Data security dynamic assessment system and protection methods

Abstract

This invention discloses a dynamic data security assessment system and protection method, belonging to the field of information security technology, and is used to solve the problem of dynamic collaborative protection of terminal device access control and behavioral risks. It generates fingerprints based on terminal device characteristics and verifies authorization. Authorized terminal devices input access feature slices into a time-series model. A trust score is generated based on the cosine similarity between the behavioral sequence and the predicted sequence. A Markov model is then constructed to dynamically select the authentication method. A risk index is calculated by combining network and geographic information and assigned to the real or virtual environment. Unauthorized terminal devices are assigned to a virtual environment after registration. Differential monitoring is implemented: a time-series database is established for virtual environments, and a suspicious score is generated through sequence matching; for real environments, a state deviation is calculated using a Hidden Markov Model and multi-dimensional features are fused to generate a risk score. Based on result-based access control, suspicious terminal devices have their permissions restricted, compliant terminal devices undergo authentication migration, and access is controlled according to the principle of least privilege and a time window mechanism.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and more particularly to a data security dynamic evaluation system and a protection method. BACKGROUND

[0002] Under the tide of digital transformation, terminal equipment as a key node of data interaction, its security protection is directly related to the enterprise core data security and business continuity. At present, the terminal security field mainly relies on static access control and independent user behavior analysis technology: on the one hand, the traditional access mechanism mostly adopts static authentication methods such as username and password, digital certificate, etc., only verifies the legality of the terminal equipment identity, lacks continuous monitoring of the security state of the terminal equipment in runtime, so that the legitimate terminal equipment hijacked by malicious software can easily bypass the protection and cause data leakage; on the other hand, although the user behavior analysis system can construct a behavior baseline based on historical data, it is not deeply associated with the security state of the terminal equipment and the permission allocation strategy, and in the face of data transmission behavior in encrypted traffic, the traditional detection means is subject to the protection of the encryption protocol, and it is difficult to identify abnormal operations, resulting in a large number of risk events with abnormal behavior but compliance with permissions in the detection blind area. The fragmentation and limitation of these technical means make the terminal security protection vulnerable in complex attack scenarios, therefore, in order to overcome these limitations, the present application provides a data security dynamic evaluation system and a protection method, which realizes the deep collaboration of terminal equipment access, permission management and behavior monitoring, and improves the overall and dynamic adaptability of terminal security protection. SUMMARY

[0003] In view of the deficiencies in the prior art, the purpose of the present application is to provide a data security dynamic evaluation system and a protection method, which solves the problem of realizing the collaborative protection of dynamic access control, behavior risk monitoring and permission adaptive regulation of terminal equipment under a unified security framework.

[0004] To achieve the above purpose, the present application provides the following technical scheme:

[0005] The data security dynamic evaluation system comprises:

[0006] Obtaining the hardware features and software environment features of the terminal equipment, generating a unique terminal equipment fingerprint, and verifying the legality of the terminal equipment fingerprint to determine whether the terminal equipment is authorized, and implementing a differentiated access control strategy;

[0007] If authorized, access features are obtained, the access features are sliced according to a preset time window and input into a time sequence behavior model, a trust score is generated by calculating the cosine similarity between the behavior sequence of the access features and the predicted sequence, a Markov decision process model is constructed based on the trust score, and an authentication mode is dynamically selected; in combination with authentication information, network type and geographic information, a fuzzy analytic hierarchy process is used to calculate an abnormal risk index, and then the terminal device is allocated to a real access environment or a virtual access environment;

[0008] If not authorized, an authentication registration process is started, a terminal device fingerprint bound to a user identity is generated and stored, and the terminal device is allocated to a virtual access environment;

[0009] The terminal device is classified through a differentiated monitoring strategy, and the differentiated monitoring strategy is configured as follows: for a terminal device in a virtual access environment, operation data is captured, a time-ordered database is constructed, frequent sequence patterns are generated and matched with an attack pattern library to calculate a suspiciousness score for classification; for a terminal device in a real access environment, a hidden Markov chain model is constructed to form a dynamic baseline, a state transition probability deviation is calculated, and an abnormal score system is constructed in combination with multi-dimensional features for classification;

[0010] According to the classification result of the terminal device, a dynamic permission shrinkage strategy and a time window control mechanism are used to manage the access permissions of the terminal device.

[0011] Specifically, the specific steps of classifying the terminal device through the differentiated monitoring strategy include:

[0012] For a terminal device entering a virtual access environment, operation data is captured in real time, and a time-ordered operation sequence database is constructed;

[0013] An ordered event sequence is constructed through timestamp standardization, and a sliding window is used to divide the ordered event sequence into ordered event subsequences representing operation events;

[0014] A time margin threshold is configured to construct a fuzzy order relationship between operation events, candidate operation events satisfying the time margin threshold constraint are obtained, and a projection database is generated;

[0015] Operation event combinations in the projection database are filtered based on a set support threshold to generate frequent sequence patterns;

[0016] The frequent sequence patterns are semantically mapped and similarity calculated with a pre-constructed attack pattern library, a multi-dimensional risk feature weight system is constructed through an analytic hierarchy process to calculate a suspiciousness score, a risk threshold is configured, and the terminal device is divided into a suspicious terminal device or a compliant terminal device.

[0017] Specifically, the specific steps of classifying the terminal device through the differentiated monitoring strategy further include:

[0018] Real-time capture of operation data to build actual observation sequence, synchronous acquisition of historical operation data and time stamp alignment;

[0019] Standardized preprocessing of historical operation data, mapping operation types to predefined operation space to build comprehensive sequence, and dividing into observation sequence by sliding window;

[0020] Building a hidden Markov chain model, defining operation types as hidden states and operation objects as observable variables, initializing state transition probability matrix by statistical frequency of each operation type in historical operation data, and initializing observation probability matrix based on co-occurrence relationship between operation objects and operation types;

[0021] Training the hidden Markov chain model parameters by expectation maximization algorithm to form a basic baseline model representing normal behavior state transition rules, and dynamically updating combined with time decay factor;

[0022] Generating standard operation sequence by Monte Carlo simulation, calculating state transition probability deviation using time difference analysis; extracting data access frequency characteristic value, sensitive operation characteristic value and operation time window characteristic value, normalizing to build an abnormal score system to generate comprehensive risk score;

[0023] Configuring dynamic risk threshold to divide terminal devices into suspicious terminal devices or compliant terminal devices.

[0024] Specifically, the specific steps of implementing differentiated access control strategy include:

[0025] Obtain terminal device access features, slice the terminal device access features according to the preset time window, and normalize to build a time series behavior model by time series analysis; the time series behavior model is used to capture the dependency relationship of the behavior sequence of the access features;

[0026] Input the behavior sequence of the current terminal device access features into the trained time series behavior model, and generate a trust score by calculating the cosine similarity between the behavior sequence of the current terminal device access features and the predicted sequence of the time series behavior model;

[0027] According to the trust score of the terminal device, build an authentication decision mechanism of Markov decision process containing state space and action space, the state space is composed of trust score, historical authentication success rate and security event frequency, and the action space is composed of authentication strategy;

[0028] Establish the mapping relationship between authentication strategy and authentication effect, the authentication effect includes authentication success rate, user time consumption and security benefit, update the Q value table in real time based on the mapping relationship to adjust the selection probability of authentication strategy;

[0029] Based on the authentication policy, user authentication information of terminal devices is collected. Combined with access network type and geographical information, a fuzzy hierarchical analysis risk assessment model containing target layer, criterion layer and indicator layer is constructed. The indicator weights are determined by the fuzzy judgment matrix, and the terminal device abnormality risk index is calculated by the weighted average operator.

[0030] Specifically, the steps for updating the Q-value table include:

[0031] Trust scores, historical authentication success rates, and security event frequencies are divided into finite interval levels to generate a discrete state space.

[0032] Initialize the Q-value entries of the state-action pairs in the state space and action space, and select the authentication strategy for the action space based on a greedy strategy;

[0033] After executing the authentication policy, record the feedback data, construct a comprehensive reward function that includes success rewards, failure penalties, and time deductions, and calculate the immediate reward;

[0034] The prediction error is calculated by combining immediate reward and expected value of the next state. The learning rate is dynamically adjusted based on the historical access frequency of state-action pairs, and the Q-value table is updated.

[0035] Specifically, the steps for implementing a differentiated access control strategy include:

[0036] The hardware and software environment characteristics of the terminal device applying for access are obtained, and feature extraction and fusion processing are performed to generate a unique terminal device fingerprint. This fingerprint is then compared with the registration database to determine whether the terminal device is authorized.

[0037] If the terminal device authorizes, obtain the terminal device's abnormal risk index;

[0038] Set a risk threshold. If the terminal device's abnormal risk index is less than the risk threshold, then grant permissions to the real access environment and establish a secure communication tunnel.

[0039] If the terminal device's abnormal risk index is greater than or equal to the risk threshold, the terminal device will be redirected to a virtual access environment.

[0040] If the terminal device is not authorized, the terminal device registration process will be initiated. Based on the submitted registration application information, a unique terminal device fingerprint will be generated, bound to the user's identity information, stored in the registration database, and the terminal device will be guided to the virtual access environment.

[0041] Specifically, the steps for calculating the doubt score include:

[0042] Frequent sequence patterns are converted into operational feature vectors through semantic mapping, and then dynamically matched with an attack pattern library containing operational feature vectors of attack pattern attributes of known threat behaviors.

[0043] Calculate the similarity between the operation feature vector and the attribute operation feature vector of each attack mode in the attack mode library;

[0044] Configure a similarity threshold to filter target attack pattern attributes with a similarity greater than the similarity threshold;

[0045] A multi-dimensional risk feature weighting system is constructed. The multi-dimensional risk feature weighting system sets feature weights for target attack pattern attributes through the hierarchical analysis method, and performs weighted aggregation calculation on the selected target attack pattern attributes to calculate the doubt score.

[0046] Specifically, the steps for generating the comprehensive risk score include:

[0047] Standard operating sequences that conform to the probability distribution of the baseline model are generated by Monte Carlo simulation, and the state transition probability deviation between the actual observed sequences and the standard operating sequences is calculated using time series difference analysis.

[0048] The deviation between the number of operations per unit time and the average number of operations in the same period of historical operation data is calculated by a standardized method to generate data access frequency feature values.

[0049] Monitor the frequency and proportion of sensitive operation sets in the observation sequence, and generate sensitive operation feature values;

[0050] Divide the operation time window intervals, calculate the difference between the proportion of operation times in each interval and the operation distribution in the corresponding time period in the baseline model, and generate operation time window feature values;

[0051] The state transition probability deviation, data access frequency feature value, sensitive operation feature value, and operation time window feature value are normalized and then weighted to generate a comprehensive risk score.

[0052] Specifically, the steps for managing access permissions on access monitoring terminal devices include:

[0053] Implement a collaborative control mechanism of network isolation and access restriction for suspicious terminal devices in the virtual access environment;

[0054] For compliant terminal devices in the virtual access environment, a progressive authentication process is initiated, a trusted environment migration is performed, and the compliant terminal devices that have passed enhanced authentication are incorporated into the real access environment.

[0055] A dynamic permission contraction strategy is implemented for permission monitoring terminal devices in real access environments. Based on the principle of least privilege, a triple permission control is performed on the permission monitoring terminal, including network access control, data operation control and account permission management.

[0056] A time window control mechanism is built for the permission monitoring terminal, dividing the working period and non-working period and configuring differentiated rules: during the working period, access to resources within the scope of the restricted permissions is open, while during the non-working period, operations are restricted through enhanced restriction policies; cross-time period access requires verification by the security policy engine and temporary access windows are granted through multi-factor authentication.

[0057] The dynamic data security protection method includes the following steps:

[0058] Step S1: Obtain the hardware and software environment characteristics of the terminal device, generate a unique terminal device fingerprint, and verify the legality of the terminal device fingerprint to determine whether the terminal device is authorized, and implement a differentiated access control strategy.

[0059] Step S2: If authorized, obtain its access characteristics, slice the access characteristics according to a preset time window and input them into the time-series behavior model, generate a trust score by calculating the cosine similarity between the behavior sequence of the access characteristics and the predicted sequence; construct a Markov decision process model based on the trust score to dynamically select the authentication method; combine authentication information, network type and geographical information, use fuzzy hierarchical analysis to calculate the abnormal risk index, and then allocate the terminal device to the real access environment or the virtual access environment;

[0060] Step S3: If not authorized, initiate the authentication and registration process, generate and store the terminal device fingerprint that is bound to the user's identity, and simultaneously assign the terminal device to the virtual access environment;

[0061] Step S4: Classify terminal devices using a differentiated monitoring strategy. The differentiated monitoring strategy is configured as follows: For terminal devices in virtual access environments, classify them by capturing operation data, constructing a time-ordered database, generating frequent sequence patterns, and matching them with an attack pattern library to calculate a suspicion score; For terminal devices in real access environments, classify them by constructing a hidden Markov chain model to form a dynamic baseline, calculating the state transition probability deviation, and combining multi-dimensional features to construct an anomaly scoring system.

[0062] Step S5: Based on the terminal device classification results, manage access permissions for the terminal devices under permission monitoring through a dynamic permission contraction strategy and a time window control mechanism.

[0063] The beneficial effects of this invention are:

[0064] This invention employs a differentiated access control strategy, leveraging terminal device fingerprinting and blockchain technology to achieve precise verification of terminal identity. It combines temporal behavior models and Hidden Markov Decision Processes (HMMs) to dynamically adapt authentication strength, addressing the security vulnerabilities of traditional static authentication. By integrating multi-dimensional risk factors using fuzzy hierarchical analysis, it achieves quantitative assessment of terminal access risks, avoiding the limitations of single indicators. Through sequence pattern mining and dynamic matching of attack pattern libraries in virtual access environments, along with HMM baseline modeling and temporal difference analysis in real access environments, it constructs a bidirectional dynamic monitoring system. This system enables accurate identification of known threats and probabilistic detection of unknown anomalies, significantly improving the comprehensiveness and timeliness of threat discovery. A dynamic permission contraction and time window control mechanism based on the principle of least privilege, combined with full log auditing and real-time blocking technology, effectively reduces the risk of permission abuse and enhances fine-grained control over data access. The overall solution, through technological integration and process closure, overcomes the static and fragmented limitations of traditional security protection, constructing a dynamic security protection system covering access, monitoring, and response, significantly improving the intelligence and adaptability of data security protection in complex network environments. Attached Figure Description

[0065] Figure 1 This is a schematic diagram of the data security dynamic assessment system of the present invention;

[0066] Figure 2 A flowchart illustrating the specific steps involved in implementing the differentiated access control strategy of this invention;

[0067] Figure 3 This is a flowchart illustrating the specific steps of a terminal device entering a virtual access environment according to the present invention.

[0068] Figure 4 This is a flowchart illustrating the specific steps of the terminal device entering the real access environment according to the present invention.

[0069] Figure 5 This is a flowchart of the dynamic data security protection method of the present invention. Detailed Implementation

[0070] Example 1

[0071] Please see Figure 1 This embodiment introduces a data security dynamic assessment system, including: an access decision module, a behavior monitoring module, and a permission control module;

[0072] The access decision module integrates multi-dimensional identity authentication and risk decision-making mechanisms. It is responsible for conducting initial security assessments of terminal devices applying for access and planning access paths through differentiated access control policies. By integrating technologies such as terminal device fingerprint verification, biometric recognition, and digital certificate verification, a three-dimensional authentication system is constructed to verify the legitimacy of terminal device identities in real time. It automatically generates isolated virtual access environments, configured with limited access permissions and simulated business data, used to trap and observe the subsequent behavior of suspicious terminal devices. For compliant terminal devices that pass rigorous authentication, a real data interaction channel is directly opened and an initial trusted connection is established. Simultaneously, the module has a built-in access policy engine that dynamically adjusts authentication strength based on contextual information such as network environment risk level and access time, ensuring the dynamic and adaptable nature of identity verification and providing reliable initial data input for subsequent behavior assessments.

[0073] Please see Figure 2 Preferably, the specific steps for implementing a differentiated access control strategy include:

[0074] The uniqueness of hardware and software characteristics can identify the identity of a terminal device. The hardware characteristics and software environment characteristics of the terminal device applying for access are obtained. Hardware characteristics include: MAC address, BIOS serial number, CPU-ID; software environment characteristics include: operating system version, list of installed applications. The hardware characteristics and software environment characteristics are extracted and fused through a hash algorithm to generate a unique terminal device fingerprint. This fingerprint is compared with the registration database. A distributed identity verification technology based on blockchain is used to verify the legality and integrity of the terminal device fingerprint through a smart contract to determine whether the terminal device is authorized.

[0075] The temporal distribution and historical patterns of terminal device behavior are continuous, and time series analysis can capture long-term dependency characteristics of abnormal operations. If the terminal device is authorized, its access characteristics are obtained, including connection time distribution, data transmission mode, target IP address, and request frequency. These access characteristics are sliced ​​according to a preset fixed time window and normalized. A temporal behavior model is constructed through time series analysis. The temporal behavior model captures long-term dependencies of behavior sequences through a gating mechanism. During the training phase of the temporal behavior model, historical behavior data of the terminal device is extracted from the security logs of the access environment as the training set. The Adam optimizer is used to minimize the mean squared error loss function, and iterative training is performed until convergence. During real-time evaluation, the behavior sequence of the current terminal device access characteristics is input into the trained temporal behavior model. A trust score of 0-100 is generated by calculating the cosine similarity between the behavior sequence of the current terminal device access characteristics and the predicted sequence of the temporal behavior model, forming a quantitative assessment of the credibility of the terminal device behavior.

[0076] A single authentication method cannot balance security and efficiency. Based on the trust score of the terminal device, an authentication decision mechanism is constructed based on a three-dimensional authentication system. Through Markov decision process modeling, the authentication method for the terminal device is dynamically selected.

[0077] The authentication decision engine is constructed using a Markov decision process, treating authentication method selection as a sequential decision problem. The state space consists of multi-dimensional variables such as trust score, historical authentication success rate, and security event frequency. The action space contains various authentication strategies, including single-factor authentication, two-factor authentication, and multimodal biometric authentication. A mapping relationship between authentication strategies and authentication effectiveness is established using Q-learning, where effectiveness includes success rate, user time consumption, and security benefits. The Q-value table is updated in real-time based on the mapping relationship between authentication strategies and effectiveness, updating the probability of strategy selection. This achieves dynamic matching between authentication strength and access efficiency, ensuring rapid access for high-trust terminal devices while implementing enhanced authentication for low-trust terminal devices.

[0078] Specifically, the steps for updating the Q-value table in real time based on the mapping relationship between authentication strategy and authentication effect include:

[0079] Original data such as trust scores and historical authentication success rates are usually continuous values. Directly using them for reinforcement learning would result in an infinitely large state space and an exponential increase in computational complexity. Therefore, trust scores, historical authentication success rates, and security event frequencies are divided into a finite number of interval levels to form a discrete state space.

[0080] Create a corresponding Q-value entry for each state in the state space and each action in the action space, and initialize it to the default value;

[0081] A purely greedy strategy can lead the algorithm into local optima, while completely random selection lacks a direction for strategy optimization. At each authentication decision, based on the greedy strategy, the authentication strategy of the action space is randomly selected with a preset probability in the current state according to the Q-value table of state-action pairs in the state space and action space.

[0082] A single metric may overlook user experience or security risks; a comprehensive reward function is needed to map multi-dimensional metrics into a unified numerical feedback. Implement the selected authentication strategy and record feedback data, including whether authentication was successful, the time taken for the user to complete authentication, and whether any security events were triggered.

[0083] A comprehensive reward function is constructed, awarding a positive reward for successful authentication without any security incidents, and a negative reward for failure or triggering a security incident. User time consumed is deducted proportionally as a penalty. Real-time rewards are calculated based on authentication results, user time consumed, and security incidents, simultaneously optimizing both security and efficiency.

[0084] By combining the current state, the action performed, the immediate reward, and the expected value of the next state, the prediction error is calculated using the temporal difference learning method, and the learning rate is dynamically adjusted based on the historical access frequency of the state and action to achieve adaptive updating of the Q-value table.

[0085] Specifically, the target value is first calculated based on the current reward and the maximum expected value of the next state. Then, the difference between the target value and the current Q value estimate is used as the error signal. Finally, the corresponding entries are updated according to the dynamically decaying learning rate to ensure that parameter updates are more cautious in high-frequency states and that exploration is maintained in low-frequency states.

[0086] Terminal device access risks involve multiple uncertainties, including terminal device trustworthiness, network risk, and geographical risk. Traditional quantitative analysis struggles to effectively handle these fuzzy aspects. This paper describes a risk assessment model constructed using fuzzy hierarchical analysis (AHP) to collect user authentication information from terminal devices based on authentication policies and combining this information with the network type and geographical information of the terminal devices. The target layer of the risk assessment model is the anomaly risk index, the criterion layer includes terminal device trustworthiness, network risk, and geographical risk, and the indicator layer covers specific indicators such as trust score, network type risk value, and geographical location risk value. A fuzzy judgment matrix is ​​constructed to obtain the weights of each indicator, and a weighted average operator is used to calculate the terminal device anomaly risk index, achieving a multi-dimensional quantitative assessment of terminal access risks.

[0087] Terminal devices need to be subject to tiered management and control. Based on the terminal device's anomaly risk index, a differentiated access control strategy should be implemented, namely:

[0088] Directly rejecting high-risk terminal devices may trigger further probing by attackers, while exposing sensitive data in the real environment poses a risk of leakage. Therefore, a risk threshold is set. If the abnormal risk index of a terminal device is less than the risk threshold, then permissions to access the real environment are granted and a secure communication tunnel is established.

[0089] If the anomaly risk index of a terminal device is greater than or equal to the risk threshold, the terminal device will be redirected to a virtual access environment. The virtual access environment employs dynamic resource allocation technology to generate simulated business scenarios and forged data resources based on the characteristics of the terminal device being evaluated. Its interface and operational logic maintain a high degree of consistency with the real access environment, but all data is simulated data that has undergone anonymization processing. By monitoring the behavior patterns of the terminal device being evaluated in the virtual environment, potential attack intentions and abnormal operations are identified.

[0090] If the terminal device is not authorized, the terminal device registration process will be initiated. A comprehensive authentication system will be used to perform full-factor authentication on the terminal device. The terminal device will submit registration application information, including terminal device information and user identity information. The validity of the user's identity will be confirmed through SMS verification codes, email verification, and other methods. Simultaneously, the submitted terminal device information will be verified for hardware authenticity to prevent registration using forged terminal device information.

[0091] After registration and authentication are completed, a unique terminal device fingerprint is generated based on the submitted registration application information, which is then bound to the user's identity information and stored in the registration database.

[0092] Unauthorized terminal devices may carry malicious software or exhibit abnormal behavior during the registration phase. During the registration process, unauthorized terminal devices will be guided to a virtual access environment for pre-evaluation of their behavior.

[0093] The behavior monitoring module is responsible for the full-cycle collection and in-depth analysis of terminal device behavior data. Through differentiated monitoring strategies, it categorizes terminal devices entering virtual and real access environments into suspicious and compliant devices. For virtual terminals, sequence pattern mining technology is used to track file operations, network connections, and data transmission in a fine-grained manner. A real-time operation sequence model is constructed and dynamically matched with a known attack pattern library to identify potential threats such as data theft and port scanning, classifying them as suspicious or compliant devices. For compliant devices, a dynamic behavior baseline is constructed based on historical operation data. Temporal difference analysis and Hidden Markov Models are used to calculate the deviation of the current behavior from the baseline in real time. Anomaly quantification assessment is performed based on dimensions such as data access frequency and sensitive data operation types, classifying them as suspicious or compliant devices. This provides multi-level behavioral feature inputs for access control and risk decision-making, achieving a technological upgrade from single behavior detection to sequence correlation assessment.

[0094] Preferably, the specific steps for classifying terminal devices entering the virtual access environment and those entering the real access environment into suspicious terminal devices and compliant terminal devices through differentiated monitoring strategies include:

[0095] Please see Figure 3 Attacks on terminal devices typically manifest as specific operation sequences, such as abnormal file traversal before file theft or network connection probing before port scanning. For terminal devices entering a virtual access environment, operation data is captured in real time, including file operation instruction streams, network connection session records, and data transmission packets. Timestamp technology is used to arrange the above operation data in the order of events to build a time-ordered operation sequence database.

[0096] Timestamps from different data sources may have clock skew. By standardizing the timestamps, the captured operation sequences are sorted by occurrence time to construct an ordered event sequence. A sliding window is then used to divide the ordered event sequence into time-continuous ordered event subsequences to represent operation events.

[0097] Actual attack behavior may deviate from the order of operations due to factors such as system load and network latency. A time margin threshold is configured to define the maximum allowed time deviation, relax the operation order constraints, and construct fuzzy order relationships between operation events. For each operation event, a projection database is constructed, which contains subsequent operation events that satisfy the time margin threshold constraint. This provides a time-constrained association data foundation for subsequent frequent pattern mining.

[0098] High-frequency co-occurring operation event combinations are often associated with known attack patterns. For example, the combination of file reading, network connection and data outgoing operation events is associated with data theft. By processing the projection database of operation events and setting a support threshold, high-frequency co-occurring operation event combinations are filtered out, and frequent sequence patterns containing operation type, operation frequency and operation correlation are generated. Frequent sequence patterns reflect the operation characteristics of terminal devices in the virtual environment.

[0099] The generated frequent sequence patterns are dynamically matched with a pre-built attack pattern library, which contains operational feature templates of known threat behaviors. Through semantic mapping, elements such as operation types and relationships in the frequent sequence patterns are converted into operational feature representations consistent with the attack pattern library, establishing a mapping relationship between operational features and attack pattern attributes to form comparable operational feature vectors. Attack pattern attributes include: the operational feature template includes operational feature vectors of each attack pattern attribute.

[0100] Similarity calculation is used to calculate the similarity between the semantically mapped operation feature vector and the operation feature vector of each attack mode attribute in the attack mode library. The similarity calculation supports algorithms such as cosine similarity and dynamic time warping. Target attack mode attributes with similarity greater than the similarity threshold can be filtered by configuring a similarity threshold.

[0101] A single similarity index cannot comprehensively assess risk. Therefore, a multi-dimensional risk feature weighting system is constructed. This system uses the analytic hierarchy process (AHP) to determine the weight of each feature by combining the severity, frequency, and business impact of attack pattern attributes. The selected attack pattern attributes are then weighted and aggregated to calculate the skepticism score.

[0102] Configure risk thresholds based on real-time network security status and business risk level. If the suspiciousness score of a terminal device is greater than the risk threshold, the terminal device is classified as a suspicious terminal device; otherwise, it is classified as a compliant terminal device and included in the continuous trust monitoring system.

[0103] Please see Figure 4In real-world environments, it is necessary to monitor the deviation between the terminal's real-time behavior and the historical baseline. For terminal devices entering real-world access environments, operation data is captured in real time to construct a time-ordered and formatted actual observation sequence. This actual observation sequence is used to characterize the real-time operation behavior pattern of the terminal device. Its construction process integrates multi-source data acquisition and time consistency processing technologies. By capturing operation data such as the terminal's file operation command stream, network connection session records, and data transmission traffic characteristics in real time, an original sequence with precise timestamps is generated according to the order of events. To address potential clock deviations in multi-source data, a timestamp alignment algorithm is used to perform spatiotemporal calibration on the original sequence to ensure that operation events are arranged in the actual order of occurrence. A time-ordered and formatted actual observation sequence is formed through a unified data format.

[0104] Synchronously acquire historical operation data covering a preset evaluation period, including file operation command sequences, network connection information, and data transmission traffic characteristics, and use a timestamp alignment algorithm to eliminate clock deviations in multi-source data;

[0105] Historical operation data is standardized and preprocessed to map operation types to a predefined operation space, construct a comprehensive sequence containing operation type, operation object and operation time, and divide the comprehensive sequence into fixed-length observation sequences through a sliding window;

[0106] Normal behavior has a time-series dependency. A hidden Markov chain model is constructed, where operation type is defined as a hidden state and operation object is defined as an observable variable. The state transition probability matrix is ​​initialized by statistically analyzing the frequency of occurrence of each operation type in historical operation data, and the observation probability matrix is ​​initialized based on the co-occurrence relationship between operation object and operation type.

[0107] The Hidden Markov Chain Model is trained with the Expectation Maximization (EM) algorithm. The expected value of the state transition probability is calculated by the forward-backward algorithm. The model parameters are iteratively updated until the log-likelihood function converges, forming a basic baseline model that represents the state transition law of normal behavior.

[0108] User behavior patterns may change with business needs. By setting a time decay factor to weight historical operation data, the influence of recent behavior on the parameters of the Hidden Markov Chain Model gradually increases, thereby realizing a dynamic update mechanism for the basic baseline model.

[0109] By generating standard operating sequences that conform to the probability distribution of the baseline model through Monte Carlo simulation, a reference benchmark for normal behavior is used. Temporal difference analysis is employed to calculate the state transition probability deviation between the actual observed sequence and the standard operating sequence, avoiding the subjectivity of traditional threshold setting and realizing dynamic anomaly detection based on probability distribution.

[0110] The system counts the number of operations performed on terminal devices per unit time, calculates the deviation from the average number of operations performed during the same period in historical operation data, and converts this deviation into a data access frequency feature value through a standardization method. For sensitive data operation types, a set of sensitive operations, including reading and writing classified documents and accessing information with administrator privileges, is predefined. The system monitors the frequency and proportion of sensitive data operations in the actual observation sequence in real time and generates sensitive operation feature values. For operation time windows, the day is divided into different time intervals, such as working hours and non-working hours. The system calculates the difference between the proportion of operations performed in each interval and the corresponding time period operation distribution in the baseline model, and quantifies the time window feature value.

[0111] Normalize the state transition probability deviation, data access frequency feature value, sensitive operation feature value and time window feature value, construct an anomaly scoring system, and generate a comprehensive risk score through a weighted synthesis algorithm to achieve multi-dimensional quantitative assessment and risk classification of terminal operations.

[0112] Configure dynamic risk thresholds and adaptively adjust them based on business operation characteristics, network security status and historical trust level of terminals. Compare the comprehensive risk score with the dynamic risk threshold. Terminal devices with a score greater than the dynamic risk threshold are classified as suspicious terminal devices, otherwise they are classified as compliant terminal devices. The operation baseline model is continuously updated using an incremental learning algorithm. By setting a trust decay factor, continuous trust assessment of terminal devices is achieved, forming a closed-loop dynamic monitoring mechanism.

[0113] Based on the evaluation results output by the behavior monitoring module, the access control module intelligently and dynamically adjusts access permissions and automates the execution of risk response strategies. According to the classification of terminal devices entering the virtual access environment and the real access environment, it manages access permissions for suspicious and compliant terminal devices separately, generating access control instructions. For suspicious terminal devices confirmed to exhibit threatening behavior in the virtual access environment, it disconnects their network connection using micro-segmentation technology, triggers firewalls to implement IP blocking, and activates a terminal device blacklist mechanism to prevent subsequent access. For terminals with abnormal behavior but compliant identities, it automatically narrows access permissions based on the degree of abnormality and the sensitivity level of data assets, using a hybrid strategy based on rule engines and machine learning.

[0114] Preferably, the specific steps for managing terminal device access permissions include:

[0115] Suspicious terminal devices in virtual access environments may carry malicious code or exhibit abnormal behavior. Direct access to the real environment could lead to the spread of attacks. Therefore, a collaborative control mechanism of network isolation and access restrictions should be implemented for terminals classified as suspicious in the virtual access environment.

[0116] First, a security isolation boundary is built at the data link layer. Communication filtering rules based on hardware addresses are used to cut off the connection channels between suspicious terminal devices and virtual resources in real time, blocking their data interaction capabilities. Simultaneously, network security terminal devices are linked to generate dynamic access control policies based on the fingerprint characteristics of terminal devices. Bidirectional access blocking is implemented at the network layer to prevent suspicious terminal devices from attempting to access the real access environment and the virtual access environment.

[0117] For persistent threat terminal devices that trigger security incidents multiple times, they will be marked as high-risk and all access requests will be rejected during the preset isolation period. After the isolation period expires, they can reapply for access only after passing an enhanced verification process that includes multi-factor biometric authentication and deep security scanning.

[0118] Compliant terminal devices in virtual access environments may pose a risk of identity theft. For terminal devices deemed compliant in the virtual access environment, a progressive authentication process is initiated to achieve trusted environment migration. An enhanced authentication mechanism is adopted to improve verification dimensions, verifying the authenticity of the user's identity through a multi-level identity confirmation process.

[0119] Upon successful enhanced authentication, a security credential containing permission levels is issued, the interaction channel in the real access environment is decrypted, and a quantum-encrypted communication link is established. Simultaneously, a trust assessment model is initialized based on the terminal's behavioral characteristics in the virtual environment, and this model is incorporated into the dynamic monitoring system of the real access environment, providing a behavioral baseline reference for subsequent permission adjustments.

[0120] Implement a dynamic permission contraction strategy for permission monitoring terminal devices in the real access environment. Permission monitoring terminal devices include compliant terminal devices in the virtual access environment that enter the real access environment through secondary authentication and suspicious terminal devices in the real access environment.

[0121] Based on the principle of least privilege, triple permission control is implemented on the permission monitoring terminal:

[0122] In terms of network access control, unnecessary service ports are disabled and unauthorized communication protocols are closed. The network connection of high-risk external targets is restricted through the license list mechanism, and the data transmission path of unregistered domain names and unverified IP addresses is blocked.

[0123] In terms of data operation control, the policy engine is used to force sensitive data access mode to read-only, prohibiting the execution of data export, modification and deletion commands, and triggering real-time approval process for operations that need to change the data status.

[0124] In terms of account permission management, the user account permissions of the permission monitoring terminal are uniformly downgraded to the restricted user level, the system management function call permission is removed, and when a privileged operation request is detected, a secondary authentication mechanism is forcibly started to verify the permission.

[0125] Abnormal access outside of working hours is often related to data theft. Therefore, a time window control mechanism should be built for the access monitoring terminal based on the business operation cycle, dividing working hours and non-working hours and configuring differentiated rules:

[0126] During working hours, the permission monitoring terminal is allowed to access authorized resources within the narrowed permission scope; outside working hours, the enhanced restriction policy is activated to restrict operations, automatically close database write permissions and disable the sensitive file download function, and only retain the emergency transaction processing channel.

[0127] For cross-time period access requests, after real-time verification by the security policy engine, a temporary access window is granted through multi-factor authentication and automatically restored to the default restriction state after the operation is completed. The duration of the temporary access window is determined according to business requirements.

[0128] Deploy a full log collection system to continuously record file operations, network connections, and data transmission behaviors. Analyze the operation logs in real time through a security information and event management platform to identify abnormal patterns, and coordinate with firewalls and intrusion detection systems to intercept unauthorized operations in real time based on preset blocking rules.

[0129] Example 2

[0130] Please see Figure 5 This embodiment introduces a dynamic data security protection method, including the following steps:

[0131] Step S1: Obtain the hardware and software environment characteristics of the terminal device, generate a unique terminal device fingerprint, verify the legality of the terminal device fingerprint to determine whether the terminal device is authorized, and implement a differentiated access control strategy based on the authorization result.

[0132] Step S2: If the terminal device is authorized, its access characteristics are obtained, the access characteristics are sliced ​​according to a preset time window and input into the time-series behavior model, and a trust score is generated by calculating the cosine similarity between the behavior sequence of the access characteristics and the predicted sequence; a Markov decision process model is constructed based on the trust score to dynamically select the authentication method; combined with authentication information, network type and geographical information, the fuzzy hierarchical analysis method is used to calculate the anomaly risk index, and the terminal device is assigned to the real access environment or the virtual access environment according to the anomaly risk index;

[0133] Step S3: If the terminal device is not authorized, the authentication and registration process is initiated, a terminal device fingerprint bound to the user's identity is generated and stored, and the terminal device is assigned to the virtual access environment.

[0134] Step S4: Classify terminal devices using a differentiated monitoring strategy. For terminal devices in virtual access environments, capture operation data and construct a time-ordered database, generate frequent sequence patterns and match them with an attack pattern library, and classify them by calculating a suspicion score through a multi-dimensional risk feature weight system. For terminal devices in real access environments: construct a hidden Markov chain model to form a dynamic baseline, calculate the state transition probability deviation, and construct an anomaly scoring system by combining data access frequency feature values, sensitive operation feature values, and operation time window feature values ​​for classification.

[0135] Step S5: Based on the terminal device classification results, implement network isolation and access restrictions on suspicious terminal devices in the virtual access environment; initiate a progressive authentication process for compliant terminal devices in the virtual access environment, and migrate them to the real access environment after successful authentication; implement a dynamic permission contraction strategy for terminal devices in the real access environment, and perform network access control, data operation management and account permission management based on the principle of least privilege; divide working hours and non-working hours through a time window control mechanism, configure differentiated access rules and perform cross-time period security verification.

[0136] Preferably, the specific steps for implementing a differentiated access control strategy include:

[0137] The terminal device access characteristics are obtained, sliced ​​according to a preset time window, and normalized. A time series behavior model is constructed through time series analysis. The time series behavior model is used to capture the dependency relationship of the behavior sequence of access characteristics.

[0138] The behavior sequence of the current terminal device access features is input into the trained temporal behavior model, and a trust score is generated by calculating the cosine similarity between the behavior sequence of the current terminal device access features and the predicted sequence of the temporal behavior model.

[0139] Based on the trust score of the terminal device, an authentication decision mechanism is constructed using a Markov decision process that includes a state space and an action space. The state space consists of the trust score, historical authentication success rate, and security event frequency, while the action space consists of the authentication policy.

[0140] Establish a mapping relationship between authentication strategies and authentication results, including authentication success rate, user time consumption, and security benefits. Based on the mapping relationship, update the Q-value table in real time to adjust the probability of authentication strategy selection.

[0141] Based on the authentication policy, user authentication information of terminal devices is collected. Combined with access network type and geographical information, a fuzzy hierarchical analysis risk assessment model containing target layer, criterion layer and indicator layer is constructed. The indicator weights are determined by the fuzzy judgment matrix, and the terminal device abnormality risk index is calculated by the weighted average operator.

[0142] Preferably, the specific steps for implementing a differentiated access control strategy include:

[0143] The hardware and software environment characteristics of the terminal device applying for access are obtained, and feature extraction and fusion processing are performed to generate a unique terminal device fingerprint. This fingerprint is then compared with the registration database to determine whether the terminal device is authorized.

[0144] If the terminal device authorizes, obtain the terminal device's abnormal risk index;

[0145] Set a risk threshold. If the terminal device's abnormal risk index is less than the risk threshold, then grant permissions to the real access environment and establish a secure communication tunnel.

[0146] If the terminal device's abnormal risk index is greater than or equal to the risk threshold, the terminal device will be redirected to a virtual access environment.

[0147] If the terminal device is not authorized, the terminal device registration process will be initiated. Based on the submitted registration application information, a unique terminal device fingerprint will be generated, bound to the user's identity information, stored in the registration database, and the terminal device will be guided to the virtual access environment.

[0148] Preferably, the specific steps for classifying terminal devices using a differentiated monitoring strategy include:

[0149] For terminal devices entering the virtual access environment, capture operation data in real time and build a time-ordered operation sequence database;

[0150] An ordered event sequence is constructed by standardizing the timestamps, and a sliding window is used to divide the ordered event sequence into ordered event subsequences representing operation events;

[0151] Configure a time margin threshold to construct a fuzzy order relationship between operation events, obtain candidate operation events that meet the time margin threshold constraint, and generate a projection database;

[0152] Based on the set support threshold, combinations of operation events within the projection database are filtered to generate frequent sequence patterns.

[0153] The frequent sequence patterns are semantically mapped and similarity is calculated with a pre-built attack pattern library. A multi-dimensional risk feature weight system is constructed using the hierarchical analysis method to calculate the doubt score, configure risk thresholds, and classify terminal devices into doubtful terminal devices or compliant terminal devices.

[0154] For terminal devices entering the real access environment, real-time capture of operation data is used to construct the actual observation sequence, and historical operation data is acquired synchronously and timestamp aligned.

[0155] Historical operation data is standardized and preprocessed, and operation types are mapped to predefined operation spaces to construct a comprehensive sequence, which is then divided into observation sequences through a sliding window.

[0156] Construct a hidden Markov chain model, define operation type as hidden state and operation object as observable variable, initialize the state transition probability matrix by statistically analyzing the occurrence frequency of each operation type in historical operation data, and initialize the observation probability matrix based on the co-occurrence relationship between operation object and operation type.

[0157] The parameters of the hidden Markov chain model are trained by the expectation-maximization algorithm to form a basic baseline model that represents the state transition law of normal behavior, and then dynamically updated by combining the time decay factor.

[0158] Standard operation sequences are generated through Monte Carlo simulation, and state transition probability deviations are calculated using temporal difference analysis. Data access frequency feature values, sensitive operation feature values, and operation time window feature values ​​are extracted, and after normalization, an anomaly scoring system is constructed to generate a comprehensive risk score.

[0159] Configure dynamic risk thresholds to classify terminal devices as either questionable or compliant.

[0160] Working principle and its effects:

[0161] This invention generates a unique terminal device fingerprint by extracting terminal hardware and software features, verifies its legitimacy, and implements differentiated access. Authorized terminal devices calculate a trust score through a time-series behavior model, dynamically select an authentication method based on a Markov decision process, and calculate an anomaly risk index by combining fuzzy hierarchical analysis with network and geographic information. The index is then assigned to a real or virtual environment. Unauthorized terminal devices enter the virtual environment after registration, thus achieving accurate identity verification and multi-dimensional risk quantification assessment.

[0162] In the differentiated monitoring stage, the virtual environment terminal captures operational data, processes it with timestamps, divides it into sliding windows to generate frequent sequence patterns, and matches it with the attack pattern library to calculate the suspicion score; the real environment terminal constructs a hidden Markov chain model, trains it with the expectation-maximization algorithm and updates it dynamically, combines Monte Carlo simulation and temporal difference analysis to calculate the state transition bias, extracts multi-dimensional features to construct an anomaly scoring system, and realizes accurate identification of known threats and probability detection of unknown anomalies.

[0163] During the access control phase, network isolation is implemented for questionable terminal devices in the virtual environment, while compliant terminal devices are migrated to the real environment through progressive authentication. Terminal devices in the real environment implement triple access control of network, data, and account based on the principle of least privilege, construct a time window control mechanism, require multi-factor authentication for cross-time period access, and reduce the risk of permission abuse by combining log collection and analysis, thereby achieving fine-grained dynamic control.

[0164] The overall solution organically integrates key technologies such as terminal device fingerprint generation, temporal behavior model, Markov decision process, fuzzy hierarchical analysis, and hidden Markov chain model. It breaks through the static and fragmented limitations of traditional security protection, and builds a dynamic security protection system covering the entire lifecycle from terminal access to access. This significantly improves the intelligence, adaptability, and threat response efficiency of data security protection in complex network environments.

[0165] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A dynamic assessment system for data security, characterized in that, The application comprises the following steps: Obtaining the hardware features and software environment features of the terminal device, generating a unique terminal device fingerprint, verifying the legality of the terminal device fingerprint to determine whether the terminal device is authorized, and implementing a differentiated access control strategy; If authorized, obtaining its access features, slicing the access features according to a preset time window and inputting them into a time sequence behavior model, generating a trust score by calculating the cosine similarity between the behavior sequence of the access features and the predicted sequence, constructing a Markov decision process model based on the trust score, dynamically selecting an authentication method, combining authentication information, network type and geographic information, calculating an abnormal risk index using fuzzy analytic hierarchy process, and then distributing the terminal device to a real access environment or a virtual access environment; If not authorized, starting an authentication registration process, generating a terminal device fingerprint bound to a user identity and storing it, and distributing the terminal device to a virtual access environment; Classifying terminal devices through a differentiated monitoring strategy, which is configured as follows: for terminal devices in a virtual access environment, classifying them by capturing operation data, constructing a time-ordered database, generating frequent sequence patterns and matching them with an attack pattern library to calculate a suspiciousness score; for terminal devices in a real access environment, classifying them by constructing a hidden Markov chain model to form a dynamic baseline, calculating state transition probability deviation and combining multi-dimensional features to construct an abnormal score system; According to the classification results of the terminal devices, managing the access permissions of the terminal devices through a dynamic permission contraction strategy and a time window control mechanism.

2. The data security dynamic assessment system of claim 1, wherein, The specific steps of classifying terminal devices through a differentiated monitoring strategy include: For terminal devices entering a virtual access environment, capturing operation data in real time and constructing a time-ordered operation sequence database; Building an ordered event sequence through timestamp standardization and dividing the ordered event sequence into ordered event subsequences representing operation events using a sliding window; Configuring a time margin threshold to build a fuzzy order relationship between operation events, obtaining candidate operation events that meet the time margin threshold constraint of the operation events, and generating a projection database; Filtering operation event combinations in the projection database based on a set support threshold to generate frequent sequence patterns; Performing semantic mapping and similarity calculation on the frequent sequence patterns and a pre-constructed attack pattern library, constructing a multi-dimensional risk feature weight system using an analytic hierarchy process to calculate a suspiciousness score, configuring a risk threshold, and dividing terminal devices into suspicious terminal devices or compliant terminal devices.

3. The data security dynamic assessment system of claim 2, wherein, The specific steps of classifying terminal devices through a differentiated monitoring strategy also include: For terminal devices entering a real access environment, capturing operation data in real time to construct an actual observation sequence, synchronously obtaining historical operation data and aligning timestamps; Standardizing and preprocessing the historical operation data, mapping operation types to a predefined operation space to construct a comprehensive sequence, and dividing the comprehensive sequence into observation sequences using a sliding window; A hidden Markov chain model is constructed, the operation type is defined as a hidden state, and the operation object is defined as an observable variable. The state transition probability matrix is initialized by counting the frequency of each operation type in the historical operation data, and the observation probability matrix is initialized based on the co-occurrence relationship between the operation object and the operation type; The hidden Markov chain model parameters are trained by the expectation maximization algorithm to form a basic baseline model representing the normal behavior state transition rule, and are dynamically updated in combination with a time decay factor; A standard operation sequence is generated by Monte Carlo simulation, and the state transition probability deviation is calculated by using time series difference analysis. Feature values such as data access frequency, sensitive operation feature values, and operation time window feature values are extracted, normalized, and then combined to generate a comprehensive risk score. A dynamic risk threshold is configured to divide the terminal device into a suspicious terminal device or a compliant terminal device.

4. The data security dynamic assessment system of claim 1, wherein, The specific steps of implementing the differentiated access control strategy include: Obtain the terminal device access features, slice the terminal device access features according to a preset time window, and normalize them to build a time series behavior model through time series analysis. The time series behavior model is used to capture the dependency relationship of the behavior sequence of the access features; Input the behavior sequence of the current terminal device access features into the trained time series behavior model, and generate a trust score by calculating the cosine similarity between the behavior sequence of the current terminal device access features and the predicted sequence of the time series behavior model; According to the trust score of the terminal device, an authentication decision mechanism of a Markov decision process including a state space and an action space is constructed, wherein the state space is composed of the trust score, the historical authentication success rate, and the security event frequency, and the action space is composed of the authentication strategy; A mapping relationship between the authentication strategy and the authentication effect is established, the authentication effect includes the authentication success rate, the user time consumption, and the security benefit, and the Q value table is updated in real time based on the mapping relationship to adjust the authentication strategy selection probability; According to the authentication strategy, the user authentication information of the terminal device is collected, the access network type and the geographic information are combined to construct a fuzzy analytic hierarchy process risk evaluation model including a target layer, a criterion layer, and an index layer, the index weight is determined through a fuzzy judgment matrix, and the terminal device abnormal risk index is calculated by using a weighted average operator.

5. The data security dynamic assessment system of claim 4, wherein, The specific steps of updating the Q value table include: Divide the trust score, the historical authentication success rate, and the security event frequency into a limited interval level to generate a discrete state space; Initialize the Q value table of the state-action pair of the state space and the action space, and select the authentication strategy of the action space based on the greedy strategy; After executing the authentication strategy, record the feedback data, construct a comprehensive reward function including a success reward, a failure penalty, and a time consumption deduction, and calculate the immediate reward; Combine the immediate reward and the next state expected value to calculate the prediction error, dynamically adjust the learning rate based on the historical access frequency of the state-action pair, and update the Q value table.

6. The data security dynamic assessment system of claim 1, wherein, The specific steps of implementing the differentiated access control strategy include: Obtain the hardware features and software environment features of the terminal device applying for access, perform feature extraction and fusion processing, generate a unique terminal device fingerprint, and compare it with the registration library to determine whether the terminal device is authorized; If the terminal device is authorized, an abnormal risk index of the terminal device is obtained; A risk threshold is set, if the abnormal risk index of the terminal device is less than the risk threshold, the permission of the real access environment is allocated, and a secure communication tunnel is established; If the abnormal risk index of the terminal device is greater than or equal to the risk threshold, the terminal device is guided to a virtual access environment; If the terminal device is not authorized, a terminal device registration process is started, a unique terminal device fingerprint is generated according to the submitted registration application information, is bound with user identity information, is stored to a registration library, and the terminal device is guided to a virtual access environment.

7. The data security dynamic assessment system of claim 2, wherein, The specific steps of calculating the suspiciousness score include: The frequent sequence pattern is converted into an operation feature vector through semantic mapping, and is dynamically matched with an attack pattern library, the attack pattern library including attack pattern attribute operation feature vectors of known threat behaviors; Similarity calculation is performed on the operation feature vector and each attack pattern attribute operation feature vector in the attack pattern library; A similarity threshold is configured, and target attack pattern attributes with a similarity greater than the similarity threshold are screened; A multi-dimensional risk feature weight system is constructed, the multi-dimensional risk feature weight system setting feature weights for the target attack pattern attributes through an analytic hierarchy process, and the screened target attack pattern attributes are weighted and aggregated to calculate the suspiciousness score.

8. The data security dynamic assessment system of claim 3, wherein, The specific steps of generating the comprehensive risk score include: A standard operation sequence conforming to a baseline model probability distribution is generated through Monte Carlo simulation, and a state transition probability deviation between an actual observation sequence and the standard operation sequence is calculated using a time series difference analysis technique; A deviation degree of the number of operations per unit time from a mean value of the number of operations in the same period of historical operation data is calculated through a standardization method to generate a data access frequency feature value; The frequency and proportion of a sensitive operation set in the observation sequence are monitored to generate a sensitive operation feature value; An operation time window interval is divided, a difference degree of the proportion of the number of operations in each interval from the operation distribution in the corresponding period of the baseline model is calculated to generate an operation time window feature value; The state transition probability deviation, the data access frequency feature value, the sensitive operation feature value and the operation time window feature value are normalized, and a comprehensive risk score is generated through weighting.

9. The data security dynamic assessment system of claim 1, wherein, The specific steps of performing access permission management on the permission monitoring terminal device include: A suspected terminal device in the virtual access environment is subjected to a cooperative control mechanism of network isolation and access restriction; A compliant terminal device in the virtual access environment is subjected to a progressive authentication process, a trusted environment migration is performed, and a compliant terminal device passing the enhanced authentication is included in the real access environment; A dynamic permission contraction strategy is implemented on the permission monitoring terminal device in the real access environment, a three-fold permission regulation is performed on the permission monitoring terminal based on the principle of least privilege, including network access control, data operation control and account permission management; A time window control mechanism is constructed for the permission monitoring terminal, a working period and a non-working period are divided, and differential rules are configured: resources in the permission range after contraction in the working period are open, resources in the non-working period are restricted through enhanced restriction strategies; cross-period access needs to be verified by a security strategy engine, and temporary access windows are granted through multi-factor authentication.

10. A data security dynamic protection method, implemented based on the data security dynamic evaluation system of any one of claims 1-9, characterized in that, The method comprises the following steps: Step S1: obtaining the hardware features and software environment features of the terminal device, generating a unique terminal device fingerprint, verifying the legality of the terminal device fingerprint to determine whether the terminal device is authorized, and implementing a differentiated access control strategy; Step S2: if authorized, obtaining access features, slicing the access features according to a preset time window and inputting the time sequence behavior model, generating a trust score by calculating the cosine similarity of the behavior sequence and the predicted sequence of the access features; constructing a Markov decision process model based on the trust score, dynamically selecting an authentication mode; combining authentication information, network types and geographic information, calculating an abnormal risk index by using a fuzzy analytic hierarchy process, and then distributing the terminal device to a real access environment or a virtual access environment; Step S3: if not authorized, starting an authentication registration process, generating a terminal device fingerprint bound to a user identity and storing the same, and distributing the terminal device to a virtual access environment; Step S4: classifying the terminal device by using a differentiated monitoring strategy, wherein the differentiated monitoring strategy is configured as follows: for a terminal device in a virtual access environment, classifying the terminal device by capturing operation data, constructing a time-ordered database, generating frequent sequence patterns, and matching the same with an attack pattern library to calculate a suspicious degree score; for a terminal device in a real access environment, classifying the terminal device by constructing a hidden Markov chain model to form a dynamic baseline, calculating a state transition probability deviation, and combining multi-dimensional features to construct an abnormal score system; Step S5: according to the classification result of the terminal device, managing the access authority of the authority monitoring terminal device by using a dynamic authority contraction strategy and a time window control mechanism.

Images