Risk asset analysis method based on longitudinal federated learning encryption aggregation algorithm

Abstract

The invention discloses a risky asset analysis method based on a longitudinal federated learning encryption aggregation algorithm. The method comprises the following steps: preprocessing risky asset data to obtain desensitized risky asset data; the method comprises the following steps: after a receiving party and a transmitting party perform homomorphic encryption and exchange on sample IDs of desensitization risk asset data for two times, taking an intersection by the transmitting party to obtain an aligned sample ID intersection set ciphertext; the receiver decrypts the ciphertext of the sample ID intersection set and performs label prediction and encryption to obtain an encrypted label value; selecting features associated with the risk assets from the risk asset data and setting weights; constructing a risk asset association analysis model and performing longitudinal federal encryption aggregation training to obtain an association analysis model; according to the trained correlation analysis model, calculating a total risk score and carrying out risk classification to form a risk classification result; and formulating risk coping strategies according to a risk assessment result, then performing priority ranking on the risk coping strategies, and preferentially processing risk assets with high total risk scores. The invention provides an efficient risk asset prediction and prevention means.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of risk asset analysis, and particularly relates to a risk asset analysis method based on a longitudinal federated learning encryption aggregation algorithm. BACKGROUND

[0002] In recent years, federated learning as a technology to solve the problem of data silos has been widely concerned and has begun to be applied in the fields of finance, medical monitoring and smart cities. The data privacy problem of multi-party analysis has a solid technical support. Through the longitudinal federated learning encryption aggregation algorithm, the encryption transmission and high-quality analysis and judgment of risk asset data are realized, and a high-quality and highly reliable risk host analysis model is provided.

[0003] With the continuous development of the Internet, network security problems have become increasingly serious, such as using malicious software, vulnerabilities, viruses and other attack means to invade network assets (referring to various devices used in computers or communication networks), which causes great harm to network asset users, so the demand for accurate and rapid risk analysis of network assets is increasing.

[0004] The existing network asset risk analysis is generally based on the method of fingerprint identification, which has the problems of single-point identification, high false alarm rate, low efficiency and inability to form a systematized problem, for example: the fingerprint detection based on NMAP mechanism is based on application feature identification, that is, single-point identification, which has certain misjudgment; the fingerprint identification based on DHCP protocol is for intranet PC and server, and the system version false alarm rate is high; the key technology fingerprint parameter identification based on HTTP protocol analysis is mainly for WEB fingerprint, and the fingerprint is single, which cannot meet the effect of overall and specific risk identification for many network assets in today's network environment.

[0005] Therefore, how to comprehensively, efficiently and accurately collect and analyze network asset data, and actively find security vulnerabilities and asset exposure risks existing in network assets, is a technical problem that needs to be solved. SUMMARY

[0006] The purpose of the present application is to provide a risk asset analysis method based on a longitudinal federated learning encryption aggregation algorithm, which realizes multi-party secure computing in a trusted execution environment through longitudinal federated learning, jointly trains a risk host analysis model, and provides a high-quality, safe and all-round risk host analysis means.

[0007] The technical scheme adopted by the present application is: The risk asset analysis method based on the longitudinal federated learning encryption aggregation algorithm comprises the following steps: Step 1, data collection and preprocessing: obtaining risk asset data prepared by each risk asset data holder participating in learning in a trusted execution environment, and performing data preprocessing in the trusted execution environment to obtain desensitized risk asset data; the risk asset data includes sample ID and corresponding risk asset characteristics; Step 2, the risk asset data holders of both parties exchange the sample IDs of their own desensitized risk asset data through two homomorphic encryptions, and the risk asset data holder as the sender performs an intersection operation on the aligned sample ID intersection set ciphertext; then the risk asset data holder as the receiver decrypts the sample ID intersection set ciphertext, performs label prediction and encryption to obtain the corresponding encrypted label value; Step 3, selecting features associated with risk assets from risk asset data according to risk asset analysis requirements, and setting weights for each feature, which reflect the importance of the feature in risk assessment; Step 4, constructing a risk asset correlation analysis model, and performing longitudinal federated encrypted aggregation training using the sample ID intersection set and the corresponding encrypted label value to obtain a correlation analysis model with accuracy meeting the requirements; Step 5, outputting a risk score according to the trained correlation analysis model, weighting and correcting the model prediction result based on the set feature weight to obtain a total risk score, and performing risk classification based on the total risk score to form a risk classification result.

[0008] Step 6, formulating corresponding risk response strategies according to the risk classification result (such as "high-risk assets") output by the correlation analysis model, and prioritizing the risk response strategies according to the severity and urgency of the risk assets, and processing the risk assets with high total risk scores first.

[0009] Further, step 1 specifically includes the following steps: Step 1-1, data collection: collecting risk correlation information of risk asset data from different data sources, and each risk asset data holder preparing risk asset data in a trusted execution environment; Further, the correlation information in step 1-1 includes access logs of assets, security event history records, supply chain information, component information, vulnerability assessment results, vulnerability information, and exposed port information.

[0010] Step 1-2, data cleaning: cleaning the data of both parties in the trusted execution environment and encrypting sensitive data to obtain risk asset data; Further, cleaning includes processing missing values, outliers, and duplicate values; sensitive data includes missing value filling values and outlier replacement values.

[0011] Steps 1-3, Data Conversion and Standardization: In a trusted execution environment, non-numerical data in the risk asset data is converted into numerical data and sensitive data is encrypted and protected. Then, the time series data is processed in a unified format to obtain de-identified risk asset data, and the de-identified risk asset data is statically stored and encrypted.

[0012] Furthermore, step 2 specifically includes the following steps: Step 2-1: The risk asset data holder, as the sender, performs homomorphic encryption on the de-identified risk asset data it holds to obtain a ciphertext, which is then sent to the risk asset data holder, as the receiver. Step 2-2: The risk asset data holder of the recipient sends the secondary ciphertext and the recipient ciphertext obtained by homomorphically encrypting the primary ciphertext and the de-identified risk asset data it holds to the risk asset data holder who is the sender. Steps 2-3: The risk asset data holder of the sender uses its own private key to decrypt the sender's secondary ciphertext and the receiver's ciphertext to obtain the sender's ciphertext and receiver's ciphertext encrypted by the receiver. The intersection operation is then performed to obtain the ciphertext of the aligned sample ID set of both parties and sent to the risk asset data holder of the receiver. Steps 2-4: The risk asset data holder of the recipient uses its own private key to decrypt the ciphertext to obtain the sample ID set IDAB, and performs prediction to obtain the tag value. Then, it encrypts the tag value and sends it to the risk asset data holder of the sender.

[0013] Furthermore, the weights of the features in step 3 are determined through expert evaluation, historical data analysis, or machine learning methods.

[0014] Furthermore, step 4 specifically includes the following steps: Step 4-1: The risk asset data holder, as the sender, calculates the residual Res based on the intersection set of sample IDs using encrypted tag values, and then sends the homomorphically encrypted residual along with the corresponding sample ID to the risk asset data holder, as the receiver. Furthermore, the method for calculating the encrypted residual in step 4-1 is as follows: Step 4-1-1, Data preparation: Extract the locally stored feature data from the intersection of sample IDs, and call the preset prediction model to generate the initial risk prediction value; Step 4-1-2, Encryption operation: Load the recipient's public key using the Paillier encryption library, perform homomorphic encryption subtraction to subtract the encryption prediction value from the encryption tag; output the encrypted residual data packet with timestamp; Step 4-1-3, Secure Transmission: Transmit data through a two-way TLS encrypted channel, and attach a digital signature to ensure data integrity.

[0015] Step 4-2: The sender and receiver calculate their respective local gradients grad and loss based on the residual Res, and then encrypt their respective local gradients grad and loss using the third party's public key before sending them to the third party. Furthermore, the local gradient calculation operation process of the sender in step 4-2 is as follows: Step 4-2-1: Receive the encrypted residual data packet; Step 4-2-2: Calculate the feature layer gradient using automatic differentiation in a GPU-accelerated environment, and calculate the regularization loss component (L2 regularization). Step 4-2-3, Encryption Processing: Call the third-party public key encryption interface to generate encrypted gradient data packets and encrypted loss values.

[0016] Furthermore, the receiver's local gradient calculation operation process (within the TEE environment) in step 4-2 is as follows: Step 4-2-11, in the SGX enclave: briefly decrypt the residual data (memory dwell time < 100ms), and use the XGBoost gradient boosting algorithm to calculate the classification layer gradient; Step 4-2-12, Re-encrypt: Use the hardware security module to generate a temporary session key, encrypt it, and send it to a third party through a dedicated channel.

[0017] Step 4-3: After the third party decrypts the local gradient grad and loss ciphertext using its own private key, it aggregates the gradients using a vertical federated cryptographic aggregation algorithm based on the gradient descent method in order to obtain updated correlation analysis model parameters. Furthermore, step 4-3 specifically includes the following steps: Step 4-3-1, Decryption Processing: The private key is decrypted within the HSM hardware security module, and the operation log is written to the blockchain auditing system in real time; Step 4-3-2, Gradient Fusion: Weights are allocated according to the ratio of the data volume of both parties (e.g., 6:4), and gradient pruning is performed to prevent numerical overflow; Step 4-3-3, Parameter Update: The parameters are adjusted using an adaptive optimization algorithm, and the learning rate decays exponentially with each training round.

[0018] Step 4-4: The third party will encrypt the updated correlation analysis model parameters into updated parameter ciphertext using the third party's private key and send it to the risk asset data holders of the sender and receiver respectively, so as to update their respective model parameters. Specifically, step 4-4 has the following technical advantages: Secure decryption: The sender (A) and receiver (B) decrypt the received encrypted parameters using a third-party public key within a Trusted Execution Environment (TEE) and verify the legitimacy of the source through digital signature.

[0019] Partition update model: The sender only updates the parameters of the feature extraction layer, and the receiver only updates the parameters of the classifier layer (such as the top decision layer). The parameters of the two sides are physically isolated, making it impossible to infer the other's model.

[0020] Security protection: Decryption and updates are completed in the TEE encrypted memory, and plaintext parameters are destroyed immediately after the operation; data transmission adopts the TLS encryption protocol throughout the entire process.

[0021] Collaborative validation: Both parties calculate their local loss values ​​and submit them to a third party in encrypted form. The third party aggregates the global loss values ​​to determine the model's convergence. If the convergence is not met, a new round of training is triggered.

[0022] Steps 4-5 involve iteratively training the association analysis model and using cross-validation to verify its performance until the accuracy meets the requirements.

[0023] Specifically, during the iterative training of the association analysis model, a dynamic convergence judgment mechanism is first used to control training termination: the system continuously tracks the loss value of the last 5 training rounds, calculates its moving average, and automatically stops training when the loss change rate drops below one in ten thousand or the number of training rounds exceeds a preset limit (e.g., 100 rounds). Simultaneously, a federated cross-validation method is used to ensure model performance: the encrypted sample set is securely divided into 5 fixed subsets, and 4 subsets are selected in turn for training in each iteration, with the remaining subset serving as the validation set; validation predictions are performed under encrypted conditions, and the validation results from each round are integrated through secure aggregation technology to finally calculate core indicators such as overall accuracy. This process is repeated until the model accuracy reaches the business requirement threshold (e.g., 95%). During this period, all data interactions are transmitted through a TLS encrypted channel, and the validation results are decrypted by a third-party institution and fed back to the participants, forming a secure closed-loop iterative optimization mechanism.

[0024] Furthermore, in step 5, the risk score output by the correlation analysis model is directly used as the core input of the total risk score. The weighted summation algorithm is used to sum the scores of all features to obtain the total risk score of the asset. The formula is: Total Risk Score = Σ(Risk Score × Feature Weight). A risk threshold is set according to business needs and risk tolerance. Assets exceeding the threshold are judged as risky assets.

[0025] Furthermore, the correlation analysis model in step 5 performs the following steps: Step 5-1, Initial Risk Score Generation: Using the asset feature vector as model input, an initial risk score of 0 to 1 is generated through the Sigmoid activation function of the output layer. Specifically, the initial risk score is cached in real time to the Redis cluster, with an automatic expiration mechanism every 5 minutes, and query permissions are strictly restricted through access control lists (ACLs) to ensure data security and timeliness.

[0026] Step 5-2, Dynamic Weight Correction: The dynamic correction engine loads the feature weight table from the configuration center (e.g., default weight of vulnerability severity 30%, exposed port 20%, historical events 10%), performs 0-1 range standardization on numerical features, and converts categorical features into one-hot encoding; it applies additional weights to key features based on preset weights, and strictly controls the correction range within ±0.15 points through a limiting mechanism to avoid excessive deviation from the original model prediction; Step 5-3, Risk Classification Determination: Based on the risk score data of the past 90 days, after removing the top 5% outliers, the mean and standard deviation are calculated using a 30-day moving window. The assets are classified according to risk based on the mean and standard deviation to form the risk classification result.

[0027] Specifically, the risk assessment system dynamically calculates the threshold: based on the risk score data of the past 90 days, after removing the top 5% of outliers, a 30-day moving window is used to calculate the mean and standard deviation. Three-level classification is performed: (1) High risk (red alert): assets with a score exceeding "mean + 1.5 times standard deviation"; (2) Medium risk (yellow alert): assets between "mean + 0.7 times standard deviation" and "mean + 1.5 times standard deviation"; (3) Low risk (green normal): assets below "mean + 0.7 times standard deviation".

[0028] When identifying risky assets, the overall risk score and risk threshold are combined to determine which assets are risky. Simultaneously, supplementary judgment criteria, such as the importance of the asset and the severity of the security incident, are considered to further confirm and classify risky assets. Furthermore, the output of a vertical federated cryptographic aggregation algorithm can be used to make a more accurate assessment of risky assets.

[0029] Furthermore, step 6 specifically includes the following steps: Step 6-1, Graded Strategy Formulation: Dynamically match a pre-set strategy library based on the high-risk, medium-risk, and low-risk assessment results output by the correlation analysis model. Specifically, the pre-configured policy library in step 6-1 includes: triggering immediate isolation, vulnerability patching and port closure for high-risk assets within 24 hours; initiating 72-hour vulnerability patching and weekly scanning for medium-risk assets; performing regular patching and monthly auditing for low-risk assets; the policy library achieves intelligent matching through knowledge graphs, supporting the automatic generation of disposal action sequences based on asset type (such as server / network device).

[0030] Step 6-2, Multi-dimensional Priority Ranking: The weighted comprehensive scoring mechanism is used to calculate the disposal priority, the assets are divided into three-level response queues, and disposal work orders with countdowns are generated in real time and synchronized to the operation and maintenance system; Specifically, in step 6-2, risk score accounts for 70% of the weighting in priority calculation, asset value accounts for 20%, and business criticality accounts for 10%. The system automatically divides assets into three response queues: Emergency Queue (overall score ≥ 0.9): automated robot response within 15 minutes; High Priority Queue (0.8 ≤ overall score < 0.9): security team processing within 2 hours; Regular Queue (overall score < 0.8): script-based handling within 24 hours. Step 6-3, Closed-loop monitoring and incremental optimization: Collect asset logs, vulnerability status and network traffic in real time through the security information platform, and store them in the data lake in an encrypted manner; daily monitoring data is used to generate weekly model performance reports to drive policy tuning; Specifically, in steps 6-3, incremental learning starts every Sunday at 2 AM: 1. Load encrypted feedback data (including manually labeled false positives / false negatives); 2. Lightweight training updates only the classifier layer parameters; 3. Release the new model to the A / B testing environment to verify its effectiveness; Step 6-4, Drift Adaptive Model Iteration: Perform data drift detection at midnight on the first day of each month, randomly select a specified proportion of asset features to compare with historical distribution, calculate feature difference degree and perform graded response based on difference degree.

[0031] Specifically, during data drift detection in steps 6-4, 10% of asset features are randomly selected and compared with historical distributions. The feature difference is calculated and a graded response is given: (1) <5% difference: record audit logs; (2) 5%-10% difference: trigger early warning notification; (3) >10% difference: automatically start full federated training (return to step 4) to form a closed loop of "monitoring-detection-retraining-deployment" to ensure that the model continuously adapts to changes in the threat environment.

[0032] Specifically, the training process described above can be simply described as follows: risk asset data holder A and risk asset data holder B each use their own samples for training, and obtain the corresponding parameters through encrypted transmission for parameter updates.

[0033] This invention employs the above technical solutions to design a privacy-preserving computation method for security analysis, specifically for approximate computation tasks. Key points: Data remains unchanged, model moves. A machine learning model is trained based on multi-party collaboration, but plaintext data is not exchanged. Existing cybersecurity incidents are trained using security analysis models from various parties. The trained model, after detection and analysis, is then integrated to form a new risk asset analysis model. While protecting enterprise asset information from leakage, multi-party participation in model training is coordinated to avoid potential data leakage risks for any party.

[0034] This invention designs a multi-party secure computation (MPC) system that enables real-time statistical analysis and aggregation of security data such as traffic and logs from multiple enterprises and organizations, effectively uncovering security vulnerabilities. The trusted execution environment eliminates concerns about unapproved malicious code and applications stealing data privacy.

[0035] This invention is applicable to scenarios involving multiple parties and with high requirements for data privacy protection. It is a risk host analysis system that integrates analysis, transmission, and operation. Multiple parties jointly train the risk asset analysis model, improving the accuracy of risk host analysis.

[0036] This invention aggregates risk asset data from multiple sources to train a risk asset analysis model, avoiding potential data leakage risks during transmission and achieving objective training results on experimental datasets. It improves the accuracy, reliability, and relevance of risk asset analysis results, providing efficient risk asset prediction and prevention tools for multiple participants. Attached Figure Description

[0037] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments; Fig. 1 This is a functional architecture diagram of the risk asset analysis method based on the vertical federated learning cryptographic aggregation algorithm of the present invention; Fig. 2 This is a flowchart illustrating the risk asset analysis method based on the vertical federated learning cryptographic aggregation algorithm of the present invention. Fig. 3 This is a flowchart illustrating the risk asset analysis method based on the vertical federated learning cryptographic aggregation algorithm of the present invention. Implementation

[0038] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings.

[0039] like Figs. 1 to 3 As shown in one example, this invention discloses a risk asset analysis method based on a vertical federated learning cryptographic aggregation algorithm, comprising the following steps: Step 1, Data Collection and Preprocessing: Obtain the risk asset data prepared by each risk asset data holder participating in the learning process in the Trusted Execution Environment, and perform data preprocessing in the Trusted Execution Environment to obtain de-identified risk asset data; the risk asset data includes sample ID and corresponding risk asset characteristics; Step 2: The risk asset data holders of both parties transmit their de-identified risk asset data sample IDs through two homomorphic encryptions and exchanges. The risk asset data holders who send the data then perform an intersection operation to obtain the ciphertext of the aligned sample ID intersection set. The risk asset data holders who receive the data then decrypt the ciphertext of the sample ID intersection set and perform tag prediction and encryption to obtain the corresponding encrypted tag value. Step 3: Select features associated with risk assets from the risk asset data according to the risk asset analysis needs, and set a weight for each feature. The weight reflects the importance of the feature in risk assessment. Step 4: Construct a risk asset correlation analysis model, and use the intersection set of sample IDs and the corresponding encrypted label values ​​to perform vertical federated encrypted aggregation training to obtain a correlation analysis model with accuracy that meets the requirements. Step 5: Output risk scores based on the trained association analysis model, and perform weighted correction on the model prediction results by combining the set feature weights to obtain the total risk score. Then, perform risk classification based on the total risk score to form the risk classification result.

[0040] Step 6: Based on the risk classification results (such as "high-risk assets") output by the correlation analysis model, formulate corresponding risk response strategies, and prioritize the risk response strategies according to the severity and urgency of the risk assets, giving priority to handling risk assets with high total risk scores.

[0041] Furthermore, step 1 specifically includes the following steps: Step 1-1, Data Collection: Collect risk association information of risk asset data from different data sources, and at the same time, collect risk asset data prepared by each risk asset data holder in a trusted execution environment; Furthermore, the associated information in step 1-1 includes asset access logs, security event history records, supply chain information, component information, vulnerability assessment results, vulnerability information, and exposed port information.

[0042] Step 1-2, Data Cleaning: Clean the data of both parties in a trusted execution environment and encrypt sensitive data to obtain risk asset data; Furthermore, cleaning includes handling missing values, outliers, and duplicate values; sensitive data includes filling in missing values ​​and replacing outliers.

[0043] Steps 1-3, Data Conversion and Standardization: In a trusted execution environment, non-numerical data in the risk asset data is converted into numerical data and sensitive data is encrypted and protected. Then, the time series data is processed in a unified format to obtain de-identified risk asset data, and the de-identified risk asset data is statically stored and encrypted.

[0044] Furthermore, step 2 specifically includes the following steps: Step 2-1: The risk asset data holder, as the sender, performs homomorphic encryption on the de-identified risk asset data it holds to obtain a ciphertext, which is then sent to the risk asset data holder, as the receiver. Step 2-2: The risk asset data holder of the recipient sends the secondary ciphertext and the recipient ciphertext obtained by homomorphically encrypting the primary ciphertext and the de-identified risk asset data it holds to the risk asset data holder who is the sender. Steps 2-3: The risk asset data holder of the sender uses its own private key to decrypt the sender's secondary ciphertext and the receiver's ciphertext to obtain the sender's ciphertext and receiver's ciphertext encrypted by the receiver. The intersection operation is then performed to obtain the ciphertext of the aligned sample ID set of both parties and sent to the risk asset data holder of the receiver. Steps 2-4: The risk asset data holder of the recipient uses its own private key to decrypt the ciphertext to obtain the sample ID set IDAB, and performs prediction to obtain the tag value. Then, it encrypts the tag value and sends it to the risk asset data holder of the sender.

[0045] Furthermore, the weights of the features in step 3 are determined through expert evaluation, historical data analysis, or machine learning methods.

[0046] Furthermore, step 4 specifically includes the following steps: Step 4-1: The risk asset data holder, as the sender, calculates the residual Res based on the intersection set of sample IDs using encrypted tag values, and then sends the homomorphically encrypted residual along with the corresponding sample ID to the risk asset data holder, as the receiver. Furthermore, the method for calculating the encrypted residual in step 4-1 is as follows: Step 4-1-1, Data preparation: Extract the locally stored feature data from the intersection of sample IDs, and call the preset prediction model to generate the initial risk prediction value; Step 4-1-2, Encryption operation: Load the recipient's public key using the Paillier encryption library, perform homomorphic encryption subtraction to subtract the encryption prediction value from the encryption tag; output the encrypted residual data packet with timestamp; Step 4-1-3, Secure Transmission: Transmit data through a two-way TLS encrypted channel, and attach a digital signature to ensure data integrity.

[0047] Step 4-2: The sender and receiver calculate their respective local gradients grad and loss based on the residual Res, and then encrypt their respective local gradients grad and loss using the third party's public key before sending them to the third party. Furthermore, the local gradient calculation operation process of the sender in step 4-2 is as follows: Step 4-2-1: Receive the encrypted residual data packet; Step 4-2-2: Calculate the feature layer gradient using automatic differentiation in a GPU-accelerated environment, and calculate the regularization loss component (L2 regularization). Step 4-2-3, Encryption Processing: Call the third-party public key encryption interface to generate encrypted gradient data packets and encrypted loss values.

[0048] Furthermore, the receiver's local gradient calculation operation process (within the TEE environment) in step 4-2 is as follows: Step 4-2-11, in the SGX enclave: briefly decrypt the residual data (memory dwell time < 100ms), and use the XGBoost gradient boosting algorithm to calculate the classification layer gradient; Step 4-2-12, Re-encrypt: Use the hardware security module to generate a temporary session key, encrypt it, and send it to a third party through a dedicated channel.

[0049] Step 4-3: After the third party decrypts the local gradient grad and loss ciphertext using its own private key, it aggregates the gradients using a vertical federated cryptographic aggregation algorithm based on the gradient descent method in order to obtain updated correlation analysis model parameters. Furthermore, step 4-3 specifically includes the following steps: Step 4-3-1, Decryption: The private key is decrypted within the HSM hardware security module, and the operation log is written to the blockchain audit system in real time; Step 4-3-2, Gradient fusion: Distribute weights according to the ratio of the data volume of both sides (e.g., 6:4), and perform gradient pruning to prevent numerical overflow; Step 4-3-3, Parameter Update: The parameters are adjusted using an adaptive optimization algorithm, and the learning rate decays exponentially with each training round.

[0050] Step 4-4: The third party will encrypt the updated correlation analysis model parameters into updated parameter ciphertext using the third party's private key and send it to the risk asset data holders of the sender and receiver respectively, so as to update their respective model parameters. Specifically, step 4-4 has the following technical advantages: Secure decryption: The sender (A) and receiver (B) decrypt the received encrypted parameters using a third-party public key within a Trusted Execution Environment (TEE) and verify the legitimacy of the source through digital signature.

[0051] Partition update model: The sender only updates the parameters of the feature extraction layer, and the receiver only updates the parameters of the classifier layer (such as the top decision layer). The parameters of the two sides are physically isolated, making it impossible to infer the other's model.

[0052] Security protection: Decryption and updates are completed in the TEE encrypted memory, and plaintext parameters are destroyed immediately after the operation; data transmission adopts the TLS encryption protocol throughout the entire process.

[0053] Collaborative validation: Both parties calculate their local loss values ​​and submit them to a third party in encrypted form. The third party aggregates the global loss values ​​to determine the model's convergence. If the convergence is not met, a new round of training is triggered.

[0054] Steps 4-5 involve iteratively training the association analysis model and using cross-validation to verify its performance until the accuracy meets the requirements.

[0055] Specifically, during the iterative training of the association analysis model, a dynamic convergence judgment mechanism is first used to control training termination: the system continuously tracks the loss value of the last 5 training rounds, calculates its moving average, and automatically stops training when the loss change rate drops below one in ten thousand or the number of training rounds exceeds a preset limit (e.g., 100 rounds). Simultaneously, a federated cross-validation method is used to ensure model performance: the encrypted sample set is securely divided into 5 fixed subsets, and 4 subsets are selected in turn for training in each iteration, with the remaining subset serving as the validation set; validation predictions are performed under encrypted conditions, and the validation results from each round are integrated through secure aggregation technology to finally calculate core indicators such as overall accuracy. This process is repeated until the model accuracy reaches the business requirement threshold (e.g., 95%). During this period, all data interactions are transmitted through a TLS encrypted channel, and the validation results are decrypted by a third-party institution and fed back to the participants, forming a secure closed-loop iterative optimization mechanism.

[0056] Furthermore, in step 5, the risk score output by the correlation analysis model is directly used as the core input of the total risk score. The weighted summation algorithm is used to sum the scores of all features to obtain the total risk score of the asset. The formula is: Total Risk Score = Σ(Risk Score × Feature Weight). A risk threshold is set according to business needs and risk tolerance. Assets exceeding the threshold are judged as risky assets.

[0057] Furthermore, the correlation analysis model in step 5 performs the following steps: Step 5-1, Initial Risk Score Generation: Using the asset feature vector as model input, an initial risk score of 0 to 1 is generated through the Sigmoid activation function of the output layer. Specifically, the initial risk score is cached in real time to the Redis cluster, with an automatic expiration mechanism every 5 minutes, and query permissions are strictly restricted through access control lists (ACLs) to ensure data security and timeliness.

[0058] Step 5-2, Dynamic Weight Correction: The dynamic correction engine loads the feature weight table from the configuration center (e.g., default weight of vulnerability severity 30%, exposed port 20%, historical events 10%), performs 0-1 range standardization on numerical features, and converts categorical features into one-hot encoding; it applies additional weights to key features based on preset weights, and strictly controls the correction range within ±0.15 points through a limiting mechanism to avoid excessive deviation from the original model prediction; Step 5-3, Risk Classification Determination: Based on the risk score data of the past 90 days, after removing the top 5% outliers, the mean and standard deviation are calculated using a 30-day moving window. The assets are classified according to risk based on the mean and standard deviation to form the risk classification result.

[0059] Specifically, the risk assessment system dynamically calculates the threshold: based on the risk score data of the past 90 days, after removing the top 5% of outliers, a 30-day moving window is used to calculate the mean and standard deviation. Three-level classification is performed: (1) High risk (red alert): assets with a score exceeding "mean + 1.5 times standard deviation"; (2) Medium risk (yellow alert): assets between "mean + 0.7 times standard deviation" and "mean + 1.5 times standard deviation"; (3) Low risk (green normal): assets below "mean + 0.7 times standard deviation".

[0060] When identifying risky assets, the overall risk score and risk threshold are combined to determine which assets are risky. Simultaneously, supplementary judgment criteria, such as the importance of the asset and the severity of the security incident, are considered to further confirm and classify risky assets. Furthermore, the output of a vertical federated cryptographic aggregation algorithm can be used to make a more accurate assessment of risky assets.

[0061] Furthermore, step 6 specifically includes the following steps: Step 6-1, Graded Strategy Formulation: Dynamically match a pre-set strategy library based on the high-risk, medium-risk, and low-risk assessment results output by the correlation analysis model. Specifically, the pre-configured policy library in step 6-1 includes: triggering immediate isolation, vulnerability patching and port closure for high-risk assets within 24 hours; initiating 72-hour vulnerability patching and weekly scanning for medium-risk assets; performing regular patching and monthly auditing for low-risk assets; the policy library achieves intelligent matching through knowledge graphs, supporting the automatic generation of disposal action sequences based on asset type (such as server / network device).

[0062] Step 6-2, Multi-dimensional Priority Ranking: The weighted comprehensive scoring mechanism is used to calculate the disposal priority, the assets are divided into three-level response queues, and disposal work orders with countdowns are generated in real time and synchronized to the operation and maintenance system; Specifically, in step 6-2, risk score accounts for 70% of the weighting in priority calculation, asset value accounts for 20%, and business criticality accounts for 10%. The system automatically divides assets into three response queues: Emergency Queue (overall score ≥ 0.9): automated robot response within 15 minutes; High Priority Queue (0.8 ≤ overall score < 0.9): security team processing within 2 hours; Regular Queue (overall score < 0.8): script-based handling within 24 hours. Step 6-3, Closed-loop monitoring and incremental optimization: Collect asset logs, vulnerability status and network traffic in real time through the security information platform, and store them in the data lake in an encrypted manner; daily monitoring data is used to generate weekly model performance reports to drive policy tuning; Specifically, in steps 6-3, incremental learning starts every Sunday at 2 AM: 1. Load encrypted feedback data (including manually labeled false positives / false negatives); 2. Lightweight training updates only the classifier layer parameters; 3. Release the new model to the A / B testing environment to verify its effectiveness; Step 6-4, Drift Adaptive Model Iteration: Perform data drift detection at midnight on the first day of each month, randomly select a specified proportion of asset features to compare with historical distribution, calculate feature difference degree and perform graded response based on difference degree.

[0063] Specifically, during data drift detection in steps 6-4, 10% of asset features are randomly selected and compared with historical distributions. The feature difference is calculated and a graded response is given: (1) <5% difference: record audit logs; (2) 5%-10% difference: trigger early warning notification; (3) >10% difference: automatically start full federated training (return to step 4) to form a closed loop of "monitoring-detection-retraining-deployment" to ensure that the model continuously adapts to changes in the threat environment.

[0064] Specifically, the training process described above can be simply described as follows: risk asset data holder A and risk asset data holder B each use their own samples for training, and obtain the corresponding parameters through encrypted transmission for parameter updates.

[0065] The specific principles of this invention will be explained in detail below: Risk asset data holder A encrypts all its stored risk asset data IDs into EnA[IDA] and sends it to risk asset data holder B. EnA represents the encryption algorithm used by A (such as Paillier homomorphic encryption). To protect its data privacy, risk asset data holder A uses an encryption algorithm to encrypt sample IDs. Even if the encrypted ID (EnA[IDA]) is intercepted during transmission, it cannot be decrypted by unauthorized individuals, thus ensuring data security.

[0066] Risk asset data holder B encrypts the encrypted ID sent by risk asset data holder A together with its own risk asset data ID (plaintext IDB), resulting in EnB[EnA[IDA]] and EnB[IDB] respectively. It then sends both sets of ciphertexts to risk asset data holder A. EnB represents the encryption algorithm used by B (which could also be the Paillier homomorphic encryption algorithm).

[0067] Upon receiving the encrypted ID, risk asset data holder B, in order to further protect data privacy, uses its own encryption algorithm to encrypt both the received encrypted ID and its own plaintext ID a second time. This ensures that even if the encrypted data is intercepted during transmission, it cannot be decrypted, thus guaranteeing data security.

[0068] After receiving the ciphertext from risk asset data holder B, risk asset data holder A decrypts it using its private key, obtaining EnB[IDA] and EnB[IDB]. Based on homomorphic properties, the intersection of these two ciphertexts can be taken to obtain EnB[IDAB], i.e., sample alignment. Sample ID alignment has now been achieved. Risk asset data holder A then uses its own private key to decrypt the ciphertext, obtaining the encrypted ID from risk asset data holder B. Because a homomorphic encryption algorithm is used, risk asset data holder A can perform an intersection operation on the ciphertexts without decryption, thereby finding the shared sample ID between the two parties. This step achieves sample alignment, providing a foundation for subsequent joint modeling.

[0069] Risk asset data holder A sends the aligned ciphertext EnB[IDAB] to risk asset data holder B. B receives the ciphertext, decrypts it using its private key B to obtain IDAB, and encrypts it using its own sample's predicted label value to create EnB[Y]. This encrypted IDAB is then sent to A along with the corresponding IDAB. Upon receiving the aligned ciphertext, risk asset data holder B decrypts it using its private key to obtain the shared sample ID. Then, risk asset data holder B uses its own encryption algorithm to encrypt the predicted label value and sends the encrypted label value along with the corresponding sample ID to risk asset data holder A. This step ensures the security of the label value during transmission.

[0070] Risk asset data holder A obtains the residual (one ID corresponds to one Res) based on the received labels and sends the Res and corresponding IDs to risk asset data holder B. Upon receiving the encrypted label values, risk asset data holder A decrypts them using its private key to obtain the label values. Then, it calculates the residuals based on the model's predictions and the actual label values. The residuals reflect the accuracy of the model's predictions and are crucial parameters for subsequent model training. Risk asset data holder A then sends the residuals and the corresponding sample IDs to risk asset data holder B for subsequent joint training.

[0071] Risk asset data holder A calculates its own gradient (one gradient per feature), then encrypts the gradient, loss, and other parameters using the public key allocated by C before sending them to C. Similarly, risk asset data holder B, upon receiving the Res from risk asset data holder A, calculates its own gradient and other parameters, encrypts them using the public key, and sends them to C. During joint training, risk asset data holders A and B calculate local gradients (grad) and losses based on the residuals. These parameters reflect the optimization direction of the model in the current iteration. To protect data privacy, both parties encrypt these parameters using the public key allocated by third party C and send the encrypted parameters to C.

[0072] After receiving the ciphertexts EnC[gradA] and EnC[gradB] from risk asset data holders A and B, Party C decrypts them using its private key, updates the parameters, and then encrypts them again before returning them to risk asset data holders A and B (A and B only receive their own parameters). Upon receiving the encrypted gradient and other parameters, Party C decrypts them using its own private key. Then, it updates the model parameters using optimization algorithms such as gradient descent. The updated parameters are then encrypted again and returned to risk asset data holders A and B. This step ensures the security of the model parameters during transmission and updates.

[0073] Risk asset data holder A and risk asset data holder B update parameters to assess accuracy and determine whether to proceed to the next iteration. Upon receiving the updated parameters, risk asset data holders A and B use these parameters to update their local models and evaluate the model's accuracy. If the model's accuracy meets the preset requirements or reaches the maximum number of iterations, the iteration stops; otherwise, the next iteration of training continues.

[0074] In simple terms, the training process described above involves risk asset data holder A and risk asset data holder B each using their own samples for training, and obtaining corresponding parameters through encrypted data transmission for parameter updates.

[0075] In the longitudinal federated learning framework, risk asset data holders A and B each retain their own original data, exchanging intermediate results (such as gradients and losses) only through encryption. This approach protects data privacy while enabling joint training of the models. Through multiple rounds of iterative training, the model gradually converges to its optimal state.

[0076] Furthermore, secure multi-party computation (MPC) defines a collaborative computational task involving multiple parties, where each party possesses a copy of the input and ultimately receives only the function's output value, unaware of the input values ​​of other participants. Participants upload their data to a trusted execution environment (TEE) on a central server for processing, without fear of data privacy theft by unverified malicious code or applications. In vertical federated learning, participants only exchange intermediate results, not raw data. The proposed method allows for collaborative training of a risk asset analysis model without collecting all data from each participant. Collaborative multi-party training of the risk asset analysis model achieves impressive training results on experimental datasets. Technologies such as secure multi-party computation (MPC) and trusted execution environments (TEEs) provide security for vertical federated learning. Within the MPC framework, multiple parties can jointly execute computational tasks without disclosing their respective input data. TEE provides a secure execution environment, ensuring data privacy during processing. Vertical federated learning combines these technologies to achieve the goal of model training while protecting data privacy. By collaboratively training multiple parties, the data advantages of each party can be fully utilized, improving the model's accuracy and generalization ability.

[0077] This invention employs the above technical solutions to design a privacy-preserving computation method for security analysis, specifically for approximate computation tasks. Key points: Data remains unchanged, model moves. A machine learning model is trained based on multi-party collaboration, but plaintext data is not exchanged. Existing cybersecurity incidents are trained using security analysis models from various parties. The trained model, after detection and analysis, is then integrated to form a new risk asset analysis model. While protecting enterprise asset information from leakage, multi-party participation in model training is coordinated to avoid potential data leakage risks for any party.

[0078] This invention designs a multi-party secure computation (MPC) system that enables real-time statistical analysis and aggregation of security data such as traffic and logs from multiple enterprises and organizations, effectively uncovering security vulnerabilities. The trusted execution environment eliminates concerns about unapproved malicious code and applications stealing data privacy.

[0079] This invention is applicable to scenarios involving multiple parties and with high requirements for data privacy protection. It is a risk host analysis system that integrates analysis, transmission, and operation. Multiple parties jointly train the risk asset analysis model, improving the accuracy of risk host analysis.

[0080] This invention aggregates risk asset data from multiple sources to train a risk asset analysis model, avoiding potential data leakage risks during transmission and achieving objective training results on experimental datasets. It improves the accuracy, reliability, and relevance of risk asset analysis results, providing efficient risk asset prediction and prevention tools for multiple participants.

[0081] Obviously, the described embodiments are only a part of the embodiments of this application, not all of them. Without conflict, the embodiments and features in the embodiments of this application can be combined with each other. The components of the embodiments of this application described and illustrated herein can generally be arranged and designed in various different configurations. Therefore, the detailed description of the embodiments of this application is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

Claims

1. A risk asset analysis method based on a vertical federated learning cryptographic aggregation algorithm, characterized by: It includes the following steps: Step 1: Obtain the risk asset data prepared by each risk asset data holder participating in the learning in the trusted execution environment, and perform data preprocessing in the trusted execution environment to obtain de-identified risk asset data; Risk asset data includes sample IDs and corresponding risk asset characteristics; Step 2: The risk asset data holders of both parties transmit their de-identified risk asset data sample IDs through two homomorphic encryptions and exchanges. The risk asset data holders who send the data then perform an intersection operation to obtain the ciphertext of the aligned sample ID intersection set. The risk asset data holders who receive the data then decrypt the ciphertext of the sample ID intersection set and perform tag prediction and encryption to obtain the corresponding encrypted tag value. Step 3: Select features associated with risk assets from the risk asset data according to the risk asset analysis needs, and set a weight for each feature. The weight reflects the importance of the feature in risk assessment. Step 4: Construct a risk asset correlation analysis model, and use the intersection set of sample IDs and the corresponding encrypted label values ​​to perform vertical federated encrypted aggregation training to obtain a correlation analysis model with accuracy that meets the requirements. Step 5: Output risk scores based on the trained association analysis model, and perform weighted correction on the model prediction results by combining the set feature weights to obtain the total risk score. Then, perform risk classification based on the total risk score to form the risk classification result. Step 6: Formulate corresponding risk response strategies based on the risk classification results output by the correlation analysis model, and prioritize the risk response strategies according to the severity and urgency of the risk assets, giving priority to risk assets with high total risk scores.

2. The risk asset analysis method based on the vertical federated learning cryptographic aggregation algorithm according to claim 1, characterized in that: Step 1 specifically includes the following steps: Step 1-1, Data Collection: Collect risk association information of risk asset data from different data sources, and at the same time, collect risk asset data prepared by each risk asset data holder in a trusted execution environment; Step 1-2, Data Cleaning: Clean the data of both parties in a trusted execution environment and encrypt sensitive data to obtain risk asset data; Steps 1-3, Data Conversion and Standardization: In a trusted execution environment, non-numerical data in the risk asset data is converted into numerical data and sensitive data is encrypted and protected. Then, the time series data is processed in a unified format to obtain de-identified risk asset data, and the de-identified risk asset data is statically stored and encrypted.

3. The risk asset analysis method based on the vertical federated learning cryptographic aggregation algorithm according to claim 2, characterized in that: The associated information in step 1-1 includes asset access logs, security event history records, supply chain information, component information, vulnerability assessment results, vulnerability information, and exposed port information.

4. The risk asset analysis method based on the vertical federated learning cryptographic aggregation algorithm according to claim 2, characterized in that: The cleaning process in steps 1-2 includes handling missing values, outliers, and duplicate values; sensitive data includes filling in missing values ​​and replacing outliers.

5. The risk asset analysis method based on the vertical federated learning cryptographic aggregation algorithm according to claim 1, characterized in that: Step 2 specifically includes the following steps: Step 2-1: The risk asset data holder, as the sender, performs homomorphic encryption on the de-identified risk asset data it holds to obtain a ciphertext, which is then sent to the risk asset data holder, as the receiver. Step 2-2: The risk asset data holder of the recipient sends the secondary ciphertext and the recipient ciphertext obtained by homomorphically encrypting the primary ciphertext and the de-identified risk asset data it holds to the risk asset data holder who is the sender. Steps 2-3: The risk asset data holder of the sender uses its own private key to decrypt the sender's secondary ciphertext and the receiver's ciphertext to obtain the sender's ciphertext and receiver's ciphertext encrypted by the receiver. The intersection operation is then performed to obtain the ciphertext of the aligned sample ID set of both parties and sent to the risk asset data holder of the receiver. Steps 2-4: The risk asset data holder of the recipient uses its own private key to decrypt the ciphertext to obtain the sample ID set IDAB, and performs prediction to obtain the tag value. Then, it encrypts the tag value and sends it to the risk asset data holder of the sender.

6. The risk asset analysis method based on the longitudinal federated learning cryptographic aggregation algorithm according to claim 1, characterized in that: The weights of the features in step 3 are determined through expert evaluation, historical data analysis, or machine learning methods.

7. The risk asset analysis method based on the vertical federated learning cryptographic aggregation algorithm according to claim 1, characterized in that: Step 4 specifically includes the following steps: Step 4-1: The risk asset data holder, as the sender, calculates the residual Res based on the intersection set of sample IDs using encrypted tag values, and then sends the homomorphically encrypted residual along with the corresponding sample ID to the risk asset data holder, as the receiver. Step 4-2: The sender and receiver calculate their respective local gradients grad and loss based on the residual Res, and then encrypt their respective local gradients grad and loss using the third party's public key before sending them to the third party. Step 4-3: After the third party decrypts the local gradient grad and loss ciphertext using its own private key, it aggregates the gradients using a vertical federated cryptographic aggregation algorithm based on the gradient descent method in order to obtain updated correlation analysis model parameters. Step 4-4: The third party will encrypt the updated correlation analysis model parameters into updated parameter ciphertext using the third party's private key and send it to the risk asset data holders of the sender and receiver respectively. After decryption and verification using the third party's public key, the respective model parameters will be updated. Steps 4-5 involve iteratively training the association analysis model and using cross-validation to verify its performance until the accuracy meets the requirements.

8. The risk asset analysis method based on the longitudinal federated learning cryptographic aggregation algorithm according to claim 1, characterized in that: Step 5 uses the risk score output by the correlation analysis model as the core input of the total risk score. The weighted summation algorithm is used to sum the scores of all features to obtain the total risk score of the asset. The formula is: Total Risk Score = Σ(Risk Score × Feature Weight). A risk threshold is set according to business needs and risk tolerance. Assets exceeding the threshold are judged as risky assets.

9. The risk asset analysis method based on the longitudinal federated learning cryptographic aggregation algorithm according to claim 1 or 8, characterized in that: In step 5, the correlation analysis model performs the following steps: Step 5-1, Initial Risk Score Generation: Using the asset feature vector as model input, an initial risk score of 0 to 1 is generated through the Sigmoid activation function of the output layer. Step 5-2, Dynamic Weight Correction: The dynamic correction engine loads the feature weight table from the configuration center, performs 0-1 range standardization on numerical features, and converts categorical features into one-hot encoding; Additional weights are applied to key features based on preset weights, and the correction range is strictly controlled within ±0.15 points through a limiting mechanism; Step 5-3, Risk Classification Determination: Based on the risk score data of the past 90 days, after removing the top 5% outliers, the mean and standard deviation are calculated using a 30-day moving window. The assets are classified according to risk based on the mean and standard deviation to form the risk classification result.

10. The risk asset analysis method based on the longitudinal federated learning cryptographic aggregation algorithm according to claim 1, characterized in that: Step 6 specifically includes the following steps: Step 6-1, Graded Strategy Formulation: Dynamically match a pre-set strategy library based on the high-risk, medium-risk, and low-risk assessment results output by the correlation analysis model. Step 6-2, Multi-dimensional Priority Ranking: The weighted comprehensive scoring mechanism is used to calculate the disposal priority, the assets are divided into three-level response queues, and disposal work orders with countdowns are generated in real time and synchronized to the operation and maintenance system; Step 6-3, Closed-loop monitoring and incremental optimization: Collect asset logs, vulnerability status and network traffic in real time through the security information platform, and store them in the data lake in an encrypted manner; daily monitoring data is used to generate weekly model performance reports to drive policy tuning; Step 6-4, Drift Adaptive Model Iteration: Perform data drift detection at midnight on the first day of each month, randomly select a specified proportion of asset features to compare with historical distribution, calculate feature difference degree and perform graded response based on difference degree.

Images