A method, system, and apparatus for monitoring and assessing the risk of digital certificate expiration based on a large model.

Abstract

The application provides a kind of digital certificate expiration risk monitoring and evaluation method, system and device based on large model, it is related to digital certificate management technical field, the method comprises: obtaining the secure communication protocol digital certificate set through the management interface of target server, and extracting each digital certificate attribute;Standardization is handled to digital certificate attribute, and structured certificate dataset is generated;Structured certificate dataset is input into pre-training large model based on transformer architecture, the feature representation of certificate expiration risk is extracted, and the risk characteristics of certificate are analyzed, to obtain three risk indicators including remaining validity period, security strength and business criticality.The application accurately identifies and efficiently processes digital certificate expiration risk, ensures the safe and stable operation of business system, and improves the efficiency and accuracy of certificate risk management.

Description

Technical Field

[0001] This invention relates to the field of digital certificate management technology, and in particular to a method, system and apparatus for monitoring and assessing the risk of digital certificate expiration based on a large model. Background Technology

[0002] In current network communication security, secure communication protocol digital certificates are a crucial foundation for ensuring the confidentiality and integrity of website service data transmission. Existing monitoring technologies for the risk of certificate expiration often rely on static thresholds for certificate validity. For example, some enterprise monitoring systems trigger alarms solely based on a fixed value of whether the remaining days of the certificate are less than 30 days. In practical applications, this method easily overlooks multi-dimensional factors such as differences in the security strength of the certificate itself and the importance of the business. For instance, even if the remaining validity period of a secure communication protocol digital certificate (using a 2048-bit RSA key) used for a payment interface on an e-commerce platform is the same as that of a certificate used in an internal testing system (using a 1024-bit RSA key), the former carries core transaction business and has a higher key strength, resulting in a significantly different impact of its expiration risk on the business compared to the latter. However, the static threshold method struggles to distinguish these differences, leading to relatively simplistic risk assessment results that fail to comprehensively and accurately reflect the actual risk level of certificate expiration.

[0003] Furthermore, some existing technologies lack a deep integration of multi-dimensional risk characteristics and a dynamic weighting mechanism, which may lead to assessment biases in complex and ever-changing business environments. For example, when an enterprise runs multiple types of businesses such as e-commerce transactions, user logins, and internal file transfers at the same time, existing technologies cannot adjust risk assessment weights according to the real-time load and security requirements of different businesses. This may result in the potential risks of digital certificates for secure communication protocols associated with core businesses being underestimated, or alarms for non-critical business certificates being over-triggered. To a certain extent, this makes it difficult to meet the needs of modern infrastructure for intelligent management of certificate lifecycles. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to provide a method, system and device for monitoring and assessing the expiration risk of digital certificates based on a large model. The large model automates the processing of certificate data assessment, risk level classification and update task sorting, reduces manual intervention process and improves certificate management efficiency.

[0005] To solve the above-mentioned technical problems, the technical solution of the present invention is as follows:

[0006] Firstly, a method for monitoring and assessing the risk of digital certificate expiration based on a large-scale model, the method comprising:

[0007] Step S1: Obtain the set of secure communication protocol digital certificates through the management interface of the target server, and extract the attributes of each digital certificate; standardize the digital certificate attributes to generate a structured certificate dataset;

[0008] Step S2: Input the structured certificate dataset into the pre-trained large model based on the transformer architecture, extract the feature representation of certificate expiration risk, and analyze the certificate risk features to obtain three risk indicators including remaining validity period, security strength and business criticality.

[0009] Step S3: Reconstruct the three risk indicators spatially to establish a risk assessment framework with three assessment dimensions. Each assessment dimension corresponds to one risk indicator. In each of the three assessment dimensions, the core region of the feature distribution is determined, including the feature extreme value region and the feature density concentration region.

[0010] Step S4: Map the feature representation of certificate expiration risk to each assessment dimension, and generate risk weight adjustment parameters based on the degree of clustering and dispersion of the feature representation;

[0011] Step S5: Using core area data and risk weight adjustment parameters, perform weighted optimization calculations on the three risk indicators to obtain the optimized risk assessment results.

[0012] Step S6: Based on the optimized risk assessment results, identify digital certificates that are about to expire within a preset time range, and classify them into multiple risk levels according to the remaining validity time and business importance, and generate an assessment report with risk level labels.

[0013] Step S7: Trigger the certificate update mechanism based on the assessment report, generate new certificates according to risk level priority order and distribute them to the target server.

[0014] Secondly, a digital certificate expiration risk monitoring and assessment system based on a large model includes:

[0015] The data acquisition module is used to obtain a set of secure communication protocol digital certificates through the target server management interface, extract the attributes of each digital certificate, standardize the attributes, and generate a structured certificate dataset.

[0016] The indicator generation module is used to input the structured certificate dataset into a pre-trained large model based on the transformer architecture, extract the feature representation of certificate expiration risk, analyze the certificate risk features, and obtain three risk indicators including remaining validity period, security strength, and business criticality.

[0017] The framework construction module is used to reconstruct the three risk indicators spatially, establish a risk assessment framework with three assessment dimensions, each assessment dimension corresponds to a risk indicator, and determine the core area of ​​feature distribution in the three assessment dimensions, including the feature extreme value area and the feature density concentration area.

[0018] The parameter generation module is used to map the feature representation of certificate expiration risk to various evaluation dimensions, and generate risk weight adjustment parameters based on the degree of clustering and dispersion of the feature representation.

[0019] The optimization calculation module is used to perform weighted optimization calculations on three risk indicators using core area data and risk weight adjustment parameters to obtain optimized risk assessment results.

[0020] The report generation module is used to identify digital certificates that are about to expire within a preset time range based on the optimized risk assessment results, and to classify them into multiple levels of risk according to the remaining validity time and business importance, and generate an assessment report with risk level labels.

[0021] The certificate update module is used to trigger the certificate update mechanism based on the assessment report, generate new certificates in order of risk level priority, and distribute them to the target server.

[0022] Thirdly, a digital certificate expiration risk monitoring and assessment device based on a large model includes:

[0023] One or more processors;

[0024] A storage device for storing one or more programs that, when executed by one or more processors, cause the one or more processors to implement the method.

[0025] The above-described solution of the present invention has at least the following beneficial effects:

[0026] By extracting and standardizing multiple attributes such as issuing authority, validity period, and key configuration, and combining them with three risk indicators—remaining validity period, security strength, and business criticality—it can simultaneously cover the characteristics of the certificate itself and its business-related value. For example, it can distinguish the risk differences between high-security certificates for core businesses and low-security certificates for non-critical businesses, avoiding one-sided assessments. A three-dimensional assessment framework is constructed and core areas are identified. Dynamic weight adjustment parameters are generated based on feature aggregation and dispersion, solving the problem of lacking dynamic weight allocation. Indicator weights can be adjusted according to the real-time business status, such as increasing the weight of core certificates during peak business periods, avoiding underestimation of core risks or excessive alarms for non-critical certificates, and improving assessment accuracy in complex environments. By classifying expiring certificates into multiple risk levels and generating reports with level identifiers, high-risk certificates can be accurately identified, reducing core service interruptions caused by certificate expiration, while avoiding interference from alarms for non-critical certificates, thus improving management efficiency. Attached Figure Description

[0027] Figure 1 This is a flowchart illustrating a method for monitoring and assessing the risk of digital certificate expiration based on a large model, provided by an embodiment of the present invention.

[0028] Figure 2 This is a schematic diagram of a digital certificate expiration risk monitoring and assessment system based on a large model, provided by an embodiment of the present invention. Detailed Implementation

[0029] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0030] like Figure 1 As shown, embodiments of the present invention propose a method for monitoring and assessing the risk of digital certificate expiration based on a large model. The method includes the following steps:

[0031] Step S1: Obtain the set of secure communication protocol digital certificates through the management interface of the target server, and extract the attributes of each digital certificate; standardize the digital certificate attributes to generate a structured certificate dataset;

[0032] Step S2: Input the structured certificate dataset into the pre-trained large model based on the transformer architecture, extract the feature representation of certificate expiration risk, and analyze the certificate risk features to obtain three risk indicators including remaining validity period, security strength and business criticality.

[0033] Step S3: Reconstruct the three risk indicators spatially to establish a risk assessment framework with three assessment dimensions. Each assessment dimension corresponds to one risk indicator. In each of the three assessment dimensions, the core region of the feature distribution is determined, including the feature extreme value region and the feature density concentration region.

[0034] Step S4: Map the feature representation of certificate expiration risk to each assessment dimension, and generate risk weight adjustment parameters based on the degree of clustering and dispersion of the feature representation;

[0035] Step S5: Using core area data and risk weight adjustment parameters, perform weighted optimization calculations on the three risk indicators to obtain the optimized risk assessment results.

[0036] Step S6: Based on the optimized risk assessment results, identify digital certificates that are about to expire within a preset time range, and classify them into multiple risk levels according to the remaining validity time and business importance, and generate an assessment report with risk level labels.

[0037] Step S7: Trigger the certificate update mechanism based on the assessment report, generate new certificates according to risk level priority order and distribute them to the target server.

[0038] In this embodiment of the invention, by extracting and standardizing multiple attributes such as issuing authority, validity period, and key configuration, and combining them with three risk indicators—remaining validity period, security strength, and business criticality—it can simultaneously cover the characteristics of the certificate itself and its business-related value. For example, it can distinguish the risk differences between high-security certificates for core businesses and low-security certificates for non-critical businesses, avoiding one-sided assessments. A three-dimensional assessment framework is constructed and core areas are identified. Dynamic weight adjustment parameters are generated based on the degree of feature aggregation and dispersion. The indicator weights can be adjusted according to the real-time business status, such as increasing the weight of core certificates during peak business periods, avoiding underestimation of core risks or excessive alarms for non-critical certificates, and improving the accuracy of assessments in complex environments. By classifying expiring certificates into multiple risk levels and generating reports with level identifiers, high-risk certificates can be accurately identified, reducing core service interruptions caused by certificate expiration, while avoiding interference from alarms for non-critical certificates and improving management efficiency.

[0039] In a preferred embodiment of the present invention, step S1 includes:

[0040] In this embodiment of the invention, step 100 involves collecting the set of secure communication protocol digital certificates deployed on the target server through a management interface. This includes extracting the issuing authority attribute, validity period attribute, and key configuration attribute of each digital certificate. Specifically, this includes: determining the target server range for certificate collection, which must cover all servers within the enterprise that have deployed secure communication protocol digital certificates, including servers used for core business (e.g., e-commerce transactions, user payments) and servers used for non-core business (e.g., internal testing, file transfer); initiating a certificate collection request through the target server's built-in management interface; the management interface must pre-complete identity authentication to ensure the security and legitimacy of the collection operation; authentication methods can include account password verification or key verification; after successful verification, interface access permissions are obtained; and then, all secure communication protocol digital certificates deployed on the target server are read in batches through the management interface. Certificates are generated into a certificate set. Then, attributes are extracted from each digital certificate in the set. This extraction process requires traversing the metadata of each certificate. For the issuing authority attribute, the name of the issuing authority, its unique identifier code, and its qualification level information must be obtained. For the validity period attribute, the start and end dates of the certificate's validity must be obtained. The start date is when the certificate begins to have legal effect, and the end date is when the certificate loses its legal effect. For the key configuration attribute, the type of key algorithm used by the certificate (e.g., RSA, ECC), the key length (e.g., 1024 bits, 2048 bits), and the key signature algorithm type (e.g., SHA256 with RSA, SHA384 with ECC) must be obtained. It is ensured that all three types of attributes for each certificate are completely extracted without omission or loss.

[0041] Step 101: Standardize the digital certificate attributes, including converting the certificate validity period into a unified time format and converting the key configuration attributes into standardized parameter representations, resulting in standardized digital certificate attributes. Specifically, this includes: standardizing the validity period attribute by first collecting all extracted certificate validity period information and analyzing the time format types present. Time formats include year-month-day-hour-minute-second, year / month / day / hour / minute / second, and timestamp formats, etc., and determining a unified target time format. The target time format is selected as the 24-hour format (year-month-day-hour-minute-second), which must contain four digits for the year, two digits for the month, two digits for the day, two digits for the hour, two digits for the minute, and two digits for the second. For validity periods originally in the year / month / day / hour / minute / second format, replace the forward slashes with hyphens to convert it to the year-month-day-hour-minute-second format. For validity periods originally in the timestamp format, first determine the base time of the timestamp, such as January 1, 1970, 00:00:00, and then calculate the timestamp. The corresponding specific year, month, day, hour, minute, and second values ​​are then combined according to the year-month-day-hour-minute-second format to complete the unified format conversion of the validity period. Next, the standardized parameter representation of the key configuration attributes is processed. For key algorithm types, algorithm types with different expressions but the same essence are uniformly named. For example, RSA algorithm and RSA encryption algorithm are uniformly expressed as RSA, and ECC algorithm and elliptic curve encryption algorithm are uniformly expressed as ECC. For key length, the combination of numbers and "bits" is directly retained to ensure that all key lengths are presented in the format of "number + bit", such as 1024 bits and 2048 bits. For signature algorithm types, the same uniform naming process is performed. SHA256withRSA algorithm and SHA256-RSA signature algorithm are uniformly expressed as SHA256withRSA, and SHA384withECC algorithm and SHA384-ECC signature algorithm are uniformly expressed as SHA384withECC. Through the above processing, the validity period attributes and key configuration attributes of all digital certificates conform to a unified standard.

[0042] Step 102 involves organizing the standardized digital certificate attributes according to a predefined data structure to generate a structured certificate dataset containing all standardized digital certificate attributes. Specifically, this includes: determining the predefined data structure, which must contain fields corresponding to the digital certificate attributes. Each field corresponds to a type of standardized attribute. The specific fields are: Certificate Unique Identifier, Issuing Authority Name, Issuing Authority Identifier Code, Issuing Authority Qualification Level, Certificate Start Date, Certificate Expiry Date, Key Algorithm Type, Key Length, and Signature Algorithm Type. The Certificate Unique Identifier field is used to distinguish different digital certificates and can use the certificate's serial number as the unique identifier. Then, for each standardized digital certificate, its corresponding attributes are filled into the corresponding fields of the predefined data structure: the certificate's serial number is filled into the Certificate Unique Identifier field, the standardized issuing authority's serial number is filled into the certificate's serial number field, and the standardized issuing authority's serial number is filled into the certificate's serial number field. Enter the issuing authority name in the issuing authority name field, the standardized issuing authority unique identifier code in the issuing authority identifier code field, the standardized issuing authority qualification level in the issuing authority qualification level field, the standardized start effective time in the certificate start effective time field, the standardized expiration time in the certificate expiration time field, the standardized key algorithm type in the key algorithm type field, the standardized key length in the key length field, and the standardized signature algorithm type in the signature algorithm type field. During the filling process, the correspondence between the content of each field and the certificate attributes must be checked one by one to ensure that there are no errors or omissions. After all the attributes of the digital certificates have been filled, sort all the filled data structures according to the order of the certificate unique identifier field. The sorting method can be ascending order, and finally a structured certificate dataset containing all the standardized attributes of digital certificates is formed.

[0043] This embodiment extracts three core attributes—issuing authority, validity period, and key configuration—to comprehensively cover the certificate's own security-related information and identity attribution information, avoiding incomplete risk feature analysis due to missing attributes. Standardization processes convert the validity period into a unified time format and the key configuration attribute into a standardized parameter representation, ensuring consistency of certificate attributes from different sources and formats. Organizing standardized attributes according to a predefined data structure makes the originally scattered certificate information orderly and organized, providing a clear data format for operations and maintenance personnel to view and manage certificate information, improving the convenience of certificate management. The collected attributes cover certificate security strength (i.e., key configuration) and validity period (i.e., information related to the validity period). The standardized structured data can be directly used to extract risk indicators such as remaining validity period and security strength.

[0044] In a preferred embodiment of the present invention, S2 includes:

[0045] In this embodiment of the invention, step 200 involves inputting the structured certificate dataset into a pre-trained large model based on a transformer architecture. The digital certificate attributes are encoded using a multi-layer self-attention mechanism to generate a high-dimensional feature representation vector for each digital certificate. Specifically, this includes: performing vector transformation on each digital certificate attribute in the structured certificate dataset. For example, for the certificate's unique identifier field, if the serial number is a string composed of numbers and letters, it is converted to numbers according to the ASCII code values ​​of the characters, and then these numbers are arranged in order to form a numerical vector corresponding to the serial number; for the text information in the issuing authority name field, each Chinese character is first converted to its corresponding pinyin, then the pinyin is split into individual letters, each letter is converted to a number according to its ASCII code value, and then arranged alphabetically to form a word vector; for the certificate's start effective time and end expiration time, the year, month, day, hour, minute, and second are first converted to numbers, for example, May 20, 2024, 14:30:00 is converted to 2024, 5, 20. The six numbers 14, 30, and 00 are arranged in order to form a time vector; the key algorithm type field is assigned a value of 1 if it is ECC algorithm and a value of 2 if it is RSA algorithm, forming an algorithm type vector; the key length field is directly represented by numbers, for example, 2048 bits is used as the vector value to form a key length vector; the signature algorithm type field is assigned a value of 3 if it is SHA256withRSA and a value of 4 if it is SHA384withECC, forming a signature algorithm vector; all attribute vectors of each digital certificate are combined into an initial feature vector. For example, a certificate's serial number value vector has 10 dimensions, the issuing authority word vector has 8 dimensions, the time vector has 6 dimensions, the algorithm type vector has 1 dimension, the key length vector has 1 dimension, and the signature algorithm vector has 1 dimension. These sub-vectors are concatenated in the order of serial number, issuing authority, time, algorithm type, key length, and signature algorithm to form a 27-dimensional initial feature vector.

[0046] Before inputting the initial feature vector, the pre-trained large model of the transformer architecture is constructed and pre-trained. First, the overall structure of the model encoder is determined, setting up a 6-layer processing structure. Each layer contains a multi-head self-attention layer and a feedforward neural network layer. The multi-head self-attention layer has 8 attention heads, which can simultaneously capture the correlation between different dimensions of the feature vector from different perspectives, avoiding missing key correlation information from a single viewpoint. Each attention head is responsible for capturing the correlation information between different dimensions of the feature vector. The feedforward neural network layer has two linear transformation layers. The first layer takes the input dimension, consistent with the initial feature vector dimension. Here, 27 dimensions are used as an example. 27 dimensions refer to the total dimension of the vector formed by concatenating all attribute sub-vectors of each certificate, such as the serial number, issuing institution, and time attribute sub-vectors, totaling 27 dimensions. This can fully carry the core information of the certificate and map it to a 512-dimensional hidden layer. The 512-dimensional hidden layer is the intermediate dimension of the linear transformation. The first layer increases the dimensionality, allowing the model to accommodate more feature association information and enhance feature representation capabilities. The second layer maps the 512 dimensions back to a 27-dimensional input dimension. The activation function used is the ReLU function, i.e., f(z) = max(0, z), where z represents the input value of the ReLU function, which is the specific value of each dimension in the 108-dimensional hidden layer vector obtained after the first linear transformation of the feedforward neural network layer, such as the value of 21 for a certain dimension, the value of -3 for another dimension, etc. max(0, z) represents the calculation logic of the function, that is, comparing the input value z with 0, and taking the larger value as the function output. If z is greater than 0, z itself is output; if z is less than or equal to 0, 0 is output. The purpose of this function is to introduce non-linearity into the model, allowing the model to learn complex relationships between features, avoiding non-linear relationships that linear transformation cannot capture, while filtering out meaningless negative values ​​in the vector and retaining positive information that is valuable to risk features.

[0047] This project collects a structured dataset of digital certificates for large-scale secure communication protocols, covering different issuing authorities (e.g., well-known CAs, enterprise-built CAs), different validity periods (from 1 month to 3 years), and different key configurations (e.g., RSA 1024-bit, RSA 2048-bit, ECC 256-bit). Each data entry is labeled with a risk-related tag. For actual certificate expiration, the project indicates whether the certificate will actually expire within the next 90 days, with expired marked as 1 and not expired as 0. This serves as the accurate label for the subsequent binary classification task of certificate expiration risk. For keys... Security level: This indicates the actual security level corresponding to the certificate key configuration, i.e., high level is labeled as 3, medium level as 2, and low level as 1. Business association importance: This indicates the actual importance of the business carried by the certificate, i.e., core business is labeled as 3, general business as 2, and secondary business as 1. The latter two types of labels, combined with the actual values ​​of the masked attributes, serve as the true labels for subsequent certificate attribute association prediction tasks. These labeled data are divided into training and validation sets in a 7:3 ratio to monitor whether the model overlearns the features of the training set (i.e., overfitting).

[0048] To verify the performance of the model during training, two pre-training tasks were set. The first task was a binary classification task for certificate expiration risk. The objective of this task was for the model to predict whether a certificate would expire within the next 90 days based on the input certificate attribute vector. The model's output for this task was the probability of the certificate expiring within the next 90 days, with the probability value ranging from 0 to 1. The closer the probability value was to 1, the higher the likelihood that the model judged the certificate to be expired. The second task was a certificate attribute association prediction task. The objective of this task was for the model to predict the actual value of the masked attribute based on a partial certificate attribute vector (i.e., randomly masking one attribute, such as key length). The model's output for this task was the prediction of the masked attribute. The predicted value must be consistent with the true value type of the masked attribute. For example, if the masked attribute is the key length, the predicted value is the specific number of bits, such as 1024 or 2048. During training, the attributes of each certificate data in the training set are first converted into 27-dimensional vectors, which are consistent with the dimension of the initial feature vectors for subsequent processing. Then, these 27-dimensional vectors are input into the model encoder one by one. After obtaining the prediction results of each data in the two tasks through forward propagation of the model, the loss value of the prediction result and the corresponding true label are calculated respectively. Specifically, for the binary classification task of certificate expiration risk, the cross-entropy loss is used to calculate the loss value, that is, let the probability of the certificate output by the model expiring in the next 90 days be p (0≤p≤1).

[0049] The true label in the pre-training data is y, where y=1 for expired certificates and y=0 for unexpired certificates. During calculation, for each certificate sample in the training set, the true label y is multiplied by the natural logarithm of the predicted probability p to obtain the first product. Then, (1 minus the true label y) is multiplied by the natural logarithm of (1 minus the predicted probability p) to obtain the second product. The two products are added together and the negative number is the cross-entropy of the sample. The value 1 in the above two values ​​(1 minus the true label y and 1 minus the predicted probability p) represents that the sample belongs to a certain category (unexpired category). The true probability of a certificate expires is used to compare with the model's predicted probability, quantifying the prediction bias in the unexpired scenario. Specifically, in the binary classification task of certificate expiration risk, the true label y has only two values: when the certificate has expired, y=1 (meaning the sample belongs to the expired class, and the true probability of belonging to this class is 1); when the certificate has not expired, y=0 (meaning the sample belongs to the unexpired class, and the true probability of belonging to this class is 1). Cross-entropy measures the difference between the predicted probability and the true label; the smaller the value, the more accurate the prediction. After the cross-entropy of all samples has been calculated, let's assume there are N certificate samples in the training set, and the cross-entropy of the i-th sample is... Then the classification loss for this task is For the certificate attribute association prediction task, the mean squared error loss is used to calculate the loss value, that is, let the predicted value of the occluded attribute in the model output be... The actual value of the masked attribute in the pre-training data is x, such as the actual value of the key length, which is 1024 or 2048.

[0050] During the calculation, for each certificate sample in the training set, the predicted value is first subtracted from the true value x. After obtaining the difference, the difference is squared to obtain the squared error of that sample. The squared error measures the deviation between the predicted value and the true value; the smaller the value, the more accurate the prediction. After calculating the squared errors of all samples, let the squared error of the i-th sample be... Then the prediction loss for this task is The classification loss and prediction loss are added together to obtain the total loss value of the model training. The total loss value = classification loss + prediction loss. The total loss value comprehensively reflects the prediction bias of the two tasks and is the core basis for adjusting the model parameters.

[0051] During model training, the gradient of the total loss with respect to all model parameters is determined using the backpropagation algorithm based on the total loss value. These parameters include the query weight matrix, key weight matrix, and value weight matrix in the multi-head self-attention layer (these three matrices are the core parameters learned by the model, used to convert the input vector into query, key, and value vectors to capture the relationships between attributes; each is 27 rows and 27 columns, with the number of rows and columns consistent with the dimension of the input vector), two linear transformation weight matrices in the feedforward neural network layer (their function is to increase and restore the vector dimension; the first is 27 rows and 108 columns, and the second is 108 rows and 27 columns), and all bias value vectors (used to adjust the overall vector offset; the dimension of each bias value vector is consistent with the dimension of the corresponding vector, such as the query bias value vector being 27 dimensions). After determining the gradient, the Adam optimizer is used to adjust the model parameters with a learning rate of 0.001. Specifically, if the current value of a certain parameter is w2, the gradient of that parameter is calculated as g through backpropagation. The gradient reflects the trend of the total loss value as the parameter changes. The negative gradient direction is the optimal adjustment direction to reduce the total loss value. The adjusted parameter value is w1 = w2 - 0.001 × g, where the learning rate of 0.001 is used to control the magnitude of each parameter adjustment. After each parameter adjustment, the certificate data in the validation set is converted into a 27-dimensional vector in the same way as the training set. The vector is then input into the model, and the total loss value of the model on the validation set is calculated. If the total loss value of the validation set no longer decreases after 10 consecutive training rounds (i.e., each round means that all samples in the training set have been fully processed by the model once), it indicates that the model performance has stabilized. At this point, training is stopped. After training stops, the query weight matrix, key weight matrix, and value weight matrix in the model are all 27 rows and 27 columns, with the number of rows and columns consistent with the dimension of the input vector. The three corresponding bias value vectors are also 27-dimensional. The specific values ​​of each dimension are fixed when training stops and are determined as fixed parameters.

[0052] After model construction and pre-training are completed, the previously concatenated 27-dimensional initial feature vector—composed of sub-vectors corresponding to attributes such as certificate serial number, issuing authority, validity period, key algorithm type, key length, and signature algorithm type—is input into the encoder of the pre-trained large model of this transformer architecture. The encoder processes the vector sequentially according to a 6-layer processing structure. First, it enters the first self-attention layer. In the first self-attention layer, a corresponding query vector, key vector, and value vector are generated for each dimension of the initial feature vector. The specific process is as follows: each dimension of the initial feature vector has a specific value. Taking the first dimension as an example... Its value is 5. When generating the query vector dimension value corresponding to this dimension, the value of the first dimension of the initial feature vector, 5, is multiplied by the value of the first row and first column of the query weight matrix, 2. The value of the first row and first column of the query weight matrix is ​​a fixed parameter pre-trained by the model, which is used to convert the value of the first dimension of the initial vector into the value of the corresponding dimension of the query vector, resulting in a product of 10. Then, 10 is added to the value of the first dimension of the query bias vector, 1. The value of the first dimension of the query bias vector is used to fine-tune the value of the query vector dimension, avoiding the expression bias caused by relying solely on matrix multiplication, resulting in the value of the first dimension of the query vector, 11.

[0053] When generating the key vector dimension value corresponding to this dimension, multiply the value of 5 in the first dimension of the initial feature vector by the value of 3 in the first row and first column of the key weight matrix to obtain a product of 15. Then add 15 to the value of 2 in the first dimension of the key bias value vector to obtain a value of 17 in the first dimension of the key vector. When generating the value vector dimension value corresponding to this dimension, multiply the value of 5 in the first dimension of the initial feature vector by the value of 4 in the first row and first column of the value weight matrix to obtain a product of 20. Then add 20 to the value of 4 in the first dimension of the value bias value vector. The value 3 is used to obtain the value 23 for the first dimension of the value vector. In the same way, for the second to the 27th dimensions of the initial feature vector, the specific value of each dimension is multiplied by the value of the corresponding row and column in the query weight matrix, key weight matrix, and value weight matrix, respectively. Then, the value of the corresponding dimension in the query bias value vector, key bias value vector, and value bias value vector is added to obtain the query vector, key vector, and value vector corresponding to each dimension. This completes the initial vector generation step of the first self-attention layer.

[0054] Next, the similarity between each query vector and all key vectors is calculated. Taking one query vector, such as the query vector corresponding to the first dimension of the initial feature vector, as an example, this query vector contains values ​​in 27 dimensions. When calculating the similarity between this query vector and the first key vector, the value of the first dimension of the query vector (11) is multiplied by the value of the first dimension of the first key vector (17), resulting in a product of 187. Then, the value of the second dimension of the query vector (let's say 8) is multiplied by the value of the second dimension of the first key vector (let's say 9), resulting in a product of 72. And so on. The values ​​of the 27 dimensions of the query vector are multiplied one by one with the values ​​of the 27 dimensions of the first key vector, resulting in 27 product results. These 27 product results are then added together to obtain the preliminary similarity score between the query vector and the first key vector. The higher the preliminary similarity score, the closer the attribute dimensions of the query vector and the key vector are related. The same method is used to calculate the preliminary similarity scores between the query vector and the second, third, and up to the 27th key vectors, finally obtaining the preliminary similarity scores between the query vector and all 27 key vectors.

[0055] After calculating all preliminary similarity scores, each preliminary score is scaled by dividing it by the square root of the key vector dimension. Since the key vector is 27-dimensional, each preliminary score is divided by... The scaled similarity scores are obtained, and all scaled similarity scores are input into the softmax function. The result is the attention weight corresponding to the key vector. The attention weight represents the importance of the corresponding key vector when calculating the value vector. The larger the weight, the greater the influence of the corresponding value vector. For example, if the sum of the 27 scaled similarity scores is 100, and one of the scaled scores is 20, then the attention weight corresponding to that scaled score is 20 divided by 100, and the result is 0.2; if one of the scaled scores is 5, the corresponding attention weight is 5 divided by 100, and the result is 0.05. According to the characteristics of the softmax function, the sum of all 27 attention weights equals 1. This ensures that the weight distribution is reasonable and that there will be no situation where the total weight is too high or too low.

[0056] Next, a weighted summation is performed, whereby the value of each dimension of each value vector is multiplied by its corresponding attention weight to obtain the weighted result for that dimension. For example, the value of the first dimension of the value vector is 23, with a corresponding attention weight of 0.2. Multiplying 23 by 0.2 gives a weighted result of 4.6. The value of the first dimension of the second value vector is 25, with a corresponding attention weight of 0.05. Multiplying 25 by 0.05 gives a weighted result of 1.25. This process is repeated for all 27 value vectors, multiplying the value of the first dimension by... The corresponding attention weights are multiplied to obtain 27 weighted results. These 27 weighted results are then summed to obtain the value of the first dimension of the feature vector after self-attention processing. The same method is used to calculate the values ​​of the second to 27th dimensions of the feature vector after self-attention processing, ultimately forming a 27-dimensional self-attention layer output vector. The self-attention layer output vector is then input into the feedforward neural network layer, where the first linear transformation is performed. The weight matrix of the first linear transformation of the feedforward neural network layer is 27 rows and 108 columns, and the bias vector is 108 dimensions.

[0057] During calculation, the value of each dimension of the self-attention layer output vector is multiplied by the value of the corresponding row and column in the first-layer linear transformation weight matrix, and then added to the value of the corresponding dimension in the first-layer bias vector. For example, if the value of the first dimension of the self-attention layer output vector is 10, multiplying it by the value of 2 in the first row and first column of the first-layer linear transformation weight matrix yields a product of 20, and adding the value of 1 in the first dimension of the first-layer bias vector yields a result of 21. This result is used as the value of the first dimension of the 108-dimensional hidden layer vector. The values ​​of all dimensions of the 108-dimensional hidden layer vector are calculated in the same way, completing the first linear transformation. The vector undergoes a transformation, and then, according to the ReLU function formula, z represents the specific value of each dimension of the 108-dimensional hidden layer vector, such as 21, -3, etc. It is processed one by one according to the logic of max(0, z). If the dimension value is greater than 0 (e.g., 21), the value is retained unchanged and remains 21; if the dimension value is less than 0 (e.g., -3), the value is changed to 0. Through this process, meaningless negative values ​​in the vector are filtered out, while positive information valuable for risk feature extraction is retained. At the same time, nonlinearity is introduced into the model, enhancing the model's ability to learn complex feature associations, resulting in a 108-dimensional vector after activation processing.

[0058] Then, a second linear transformation is performed. The weight matrix of the second linear transformation layer of the feedforward neural network is 108 rows and 27 columns, and the bias vector is 27 dimensions. During calculation, the value of each dimension of the activated 108-dimensional vector is multiplied by the value of the corresponding row and column in the second-layer linear transformation weight matrix, and then added to the value of the corresponding dimension in the second-layer bias vector. For example, if the value of the first dimension of the activated vector is 21, multiplying it by the value of 0.5 in the first row and first column of the second-layer linear transformation weight matrix yields a product of 10.5. Adding this to the value of 0.5 in the first dimension of the second-layer bias vector gives a result of 11. This result is used as the first dimension of the 27-dimensional vector. The numerical values ​​of the degrees are calculated; in the same way, the numerical values ​​of all dimensions of the 27-dimensional vector are calculated to obtain the output vector of the feedforward neural network layer. The output vector of the feedforward neural network layer is input into the next self-attention layer. The above process of generating query vector, key vector, value vector, calculating the similarity between query vector and all key vectors, scaling the similarity score and calculating attention weights, weighted summation to obtain the output vector of the self-attention layer, and linear transformation and ReLU activation processing of the feedforward neural network layer is repeated. When all 6 layers of processing structure are completed, each digital certificate will obtain a 27-dimensional high-dimensional feature representation vector, which contains the deep correlation information between the various attributes of the certificate.

[0059] Step 201 involves performing deep semantic analysis on the high-dimensional feature representation vector to identify potential patterns related to certificate expiration risk. From these patterns, time-series features representing the remaining validity period, configuration features representing key security strength, and context-related features representing business criticality are separated. Specifically, this includes splitting the high-dimensional feature representation vector (27 dimensions) of each digital certificate into three 8-dimensional sub-vector segments and one 3-dimensional sub-vector segment based on dimensional function. The first 8-dimensional sub-vector segment corresponds to time-related information, the second 8-dimensional sub-vector segment corresponds to key configuration-related information, the third 8-dimensional sub-vector segment corresponds to business scenario-related information, and the 3-dimensional sub-vector segment... The vector segments correspond to basic identification information and are excluded from risk analysis. Then, the numerical change patterns of each sub-vector segment are analyzed to determine the semantic content. For the first 8-dimensional sub-vector segment, the values ​​of the sub-vector segment at different time points are extracted, for example, the values ​​are recorded once a day, and the trend of change is observed: if the value of the sub-vector segment decreases by a fixed amount every day as the certificate expiration time approaches, for example, by 0.02 per day, and the smaller the value, the shorter the remaining validity period, then it is determined that this sub-vector segment carries time-related semantics; if the value of a certain dimension begins to decrease rapidly 30 days before the expiration time, then it is determined that this dimension is the core dimension of time semantics.

[0060] For the second 8-dimensional sub-vector segment, comparing the sub-vector segment values ​​of certificates with different key configurations, if the certificate uses the ECC algorithm, the value of a certain dimension of this sub-vector segment is 0.3 higher than that of the certificate using the RSA algorithm; for a certificate with a key length of 2048 bits, the value of a certain dimension is 0.2 higher than that of a certificate with a key length of 1024 bits; for a certificate using the SHA384 with ECC signature algorithm, the value of a certain dimension is 0.15 higher than that of the SHA256 with RSA. Therefore, this sub-vector segment is determined to carry key configuration-related semantics, and these dimensions are the core dimensions of key configuration semantics. For the third 8-dimensional sub-vector segment, comparing the sub-vector segment values ​​of certificates of different business servers, if the certificate of the payment interface server has a sub-vector segment value 0.4 higher than that of the internal test server; for a server certificate with an average daily access volume of 1 million, the value of a certain dimension is 0.25 higher than that of a server with 100,000; for a server certificate whose business interruption affects 100,000 users, the value of a certain dimension is 0.3 higher than that affecting 10,000 users. Therefore, this sub-vector segment is determined to carry business scenario-related semantics, and these dimensions are the core dimensions of business scenario semantics.

[0061] Three sub-vector segments related to time, key configuration, and business scenario were selected as the risk-related sub-vector segment set. Within the time sub-vector segment, those with similar numerical trends (e.g., linearly decreasing as the remaining validity period shortens) were grouped together to form a potential pattern of remaining validity period change. Within the key configuration sub-vector segment, those with values ​​increasing as key security level improves were grouped together to form a potential pattern of key security strength change. Within the business scenario sub-vector segment, those with values ​​increasing as business importance increases were grouped together to form a potential pattern of "business criticality change." For the "remaining validity period change" pattern, the values ​​of all core dimensions in the time sub-vector segment were extracted. These values ​​reflect the length of the remaining validity period, for example... The value 0.8 corresponds to 90 days remaining, 0.5 corresponds to 60 days remaining, and 0.2 corresponds to 30 days remaining. The trend of change is also considered; for example, it took 30 days for the value to decrease from 0.5 to 0.2, decreasing by 0.01 per day. Combining these values ​​forms a time-series feature. For the "key security strength change" mode, the core dimensions of the key configuration sub-vector segment are extracted. These values ​​reflect the security of the key algorithm: ECC corresponds to 0.8, RSA corresponds to 0.5; key length security: 2048 bits corresponds to 0.9, 1024 bits corresponds to 0.6; and signature algorithm security: SHA384 with ECC corresponds to 0.85, SHA256 with RSA corresponds to 0.7. Combining these values ​​forms a configuration feature.

[0062] For business-critical change patterns, extract the core dimensions of the business scenario sub-vector segments. These values ​​reflect the importance of the business type (e.g., 0.9 for payment, 0.3 for testing), the importance of business load (e.g., 0.8 for 1 million visits, 0.5 for 100,000), and the importance of interruption impact (e.g., 0.85 for 100,000 users, 0.4 for 10,000). Combine these values ​​to form context-related features. During separation, check the source of each value to ensure that time-series features only contain time-related values, configuration features only contain key-related values, and context-related features only contain business-related values, without mixing in other types of information.

[0063] Step 202 involves normalizing and quantifying the time-series features, configuration features, and context-related features to obtain continuously valued remaining validity period indicators, security strength indicators, and business criticality indicators, which together constitute three risk indicators. Specifically, the first step is to calculate the original remaining validity period for each certificate. This involves determining the current system time and the certificate's expiration date. For example, if the current time is May 20, 2024, and the certificate's expiration date is August 20, 2024, subtract the current time from the year of the expiration date. If the years are the same, subtract the current month from the month of the expiration date to get 3 months. Then, add the number of days in each month: May has 11 days remaining, June has 30 days, July has 31 days, and August has 20 days, totaling 11 + 30 + 31 + 20 = 92 days. This 92 days is the original remaining validity period for the certificate. If the years are different, first calculate the remaining validity period for the entire year. The first step is to add the number of days to the remaining months to obtain the original value. The second step is to calculate the maximum and minimum values ​​of the remaining validity period of all certificates. Assuming the maximum value is 180 days and the minimum value is 10 days, the third step is to perform normalization. For each certificate's original value, the minimum value is subtracted from the original value to obtain the first difference. For example, if the original value of a certificate is 92 days, 92-10=82. The maximum value is then subtracted from the minimum value to obtain the second difference, 180-10=170. The first difference is then divided by the second difference. 82 divided by 170 is approximately equal to 0.48. This 0.48 is the normalized time-series characteristic value. The fourth step is to perform quantization. The normalized value is retained to two decimal places. If the third decimal place is greater than or equal to 5, it is rounded up; if it is less than 5, it is discarded. For example, 0.483 is retained as 0.48, and 0.486 is retained as 0.49, resulting in a continuously variable remaining validity period index.

[0064] Next, the configuration features are processed to generate security strength indicators. The first step involves quantifying and mapping the security level of each piece of information in the configuration features. Based on the cryptographic security strength of the key algorithm, the ECC algorithm, due to its elliptic curve cryptography, has higher security and a corresponding quantization value of 10; the RSA algorithm has slightly lower security than the ECC algorithm and a corresponding quantization value of 8. Based on the key length's ability to resist brute-force attacks, a 2048-bit key is more difficult to crack and has a corresponding quantization value of 10, while a 1024-bit key is easier to crack and has a corresponding quantization value of 6. Based on the hash strength and collision resistance of the signature algorithm, the SHA384 with ECC signature algorithm has a longer hash length and higher security and a corresponding quantization value of 10; the SHA256 with RSA signature algorithm has a slightly shorter hash length and a corresponding quantization value of 8; and the SHA1 with RSA signature algorithm has a security vulnerability and a corresponding quantization value of 4.

[0065] The second step is to calculate the original total score of the configuration features. This involves summing the quantized values ​​of the key algorithm, key length, and signature algorithm for a given certificate to obtain its original total score. For example, if a certificate uses the ECC algorithm (10 quantized values), a 2048-bit key (10 quantized values), and SHA384 with ECC signature algorithm (10 quantized values), the sum of these three quantized values ​​is 30, which is the original total score of the certificate's configuration features. If a certificate uses the RSA algorithm (8 quantized values), a 1024-bit key (6 quantized values), and SHA256 with RSA signature algorithm (8 quantized values), the sum of these three quantized values ​​is 22, which is the original total score of the certificate's configuration features. The third step is to determine the range of values ​​for the original total score of the configuration features. This involves iterating through the original total scores of all certificates and calculating the maximum and minimum values. Assuming the maximum value is 30 and the minimum value is... The value is 12; the fourth step is to perform normalization processing. For each certificate's configuration feature original total score, first calculate the difference between the original total score and the minimum value, i.e., the third difference. For example, if the original total score is 30, subtract 12 from 30 to get the third difference of 18; if the original total score is 22, subtract 12 from 22 to get the third difference of 10. Then calculate the difference between the maximum and minimum values, i.e., the fourth difference, subtract 12 from 30 to get the fourth difference of 18. Finally, divide the third difference of each certificate by the fourth difference. The difference is used to obtain the normalized configuration feature value. For example, 18 divided by 18 results in 1; 10 divided by 18 results in approximately 0.56. The fifth step is to perform quantization processing, that is, to retain two decimal places for the normalized configuration feature value. If the third decimal place is greater than or equal to 5, then 1 is added to the second decimal place. If it is less than 5, then the third and subsequent decimal places are discarded. For example, 0.564 is retained as 0.56, and 0.567 is retained as 0.57. Finally, a security strength index with continuously taking values ​​is obtained.

[0066] The process involves processing contextual features to generate key business indicators. The first step is to quantify and map the importance of each element within the contextual features based on its impact on the company's core operations. For example, payment interface services are directly related to fund flows, corresponding to a quantification value of 10; user login services are related to user authentication and system access security, corresponding to a quantification value of 9; internal testing services are only used for internal functional verification, corresponding to a quantification value of 3; and log storage services are mainly used for data recording, corresponding to a quantification value of 2. Based on the user scale and system dependency reflected by the business load, daily visits exceeding 1 million indicate serving a large number of users, corresponding to a quantification value of 10; daily visits between 500,000 and 1 million correspond to a quantification value of 8; daily visits between 100,000 and 500,000 correspond to a quantification value of 5; and daily visits below 100,000 correspond to a quantification value of 3. Finally, based on the scope and extent of the impact after a business interruption, services affecting more than 100,000 users or causing economic losses correspond to a quantification value of 10; services affecting 10,000 to 100,000 users correspond to a quantification value of 8; services affecting less than 10,000 users correspond to a quantification value of 4; and services with no direct impact correspond to a quantification value of 2.

[0067] The second step is to calculate the original total score of the context association feature. This involves summing the quantified values ​​of a certificate in three aspects: business type, business load, and the scope of impact of business interruption. For example, if a certificate corresponds to a payment interface business with a quantified value of 10, an average daily access volume of 1.2 million with a quantified value of 10, and a business interruption affecting 200,000 users with a quantified value of 10, then summing these three quantified values ​​gives 30, which is the original total score of the certificate's context association feature. If a certificate corresponds to an internal testing business with a quantified value of 3, an average daily access volume of 50,000 with a quantified value of 3, and a business interruption affecting 500 users with a quantified value of 4, then summing these three quantified values ​​gives 10, which is the original total score of the certificate's context association feature. The third step is to determine the range of values ​​for the original total score of the context association feature. This involves iterating through the original total scores of all certificates and calculating the maximum and minimum values. For example, the maximum value is assumed to be 30, and the minimum value is 8.

[0068] The fourth step is to perform normalization. For the original total score of the context-related feature for each certificate, first calculate the difference between the original total score and the minimum value, i.e., the fifth difference. For example, if the original total score is 30, subtract 8 from 30 to get the fifth difference of 22; if the original total score is 10, subtract 8 from 10 to get the fifth difference of 2. Then calculate the difference between the maximum and minimum values, i.e., the sixth difference, subtract 8 from 30 to get the sixth difference of 22. Finally, divide the fifth difference of each certificate by the sixth difference to obtain the normalized context-related feature value. For example, divide 22 by 22. The result is 1; 2 divided by 22, the result is approximately 0.09; the fifth step is to perform quantification, that is, to retain two decimal places for the normalized context-related feature value. If the third decimal place is greater than or equal to 5, then 1 is added to the second decimal place. If it is less than 5, then the third and subsequent decimal places are discarded. For example, 0.093 is retained as 0.09, and 0.096 is retained as 0.10. Finally, the business key indicators with continuous values ​​are obtained. The remaining validity period indicators, security strength indicators, and business key indicators are integrated to form the three risk indicators required for subsequent risk assessment.

[0069] This embodiment fully captures the deep correlations between various attributes of digital certificates through a multi-layered self-attention mechanism. It also separates three core features: remaining validity period, security strength, and business criticality, achieving multi-dimensional coverage of certificate expiration risks. This avoids misjudgments caused by single-dimensional assessments, making risk assessments more aligned with the actual security status and business value of certificates. Deep semantic parsing clearly distinguishes three types of features: timing, configuration, and contextual relationships. Normalization and quantification then convert these features into continuous indicators with a unified value range, ensuring the comparability of risk indicators for different certificates and avoiding assessment biases caused by differences in information format or semantic ambiguity, thus improving the reliability of risk indicators. The generated three continuous risk indicators can be directly used for spatial dimension reconstruction and weight adjustment, solving the problem of lacking quantifiable multi-dimensional risk parameters. Furthermore, it fully explores potential risk patterns in certificate attributes, such as identifying the correlation between key length and expiration risk, and the correlation between business type and risk impact through high-dimensional feature parsing. This overcomes the limitation of not being able to perceive potential risk correlations, allowing risk assessment to not only focus on surface validity information but also deeply identify the core factors affecting expiration risk, improving the depth and comprehensiveness of risk assessment.

[0070] In a preferred embodiment of the present invention, S3 includes:

[0071] In this embodiment of the invention, step 300 involves constructing a three-dimensional risk assessment space using the remaining validity period indicator, security strength indicator, and business criticality indicator as three orthogonal coordinate axes. Each risk indicator corresponds to an assessment dimension in the three-dimensional risk assessment space. Specifically, this includes: first, clarifying the correspondence between the three orthogonal coordinate axes, setting the remaining validity period indicator as the X-axis of the three-dimensional risk assessment space, the security strength indicator as the Y-axis, and the business criticality indicator as the Z-axis. The three coordinate axes are perpendicular to each other and there are no overlapping dimensions, ensuring that the risk indicator of each dimension can independently reflect a certain aspect of the risk characteristics of the certificate. Next, determining the value range of each coordinate axis. Since the three risk indicators have been normalized before, the values ​​of all indicators are between 0 and 1. Therefore, the value range of the three coordinate axes is uniformly set to 0 to 1, and each numerical point on the coordinate axis corresponds to a specific value of a risk indicator.

[0072] For example, on the X-axis, point 0 corresponds to the lowest remaining validity period, meaning the certificate is about to expire, while point 1 corresponds to the highest remaining validity period, meaning the certificate has sufficient validity. On the Y-axis, point 0 corresponds to the lowest security strength, meaning the key configuration security is extremely low, while point 1 corresponds to the highest security strength, meaning the key configuration security is extremely high. On the Z-axis, point 0 corresponds to the lowest business criticality, meaning the business supported by the certificate is not important, while point 1 corresponds to the highest business criticality, meaning the certificate supports the core business. Then, the meaning of a "point" in the three-dimensional risk assessment space is defined. Each digital certificate, based on its three risk index values, corresponds to a unique coordinate point in the three-dimensional space. The X value of the punctuation marks represents the remaining validity period of the certificate, the Y value represents the security strength value, and the Z value represents the business criticality value. For example, if a certificate has a remaining validity period of 0.6, a security strength value of 0.8, and a business criticality value of 0.9, then the coordinates of the certificate in the three-dimensional space are (0.6, 0.8, 0.9). This coordinate point can be used to intuitively present the overall status of the certificate in the three risk dimensions. Finally, the three-dimensional risk assessment space is constructed, and all historical certificate data and certificate data to be assessed are mapped into the space according to the above rules to form a visual assessment framework that includes the risk coordinates of all certificates.

[0073] Step 301: Based on historical certificate data, determine the characteristic extreme value regions for each evaluation dimension; the historical certificate data includes three risk indicator data for expired and non-expired digital certificates; the characteristic extreme value regions include high-risk extreme value regions and low-risk extreme value regions; the high-risk extreme value regions correspond to the numerical range where the remaining validity period indicator is less than a first preset threshold, the security strength indicator is less than a second preset threshold, or the business criticality indicator is greater than or equal to a third preset threshold; the low-risk extreme value regions correspond to the numerical range where the remaining validity period indicator is greater than or equal to a fourth preset threshold, the security strength indicator is greater than or equal to a fifth preset threshold, or the business criticality indicator is less than a sixth preset threshold, specifically including:

[0074] Organize historical certificate data, collecting three risk indicators for all expired and non-expired digital certificates from the past 3 to 5 years. Expired certificates must be marked with their expiration date and risk indicator changes before expiration. Non-expired certificates must be marked with their current risk indicator values ​​and historical update records. This ensures data coverage of certificates with different validity periods, security configurations, and business scenarios, avoiding inaccurate threshold settings due to limited data. Next, determine the preset thresholds for each dimension, specifically:

[0075] To determine the first preset threshold, which is the high-risk threshold for the remaining validity period indicator, firstly, statistically analyze the remaining validity period indicator values ​​of all expired certificates 90 days before expiration, calculate the median of these values, and use this median as the first preset threshold. For example, if statistically analyze 1000 expired certificate data, and the median of the remaining validity period indicator 90 days before expiration is 0.3, then the first preset threshold is set to 0.3. The range of remaining validity period indicators less than 0.3 is the high-risk extreme value area for this dimension.

[0076] Determining the second preset threshold, i.e. the high-risk threshold of the security strength index, requires screening certificates that have experienced security incidents such as key leakage and signature verification failure in the past, statistically analyzing the security strength index values ​​of these certificates, calculating the average value of these values, and using this average value as the second preset threshold. For example, if the average security strength index of 500 certificates with security incidents is 0.4, then the second preset threshold is set to 0.4. The range of security strength index values ​​less than 0.4 is the high-risk extreme value area of ​​this dimension.

[0077] Determining the third preset threshold, which is the high-risk threshold for business criticality indicators, requires statistical analysis of the values ​​of all business criticality indicators that carry core business functions, such as payment interfaces and user login certificates. The minimum value of these values ​​is taken as the third preset threshold. For example, if 800 core business certificate data are analyzed and the minimum value of the business criticality indicator is 0.8, then the third preset threshold is set to 0.8. The range of business criticality indicators greater than or equal to 0.8 is the high-risk extreme value area for that dimension.

[0078] To determine the fourth preset threshold, which is the low-risk threshold for the remaining validity period indicator, it is necessary to statistically analyze the remaining validity period indicator values ​​of all certificates that have not expired and have a remaining validity period of more than 180 days, calculate the median of these values, and use this median as the fourth preset threshold. For example, if 1200 such certificates are statistically analyzed and the median of the remaining validity period indicator is 0.7, then the fourth preset threshold is set to 0.7. The range of remaining validity period indicators greater than or equal to 0.7 is the low-risk extreme value area of ​​this dimension.

[0079] Determining the fifth preset threshold, which is the low-risk threshold for the security strength index, requires screening certificates that have never experienced a security incident and whose key configuration conforms to current industry security standards, such as a key length of at least 2048 bits and a signature algorithm of SHA256 or higher. The security strength index values ​​of these certificates are then statistically analyzed, and the median of these values ​​is used as the fifth preset threshold. For example, if 1500 such certificates are analyzed and the median security strength index is 0.8, then the fifth preset threshold is set to 0.8. Values ​​with a security strength index greater than or equal to 0.8 represent the low-risk extreme value region for this dimension.

[0080] Determining the sixth preset threshold, i.e., the low-risk threshold for business criticality indicators, requires statistically analyzing the business criticality indicator values ​​of all certificates carrying non-core business functions, such as internal testing and log storage. The maximum value of these values ​​is taken as the sixth preset threshold. For example, if the maximum value of the business criticality indicator for 600 non-core business certificate data is 0.3, then the sixth preset threshold is set to 0.3. The range of business criticality indicators less than 0.3 is the low-risk extreme value area for that dimension. Finally, for each evaluation dimension, the specific numerical ranges of the high-risk and low-risk extreme value areas are defined. For example, on the X-axis, the high-risk extreme value area for the remaining validity period indicator is 0 to 0.3, and the low-risk extreme value area is 0.7 to 1.0; on the Y-axis, the high-risk extreme value area for the security strength indicator is 0 to 0.4, and the low-risk extreme value area is 0.8 to 1.0; and on the Z-axis, the high-risk extreme value area for the business criticality indicator is 0.8 to 1.0, and the low-risk extreme value area is 0 to 0.3. This provides clear boundary basis for subsequent statistical analysis and regional integration.

[0081] Within each assessment dimension, the order of the high-risk and low-risk thresholds must conform to the risk logic of that dimension:

[0082] Remaining validity period indicator: The lower the value, the higher the risk. Therefore, the high-risk threshold (first preset threshold) must be lower than the low-risk threshold (fourth preset threshold).

[0083] Safety strength index: The lower the value, the higher the risk. Therefore, the high-risk threshold (second preset threshold) must be lower than the low-risk threshold (fifth preset threshold).

[0084] Key business indicators: The higher the value, the higher the risk. Therefore, the high-risk threshold (third preset threshold) must be greater than the low-risk threshold (sixth preset threshold).

[0085] Step 302 involves statistically analyzing the distribution of risk indicator values ​​for each assessment dimension. Based on the statistical distribution characteristics in historical data, the feature density concentration areas for each assessment dimension are identified. Specifically, this includes: firstly, dividing the value range of each assessment dimension into intervals. Since all risk indicator values ​​are between 0 and 1, the value range of each dimension is divided into 10 consecutive numerical intervals, each interval being 0.1. That is, the first interval is 0.0 to 0.1, the second interval is 0.1 to 0.2, the third interval is 0.2 to 0.3, and so on, up to the tenth interval. The range is from 0.9 to 1.0, ensuring that the span of each range is consistent. The number of historical certificates within each range is counted. Taking the X-axis, i.e., the remaining validity period indicator, as an example, the remaining validity period indicator values ​​of all certificates are first extracted from the historical certificate data. Then, the indicator value of each certificate is matched with the corresponding range. That is, the value range of each range is first determined, such as the range from 0.7 to 0.8, which includes 0.7 and is less than 0.8. Then, the remaining validity period indicator value of a certain certificate is checked. If the value is greater than or equal to the starting value of the range and less than the ending value of the range, the certificate is included in the statistical count of that range.

[0086] For example, if a certificate's remaining validity period indicator is 0.72, which is greater than 0.7 and less than 0.8, falling within the range of 0.7 to 0.8, then the certificate is included in the statistics for the 0.7 to 0.8 range. Similarly, if a certificate's remaining validity period indicator is 0.65, which is greater than 0.6 and less than 0.7, falling within the range of 0.6 to 0.7, then the certificate is included in the statistics for the 0.6 to 0.7 range. Following this method, each certificate in the historical data is judged and categorized one by one. After all certificates are assigned to their corresponding ranges, the statistics for each range are then compiled separately. The total number of certificates included is the original statistical count for each interval. Then, the certificate density for each interval is calculated by dividing the number of certificates in each interval by the total number of historical certificate data. For example, if the total number of historical certificates is 5000, and the number of certificates in the 0.2 to 0.3 interval is 800, then the certificate density for that interval is 800 divided by 5000; if the number of certificates in the 0.7 to 0.8 interval is 1200, then the certificate density for that interval is 1200 divided by 5000. By calculating the density, the influence of the total number on the interval statistical results can be eliminated, and the degree of certificate concentration in different intervals can be more accurately reflected.

[0087] Next, the feature density concentration region is identified. For each dimension, the 10 intervals are sorted from highest to lowest certificate density. The two intervals with the highest density are selected as core candidate intervals. If these two candidate intervals are continuous, such as 0.2 to 0.3 and 0.3 to 0.4, they are merged into a single continuous numerical range, which is considered the feature density concentration region for that dimension. If these two candidate intervals are not continuous, such as 0.2 to 0.3 and 0.5 to 0.6, the density of adjacent intervals is examined. If the density difference between the adjacent interval and the candidate interval is less than 0.02, the adjacent interval is also included to form a continuous concentration region. For example, on the X-axis, i.e., in the remaining validity period indicator, the density of the 0.6 to 0.7 interval is 0.22, and the density of the 0.7 to 0.8 interval is 0.24. These two intervals are continuous and have the highest density; after merging, the range of 0.6 to 0.8 is the feature density concentration region for the remaining validity period dimension. On the Y-axis, i.e., security strength... In the degree index, the density of the interval between 0.7 and 0.8 is 0.21, and the density of the interval between 0.8 and 0.9 is 0.23. After merging, the range of 0.7 to 0.9 is the concentrated area of ​​feature density for the security strength dimension. In the Z-axis, i.e., the business criticality index, the density of the interval between 0.4 and 0.5 is 0.19, and the density of the interval between 0.5 and 0.6 is 0.20. After merging, the range of 0.4 to 0.6 is the concentrated area of ​​feature density for the business criticality dimension. The concentrated area of ​​feature density for each dimension is verified to check whether the certificates in the area meet the risk characteristics of that dimension. For example, the density concentrated area of ​​0.6 to 0.8 for the remaining validity period dimension needs to be confirmed to be mostly certificates that have not expired and have sufficient remaining validity. If it meets the requirements, the area is determined as the final concentrated area of ​​feature density. If it does not meet the requirements, the interval with the second highest density is re-selected to ensure that the concentrated area of ​​feature density can truly reflect the risk index distribution of most certificates.

[0088] Step 303 involves integrating the distribution ranges of the extreme value regions and the concentrated feature density regions to form the core region definition for each evaluation dimension. Specifically, this includes: for each evaluation dimension, identifying the specific numerical ranges of the high-risk extreme value regions, low-risk extreme value regions, and concentrated feature density regions, and clarifying the boundaries of each region. For example, on the X-axis, the high-risk extreme value region for the remaining validity period indicator is 0.0 to 0.3, the low-risk extreme value region is 0.7 to 1.0, and the concentrated feature density region is 0.6 to 0.8; on the Y-axis, the high-risk extreme value region for the security strength indicator is 0.0 to 0.4, the low-risk extreme value region is 0.8 to 1.0, and the concentrated feature density region is 0.7 to 0.9; and on the Z-axis, the high-risk extreme value region for the business criticality indicator is 0.8 to 1.0, the low-risk extreme value region is 0.0 to 0.3, and the concentrated feature density region is 0.4 to 0.6.

[0089] To determine the overlap between the feature density concentration region and the feature extremum region, three cases are considered for integration. The first case is when the feature density concentration region overlaps with the high-risk extremum region. Taking the X-axis as an example, if the high-risk extremum region of a certain dimension is 0.0 to 0.3, and the feature density concentration region is 0.2 to 0.4, the overlap range is 0.2 to 0.3. This overlap range is the high-risk core region of that dimension because it belongs to the high-risk extremum range and also contains a large number of historical certificates, making it the main distribution area of ​​high-risk certificates. The second scenario is that the feature density concentration area overlaps with the low-risk extreme value area. Taking the Y-axis as an example, the low-risk extreme value area is 0.8 to 1.0, and the feature density concentration area is 0.7 to 0.9. The overlap range is 0.8 to 0.9. This overlap range is the low-risk core area of ​​this dimension because this area belongs to the low-risk extreme value range and also gathers a large number of historical certificates, making it the main distribution area of ​​low-risk certificates. The third scenario is that the feature density concentration area does not overlap with either the high-risk extreme value area or the low-risk extreme value area.

[0090] Taking the Z-axis as an example, the high-risk extreme value region is 0.8 to 1.0, the low-risk extreme value region is 0.0 to 0.3, and the feature density concentration region is 0.4 to 0.6. These three regions do not overlap. This feature density concentration region is the core region of medium risk in this dimension because it contains a large number of certificates that do not belong to either high or low risk, making it the main distribution area for medium-risk certificates. Then, the definition of non-overlapping regions is supplemented: for the portion of the feature extreme value region that does not overlap with the density concentration region, if the certificate density in this portion is below 0.05, meaning the number of certificates in this region accounts for less than 5% of the total, it is defined as a high-risk marginal region. Or a low-risk edge area, indicating that although the area belongs to the extreme value range, the number of certificates is very small and it is not typical; if the density is higher than 0.05, it is included in the extended range of the corresponding core area. For example, in the high-risk extreme value area of ​​0.0 to 0.3 on the X-axis, the density of the interval 0.0 to 0.2 is 0.03, which is lower than 0.05, and it is defined as a high-risk edge area; the density of the interval 0.2 to 0.3 is 0.16, which is higher than 0.05, and it is included in the high-risk core area. Finally, a complete core area definition is formed for each assessment dimension, and the specific numerical ranges of high-risk core area, medium-risk core area, low-risk core area and edge area are clearly defined.

[0091] For example, the X-axis, i.e., the core area of ​​the remaining validity period indicator, is defined as the high-risk core area (0.2 to 0.3), the high-risk edge area (0.0 to 0.2), the medium-risk core area (0.3 to 0.7), the low-risk core area (0.7 to 0.8), and the low-risk edge area (0.8 to 1.0); the Y-axis, i.e., the core area of ​​the security strength indicator, is defined as the high-risk core area (0.0 to 0.4, with a density higher than 0.05), the medium-risk core area (0.4 to 0.8), the low-risk core area (0.8 to 0.9), and the low-risk edge area (0.9 to 1.0); the Z-axis, i.e., the core area of ​​the business criticality indicator, is defined as the low-risk core area (0.0 to 0.3, with a density higher than 0.05), the medium-risk core area (0.4 to 0.6), the high-risk core area (0.8 to 1.0, with a density higher than 0.05), and the high-risk edge area (0.6 to 0.8).

[0092] This embodiment constructs a three-dimensional risk assessment space, transforming the three risk indicators—remaining validity period, security strength, and business criticality—into orthogonal assessment dimensions. This allows for a direct presentation of the certificate's comprehensive risk status across multiple dimensions, avoiding misjudgments caused by single-dimensional assessments and ensuring the risk assessment better aligns with the actual security and business attributes of the certificate. Based on historical certificate data, including both expired and non-expired certificates, it identifies characteristic extreme value regions. By statistically analyzing historical data such as the median and average, it sets preset thresholds, providing objective data support for the boundaries between high-risk and low-risk regions. This avoids biases caused by manually setting thresholds and improves the reliability of risk region segmentation. It captures the risk distribution patterns of most certificates, identifying areas of concentrated characteristic density through interval division and density calculation. This accurately identifies the main distribution range of certificate risk indicators in historical data, avoiding focusing solely on extreme value regions while ignoring the risk characteristics of most certificates. Finally, it defines precise risk core regions by integrating characteristic extreme value regions and density concentration regions, clearly defining the boundaries of high, medium, and low-risk core regions. This retains the risk warning significance of extreme value regions while incorporating the distribution characteristics of most certificates, resolving the issues of ambiguous risk regions and unclear judgment criteria, and improving the accuracy of risk assessment.

[0093] In a preferred embodiment of the present invention, S4 includes:

[0094] In this embodiment of the invention, step 400 involves projecting the feature representation of certificate expiration risk onto the three assessment dimensions of a three-dimensional risk assessment space to obtain the feature value distribution on each assessment dimension. Specifically, this includes: identifying the three core indicators corresponding to the feature representation of certificate expiration risk. This feature representation is composed of the remaining validity period indicator, security strength indicator, and business criticality indicator obtained previously. Each indicator corresponds to one assessment dimension of the three-dimensional risk assessment space, i.e., the remaining validity period indicator corresponds to the X-axis, the security strength indicator corresponds to the Y-axis, and the business criticality indicator corresponds to the Z-axis; extracting the three risk indicator values ​​of all certificates in the certificate set to be analyzed, and obtaining the remaining validity period indicator value, security strength indicator value, and business criticality indicator value of each certificate one by one from the certificate data records to ensure that the three indicator values ​​of each certificate are complete and accurate, without missing or erroneous data.

[0095] For example, from the record of certificate A, the remaining validity period index is extracted to be 0.68, the security strength index to be 0.75, and the business criticality index to be 0.82; from the record of certificate B, the remaining validity period index to be 0.42, the security strength index to be 0.53, and the business criticality index to be 0.35, and so on, to complete the extraction of all certificate index values; then, the index values ​​are projected dimensionally, mapping the three index values ​​of each certificate to the three axes of three-dimensional space, that is, mapping the remaining validity period index value of each certificate to the corresponding position on the X-axis, as the feature value of the certificate on the X-axis, i.e., the remaining validity period dimension; mapping the security strength index value of each certificate to the corresponding position on the Y-axis, as the feature value of the certificate on the Y-axis, i.e., the security strength dimension; and mapping the business criticality index value of each certificate to the corresponding position on the Y-axis, i.e., the security strength dimension; and mapping the business criticality index value of each certificate to the corresponding position on the Y-axis. The numerical values ​​are mapped to the corresponding positions on the Z-axis, serving as the feature values ​​of the certificate on the Z-axis, i.e., the business criticality dimension. The feature value distribution of each dimension is organized, and the feature values ​​of all certificates on the same dimension are summarized to form the feature value set of that dimension. For example, summarizing the remaining validity period index values ​​of all certificates yields the feature value set of the X-axis dimension, such as 0.68, 0.42, 0.72, 0.35, etc.; summarizing the security strength index values ​​of all certificates yields the feature value set of the Y-axis dimension, such as 0.75, 0.53, 0.81, 0.48, etc.; summarizing the business criticality index values ​​of all certificates yields the feature value set of the Z-axis dimension, such as 0.82, 0.35, 0.66, 0.29, etc. The arrangement of the values ​​in each set is the feature value distribution on the corresponding evaluation dimension.

[0096] Step 401: Based on the eigenvalue distribution across each evaluation dimension, calculate the standard deviation of the eigenvalues ​​as an indicator of dispersion, and calculate the kurtosis coefficient of the eigenvalues ​​as an indicator of clustering. Specifically, this includes: calculating the standard deviation of the eigenvalues ​​for each evaluation dimension, i.e., the dispersion index. First, calculate the average of the eigenvalues ​​for each dimension. Taking the X-axis, i.e., the remaining validity period dimension, as an example, first count the total number of values ​​in the eigenvalue set for that dimension, then sum all the eigenvalues ​​in the set to obtain the sum of the eigenvalues. Divide the sum of the eigenvalues ​​by the total number of values ​​to obtain the average of the eigenvalues ​​for that dimension. For example, if the X-axis eigenvalue set contains 100 values, the sum of all the values... The sum is 65. Dividing 65 by 100 gives the average value of the X-axis eigenvalues ​​as 0.65. The Y-axis eigenvalue set contains 100 values ​​with a sum of 72. Dividing 72 by 100 gives the average value of the Y-axis eigenvalues ​​as 0.72. The Z-axis eigenvalue set contains 100 values ​​with a sum of 58. Dividing 58 by 100 gives the average value of the Z-axis eigenvalues ​​as 0.58. Next, the squared deviation of each eigenvalue from the average is calculated. For each dimension's eigenvalue set, each eigenvalue is taken, and the average value of that dimension is subtracted from the eigenvalue to obtain the deviation value. The deviation value is then squared to obtain the squared deviation value.

[0097] For example, if a feature value on the X-axis is 0.68 and the average value is 0.65, subtracting 0.65 from 0.68 yields a deviation of 0.03. Squaring 0.03 gives the squared deviation. If another feature value on the X-axis is 0.42, subtracting 0.42 from 0.65 yields a deviation of -0.23. Squaring -0.23 gives the squared deviation. This process is repeated for all feature values ​​in that dimension. Then, the average of the squared deviations is calculated. The sum of the squared deviations for all feature values ​​in that dimension is then obtained. Finally, the sum of the squared deviations is divided by the total number of feature values ​​in that dimension to get the average squared deviation. For example, on the X-axis... The sum of the squared deviations of all eigenvalues ​​is 2.5. Since there are 100 eigenvalues, dividing 2.5 by 100 gives the average of the squared deviations, which is 0.025. Finally, the standard deviation is calculated by taking the square root of the average squared deviation. This result is the standard deviation of the eigenvalues ​​in that dimension, serving as an indicator of dispersion. For example, the average squared deviation of the X-axis is 0.025. Taking the square root of 0.025 reflects the dispersion of the eigenvalues ​​along the X-axis; a larger value indicates a more dispersed distribution. The same steps are followed to calculate the standard deviations of the eigenvalues ​​along the Y-axis and Z-axis, yielding their respective dispersion indicators.

[0098] To calculate the kurtosis coefficient, or clustering index, of the eigenvalues ​​for each evaluation dimension, first calculate the fourth power of the deviation of each eigenvalue from the mean. For each dimension's eigenvalue set, take each eigenvalue in the set, subtract the mean of that dimension from that eigenvalue to obtain the deviation value, and then raise the deviation value to the fourth power to obtain the fourth power deviation value. For example, if the mean of the Y-axis eigenvalues ​​is 0.72, and one eigenvalue is 0.75, subtracting 0.72 from 0.75 gives a deviation value of 0.03. Raising 0.03 to the fourth power gives the fourth power deviation value. Another Y-axis eigenvalue is 0.53, subtracting 0.72 from 0.53 gives a deviation value of -0.19, and raising -0.19 to the fourth power gives the fourth power deviation value. The calculation yields the fourth power of the deviation value. This process is repeated for all eigenvalues ​​of that dimension. Next, the average of the fourth power deviations is calculated. The fourth power deviations of all eigenvalues ​​of that dimension are summed to obtain the total fourth power deviation. This total fourth power deviation is then divided by the total number of eigenvalues ​​in that dimension to obtain the average fourth power deviation. For example, if the total fourth power deviation of all eigenvalues ​​on the Y-axis is 0.085 and the total number of eigenvalues ​​is 100, dividing 0.085 by 100 gives an average fourth power deviation of 0.00085. Finally, the fourth power of the standard deviation is calculated by raising the previously obtained standard deviations of the eigenvalues ​​in that dimension to the fourth power to obtain the fourth power of the standard deviation.

[0099] For example, if the standard deviation of the Y-axis eigenvalue is 0.12, we can raise 0.12 to the fourth power to obtain the fourth power of the standard deviation. To calculate the kurtosis coefficient, we divide the average of the fourth power of the deviation by the fourth power of the standard deviation, and then subtract 3 from the result. The resulting value is the kurtosis coefficient for that dimension of eigenvalue, serving as an indicator of clustering. For instance, if the average of the fourth power of the Y-axis deviation is 0.00085 and the fourth power of the standard deviation is 0.00020736, dividing 0.00085 by 0.00020736 yields approximately 4.1. Subtracting 3 from 4.1 gives a kurtosis coefficient of approximately 1.1. This value reflects the degree of clustering of the eigenvalues; a larger value indicates that the eigenvalues ​​are more concentrated near the average. If the value is less than 0, it indicates that the eigenvalues ​​are more dispersed. Following the same steps, we can calculate the kurtosis coefficients for the X-axis and Z-axis eigenvalues ​​to obtain their respective clustering indicators.

[0100] Step 402: Based on the ratio of the clustering index to the dispersion index for each assessment dimension, generate the risk weight adjustment parameters for each assessment dimension. Specifically, this includes: clarifying the clustering index and dispersion index for each dimension; organizing the kurtosis coefficient (clustering index) and standard deviation (dispersion index) of each dimension calculated in Step 401 to ensure that the two indices for each dimension correspond one-to-one without confusion. For example, the clustering index (kurtosis coefficient) for the X-axis is 0.8, and the dispersion index (standard deviation) is 0.158; the clustering index (kurtosis coefficient) for the Y-axis is 1.1, and the dispersion index (standard deviation) is 0.12; the clustering index (kurtosis coefficient) for the Z-axis is 0.6, and the dispersion index (standard deviation) is 0.18. Then, calculate the ratio of the clustering index to the dispersion index for each dimension. For each dimension, divide the kurtosis coefficient (clustering index) of that dimension by the standard deviation (dispersion index) of that dimension to obtain the ratio result.

[0101] This ratio reflects the strength of the clustering of feature values ​​within a dimension relative to their dispersion. A larger ratio indicates a more significant clustering of feature values ​​in that dimension, potentially leading to a stronger ability to distinguish between differentiating certificate expiration risks. Then, the ratios for all dimensions are normalized. First, the sum of the ratios for all dimensions is calculated. Then, the ratios for the three dimensions are added together to obtain the total ratio. For example, if the X-axis ratio is 5.06, the Y-axis ratio is 9.17, and the Z-axis ratio is 3.33, adding 5.06, 9.17, and 3.33 gives a total ratio of 17.56. Then, the ratio for each dimension is divided by the total ratio to obtain the normalized ratio for that dimension. For example, for the X-axis, dividing 5.06 by 17.56 gives... To obtain the normalized ratio, divide 9.17 by 17.56 for the Y-axis and 3.33 by 17.56 for the Z-axis. These normalized ratios are then used to determine the risk weight adjustment parameters for each dimension. For example, the risk weight adjustment parameter for the X-axis (remaining validity period dimension) is 0.288, for the Y-axis (security strength dimension) it is 0.522, and for the Z-axis (business criticality dimension) it is 0.189. A larger weight parameter indicates a higher weight for that dimension in the overall risk assessment and a greater impact on the risk level determination.

[0102] This embodiment projects the characteristic representation of certificate expiration risk onto a three-dimensional assessment dimension, transforming abstract risk characteristics into quantifiable and analyzable dimensional numerical distributions, thus addressing the disconnect between characteristics and the assessment framework in risk assessment. By calculating the standard deviation and kurtosis coefficient, the distribution of characteristic values ​​is described from the two dimensions of dispersion and clustering, respectively, avoiding the limitations of relying solely on subjective judgment to assess the characteristic distribution. This makes the analysis results of the characteristic distribution more objective and accurate, aligning with the data accuracy requirements of digital certificate risk assessment. Risk weight adjustment parameters are generated based on the ratio of clustering to dispersion, ensuring that the weight allocation reflects the actual situation of the characteristic distribution in each dimension, enhancing the influence of that dimension on risk assessment. By balancing the influence of different dimensions through weight adjustment parameters, the dimensions that can better distinguish risk differences in risk assessment—that is, those with strong clustering and weak dispersion—play a greater role, reducing the interference of irrelevant or low-discrimination dimensions on the assessment results. This makes the final risk assessment result more closely reflect the actual situation of certificate expiration risk, solving the assessment bias problem caused by the rigidity of dimensional weights in the assessment.

[0103] In a preferred embodiment of the present invention, S5 includes:

[0104] In this embodiment of the invention, step 500, based on the definition of the core region, calculates the geometric distance between the center point of the feature value distribution on each evaluation dimension and the center point of the corresponding core region, and generates a position adjustment coefficient based on the geometric distance. Specifically, this includes: determining the core region and the center point of the core region corresponding to each evaluation dimension; based on the core region definition of each dimension formed in step 303, clarifying the core region that matches the current risk status of the certificate under each evaluation dimension. For example, if the remaining validity period index of a certificate is 0.72, corresponding to the X-axis, that is, the low-risk core region of the remaining validity period dimension is 0.7 to 0.8; the security strength index is 0.85, corresponding to the Y-axis, that is, the low-risk core region of the security strength dimension is 0.8 to 0.9; the business criticality index is 0.6, corresponding to the Z-axis, that is, the medium-risk core region of the business criticality dimension is 0.4 to 0.6; for each matching core region, calculate its center point value, that is, add the starting value of the core region to the ending value, divide the sum by 2, and obtain the center point value of the core region.

[0105] For example, the low-risk core area on the X-axis is 0.7 to 0.8. We calculate 0.7 + 0.8 = 1.5, then divide 1.5 by 2 to get the center point value of the core area: 0.75. The low-risk core area on the Y-axis is 0.8 to 0.9. We calculate 0.8 + 0.9 = 1.7, then divide 1.7 by 2 to get the center point value of the core area: 0.85. The medium-risk core area on the Z-axis is 0.4 to 0.6. We calculate 0.4 + 0.6 = 1.0, then divide 1.0 by 2 to get the center point value of the core area: 0.5. Next, we calculate the center point of the eigenvalue distribution on each evaluation dimension. This center point is the average value of the eigenvalues ​​calculated in step 401. Since the center point of the eigenvalue distribution represents the central tendency of all eigenvalues, the average value accurately reflects this. Trends, such as the X-axis (meaning the average value of the remaining validity period dimension feature value is 0.65, which is the center point of the X-axis feature value distribution); the Y-axis (meaning the average value of the security strength dimension feature value is 0.72, which is the center point of the Y-axis feature value distribution); and the Z-axis (meaning the average value of the business criticality dimension feature value is 0.58, which is the center point of the Z-axis feature value distribution. Then, the geometric distance between the center point of the feature value distribution and the center point of the core area is calculated. Since each evaluation dimension is a single-axis linear dimension, the geometric distance is the absolute amount of the difference between the values ​​of the two center points. The calculation method is to subtract the value of the core area center point from the value of the feature value distribution center point and take the absolute amount of this difference to avoid negative distance values, thus obtaining the geometric distance between the two center points.

[0106] For example, if the center point of the X-axis eigenvalue distribution is 0.65 and the center point of the core region is 0.75, the difference between 0.65 and 0.75 is obtained, and the absolute value yields a geometric distance of 0.1. Similarly, if the center point of the Y-axis eigenvalue distribution is 0.72 and the center point of the core region is 0.85, the difference between 0.72 and 0.85 is obtained, and the absolute value yields a geometric distance of 0.13. And if the center point of the Z-axis eigenvalue distribution is 0.58 and the center point of the core region is 0.5, the difference between 0.58 and 0.5 is obtained, and the absolute value yields a geometric distance of 0.08. Finally, a position adjustment coefficient is generated based on this geometric distance. This coefficient reflects the degree of fit between the eigenvalue distribution and the core region; the closer the fit (the smaller the distance), the better. The larger the coefficient, the smaller it is. The calculation method is to subtract the geometric distance from 1. Since the value range of each dimension is from 0 to 1, and the maximum geometric distance is 1, subtracting the distance from 1 will make the coefficient range fall between 0 and 1, thus obtaining the position adjustment coefficient. For example, if the geometric distance on the X-axis is 0.1, subtracting 0.1 from 1 gives a position adjustment coefficient of 0.9; if the geometric distance on the Y-axis is 0.13, subtracting 0.13 from 1 gives a position adjustment coefficient of 0.87; and if the geometric distance on the Z-axis is 0.08, subtracting 0.08 from 1 gives a position adjustment coefficient of 0.92. If the geometric distance is 0 (perfect fit), the position adjustment coefficient is 1; if the geometric distance is 1 (complete distance), the position adjustment coefficient is 0, ensuring that the coefficient accurately reflects the degree of fit.

[0107] Step 501 involves weighting the risk weight adjustment parameters and position adjustment coefficients for each assessment dimension to obtain the comprehensive weight coefficient for each dimension. This includes: compiling the risk weight adjustment parameters and position adjustment coefficients for each assessment dimension; ensuring a one-to-one correspondence between the risk weight adjustment parameters obtained in Step 402 (e.g., X-axis 0.288, Y-axis 0.522, Z-axis 0.189) and the position adjustment coefficients obtained in Step 500 (e.g., X-axis 0.9, Y-axis 0.87, Z-axis 0.92), guaranteeing accurate matching and no confusion between the two parameters for each dimension; and performing a weighted calculation for each dimension by multiplying the risk weight adjustment parameter by the position adjustment coefficient. The resulting product is the comprehensive weight coefficient for that dimension. For example, X... The X-axis is calculated by multiplying the risk weight adjustment parameter 0.288 by the position adjustment coefficient 0.9. The resulting value is the comprehensive weight coefficient for the remaining validity period dimension. The Y-axis is calculated by multiplying the risk weight adjustment parameter 0.522 by the position adjustment coefficient 0.87. The resulting value is the comprehensive weight coefficient for the safety strength dimension. The Z-axis is calculated by multiplying the risk weight adjustment parameter 0.189 by the position adjustment coefficient 0.92. The resulting value is the comprehensive weight coefficient for the business criticality dimension. To verify the rationality of the comprehensive weight coefficients for each dimension, the comprehensive weight coefficients of the three dimensions are added together. The sum is checked to see if it is between 0.95 and 1.05. Due to the decimal retention error in the calculation process, slight fluctuations are allowed. If it exceeds the range, the parameter values ​​and multiplication calculation process are rechecked to ensure that the comprehensive weight coefficients are accurate.

[0108] Step 502: Calculate the comprehensive risk assessment value by weighting and summing the corresponding risk indicators using the comprehensive weighting coefficient of each assessment dimension. Specifically, this includes: extracting the risk indicator values ​​of the certificate to be assessed across the three assessment dimensions; obtaining the remaining validity period indicator value, security strength indicator value, and business criticality indicator value from the certificate's risk indicator records (e.g., a certificate with a remaining validity period indicator of 0.72, a security strength indicator of 0.85, and a business criticality indicator of 0.6), ensuring a one-to-one correspondence between the indicator values ​​and the assessment dimensions; and performing a weighted calculation on the risk indicator values ​​for each dimension, multiplying the risk indicator value of each dimension by the comprehensive weighting coefficient of that dimension to obtain the risk assessment value for that dimension. The weighted results are calculated as follows: for the X-axis (remaining validity period dimension), the risk indicator value is multiplied by a comprehensive weighting coefficient of 0.2592 to obtain the X-axis weighted result; for the Y-axis (security strength dimension), the risk indicator value is multiplied by a comprehensive weighting coefficient of 0.85 to obtain the Y-axis weighted result; and for the Z-axis (business criticality dimension), the risk indicator value is multiplied by a comprehensive weighting coefficient of 0.17388 to obtain the Z-axis weighted result. The weighted results of the three dimensions are then summed to obtain the comprehensive risk assessment value. This value combines the risk indicators and corresponding weights of the three dimensions, reflecting the overall risk level of the certificate.

[0109] Step 503: Normalize the comprehensive risk assessment value to obtain an optimized risk assessment result with a value range between 0 and 1. Specifically, this includes: determining the range of the comprehensive risk assessment value. Since the risk indicator values ​​for each assessment dimension range from 0 to 1, the comprehensive weight coefficient ranges from 0 to 1, the maximum weighted result for a single dimension is 1×1=1, and the sum of the maximum weighted results for the three dimensions is 1+1+1=3. Therefore, the comprehensive risk assessment value for all certificates ranges from 0 to 3. Calculate the normalization coefficient, which is the maximum possible value of the comprehensive risk assessment value, i.e., 3. Since the sum of the maximum weighted results for the three dimensions is 3, this coefficient is used to uniformly map all comprehensive risk assessment values ​​to the range of 0 to 1. Then, for each certificate... The comprehensive risk assessment value of the certificate is normalized by dividing it by a normalization coefficient of 3 to obtain the normalized risk assessment result. If the comprehensive risk assessment value of a certificate is 0, the normalization result is 0; if it is 3, the normalization result is 1, ensuring that all results fall between 0 and 1. The normalized result is then processed to retain four decimal places, or a specified number of decimal places as needed, removing trailing zeros to obtain the optimized risk assessment result. For example, 0.225657 becomes 0.2257 with four decimal places, and 0.8 becomes 0.8000 with four decimal places. The final result can intuitively reflect the relative level of the certificate's risk; the closer the value is to 1, the higher the risk, and the closer it is to 0, the lower the risk.

[0110] This embodiment calculates the geometric distance and location adjustment coefficient between the feature value distribution and the core area, ensuring that weight adjustment considers not only the characteristics of the feature distribution but also the actual location of the risk area. This avoids blind weight allocation that deviates from the definition of the core area, making the risk assessment more aligned with the regional division logic of the three-dimensional risk assessment space and improving the targeting of the assessment. By weighting and combining the risk weight adjustment parameters with the location adjustment coefficient, it integrates the discrete and clustered characteristics of the feature distribution with the fit of the regional location, avoiding the one-sidedness of a single parameter determining the weight. This allows the comprehensive weight coefficient of each dimension to more fully reflect the actual impact of that dimension on the overall risk, reducing weight bias. To mitigate assessment errors, a weighted summation method is used to calculate the comprehensive risk assessment value. This method ensures that the risk indicators of the three assessment dimensions contribute to the overall assessment according to their respective comprehensive weights, avoiding the problem of simply adding values ​​while ignoring the differences in the importance of dimensions. This allows the comprehensive assessment value to objectively reflect the overall risk level of the certificate across multiple dimensions, aligning with the reality that digital certificate risks are influenced by multiple factors. Furthermore, normalization maps the comprehensive risk assessment value to a range of 0 to 1, eliminating inconsistencies in the numerical range of comprehensive values ​​for different certificates due to differences in dimension weights. This makes the risk assessment results of different certificates directly comparable, facilitating the rapid identification of high-risk and low-risk certificates.

[0111] In a preferred embodiment of the present invention, S6 includes:

[0112] In this embodiment of the invention, step 600, based on the optimized risk assessment results, filters digital certificates whose optimized risk assessment results are greater than a preset risk threshold as a set of high-risk certificates to be processed. Specifically, this includes: first, determining the preset risk threshold, which is determined based on the statistical analysis of the optimized risk assessment results of historical high-risk certificates; collecting certificates that have been judged as high-risk and have actually expired or experienced security incidents within the past 1 to 2 years; extracting the optimized risk assessment results of these certificates; calculating the median of these results; and using this median as the preset risk threshold. For example, if the median of the optimized risk assessment results of 500 historical high-risk certificates is 0.65, then the preset risk threshold is set to 0.65 to distinguish between high-risk and non-high-risk certificates; and extracting the optimized risk assessment results of all certificates to be assessed, obtaining the optimized risk assessment results of each certificate one by one from the certificate risk assessment records.

[0113] For example, certificate A has a risk assessment result of 0.72, certificate B has a risk assessment result of 0.58, and certificate C has a risk assessment result of 0.81, etc., ensuring that the results for each certificate are complete and without missing or erroneous data. The optimized risk assessment result of each certificate is compared with the preset risk threshold. If the optimized risk assessment result of a certificate is greater than the preset risk threshold, the certificate is included in the set of high-risk certificates to be processed. If the result is less than or equal to the preset risk threshold, the certificate is classified as a non-high-risk certificate and is not included in the set. For example, if the preset risk threshold is 0.65, certificate A's result of 0.72 is greater than 0.65 and it is included in the high-risk set; certificate B's result of 0.58 is less than 0.65 and it is not included; certificate C's result of 0.81 is greater than 0.65 and it is included in the high-risk set. All the selected high-risk certificates are sorted according to their certificate identifiers, such as serial numbers, to form a complete list of high-risk certificates to be processed. The list contains basic information such as the identifier and optimized risk assessment result of each high-risk certificate.

[0114] Step 601: For each digital certificate in the high-risk certificate set, extract the remaining validity period indicator and the business criticality indicator. Based on the remaining validity period indicator, classify the certificate into four validity levels; based on the business criticality indicator, classify the certificate into three business levels. Specifically, this includes: extracting the corresponding remaining validity period indicator and business criticality indicator from each certificate record in the high-risk certificate set, ensuring that the two indicators for each certificate correspond one-to-one with the certificate identifier without confusion. For example, from the record of certificate A, extract the remaining validity period indicator of 0.35 and the business criticality indicator of 0.92; from the record of certificate D, extract the remaining validity period indicator of 0.12 and the business criticality indicator of 0.92. The threshold is 0.55. The remaining validity period of all certificates in the high-risk certificate set is statistically analyzed, and the 25th, 50th (median), and 75th quartiles of these values ​​are calculated. These three quartiles are used as the boundaries for classifying the certificates. For example, if the remaining validity period of 100 high-risk certificates is statistically analyzed, and the 25th quartile is 0.2, the 50th quartile is 0.4, and the 75th quartile is 0.6, then the classification criteria for the four validity periods are: a value less than 0.2 indicates an extremely short validity period; a value greater than or equal to 0.2 and less than 0.4 indicates a relatively short validity period; a value greater than or equal to 0.4 and less than 0.6 indicates a medium validity period; and a value greater than or equal to 0.6 indicates a relatively long validity period.

[0115] Next, determine the three business level classification standards for key business indicators. Similarly, statistically analyze the business key indicator values ​​of all certificates in the high-risk certificate set, and calculate the 33rd and 67th percentiles of these values. Use these two percentiles as the boundaries for level classification. For example, if the business key indicator of 100 high-risk certificates is statistically analyzed, and the 33rd percentile is 0.4 and the 67th percentile is 0.7, then the classification standards for the three business levels are: indicators less than 0.4 are general business level, indicators greater than or equal to 0.4 and less than 0.7 are important business level, and indicators greater than or equal to 0.7 are core business level. For each certificate in the high-risk certificate set, first determine the validity period level to which its remaining validity period indicator belongs, that is, compare the remaining validity period indicator of the certificate with the classification standards of the four validity periods one by one to determine the level corresponding to the indicator.

[0116] For example, Certificate A has a remaining validity period of 0.35, which is greater than or equal to 0.2 and less than 0.4, classifying it as a short validity period; Certificate D has a remaining validity period of 0.12, which is less than 0.2, classifying it as an extremely short validity period; a certain certificate has a remaining validity period of 0.58, which is greater than or equal to 0.4 and less than 0.6, classifying it as a medium validity period; a certain certificate has a remaining validity period of 0.65, which is greater than or equal to 0.6, classifying it as a relatively long validity period; then, the business level to which each certificate belongs is determined, that is, the certificate's business criticality indicator is compared with the three... The criteria for classifying each business level are compared one by one to determine the corresponding level. For example, Certificate A has a business criticality index of 0.92, which is greater than or equal to 0.7, and is classified as a core business level; Certificate D has a business criticality index of 0.55, which is greater than or equal to 0.4 and less than 0.7, and is classified as an important business level; a certain certificate has a business criticality index of 0.32, which is less than 0.4, and is classified as a general business level. The corresponding validity level and business level are recorded for each high-risk certificate to ensure that the level classification result of each certificate is stored together with the certificate identifier and the values ​​of the two indicators.

[0117] Step 602: Based on the timeliness level and business level, a multi-level classification matrix is ​​used to conduct a comprehensive risk level assessment for each high-risk certificate, generating a structured assessment report containing certificate identifier, risk level, validity period status, and business importance. A visual risk level identifier is added to each high-risk certificate in the assessment report, and they are sorted in descending order of risk level. Specifically, this includes: First, constructing a multi-level classification matrix, with timeliness level as the row and business level as the column, forming a 4x3 matrix structure. Each matrix cell corresponds to a comprehensive risk level. Based on the logic that shorter timeliness and more core business lead to higher risk levels, the comprehensive risk level of each cell is determined. Row 1 (the intersection of the extremely short timeliness level and column 3 (the core business level)) corresponds to Level 1 high risk; Row 1 (the extremely short timeliness level) and column 2 (the important business level); Row 2 (the relatively short timeliness level) and column 3 (the less important business level) correspond to... The cells at the intersection of the core business level and column 1 correspond to Level 2 high risk; Row 1 (very short timeliness level) and column 1 (general business level), Row 2 (shorter timeliness level) and column 2 (important business level), Row 3 (medium timeliness level) and column 3 (core business level) correspond to Level 3 high risk; Row 2 (shorter timeliness level) and column 1 (general business level), Row 3 (medium timeliness level) and column 2 (important business level), Row 4 (longer timeliness level) and column 3 (core business level) correspond to Level 4 high risk; Row 3 (medium timeliness level) and column 1 (general business level), Row 4 (longer timeliness level) and column 2 (important business level) correspond to Level 5 high risk; Row 4 (longer timeliness level) and column 1 (general business level) correspond to Level 6 high risk, where Level 1 high risk is the highest and Level 6 high risk is the lowest.

[0118] For each high-risk certificate, locate the corresponding cell in the multi-level classification matrix. This involves determining the row based on the certificate's validity period and the column based on its business level. The combined risk level of the cell at the intersection of the row and column is the final combined risk level for that certificate. For example, certificate A has a short validity period (row 2) and a core business level (column 3), corresponding to a level 2 high-risk certificate in the matrix; certificate D has an extremely short validity period (row 1) and an important business level (column 2), corresponding to a level 2 high-risk certificate in the matrix; and a certain certificate has a longer validity period (row 4) and a general business level (column 1), corresponding to a level 6 high-risk certificate in the matrix. The content of the structured assessment report is then determined, including four core fields. The certificate identifier must be the unique serial number or serial number of the certificate, used to distinguish different certificates; the risk level must be the overall risk level after assessment, such as Level 1 High Risk, Level 2 High Risk, etc.; the validity status must be converted into a plain description according to the validity level, such as the extremely short validity level corresponding to the imminent expiration, that is, the remaining validity period is extremely short, and the longer validity level corresponding to the longer remaining validity period; the business importance must be converted into a plain description according to the business level, such as the core business level corresponding to the carrying of core business, that is, the interruption will have a significant impact, and the general business level corresponding to the carrying of general business, that is, the interruption will have a minor impact. Fill in the above information for each high-risk certificate into the report fields one by one to form an assessment record for a single certificate.

[0119] Each high-risk certificate is given a visual risk level identifier, using different colored icons or labels to correspond to different risk levels. For example, a red exclamation mark icon represents Level 1 high risk, an orange exclamation mark icon represents Level 2 high risk, a yellow exclamation mark icon represents Level 3 high risk, and blue exclamation mark icons represent Levels 4 to 6 high risk. The corresponding risk level text is labeled next to the icon, making the risk level intuitively identifiable. All high-risk certificates in the assessment report are sorted from highest to lowest based on their overall risk level, with all Level 1 high-risk certificates listed first, followed by Level 2, 3, 4, 5, and 6 high-risk certificates in that order. If there are multiple certificates under the same risk level, they are then sorted from smallest to largest by the remaining validity period (the shorter the validity period, the earlier it appears). This ensures that the report prioritizes the certificates with the highest risk and the most urgent need for handling. After sorting, the reports are compiled into a complete structured assessment report, facilitating staff to quickly locate high-priority tasks.

[0120] In this embodiment, certificates whose risk assessment results exceed the limit after optimization are filtered by preset risk thresholds. This avoids non-high-risk certificates occupying processing resources, allowing staff to focus on certificates that truly require intervention, improving the efficiency of risk handling, and aligning with the actual need for precise problem identification in digital certificate risk management. By combining the two core influencing factors of remaining validity period (validity level) and business criticality (business level), the one-sidedness of assessing risk levels from a single dimension is avoided, allowing risk levels to more comprehensively reflect the urgency of the certificate and its business impact, providing a basis for differentiated processing. A multi-level classification matrix clarifies the risk levels corresponding to different combinations of validity periods and business levels, avoiding level deviations caused by subjective assessments, unifying the level assessment standards for all high-risk certificates, and improving the objectivity and consistency of assessment results. The structured report contains core certificate information and visual identifiers, and after sorting, high-priority certificates are displayed first, making it easier for staff to quickly understand the certificate risk status and clarify the processing order, solving the problems of cluttered report information and lack of focus, and improving the response speed of risk handling.

[0121] In a preferred embodiment of the present invention, S7 includes:

[0122] In this embodiment of the invention, step 700 involves parsing the risk level information in the assessment report and generating a certificate update task queue according to the risk level from high to low. Specifically, this includes: reading the certificate identifier, comprehensive risk level, remaining validity period indicator, and business criticality level of each high-risk certificate from the structured assessment report, and storing this information in association with the certificate identifier to ensure that each certificate's information corresponds one-to-one without misalignment or omission. For example, the identifier of certificate A is SN12345, the comprehensive risk level is Level 1 (high risk), the remaining validity period indicator is 0.35, and the business criticality level is... Core business level; the identifier of certificate B is SN67890, the comprehensive risk level is level 2 high risk, the remaining validity period index is 0.22, and the business criticality level is important business level; determine the sorting rules of risk levels, and clarify the priority order of comprehensive risk levels, that is, level 1 high risk has the highest priority, followed by level 2 high risk, then level 3 high risk, level 4 high risk, level 5 high risk, and level 6 high risk has the lowest priority. According to this order, first group all high-risk certificates according to comprehensive risk level, and group certificates of the same risk level together to form level 1 group, level 2 group and so on up to level 6 group.

[0123] Certificates within the same risk level group are sorted a second time. Certificates within the same risk level group are sorted from smallest to largest based on their remaining validity period index. The smaller the remaining validity period index, the shorter the remaining validity period of the certificate, and the higher the priority for urgent processing. For example, in the Level 1 high-risk group, there is certificate A with a remaining validity period index of 0.35 and certificate C with a remaining validity period index of 0.18. Certificate C's index is smaller than that of certificate A, so certificate C is ranked before certificate A in the Level 1 group. In the Level 2 high-risk group, there are certificate B with a remaining validity period index of 0.22 and certificate D with a remaining validity period index of 0.28. Certificate B is ranked before certificate D. The certificates in the Level 1 high-risk group are placed into the queue according to the second sorting results. After all certificates in the Level 1 group are placed, the sorting results of the Level 2 high-risk group are added, followed by the sorting results of the Level 3, Level 4, Level 5, and Level 6 high-risk groups, forming a complete task queue. Each task node in the queue contains a certificate identifier, comprehensive risk level, remaining validity period index, and business criticality level. Subsequent certificate update operations will be executed sequentially according to the queue order.

[0124] Step 701: Generate a new digital certificate for each certificate to be updated according to the order in the certificate update task queue. The validity period of the new digital certificate is adjusted based on the business criticality level of the original certificate. Specifically, this includes: determining the basic validity period standard corresponding to different business criticality levels; combining the industry's conventional validity period settings for digital certificates with business importance requirements; setting a basic validity period, i.e., a basic validity period of 3 years for core business level, a basic validity period of 2 years for important business level, and a basic validity period of 1 year for general business level. This basic standard ensures that the more critical the business, the more sufficient the initial validity period, reducing the impact of frequent updates on core business; processing each certificate to be updated according to the task queue order; starting from the head of the queue, extracting the business criticality level of the certificate to be updated and the key configuration information of the original certificate, such as key algorithm type, key length, and signature algorithm type. For example, extracting the business criticality level of certificate C from the first task node of the queue as core business level, and the original key configuration as ECC 256-bit algorithm and SHA384withECC signature algorithm.

[0125] From the second node, the business criticality level of certificate A is extracted as core business level, and the original key configuration is RSA 2048-bit algorithm with SHA256 with RSA signature algorithm. After determining the basic validity period based on the business criticality level of the certificate to be updated, no additional adjustments are needed. If there are special business needs later, the time can be increased or decreased based on the basic validity period, but this time it is executed according to the basic standard, and the basic validity period is directly used as the validity period of the new certificate. For example, for core business level certificates C and A, the new certificate validity period is set to 3 years; if a certificate to be updated is of important business level, the new certificate validity period is set to 2 years; for general business level certificates, the new certificate validity period is set to... Set the validity period to 1 year; fill in the issuing authority information of the new certificate, which should be consistent with the original certificate; certificate identifier, i.e., generate a new unique serial number; key algorithm and length, which should be consistent with the original certificate or adjusted according to industry upgrade standards, such as upgrading the original RSA 1024-bit to RSA 2048-bit; signature algorithm, which should be consistent with the original certificate; set the start effective time of the new certificate to the current time, and the end expiration time to the current time plus the newly determined validity period, such as the current time being May 20, 2024, the validity period being 3 years, and the end expiration time being May 20, 2027; after generating the new certificate, digitally sign the certificate to ensure the integrity and authority of the certificate, and complete the generation of a new certificate for a single certificate.

[0126] Step 702: Distribute the new digital certificate to the corresponding target server through a secure transmission channel, and verify the validity and compatibility of the new certificate after distribution; update the certificate status information in the certificate management database, record the certificate update time and update operation log, and complete the certificate update process. Specifically, this includes: querying the target server IP address or domain name corresponding to the certificate to be updated from the certificate management records; using HTTPS protocol or a dedicated encrypted transmission channel for transmission, such as SSL / TLS-based file transfer, to ensure that the certificate data is not stolen or tampered with during transmission. For example, if the target server address corresponding to certificate C is found to be 192.168.1.100, HTTPS protocol is used for transmission; if the target server address corresponding to certificate A is 192.168.1.200, a dedicated encrypted channel is used for transmission. The generated new certificate file, such as PEM or DER format, is sent to the specified directory of the target server through the determined secure transmission channel. After transmission is completed, a transmission success signal is sent back to the distribution system. If transmission fails, such as due to network interruption, transmission is re-initiated until successful.

[0127] To verify the validity of the new certificate, perform the verification operation on the target server. First, check the digital signature of the new certificate by verifying its legitimacy using the certificate authority's public key to ensure the certificate has not been tampered with. Second, check the validity period of the new certificate, confirming that the start effective time is earlier than the current time, the expiration time is later than the current time, and the validity period matches the preset new validity period. Third, check the certificate subject information, such as the issuing authority and certificate identifier, to ensure they are correct. If all three checks pass, the new certificate is valid. If any check fails, the new certificate needs to be regenerated and redistributed. Start application services that depend on the certificate on the target server, such as web services and database services, and observe whether the services can load the new certificate normally and establish a secure connection. For example, access the web service through a browser to check if the HTTPS logo is displayed correctly. Simultaneously check the service logs to confirm there are no compatibility errors such as certificate format errors or unsupported algorithms. If the service runs normally without errors, the new certificate is compatible. If compatibility issues exist, the configuration of the new certificate needs to be adjusted according to the server environment, such as changing the supported signature algorithm, and then regenerating and redistributing the certificate.

[0128] Update the certificate status information in the certificate management database. Log in to the certificate management database, locate the record corresponding to the certificate to be updated (the original certificate), and change the original certificate's status from valid or pending update to expired (if the original certificate has expired) or replaced (if the original certificate has not expired). Simultaneously, add a new record for the new certificate in the database, filling in the new certificate's identifier, issuing authority, validity period, key configuration, target server address, and valid status. Ensure that the new certificate record is bound to the original certificate record via the update association ID for easy tracking of update history. In the new certificate's database record, enter the update time field as the time of the current distribution verification, accurate to the second, such as May 20, 2024, 15:00. At 30 minutes and 22 seconds; in the original certificate record, fill in the expiration time field as the start time of the new certificate, specifying the time node when the original certificate was replaced. Add a new log record in the operation log system, including the operation time (consistent with the update time), operation type (certificate update), operator (account executing the update task), original certificate identifier, new certificate identifier, target server address, update result (success or failure, here it is success), and verification result (validity qualified, compatibility qualified). The log record must be permanently saved. After completing the database update and log record, the update process for a single certificate ends. Continue processing the next certificate to be updated according to the task queue order until all queue tasks are completed.

[0129] This embodiment prioritizes updating high-risk, soon-to-expire certificates by sorting them by risk level and timeliness through a task queue. This prevents security incidents caused by untimely updates of high-risk certificates due to disordered processing, improving the timeliness and targeting of risk response and meeting the urgent needs of digital certificate risk management. The validity period of new certificates is adjusted based on business criticality levels, giving core business certificates a longer validity period and reducing frequent interference with core business operations. Simultaneously, the update frequency of general business certificates is balanced, taking into account both business stability and security update requirements. A secure transmission channel prevents data leakage during distribution, and validity and compatibility verification ensures that new certificates can be used normally and are compatible with the server environment, reducing the probability of service failures after updates and ensuring the continuous and stable operation of business systems. This addresses the problem of excessive distribution and insufficient verification during updates.

[0130] like Figure 2 As shown, embodiments of the present invention also provide a digital certificate expiration risk monitoring and assessment system based on a large model, comprising:

[0131] The data acquisition module is used to obtain a set of secure communication protocol digital certificates through the target server management interface, extract the attributes of each digital certificate, standardize the attributes, and generate a structured certificate dataset.

[0132] The indicator generation module is used to input the structured certificate dataset into a pre-trained large model based on the transformer architecture, extract the feature representation of certificate expiration risk, analyze the certificate risk features, and obtain three risk indicators including remaining validity period, security strength, and business criticality.

[0133] The framework construction module is used to reconstruct the three risk indicators spatially, establish a risk assessment framework with three assessment dimensions, each assessment dimension corresponds to a risk indicator, and determine the core area of ​​feature distribution in the three assessment dimensions, including the feature extreme value area and the feature density concentration area.

[0134] The parameter generation module is used to map the feature representation of certificate expiration risk to various evaluation dimensions, and generate risk weight adjustment parameters based on the degree of clustering and dispersion of the feature representation.

[0135] The optimization calculation module is used to perform weighted optimization calculations on three risk indicators using core area data and risk weight adjustment parameters to obtain optimized risk assessment results.

[0136] The report generation module is used to identify digital certificates that are about to expire within a preset time range based on the optimized risk assessment results, and to classify them into multiple levels of risk according to the remaining validity time and business importance, and generate an assessment report with risk level labels.

[0137] The certificate update module is used to trigger the certificate update mechanism based on the assessment report, generate new certificates in order of risk level priority, and distribute them to the target server.

[0138] It should be noted that this system is a system corresponding to the above method. All implementation methods in the above method embodiments are applicable to this embodiment and can achieve the same technical effect.

[0139] Embodiments of the present invention also provide a digital certificate expiration risk monitoring and assessment device based on a large model, comprising: a processor and a memory storing a computer program, wherein the computer program, when run by the processor, executes the method described above. All implementations in the above method embodiments are applicable to this embodiment and can achieve the same technical effect.

[0140] The digital certificate data collection, processing, and evaluation process described in this invention only targets the legally authorized digital certificate attribute information (such as issuing authority, validity period, key configuration, etc.) of the target server, and does not involve user personal identity information, transaction details, or other privacy data. All data collection must comply with relevant laws and regulations and obtain legal authorization from the data owner. In this invention's technical solution, the storage, transmission, and model training of the structured certificate dataset must employ security measures such as encryption and access control to prevent data leakage, tampering, or misuse. Historical data used in pre-training large models must undergo anonymization processing to remove any sensitive identification information that can be associated with a specific user or institution. This invention only provides a technical method for monitoring and evaluating the risk of digital certificate expiration and does not assume legal liability or liability for damages arising from data providers not obtaining legal authorization, data processing violating privacy protection regulations, or third parties illegally obtaining or using related data. For actual systems built based on this invention's technical solution, the operator must separately formulate and publicize a complete privacy protection plan according to the specific application scenario to ensure users or data subjects' right to know, query, and correct data processing, and fulfill the obligation to inform about privacy protection.

[0141] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A large model-based digital certificate expiration risk monitoring and evaluation method, characterized in that, The method comprises: Step S1, obtaining a set of security communication protocol digital certificates through a management interface of a target server, and extracting attributes of each digital certificate; standardizing the digital certificate attributes to generate a structured certificate dataset; Step S2, inputting the structured certificate dataset into a pre-trained large model based on a transformer architecture, extracting a feature representation of a certificate expiration risk, and analyzing the certificate risk features to obtain three risk indicators including a remaining validity period, a security strength, and a business criticality; Step S3, reconstructing the three risk indicators in a spatial dimension to establish a risk assessment framework comprising three evaluation dimensions, each evaluation dimension corresponding to a risk indicator, and determining a core area of the feature distribution in the three evaluation dimensions, including a feature extreme area and a feature density concentrated area; Step S4, mapping the feature representation of the certificate expiration risk to each evaluation dimension, and generating a risk weight adjustment parameter according to the aggregation degree and dispersion degree of the feature representation; Step S5, using the core area data and the risk weight adjustment parameter to perform weighted optimization calculation on the three risk indicators to obtain an optimized risk assessment result; Step S6, identifying digital certificates that will expire within a preset time range according to the optimized risk assessment result, and performing multi-level risk classification according to the remaining validity time and the business importance to generate an evaluation report with a risk level identifier; Step S7, triggering a certificate update mechanism according to the evaluation report, generating new certificates according to the risk level priority order, and distributing the new certificates to the target server.

2. The large model-based digital certificate expiration risk monitoring and assessment method according to claim 1, characterized in that, The step S1 comprises: Step 100, collecting a set of security communication protocol digital certificates deployed in a target server through a management interface, and extracting the issuing authority attribute, the validity period attribute, and the key configuration attribute of each digital certificate; Step 101, standardizing the digital certificate attributes, including converting the certificate validity period into a unified time format and converting the key configuration attribute into a standardized parameter representation, to obtain standardized digital certificate attributes; Step 102, organizing the standardized digital certificate attributes according to a predefined data structure to generate a structured certificate dataset containing all standardized digital certificate attributes.

3. The large model-based digital certificate expiration risk monitoring and assessment method according to claim 2, characterized in that, The step S2 comprises: Step 200, inputting the structured certificate dataset into a pre-trained large model based on a transformer architecture, and encoding the digital certificate attributes through a multi-layer self-attention mechanism to generate a high-dimensional feature representation vector for each digital certificate; Step 201, performing deep semantic analysis on the high-dimensional feature representation vector to identify potential patterns related to the certificate expiration risk, and separating time sequence features representing the remaining validity period, configuration features representing the key security strength, and context association features representing the business criticality from the potential patterns; Step 202, normalizing and quantifying the time sequence features, the configuration features, and the context association features respectively to obtain continuous-valued remaining validity period indicators, security strength indicators, and business criticality indicators, which together constitute the three risk indicators.

4. The large model-based digital certificate expiration risk monitoring and assessment method according to claim 3, characterized in that, The step S3 comprises: Step 300, with the remaining validity period index, the security strength index and the business criticality index as three orthogonal coordinate axes, a three-dimensional risk assessment space is constructed, and each risk index corresponds to an evaluation dimension in the three-dimensional risk assessment space; Step 301, based on historical certificate data, the characteristic extreme value region is determined on each evaluation dimension; the historical certificate data includes three risk index data of expired digital certificates and unexpired digital certificates; the characteristic extreme value region includes a high-risk extreme value region and a low-risk extreme value region; the high-risk extreme value region corresponds to a numerical range in which the remaining validity period index is less than a first preset threshold, the security strength index is less than a second preset threshold, or the business criticality index is greater than or equal to a third preset threshold; the low-risk extreme value region corresponds to a numerical range in which the remaining validity period index is greater than or equal to a fourth preset threshold, the security strength index is greater than or equal to a fifth preset threshold, or the business criticality index is less than a sixth preset threshold; Step 302, statistical analysis is performed on the risk index numerical distribution on each evaluation dimension, and a characteristic density concentration region on each evaluation dimension is identified based on the statistical distribution characteristics in the historical data; Step 303, the distribution ranges of the characteristic extreme value region and the characteristic density concentration region are integrated to form a core region definition of each evaluation dimension.

5. The large model-based digital certificate expiration risk monitoring and assessment method according to claim 4, characterized in that, The step S4 includes: Step 400, projecting the characteristics of the certificate expiration risk onto the three evaluation dimensions of the three-dimensional risk assessment space to obtain the characteristic value distribution on each evaluation dimension; Step 401, based on the characteristic value distribution on each evaluation dimension, calculating the standard deviation of the characteristic value as a dispersion degree index, and calculating the kurtosis coefficient of the characteristic value as an aggregation degree index; Step 402, generating a risk weight adjustment parameter for each evaluation dimension according to the ratio of the aggregation degree index to the dispersion degree index on each evaluation dimension.

6. The large model-based digital certificate expiration risk monitoring and assessment method according to claim 5, characterized in that, The step S5 includes: Step 500, according to the core region definition, calculating the geometric distance between the center point of the characteristic value distribution on each evaluation dimension and the center point of the corresponding core region, and generating a position adjustment coefficient based on the geometric distance; Step 501, weighting and calculating the risk weight adjustment parameter and the position adjustment coefficient of each evaluation dimension to obtain a comprehensive weight coefficient of each evaluation dimension; Step 502, using the comprehensive weight coefficient of each evaluation dimension to perform weighted summation on the corresponding risk index to calculate a comprehensive risk assessment value; Step 503, performing normalization processing on the comprehensive risk assessment value to obtain an optimized risk assessment result with a value range of 0 to 1.

7. The large model-based digital certificate expiration risk monitoring and assessment method according to claim 6, characterized in that, The step S6 includes: Step 600, according to the optimized risk assessment result, screening digital certificates with an optimized risk assessment result greater than a preset risk threshold as a high-risk certificate set to be processed; Step 601, for each digital certificate in the high-risk certificate set, extracting the remaining validity period index and the business criticality index, dividing the certificate into four time efficiency levels according to the size of the remaining validity period index, and dividing the certificate into three business levels according to the size of the business criticality index; In step 602, according to the time limit level and the service level, a multi-level classification matrix is used to evaluate the comprehensive risk level of each high-risk certificate, and a structured evaluation report containing the certificate identifier, risk level, validity period state and service importance is generated; a visual risk level identifier is added to each high-risk certificate in the evaluation report, and the high-risk certificates are sorted in descending order of risk level.

8. The large model-based digital certificate expiration risk monitoring and assessment method according to claim 7, characterized in that, The step S7 comprises: In step 700, the risk level information in the evaluation report is parsed, and a certificate update task queue is generated in descending order of risk level; In step 701, according to the order in the certificate update task queue, a new digital certificate is generated for each certificate to be updated, and the validity period of the new digital certificate is adjusted based on the service criticality level of the original certificate; In step 702, the new digital certificate is distributed to the corresponding target server through a secure transmission channel, and the validity and compatibility of the new certificate are verified after the certificate distribution is completed; the certificate state information in the certificate management database is updated, the certificate update time and update operation log are recorded, and the certificate update process is completed.

9. A large model-based digital certificate expiration risk monitoring and assessment system, the system implements the method as claimed in any one of claims 1 to 8, characterized in that, Comprise: A data acquisition module is configured to obtain a set of secure communication protocol digital certificates through a target server management interface, extract attributes of each digital certificate, and perform standardized processing on the attributes to generate a structured certificate dataset; An index generation module is configured to input the structured certificate dataset into a pre-trained large model based on a transformer architecture, extract feature representations of certificate expiration risks, and analyze certificate risk features to obtain three risk indexes including remaining validity period, security strength and service criticality; A framework construction module is configured to reconstruct the three risk indexes in spatial dimensions to establish a risk evaluation framework comprising three evaluation dimensions, each evaluation dimension corresponding to one risk index, and determining a core area of feature distribution in each of the three evaluation dimensions, including a feature extreme value area and a feature density concentration area; A parameter generation module is configured to map the feature representations of the certificate expiration risks to each evaluation dimension, and generate risk weight adjustment parameters according to the aggregation degree and dispersion degree of the feature representations; An optimization calculation module is configured to use core area data and risk weight adjustment parameters to perform weighted optimization calculation on the three risk indexes to obtain an optimized risk evaluation result; A report generation module is configured to identify digital certificates that will expire within a preset time range according to the optimized risk evaluation result, perform multi-level risk classification according to the remaining validity time and service importance, and generate an evaluation report with risk level identifiers; A certificate update module is configured to trigger a certificate update mechanism according to the evaluation report, generate new certificates according to the risk level priority order, and distribute the new certificates to target servers.

10. A large model-based digital certificate expiration risk monitoring and assessment device, characterized in that, Comprise: One or more processors; A storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, so that the one or more processors implement the method of any one of claims 1 to 8. Comprise: One or more processors; A storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, so that the one or more processors implement the method of any one of claims 1 to 8.

Images