in the data platform is obtained by analysis and sent to the comprehensive analysis module; the comprehensive analysis module is used to analyze the overall security of the data files in the data platform based on the exposure value and the risk value.

[0011] Furthermore, the analysis process of the initial analysis module includes the following sub-steps:

[0012] Step S1, obtaining the usage counts of different data files, adding the usage counts of different data files to obtain the total usage counts of all data files, and dividing the usage counts of different data files by the total usage counts of all data files to obtain the usage counts corresponding to the different data files;

[0013] Step S2, calculating the average usage frequency of data files in the data platform;

[0014] Step S3, calculating the standard deviation of the usage frequencies of the data files in the data platform, and dividing the usage frequencies corresponding to different data files by the average usage frequency to obtain the relative usage frequencies corresponding to the different data files.

[0015] Furthermore, the analysis process of the initial analysis module further includes the following sub-steps:

[0016] Step S4: subtract the last update time of different data files from the current time to obtain the latest update time interval corresponding to the different data files, add the latest update time intervals corresponding to the different data files, and divide the sum by the number of data files to obtain the average update time interval of the data files;

[0017] Step S5, calculating the importance values ​​of different data files;

[0018] Similarly, calculate the importance thresholds for different data files;

[0019] Step S6: If the importance value of the data file is greater than or equal to the importance threshold, the importance level of the corresponding data file is the first importance level;

[0020] If the importance value of the data file is less than the importance threshold, the importance level of the corresponding data file is the second importance level.

[0021] Furthermore, the configuration process of the permission configuration module includes the following sub-steps:

[0022] Step S110: assigning different operation permissions to data files of different importance levels, specifically:

[0023] Assign the operation authority of the data file of the first importance level to the first level authority;

[0024] Allocate the operation permission of the data file of the second most important level as the second level permission, wherein the permission level of the first level permission is higher than the permission level of the second level permission;

[0025] The device terminal that performs operations on data files is recorded as a data access terminal, and the operations include read-only, edit and transfer operations;

[0026] Step S120: Configure operation behavior rules for different operation permissions, specifically:

[0027] Allowing a data access terminal with a first-level operation authority to operate data files of the first and second importance levels;

[0028] Allowing data access terminals with level 2 operation authority to operate data files of the second most important level;

[0029] Data access terminals with level 2 operation authority are not allowed to operate data files with level 1 importance;

[0030] Step S130: assign different sensitivity values ​​to data files of different importance levels, specifically:

[0031] When the importance level of a data file is the first importance level, the corresponding data file is assigned the first sensitivity value;

[0032] When the importance level of a data file is the second importance level, a second sensitivity value is assigned to the corresponding data file; wherein the first sensitivity value and the second sensitivity value are both positive numbers, and the value of the first sensitivity value is greater than the value of the second sensitivity value.

[0033] Furthermore, the analysis process of the exposure analysis module includes the following sub-steps:

[0034] Step S11, comparing the device code of the data access terminal with the device code of the authorized terminal in the server;

[0035] Step S12: If the device code of the data access terminal is different from the device code of the authorized terminal in the server, the corresponding data access terminal is recorded as an unauthorized terminal, and the operation behavior of the unauthorized terminal on the data file is recorded as an attempted operation behavior, and the number of attempted operations of the unauthorized terminal on the data file is counted;

[0036] Step S13: If the device code of the data access terminal is the same as the device code of the authorized terminal in the server, the corresponding data access terminal is recorded as an authorized terminal and the process proceeds to the next step;

[0037] Specifically, each data access terminal corresponds to a unique device code, and the authorized terminal is an authorized terminal.

[0038] Furthermore, the analysis process of the exposure analysis module further includes the following sub-steps:

[0039] Step S14, obtaining the operation authority of the authorized terminal, and comparing the operation authority of the authorized terminal with the operation authority of the data file;

[0040] Step S15: If the operation authority of the authorized terminal is less than the operation authority of the data file, the operation behavior of the authorized terminal on the data file is recorded as unauthorized behavior, and the number of unauthorized behaviors of the authorized terminal on the data file is counted;

[0041] Step S16: If the operation authority of the authorized terminal is greater than or equal to the operation authority of the data file, an authorization signal is generated, the operation behavior of the authorized terminal on the data file is recorded as the authority use behavior, and the number of authority use behaviors of the authorized terminal on the data file is counted.

[0042] Furthermore, the analysis process of the exposure analysis module further includes the following sub-steps:

[0043] Step S17, summing the number of attempted operations on the data file by the unauthorized terminal, the number of unauthorized operations by the authorized terminal, and the number of permission usage behaviors to obtain the total number of operations on the data file by the data access terminal;

[0044] Collect the real-time access count of the data file at the current moment, collect the historical access count of the data file, and divide the historical access count of the data file by the total number of data files to obtain the average access count of the data file; when the historical access count of the data file is zero, the average access count of the data file defaults to one;

[0045] Step S18: Calculate the exposure value of the data file in the data platform.

[0046] Furthermore, the analysis process of the risk analysis module includes the following sub-steps:

[0047] Step S21, obtaining the time of the authorized terminal's operation on the data file, and comparing the time of the authorized terminal's operation on the data file with the working time interval;

[0048] If the time of the operation of the data file by the authorized terminal falls within the working hours, no operation is performed; if the time of the operation of the data file by the authorized terminal does not fall within the working hours, the process proceeds to the next step;

[0049] Step S22: Record the operation behavior of the authorized terminal that does not fall within the working time interval as an abnormal time operation; obtain the minimum number of historical abnormal time operations, and use the minimum number of historical abnormal time operations as a reference threshold for abnormal time operations;

[0050] Step S23, obtaining the number of abnormal event operations of the authorized terminal at the current moment, and comparing the number of abnormal time operations of the authorized terminal at the current moment with a reference threshold;

[0051] If the number of abnormal time operations at the current moment is less than the reference threshold, no operation is performed; if the number of abnormal time operations at the current moment is greater than or equal to the reference threshold, proceed to the next step;

[0052] Step S24: real-time monitoring of specific operations of the authorized terminal on the data file;

[0053] When the terminal is authorized to perform read-only operations on data files, no operation will be performed;

[0054] When an authorized terminal performs an editing operation on a data file, the backup volume of the data file at the current moment is collected, and the backup coverage rate of the data file is obtained by dividing the backup volume of the data file at the current moment by the total number of data files;

[0055] When an authorized terminal performs a data file transmission operation, the transmission volume of the data file of the first importance level and the transmission volume of the data file of the second importance level are obtained, and the transmission volume of the data file of the first importance level is divided by the total amount of data file transmission to obtain the transmission ratio of the data file of the first importance level, and the transmission volume of the data file of the second importance level is divided by the total amount of data file transmission to obtain the transmission ratio of the data file of the second importance level;

[0056] Step S25: Calculate the risk value of the data files in the data platform.

[0057] Furthermore, the analysis process of the comprehensive analysis module includes the following sub-steps:

[0058] Step S31, calculating the overall security value of the data files in the data platform;

[0059] Step S32: If the overall security value of the data files in the data platform falls within the first security interval, a data file security alarm is triggered;

[0060] Step S33: If the overall security value of the data file in the data platform falls within the second security interval, the data file is continuously monitored;

[0061] Step S34: If the overall security value of the data files in the data platform falls within the third security interval, no operation is performed;

[0062] The values ​​within the first safety interval are all greater than the values ​​within the second safety interval, and the values ​​within the second safety interval are all greater than the values ​​within the third safety interval.

[0063] In the second aspect, a data security analysis and processing method based on multi-directional supervision includes:

[0064] Step S101, performing an initial analysis of the importance of data files based on the number of times the data files are used and the time interval between their last updates in different data platforms, and obtaining importance levels of different data files through analysis;

[0065] Step S102, configuring permissions for different data files based on importance levels;

[0066] Step S103, analyzing the data file based on the operation authority of the data access terminal and the access volume of the data file to obtain the exposure value of the data file;

[0067] Step S104: Analyze the data file based on different operation behaviors of the authorized terminal to obtain a risk value of the data file;

[0068] Step S105: Analyze the overall security of the data files in the data platform based on the exposure value and the risk value.

[0069] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0070] 1. The present invention first obtains the number of times data files are used and the interval between the last updates in different data platforms, and then analyzes the importance of the data files to obtain the importance levels corresponding to different data files. At the same time, the permissions of different data files are configured according to the importance levels. The present invention realizes the configuration of permissions of data files according to the importance levels.

[0071] 2. The present invention analyzes the data files based on the operating permissions of the data access terminal and the access volume of the data files. At the same time, the data files are analyzed according to the different operating behaviors of the authorized terminals to obtain the exposure value and risk value of the data files. Finally, the overall security of the data files is analyzed based on the exposure value and risk value. The present invention realizes a comprehensive analysis of the overall security of the data files from different dimensions. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] To facilitate understanding by those skilled in the art, the present invention is further described below with reference to the accompanying drawings.

[0073] Figure 1 is a block diagram of the overall system of the present invention;

[0074] Figure 2 A schematic diagram of the permission configuration in the present invention;

[0075] Figure 3 This is a flow chart of the safety analysis in the present invention;

[0076] Figure 4 Flow chart of the method of the present invention. DETAILED DESCRIPTION

[0077] The technical solutions of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0078] Example 1: Please refer to Figure 1-Figure 3 As shown, the technical solution provided by the present invention is: a data security analysis and processing system based on multi-directional supervision, including an initial analysis module, a multi-directional supervision module, a permission configuration module, an exposure analysis module, a risk analysis module and a comprehensive analysis module;

[0079] The multi-directional monitoring module is used to collect the usage counts of data files in different data platforms and send the usage counts of different data files to the initial analysis module;

[0080] In practice, the data platform is a public platform used by enterprises or organizations to store data files. Multiple data files are stored in the public platform, including but not limited to document files, image files, audio and video files, etc.

[0081] In this embodiment, the initial analysis module is used to perform an initial analysis of the importance of the data file. The analysis process includes the following sub-steps:

[0082] Step S1, obtaining the usage counts of different data files, adding the usage counts of different data files to obtain the total usage counts of all data files, and dividing the usage counts of different data files by the total usage counts of all data files to obtain the usage frequencies PLi corresponding to the different data files, where i is the number of the data file, i=1, 2, ..., n, and n is a positive integer;

[0083] Step S2, by formula Calculate the average usage frequency PJ of data files in the data platform;

[0084] Step S3, by formula Calculate the standard deviation BZC of the usage frequency of data files in the data platform, and divide the usage frequency corresponding to different data files by the average usage frequency to obtain the relative usage frequency corresponding to different data files;

[0085] Step S4: subtract the last update time of different data files from the current time to obtain the latest update time interval corresponding to the different data files, add the latest update time intervals corresponding to the different data files, and divide the sum by the number of data files to obtain the average update time interval of the data files;

[0086] Step S5: Dividing the most recent update time interval of different data files by the maximum value of the most recent update time interval to obtain a relative update value, and adding a value obtained by subtracting the relative update value from one and multiplying it by the corresponding weight coefficient to a value obtained by dividing the relative usage frequency of different data files by the standard value and multiplying it by the corresponding weight coefficient to obtain the importance value of the different data files;

[0087] Similarly, the importance thresholds of different data files are obtained by adding the value obtained by dividing the standard deviation of the usage frequency of data files in the data platform by the standard value and multiplying it by the corresponding weight coefficient, and the value obtained by dividing the average update time interval of the data files by the standard value and multiplying it by the corresponding weight coefficient.

[0088] Step S6: If the importance value of the data file is greater than or equal to the importance threshold, the importance level of the corresponding data file is the first importance level;

[0089] If the importance value of a data file is less than the importance threshold, the importance level of the corresponding data file is the second importance level. It should be explained that the importance of the first importance level is greater than the importance of the second importance level. It should be explained that the importance threshold of the data file is 0.6.

[0090] The preliminary analysis module sends the importance levels of different data files to the authority configuration module.

[0091] In this embodiment, the permission configuration module is used to configure permissions for different data files based on importance levels. The configuration process includes the following sub-steps:

[0092] Step S110: assigning different operation permissions to data files of different importance levels, specifically:

[0093] Assign the operation authority of the data file of the first importance level to the first level authority;

[0094] Allocate the operation permission of the data file of the second most important level as the second level permission, wherein the permission level of the first level permission is higher than the permission level of the second level permission;

[0095] Specifically, the device terminal that performs operations on data files is recorded as a data access terminal, and the operations include read-only, editing, and transfer operations;

[0096] Step S120, please refer to Figure 2 As shown, configure the operation behavior rules for different operation permissions, specifically:

[0097] Allowing a data access terminal with a first-level operation authority to operate data files of the first and second importance levels;

[0098] Allowing data access terminals with level 2 operation authority to operate data files of the second most important level;

[0099] Data access terminals with level 2 operation authority are not allowed to operate data files with level 1 importance;

[0100] Step S130: assign different sensitivity values ​​to data files of different importance levels, specifically:

[0101] When the importance level of a data file is the first importance level, the corresponding data file is assigned the first sensitivity value;

[0102] When the importance level of a data file is the second importance level, a second sensitivity value is assigned to the corresponding data file; wherein the first sensitivity value and the second sensitivity value are both positive numbers, and the value of the first sensitivity value is greater than the value of the second sensitivity value;

[0103] The authority configuration module sends the authority configuration results to the exposure analysis module and the risk analysis module.

[0104] Furthermore, the multi-directional monitoring module is used to collect the device codes of the data access terminals and the operation behaviors of different data access terminals on the data files in real time, and send the device codes of the data access terminals and the operation behaviors of different data access terminals on the data files to the exposure analysis module; the exposure analysis module is used to analyze the exposure value of the data files based on the operation permissions of the data access terminals and the access volume of the data files. The analysis process includes the following sub-steps:

[0105] Step S11, please refer to Figure 3 As shown, the device code of the data access terminal is compared with the device code of the authorized terminal in the server;

[0106] Step S12: If the device code of the data access terminal is different from the device code of the authorized terminal in the server, the corresponding data access terminal is recorded as an unauthorized terminal, and the operation behavior of the unauthorized terminal on the data file is recorded as an attempted operation behavior, and the number of attempted operations of the unauthorized terminal on the data file is counted;

[0107] Step S13: If the device code of the data access terminal is the same as the device code of the authorized terminal in the server, the corresponding data access terminal is recorded as an authorized terminal and the process proceeds to the next step;

[0108] In this embodiment, each data access terminal corresponds to a unique device code, and the authorized terminal is an authorized terminal;

[0109] Step S14, obtaining the operation authority of the authorized terminal, and comparing the operation authority of the authorized terminal with the operation authority of the data file;

[0110] Step S15: If the operation authority of the authorized terminal is less than the operation authority of the data file, the operation behavior of the authorized terminal on the data file is recorded as unauthorized behavior, and the number of unauthorized behaviors of the authorized terminal on the data file is counted;

[0111] Step S16: If the operation authority of the authorized terminal is greater than or equal to the operation authority of the data file, an authorization signal is generated, the operation behavior of the authorized terminal on the data file is recorded as the permission use behavior, and the number of permission use behaviors of the authorized terminal on the data file is counted;

[0112] For example, if the terminal authority of the authorized terminal is a first-level authority and the operation authority of the data file is a second-level authority, an authorization signal is generated and the operation behavior of the authorized terminal is recorded as a permission use behavior;

[0113] Step S17, summing the number of attempted operations on the data file by the unauthorized terminal, the number of unauthorized operations by the authorized terminal, and the number of permission usage behaviors to obtain the total number of operations on the data file by the data access terminal;

[0114] Collect the current real-time access count of the data file, collect the historical access count of the data file, and divide the historical access count of the data file by the total number of data files to obtain the average access count of the data file. It should be explained that when the historical access count of a data file is zero, the average access count of the data file defaults to one.

[0115] Step S18: The number of attempted operations on the data file by unauthorized terminals and the number of unauthorized operations on the data file by authorized terminals are summed and divided by the total number of operations on the data file by the data access terminals to obtain the abnormal behavior ratio. The value obtained by dividing the current real-time access volume of the data file by the average access volume and multiplying the result by the corresponding weight coefficient is added to the value obtained by multiplying the abnormal behavior ratio by the corresponding weight coefficient to obtain the exposure value of the data file in the data platform.

[0116] The exposure analysis module sends the exposure value to the comprehensive analysis module, and the exposure analysis module sends the authorization signal to the risk analysis module.

[0117] In this embodiment, the risk analysis module is used to analyze the risk of the data file based on the operation behavior of the authorized terminal after receiving the authorization signal. The analysis process includes the following sub-steps:

[0118] Step S21, please refer to Figure 3 As shown, the operation time of the authorized terminal on the data file is obtained, and the operation time of the authorized terminal on the data file is compared with the working time interval;

[0119] If the time of the operation of the data file by the authorized terminal falls within the working hours, the operation is not performed; if the time of the operation of the data file by the authorized terminal does not fall within the working hours, the process proceeds to the next step; for example, the working hours are preset intervals, which may be [9:00, 18:00];

[0120] Step S22: Record the operation behavior of the authorized terminal that does not fall within the working time interval as an abnormal time operation; obtain the minimum number of historical abnormal time operations, and use the minimum number of historical abnormal time operations as a reference threshold for abnormal time operations;

[0121] Step S23, obtaining the number of abnormal event operations of the authorized terminal at the current moment, and comparing the number of abnormal time operations of the authorized terminal at the current moment with a reference threshold;

[0122] If the number of abnormal time operations at the current moment is less than the reference threshold, no operation is performed; if the number of abnormal time operations at the current moment is greater than or equal to the reference threshold, proceed to the next step;

[0123] Step S24: real-time monitoring of specific operations of the authorized terminal on the data file;

[0124] When the terminal is authorized to perform read-only operations on data files, no operation will be performed;

[0125] When an authorized terminal performs an editing operation on a data file, the backup volume of the data file at the current moment is collected, and the backup coverage rate of the data file is obtained by dividing the backup volume of the data file at the current moment by the total number of data files;

[0126] For example, the fixed historical period is the past 24 hours, and the backup coverage of data files reflects the recoverability of data files;

[0127] When the authorized terminal performs a data file transmission operation, the transmission volume of the first-importance-level data file and the transmission volume of the second-importance-level data file are obtained, and the transmission volume of the first-importance-level data file is divided by the total number of data file transmissions to obtain the transmission ratio of the first-importance-level data file, and the transmission volume of the second-importance-level data file is divided by the total number of data file transmissions to obtain the transmission ratio DE of the second-importance-level data file;

[0128] Step S25: A risk value of the data file in the data platform is obtained by adding a value obtained by multiplying the transmission ratio of the data file of the first importance level by the first sensitivity value, a value obtained by multiplying the transmission ratio of the data file of the second importance level by the second sensitivity value, and the inverse of the backup coverage ratio of the data file.

[0129] The risk analysis module sends the risk values ​​of the data files in the data platform to the comprehensive analysis module.

[0130] Furthermore, the comprehensive analysis module is used to analyze the overall security of data files in the data platform based on the exposure value and the risk value. The analysis process includes the following sub-steps:

[0131] Step S31: Adding the value obtained by multiplying the exposure value of the data file by the corresponding weight coefficient and the value obtained by multiplying the risk value of the data file by the corresponding weight coefficient to obtain the overall security value of the data file in the data platform;

[0132] Step S32: If the overall security value of the data files in the data platform falls within the first security interval, indicating that the overall security of the data files in the data platform is low, a data file security alarm is triggered;

[0133] Step S33: If the overall security value of the data files in the data platform falls within the second security interval, indicating that the overall security of the data files in the data platform is normal, the data files are continuously monitored;

[0134] Step S34: If the overall security value of the data files in the data platform falls within the third security interval, indicating that the overall security of the data files in the data platform is high, no operation is performed;

[0135] Among them, the values ​​in the first safety interval are all greater than the values ​​in the second safety interval, and the values ​​in the second safety interval are all greater than the values ​​in the third safety interval. For example, the values ​​in the first safety interval are [1, +∞), the values ​​in the second safety interval are [0.4, 1), and the values ​​in the third safety interval are (0, 0.4).

[0136] In this application, if a corresponding calculation formula appears, the above calculation formula is dimensionless and its numerical calculation is performed. The weight coefficient, proportional coefficient and other coefficients in the formula are set to a result value obtained by quantifying each parameter. Regarding the size of the weight coefficient and the proportional coefficient, as long as it does not affect the proportional relationship between the parameter and the result value, it is acceptable.

[0137] Example 2: Please refer to Figure 4 As shown, based on another concept of the same invention, a data security analysis and processing method based on multi-directional supervision is now proposed, including the following steps:

[0138] Step S101, performing an initial analysis of the importance of data files based on the number of times the data files are used and the time interval between their last updates in different data platforms, and obtaining importance levels of different data files through analysis;

[0139] Step S102, configuring permissions for different data files based on importance levels;

[0140] Step S103, analyzing the data file based on the operation authority of the data access terminal and the access volume of the data file to obtain the exposure value of the data file;

[0141] Step S104: Analyze the data file based on different operation behaviors of the authorized terminal to obtain a risk value of the data file;

[0142] Step S105: Analyze the overall security of the data files in the data platform based on the exposure value and the risk value.

[0143] The preferred embodiments of the present invention disclosed above are intended only to help illustrate the present invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the present invention to specific embodiments. Obviously, many modifications and variations are possible based on the contents of this specification. These embodiments are selected and described in detail in this specification to better explain the principles and practical applications of the present invention, thereby enabling those skilled in the art to better understand and utilize the present invention. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A data security analysis and processing system based on multi-directional supervision, characterized in that: It includes an initial analysis module, a multi-directional supervision module, a permission configuration module, an exposure analysis module, a risk analysis module and a comprehensive analysis module; the multi-directional supervision module is used to collect the usage counts of data files in different data platforms and send them to the initial analysis module; The initial analysis module is used to perform an initial analysis of the importance of data files, generate importance levels for different data files through analysis, and send the results to the permission configuration module; the permission configuration module is used to configure permissions for different data files based on the importance levels, generate permission configuration results, and send them to the exposure analysis module and the risk analysis module; the multi-directional monitoring module is also used to collect the device codes of data access terminals and the operation behaviors of different data access terminals on data files in real time, and send them to the exposure analysis module; The exposure analysis module is used to analyze the exposure value of the data file based on the operation authority of the data access terminal and the access volume of the data file, determine whether the data access terminal is an authorized terminal or an unauthorized terminal, and generate an authorization signal when the operation authority of the authorized terminal is greater than or equal to the operation authority of the data file. At the same time, the exposure value of the data file in the data platform is calculated based on the number of attempted operation behaviors, the number of unauthorized behaviors, the total number of operation behaviors, the real-time access volume and the average access volume. If the exposure value of the data file is generated, it is sent to the comprehensive analysis module; if the authorization signal is generated, it is sent to the risk analysis module; The risk analysis module is used to analyze the risk of the data file based on the operation behavior of the authorized terminal after receiving the authorization signal. Based on the backup coverage rate of the data file, the sensitivity value and transmission ratio of data files of different importance levels, the risk value of the data file in the data platform is analyzed and sent to the comprehensive analysis module; The comprehensive analysis module is used to analyze the overall security of data files in the data platform based on exposure values ​​and risk values.

2. A data security analysis and processing system based on multi-directional supervision according to claim 1, characterized in that: The analysis process of the initial analysis module includes the following sub-steps: Step S1, obtaining the usage counts of different data files, adding the usage counts of different data files to obtain the total usage counts of all data files, and dividing the usage counts of different data files by the total usage counts of all data files to obtain the usage frequencies corresponding to the different data files; Step S2, calculating the average usage frequency of data files in the data platform; Step S3, calculating the standard deviation of the usage frequencies of the data files in the data platform, and dividing the usage frequencies corresponding to different data files by the average usage frequency to obtain the relative usage frequencies corresponding to the different data files.

3. A data security analysis and processing system based on multi-directional supervision according to claim 2, characterized in that: The analysis process of the initial analysis module further includes the following sub-steps: Step S4: subtract the last update time of different data files from the current time to obtain the latest update time interval corresponding to the different data files, add the latest update time intervals corresponding to the different data files, and divide the sum by the number of data files to obtain the average update time interval of the data files; Step S5, calculating the importance values ​​of different data files; Similarly, the importance thresholds of different data files are obtained by adding the value obtained by dividing the standard deviation of the usage frequency of data files in the data platform by the standard value and multiplying it by the corresponding weight coefficient, and the value obtained by dividing the average update time interval of the data files by the standard value and multiplying it by the corresponding weight coefficient. Step S6: If the importance value of the data file is greater than or equal to the importance threshold, the importance level of the corresponding data file is the first importance level; If the importance value of the data file is less than the importance threshold, the importance level of the corresponding data file is the second importance level.

4. A data security analysis and processing system based on multi-directional supervision according to claim 3, characterized in that: The configuration process of the permission configuration module includes the following sub-steps: Step S110: assigning different operation permissions to data files of different importance levels, specifically: Assign the operation authority of the data file of the first importance level to the first level authority; Allocate the operation permission of the data file of the second most important level as the second level permission, wherein the permission level of the first level permission is higher than the permission level of the second level permission; The device terminal that performs operations on data files is recorded as a data access terminal, and the operations include read-only, edit and transfer operations; Step S120: Configure operation behavior rules for different operation permissions, specifically: Allowing a data access terminal with a first-level operation authority to operate data files of the first and second importance levels; Allowing data access terminals with level 2 operation authority to operate data files of the second most important level; Data access terminals with level 2 operation authority are not allowed to operate data files with level 1 importance; Step S130: assign different sensitivity values ​​to data files of different importance levels, specifically: When the importance level of a data file is the first importance level, the corresponding data file is assigned the first sensitivity value; When the importance level of a data file is the second importance level, a second sensitivity value is assigned to the corresponding data file; wherein the first sensitivity value and the second sensitivity value are both positive numbers, and the value of the first sensitivity value is greater than the value of the second sensitivity value.

5. The data security analysis and processing system based on multi-directional supervision according to claim 4 is characterized in that: The analysis process of the exposure analysis module includes the following sub-steps: Step S11, comparing the device code of the data access terminal with the device code of the authorized terminal in the server; Step S12: If the device code of the data access terminal is different from the device code of the authorized terminal in the server, the corresponding data access terminal is recorded as an unauthorized terminal, and the operation behavior of the unauthorized terminal on the data file is recorded as an attempted operation behavior, and the number of attempted operations of the unauthorized terminal on the data file is counted; Step S13: If the device code of the data access terminal is the same as the device code of the authorized terminal in the server, the corresponding data access terminal is recorded as an authorized terminal and the process proceeds to the next step; Specifically, each data access terminal corresponds to a unique device code, and the authorized terminal is an authorized terminal.

6. A data security analysis and processing system based on multi-directional supervision according to claim 5, characterized in that: The analysis process of the exposure analysis module also includes the following sub-steps: Step S14, obtaining the operation authority of the authorized terminal, and comparing the operation authority of the authorized terminal with the operation authority of the data file; Step S15: If the operation authority of the authorized terminal is less than the operation authority of the data file, the operation behavior of the authorized terminal on the data file is recorded as unauthorized behavior, and the number of unauthorized behaviors of the authorized terminal on the data file is counted; Step S16: If the operation authority of the authorized terminal is greater than or equal to the operation authority of the data file, an authorization signal is generated, the operation behavior of the authorized terminal on the data file is recorded as the authority use behavior, and the number of authority use behaviors of the authorized terminal on the data file is counted.

7. A data security analysis and processing system based on multi-directional supervision according to claim 6, characterized in that: The analysis process of the exposure analysis module also includes the following sub-steps: Step S17, summing the number of attempted operations on the data file by the unauthorized terminal, the number of unauthorized operations by the authorized terminal, and the number of permission usage behaviors to obtain the total number of operations on the data file by the data access terminal; Collect the real-time access count of the data file at the current moment, collect the historical access count of the data file, and divide the historical access count of the data file by the total number of data files to obtain the average access count of the data file; when the historical access count of the data file is zero, the average access count of the data file defaults to one; Step S18: Calculate the exposure value of the data file in the data platform.

8. The data security analysis and processing system based on multi-directional supervision according to claim 1 is characterized in that: The analysis process of the risk analysis module includes the following sub-steps: Step S21, obtaining the time of the authorized terminal's operation on the data file, and comparing the time of the authorized terminal's operation on the data file with the working time interval; If the time of the operation of the data file by the authorized terminal falls within the working hours, no operation is performed; if the time of the operation of the data file by the authorized terminal does not fall within the working hours, the process proceeds to the next step; Step S22: Recording the operation of the authorized terminal that is not within the working time interval as abnormal time operation; Obtain the minimum number of historical abnormal time operations and use the minimum number of historical abnormal time operations as a reference threshold for abnormal time operations; Step S23, obtaining the number of abnormal event operations of the authorized terminal at the current moment, and comparing the number of abnormal time operations of the authorized terminal at the current moment with a reference threshold; If the number of abnormal time operations at the current moment is less than the reference threshold, no operation is performed; if the number of abnormal time operations at the current moment is greater than or equal to the reference threshold, proceed to the next step; Step S24: real-time monitoring of specific operations of the authorized terminal on the data file; When the terminal is authorized to perform read-only operations on data files, no operation will be performed; When an authorized terminal performs an editing operation on a data file, the backup volume of the data file at the current moment is collected, and the backup coverage rate of the data file is obtained by dividing the backup volume of the data file at the current moment by the total number of data files; When an authorized terminal performs a data file transmission operation, the transmission volume of the data file of the first importance level and the transmission volume of the data file of the second importance level are obtained, and the transmission volume of the data file of the first importance level is divided by the total amount of data file transmission to obtain the transmission ratio of the data file of the first importance level, and the transmission volume of the data file of the second importance level is divided by the total amount of data file transmission to obtain the transmission ratio of the data file of the second importance level; Step S25: Calculate the risk value of the data files in the data platform.

9. The data security analysis and processing system based on multi-directional supervision according to claim 1 is characterized in that: The analysis process of the comprehensive analysis module includes the following sub-steps: Step S31, calculating the overall security value of the data files in the data platform; Step S32: If the overall security value of the data files in the data platform falls within the first security interval, a data file security alarm is triggered; Step S33: If the overall security value of the data file in the data platform falls within the second security interval, the data file is continuously monitored; Step S34: If the overall security value of the data files in the data platform falls within the third security interval, no operation is performed; The values ​​within the first safety interval are all greater than the values ​​within the second safety interval, and the values ​​within the second safety interval are all greater than the values ​​within the third safety interval.

10. A data security analysis and processing method based on multi-directional supervision, characterized in that: Utilizing the data security analysis and processing system based on multi-directional supervision according to any one of claims 1 to 9, the method includes: Step S101, performing an initial analysis of the importance of data files based on the number of times the data files are used and the time interval between their last updates in different data platforms, and obtaining importance levels of different data files through analysis; Step S102, configuring permissions for different data files based on importance levels; Step S103, analyzing the data file based on the operation authority of the data access terminal and the access volume of the data file to obtain the exposure value of the data file; Step S104: Analyze the data file based on different operation behaviors of the authorized terminal to obtain a risk value of the data file; Step S105: Analyze the overall security of the data files in the data platform based on the exposure value and the risk value.

Images