A method and system for visualizing dynamic analysis of financial data

Abstract

The application discloses a visual financial data dynamic analysis method and system, and relates to the technical field of data analysis.The method further calculates response strategy strength R2 after identifying and preliminarily judging the risk partition of exposure index R1 of single access behavior, and divides the access behavior into a path reinforcement strategy rule set according to the response strategy strength R2.Each strategy rule set corresponds to different access reinforcement control contents, such as end-to-end encryption mode switching, binding authentication mechanism starting, access permission automatic degradation, and access data delay decoupling, etc.The mechanism enables dynamic selection of reinforcement response schemes according to the current behavior, path and environmental factors of the visitor, thereby improving the protection accuracy and sensitivity of high-risk access paths, avoiding resource waste caused by excessive reinforcement of low-risk access, and realizing adaptive matching and on-demand configuration between strategies and risks.

Description

Technical Field

[0001] This invention relates to the field of data analysis technology, specifically to a method and system for dynamic analysis of visualized financial data. Background Technology

[0002] With the widespread deployment of enterprise information systems in cloud platforms, hybrid office environments, and remote access scenarios, financial data is gradually evolving into dynamic data assets accessed concurrently across terminals, paths, and roles. In this context, a single access action may lead to potential data exposure during the access process due to complex access paths, unstable network conditions, diverse device environments, or inconsistent encryption configurations. How to assess the intensity of financial data exposure on the network in real time, quantitatively, and visually during each access has become a crucial research direction for ensuring the security of core enterprise digital assets.

[0003] Currently, in visualized financial systems, monitoring of financial data access is mostly focused on the access operation behavior layer, such as who accessed what and how frequently. However, there is a lack of effective means to detect whether the network path itself poses an exposure risk during the access process. Common methods, such as access log auditing or static permission checks, can only determine whether the access is legal and record the access operation itself, but cannot reveal the real-time exposure risks that may arise in the access channel due to factors such as insecure network paths, degraded transmission environments, incomplete path encryption, or untrusted access sources. This prevents the management system from adjusting access policies or making security response decisions based on the dynamic network environment, and further prevents the real-time and intuitive visualization of potential risks on the financial layer.

[0004] The aforementioned problems arise primarily from the existing system's architecture, which decouples access control from network security. It fails to incorporate the security posture of access data paths into real-time visualization analysis and management, and lacks integrated modeling and risk index calculation for multi-source heterogeneous risk factors such as access environment parameters, encryption status, and path node complexity. This flawed mechanism directly leads to the following security vulnerabilities: First, high-risk users may bypass the normal trust identification system through low-encryption links, accessing sensitive data without warning. Second, the system struggles to promptly identify network security signals such as abnormal path aggregation and data exposure trend aggregation, resulting in data exposure during access without early warning. Third, in complex and changing network environments, such as remote work and mobile device access, traditional static analysis cannot meet the demands for rapid response, thus impacting the overall defense quality and risk management capabilities of the financial data system. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a method and system for dynamic analysis of visualized financial data, solving the problems mentioned in the background section.

[0006] To achieve the above objectives, the present invention provides the following technical solution, comprising the following steps:

[0007] S1. By setting up a detection program in the visual financial cloud platform, network access data of each financial data access record is collected in real time, and the network access data is preprocessed to obtain a standardized dataset.

[0008] S2. Based on the standardized dataset, calculate and output the exposure index R1, set the exposure risk interval threshold and conduct a preliminary comparison and evaluation with the exposure index R1, and then trigger the path reinforcement mechanism based on the preliminary comparison and evaluation results.

[0009] S3. After triggering the path reinforcement mechanism, calculate and output the response strategy strength R2 based on the exposure index R1 to measure the original risk score of the current visitor.

[0010] S4. Divide the path reinforcement strategy rule set into different sets according to the response strategy strength R2, and execute relevant control content according to the different path reinforcement strategy rule sets;

[0011] S5. Based on the obtained exposure index R1 and response strategy intensity R2, perform a summary calculation and output the summary result evaluation function R3, and set a comprehensive evaluation threshold Rth for a second comparison evaluation to determine the rationality of the current response resource investment.

[0012] Preferably, S1 includes S11 and S12;

[0013] S11. Set up a monitoring program in the visual financial cloud platform to monitor the network access data of users accessing each visual financial data access record in real time;

[0014] The network access data includes the source IP reputation value Esrc, network quality degradation factor Pqos, user behavior deviation degree Tact, financial data sensitivity Nsen, number of exposed intermediate routing nodes Vpath, and encryption integrity factor Wcrypto.

[0015] S12. Preprocess the acquired network access data to obtain a standardized dataset;

[0016] The preprocessing includes missing value handling, validity verification, and normalization.

[0017] The missing value handling and validity verification are achieved by performing validity boundary verification on all network access data and processing invalid data.

[0018] The legality boundary verification is performed by eliminating access source IP reputation value Esrc, user behavior deviation degree Tact, financial data sensitivity Nsen, and encryption integrity factor Wcrypto that do not belong to [0, 1], and then using the historical average of the current parameters to complete them;

[0019] At the same time, data with network quality degradation factor Pqos≤0 and routing intermediate node exposure number Vpath≤0 are removed and filled with the default minimum value;

[0020] The normalization process involves using the Min-Max normalization method to eliminate the influence of units in the network access data after handling missing values ​​and validating its validity, thereby obtaining a standardized dataset.

[0021] Preferably, S2 includes S21 and S22;

[0022] S21. Calculate and output the exposure index R1 based on the standardized dataset to measure the exposure risk intensity of a single financial data access behavior;

[0023] The exposure index R1 is calculated and output using the following algorithm formula;

[0024] ;

[0025] In the formula, log represents the logarithmic function.

[0026] Preferably, in step S22, the statistical distribution of the exposure index R1 for each historical visit is extracted, and an exposure risk interval threshold is set based on the quantile of the statistical distribution of the exposure index R1. The exposure risk interval threshold includes a first exposure risk threshold F1 and a second exposure risk threshold F2, wherein the first exposure risk threshold F1 is taken as the 50th quantile of the statistical distribution of the exposure index R1, and the second exposure risk threshold F2 is taken as the 85th quantile of the statistical distribution of the exposure index R1. That is, the first exposure risk threshold F1 is the warning boundary, and the second exposure risk threshold F2 is the danger boundary.

[0027] The data exposure of a single financial data access behavior is determined by comparing the real-time exposure index R1 with the exposure risk interval threshold. Based on the preliminary comparison and assessment results, a trigger path reinforcement mechanism is implemented. The specific assessment content is as follows:

[0028] When the exposure index R1 is less than the first exposure risk threshold F1, it means that there is no exposure risk for the current visitor accessing the visualized financial data, and no action is required to allow normal access.

[0029] When the first exposure risk threshold F1 ≤ exposure index R1 < second exposure risk threshold F2, it indicates that there is an anomaly in the current visitor's access to the visualized financial data. At this time, a yellow triangle warning icon is overlaid on the visualized financial data layer, and the standardized dataset of the current visitor is recorded in the security log pool. After 5 minutes, the current visitor's exposure index R1 is re-analyzed, and a second preliminary comparison assessment is performed. If there is still an anomaly in the second assessment, the warning is skipped and the current visitor's access is restricted, while the path reinforcement mechanism is triggered.

[0030] When the exposure index R1 is greater than or equal to the second exposure risk threshold F2, the current visitor's access is immediately restricted, and the path reinforcement mechanism is directly triggered.

[0031] Preferably, S3 includes S31;

[0032] S31. After triggering the path hardening mechanism, based on the obtained exposure index R1, combined with the user behavior deviation Tact, the number of exposed intermediate nodes Vpath and the encryption integrity factor Wcrypto in the standard dataset, the response strategy strength R2 is calculated and output to measure the original risk score of the current visitor.

[0033] The response strategy strength R2 is calculated and output using the following algorithm formula;

[0034] ;

[0035] In the formula, e represents an exponential function. This represents the global control coefficient, used to adjust the dimension of the response intensity output by the entire formula. The specific value is set by the user and is dimensionless.

[0036] Preferably, S4 includes S41 and S42;

[0037] S41. Based on the response strategy strength R2 of the current visitor, the path reinforcement strategy rule set is combined and divided into a path reinforcement strategy rule set, which includes RSP-A, RSP-B, RSP-C and RSP-D, and is combined and divided in the following way;

[0038] When the response strategy strength R2∈[6.0,7.5], it is classified as RSP-A;

[0039] When the response strategy strength R2∈[7.5,8.5], it is classified as RSP-B;

[0040] When the response strategy strength R2∈[8.5,9.8], it is classified as RSP-C;

[0041] When any two types of path hardening strategy rules are met and the response strategy strength R2 ≥ 9.8, it is classified as RSP-D.

[0042] Preferably, S42, based on the divided path reinforcement strategy rule set, execute relevant control content to reinforce the access path of the current visualized financial data. The specific relevant control content is as follows;

[0043] When classified as RSP-A, switch the access interface to end-to-end encryption mode, optimize the access path, retain only the 2-hop path, and disable the load balancing gateway.

[0044] When classified as RSP-B, device binding authentication is initiated, binding the fingerprint of the hardware and the visual financial data platform to add an additional access verification mechanism.

[0045] When classified as RSP-C, access permissions are automatically downgraded to read-only mode and a second verification code is required.

[0046] When classified as RSP-D, a temporary access buffer is enabled. Raw financial data is not read directly. Financial data operations are synchronously written to the access log 5 minutes after execution and uploaded to the security monitoring system for manual review.

[0047] Preferably, S5 includes S51 and S52;

[0048] S51. After the path reinforcement mechanism is completed, recalculate the exposure index R1 and response strategy strength R2 of all visitors, and sum them up to obtain the summary calculation output summary result evaluation function R3, and comprehensively measure the response effect of the path reinforcement mechanism.

[0049] The summary result evaluation function R3 is calculated and output using the following algorithm formula;

[0050] ;

[0051] In the formula, n represents the total number of access records within the statistical period, and R1 i R² represents the exposure index of the i-th access request. i This indicates the strength of the response policy for the i-th access request.

[0052] Preferably, S52, based on the critical point of the user's security defense needs, a comprehensive evaluation threshold Rth is set, and the real-time acquired comprehensive evaluation threshold Rth is compared and evaluated with the summary result evaluation function R3. The comprehensive analysis is performed on the current security status and resource utilization efficiency within the entire time window after the path hardening mechanism is completed. The specific evaluation content is as follows.

[0053] When the summarization result evaluation function R3 < the comprehensive evaluation threshold Rth, it indicates that the current path reinforcement mechanism is reasonable and the existing strategy should be maintained.

[0054] When the summarization result evaluation function R3 is greater than or equal to the comprehensive evaluation threshold Rth, it indicates that the current path reinforcement mechanism is unreasonable. At this time, a red warning is generated, prompting the operation and maintenance personnel to reconstruct the path reinforcement strategy rule set.

[0055] A visual financial data dynamic analysis system includes an access data detection and processing module, an exposure analysis module, a response strategy analysis module, a path reinforcement strategy execution module, and a comprehensive response analysis module.

[0056] The access data detection and processing module collects network access data for each financial data access record in real time by setting up a detection program in the visualized financial cloud platform, and preprocesses the network access data to obtain a standardized dataset.

[0057] The exposure analysis module calculates and outputs the exposure index R1 based on a standardized dataset, sets an exposure risk interval threshold and conducts a preliminary comparison and evaluation with the exposure index R1, and then triggers a path reinforcement mechanism based on the preliminary comparison and evaluation results.

[0058] The response strategy analysis module calculates and outputs the response strategy strength R2 based on the exposure index R1 after the trigger path reinforcement mechanism is implemented, thereby measuring the original risk score of the current visitor.

[0059] The path reinforcement strategy execution module divides the path reinforcement strategy into different sets of rules based on the response strategy strength R2, and executes relevant control content according to the different sets of path reinforcement strategy rules.

[0060] The comprehensive response analysis module performs a summary calculation based on the obtained exposure index R1 and response strategy intensity R2, outputs a summary result evaluation function R3, and sets a comprehensive evaluation threshold Rth for secondary comparison evaluation to determine the rationality of the current response resource investment.

[0061] This invention provides a method and system for dynamic analysis of visualized financial data. It has the following beneficial effects:

[0062] (1) This method sets up a monitoring program in the visualized financial cloud platform to collect the source IP reputation value Esrc, network quality attenuation factor Pqos, user behavior deviation degree Tact, financial data sensitivity Nsen, number of exposed intermediate nodes Vpath, and encryption integrity factor Wcrypto for each access record. A standardized dataset is constructed, and an exposure index R1 is output by combining a nonlinear risk weighting algorithm. This allows for real-time quantification of the network exposure risk intensity of the access when it occurs. At the same time, the R1 output result is compared and evaluated in real time with the set risk interval threshold. The evaluation results are presented on the visualized financial chart as an early warning icon and trigger the path reinforcement mechanism, which effectively improves the ability to identify high-risk access paths and the proactive response, and enhances the visual protection capability of financial data in the access path.

[0063] (2) This method, after identifying the exposure index R1 and making a preliminary risk zoning judgment for a single access behavior, further calculates the response strategy strength R2, and classifies the access behavior into a path hardening strategy rule set based on the response strategy strength R2. Each strategy rule set corresponds to different access hardening control content, such as end-to-end encryption mode switching, binding authentication mechanism activation, automatic access permission degradation, and latency decoupling of access data. This mechanism enables the dynamic selection of hardening response schemes based on the visitor's current behavior, path, and environmental factors, thereby improving the protection accuracy and sensitivity of high-risk access paths, while avoiding excessive hardening of low-risk access and resulting in resource waste, and realizing adaptive matching and on-demand configuration between strategy and risk.

[0064] (3) This method constructs a summary result evaluation function R3 by weighting and summarizing the exposure index R1 and response strategy intensity R2 of all visitors within the statistical period. This function is used to quantify the overall effectiveness of the system's protection resource investment within a certain time window. By comparing the summary result evaluation function R3 with the comprehensive evaluation threshold Rth set by the user, the rationality of the current path reinforcement mechanism is determined. If the summary result evaluation function R3 is lower than the threshold, the existing strategy is maintained; if the summary result evaluation function R3 is higher than the threshold, a red warning is triggered, prompting the reconstruction of the path reinforcement strategy rule set. This mechanism constructs a complete technical closed-loop path from access risk identification, strategy control execution to overall protection result evaluation, enabling the system to have self-diagnostic capabilities and strategy self-optimization capabilities under long-term operation, ensuring that the platform can still operate stably, securely, and efficiently when facing complex dynamic access behaviors. Attached Figure Description

[0065] Figure 1 This is a schematic diagram illustrating the steps of a method for dynamic analysis of visualized financial data according to the present invention.

[0066] Figure 2This is a schematic diagram of the process of a visual financial data dynamic analysis system according to the present invention;

[0067] Figure 3 This is a dynamic radar chart of network access data according to the present invention. Detailed Implementation

[0068] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0069] Example 1

[0070] Please see Figure 1 and Figure 3 This invention provides a method for dynamic analysis of visualized financial data. To achieve the above objectives, this invention employs the following technical solution, comprising the following steps:

[0071] S1. By setting up a detection program in the visual financial cloud platform, network access data of each financial data access record is collected in real time, and the network access data is preprocessed to obtain a standardized dataset.

[0072] S2. Based on the standardized dataset, calculate and output the exposure index R1, set the exposure risk interval threshold and conduct a preliminary comparison and evaluation with the exposure index R1, and then trigger the path reinforcement mechanism based on the preliminary comparison and evaluation results.

[0073] S3. After triggering the path reinforcement mechanism, calculate and output the response strategy strength R2 based on the exposure index R1 to measure the original risk score of the current visitor.

[0074] S4. Divide the path reinforcement strategy rule set into different sets according to the response strategy strength R2, and execute relevant control content according to the different path reinforcement strategy rule sets;

[0075] S5. Based on the obtained exposure index R1 and response strategy intensity R2, perform a summary calculation and output the summary result evaluation function R3, and set a comprehensive evaluation threshold Rth for a second comparison evaluation to determine the rationality of the current response resource investment.

[0076] In this embodiment, the method first deploys a network access monitoring program on a visualized financial cloud platform in step S1 to collect and normalize the six types of network access data involved in each financial data access record in real time, constructing a standardized dataset. In step S2, the exposure index R1 of a single access behavior is output by integrating a multi-factor nonlinear weighted risk modeling algorithm, and a real-time preliminary risk partitioning assessment is performed by combining the exposure risk interval threshold set based on historical access distribution, triggering a path hardening mechanism under medium-to-high risk conditions. In step S3, the response strategy strength R2 is further calculated based on the exposure index R1 and key parameters in the standard dataset to measure the strength of defense control that the current visitor needs to implement. In step S4, the system dynamically divides the path hardening strategy rule set according to the R2 value and implements diverse security control strategies such as end-to-end encryption, permission downgrading, and device binding on the access path. Finally, in step S5, the summary result evaluation function R3 is calculated by multiplying the exposure index R1 and the response strategy strength R2 record by record, and compared with the comprehensive evaluation threshold Rth set by the user, realizing the full-cycle effectiveness feedback and strategy self-regulation of the path hardening mechanism. This invention, through the coordinated implementation of the above steps, achieves accurate identification of potential network exposure risks for each financial data access request without altering the existing hardware architecture. Based on risk levels, it dynamically classifies response levels and adaptively strengthens security policies. Finally, it uses aggregated indicators to conduct a closed-loop evaluation of the rationality of access protection resource investment, thereby achieving the technical goals of improving access security awareness, enhancing policy response accuracy, optimizing resource allocation efficiency, and constructing an intelligent closed-loop data defense system. This method significantly improves the dynamic protection capabilities of enterprise financial data in complex network environments, providing a refined, visualized, and closed-loop controllable innovative security solution for access control of highly sensitive data.

[0077] Example 2

[0078] Please see Figure 1 and Figure 3 Specifically: S1 includes S11 and S12;

[0079] S11. Set up a monitoring program in the visual financial cloud platform to monitor the network access data of users accessing each visual financial data access record in real time;

[0080] Network access data includes the source IP reputation value Esrc, network quality degradation factor Pqos, user behavior deviation Tact, financial data sensitivity Nsen, number of exposed intermediate routing nodes Vpath, and encryption integrity factor Wcrypto;

[0081] The source IP reputation value Esrc is obtained by using an IP detection program to obtain the IP address from the visitor's HTTP request header, using an IP reputation database to query the IP address in real time, and then calling a third-party API to extract the source IP reputation value Esrc.

[0082] The network quality degradation factor Pqos is calculated and output using the Ping command in the network testing program and the packet capture tool Wireshark to obtain the TCP network latency RTT and packet loss rate Db between the client and the visualized financial cloud platform. The specific calculation formula is as follows: RTTmax represents the upper limit of TCP network latency, which can be set by the user according to business needs;

[0083] User behavior deviation score Tact is obtained by setting up JS tracking points on the front-end web page and mobile APP of the visual financial cloud platform to monitor user operation, record the behavior sequence of visitors, analyze the behavior sequence using ELKStack, and calculate the deviation score between the current behavior sequence and the historical normal behavior sequence using clustering analysis algorithm.

[0084] Financial data sensitivity Nsen sets static classification tags for financial data sensitivity in the visual financial cloud platform. When accessed, the static classification tags of the financial data involved in the current request are automatically retrieved and assigned financial data sensitivity Nsen.

[0085] The number of intermediate nodes exposed in the route, Vpath, is recorded using the ICMPTTL tracing tool. It represents the number of intermediate hops that data needs to pass through between the client and the server, i.e., the number of exposure points.

[0086] The encryption integrity factor Wcrypto is obtained by enabling TLShandshakelogging on gateways and proxies and periodically scanning the channel encryption strength using the tool ssllabs-scan.

[0087] S12. Preprocess the acquired network access data to obtain a standardized dataset;

[0088] Preprocessing includes handling missing values, validating data, and normalizing data.

[0089] Missing value handling and validity verification are achieved by performing validity boundary verification on all network access data and processing invalid data.

[0090] The legality boundary verification eliminates access source IP reputation value Esrc, user behavior deviation degree Tact, financial data sensitivity Nsen, and encryption integrity factor Wcrypto that do not belong to [0, 1], and completes them using the historical average of the current parameters;

[0091] At the same time, data with network quality degradation factor Pqos≤0 and routing intermediate node exposure number Vpath≤0 are removed and filled with the default minimum value;

[0092] Normalization is performed by using the Min-Max normalization method to eliminate the influence of units in the network access data after handling missing values ​​and validating its validity, thereby obtaining a standardized dataset.

[0093] In this embodiment, the method, through the joint execution of sub-steps S11 and S12 included in step S1, first sets up a multi-source monitoring program in the visualized financial cloud platform. This program comprehensively collects network access behavior data generated when users access visualized financial data, focusing on six parameters that are representative of the attack surface and correlated with network link status: the access source IP reputation value Esrc, the network quality attenuation factor Pqos, the user behavior deviation Tact, the financial data sensitivity Nsen, the number of exposed intermediate routing nodes Vpath, and the encryption integrity factor Wcrypto. Specifically, the access source reputation value is obtained through a combination of an IP reputation database and a third-party API; network quality indicators such as latency and packet loss rate are obtained using Ping and Wireshark tools; the behavior deviation is dynamically calculated using JS tracking and clustering algorithms; the data sensitivity is extracted through static classification and labeling of access resource calls; the number of exposed paths is quantified by ICMP-TTL tracking; and the encryption integrity factor is obtained from TLS handshake logs and channel encryption scanning. This forms a multi-dimensional, fine-grained, and highly real-time set of access parameters. Subsequently, in sub-step S12, a standardized processing procedure is performed on the collected data. First, non-compliant data is eliminated and missing data is repaired according to historical averages or default minimum values ​​through legality boundary verification and missing value completion mechanisms. Then, the Min-Max normalization method is used to perform dimensionless processing on all valid parameter values ​​to obtain a unified standardized dataset that can be used for subsequent modeling and analysis. Through the implementation of the above S1 step, this invention not only achieves real-time capture of the security characteristics of the entire path of user financial data access, but also ensures the availability of data quality and the consistency of model input through a standardized data processing mechanism. This significantly improves the accuracy and reliability of subsequent algorithm modules such as exposure index R1, response strategy strength R2, and summary result evaluation function R3. Ultimately, it achieves the comprehensive technical goal of "accurate extraction of multi-dimensional security characteristics, quantitative analysis of risk indicators, and support for intelligent prevention and control strategies" for financial data access behavior, providing a solid foundation for building a financial security management and control system with dynamic visualization analysis capabilities and strategy adaptability.

[0094] Example 3

[0095] Please see Figure 1 Specifically: S2 includes S21 and S22;

[0096] S21. Calculate and output the exposure index R1 based on the standardized dataset to measure the exposure risk intensity of a single financial data access behavior;

[0097] The exposure index R1 is calculated and output using the following algorithm formula;

[0098] ;

[0099] In the formula, log represents the logarithmic function;

[0100] This indicates whether the starting point of the visitor's access path is trustworthy. If the visitor has high credibility, such as coming from a registered VPN or encrypted end-to-end connection, the product is close to 1. The remaining 1 minus the product is close to 0, indicating a lower risk.

[0101] If the IP reputation is poor and the encryption is poor, the product is small and the risk compensation factor is large. The square amplification is used to form an exponential risk enhancement mechanism for the combination of poor reputation and poor encryption.

[0102] This indicates abnormal behavior in highly sensitive data domains, meaning a sharp increase in exposure risk. The quadratic expression emphasizes the non-linear impact of deviations to prevent small deviations from being underestimated.

[0103] This indicates that network instability, high latency, and packet loss lead to a non-linear, quadratic increase in the probability of data leakage, suggesting that poor link conditions accelerate the exposure of risks.

[0104] This means that with each additional hop, the chance of data being hijacked increases by one. Using logarithms, it indicates that path risk increases but tends to saturate, with non-linear but limited growth.

[0105] The physical meaning of the formula lies in the risk of financial data exposure, which is the risk that a certain piece of financial information may be abnormally known or misused when it is accessed due to a combination of factors such as access path, behavior, network, and security settings. Identifying and managing it is not only an important part of security protection, but also an important means for corporate compliance, risk control, and digital asset protection.

[0106] S22. Extract the statistical distribution of the exposure index R1 for each historical visit. Set the exposure risk interval threshold based on the quantile of the exposure index R1 statistical distribution. The exposure risk interval threshold includes a first exposure risk threshold F1 and a second exposure risk threshold F2. The first exposure risk threshold F1 is taken as the 50th quantile of the exposure index R1 statistical distribution, and the second exposure risk threshold F2 is taken as the 85th quantile of the exposure index R1 statistical distribution. That is, the first exposure risk threshold F1 is the warning boundary, and the second exposure risk threshold F2 is the danger boundary.

[0107] The data exposure of a single financial data access behavior is determined by comparing the real-time exposure index R1 with the exposure risk interval threshold. Based on the preliminary comparison and assessment results, a trigger path reinforcement mechanism is implemented. The specific assessment content is as follows:

[0108] When the exposure index R1 < the first exposure risk threshold F1, it means that there is no exposure risk for the current visitor to access the visualized financial data, the risk is acceptable, the access source is credible, the path is encrypted and complete, and the behavior is reasonable. At this time, no action is required and the access is allowed normally.

[0109] When the first exposure risk threshold F1 ≤ exposure index R1 < second exposure risk threshold F2, it indicates that the current visitor's access to the visualized financial data is abnormal, that is, there is a certain abnormality, such as slight network degradation, slight deviation of behavior, or sensitive data. At this time, a yellow triangle warning icon is superimposed on the visualized financial data layer, and the standardized dataset of the current visitor is recorded in the security log pool. After 5 minutes, the current visitor's exposure index R1 is re-analyzed, and a second preliminary comparative evaluation is performed. If the abnormality is still present in the second evaluation, the warning is skipped and the current visitor's access is restricted, while the path hardening mechanism is triggered.

[0110] When the exposure index R1 is greater than or equal to the second exposure risk threshold F2, it indicates poor access source, insufficient encryption, complex path, sensitive data, and significant behavioral deviation. At this time, the current visitor's access will be immediately restricted, and the path hardening mechanism will be directly triggered.

[0111] In this embodiment, the method, through the joint execution of sub-steps S21 and S22 in step S2, first constructs an exposure index R1 based on a nonlinear composite risk modeling algorithm after obtaining a standardized network access dataset. This index measures the potential exposure intensity of a single financial data access behavior in the network path. The exposure index R1 formula comprehensively considers multiple dimensions, including the reputation and encryption quality of the access source, behavioral deviations on highly sensitive data, link degradation, and path hop saturation characteristics. It constructs a composite structure combining polynomials and logarithmic functions, achieving exponential amplification of abnormal combination risks and saturation weakening of acceptable behaviors. This fully reflects the changing patterns of data access behavior exposure risks in complex network environments, effectively solving the problems of single-factor judgment failure and insufficient risk sensitivity in traditional methods. In sub-step S22, the full access distribution characteristics of historical exposure index R1 values ​​are further extracted. Dynamic risk interval thresholds are set based on the quantile method, including a first exposure risk threshold F1 (median) as the warning boundary and a second exposure risk threshold F2 as the danger boundary. These are used to perform a preliminary comparative assessment of the real-time exposure index R1 value, quickly determining the risk level of the access behavior. The assessment results employ a three-stage response logic: normal access is granted under low-risk conditions; a visual layer warning is issued and assessment is delayed under medium-risk conditions; and access is directly restricted and subsequent path reinforcement mechanisms are triggered under high-risk conditions, achieving a rapid closed-loop judgment from identification and alarm to control. Through the implementation of step S2, this invention enables real-time quantitative identification and level assessment of the risk intensity of each financial data access record, significantly improving the proactive response and precision of financial data security protection. Furthermore, by combining historical distribution with adaptively setting assessment thresholds, it enhances the adaptability to dynamic risk changes under different network environments, further improving the overall platform's data access risk control capabilities and the level of intelligent strategy scheduling.

[0112] Example 4

[0113] Please see Figure 1 Specifically: S3 includes S31;

[0114] S31. After triggering the path hardening mechanism, based on the obtained exposure index R1, combined with the user behavior deviation Tact, the number of exposed intermediate nodes Vpath and the encryption integrity factor Wcrypto in the standard dataset, the response strategy strength R2 is calculated and output to measure the original risk score of the current visitor.

[0115] The response strategy strength R2 is calculated and output using the following algorithm formula;

[0116] ;

[0117] In the formula, e represents an exponential function. This represents the global control coefficient, used to adjust the dimension of the response intensity output by the entire formula. The specific value is set by the user and is dimensionless.

[0118] The calculation logic and physical meaning of the formula are as follows: First This represents the Sigmoid risk activation function. The Sigmoid is a smooth non-linear activation function that can compress any real number to the (0,1) interval. Here, it is used to map the result of adding the user behavior deviation degree Tact and the number of exposed intermediate nodes Vpath in the route to an activation level. After the two are added together, subtracting 1 is to take the normal level, such as a 2-hop path plus a slight deviation = 1, as the input at point 0, so that the Sigmoid function outputs 0.5 at point 1, which has symmetry and sensitivity.

[0119] This indicates the encryption incompleteness of the current path. If the encryption level is high, the encryption integrity factor Wcrypto approaches 0, which can offset the activation item. If the encryption is poor, it approaches 1, maximizing the risk.

[0120] Finally, everything is handed over to the global control coefficient. Adjustments are made to suit different sensitivity requirements.

[0121] In this embodiment, the method, through the specific execution of S31 in step S3, after triggering the path hardening mechanism, further constructs a comprehensive scoring mechanism for the response strategy strength R2 based on the acquired exposure index R1 and combined with three key parameters closely related to path security and user behavior in the standardized dataset: user behavior deviation Tact, number of exposed intermediate nodes Vpath, and encryption integrity factor Wcrypto. This allows for a more refined quantitative assessment of the original security risk level of the current visitor. The calculation model introduces the nonlinear activation function Sigmoid as the core of risk activation, summing and centering the user behavior deviation Tact and the number of exposed intermediate nodes Vpath. This ensures a sensitive response near normal levels and a rapid increase during abnormal deviations, demonstrating a collaborative risk response capability to "behavioral deviation plus increased hop count." Simultaneously, the encryption integrity factor Wcrypto is introduced as a negative adjustment term to reflect the ability of path encryption integrity to suppress overall risk, naturally suppressing the activation strength of well-encrypted paths, thereby achieving dynamic "compensation weighting" for risk control effectiveness. Furthermore, a global control coefficient is also set. To adapt to the policy sensitivity requirements of different business scenarios, this model has flexible adjustment capabilities and is suitable for various access environments. Ultimately, the output of the response policy strength R2 serves not only as a quantitative indicator of the user access risk level but also as the core basis for subsequent path reinforcement policy rule set division. Through the implementation of step S3, this invention effectively overcomes the problem that traditional methods based on static rules or simple scoring cannot distinguish risk intensity levels, significantly improving the policy response mechanism's ability to accurately perceive and judge high-risk access behaviors.

[0122] Example 5

[0123] Please see Figure 1 Specifically: S4 includes S41 and S42;

[0124] S41. Based on the response strategy strength R2 of the current visitor, the path reinforcement strategy rule set is combined and divided into a path reinforcement strategy rule set, which includes RSP-A, RSP-B, RSP-C and RSP-D, and is combined and divided in the following way;

[0125] When the response strategy strength R2∈[6.0,7.5], it indicates a complex path structure and poor encryption quality, and is classified as RSP-A;

[0126] When the response strategy strength R2∈[7.5,8.5], it indicates that the user behavior is seriously deviated and the source is untrustworthy, and it is classified as RSP-B;

[0127] When the response strategy strength R2∈[8.5,9.8], it indicates that the data is highly sensitive and the network anomaly is significant, and it is classified as RSP-C;

[0128] When any two types of path hardening strategy rules are met and the response strategy strength R2≥9.8, it indicates that multiple dimensions are triggered together, synergistically amplifying the risk, and it is classified as RSP-D.

[0129] S42. Based on the defined path reinforcement strategy rule set, execute relevant control measures to reinforce the access path of the current visualized financial data. The specific relevant control measures are as follows:

[0130] When classified as RSP-A, switch the access interface to end-to-end encryption mode, optimize the access path, retain only the 2-hop path, and disable the load balancing gateway.

[0131] When classified as RSP-B, device binding authentication is initiated, binding the fingerprint of the hardware and the visual financial data platform to add an additional access verification mechanism.

[0132] When classified as RSP-C, access permissions are automatically downgraded to read-only mode and a second verification code is required.

[0133] When classified as RSP-D, a temporary access buffer is enabled. Raw financial data is not read directly. Financial data operations are synchronously written to the access log 5 minutes after execution and uploaded to the security monitoring system for manual review.

[0134] In this embodiment, step S4 of the method establishes a mapping relationship between the response policy strength R2 and the path hardening policy rule set, forming a dynamic path security control mechanism with layered response capabilities. Specifically, step S41 divides the access behavior into four policy levels, RSP-A to RSP-D, based on the output value of the response policy strength R2, achieving gradient control from light protection to deep hardening. Each rule classification considers not only single indicator anomalies but also the composite risks brought about by multi-dimensional indicator interaction anomalies. In particular, RSP-D is used to identify extremely high-risk access requests caused by multi-factor resonance, providing a precise entry point for high-strength protection. In S42, differentiated control operations are performed for each type of path hardening strategy rule set: for example, the RSP-A strategy effectively reduces the path exposure surface by switching the access interface to end-to-end encryption and reducing the number of hops; the RSP-B strategy introduces a dual mechanism of device binding and behavior verification to strengthen identity credibility from the source; the RSP-C strategy restricts the operation permissions of abnormal users through dual protection of read-only permissions and verification codes; and the RSP-D strategy activates the access isolation mechanism, and through temporary buffering and delayed writing, realizes the audit buffering of access behavior in data-sensitive access scenarios, which greatly enhances the transparency and traceability of data access.

[0135] Example 6

[0136] Please see Figure 1 Specifically: S5 includes S51 and S52;

[0137] S51. After the path reinforcement mechanism is completed, recalculate the exposure index R1 and response strategy strength R2 of all visitors, and sum them up to obtain the summary calculation output summary result evaluation function R3, and comprehensively measure the response effect of the path reinforcement mechanism.

[0138] The summary result evaluation function R3 is calculated and output using the following algorithm formula;

[0139] ;

[0140] In the formula, n represents the total number of access records within the statistical period, and R1 i R² represents the exposure index of the i-th access request. i This indicates the strength of the response policy for the i-th access request.

[0141] S52. Based on the critical point of the user's security defense needs, a comprehensive evaluation threshold Rth is set, and the real-time comprehensive evaluation threshold Rth is compared and evaluated with the summary result evaluation function R3. The comprehensive analysis is conducted on the current security status and resource utilization efficiency within the entire time window after the path hardening mechanism is completed. The specific evaluation content is as follows.

[0142] When the summarization result evaluation function R3 < the comprehensive evaluation threshold Rth, it indicates that the current path reinforcement mechanism is reasonable and the existing strategy should be maintained.

[0143] When the summarization result evaluation function R3 is greater than or equal to the comprehensive evaluation threshold Rth, it indicates that the current path reinforcement mechanism is unreasonable. At this time, a red warning is generated, prompting the operation and maintenance personnel to reconstruct the path reinforcement strategy rule set.

[0144] In this embodiment, the method introduces an interactive aggregation of exposure index R1 and response strategy strength R2 to obtain an aggregation result evaluation function R3, constructing a quantifiable security control effectiveness feedback mechanism to achieve closed-loop verification and dynamic optimization of path hardening effects. Specifically, in S51, the aggregation result evaluation function R3 is obtained by multiplying the exposure index R1 and response strategy strength R2 in all access records within the statistical period and taking the average. This evaluation function can comprehensively measure the matching degree between the overall risk intensity of the system and the response resource investment after the protection strategy is implemented, avoiding one-sided and distorted single risk judgment. In S52, the aggregation result evaluation function R3 is compared with the user-preset comprehensive evaluation threshold Rth. If the aggregation result evaluation function R3 < the comprehensive evaluation threshold Rth, it indicates that the overall resource investment of the current path hardening strategy is reasonable and the protection effect is excellent, and no adjustment is needed; if the aggregation result evaluation function R3 ≥ the comprehensive evaluation threshold Rth, it is determined that the strategy execution effect and resource matching degree are poor, the system will generate a red warning prompt, and drive the strategy reconstruction module to guide the optimization and update of the path protection strategy in an automatic or semi-automatic manner.

[0145] Example 7

[0146] Please see Figure 1 and Figure 2 A visual financial data dynamic analysis system includes an access data detection and processing module, an exposure analysis module, a response strategy analysis module, a path reinforcement strategy execution module, and a comprehensive response analysis module.

[0147] The access data detection and processing module collects network access data for each financial data access record in real time by setting up a detection program in the visualized financial cloud platform, and preprocesses the network access data to obtain a standardized dataset.

[0148] The exposure analysis module calculates and outputs the exposure index R1 based on a standardized dataset, sets an exposure risk interval threshold and conducts a preliminary comparison and assessment with the exposure index R1, and then triggers a path reinforcement mechanism based on the preliminary comparison and assessment results.

[0149] The response strategy analysis module calculates and outputs the response strategy strength R2 based on the exposure index R1 after the trigger path reinforcement mechanism is implemented, which measures the original risk score of the current visitor.

[0150] The path reinforcement strategy execution module divides the path reinforcement strategy into different sets of rules based on the response strategy strength R2, and executes relevant control content according to the different sets of path reinforcement strategy rules.

[0151] The comprehensive response analysis module calculates and outputs a summary result evaluation function R3 based on the obtained exposure index R1 and response strategy intensity R2. It also sets a comprehensive evaluation threshold Rth for secondary comparison and evaluation to determine the rationality of the current response resource investment.

[0152] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention.

Claims

1. A method of visualizing dynamic analysis of financial data, characterized by: The method comprises the following steps: S1, by setting a detection program in the visual financial cloud platform, real-time collection of each financial data access record network access data, and preprocessing the network access data to obtain a standardized data set; S1 includes S11 and S12; S11, setting a monitoring program in the visual financial cloud platform, real-time monitoring of user access to each visual financial data access record network access data; The network access data includes access source IP reputation value Esrc, network quality attenuation factor Pqos, user behavior deviation Tact, financial data sensitivity Nsen, route intermediate node exposure number Vpath and encryption integrity factor Wcrypto; S12, preprocessing the obtained network access data to obtain a standardized data set; The preprocessing includes missing value processing, legality verification and normalization processing; The missing value processing and legality verification are performed by legality boundary verification on all network access data, and the illegal data is processed; The legality boundary verification is performed by excluding the access source IP reputation value Esrc, user behavior deviation Tact, financial data sensitivity Nsen and encryption integrity factor Wcrypto not belonging to [0, 1], and using the historical mean of the current parameters to complete; At the same time, the data of network quality attenuation factor Pqos≤0 and route intermediate node exposure number Vpath≤0 are excluded, and the default minimum value is used for completion; The normalization processing is performed by using the Min-Max normalization method to eliminate the dimension effect in the network access data after the missing value processing and legality verification, to obtain a standardized data set; S2, based on the standardized data set, calculating and outputting exposure index R1, and setting exposure risk interval threshold to preliminarily compare and evaluate exposure index R1, and triggering path reinforcement mechanism based on the preliminary comparison and evaluation result; S2 includes S21; S21, based on the standardized data set, calculating and outputting exposure index R1 to measure the exposure risk intensity of single financial data access behavior; The exposure index R1 is calculated and output by the following algorithm formula: ； In the formula, log represents the logarithmic function S3, after triggering the path reinforcement mechanism, based on the exposure index R1, calculating and outputting the response strategy strength R2 to measure the original risk score of the current visitor; S4, according to the response strategy strength R2, dividing into different path reinforcement strategy rule sets, and executing related control content according to different path reinforcement strategy rule sets; S5, based on the obtained exposure index R1 and response strategy strength R2, calculating and outputting the summary result evaluation function R3, setting the comprehensive evaluation threshold Rth for secondary comparison and evaluation, and judging the rationality of the current response resource input.

2. The method of visualizing dynamic analysis of financial data according to claim 1, wherein: S2 also includes S22; S22, extract the exposure index R1 statistical distribution of each access history, set the exposure risk interval threshold according to the quantile of the exposure index R1 statistical distribution, the exposure risk interval threshold includes a first exposure risk threshold F1 and a second exposure risk threshold F2, wherein the first exposure risk threshold F1 takes the 50% quantile of the exposure index R1 statistical distribution, and the second exposure risk threshold F2 takes the 85% quantile of the exposure index R1 statistical distribution, that is, the first exposure risk threshold F1 is a pre-warning boundary, and the second exposure risk threshold F2 is a dangerous boundary; In the preliminary comparative evaluation of the real-time exposure index R1 and the exposure risk interval threshold, the data exposure of the single financial data access behavior is judged, and the trigger path reinforcement mechanism is triggered based on the preliminary comparative evaluation result, and the specific evaluation content is as follows: When the exposure index R1 is less than the first exposure risk threshold F1, it indicates that there is no exposure risk in accessing the visual financial data by the current visitor, and no operation is required for normal release; When the first exposure risk threshold F1 is less than or equal to the exposure index R1 and less than the second exposure risk threshold F2, it indicates that there is an abnormality in accessing the visual financial data by the current visitor, at this time, a yellow triangular pre-warning icon is superimposed in the visual financial data layer, and the standardized data set of the current visitor is recorded in the security log pool, after 5 minutes, the exposure index R1 of the current visitor is reanalyzed, and the preliminary comparative evaluation is performed again, if there is still an abnormality, skip the pre-warning and limit the current visitor to access, and trigger the path reinforcement mechanism; When the exposure index R1 is greater than or equal to the second exposure risk threshold F2, the current visitor is immediately restricted from accessing, and the path reinforcement mechanism is directly triggered.

3. The method of visualizing dynamic analysis of financial data of claim 2, wherein: The S3 includes S31; S31, after triggering the path reinforcement mechanism, the exposure index R1 is obtained, and the user behavior deviation Tact, the number of exposure of the intermediate nodes Vpath and the encryption integrity factor Wcrypto in the standard data set are combined to calculate the response strategy strength R2, and the original risk score of the current visitor is measured; The response strategy strength R2 is calculated and output by the following algorithm formula; ； In the formula, e represents an exponential function, represents a global control coefficient, used to adjust the response intensity dimension of the whole formula output, and the specific value is set by the user, which is dimensionless.

4. The method of visualizing dynamic analysis of financial data of claim 3, wherein: The S4 includes S41; S41, based on the response strategy strength R2 of the current visitor, the path reinforcement strategy rule set is combined and divided, the path reinforcement strategy rule set includes RSP-A, RSP-B, RSP-C and RSP-D, and the combination and division are as follows: When the response strategy strength R2 is in the range of [6.0, 7.5], it is divided into RSP-A; When the response strategy strength R2 is in the range of [7.5, 8.5], it is divided into RSP-B; When the response strategy strength R2 is in the range of [8.5, 9.8], it is divided into RSP-C; When any two types of path reinforcement strategy rules are met and the response strategy strength R2 is greater than or equal to 9.8, it is divided into RSP-D.

5. The method of visualizing dynamic analysis of financial data of claim 4, wherein: The S4 also includes S42; S42, based on the divided path reinforcement strategy rule set, the related control content is executed to reinforce the access path of the current visual financial data, and the specific related control content is as follows: When divided into RSP-A, the access interface is switched to end-to-end encryption mode, and the access path is optimized to only keep a 2-hop path, and the load balancing gateway is disabled; When divided into RSP-B, the device binding authentication is started, the hardware is bound with the visual financial data platform fingerprint, and an additional access verification mechanism is added; When divided into RSP-C, the access permission is automatically downgraded to read-only mode, and secondary verification code verification is performed; When divided into RSP-D, the temporary access buffer is started, the original financial data is not directly read, the financial data operation is executed for 5 minutes, then the access log is synchronized and uploaded to the security monitoring for manual review.

6. The method of visualizing dynamic analysis of financial data of claim 5, wherein: The S5 comprises S51; S51, after the path reinforcement mechanism is executed, the exposure index R1 and the response strategy strength R2 of all accessors are recalculated, and the summary calculation output summary result evaluation function R3 is obtained by summation, and the response effect of the path reinforcement mechanism is comprehensively measured; The summary result evaluation function R3 is calculated by the following algorithm formula; ； In the formula, n represents the total number of access records in a statistical period, R1 i represents the exposure index of the ith access request, R2 i represents the response strategy strength of the ith access request.

7. The method of visualizing dynamic analysis of financial data of claim 6, wherein: The S5 further comprises S52; S52, based on the critical point of the user according to the security defense demand, the comprehensive evaluation threshold Rth is set, and the real-time obtained comprehensive evaluation threshold Rth is compared with the summary result evaluation function R3 for secondary comparison and evaluation, and the current security state and resource use efficiency in the entire time window after the path reinforcement mechanism is executed are comprehensively analyzed, and the specific evaluation content is as follows; When the summary result evaluation function R3 is less than the comprehensive evaluation threshold Rth, it indicates that the current path reinforcement mechanism is reasonable, and the existing strategy is maintained; When the summary result evaluation function R3 is greater than or equal to the comprehensive evaluation threshold Rth, it indicates that the current path reinforcement mechanism is unreasonable, and a red warning is generated to prompt the operation and maintenance personnel to reconstruct the path reinforcement strategy rule set.

8. A visualized financial data dynamic analysis system applied to the visualized financial data dynamic analysis method of any one of claims 1-7, characterized in that: It comprises an access data detection processing module, an exposure analysis module, a response strategy analysis module, a path reinforcement strategy execution module and a comprehensive response analysis module; The access data detection processing module sets a detection program in the visual financial cloud platform, collects network access data of each financial data access record in real time, and pre-processes the network access data to obtain a standardized data set; The exposure analysis module calculates the exposure index R1 based on the standardized data set, compares the exposure risk interval threshold with the exposure index R1 for preliminary comparison and evaluation, and triggers the path reinforcement mechanism based on the preliminary comparison and evaluation result; The response strategy analysis module calculates the response strategy strength R2 based on the exposure index R1 after triggering the path reinforcement mechanism, and measures the original risk score of the current accessor; The path reinforcement strategy execution module divides the response strategy strength R2 into different path reinforcement strategy rule sets according to the response strategy strength R2, and executes related control contents according to different path reinforcement strategy rule sets; The comprehensive response analysis module calculates the summary result evaluation function R3 based on the obtained exposure index R1 and response strategy strength R2, and sets the comprehensive evaluation threshold Rth for secondary comparison and evaluation to judge the rationality of the current response resource input.

Images