Data security defense method and device for financial management system

Abstract

The application discloses a data security defense method and device of a financial management system, and relates to the technical field of data security. The method comprises the following steps: using a layered encryption mechanism to perform layered encryption on financial data of a client, and uploading the obtained layered encrypted financial data to a distributed network of a financial management system for storage; using a data security defense engine of the financial management system to collect multi-source monitoring data of the client accessing the financial management system, and performing attack detection on the multi-source monitoring data to obtain an attack detection result; according to the attack detection result, using a defense strategy generation model of the financial management system to generate a data security defense strategy, and adjusting the data security defense mechanism of the financial management system according to the data security defense strategy. The problems of insufficient data transmission and storage security, limited attack detection capability and lagging defense strategy response in the prior art are solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security, and in particular to a data security defense method and device for a financial management system. BACKGROUND

[0002] The financial management system is the core of enterprise informatization, and the financial data stored and processed thereby has extremely high sensitivity and value. Once the financial data is leaked, tampered with or destroyed, the enterprise will suffer huge economic losses and reputation risks. At present, the financial data security mainly faces the following challenges:

[0003] 1) Insufficient data transmission and storage security: traditional data encryption schemes often use a single encryption algorithm, and the key management is complex and has a single point failure risk. In the data transmission process, it is vulnerable to man-in-the-middle attacks; in the storage end, the static data encryption strength is insufficient and is also vulnerable to cracking.

[0004] 2) Limited attack detection capability: existing intrusion detection systems are mostly based on feature library matching or simple statistical models, and have insufficient detection capability for unknown attacks, zero-day vulnerability exploits and complex attack patterns such as advanced persistent threats, and have a high false negative rate and false positive rate. Deep learning models are used for time series data analysis, but their performance is heavily dependent on the initial settings of the model parameters, and traditional optimization algorithms are prone to local optima.

[0005] 3) Response lag of defense strategy: system defense is mostly static rule configuration, and relies on the experience of security experts for manual update. This way responds slowly and cannot dynamically adjust according to the changes in attack situation, and is difficult to cope with rapidly evolving network attacks. SUMMARY

[0006] The present application provides a data security defense method and device for a financial management system, which solves the problems of insufficient data transmission and storage security, limited attack detection capability and response lag of defense strategy in the prior art.

[0007] In a first aspect, the present application embodiment provides a data security defense method for a financial management system, the method comprising:

[0008] using a layered encryption mechanism to perform layered encryption on the financial data of the client, and uploading the obtained layered encrypted financial data to a distributed network of the financial management system for storage;

[0009] using a data security defense engine of the financial management system to collect multi-source monitoring data of the client accessing the financial management system, and performing attack detection on the multi-source monitoring data to obtain an attack detection result;

[0010] According to the attack detection result, a defense strategy generation model of the financial management system is used to generate a data security defense strategy, and according to the data security defense strategy, the data security defense mechanism of the financial management system is adjusted.

[0011] The technical scheme provided by the embodiments of the present application at least brings the following beneficial effects:

[0012] The hierarchical encryption mechanism avoids single-point failure analysis, protects against man-in-the-middle attacks in the data transmission process, uses distributed storage, and improves storage reliability and security; the data security defense engine uses a deep learning algorithm to construct and perform automated data monitoring and attack detection, which can more accurately capture complex attack behavior deep features and improve attack detection capability; the defense strategy generation model realizes the transition from “passive response” to “active prediction”, improves response speed, dynamically adjusts according to changes in attack situation, and responds to rapidly evolving network attacks.

[0013] In an optional implementation, a hierarchical encryption mechanism is used to perform hierarchical encryption on the financial data of the client, and the obtained hierarchical encrypted financial data is uploaded to a distributed network of the financial management system for storage, including:

[0014] The financial data plaintext generated by the client is encrypted once using the asymmetric encryption public key pre-installed locally on the client and issued by the key management center, to obtain the once-encrypted financial data;

[0015] A symmetric session key is negotiated and generated between the client and the financial management system through a quantum key distribution network, and the once-encrypted financial data is encrypted twice according to the symmetric session key to generate hierarchical encrypted financial data;

[0016] The hierarchical encrypted financial data is uploaded to the public partition of the financial management system, and in the public partition, the hierarchical encrypted financial data is decrypted once according to the symmetric session key to obtain the once-decrypted financial data;

[0017] The once-decrypted financial data is verified for legality, and after the legality verification is passed, the once-decrypted financial data of the public partition is transmitted to the cache partition of the financial management system;

[0018] In the cache partition, the once-decrypted financial data is decrypted twice according to the asymmetric encryption private key to obtain the twice-decrypted financial data;

[0019] The twice-decrypted financial data is verified for integrity, and after the integrity verification is passed, the twice-decrypted financial data of the cache partition is transmitted to the encryption partition of the financial management system;

[0020] In the encrypted partition, the twice-decrypted financial data is statically encrypted according to a static encryption key to obtain statically encrypted financial data, and the statically encrypted financial data is stored in the distributed network of the financial management system.

[0021] In an optional implementation, the data security defense engine is provided with a monitoring data collection layer, a monitoring data processing layer and an attack detection layer connected in sequence.

[0022] In an optional implementation, the attack detection layer is provided with an attack detection model constructed based on an ILFA-LSTM algorithm, and the construction method of the attack detection model comprises:

[0023] The monitoring data collection layer of the data security defense engine is used to collect a plurality of historical multi-source monitoring data of the client accessing the financial management system;

[0024] The monitoring data processing layer of the data security defense engine is used to pre-process the plurality of historical multi-source monitoring data to obtain a plurality of pre-processed historical multi-source monitoring data;

[0025] A corresponding preset attack detection label is added to each pre-processed historical multi-source monitoring data to obtain a plurality of training samples;

[0026] An attack detection model is constructed using an ILFA-LSTM algorithm according to the plurality of training samples;

[0027] The attack detection model is arranged in the attack detection layer of the data security defense engine.

[0028] In an optional implementation, the attack detection model is constructed using an ILFA-LSTM algorithm according to the plurality of training samples, comprising the following steps:

[0029] An initial attack detection model is constructed using an LSTM algorithm;

[0030] An initial model parameter of the initial attack detection model is optimized using an ILFA algorithm to obtain an optimized attack detection model;

[0031] The optimized attack detection model is trained according to the plurality of training samples to obtain a final attack detection model.

[0032] In an optional implementation, the initial model parameter of the initial attack detection model is optimized using an ILFA algorithm to obtain an optimized attack detection model, comprising:

[0033] The initial model parameter of the initial attack detection model is encoded into an individual vector of an ILFA individual in an ILFA population, and ILFA population parameters, a maximum iteration number and an fitness function of the ILFA algorithm are set;

[0034] According to the ILFA population parameters, an initial ILFA population is obtained by using a Circle chaotic mapping sequence for initialization;

[0035] In the biological pollination stage of the ILFA algorithm, the initial ILFA population is iteratively updated by using the dragonfly algorithm to obtain an updated ILFA population for global search, and a global optimal solution is retained;

[0036] A dynamic reverse mechanism is introduced to generate a plurality of reverse solutions of the updated ILFA population with a probability p , and a globally better solution is selected from the global optimal solution and the plurality of reverse solutions;

[0037] The globally better solution is locally optimized by using a convergence factor to control the step size of local search, to obtain a locally optimal solution, and a final optimal solution is selected from the locally optimal solution and the globally better solution;

[0038] The individual vector of an ILFA individual corresponding to the final optimal solution is decoded to obtain optimal initial model parameters, and an initial attack detection model is optimized according to the optimal initial model parameters to obtain an optimized attack detection model.

[0039] In an optional implementation, the multi-source monitoring data of the client accessing the financial management system are collected by using the data security defense engine of the financial management system, and the multi-source monitoring data are subjected to attack detection to obtain an attack detection result, including:

[0040] The multi-source monitoring data of the client accessing the financial management system are collected in real time by using the monitoring data collection layer of the data security defense engine of the financial management system;

[0041] The real-time collected multi-source monitoring data are preprocessed by using the monitoring data processing layer of the data security defense engine of the financial management system to obtain preprocessed multi-source monitoring data;

[0042] The preprocessed multi-source monitoring data are subjected to attack detection by using the attack detection model in the attack detection layer of the data security defense engine of the financial management system to obtain an attack detection result.

[0043] In an optional implementation, the defense strategy generation model is constructed based on the MPO-DRL algorithm, and the defense strategy generation model includes a meta-strategy optimization module constructed based on the MPO algorithm and a defense strategy generation module constructed based on the DRL algorithm connected to each other, the defense strategy generation module includes a defense strategy generation agent constructed based on the DQN algorithm and an experience replay pool, and the defense strategy generation agent is provided with a multi-objective joint reward function.

[0044] In an optional implementation, according to the attack detection result, a defense strategy generation model of the financial management system is used to generate a data security defense strategy, and according to the data security defense strategy, a data security defense mechanism of the financial management system is adjusted, including:

[0045] According to the attack detection result, a meta-strategy optimization module of the defense strategy generation model of the financial management system is used to adjust a defense strategy generation agent of the defense strategy generation module to obtain an adjusted defense strategy generation agent;

[0046] The real-time system state of the financial management system is collected, and according to the attack detection result and the real-time system state, a state space of the adjusted defense strategy generation agent is updated to obtain an updated state space;

[0047] In the experience replay pool of the defense strategy generation module, a plurality of historical experiences are randomly extracted, and according to the plurality of historical experiences, an action space of the adjusted defense strategy generation agent is updated to obtain an updated action space;

[0048] The adjusted defense strategy generation agent is used to select an execution action in the updated action space according to the updated state space and output, and according to the execution action, a data security defense strategy is obtained;

[0049] According to the data security defense strategy, the data security defense mechanism of the financial management system is adjusted, and the attack detection step is returned.

[0050] In a second aspect, the embodiments of the present application provide a data security defense device of a financial management system, which is used to implement the data security defense method. The device comprises:

[0051] A hierarchical encryption unit is configured to use a hierarchical encryption mechanism to perform hierarchical encryption on the financial data of the client, and upload the obtained hierarchical encrypted financial data to a distributed network of the financial management system for storage;

[0052] An attack detection unit is configured to use a data security defense engine of the financial management system to collect multi-source monitoring data of the client accessing the financial management system, and perform attack detection on the multi-source monitoring data to obtain an attack detection result;

[0053] A defense strategy adjustment unit is configured to use a defense strategy generation model of the financial management system to generate a data security defense strategy according to the attack detection result, and adjust a data security defense mechanism of the financial management system according to the data security defense strategy.

[0054] In a third aspect, the embodiments of the present application provide an electronic device, which comprises:

[0055] at least one processor; and a memory connected with the at least one processor in communication; wherein

[0056] The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to the first aspect of the embodiments of the present application.

[0057] The fourth aspect of the embodiments of the present application provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the method according to the first aspect of the embodiments of the present application. BRIEF DESCRIPTION OF DRAWINGS

[0058] Figure 1 is a schematic diagram of an electronic device structure of a hardware running environment related to the embodiments of the present application.

[0059] Figure 2 is a flow chart of steps of a data security defense method of a financial management system provided by the embodiments of the present application.

[0060] Figure 3 is a functional unit schematic diagram of a data security defense device of a financial management system provided by the embodiments of the present application. DETAILED DESCRIPTION

[0061] In order to make the above objectives, characteristics and advantages of the present application more apparent, comprehensible and easily understood, the present application will be further described in detail below with reference to the drawings and specific embodiments. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0062] The scheme of the present application will be further described below with reference to the drawings.

[0063] Reference Figure 1 , Figure 1 is a schematic diagram of an electronic device structure of a hardware running environment related to the embodiments of the present application.

[0064] As Figure 1As shown, the electronic device can include a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. The communication bus 1002 is used to realize the connection communication between the components. The user interface 1003 can include a display, an input unit such as a keyboard, and can also include a standard wired interface, a wireless interface. The network interface 1004 can optionally include a standard wired interface, a wireless interface (such as a wireless fidelity (WIreless-FIdelity, WI-FI) interface). The memory 1005 can be a high-speed random access memory (RAM) memory, or a stable non-volatile memory (Non-Volatile Memory, NVM), such as a disk memory. The memory 1005 can also be a storage device independent of the aforementioned processor 1001.

[0065] Those skilled in the art can understand that Figure 1 The structure shown in the figure does not constitute a limitation on the electronic device, and can include more or fewer components than the figure, or combine certain components, or different component arrangements.

[0066] As Figure 1 As shown, the memory 1005 as a storage medium can include an operation device, a data storage module, a network communication module, a user interface module, and an electronic program.

[0067] In Figure 1 In the electronic device shown, the network interface 1004 is mainly used for data communication with a network server; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the electronic device of the present application can be arranged in the electronic device, and the electronic device calls the data security defense device of the financial management system stored in the memory 1005 through the processor 1001, and executes the data security defense method of the financial management system provided by the embodiment of the present application.

[0068] Referring to Figure 2 , the embodiment of the present application provides a data security defense method of a financial management system, the method comprising:

[0069] S201: using a layered encryption mechanism, the financial data of the client is layered encrypted, and the obtained layered encrypted financial data is uploaded to a distributed network of a financial management system for storage;

[0070] S202: Collect multi-source monitoring data of the client accessing the financial management system using the data security defense engine of the financial management system, and perform attack detection on the multi-source monitoring data to obtain an attack detection result;

[0071] S203: Generate a data security defense strategy using a defense strategy generation model of the financial management system according to the attack detection result, and adjust the data security defense mechanism of the financial management system according to the data security defense strategy.

[0072] The technical scheme provided by the embodiments of the present application at least brings the following beneficial effects:

[0073] The hierarchical encryption mechanism avoids single-point failure analysis, protects against man-in-the-middle attacks during data transmission, uses distributed storage, and improves storage reliability and security; the data security defense engine uses a deep learning algorithm to construct and perform automated data monitoring and attack detection, which can more accurately capture complex attack behavior deep features and improve attack detection capability; the defense strategy generation model realizes the transition from "passive response" to "active prediction", improves response speed, and dynamically adjusts according to changes in attack posture to cope with rapidly evolving network attacks.

[0074] In an optional implementation, a hierarchical encryption mechanism is used to encrypt the financial data of the client in layers, and the obtained hierarchical encrypted financial data is uploaded to a distributed network of the financial management system for storage, including:

[0075] S2011: Encrypt the financial data plaintext generated by the client using the asymmetric encryption public key pre-installed locally and issued by the key management center to obtain one-time encrypted financial data, forming the first layer of protection;

[0076] S2012: Negotiate to generate a symmetric session key between the client and the financial management system through a quantum key distribution network, and encrypt the one-time encrypted financial data according to the symmetric session key to generate hierarchical encrypted financial data, forming hierarchical encrypted data with "asymmetric within the domain and symmetric between domains", and using the non-intercepting nature of quantum keys to ensure the security of inter-domain transmission;

[0077] S2013: Upload the hierarchical encrypted financial data to the public partition of the financial management system, and in the public partition, decrypt the hierarchical encrypted financial data according to the symmetric session key to obtain one-time decrypted financial data;

[0078] S2014: Perform legality verification (such as source IP, digital signature, etc.) on the one-time decrypted financial data, and if the legality verification is passed, transfer the one-time decrypted financial data in the public partition to the cache partition of the financial management system;

[0079] S2014: In the cache partition, the once-decrypted financial data is decrypted again according to the asymmetric encryption private key, to obtain twice-decrypted financial data;

[0080] S2015: The twice-decrypted financial data is subjected to integrity verification (such as hash value comparison), and after the integrity verification passes, the twice-decrypted financial data of the cache partition is transmitted to the encryption partition of the financial management system. The multi-partition and multi-level encryption and verification mechanism ensures the end-to-end security of data in the entire upload link;

[0081] S2016: In the encryption partition, the twice-decrypted financial data is statically encrypted according to the static encryption key, to obtain statically encrypted financial data, and the statically encrypted financial data is stored to the distributed network of the financial management system.

[0082] It is worth noting that through the hierarchical encryption of "intra-domain asymmetric + inter-domain symmetric", combined with quantum key distribution technology, the risk of eavesdropping in the traditional key distribution process is fundamentally eliminated. The multi-partition, multi-round decryption, verification and re-encryption process of the system end builds a defense-in-depth system. Even if a certain link is broken, the data is still in an encrypted state, ensuring the final security of the stored data.

[0083] In an optional implementation, the data security defense engine is provided with a monitoring data collection layer, a monitoring data processing layer and an attack detection layer connected in sequence.

[0084] In an optional implementation, the attack detection layer is provided with an attack detection model constructed based on an improved Lotus flower algorithm (ILFA)-Long Short-Term Memory (LSTM) algorithm, and the construction method of the attack detection model comprises:

[0085] A-1: Use the monitoring data collection layer of the data security defense engine to collect a plurality of historical multi-source monitoring data of the client accessing the financial management system;

[0086] It is worth noting that the multi-source monitoring data includes network flow logs of the client accessing the financial management system, system call logs of the financial management system during access, user operation behavior logs, database access logs and security device alarm information;

[0087] A-2: Use the monitoring data processing layer of the data security defense engine to pre-process the plurality of historical multi-source monitoring data to obtain a plurality of pre-processed historical multi-source monitoring data;

[0088] The preprocessing includes de-duplication processing, outlier processing, format conversion and normalization processing;

[0089] A-3: adding a corresponding preset attack detection label to each preprocessed historical multi-source monitoring data to obtain a plurality of training samples;

[0090] A-4: constructing an attack detection model using an ILFA-LSTM algorithm according to the plurality of training samples;

[0091] A-5: setting the attack detection model in an attack detection layer of a data security defense engine.

[0092] In an optional implementation, constructing an attack detection model using an ILFA-LSTM algorithm according to the plurality of training samples includes the following steps:

[0093] A-4-1: constructing an initial attack detection model using an LSTM algorithm;

[0094] A-4-2: optimizing initial model parameters of the initial attack detection model using an ILFA algorithm to obtain an optimized attack detection model;

[0095] A-4-3: training the optimized attack detection model according to the plurality of training samples to obtain a final attack detection model.

[0096] In an optional implementation, optimizing initial model parameters of the initial attack detection model using an ILFA algorithm to obtain an optimized attack detection model includes:

[0097] A-4-2-1: encoding the initial model parameters of the initial attack detection model into individual vectors of ILFA individuals in an ILFA population, and setting ILFA population parameters, a maximum number of iterations and a fitness function of the ILFA algorithm;

[0098] The formula is:

[0099]

[0100] In the formula, is the fitness function; is the attack detection accuracy of the ILFA individual ; is the false positive rate of the ILFA individual ; is the ILFA individual reference parameter; is the fitness weight;

[0101] A-4-2-2: According to the ILFA population parameters, use the Circle chaotic mapping sequence for initialization to obtain the initial ILFA population; enhance population diversity and avoid premature convergence;

[0102] The formula is:

[0103]

[0104] In the formula, is the initial ILFA population in the i initial ILFA individual; is the i chaotic variable; is the upper and lower bounds of the search space; i is the ILFA individual indicator;

[0105]

[0106] In the formula, is the i- 1 chaotic variable; is the control parameter (usually = 0.5); is the modulo function;

[0107] A-4-2-3: In the biological pollination stage of the ILFA algorithm, use the dragonfly algorithm to iteratively update the initial ILFA population to obtain an updated ILFA population for global search, and retain the global optimal solution; simulate insect pollination, and achieve it through the group behavior of the dragonfly algorithm;

[0108] If the individual is in the food / enemy neighborhood, update the individual position through the five behaviors of the dragonfly algorithm (separation, alignment, cohesion, food attraction, and enemy avoidance). The dragonfly algorithm can efficiently realize global search by simulating the group behavior of dragonflies (separation, alignment, cohesion, food attraction, and enemy avoidance), which is highly consistent with the biological pollination stage of the lotus algorithm. Therefore, the lotus algorithm directly adopts the mechanism of the dragonfly algorithm to enhance the global exploration ability:

[0109] The formula is:

[0110]

[0111] In the formula, is the separation behavior value of the iteration number t ; is the current individual position and the position of the adjacent individual at the iteration number ; is the ILFA individual indicator; t i,j N ​​The number of adjacent individuals; avoid collision between individuals and adjacent individuals, enhance population diversity, simulate the dispersion behavior of insects in the process of lotus pollination, and avoid over-concentration;

[0112]

[0113] In the formula, The number of iterations t The alignment behavior value; The number of iterations t The speed of adjacent individuals; make the individual speed consistent with the speed of adjacent individuals, enhance group cooperation, and simulate the cooperative flying behavior of insect groups in the pollination process;

[0114]

[0115] In the formula, The number of iterations t The cohesion behavior value; make the individual move to the center of adjacent individuals, enhance group aggregation, and simulate the behavior of insects gathering to the center of the flower cluster in the pollination process;

[0116]

[0117] In the formula, The number of iterations t The food attraction behavior value; The number of iterations t The food source position; guide the individual to move to the food source (optimal solution), simulate the behavior of insects being attracted by pollen, and accelerate global search;

[0118]

[0119] In the formula, The number of iterations t The enemy avoidance behavior value; The number of iterations t The enemy position; make the individual move away from the enemy (poor solution), avoid falling into local optimum, simulate the behavior of insects avoiding dangerous areas, and enhance the robustness of global exploration;

[0120]

[0121] In the formula, The number of iterations t+ 1, t The position change value; The global search weight;

[0122]

[0123] In the formula, The number of iterationst+ an updated ILFA individual of the updated ILFA population of 1; to update the weight;

[0124] When there is no solution around, the dragonfly flies randomly and adjusts its step length, which improves the random exploration behavior of the dragonfly in the search space, and the formula is:

[0125]

[0126] wherein, is the number of iterations of random flight t+ an updated ILFA individual of the updated ILFA population of 1; is a distributed random step length; d is a random flight parameter;

[0127] A-4-2-4: Introduce a dynamic reverse mechanism, after each iteration, with a certain probability p (as p =0.3), generate a number of reverse solutions of the updated ILFA population, and select the globally better solution from the global optimal solution and the number of reverse solutions; Introduce reverse solution, enhance global exploration ability;

[0128] The formula is:

[0129]

[0130] wherein, is the number of iterations t+ the reverse solution of the i th ILFA individual of the updated ILFA population of 1; is the current solution of the i th ILFA individual in the updated ILFA population; is the reverse solution of the i th ILFA individual in the updated ILFA population; is the fitness function;

[0131]

[0132] wherein, is the current solution of the i th ILFA individual in the updated ILFA population;

[0133] A-4-2-5: Use a convergence factor to control the step length of local search, locally optimize the globally better solution to get a locally optimal solution, and select the final optimal solution from the locally optimal solution and the globally better solution; Simulate wind / water spread pollen, and realize it through the moving mechanism of water droplets on lotus leaves;

[0134] The formula is:

[0135]

[0136] In the formula, is a step length of local search; is a base number; is a convergence factor, dynamically adjusts the step length of local search, and improves the convergence precision; is a maximum iteration number; is a current iteration number;

[0137]

[0138] In the formula, is a maximum value and a minimum value of the convergence factor;

[0139]

[0140] In the formula, is an iteration number t+ 1th i ILFA individual of local search; is a globally better solution; is an iteration number t+ 1th i ILFA individual of neighbor of the globally better solution;

[0141] A-4-2-6: decode the individual vector of the ILFA individual corresponding to the final optimal solution to obtain the optimal initial model parameter, and optimize the initial attack detection model according to the optimal initial model parameter to obtain the optimized attack detection model, which can effectively identify complex and time-correlated attack behaviors.

[0142] It is worth noting that the ILFA algorithm combines the global search capability of the dragonfly algorithm, the ability to jump out of local optimization of dynamic reverse learning, and the local fine search capability of the adaptive convergence factor, and can quickly and stably find the globally optimal initial model parameter. Using the ILFA-LSTM algorithm to construct the attack detection model solves the problem of LSTM parameter optimization through the improved intelligent optimization algorithm, so that it can more accurately capture the tiny features of complex attack behaviors in time series data, significantly improve the accuracy (reduce false positives) and recall rate (reduce false negatives) of detection, and has stronger identification ability for advanced threats.

[0143] In an optional implementation, the data security defense engine of the financial management system is used to collect multi-source monitoring data of the client accessing the financial management system, and attack detection is performed on the multi-source monitoring data to obtain an attack detection result, including:

[0144] S2021: using the monitoring data collection layer of the data security defense engine of the financial management system, real-time collection of multi-source monitoring data of the client accessing the financial management system;

[0145] S2022: using the monitoring data processing layer of the data security defense engine of the financial management system, pre-processing the real-time collected multi-source monitoring data to obtain pre-processed multi-source monitoring data;

[0146] S2023: using the attack detection model in the attack detection layer of the data security defense engine of the financial management system, attack detection on the pre-processed multi-source monitoring data to obtain an attack detection result.

[0147] In this embodiment, the attack detection result includes threat type, confidence score and attack source feature.

[0148] In an optional implementation, the defense strategy generation model is constructed based on a Meta-Policy Optimization (MPO)-Deep Reinforcement Learning (DRL) algorithm, and the defense strategy generation model includes a connected meta-policy optimization module constructed based on the MPO algorithm and a defense strategy generation module constructed based on the DRL algorithm, the defense strategy generation module includes a defense strategy generation agent constructed based on a Deep Q-Network (DQN) algorithm and an experience replay pool, and the defense strategy generation agent is provided with a multi-objective joint reward function.

[0149] It is worth noting that the meta-policy optimization module optimizes the DRL agent in the defense strategy generation module at the policy level, adjusts the internal parameters (such as learning rate and exploration rate) in the DRL agent at the meta level, makes it quickly adapt to new attack types, dynamically adjusts the decision tendency of the agent, provides high-level strategy guidance, makes the agent have stronger adaptability in complex and changeable network environment, through the meta-learning mechanism, the agent can quickly adapt to new tasks or environmental changes without starting from scratch, when the network topology, load and business demand frequently change, it can still maintain high performance, through the "learning to learn" mechanism, greatly reduces the dependence on a large amount of labeled data, improves the training efficiency;

[0150] The defense strategy generation module selects an optimal action according to the current state, uses a multi-objective joint reward function to comprehensively evaluate the trade-off of different objectives, approximates the Q value function through a neural network, realizes efficient decision-making in a high-dimensional state space, and balances multiple conflicting objectives through the design of the joint reward function, which meets the actual demand. The random sampling of experience in the experience replay pool avoids the temporal correlation between samples, improves the training stability, and reduces the dependence on real-time data.

[0151] Definition of the state space of the defense strategy generation agent: At the decision time step, the state observed by the agent is defined as a vector or matrix, including: real-time system state (CPU / memory usage, network connection number, attacked port, and other quantitative indicators), for example, {CPU: 45%, memory: 60%, active connection: 200, attack type: internal threat, confidence: 0.70, user: financial manager Zhang San}, and attack detection result.

[0152] Definition of the action space of the defense strategy generation agent: The action of the agent is defined as an executable defense operation, including "blocking IP", "limiting account permissions", "enabling two-factor authentication", "isolating affected services", "warning and recording", and other discrete actions.

[0153] Multi-objective joint reward function, used to evaluate the pros and cons of actions in states, the formula of the multi-objective joint reward function is:

[0154]

[0155] In the formula, is the number of iterations t is the multi-objective joint reward function value of the state; is the threat elimination effect reward; is the negative reward of business impact; is the resource consumption index; is an adjustable weight coefficient used to balance different optimization objectives;

[0156] The agent constantly explores and tries through a large number of interactions with the environment, the Actor network of the defense strategy generation agent outputs actions according to the state, the Critic network evaluates the value of the action and guides the Actor network to update parameters, and finally learns an optimal data security defense strategy, for example, starting a two-factor authentication challenge for the current session of user 'Zhang San';

[0157] The training process includes:

[0158] The Actor network (policy network) of the agent receives the state and outputs an action, and the output layer of the Actor network usually uses a softmax or tanh activation function to ensure that the action is within a reasonable range;

[0159] The action is applied to the network simulation environment or the actual network, and after the environment executes the scheme, it will move to a new state and generate a reward signal, and the reward is calculated according to the multi-objective joint reward function described above;

[0160] The Critic network (value network) evaluates the value of this experience (state, action, reward signal, new state), that is, calculates the time difference error, and uses the error to update the parameters of the Critic network to make the value evaluation more accurate. At the same time, the evaluation result of the Critic network is used to guide the parameter update of the Actor network, so that it tends to produce actions that can bring higher rewards;

[0161] Through continuous interaction with the environment and updating, the agent eventually learns an optimal strategy and can make the optimal data security defense strategy in any state;

[0162] In the reasoning phase, for a given state, the trained Actor network directly outputs the optimal data security defense strategy.

[0163] In an optional implementation, according to the attack detection result, a defense strategy generation model of the financial management system is used to generate a data security defense strategy, and according to the data security defense strategy, the data security defense mechanism of the financial management system is adjusted, including:

[0164] S2031: According to the attack detection result, the meta-strategy optimization module of the defense strategy generation model of the financial management system is used to adjust the defense strategy generation agent of the defense strategy generation module to obtain an adjusted defense strategy generation agent;

[0165] S2032: Collect the real-time system state of the financial management system, and update the state space of the adjusted defense strategy generation agent according to the attack detection result and the real-time system state to obtain an updated state space;

[0166] S2033: In the experience replay pool of the defense strategy generation module, a plurality of historical experiences are randomly extracted, and the action space of the adjusted defense strategy generation agent is updated according to the plurality of historical experiences to obtain an updated action space;

[0167] S2034: Using the adjusted defense strategy generation agent, an execution action is selected and output in the updated action space according to the updated state space, and a data security defense strategy is obtained according to the execution action;

[0168] S2035: According to the data security defense strategy, adjust the data security defense mechanism of the financial management system, and return to the attack detection step.

[0169] It is worth noting that the defense strategy generation model based on the MPO-DRL algorithm realizes the transition from "passive response" to "active prediction", the meta-strategy optimization enables the model to quickly adapt to new threats, the multi-objective joint reward function ensures the optimal balance of the defense strategy, and the system can generate and execute the optimal defense strategy according to the real-time situation, realizing the automation, intelligence and dynamic of defense.

[0170] The embodiment of the application also provides a data security defense device of a financial management system, referring to Figure 3 , a functional unit diagram of a data security defense device 300 of a financial management system is shown, and the device can include the following units:

[0171] The hierarchical encryption unit is configured to use a hierarchical encryption mechanism to perform hierarchical encryption on the financial data of the client, and upload the obtained hierarchical encrypted financial data to a distributed network of the financial management system for storage.

[0172] The attack detection unit is configured to use a data security defense engine of the financial management system to collect multi-source monitoring data of the client accessing the financial management system, and perform attack detection on the multi-source monitoring data to obtain an attack detection result.

[0173] The defense strategy adjustment unit is configured to use a defense strategy generation model of the financial management system to generate a data security defense strategy according to the attack detection result, and adjust the data security defense mechanism of the financial management system according to the data security defense strategy.

[0174] Based on the same inventive concept, another embodiment of the application provides an electronic device, which includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory complete communication with each other through the communication bus,

[0175] The memory is configured to store a computer program.

[0176] The processor is configured to execute the program stored on the memory to implement the data security defense method of the financial management system.

[0177] The communication bus mentioned above can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For the convenience of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or only one type of bus. The communication interface is used for communication between the terminal and other devices. The memory can include a Random Access Memory (RAM) and can also include a non-volatile memory, for example, at least one disk memory. Optionally, the memory can also be at least one storage device located away from the processor.

[0178] The processor mentioned above can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc. It can also be a Digital Signal Processing (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0179] In addition, to achieve the above-mentioned purpose, the embodiment of the present application also provides a computer readable storage medium, which stores a computer program. The computer program is executed by a processor to realize the data security defense method of the financial management system of the embodiment of the present application.

[0180] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, device or computer program product. Therefore, the embodiments of the present application can be in the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware aspects. Moreover, the embodiments of the present application can be in the form of a computer program product implemented on one or more computer usable vehicles (including but not limited to disk memory, CD-ROM, optical memory, etc.) containing computer usable program codes.

[0181] The embodiments of the present application are described with reference to the flowchart illustrations and / or block diagrams of the methods, terminal devices (apparatus) and computer program products according to embodiments of the present application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing terminal devices to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal devices, create means for implementing the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams.

[0182] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing terminal devices to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions means which implement the function specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams.

[0183] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal devices, such that a series of operational steps are performed on the computer or other programmable terminal devices to create a computer implemented process so that the instructions executed on the computer or other programmable terminal devices provide steps for implementing the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams.

[0184] Finally, it should also be noted that, in the present text, the relationship terms such as first and second, etc. are merely used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. "And / or" indicates that any one of the two or both can be selected. Moreover, the term "comprising" includes "consisting of" "consisting essentially of" or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed or inherent to such a process, method, article or terminal device. Without more limitations, the element defined by the phrase "comprising a…" does not exclude the presence of additional identical elements in the process, method, article or terminal device including the element.

[0185] The above merely illustrates the specific embodiments of the present application, but the protection scope of the present application is not limited thereto, and any skilled person in the art can easily think of various equivalent modifications or replacements within the technical range disclosed by the present application, and these modifications or replacements should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A data security defense method for a financial management system, characterized in that, The method includes: A layered encryption mechanism is used to encrypt the client's financial data in layers, and the resulting layered encrypted financial data is then uploaded to the distributed network of the financial management system for storage, including: Using the asymmetric encryption public key pre-installed on the client and issued by the key management center, the plaintext financial data generated by the client is encrypted once to obtain encrypted financial data; A symmetric session key is negotiated and generated between the client and the financial management system through a quantum key distribution network. The financial data that has been encrypted once is then encrypted a second time based on the symmetric session key to generate layered encrypted financial data. The layered encrypted financial data is uploaded to the public partition of the financial management system. In the public partition, the layered encrypted financial data is decrypted once according to the symmetric session key to obtain the decrypted financial data. The legality of the decrypted financial data is verified. Once the legality verification is passed, the decrypted financial data in the public partition is transferred to the cache partition of the financial management system. In the cache partition, the financial data that has been decrypted once is decrypted a second time using the asymmetric encryption private key to obtain the financial data after the second decryption. The integrity of the decrypted financial data is verified. Once the integrity verification is successful, the decrypted financial data in the cache partition is transferred to the encrypted partition of the financial management system. In the encrypted partition, the financial data after secondary decryption is statically encrypted according to the static encryption key to obtain the statically encrypted financial data, and the statically encrypted financial data is stored in the distributed network of the financial management system. The data security defense engine of the financial management system is used to collect multi-source monitoring data of client access to the financial management system, and attack detection is performed on the multi-source monitoring data to obtain the attack detection results. Based on the attack detection results, a data security defense strategy is generated using the defense strategy generation model of the financial management system. Then, the data security defense mechanism of the financial management system is adjusted according to the data security defense strategy.

2. The data security defense method for the financial management system according to claim 1, characterized in that, The data security defense engine is configured with a monitoring data acquisition layer, a monitoring data processing layer, and an attack detection layer connected in sequence.

3. The data security defense method for the financial management system according to claim 2, characterized in that, The attack detection layer is equipped with an attack detection model based on the ILFA-LSTM algorithm, and the method for constructing the attack detection model includes: The monitoring data acquisition layer of the data security defense engine is used to collect several historical multi-source monitoring data from client access to the financial management system. The monitoring data processing layer of the data security defense engine is used to preprocess several historical multi-source monitoring data to obtain several preprocessed historical multi-source monitoring data. Add corresponding preset attack detection labels to each preprocessed historical multi-source monitoring data to obtain several training samples; Based on several training samples, an attack detection model is constructed using the ILFA-LSTM algorithm; Set the attack detection model in the attack detection layer of the data security defense engine.

4. The data security defense method for the financial management system according to claim 3, characterized in that, Based on several training samples, an attack detection model is constructed using the ILFA-LSTM algorithm, including the following steps: An initial attack detection model is constructed using the LSTM algorithm; The ILFA algorithm is used to optimize the initial model parameters of the initial attack detection model, resulting in an optimized attack detection model. The optimized attack detection model is trained based on several training samples to obtain the final attack detection model.

5. The data security defense method for a financial management system according to claim 4, characterized in that, The ILFA algorithm is used to optimize the initial model parameters of the initial attack detection model, resulting in an optimized attack detection model, including: The initial model parameters of the initial attack detection model are encoded as individual vectors of ILFA individuals in the ILFA population, and the ILFA population parameters, maximum number of iterations, and fitness function of the ILFA algorithm are set. Based on the ILFA population parameters, the initial ILFA population is obtained by initializing using the Circle chaotic mapping sequence; In the biological pollination stage of the ILFA algorithm, the dragonfly algorithm is used to iteratively update the initial ILFA population, obtain the updated ILFA population for global search, and retain the global optimal solution. Introducing a dynamic reverse mechanism, based on probability p Generate several reverse solutions for the updated ILFA population, and select the globally better solution from the globally optimal solution and several reverse solutions; The convergence factor is used to control the step size of the local search, and the better global solution is locally optimized to obtain the local optimum. The final optimum solution is then selected from the local optimum solution and the better global solution. The individual vectors of the ILFA individuals corresponding to the final optimal solution are decoded to obtain the optimal initial model parameters. Based on the optimal initial model parameters, the initial attack detection model is optimized to obtain the optimized attack detection model.

6. The data security defense method for a financial management system according to claim 5, characterized in that, The data security defense engine of the financial management system is used to collect multi-source monitoring data on client access to the financial management system, and attack detection is performed on the multi-source monitoring data to obtain attack detection results, including: The monitoring data acquisition layer of the financial management system's data security defense engine collects multi-source monitoring data from client access to the financial management system in real time. The monitoring data processing layer of the data security defense engine of the financial management system is used to preprocess the real-time multi-source monitoring data to obtain preprocessed multi-source monitoring data. The attack detection model in the attack detection layer of the data security defense engine of the financial management system is used to perform attack detection on the preprocessed multi-source monitoring data to obtain the attack detection results.

7. The data security defense method for a financial management system according to claim 6, characterized in that, The defense strategy generation model is constructed based on the MPO-DRL algorithm, and includes a meta-policy optimization module based on the MPO algorithm and a defense strategy generation module based on the DRL algorithm. The defense strategy generation module includes a defense strategy generation agent based on the DQN algorithm and an experience replay pool. The defense strategy generation agent is equipped with a multi-objective joint reward function.

8. The data security defense method for a financial management system according to claim 7, characterized in that, Based on the attack detection results, a data security defense strategy is generated using the defense strategy generation model of the financial management system. Then, the data security defense mechanism of the financial management system is adjusted according to the data security defense strategy, including: Based on the attack detection results, the meta-policy optimization module of the defense policy generation model of the financial management system is used to adjust the defense policy generation agent of the defense policy generation module, resulting in the adjusted defense policy generation agent. The system collects the real-time system status of the financial management system, and updates and adjusts the defense strategy based on the attack detection results and the real-time system status to generate the state space of the intelligent agent, thus obtaining the updated state space. In the experience replay pool of the defense strategy generation module, a number of historical experiences are randomly selected, and the action space of the defense strategy generation agent is updated and adjusted based on these historical experiences to obtain the updated action space. The agent is generated using the adjusted defense strategy. Based on the updated state space, an action is selected from the updated action space for output. Based on the action, the data security defense strategy is obtained. Based on the data security defense strategy, adjust the data security defense mechanism of the financial management system and return to the attack detection steps.

9. A data security defense device for a financial management system, used to implement the data security defense method as described in any one of claims 1-8, characterized in that, The device includes: The layered encryption unit is used to perform layered encryption on the client's financial data using a layered encryption mechanism, and then uploads the obtained layered encrypted financial data to the distributed network of the financial management system for storage. The attack detection unit is used to collect multi-source monitoring data of client access to the financial management system using the data security defense engine of the financial management system, and to perform attack detection on the multi-source monitoring data to obtain the attack detection results. The defense strategy adjustment unit is used to generate a data security defense strategy based on the attack detection results and the defense strategy generation model of the financial management system, and to adjust the data security defense mechanism of the financial management system according to the data security defense strategy.

Images