Method and system for risk assessment of information protection

Abstract

The application discloses a risk assessment method and system for information protection and belongs to the technical field of information security, and specifically comprises the following steps: obtaining attack characteristic data generated based on an attack characteristic fingerprint library and a blockchain cluster architecture; extracting risk feature vectors of nodes at all levels by using a large model coupling mechanism, and obtaining optimized risk values of the nodes at all levels by means of a preset risk assessment model, which correspond to the threat degree of the nodes; calculating the risk correlation degrees of different blockchain nodes by a cross-chain collaborative interaction mechanism according to the optimized risk values of the nodes at all levels, triggering cross-chain data synchronization, and finally obtaining a comprehensive risk assessment result containing a total risk value after dynamic weight distribution, a risk contribution degree ranking and risk trend prediction data, and improving the security protection of the blockchain.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, specifically a risk assessment method and system for information protection. Background Technology

[0002] In today's digital age, information security faces numerous challenges, with a proliferation of attack methods. Traditional risk assessment methods often struggle to comprehensively and accurately evaluate the complex and ever-changing security threats. While the decentralized and immutable characteristics of blockchain technology offer new solutions for information security, a single blockchain has limitations in addressing diverse attacks and cannot fully utilize information from different types of attacks for comprehensive risk assessment. Therefore, a method is needed that combines cross-chain blockchain technology to achieve more efficient and accurate information protection risk assessment. Summary of the Invention

[0003] To address the shortcomings of existing technologies, this invention proposes a risk assessment method and system for information protection. It acquires attack feature data generated based on an attack feature fingerprint database and a blockchain cluster architecture; extracts risk feature vectors from nodes at all levels using a large model coupling mechanism; obtains optimized risk values ​​for each level of node using a pre-set risk assessment model, which correspond to the node's threat level; and calculates the risk correlation between different blockchain nodes based on the optimized risk values ​​of each level of node through a cross-chain collaborative interaction mechanism, triggering cross-chain data synchronization. Finally, it obtains a comprehensive risk assessment result including the total risk value after dynamic weight allocation, risk contribution ranking, and risk trend prediction data, thereby improving blockchain security.

[0004] To achieve the above objectives, the present invention provides the following technical solution:

[0005] Risk assessment methods for information protection include:

[0006] Acquire attack feature data; the attack feature data is generated based on an attack feature fingerprint database and a blockchain cluster architecture; the attack feature data includes multi-level attack scale nodes; the multi-level attack scale nodes include attack method feature parameter sets, attack traffic intensity, duration and data packet feature information corresponding to each level of node;

[0007] The system obtains risk assessment instructions, uses a large model coupling mechanism to extract features from attack feature data, obtains risk feature vectors for each level of node, and uses a preset risk assessment model to predict the risk of the extracted risk feature vectors, thereby obtaining optimized risk values ​​for each level of node; the risk values ​​correspond to the threat level of nodes at each level of attack.

[0008] Based on the optimized risk values ​​of nodes at each level, the risk correlation of different blockchain nodes is calculated through the configured cross-chain collaborative interaction mechanism, triggering cross-chain data synchronization to obtain comprehensive risk assessment results; the comprehensive risk assessment results include the total risk value after dynamic weight allocation, risk contribution ranking, and risk trend prediction data.

[0009] Specifically, the attack signature data is generated based on an attack signature fingerprint database and a blockchain cluster architecture, including:

[0010] A1: Construct a blockchain cluster architecture, which includes one main chain and at least three side chains. The nodes of the main chain are full nodes, and the nodes of the side chains include full nodes and light nodes. The main chain is responsible for storing the hash values ​​of the attack feature fingerprint database and the global risk assessment results. The side chains are responsible for storing the attack feature data of the corresponding business domain in real time.

[0011] A2: Build an attack signature fingerprint database and update it in batches. After each batch update, calculate the SHA-256 hash value and write it into the main chain block through the main chain smart contract to form an immutable version record.

[0012] A3: Sidechain light nodes capture network traffic using deep packet inspection (DPC) technology, extract attack features, and send them to the sidechain full nodes. The sidechain full nodes call the main chain cross-link interface to obtain the latest fingerprint database hash value. They verify the integrity by comparing the latest fingerprint database hash value with the hash value in the local fingerprint database. After successful verification, they perform similarity matching between the real-time attack features and templates in the attack feature fingerprint database. The attack features include attack tool signatures, path topology, and vulnerability exploit sequences. The local fingerprint database refers to a copy of the attack feature fingerprint database stored on the local storage medium of the sidechain full node. The local storage medium can be a server hard drive or a distributed cache.

[0013] A4: Based on the matching results, the attack feature data is mapped to multi-level attack scale nodes, and the feature data of each attack scale node is stored on the blockchain through a sidechain smart contract.

[0014] Specifically, the process of constructing the attack feature fingerprint database includes:

[0015] B1: Collect historical attack sample data and extract a three-dimensional feature vector for each attack sample; the three-dimensional feature vector includes: attack tool signature, attack path topology, and vulnerability exploitation sequence; the attack tool signature adopts N-gram features of binary instruction sequence; the attack path topology adopts topological embedding vector extracted by graph neural network; the vulnerability exploitation sequence adopts API call chain generated by dynamic taint analysis;

[0016] B2: Establish a feature similarity calculation model; the feature similarity calculation model uses an improved cosine similarity algorithm to calculate the similarity between three-dimensional feature vectors;

[0017] B3: Perform cluster analysis on attack samples that exceed the preset similarity threshold, and use each cluster as an attack feature fingerprint template;

[0018] B4: Calculate the feature mean vector and variance matrix of the three-dimensional feature vectors within each cluster to generate an attack feature fingerprint database; the feature mean vector is the arithmetic mean of the feature values ​​in each dimension; the variance matrix is ​​the covariance matrix of the feature values ​​in each dimension.

[0019] Specifically, the improved cosine similarity algorithm in B2 calculates the similarity between three-dimensional feature vectors by: calculating the cosine similarity of each of the three feature vectors in the three-dimensional feature vectors, that is, dividing the dot product of the attack tool feature code vectors by the product of the L2 norms of the attack tool feature code vectors to obtain a first-class cosine similarity; dividing the dot product of the topological embedding vectors of the attack path topology by the product of the corresponding L2 norms to obtain a second-class cosine similarity; and dividing the dot product of the API call chain vectors of the vulnerability exploit sequence by the product of the corresponding L2 norms to obtain a third-class cosine similarity; multiplying the obtained first-class, second-class, and third-class cosine similarities by their respective preset weights; adding the three product results together, and then dividing the sum by the sum of the three preset weights to obtain the similarity between the three-dimensional feature vectors.

[0020] Specifically, the step of using a large model coupling mechanism to extract features from attack feature data to obtain risk feature vectors at corresponding node levels includes:

[0021] C1: Construct a large model coupling architecture; the large model coupling architecture includes a cascaded structure of Transformer models and graph convolutional networks;

[0022] C2: Standardize and normalize the feature parameter set of multi-level attack nodes, concatenate the N-gram vector of the attack tool feature code and the API call chain vector into sequence features, and use the topological embedding vector of the attack path topology as graph features.

[0023] C3: Input the sequence features into the Transformer model, calculate the dependencies between features through the self-attention mechanism, and output the sequence feature vector;

[0024] C4: Input graph features into the graph convolutional network model, aggregate neighbor node features through the adjacency matrix, and output graph feature vector;

[0025] C5: Concatenate the sequence feature vector with the graph feature vector, and map it to a risk feature vector through a fully connected layer. The risk feature vectors of each node are extracted separately.

[0026] C6: Calculate the reconstruction error between the extracted risk feature vector and the attack feature data. If the reconstruction error is greater than the preset error threshold, repeat steps C2-C3 until the reconstruction error is less than or equal to the preset error threshold.

[0027] C7: Store the verified risk feature vector in the node's attack feature fingerprint database, and calculate the SHA-256 hash value of the corresponding risk feature vector, and then store it on the blockchain through the sidechain smart contract.

[0028] Specifically, the step of using a preset risk assessment model to predict the risk of the extracted risk feature vector and obtain optimized risk values ​​for each level of node includes:

[0029] D1: Load the gradient boosting machine model, take the risk feature vector of historical attack events as input and the actual threat level as output, train the gradient boosting machine model, and obtain the trained gradient boosting machine model as the risk assessment model.

[0030] D2: Input the risk feature vectors of each level of node into the risk assessment model and output the initial risk value;

[0031] D3: A dynamic correction factor is introduced to optimize the initial risk value of the output, resulting in optimized risk values ​​for each level of node; the dynamic correction factor is determined based on the attack duration and the traffic intensity deviation rate.

[0032] D4: Store the optimized risk values ​​of each level of node in the risk value contract of the sidechain, and synchronize them to the global risk database of the main chain node through the cross-chain relay node.

[0033] Specifically, the configuration process of the cross-chain collaborative interaction mechanism includes:

[0034] E1: Set up cross-chain relay nodes, including setting up at least one cross-chain relay node on each sidechain and two cross-chain relay nodes on each mainchain;

[0035] E2: Deploy a risk correlation calculation contract on the main chain, including:

[0036] Receive the risk values ​​synchronized by each sidechain node, execute the correlation algorithm, and output the risk correlation matrix;

[0037] E3: Deploy data synchronization contracts on each sidechain, including:

[0038] Receive the correlation results synchronized from the main chain risk correlation calculation contract and update the risk correlation records locally on the side chain;

[0039] E4: The sidechain node generates a proof of the optimized risk value of each level of node through the zero-knowledge proof algorithm, and sends the proof and the hash value of the optimized risk value of each level of node to the sidechain cross-chain relay node.

[0040] E5: The sidechain cross-chain relay node verifies the validity of the proof. After the verification is successful, the risk value, node identifier and proof are forwarded to the risk correlation calculation contract of the main chain.

[0041] E6: After the main chain's risk correlation calculation contract completes the risk correlation calculation, it sends the result to the data synchronization contracts of each side chain to complete cross-chain synchronization.

[0042] Specifically, the calculation of the risk correlation between different blockchain nodes includes:

[0043] F1: Extract optimized risk values ​​for each level of node within a preset time period for each blockchain node, forming a time series;

[0044] F2: The risk correlation is calculated using an improved Pearson correlation coefficient; the improved Pearson correlation coefficient includes:

[0045] Obtain the time series of risk values ​​for node i within a preset time period. Calculate the mean of the risk value time series. Obtain the time series of risk values ​​for node j within a preset time period. and the corresponding mean ;

[0046] For each time point k, calculate the risk value of node i at time point k and... The difference is used to obtain the first difference, and the risk value of node j at time point k is compared with... The difference between the first and second differences is used to obtain the second difference. The first and second differences are multiplied and summed along the time axis to obtain the sum of the numerators.

[0047] Calculate the sum of squares of all time points at node i, and then take the square root of the sum to obtain the first square value. At the same time, calculate the sum of squares of all time points at node j, and then take the square root of the sum to obtain the second square value. Multiply the first square value and the second square value to obtain the product of the denominators.

[0048] Divide the sum of the numerators by the product of the denominators to obtain the risk correlation between the two nodes.

[0049] F3: Construct a risk correlation matrix based on the risk correlation of all node pairs.

[0050] Specifically, the triggering of cross-chain data synchronization and obtaining comprehensive risk assessment results includes:

[0051] G1: After calculating the risk correlation between different blockchain nodes, a risk correlation threshold is set. If the risk correlation between two blockchain nodes exceeds the risk correlation threshold, cross-chain data synchronization is triggered. The cross-chain data synchronization process is achieved through a cross-chain collaborative interaction mechanism. The synchronized data includes the optimized risk values ​​and attack characteristic data of each level of each blockchain node.

[0052] G2: Based on the synchronized data, obtain the optimized risk values ​​of each level of nodes, and use the weighted average method to calculate the comprehensive risk assessment result after dynamic weight allocation.

[0053] The information protection risk assessment system includes: a data acquisition module, a model coupling module, and a comprehensive risk assessment module;

[0054] The data acquisition module is used to collect attack signature data for risk assessment.

[0055] The model coupling module is used to analyze the acquired attack feature data, extract risk features, and predict the risk values ​​of nodes at all levels.

[0056] The comprehensive risk assessment module is used to calculate the risk correlation between different blockchain nodes based on the risk values ​​of nodes at each level, and obtain the comprehensive risk assessment results.

[0057] Compared with the prior art, the beneficial effects of the present invention are:

[0058] 1. This invention proposes a risk assessment system for information protection, and optimizes and improves its architecture, operation steps and processes. The system has the advantages of simple process, low investment and operating costs and low production and working costs.

[0059] 2. This invention proposes a risk assessment method for information protection. Based on an attack feature fingerprint database and a blockchain cluster architecture, attack feature data containing detailed information on nodes at multiple attack levels is generated. Risk feature vectors are extracted using a large model coupling mechanism, and then predicted by a preset risk assessment model to obtain optimized risk values ​​for nodes at each level. This method can comprehensively and accurately measure the threat level of nodes at each attack level, avoiding the problems of insufficient or excessive protection caused by inaccurate risk assessment.

[0060] 3. This invention proposes a risk assessment method for information protection. Based on the optimized risk values ​​of nodes at all levels, the risk correlation of different blockchain nodes is calculated through a cross-chain collaborative interaction mechanism, and cross-chain data synchronization is triggered. Finally, a comprehensive risk assessment result is obtained, which includes the total risk value after dynamic weight allocation, the ranking of risk contribution, and the prediction of risk trends. This helps to grasp the overall risk status of the blockchain system, clarify the contribution of each node to the system risk, and predict the risk development trend in advance. Attached Figure Description

[0061] Figure 1 This is a schematic diagram of the information protection risk assessment method of the present invention;

[0062] Figure 2 This is a flowchart illustrating the principle of the risk assessment method for information protection in this invention.

[0063] Figure 3 This is a diagram of the risk assessment system architecture for information protection in this invention. Detailed Implementation

[0064] Example 1:

[0065] Please see Figure 1 and Figure 2 The present invention provides an embodiment of a risk assessment method for information protection, the method comprising S1-S3, including the following steps:

[0066] S1: Obtain attack feature data, which is generated based on an attack feature fingerprint database and a blockchain cluster architecture; the attack feature data includes multi-level attack scale nodes; the multi-level attack scale nodes include attack method feature parameter sets, attack traffic intensity, duration and data packet feature information corresponding to each level of node;

[0067] Furthermore, the process of obtaining the attack method feature parameter set includes:

[0068] (1) For the characteristic parameters of the attack tool, the binary code in the attack data packet is analyzed by deep packet inspection technology to identify the opcode and operand of the attack tool. Combined with the pre-established attack tool characteristic library, the type and version of the attack tool are determined. For example, by analyzing the specific instruction sequence in the attack data packet, it is determined whether it is a common attack tool such as Metasploit. The deep packet inspection technology is the prior art in this field and is not an inventive solution of this application. It will not be described in detail here.

[0069] (2) Regarding attack path characteristic parameters, in the blockchain cluster architecture, each node maintains an attack path tracking table. When an attack is detected, the source and destination of the attack data packet are recorded, and the attack path tracking table is updated. By analyzing the information in the attack path tracking table, the key nodes of the attack path are determined, such as the interception status of security devices like firewalls and intrusion detection systems, as well as the propagation path of the attack in the blockchain network.

[0070] (3) For vulnerability exploitation characteristic parameters, use vulnerability scanning tools to regularly scan blockchain nodes and record the vulnerability information of the nodes. When an attack occurs, combine the results of dynamic taint analysis to determine the specific vulnerability exploited by the attacker, including the vulnerability's CVE number, the scope of the vulnerability's impact, and the exploitation difficulty parameters.

[0071] Furthermore, the calculation process for the attack traffic intensity includes:

[0072] (1) Define attack traffic intensity as the attack data packet characteristics per unit time, including two indicators: data packet rate and byte rate;

[0073] (2) The total number and total bytes of attack data packets in each window are counted using the sliding window method;

[0074] (3) Using 3 The criteria identify abnormal traffic values ​​within a window and replace these abnormal traffic values ​​with the average of the three windows before and after the current window.

[0075] (4) Construct an attack traffic baseline and calculate the deviation rate between the real-time traffic intensity and the attack traffic baseline; the deviation rate is equal to the difference between the real-time value and the baseline value divided by the baseline value. When the deviation rate is greater than 50%, it is marked as an abnormal increase in traffic intensity.

[0076] (5) The traffic intensity thresholds of nodes at all attack levels are dynamically updated through the main chain smart contract, and the update is based on the statistical analysis results of attack events in the past 30 days.

[0077] Furthermore, the process of determining the duration includes:

[0078] (1) The duration starts from the time of the attack characteristics and is recorded through the timestamp service of the sidechain node;

[0079] (2) The condition for determining the end of the duration is that the attack feature is not detected within 3 consecutive sliding windows, or the attack traffic intensity drops below L1 level and lasts for 1 minute. At this time, the end time is recorded.

[0080] (3) The duration is equal to the difference between the attack feature time and the endpoint time; if an interruption occurs during the attack and the interruption duration is less than 5 minutes, it is considered a continuous attack, and the total duration is the sum of the durations of each segment; if the interruption duration is greater than or equal to 5 minutes, the starting point is recorded again.

[0081] (4) The duration is divided into short-term, medium-term and long-term. The classification results are used as input parameters for subsequent risk value calculation and stored in the duration statistics contract of the side chain; the short-term is less than 5 minutes; the medium-term is 5 minutes to 30 minutes; and the long-term is greater than 30 minutes.

[0082] S2: Obtain risk assessment instructions, use the large model coupling mechanism to extract features from attack feature data, obtain risk feature vectors for each level of nodes, and use a preset risk assessment model to predict the risk of the extracted risk feature vectors, thereby obtaining optimized risk values ​​for each level of nodes; the risk values ​​correspond to the threat level of nodes at each level of attack.

[0083] The risk assessment instruction is issued by the management node in the blockchain cluster. This instruction contains the task information for the risk assessment, such as the time range of the assessment and the range of nodes to be assessed.

[0084] Furthermore, the process of obtaining risk assessment instructions includes:

[0085] (1) Risk assessment instructions are triggered in two ways: automatic and manual. Automatic triggering is triggered when L3 or higher attack level nodes are detected. Manual triggering is initiated by the administrator through the management console of the main chain node and requires signature confirmation from more than 2 / 3 of the main chain nodes.

[0086] (2) The risk assessment instruction format is a JSON structure, which includes the assessment scope, time window, assessment accuracy level, and response strategy switch. The assessment scope is the main chain and the specified side chain identifier. The time window includes the start time and the end time. The response strategy switch is whether to automatically execute risk mitigation measures.

[0087] (3) When automatically triggered, the sidechain full node generates the instruction and sends it to the main chain relay node; when manually triggered, the administrator instruction is encrypted by the management console and sent to the main chain full node; the main chain relay node verifies the instruction signature and then broadcasts it to all main chain nodes and related sidechain nodes.

[0088] (4) After receiving the instruction, the node returns a confirmation message containing its own node ID and timestamp. After the main chain receives confirmation messages from at least half of the nodes, the instruction is marked to enter the execution state and recorded in the main chain transaction log.

[0089] S3: Based on the optimized risk values ​​of nodes at all levels, calculate the risk correlation of different blockchain nodes through the configured cross-chain collaborative interaction mechanism, trigger cross-chain data synchronization, and obtain comprehensive risk assessment results; the comprehensive risk assessment results include the total risk value after dynamic weight allocation, risk contribution ranking, and risk trend prediction data.

[0090] In summary, the core of this application is to accurately identify network attack risks and provide comprehensive assessment results through blockchain technology and artificial intelligence models. Specifically, the entire process consists of three main steps: The first step is feature extraction: first, an attack feature fingerprint database is built, and then attack behaviors in the network are captured in real time by a blockchain cluster, attack features are extracted, and these attack features are classified into nodes with different attack magnitudes; the blockchain cluster is a distributed system composed of a main chain and multiple side chains; the second step is risk assessment: after receiving a risk assessment instruction, key risk information is extracted from the attack features using Transformer and graph neural networks, and then the risk value of each attack node is calculated using a trained risk assessment model, which also dynamically adjusts the risk value based on attack duration, traffic intensity, etc.; the third step is correlation calculation: through a cross-chain collaborative interaction mechanism, the risk correlation degree of different nodes is calculated, data synchronization is triggered, and finally, a comprehensive assessment result is summarized.

[0091] For example, an enterprise blockchain cluster detected abnormal traffic. This cluster uses one main chain and three side chains. Light nodes on the side chains extracted attack signatures using deep packet inspection. The attack tool was a customized scanner, which yielded N-gram feature vectors. After the attack path is routed through three layers, the topology embedding vector is obtained. The exploit sequence contains 5 API calls, resulting in a vector. The sidechain full node calls the main chain interface to obtain the fingerprint database hash. After verifying the integrity of the local database, it calculates the matching degree using an improved cosine similarity algorithm. After weighting, it calculates the comprehensive similarity. Assuming the weighted comprehensive similarity is 0.82, exceeding the threshold of 0.8, it is mapped to an L3-level attack-capable node. The attack feature data is stored on-chain via the sidechain smart contract. After the risk assessment command is triggered, the large model coupling architecture starts: the Transformer model processes the concatenated data. and Sequence features, outputting an N-dimensional sequence vector; graph convolutional network processing. The topological features are used to output an N-dimensional graph vector. These two vectors are concatenated and passed through a fully connected layer to generate an M-dimensional risk feature vector. This vector is then input into a trained gradient boosting machine model, which outputs an initial risk value. A dynamic correction factor is then applied to obtain an optimized node risk value, which is stored in the sidechain risk value contract and synchronized to the main chain. The main chain risk correlation calculation contract receives the synchronized risk values ​​from the sidechain nodes, extracts the time series data of sidechain A and sidechain B over the past hour, and calculates the risk correlation using an improved Pearson correlation coefficient. Assuming a risk correlation of 0.72, if it exceeds the preset risk correlation threshold of 0.6, cross-chain data synchronization is triggered. A total risk value is obtained based on a dynamic weighted average. Based on the total risk value, sidechain A ranks first in risk contribution, and trend prediction indicates that the risk will increase in the next hour.

[0092] For example, consider an enterprise's internal encrypted customer data storage system. This system employs high-strength encryption algorithms to protect customer privacy data, a crucial information protection measure that effectively prevents data leakage during unauthorized access. When an attacker attempts to crack this encrypted storage system, the system first acquires attack characteristic data. For instance, by analyzing the code in the attack data packets, it identifies that the attacker is using a tool specifically designed to crack encryption algorithms. It also traces the attack path through the system's firewall and encryption authentication nodes, and discovers that the attacker exploited known vulnerabilities in the encrypted storage system. Next, it analyzes the attack traffic, finding an abnormal increase in the number of data packets and total bytes per unit time, deviating from the normal traffic baseline by more than half. For example, if the attack started at 9:00 AM with two brief interruptions, each lasting less than five minutes, it is considered a continuous attack, with a total duration of twenty minutes, classifying it as a mid-term attack. Afterward, the system receives a risk assessment instruction and uses a large-scale model to couple... The mechanism extracts key information from these attack characteristics to form a risk feature vector, which is then analyzed using a pre-set risk assessment model. This analysis considers factors such as the threat level of the attack tools, the scope of the vulnerability's impact, abnormal traffic intensity, and duration to determine the current risk value of the encrypted storage system. Due to the long duration of the attack and the significant traffic anomalies, the risk value is assessed as high. Finally, through a cross-chain collaborative interaction mechanism, the risk correlation between the encrypted system's nodes and non-nodes is calculated. This reveals a high correlation between this attack and previous attacks targeting the data transmission encryption channel, triggering cross-chain data synchronization. The comprehensive risk assessment results are then compiled, showing that the customer data encrypted storage system has the highest risk contribution, and the risk is expected to increase in the near future. In summary, the advantages of this application are that by comprehensively capturing various characteristics of attacks and conducting assessments according to standardized procedures, it is possible to accurately grasp the risk status of information protection measures. For example, attacks against encryption systems are analyzed in detail, from tools and paths to vulnerability exploitation. Combined with data such as traffic and duration, the risk assessment becomes more accurate. At the same time, the cross-chain collaborative interaction mechanism can discover the correlation between different attacks and take joint protective measures in advance to further strengthen information protection and prevent the leakage of important customer data due to the breach of encryption systems.

[0093] The attack signature data is generated based on an attack signature fingerprint database and a blockchain cluster architecture, and includes:

[0094] A1: Construct a blockchain cluster architecture, which includes one main chain and at least three side chains. The nodes of the main chain are full nodes, and the nodes of the side chains include full nodes and light nodes. The main chain is responsible for storing the hash values ​​of the attack feature fingerprint database and the global risk assessment results. The side chains are responsible for storing the attack feature data of the corresponding business domain in real time.

[0095] A2: Construct an attack feature fingerprint database and update it in batches. After each batch update, calculate the SHA-256 hash value and write it into the main chain block through the main chain smart contract to form an immutable version record. Here, SHA-256 is existing technology in this field and is not an inventive solution of this application, so it will not be described in detail here.

[0096] Furthermore, the batch update process of the attack signature fingerprint database includes:

[0097] (1) Set an update cycle and collect new attack sample data in each update cycle;

[0098] (2) Perform feature extraction and clustering on the newly added attack sample data. If the similarity between the newly added attack sample data and the template in the attack feature fingerprint database is lower than the preset threshold, a new fingerprint template is generated. If the similarity between the newly added attack sample data and the template in the attack feature fingerprint database is higher than the preset threshold, the feature mean vector and variance matrix of the template are updated.

[0099] (3) Generate batch update data, including the new fingerprint template and the updated template, calculate the SHA-256 hash value of the batch data, and record the update time, update personnel and update description;

[0100] (4) Initiate a hash value writing transaction through the main chain smart contract. The transaction information includes: batch number, hash value, and update time. The main chain node performs consensus verification on the transaction and writes it into the main chain block after the verification is successful.

[0101] (5) The main chain generates an update notification, which is synchronized to all side chain full nodes through the cross-chain relay node. The side chain full nodes download the corresponding batch of update data according to the notification and complete the local fingerprint database update.

[0102] A3: Sidechain light nodes capture network traffic using deep packet inspection (DPC) technology, extract attack features, and send them to the sidechain full nodes. The sidechain full nodes call the main chain cross-link interface to obtain the latest fingerprint database hash value. They verify the integrity by comparing the latest fingerprint database hash value with the hash value in the local fingerprint database. After successful verification, they perform similarity matching between the real-time attack features and templates in the attack feature fingerprint database. The attack features include attack tool signatures, path topology, and vulnerability exploit sequences. The local fingerprint database refers to a copy of the attack feature fingerprint database stored on the local storage medium of the sidechain full node. The local storage medium can be a server hard drive or a distributed cache.

[0103] It's important to note that the main chain stores the attack signature fingerprint database hash and global results, while the side chains store real-time attack data. Traditional centralized storage is susceptible to tampering or single points of failure. However, in a blockchain cluster, the main chain's hash storage ensures the attack signature fingerprint database version is immutable, and the side chain's partitioned storage allows for independent management of attack data from different business domains. This ensures both data security and improved query efficiency. For example, if any side chain is attacked and its data is tampered with, the main chain's hash value can quickly detect the anomaly without affecting the operation of other side chains.

[0104] A4: Based on the matching results, the attack feature data is mapped to multi-level attack intensity nodes, and the feature data of each attack intensity node is stored on the blockchain through a sidechain smart contract. Among them, L1 level is low intensity, with a similarity of [0.6, 0.7) and an attack traffic intensity of less than 100pps, where pps represents the data packet rate, i.e., the number of data packets per second; L2 level is low to medium intensity, with a similarity of [0.7, 0.8) or an attack traffic intensity of [100pps, 500pps); L3 level is medium intensity, with a similarity of [0.8, 0.9) or an attack traffic intensity of [500pps, 1000pps); L4 level is medium to high intensity, with a similarity of [0.9, 0.95] or an attack traffic intensity of [1000pps, 5000pps]; L5 level is high intensity, with a similarity greater than 0.95 or an attack traffic intensity greater than 5000pps.

[0105] The process of constructing the attack signature fingerprint database includes:

[0106] B1: Collect historical attack sample data and extract a three-dimensional feature vector for each attack sample; the three-dimensional feature vector includes: attack tool signature, attack path topology, and vulnerability exploitation sequence; the attack tool signature adopts N-gram features of binary instruction sequence; the attack path topology adopts topological embedding vector extracted by graph neural network; the vulnerability exploitation sequence adopts API call chain generated by dynamic taint analysis;

[0107] Furthermore, the attack tool signature is obtained by decompiling the executable file of the attack tool to obtain a binary instruction sequence. The binary instruction sequence is then converted into an N-gram feature vector using the N-gram feature extraction method. Specifically, this includes converting the binary code of the attack tool into an instruction sequence, where each instruction includes an opcode and operands. Then, the range of N is set (in this invention, N is 2-5). Subsequences of length N are extracted sequentially from the instruction sequence using a sliding window method, and these subsequences are used as N-gram features.

[0108] Attack path topology: The network nodes traversed during the attack, such as routers, firewalls, and servers, are treated as graph nodes, and the communication connections between nodes are treated as directed edges, with the edge weight being the communication frequency, thus constructing an attack path topology graph. A graph attention network is used to extract features from the attack path topology graph, and a multi-head attention mechanism is used to calculate the dependencies between nodes, generating a topology embedding vector. Specifically, this includes: First, constructing the attack path as a directed graph, where nodes represent various components in the attack process, and edges represent the attack flow or interaction relationships between components. Then, initializing the embedding representation of the nodes in the graph, assigning a vector to each node using random initialization. Next, through the message passing mechanism of the graph neural network, in each layer of the network, the node updates its own embedding vector based on the embedding vectors of its neighboring nodes. After multiple iterations, the final embedding vector of each node is obtained. Finally, the embedding vectors of all nodes are aggregated to obtain the topology embedding vector of the entire attack path topology. The graph attention network is existing technology in this field and is not an inventive solution of this application, and will not be elaborated upon here.

[0109] Vulnerability Exploitation Sequence: Dynamic taint analysis tools, such as Pin, are used to track the vulnerability exploitation process of attack samples, marking the attack input data as taint sources. Then, during system operation, the flow of tainted data is monitored, the API calls that the tainted data passes through are recorded, and the API call chain triggered during taint propagation is recorded. The call chain is converted into a sequence feature vector according to the execution order. For example, when an attacker triggers a buffer overflow vulnerability by inputting malicious data, the tainted data will start from the input point, go through a series of memory operations and function calls, and may eventually lead to system crash or execution of malicious code. The API call chain includes API name, call parameters, and return value. Pin is existing technology in this field and is not an inventive solution of this application, so it will not be described in detail here.

[0110] It should be noted that by extracting attack tool signatures, attack path topology, and vulnerability exploitation sequences, a three-dimensional fingerprint of the attack is constructed. Compared to traditional methods that only focus on a single feature, such as the attack tool, the three-dimensional features of this application can comprehensively depict the attack behavior. For example, APT attacks may use common tools, but the attack path and vulnerability exploitation sequence are unique. The three-dimensional features can accurately distinguish them and avoid misjudgment. For example, when two attacks both use the Nmap scanning tool, but the attack paths and vulnerability exploitation sequences are different, such as one going through an internal network router and the other directly attacking the server, or one using SQL injection and the other using XSS, the three-dimensional features of this application can accurately distinguish them, laying the foundation for subsequent identification.

[0111] B2: Establish a feature similarity calculation model; the feature similarity calculation model uses an improved cosine similarity algorithm to calculate the similarity between three-dimensional feature vectors;

[0112] The improved cosine similarity algorithm in B2 calculates the similarity between three-dimensional feature vectors by: firstly, calculating the cosine similarity of each of the three feature vectors in the three-dimensional feature vectors, that is, dividing the dot product of the attack tool feature code vector by the product of the L2 norm of the vector to obtain a first-class cosine similarity; dividing the dot product of the topological embedding vector of the attack path topology by the product of the L2 norm of the vector to obtain a second-class cosine similarity; and dividing the dot product of the API call chain vector of the vulnerability exploit sequence by the product of the L2 norm of the vector to obtain a third-class cosine similarity; then multiplying the obtained first-class, second-class, and third-class cosine similarities by their corresponding preset weights; finally, adding the three product results together, dividing the sum by the sum of the three preset weights, and finally improving the cosine similarity to obtain the similarity between the three-dimensional feature vectors.

[0113] B3: Perform cluster analysis on attack samples that exceed the preset similarity threshold, and use each cluster as an attack feature fingerprint template;

[0114] It should be noted that templated storage can significantly improve real-time matching efficiency, eliminating the need to compare samples one by one. Furthermore, the mean and variance can cover subtle differences in similar attacks. For example, when dealing with weak password attacks, different attackers may have slightly different attempt frequencies and password dictionaries, but the clustered template can cover these differences, ensuring that no cases are missed due to differences in details during real-time capture.

[0115] B4: Calculate the feature mean vector and variance matrix of the three-dimensional feature vectors within each cluster to generate an attack feature fingerprint database; the feature mean vector is the arithmetic mean of the feature values ​​in each dimension; the variance matrix is ​​the covariance matrix of the feature values ​​in each dimension.

[0116] The method of using a large model coupling mechanism to extract features from attack feature data to obtain risk feature vectors at corresponding node levels includes:

[0117] C1: Constructing a large model coupling architecture; the large model coupling architecture includes a cascaded structure of a Transformer model and a graph convolutional network, wherein the Transformer model and the graph convolutional network are existing technologies in this field and are not inventive solutions of this application, and will not be described in detail here;

[0118] C2: Standardize and normalize the feature parameter set of multi-level attack nodes, concatenate the N-gram vector of the attack tool feature code and the API call chain vector into sequence features, and use the topological embedding vector of the attack path topology as graph features.

[0119] C3: Input the sequence features into the Transformer model, calculate the dependencies between features through the self-attention mechanism, and output the sequence feature vector;

[0120] C4: Input graph features into the graph convolutional network model, aggregate the features of neighboring nodes through the adjacency matrix, and output the graph feature vector;

[0121] C5: Concatenate the sequence feature vector with the graph feature vector, and map it to a risk feature vector through a fully connected layer. The risk feature vectors of each node are extracted separately.

[0122] C6: Calculate the reconstruction error between the extracted risk feature vector and the attack feature data. If the reconstruction error is greater than the preset error threshold, repeat steps C2-C3 until the reconstruction error is less than or equal to the preset error threshold.

[0123] C7: Store the verified risk feature vector in the node's attack feature fingerprint database, and calculate the SHA-256 hash value of the corresponding risk feature vector, and then store it on the blockchain through the sidechain smart contract.

[0124] The step of using a preset risk assessment model to predict the risk of the extracted risk feature vector and obtain optimized risk values ​​for each level of node includes:

[0125] D1: Load the gradient boosting machine model, take the risk feature vector of historical attack events as input and the actual threat level as output, train the gradient boosting machine model, and obtain the trained gradient boosting machine model as a risk assessment model. The gradient boosting machine model is the prior art in this field and is not an inventive solution of this application, so it will not be described in detail here.

[0126] It should be noted that this application uses a gradient boosting machine model, which trains the model using risk feature vectors from historical attacks and actual threat levels, enabling the model to learn to predict risks from features. Traditional models often rely on manually set rules, while the gradient boosting machine model learns from historical data, capturing complex feature relationships and making more accurate predictions. For example, if the attack traffic is only 800pps, lower than the traditional 1000pps threshold, the gradient boosting machine model learns that the combination of "the traffic lasting for 1 hour and exploiting the Log4j vulnerability" poses an extremely high risk, thus avoiding missed detections.

[0127] D2: Input the risk feature vectors of each level of node into the risk assessment model and output the initial risk value;

[0128] D3: A dynamic correction factor is introduced to optimize the initial risk value of the output, resulting in optimized risk values ​​for each level of node; the dynamic correction factor is determined based on the attack duration and the traffic intensity deviation rate.

[0129] It should be noted that risk is not static. An attack with the same traffic intensity, lasting 10 minutes, poses a completely different threat than one that lasts 2 hours. An attack with a sudden surge in traffic is more dangerous than an attack with stable traffic. The correction factor makes the risk value change with the attack, and the result is more realistic. For example, if the initial risk value of any attack is 5, but the duration is 30 minutes and the traffic intensity deviation rate is 60%, the risk value will rise to 8 after correction, which more accurately reflects the threat.

[0130] D4: Store the optimized risk values ​​of each level of node in the risk value contract of the sidechain, and synchronize them to the global risk database of the main chain node through the cross-chain relay node.

[0131] The configuration process for the cross-chain collaborative interaction mechanism includes:

[0132] E1: Set up cross-chain relay nodes, including setting up at least one cross-chain relay node on each sidechain and two cross-chain relay nodes on each mainchain;

[0133] It should be noted that relay nodes, i.e. data transfer stations, are set up on both the sidechain and the main chain. The main chain deploys a risk correlation calculation contract, and the sidechain deploys a data synchronization contract. Compared with traditional cross-chain solutions that rely heavily on centralized intermediaries and are vulnerable to attacks or tampering, the mechanism in this application achieves decentralized data transmission and computation through relay nodes and smart contracts. For example, the relay nodes use the Byzantine fault tolerance algorithm, and the contract automatically executes calculations and synchronization, avoiding errors or malicious operations caused by human intervention.

[0134] E2: Deploy a risk correlation calculation contract on the main chain, including:

[0135] Receive the risk values ​​synchronized by each sidechain node, execute the correlation algorithm, and output the risk correlation matrix;

[0136] E3: Deploy data synchronization contracts on each sidechain, including:

[0137] Receive the correlation results synchronized from the main chain risk correlation calculation contract and update the risk correlation records locally on the side chain;

[0138] E4: The sidechain node generates a proof of the optimized risk value of each level of node through the zero-knowledge proof algorithm, and sends the proof and the hash value of the optimized risk value of each level of node to the sidechain cross-chain relay node. The zero-knowledge proof algorithm is the prior art in this field and is not an inventive solution of this application, so it will not be described in detail here.

[0139] E5: The sidechain cross-chain relay node verifies the validity of the proof. After the verification is successful, the risk value, node identifier and proof are forwarded to the risk correlation calculation contract of the main chain.

[0140] E6: After the main chain's risk correlation calculation contract completes the risk correlation calculation, it sends the result to the data synchronization contracts of each side chain to complete cross-chain synchronization.

[0141] The calculation of the risk correlation between different blockchain nodes includes:

[0142] F1: Extract optimized risk values ​​for each level of node within a preset time period for each blockchain node, forming a time series;

[0143] F2: The risk correlation is calculated using an improved Pearson correlation coefficient; the improved Pearson correlation coefficient includes:

[0144] Obtain the time series of risk values ​​for node i within a preset time period. Calculate the mean of the risk value time series. Similarly, obtain the time series of risk values ​​for node j within a preset time period. and the corresponding mean ;

[0145] For each time point k, calculate the risk value of node i at time point k and... The difference is used to obtain the first difference, and the risk value of node j at time point k is compared with... The difference between the first and second differences is used to obtain the second difference. The first and second differences are multiplied and summed along the time axis to obtain the sum of the numerators.

[0146] Calculate the sum of squares of all time points at node i, and then take the square root of the sum to obtain the first square value. At the same time, calculate the sum of squares of all time points at node j, and then take the square root of the sum to obtain the second square value. Multiply the first square value and the second square value to obtain the product of the denominators.

[0147] Divide the sum of the numerators by the product of the denominators to obtain the risk correlation between the two nodes.

[0148] F3: Construct a risk correlation matrix based on the risk correlation of all node pairs.

[0149] The triggering of cross-chain data synchronization and obtaining comprehensive risk assessment results includes:

[0150] G1: After calculating the risk correlation between different blockchain nodes, a risk correlation threshold is set. If the risk correlation between two blockchain nodes exceeds the risk correlation threshold, cross-chain data synchronization is triggered. The cross-chain data synchronization process is achieved through a cross-chain collaborative interaction mechanism. The synchronized data includes the optimized risk values ​​and attack characteristic data of each level of each blockchain node.

[0151] G2: Based on the synchronized data, obtain the optimized risk values ​​of each level of nodes, and use the weighted average method to calculate the comprehensive risk assessment result after dynamic weight allocation.

[0152] Example 2:

[0153] Please see Figure 3 Another embodiment of the present invention provides: a risk assessment system for information protection, comprising:

[0154] Data acquisition module, model coupling module, and comprehensive risk assessment module;

[0155] The data acquisition module is used to collect attack signature data for risk assessment, providing data support for subsequent risk analysis;

[0156] The model coupling module is used to analyze the acquired attack feature data, extract risk features, and predict the risk values ​​of nodes at each level to quantify the threat level of the attack.

[0157] The comprehensive risk assessment module is used to calculate the risk correlation between different blockchain nodes based on the risk values ​​of nodes at all levels, and obtain comprehensive risk assessment results to help users understand the risk status of the entire system.

[0158] The data acquisition module includes: a data generation unit and an instruction acquisition unit;

[0159] The data generation unit is used to generate attack feature data based on the attack feature fingerprint database and the blockchain cluster architecture. The attack feature fingerprint database stores feature information of various known attacks. Combined with the blockchain cluster architecture, it can comprehensively capture the attack situation on different nodes and generate data containing nodes with multiple levels of attack volume. It covers the attack method feature parameter set, attack traffic intensity, duration and data packet feature information corresponding to each level of node, providing rich data for accurate assessment of attack risks.

[0160] The instruction acquisition unit is used to acquire risk assessment instructions, which are the trigger signals to start the subsequent risk assessment process. Only when this instruction is received will the system begin to process and analyze the acquired attack feature data.

[0161] The model coupling module includes: a feature extraction unit and a risk prediction unit;

[0162] The feature extraction unit is used to extract features from attack feature data using the large model coupling mechanism. The large model has powerful data processing and analysis capabilities, and can mine risk feature vectors at each level of nodes from complex attack feature data. These vectors can accurately reflect the characteristics and potential risks of the attack.

[0163] The risk prediction unit is used to predict risks by using a preset risk assessment model to extract risk feature vectors. The risk assessment model is built based on historical data and can analyze and calculate the input risk feature vectors to obtain optimized risk values ​​for nodes at each level. These risk values ​​correspond to the threat level of nodes at each level of attack, providing basic data for subsequent comprehensive risk assessment.

[0164] The comprehensive risk assessment module includes: a correlation calculation unit and a result generation unit;

[0165] The correlation calculation unit is used to calculate the risk correlation of different blockchain nodes based on the optimized risk values ​​of nodes at all levels, through the configured cross-chain collaborative interaction mechanism. The cross-chain collaborative interaction mechanism enables information sharing and interaction between different blockchain nodes. By analyzing the relationship between the risk values ​​of each node, the risk correlation between them is calculated, thereby understanding the propagation and impact of attacks on different nodes.

[0166] The result generation unit triggers cross-chain data synchronization, integrating and synchronizing the risk data and correlation information of each node. Based on the synchronized data, a comprehensive risk assessment result is obtained, including the total risk value after dynamic weight allocation, risk contribution ranking, and risk trend prediction data. Dynamic weight allocation rationally distributes weights according to the importance and risk level of each node, making the total risk value more accurately reflect the overall risk of the system. The risk contribution ranking clarifies the magnitude of each node's contribution to the system's risk, while the risk trend prediction data helps users understand the development trend of risks in advance and take corresponding preventative measures.

[0167] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments under the guidance of the present invention without departing from the spirit and scope of the present invention. All of these variations are within the protection scope of the present invention.

Claims

1. A risk assessment method for information protection, characterized in that, include: Obtain attack signature data; The attack signature data is generated based on an attack signature fingerprint database and a blockchain cluster architecture; The attack signature data includes nodes at multiple attack magnitude levels; The multi-level attack scale nodes include the attack method feature parameter set, attack traffic intensity, duration and data packet feature information corresponding to each level of nodes; Obtain risk assessment instructions, use the large model coupling mechanism to extract features from attack feature data, obtain risk feature vectors for each level of node, and use the preset risk assessment model to predict the risk of the extracted risk feature vectors to obtain the optimized risk values ​​for each level of node. The risk value corresponds to the threat level of nodes at each attack level; Based on the optimized risk values ​​of nodes at each level, the risk correlation of different blockchain nodes is calculated through the configured cross-chain collaborative interaction mechanism, cross-chain data synchronization is triggered, and a comprehensive risk assessment result is obtained. The comprehensive risk assessment results include the total risk value after dynamic weight allocation, the risk contribution ranking, and risk trend prediction data.

2. The information protection risk assessment method as described in claim 1, characterized in that, The attack signature data is generated based on an attack signature fingerprint database and a blockchain cluster architecture, and includes: A1: Construct a blockchain cluster architecture, which includes one main chain and at least three side chains. The nodes of the main chain are full nodes, and the nodes of the side chains include full nodes and light nodes. The main chain is responsible for storing the hash values ​​of the attack feature fingerprint database and the global risk assessment results. The side chains are responsible for storing the attack feature data of the corresponding business domain in real time. A2: Build an attack signature fingerprint database and update it in batches. After each batch update, calculate the SHA-256 hash value and write it into the main chain block through the main chain smart contract to form an immutable version record. A3: Sidechain light nodes capture network traffic using deep packet inspection (DPC) technology, extract attack features, and send them to the sidechain full nodes. The sidechain full nodes call the main chain cross-link interface to obtain the latest fingerprint database hash value. They verify the integrity by comparing the latest fingerprint database hash value with the hash value in the local fingerprint database. After successful verification, they perform similarity matching between the real-time attack features and templates in the attack feature fingerprint database. The attack features include attack tool signatures, path topology, and vulnerability exploit sequences. The local fingerprint database refers to a copy of the attack feature fingerprint database stored on the local storage medium of the sidechain full node. The local storage medium can be a server hard drive or a distributed cache. A4: Based on the matching results, the attack feature data is mapped to multi-level attack scale nodes, and the feature data of each attack scale node is stored on the blockchain through a sidechain smart contract.

3. The information protection risk assessment method as described in claim 2, characterized in that, The process of constructing the attack signature fingerprint database includes: B1: Collect historical attack sample data and extract a three-dimensional feature vector for each attack sample; the three-dimensional feature vector includes: attack tool signature, attack path topology, and vulnerability exploitation sequence; the attack tool signature adopts N-gram features of binary instruction sequence; the attack path topology adopts topological embedding vector extracted by graph neural network; the vulnerability exploitation sequence adopts API call chain generated by dynamic taint analysis; B2: Establish a feature similarity calculation model; the feature similarity calculation model uses an improved cosine similarity algorithm to calculate the similarity between three-dimensional feature vectors; B3: Perform cluster analysis on attack samples that exceed the preset similarity threshold, and use each cluster as an attack feature fingerprint template; B4: Calculate the feature mean vector and variance matrix of the three-dimensional feature vectors within each cluster to generate an attack feature fingerprint database; the feature mean vector is the arithmetic mean of the feature values ​​in each dimension; the variance matrix is ​​the covariance matrix of the feature values ​​in each dimension.

4. The information protection risk assessment method as described in claim 3, characterized in that, The improved cosine similarity algorithm in B2 calculates the similarity between three-dimensional feature vectors by: calculating the cosine similarity of each of the three feature vectors in the three-dimensional feature vectors, i.e., dividing the dot product of the attack tool feature code vectors by the product of the L2 norms of the attack tool feature code vectors to obtain a first-class cosine similarity; dividing the dot product of the topological embedding vectors of the attack path topology by the product of the corresponding L2 norms to obtain a second-class cosine similarity; and dividing the dot product of the API call chain vectors of the vulnerability exploit sequence by the product of the corresponding L2 norms to obtain a third-class cosine similarity; multiplying the obtained first-class, second-class, and third-class cosine similarities by their respective preset weights; summing the three product results and dividing the sum by the sum of the three preset weights to obtain the similarity between the three-dimensional feature vectors.

5. The information protection risk assessment method as described in claim 4, characterized in that, The method of using a large model coupling mechanism to extract features from attack feature data to obtain risk feature vectors at corresponding node levels includes: C1: Construct a large model coupling architecture; the large model coupling architecture includes a cascaded structure of Transformer models and graph convolutional networks; C2: Standardize and normalize the feature parameter set of multi-level attack nodes, concatenate the N-gram vector of the attack tool feature code and the API call chain vector into sequence features, and use the topological embedding vector of the attack path topology as graph features. C3: Input the sequence features into the Transformer model, calculate the dependencies between features through the self-attention mechanism, and output the sequence feature vector; C4: Input graph features into the graph convolutional network model, aggregate neighbor node features through the adjacency matrix, and output graph feature vector; C5: Concatenate the sequence feature vector with the graph feature vector, and map it to a risk feature vector through a fully connected layer. The risk feature vectors of each node are extracted separately. C6: Calculate the reconstruction error between the extracted risk feature vector and the attack feature data. If the reconstruction error is greater than the preset error threshold, repeat steps C2-C3 until the reconstruction error is less than or equal to the preset error threshold. C7: Store the verified risk feature vector in the node's attack feature fingerprint database, and calculate the SHA-256 hash value of the corresponding risk feature vector, and then store it on the blockchain through the sidechain smart contract.

6. The information protection risk assessment method as described in claim 5, characterized in that, The step of using a preset risk assessment model to predict the risk of the extracted risk feature vector and obtain optimized risk values ​​for each level of node includes: D1: Load the gradient boosting machine model, take the risk feature vector of historical attack events as input and the actual threat level as output, train the gradient boosting machine model, and obtain the trained gradient boosting machine model as the risk assessment model. D2: Input the risk feature vectors of each level of node into the risk assessment model and output the initial risk value; D3: A dynamic correction factor is introduced to optimize the initial risk value of the output, resulting in optimized risk values ​​for each level of node; the dynamic correction factor is determined based on the attack duration and the traffic intensity deviation rate. D4: Store the optimized risk values ​​of each level of node in the risk value contract of the sidechain, and synchronize them to the global risk database of the main chain node through the cross-chain relay node.

7. The information protection risk assessment method as described in claim 6, characterized in that, The configuration process for the cross-chain collaborative interaction mechanism includes: E1: Set up cross-chain relay nodes, including setting up at least one cross-chain relay node on each sidechain and two cross-chain relay nodes on each main chain; E2: Deploy a risk correlation calculation contract on the main chain, including: Receive the risk values ​​synchronized by each sidechain node, execute the correlation algorithm, and output the risk correlation matrix; E3: Deploy data synchronization contracts on each sidechain, including: Receive the correlation results synchronized from the main chain risk correlation calculation contract and update the risk correlation records locally on the side chain; E4: Sidechain nodes generate proofs of the optimized risk values ​​of nodes at all levels using zero-knowledge proof algorithms, and send the proofs and hash values ​​of the optimized risk values ​​of nodes at all levels to the sidechain cross-chain relay nodes. E5: The sidechain cross-chain relay node verifies the validity of the proof. After the verification is successful, the risk value, node identifier and proof are forwarded to the risk correlation calculation contract of the main chain. E6: After the main chain's risk correlation calculation contract completes the risk correlation calculation, it sends the result to the data synchronization contracts of each side chain to complete cross-chain synchronization.

8. The information protection risk assessment method as described in claim 7, characterized in that, The calculation of the risk correlation between different blockchain nodes includes: F1: Extract optimized risk values ​​for each level of node within a preset time period for each blockchain node, forming a time series; F2: The risk correlation is calculated using an improved Pearson correlation coefficient; the improved Pearson correlation coefficient includes: Obtain the time series of risk values ​​for node i within a preset time period. Calculate the mean of the risk value time series. Obtain the time series of risk values ​​for node j within a preset time period. and the corresponding mean ; For each time point k, calculate the risk value of node i at time point k and... The difference is used to obtain the first difference, and the risk value of node j at time point k is compared with... The difference between the first and second differences is used to obtain the second difference. The first and second differences are multiplied and summed along the time axis to obtain the sum of the numerators. Calculate the sum of squares of all time points at node i, and then take the square root of the sum to obtain the first square value. At the same time, calculate the sum of squares of all time points at node j, and then take the square root of the sum to obtain the second square value. Multiply the first square value and the second square value to obtain the product of the denominators. Divide the sum of the numerators by the product of the denominators to obtain the risk correlation between the two nodes. F3: Construct a risk correlation matrix based on the risk correlation of all node pairs.

9. The information protection risk assessment method as described in claim 8, characterized in that, The triggering of cross-chain data synchronization and obtaining comprehensive risk assessment results includes: G1: After calculating the risk correlation between different blockchain nodes, a risk correlation threshold is set. If the risk correlation between two blockchain nodes exceeds the risk correlation threshold, cross-chain data synchronization is triggered. The cross-chain data synchronization process is achieved through a cross-chain collaborative interaction mechanism. The synchronized data includes the optimized risk values ​​and attack characteristic data of each level of each blockchain node. G2: Based on the synchronized data, obtain the optimized risk values ​​of each level of nodes, and use the weighted average method to calculate the comprehensive risk assessment result after dynamic weight allocation.

10. A risk assessment system for information protection, used to implement the risk assessment method for information protection as described in any one of claims 1-9, characterized in that, include: Data acquisition module, model coupling module, and comprehensive risk assessment module; The data acquisition module is used to collect attack signature data for risk assessment. The model coupling module is used to analyze the acquired attack feature data, extract risk features, and predict the risk values ​​of nodes at all levels. The comprehensive risk assessment module is used to calculate the risk correlation between different blockchain nodes based on the risk values ​​of nodes at each level, and obtain the comprehensive risk assessment results.

Images