Information security risk prediction method and system combined with big data analysis

Abstract

The application provides an information security risk prediction method and system combined with big data analysis, which first collects a historical security risk event set and a corresponding associated element set of an information system, analyzes the triggering association and parameter influence relationship between different events, constructs a risk transmission path network containing multiple risk transmission paths, then collects a current running state signal set and a current system task parameter set of the information system in real time, matches them with the triggering precondition and system parameter constraint in the risk transmission path network, screens out the activated risk transmission path and extracts the risk event node activation feature, and finally, based on the activated risk transmission path and the risk event node activation feature, in combination with the stage association of the information system task, deduces the risk event sequence, the associated relationship and the risk influence parameter change trend that may occur in subsequent different task stages, forms a security risk prediction result, and improves the accuracy and real-time performance of information security risk prediction.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and more specifically, to an information security risk prediction method and system that combines big data analysis. Background Technology

[0002] In today's digital age, information systems are widely used in various fields, from financial transactions to healthcare, making their security paramount. A security breach in an information system can lead to serious consequences such as data breaches, system crashes, and business interruptions, causing significant losses to businesses and users.

[0003] Currently, the prediction of information security risks mainly relies on traditional security protection technologies and rule-based expert systems. Traditional security protection technologies, such as firewalls and intrusion detection systems, primarily prevent known attacks by setting fixed rules, but they often struggle to effectively address unknown security risks and emerging attack methods. While rule-based expert systems can classify and handle security events based on pre-defined rules, the formulation of these rules typically depends on expert experience and historical cases, lacking in-depth analysis and mining of large amounts of historical security risk event data, making it difficult to comprehensively and accurately predict information security risks.

[0004] Furthermore, most existing information security risk prediction methods do not adequately consider the interrelationships between different task phases of an information system and the impact of changes in system parameters on risks. Information systems may face different security threats and risk factors at different task phases, and changes in system parameters may alter the risk transmission path. Summary of the Invention

[0005] In view of the aforementioned problems, and in conjunction with the first aspect of the present invention, embodiments of the present invention provide an information security risk prediction method combining big data analysis, the method comprising:

[0006] Collect a set of historical security risk events for the information system and a set of related elements corresponding to each historical security risk event;

[0007] Based on the set of historical security risk events and the set of related elements, the triggering associations and the influence relationships of related system parameters between different historical security risk events are analyzed. The descriptions of the preconditions and parameter constraints corresponding to the triggering associations are extracted, and the risk transmission path network is formed by connecting them in the order of triggering and the parameter constraint relationships. The risk transmission path network contains multiple risk transmission paths, and each risk transmission path contains sequentially associated risk event nodes, the triggering preconditions between nodes, and the system parameter constraints corresponding to the nodes.

[0008] Real-time acquisition of the current operating status signal set and the current system task parameter set of the information system;

[0009] The current running status signal set is associated with the triggering preconditions in the risk transmission path network, and the current system task parameter set is matched with the system parameter constraints in the risk transmission path network. Risk transmission paths that simultaneously satisfy the triggering preconditions and parameter constraints are selected as active risk transmission paths. Signal matching features and parameter matching features corresponding to each risk event node in the active risk transmission path are extracted and fused to generate risk event node activation features.

[0010] Based on the activation risk transmission path and the activation characteristics of the risk event nodes, and combined with the phase correlation of information system tasks, the sequence of risk events, the correlation of risk events, and the changing trend of risk impact parameters that may occur in different subsequent task phases of the information system are deduced, thus forming the security risk prediction result of the information system.

[0011] Furthermore, embodiments of the present invention also provide an information security risk prediction system that combines big data analysis, comprising:

[0012] A processor; a machine-readable storage medium for storing machine-executable instructions of the processor; wherein the processor is configured to execute the aforementioned information security risk prediction method incorporating big data analysis by executing the machine-executable instructions.

[0013] In another aspect, embodiments of the present invention also provide a computer program product, the computer program product including machine-executable instructions, the machine-executable instructions being stored in a computer-readable storage medium, a processor of a computer device reading the machine-executable instructions from the computer-readable storage medium, the processor executing the machine-executable instructions, causing the computer device to execute the aforementioned information security risk prediction method combined with big data analysis.

[0014] Based on the above, by collecting historical security risk event sets and their associated element sets of the information system, analyzing the triggering correlations and influence relationships of related system parameters among different historical security risk events, a risk transmission path network containing multiple risk transmission paths is constructed. This comprehensively uncovers the hidden risk transmission patterns in historical data. Then, the current operating status signal set and current system task parameter set of the information system are collected in real time and precisely matched with the triggering preconditions and system parameter constraints in the risk transmission path network. Activated risk transmission paths are selected and activation features of risk event nodes are extracted. This dynamic matching and feature extraction method can promptly capture the current security status of the information system, improving the real-time performance and accuracy of risk prediction. Based on the activation of risk transmission paths and the activation features of risk event nodes, combined with the stage correlation of information system tasks, the sequence of risk events, the correlation relationships of risk events, and the changing trends of risk impact parameters that may occur in different subsequent task stages of the information system are deduced, forming a comprehensive and accurate information system security risk prediction result, effectively solving the limitations of existing information security risk prediction methods. Attached Figure Description

[0015] Figure 1 This is a schematic diagram of the execution flow of the information security risk prediction method combining big data analysis provided in the embodiments of the present invention.

[0016] Figure 2 This is a schematic diagram of exemplary hardware and software components of the information security risk prediction system that combines big data analysis, provided in an embodiment of the present invention. Detailed Implementation

[0017] The present invention will now be described in detail with reference to the accompanying drawings. Figure 1 This is a flowchart illustrating an embodiment of the information security risk prediction method combining big data analysis provided by the present invention. The following is a detailed description of the information security risk prediction method combining big data analysis.

[0018] Step S110: Collect a set of historical security risk events of the information system and a set of associated elements corresponding to each historical security risk event. The set of historical security risk events includes data transmission risk events, data processing risk events, device access risk events, and data interpretation risk events. The set of associated elements includes a description of the risk triggering source, a description of the risk impact scope, a description of the risk handling process, and a description of the risk-related system parameters.

[0019] In this embodiment, an enterprise-level information management system is selected as the application scenario. This system covers functional modules such as the collection, transmission, processing, and output of daily business data. Security-related data needs to be obtained from the system's historical operation records. First, the system's security event repository is accessed. This repository integrates all recorded security risk events and related data since the system's inception. During the access process, the scope of data extraction is defined. This scope includes all recorded security risk events since the system's deployment, and covers security risk events corresponding to all business types supported by the system, such as financial data processing, customer information management, and supply chain data interaction.

[0020] By using the standard query interface provided by the security event repository, data extraction operations are performed to obtain all historical security risk events that fall within the aforementioned data extraction scope. Each extracted historical security risk event includes: an event occurrence identifier, used to uniquely identify the record location of the event in the repository; an event type identifier, used to distinguish whether the event belongs to a data transmission risk event, data processing risk event, device access risk event, or data interpretation risk event; an event occurrence time description, recording the specific time when the event began; an event end time description, recording the specific time when the event was completely resolved or terminated automatically; an event associated task identifier, indicating the specific business task the system was executing at the time the event occurred; an event description, detailing the phenomena and process of the event; and an event impact description, assessing the severity of the event's impact on system functionality, data security, and other aspects.

[0021] For example, step S111: Access the information system's security event repository, which contains all security risk events and related data recorded since the information system started operating, and set the data extraction range, which includes all security risk events within a specified time interval and security risk events corresponding to all system task types.

[0022] In the aforementioned enterprise-level information management system scenario, the security event repository adopts a distributed database architecture and is deployed on a dedicated server cluster within the system. Access operations are conducted through a pre-defined access permission verification mechanism; operators must be authenticated before calling the query interface. The data extraction scope is set by inputting corresponding parameters into the query interface. The specified time interval parameter is set to the period from the system's initial operating date to the current date to ensure the acquisition of all historical data; the system task type parameter is set to the "All" option to cover security risk events corresponding to all business types, including financial data processing, customer information management, and supply chain data interaction.

[0023] Step S112: Extract all historical security risk events that meet the data extraction range through the query interface of the security event repository. The historical security risk events include event occurrence identifier, event type identifier, event occurrence time description, event end time description, event associated task identifier, event description content, and event impact degree description.

[0024] After receiving the parameters, the query interface executes a data retrieval operation. During the retrieval process, the interface filters records within a specified time interval based on the event occurrence time description and matches all system task types based on the event-associated task identifier. The extracted historical security risk events are returned in a structured data format, where the event occurrence identifier is a string of letters and numbers, and the event type identifier is represented by a preset code, such as "001" representing a data transmission risk event and "002" representing a data processing risk event; both the event occurrence time description and the event end time description use standard time formats; the event-associated task identifier corresponds to a unique code for a business task within the system; the event description content is a detailed record in text format; and the event impact severity is described using levels such as "minor," "moderate," "serious," and "fatal."

[0025] Step S113: Assign a unique event number to each extracted historical security risk event. The event number includes a time code, a type code, and a sequence number code, which are used to uniquely distinguish different historical security risk events.

[0026] For each historical security risk event extracted from the security event repository, an event number is generated according to a preset encoding rule. The time encoding part extracts the year and month information from the event occurrence time description and converts it into a character combination in a specific format; the type encoding part is determined based on the event type identifier and uses another set of preset codes corresponding to the event type identifier; the sequence number encoding part is a numerical sequence that increments sequentially according to the order of event extraction or the order of event occurrence time, under the same combination of time and type encoding. The event number generated by the above combination method ensures that each historical security risk event has a unique identifier, avoiding confusion in subsequent processing.

[0027] Step S114: For each historical security risk event with an event number, extract the risk trigger source description corresponding to the historical security risk event from the security event repository. The risk trigger source description includes an external factor description and an internal factor description that caused the historical security risk event to occur. The external factor description involves external device access and network environment interference, while the internal factor description involves system module failure, operation process error, and improper parameter configuration.

[0028] For each historical security risk event with an assigned event number, the security event repository is accessed again to precisely query and extract the risk trigger source description corresponding to that event based on the event number. The risk trigger source description details the various factors that led to the event. External factors may involve external device access, such as unauthorized external storage devices accessing the system's data interface; network interference, such as abnormal data packet attacks from external networks or sudden large fluctuations in network bandwidth. Internal factors may involve system module failures, such as malfunctions of a subcomponent in the data processing module; operational errors, such as operators not following prescribed steps in data transmission; and improper parameter configuration, such as an unreasonable data transmission timeout threshold setting in the system.

[0029] Step S115: Extract the risk impact scope description corresponding to the historical security risk event. The risk impact scope description includes the system module identifier affected by the historical security risk event, the data type identifier affected by the historical security risk event, the business process identifier affected by the historical security risk event, and the task stage description affected by the historical security risk event. The system module identifier affected by the historical security risk event involves the equipment operation module, data transmission module, and data processing module. The data type identifier affected by the historical security risk event involves the raw collected data, processed data, and interpreted result data. The business process identifier affected by the historical security risk event involves the data acquisition process, data transmission process, and data processing process. The task stage description affected by the historical security risk event involves the data acquisition stage and the data interpretation stage.

[0030] Continuing with historical security risk events bearing event numbers, extract corresponding risk impact scope descriptions from the security event repository. These risk impact scope descriptions include affected system module identifiers, which correspond to specific functional modules within the system, such as the device operation module (responsible for handling interactions with external devices), the data transmission module (responsible for transmitting data between the system and external systems), and the data processing module (processing and calculating received data). Affected data type identifiers involve raw collected data (unprocessed data directly obtained from external data sources), processed data (intermediate or result data processed by the data processing module), and interpreted result data (directly usable data obtained after parsing data in a specific format or encoding). Affected business process identifiers correspond to various business processing flows within the system, such as the data acquisition flow, describing the complete steps for obtaining data from the data source; the data transmission flow, specifying the paths and rules for data transmission between system modules or with external systems; and the data processing flow, clarifying the specific operational steps for processing data. The affected task stage description indicates the specific stage of the business task the system was performing at the time of the event, such as the data acquisition stage (data collection in progress) and the data interpretation stage (parses the acquired data to extract useful information).

[0031] Step S116: Extract the risk handling process description corresponding to the historical security risk event. The risk handling process description includes a description of the handling measures taken for the historical security risk event, a description of the entity implementing the handling measures, a description of the time period during which the handling measures were implemented, a description of the steps in which the handling measures were implemented, and a description of the feedback on the handling effect. The description of the handling measures taken for the historical security risk event involves restarting system modules, adjusting parameter configurations, and replacing faulty equipment. The description of the feedback on the handling effect involves the problem resolution status, system recovery time, and subsequent operating status.

[0032] The risk handling process description corresponding to this historical security risk event is extracted from the security event repository. The handling measures description details the specific actions taken to address the event, such as restarting system modules (restoring a module to normal operation when it malfunctions), adjusting parameter configurations (modifying event-related parameter settings to eliminate the conditions that triggered the event), and replacing faulty equipment (replacing the faulty equipment if the event was determined to be caused by hardware failure). The handling measures execution entity description specifies the specific department or personnel performing these handling measures, such as the system maintenance team or network security emergency response team. The handling measures execution period description records the time interval from the start of handling measures to their completion. The handling measures execution steps description lists the specific operational procedures for performing the handling measures in chronological order, with each step having clear operational content and objectives. The handling effect feedback description evaluates the actual effectiveness of the handling measures, including problem resolution (whether the event was completely resolved or if any residual issues remain); system recovery time (the time taken from the completion of handling measures to the system returning to normal function); and subsequent operational status (whether the operation of related system modules or business processes remained stable for a period of time after the event handling).

[0033] Step S117: Extract the risk-related system parameter description corresponding to the historical security risk event. The risk-related system parameter description includes the data resolution parameter description, data band parameter description, data correction parameter description, data acquisition range parameter description, data processing accuracy parameter description, and parameter abnormal change description at the time the historical security risk event occurred.

[0034] Extract the risk-related system parameter descriptions corresponding to the historical security risk event from the security event repository. These descriptions contain information on various parameters related to data processing in the system at the time of the event. The data resolution parameter description records the resolution settings used by the system when processing data; the data band parameter description involves the band-related parameters used during data transmission or processing; the data correction parameter description specifies the parameter values ​​used when correcting the data; the data acquisition range parameter description clarifies the area covered by the data acquisition operation; and the data processing accuracy parameter description specifies the accuracy standards that the data processing results need to achieve. Furthermore, the parameter anomaly change description details whether any of the above parameters experienced abnormal fluctuations or exceeded their normal ranges during the event, along with the specific manifestations and timing of these anomalies.

[0035] Step S118: Combine the risk trigger source description, risk impact scope description, risk handling process description, and risk-related system parameter description of the same historical security risk event to form a set of related elements corresponding to the historical security risk event, and store the set of related elements in association with the event number, event occurrence time description, and event-related task identifier of the historical security risk event.

[0036] The risk trigger source description, risk impact scope description, risk handling process description, and risk-related system parameter description extracted from the same historical security risk event are integrated and combined into a complete data structure according to a preset format. This data structure is the set of related elements corresponding to this historical security risk event. Then, the set of related elements is associated with the event number, event occurrence time description, and event-related task identifier of the historical security risk event. The above association relationship and the set of related elements are stored together in a dedicated database table or data file so that the required information can be quickly and accurately obtained in subsequent operations such as risk analysis and path network construction.

[0037] Step S119: Classify and organize all historical security risk events and their corresponding related element sets, group them according to the event type identifier, event-related task type, and event occurrence time interval to form a structured historical security risk event set and its corresponding related element set, and establish a query index for event number and related element set.

[0038] All acquired historical security risk events and their corresponding sets of related elements are systematically categorized and organized. First, they are initially classified according to their event type identifiers, categorizing data transmission risk events, data processing risk events, device access risk events, and data interpretation risk events into different subcategories. Within each event type category, further subdivision is made based on the type of task associated with the event. For example, events related to financial data processing are grouped into one category, while those related to customer information management are grouped into another. Simultaneously, events can be grouped according to their occurrence time intervals, such as by year, quarter, or month. This categorization and organization creates a structured set of historical security risk events and their corresponding sets of related elements, making the data organization more orderly. Finally, a query index is established between event numbers and sets of related elements. This query index can be an index table in a database or an index file in a file system. Using the event number, the corresponding set of related elements can be quickly located and retrieved, improving the efficiency of subsequent data access.

[0039] Step S120: Based on the set of historical security risk events and the set of related elements, analyze the triggering associations and the influence relationships of related system parameters between different historical security risk events, extract the precondition descriptions and parameter constraints corresponding to the triggering associations, and connect them in the order of triggering and the parameter constraint relationships to form a risk transmission path network. The risk transmission path network contains multiple risk transmission paths, and each risk transmission path contains sequentially associated risk event nodes, preconditions between nodes, and system parameter constraints corresponding to the nodes.

[0040] Step S121: Extract the occurrence period description, end period description, and associated system task stage description of each historical security risk event from the set of historical security risk events. Based on the time overlap between the occurrence period description and the end period description, and combined with the sequential logic of the system task stages, determine the time-task stage association characteristics between different historical security risk events.

[0041] For each historical security risk event in the set of historical security risk events, the occurrence period description and the end period description are extracted from its corresponding event occurrence time description and event end time description. The occurrence period description starts from the time point in the event occurrence time description, and the end period description ends from the time point in the event end time description. At the same time, the system task stage description associated with the event is obtained from the business task information corresponding to the event-associated task identifier. The system task stage description indicates the specific stage the business task was in when the event occurred, such as the task preparation stage, data acquisition stage, data processing stage, etc.

[0042] By comparing the occurrence and termination times of different historical security risk events pairwise, it is determined whether there is a temporal overlap. If the occurrence and termination times of two events overlap on the timeline, it indicates a possible temporal correlation between the two events. Considering the sequential logic of system task phases—that is, business tasks typically proceed in the order of task preparation, equipment debugging, data acquisition, data transmission, data processing, data interpretation, and result output—it is analyzed whether overlapping events occur within the same or adjacent task phases. Based on these analyses, the time-task phase correlation characteristics between different historical security risk events are determined. These characteristics include descriptions of the degree of temporal overlap between events and their relationship within the task phases they occupy.

[0043] Step S122: Analyze the risk trigger source description and risk association system parameter description in the associated element set corresponding to each historical security risk event, and extract the core triggering factors in the risk trigger source description and the key influencing parameters in the risk association system parameter description. The core triggering factors include equipment operation behavior factors, data transmission protocol factors, data processing parameter factors, and data interpretation algorithm factors. The key influencing parameters include data resolution threshold parameters, data band compatibility parameters, and data correction error parameters.

[0044] For each historical security risk event, a set of associated elements is analyzed in depth, focusing on the descriptions of risk trigger sources and associated system parameters. When analyzing the risk trigger source descriptions, core triggering factors are identified and extracted. Equipment operation behavior factors focus on whether operators' actions on system equipment conform to standards, such as the order of operations and access permissions. Data transmission protocol factors involve whether the protocols used for data transmission have vulnerabilities and whether the configuration is correct. Data processing parameter factors refer to whether the parameters set during data processing are reasonable and whether they will affect the accuracy of the processing results or the stability of the system. Data interpretation algorithm factors consider whether the algorithms used for data interpretation have defects and whether they are suitable for the current type of data.

[0045] When analyzing the risk-related system parameter descriptions, key influencing parameters are extracted. The data resolution threshold parameter describes the upper and lower limits of the data resolution the system can handle; the data band compatibility parameter describes whether different data bands are compatible to ensure data is not distorted during processing or transmission; the data correction error parameter describes the allowable error range when correcting data, directly affecting data accuracy. Through this analysis process, the core triggering factors and key influencing parameters are determined for each historical security risk event.

[0046] Step S123: Compare the core triggering factors of different historical security risk events, identify historical security risk event groups with common core triggering factors, analyze the numerical correlation of key impact parameters corresponding to historical security risk events within the group, and determine the factor-parameter correlation characteristics between historical security risk events within the group.

[0047] By comparing the core triggering factors of all historical security risk events, those events sharing common core triggering factors are identified and grouped into a single historical security risk event group. For example, if multiple events all contain "unauthorized operation" as a core triggering factor in the equipment operation behavior factor, then these events are classified into the same event group.

[0048] For each group of historical security risk events, the numerical correlations between the key impact parameters corresponding to each event within the group are analyzed. For example, the values ​​of data resolution threshold parameters, data band compatibility parameters, and data correction error parameters of events within the group are compared to see if there are any trends or correlations. For instance, does an abnormal increase in a key impact parameter of one event lead to abnormal changes in related key impact parameters of another event? Based on these analyses, the factor-parameter correlation characteristics among historical security risk events within the group are determined. These characteristics describe the transmission or influence relationship of key impact parameters between different events under the influence of a common core triggering factor.

[0049] Step S124: Combining the time-task stage correlation features and the factor-parameter correlation features, determine the triggering correlation and parameter influence relationship between different historical security risk events, mark the preceding historical security risk events with triggering correlation as triggering source events, mark the subsequent historical security risk events as triggered events, and record the influence of the key influence parameters of the triggering source events on the key influence parameters of the triggered events.

[0050] The previously obtained time-task phase correlation features and factor-parameter correlation features are analyzed comprehensively. For historical security risk events that show time overlap and fall within related task phases in the time-task phase correlation features, the correlation between their core triggering factors and key influencing parameters in the factor-parameter correlation features is combined to determine whether a triggering correlation exists between these events. If the occurrence of one event creates conditions for or directly causes the occurrence of another event, then a triggering correlation is determined to exist between them.

[0051] Of two events that are related, the event that occurs first is marked as the source event, and the event that occurs later is marked as the triggered event. At the same time, the method by which the key influence parameters of the source event affect the key influence parameters of the triggered event is recorded in detail. For example, is the influence generated through the direct transmission of parameter values, through changing the trend of parameter changes, or through other indirect means?

[0052] Step S125: Extract the risk impact range description fragment and risk association system parameter description fragment related to the triggered event from the set of associated elements corresponding to the triggering source event. Combine the risk triggering source description and risk association system parameter description of the triggered event to form the precondition description and parameter constraint conditions corresponding to the trigger association. The precondition description includes the impact characteristics of the triggering source event and the triggering requirement characteristics of the triggered event. The parameter constraint conditions include the allowable value range description of the key impact parameters corresponding to the triggered event.

[0053] For the identified triggering events and the triggered events, extract the risk impact scope description and risk-related system parameter description from the set of associated elements corresponding to the triggering event. During the extraction process, select the descriptive fragments related to the triggered event, namely, the parts of the risk impact scope description that involve the system modules, data types, business processes, or task stages that the triggered event may affect; and the parts of the risk-related system parameter description that may affect the key impact parameters of the triggered event.

[0054] The extracted descriptive fragments are integrated and analyzed with the risk triggering source description and risk-related system parameter description of the triggered event itself. Based on the impact characteristics of the triggering source event (i.e., the specific impact of the triggering source event on the system) and the triggering requirement characteristics of the triggered event (i.e., the inherent conditions that must be met for the triggered event to occur), a description of the preconditions corresponding to the trigger association is compiled. Simultaneously, based on the key impact parameters of the triggered event, combined with relevant system requirements and historical data, the allowable value range of these key impact parameters is determined, and parameter constraints are compiled.

[0055] Step S126: Connect the trigger source event, the description of the precondition, the parameter constraint, and the triggered event in the order of triggering to form a basic risk transmission segment. Each basic risk transmission segment contains a trigger source event, a description of the precondition, a parameter constraint, and a triggered event.

[0056] Following the triggering order between the source event and the triggered event, the source event, the previously compiled precondition description, the parameter constraints, and the triggered event are sequentially linked together to form a basic risk transmission unit, namely, a basic risk transmission segment. In this segment, the source event is the starting point of risk transmission, the precondition description is the condition that the source event must meet to trigger the triggered event, the parameter constraints specify the limitation range of key influencing parameters when the triggered event occurs, and the triggered event is the result of risk transmission. Each basic risk transmission segment contains one and only one source event, one precondition description, one parameter constraint, and one triggered event, thus clearly demonstrating the risk transmission relationship between the two events.

[0057] Step S127: Summarize all basic risk transmission segments, identify the same triggered events and corresponding parameter constraints in different basic risk transmission segments, and splice other basic risk transmission segments with the same triggered event as the trigger source event and with the parameter constraints having an inheritance relationship with the original segments to form a longer risk transmission path containing multi-stage parameter constraints.

[0058] Summarize all the basic risk transmission segments formed through the above steps. Perform a comprehensive scan of these basic risk transmission segments to identify those with the same triggered event and corresponding identical parameter constraints. For these segments, further investigate whether other basic risk transmission segments use the same triggered event as the trigger source event, and whether the parameter constraints of these other segments have an inheritance relationship with the parameter constraints of the original segments. For example, the allowed value range of the parameter constraints may be refined or expanded based on the allowed value range of the parameter constraints of the original segments.

[0059] Other basic risk transmission segments that meet the above conditions are concatenated with the original basic risk transmission segment in the order of triggering. During concatenation, the triggered event of the original segment serves as the trigger source event for the new segment, and the preconditions, parameter constraints, and triggered event of the new segment are sequentially connected. Through the above concatenation operation, a longer risk transmission path containing multiple stage parameter constraints is formed. This risk transmission path can demonstrate the process of risk being transmitted from the initial trigger source event through multiple intermediate events to the final subsequent event.

[0060] Step S128: Analyze the transmission relationship of key impact parameters corresponding to each risk event node in each spliced ​​risk transmission path, and supplement the parameter transmission coefficient description. The parameter transmission coefficient description reflects the degree of influence of the key impact parameters of the preceding node on the key impact parameters of the subsequent node.

[0061] For each longer risk transmission path formed by splicing, the key impact parameters corresponding to each risk event node (including the triggering source event node and the triggered event node) in the path are analyzed. The focus is on the transmission relationship between the key impact parameters of preceding risk event nodes and the key impact parameters of subsequent risk event nodes, that is, how the key impact parameters of preceding nodes affect the key impact parameters of subsequent nodes.

[0062] Based on historical data and actual risk event cases, the degree of influence of key impact parameters of preceding nodes on key impact parameters of subsequent nodes is determined, and this degree of influence is supplemented into the risk transmission path in the form of parameter transfer coefficients. Parameter transfer coefficients can be expressed qualitatively or quantitatively. Qualitative methods include terms such as "significant impact," "moderate impact," and "minor impact," while quantitative methods include classifying the degree of influence through a certain numerical range. This description helps to understand the patterns of parameter changes and the strength of impact during risk transmission.

[0063] Step S129: Integrate all spliced ​​risk transmission paths, unspliced ​​basic risk transmission segments, and supplementary parameter transmission coefficient descriptions, assign a unique path identifier to each risk transmission path, mark the system task type adaptation range corresponding to the risk transmission path, and form a risk transmission path network.

[0064] All spliced ​​risk transmission paths, unspliced ​​basic risk transmission segments, and supplementary parameter transmission coefficient descriptions are uniformly integrated. Each integrated risk transmission path is assigned a unique path identifier, which can be a string of letters, numbers, or specific symbols, used to uniquely identify the path in subsequent risk prediction and other processes.

[0065] Simultaneously, based on the system task identifiers associated with the risk event nodes involved in each risk transmission path, the system task type adaptation range corresponding to that path is determined, i.e., which business task types the path is applicable to. The path identifiers and system task type adaptation ranges are then marked on the corresponding risk transmission paths. Finally, all marked risk transmission paths and basic risk transmission segments are combined to form a complete risk transmission path network. This network comprehensively reflects the transmission relationships and patterns among various risk events in the system.

[0066] Step S130: Real-time acquisition of the current operating status signal set and the current system task parameter set of the information system. The current operating status signal set includes equipment operation record signals, data transmission link signals, data processing interaction signals, and data interpretation feedback signals. The current system task parameter set includes task type parameters, data resolution parameters, data band parameters, and data correction parameters.

[0067] In the daily operation of an enterprise-level information management system, it is necessary to collect the system's current operating status and parameters of the currently executed tasks in real time. The collection objects of the current operating status signal set include: device operation log signals, which record various operations performed by operators on system devices, such as login operations, data query operations, and file transfer operations; data transmission link signals, which reflect the status of data transmission between various modules within the system and between the system and external devices, such as transmission rate, whether transmission is interrupted, and whether erroneous data packets have occurred; data processing interaction signals, which record the interaction between the data processing module and other modules in the system, such as task submission, processing progress feedback, and return of processing results; and data interpretation feedback signals, which reflect the results of the data interpretation module's data interpretation processing, such as whether the interpretation was successful and the accuracy assessment of the interpretation results.

[0068] The current system task parameter set includes the following parameters: task type parameter, indicating the specific business task type currently being executed by the system; data resolution parameter, the resolution setting used when processing data in the current task; data band parameter, the band-related parameters involved in data transmission or processing in the current task; and data correction parameter, the parameter values ​​used for data correction processing in the current task. A dedicated data acquisition module enables real-time acquisition of the above signals and parameters, and transmits the acquired data to subsequent processing modules in real time.

[0069] For example, step S131: Collect recording signals related to the operation of information system equipment according to the preset collection frequency and collection trigger conditions to form equipment operation recording signals. The collection trigger conditions include the initiation of equipment operation instructions and the feedback of equipment operation results. The equipment operation recording signals include descriptions of operation initiation subjects, operation object identifiers, operation instruction types, operation execution durations, operation result feedback, and operation abnormality prompts.

[0070] For the acquisition of equipment operation log signals, a preset acquisition frequency is first set. This preset acquisition frequency is determined according to the system's required level of detail in monitoring equipment operation behavior, such as acquiring data once per second or once every time an equipment operation occurs. Simultaneously, acquisition trigger conditions are set: acquisition is triggered when the equipment operation command is initiated, i.e., the moment the operator issues the operation command to the equipment; and acquisition is triggered again when the equipment operation result is fed back, i.e., when the equipment completes the operation and returns the operation result to the system.

[0071] During the data acquisition process, the following information about the device operation log signals is recorded: Operation Initiator Description: Records the identity information or account of the operator performing the operation; Operation Object Identifier Description: Specifies the specific device or functional module within the device to which the operation is performed; Operation Instruction Type Description: Describes the specific type of operation instruction, such as read data instruction, write data instruction, delete data instruction, etc.; Operation Execution Time Description: Records the time elapsed from the initiation of the operation instruction to the feedback of the operation result; Operation Result Feedback Description: Describes the result status, such as successful, failed, or partially successful operation; Operation Anomaly Prompt Description: Describes whether any abnormal situations occurred during the operation, and the specific manifestations of these abnormal situations.

[0072] Step S132: Capture link signals related to information system data transmission according to preset transmission signal capture rules to form data transmission link signals. The transmission signal capture rules include real-time monitoring of all transmission links and key capture of links whose transmitted data volume exceeds a preset threshold. The data transmission link signals include transmission link identification description, data sender identification description, data receiver identification description, data transmission direction description, data transmission time period description, transmitted data volume description, transmitted data type description, transmission stability description, and transmission error code description.

[0073] For the acquisition of data transmission link signals, a preset transmission signal capture rule is followed. This rule requires real-time monitoring of all data transmission links in the system to ensure that data transmission activity on all links can be captured. Simultaneously, links whose transmitted data volume exceeds a preset threshold are given priority for capture; this involves increasing the signal sampling frequency or capturing more detailed transmission information for these links. The preset threshold is set based on the normal data transmission volume range of the system. When the transmitted data volume of a link exceeds this threshold per unit time, it is identified as a link requiring focused attention.

[0074] The data transmission link signal includes the following: a transmission link identifier description, used to uniquely identify a data transmission link in the system; a data sender identifier description, indicating the sender of the data, which may be a module within the system or an external device; a data receiver identifier description, indicating the receiver of the data; a data transmission direction description, indicating whether the data transmission is unidirectional or bidirectional from the sender to the receiver; a data transmission period description, recording the start and end times of data transmission; a data volume description, summarizing the total amount of data transmitted within the transmission period; a data type description, specifying the specific type of data transmitted, such as text data, image data, audio data, etc.; a transmission stability description, assessing whether the data transmission process is stable and whether frequent interruptions or delays occur; and a transmission error code description, recording the error codes that occur during data transmission, with each error code corresponding to a specific transmission error type.

[0075] Step S133: Acquire interactive signals related to data processing in the information system to form data processing interactive signals. The acquisition process includes data interaction related to data processing task scheduling, and synchronously acquires the initiation and completion signals of data processing tasks. The data processing interactive signals include an interaction initiation module identifier, an interaction receiving module identifier, a processing task type description, a processing parameter setting description, a processing progress feedback description, a processing result quality description, a processing time description, and a processing exception log description.

[0076] When acquiring data processing interaction signals, the system encompasses various data interaction processes related to data processing task scheduling. In the system, when a data processing task needs to be executed, the task scheduling module interacts with the data processing module, at which point it begins acquiring interaction signals. Simultaneously, it also acquires the task initiation signal (the signal indicating the task has started execution) and the completion signal (the signal indicating the task has finished executing).

[0077] The data processing interaction signals include: an interaction initiating module identifier, recording the module that initiated the data processing interaction request, such as the task scheduling module or the user terminal module; an interaction receiving module identifier, indicating the module that receives the interaction request and executes the data processing task; a processing task type description, specifying the specific type of data processing task, such as data cleaning, data statistics, or data mining; a processing parameter setting description, recording the parameters set when executing the processing task, such as processing thresholds and processing algorithm selection; a processing progress feedback description, reflecting the real-time progress of task processing, such as 30% complete or 50% complete; a processing result quality description, assessing whether the processing result meets the expected quality standards; a processing time description, recording the time spent from task initiation to task completion; and a processing exception log, describing any exceptions that occur during task processing, including detailed log information such as the time of occurrence, the exception phenomenon, and the cause of the exception.

[0078] Step S134: Obtain feedback signals related to data interpretation in the information system to form data interpretation feedback signals. The acquisition process includes running status and result feedback signals related to the execution of the interpretation algorithm. The data interpretation feedback signals include a description of the interpretation task identifier, a description of the interpretation algorithm type, a description of the interpretation data source, a description of the interpretation result accuracy, a description of the interpretation error prompt, a description of the interpretation completion time period, and a description of the interpretation result correction record.

[0079] When acquiring data interpretation feedback signals, an interface is established with the data interpretation module in the system to obtain real-time running status signals during the execution of the interpretation algorithm and result feedback signals after execution. The interpretation task identifier uniquely identifies the currently executing interpretation task; the interpretation algorithm type description specifies the specific algorithm used in the interpretation task, such as rule-based interpretation algorithms, statistical interpretation algorithms, etc.; the interpretation data source description indicates the acquisition method of the interpretation data, such as from an internal database, external data interface, or local file; the interpretation result accuracy description assesses the accuracy of the interpretation result, usually compared with a preset accuracy standard; the interpretation anomaly prompt description indicates whether any anomalies occurred during the interpretation process, such as algorithm errors or data format incompatibility; the interpretation completion time description records the time interval from the start to the end of the interpretation task; and the interpretation result correction record describes whether corrections were made if the interpretation result did not meet the expected accuracy, and the specific operations and content of the corrections.

[0080] Step S135: Collect parameter information corresponding to the system task currently being executed by the information system to form a current system task parameter set. The collection process includes connection interactions related to task planning and parameter configuration. The current system task parameter set includes task type parameters, data resolution parameters, data band parameters, data correction parameters, data acquisition range parameters, data processing accuracy requirement parameters, and task completion time limit parameters.

[0081] When collecting the current system task parameter set, it interacts with the system's task planning module and parameter configuration module. Through interaction with the task planning module, it obtains the task type parameter, which specifies the task's specific business category. Through interaction with the parameter configuration module, it obtains the data resolution parameter, i.e., the resolution setting of the data being processed by the current task; the data band parameter, the band parameter related to data transmission or processing in the current task; the data correction parameter, the parameter value used for data correction processing; the data acquisition range parameter, which specifies the boundary of the data acquisition range for the current task; the data processing accuracy requirement parameter, which specifies the accuracy standard that the data processing result must achieve; and the task completion deadline parameter, which sets the deadline that the current task must complete. Combining the above obtained parameter information forms the current system task parameter set.

[0082] Step S136: Sort the collected device operation record signals, data transmission link signals, data processing interaction signals, and data interpretation feedback signals according to the signal acquisition timestamps to generate a time-series-based set of current system task parameters.

[0083] For the collected device operation log signals, data transmission link signals, data processing interaction signals, and data interpretation feedback signals, the acquisition timestamp of each signal is extracted. This timestamp records the specific time the signal was acquired. All signals are then uniformly sorted according to the chronological order of their acquisition timestamps, forming a time series. The sorted signals are then associated with the current system task parameter set to generate a time-series-based current system task parameter set. The parameter information in this set is consistent with the corresponding signals in time, facilitating subsequent analysis of the dynamic relationship between the system's operating status and task parameters.

[0084] Step S140: Associate the current running status signal set with the triggering preconditions in the risk transmission path network, and match the current system task parameter set with the system parameter constraints in the risk transmission path network. Select risk transmission paths that simultaneously satisfy the triggering preconditions and parameter constraints as active risk transmission paths. Extract the signal matching features and parameter matching features corresponding to each risk event node in the active risk transmission path, and fuse them to generate active features for risk event nodes.

[0085] Step S141: Analyze the triggering preconditions and system parameter constraints contained in each risk transmission path in the risk transmission path network, and extract the key feature items in each triggering precondition and the key parameter items in each system parameter constraint. The key feature items include operation behavior feature items, transmission link feature items, processing interaction feature items, and interpretation feedback feature items. The key parameter items include resolution adaptation parameter items, band compatibility parameter items, and correction error parameter items.

[0086] Each risk transmission path in the risk transmission path network is analyzed, with a focus on the triggering preconditions and system parameter constraints they contain. For triggering preconditions, key feature items are extracted, which are the key basis for determining whether the current operating state meets the triggering conditions. Operational behavior feature items focus on characteristics related to equipment operation, such as operation type and operation sequence; transmission link feature items involve characteristics of data transmission links, such as link identification and transmission stability; processing interaction feature items reflect characteristics in the data processing interaction process, such as interaction modules and processing task types; interpretation feedback feature items include characteristics of data interpretation feedback, such as interpretation result accuracy and anomaly prompts.

[0087] For system parameter constraints, key parameters are extracted. Resolution adaptation parameters specify adaptation requirements related to data resolution; band compatibility parameters clarify compatibility conditions between data bands; and correction error parameters set the allowable range for data correction errors. These key features and parameters are extracted.

[0088] Step S142: Separate the device operation record signal, data transmission link signal, data processing interaction signal, and data interpretation feedback signal from the current operating status signal set, and extract the feature information from each signal to form the device operation feature set, transmission link feature set, processing interaction feature set, and interpretation feedback feature set.

[0089] Step S1421: Perform signal classification preprocessing on the current operating status signal set to remove invalid interference segments from the signals. The invalid interference segments include blank signal segments with no actual operation records, silent signal segments with no data transmission records, idle signal segments with no processing interaction records, and unresponsive signal segments with no interpretation feedback records.

[0090] Before separating various signals from the current operating status signal set, signal classification preprocessing is performed. All signal segments in the current operating status signal set are traversed, and invalid interference segments are identified and removed. These include: blank signal segments with no actual operation records (segments without any device operation records); silent signal segments with no data transmission records (segments corresponding to time periods without data transmission activity in the data transmission link); idle signal segments with no processing interaction records (segments where the system is idle and no processing interaction activity exists); and unresponsive signal segments with no interpretation feedback records (segments where the data interpretation module did not return any interpretation feedback). Removing these invalid interference segments improves the accuracy and efficiency of subsequent signal separation and feature extraction.

[0091] Step S1422: Based on the signal source identifier and signal content characteristics, the preprocessed signals are divided into four categories: device operation record signals, data transmission link signals, data processing interaction signals, and data interpretation feedback signals. The signal source identifier includes the device operation module identifier, data transmission module identifier, data processing module identifier, and data interpretation module identifier.

[0092] After preprocessing to remove invalid interference segments, the signals are classified according to their source identifiers. These source identifiers are automatically added by the system when the signal is generated and indicate which system module the signal originates from. For example, a device operation module identifier indicates the signal originates from the device operation module, a data transmission module identifier indicates the signal originates from the data transmission module, a data processing module identifier corresponds to the data processing module, and a data interpretation module identifier corresponds to the data interpretation module.

[0093] Simultaneously, auxiliary classification is performed based on signal content characteristics. For example, signals containing operation instructions or results are classified as device operation record signals; those containing transmission link information or data transmission and reception information are classified as data transmission link signals; those containing task processing interaction information are classified as data processing interaction signals; and those containing decoding result feedback information are classified as data decoding feedback signals. Through these methods, the pre-processed signals are accurately divided into four categories.

[0094] Step S1423: For the equipment operation record signal, extract the operation initiator description, operation object identification description, operation instruction type description, operation execution duration description, and operation result feedback description from the signal. Arrange the operation initiator description, operation object identification description, operation instruction type description, operation execution duration description, and operation result feedback description in the order of operation occurrence time to form a equipment operation feature sequence. Each equipment operation feature sequence corresponds to one equipment operation process, and multiple equipment operation feature sequences form a equipment operation feature set.

[0095] For each categorized device operation log signal, the following descriptions are extracted: operation initiator description, operation object identifier description, operation command type description, operation execution duration description, and operation result feedback description. Then, these extracted descriptive information items are arranged sequentially according to the order in which the operations occurred, forming a device operation feature sequence. Each device operation feature sequence corresponds to a complete device operation process in the system, from operation initiation to operation result feedback. All of the above device operation feature sequences are combined to form a device operation feature set.

[0096] Step S1424: For the data transmission link signal, extract the transmission link identifier description, data sender identifier description, data receiver identifier description, data transmission direction description, data transmission period description, data transmission volume description, data transmission type description, and transmission stability description from the signal. Arrange the transmission link identifier description, data sender identifier description, data receiver identifier description, data transmission direction description, data transmission period description, data transmission volume description, data transmission type description, and transmission stability description in the order of transmission occurrence time to form a transmission link feature sequence. Each transmission link feature sequence corresponds to one data transmission process, and multiple transmission link feature sequences form a transmission link feature set.

[0097] The data transmission link signal is processed to extract the following descriptions: transmission link identifier, data sender identifier, data receiver identifier, data transmission direction, data transmission time period, data volume, data type, and transmission stability. These descriptions are then arranged chronologically to form a transmission link feature sequence, with each sequence corresponding to a complete data transmission process. Multiple transmission link feature sequences together constitute a transmission link feature set.

[0098] Step S1425: For the data processing interaction signal, extract the interaction initiating module identifier, interaction receiving module identifier, processing task type description, processing parameter setting description, processing progress feedback description, processing result quality description, and processing time description from the signal. Arrange the interaction initiating module identifier, interaction receiving module identifier, processing task type description, processing parameter setting description, processing progress feedback description, processing result quality description, and processing time description in the order of interaction occurrence time to form a processing interaction feature sequence. Each processing interaction feature sequence corresponds to one data processing interaction process, and multiple processing interaction feature sequences form a processing interaction feature set.

[0099] Extract the following information from the data processing interaction signals: interaction initiation module identifier, interaction receiving module identifier, processing task type description, processing parameter setting description, processing progress feedback description, processing result quality description, and processing time description. Arrange these descriptions in chronological order of interaction occurrence to form a processing interaction feature sequence, with each sequence corresponding to one data processing interaction flow. Multiple processing interaction feature sequences constitute a processing interaction feature set.

[0100] Step S1426: For the data interpretation feedback signal, extract the interpretation task identifier description, interpretation algorithm type description, interpretation data source description, interpretation result accuracy description, interpretation anomaly prompt description, and interpretation completion time period description from the signal. Arrange the interpretation task identifier description, interpretation algorithm type description, interpretation data source description, interpretation result accuracy description, interpretation anomaly prompt description, and interpretation completion time period description in the order of interpretation occurrence time to form an interpretation feedback feature sequence. Each interpretation feedback feature sequence corresponds to one data interpretation process, and multiple interpretation feedback feature sequences form an interpretation feedback feature set.

[0101] For data interpretation feedback signals, extract the following descriptions: interpretation task identifier, interpretation algorithm type, interpretation data source, interpretation result accuracy, interpretation anomaly message, and interpretation completion time. Arrange these descriptions in chronological order of interpretation occurrence to form an interpretation feedback feature sequence, with each sequence corresponding to one data interpretation process. Multiple interpretation feedback feature sequences constitute an interpretation feedback feature set.

[0102] Step S143: Extract the parameter value descriptions corresponding to the key parameter items from the current system task parameter set to form the current parameter set, which includes the current resolution parameter description, the current band parameter description, and the current correction error parameter description.

[0103] Based on the key parameters extracted from the system parameter constraints, such as resolution adaptation parameters, band compatibility parameters, and correction error parameters, the corresponding parameter values ​​are extracted from the current system task parameter set. The extracted current resolution parameter description (the resolution setting value for the current task), current band parameter description (the band-related parameter values ​​in the current task), and current correction error parameter description (the data correction error parameter values ​​in the current task) are combined to form the current parameter set.

[0104] Step S144: Associate and compare the feature information in the device operation feature set with the operation behavior feature items in the trigger preconditions to extract matching operation feature fragments; Associate and compare the feature information in the transmission link feature set with the transmission link feature items in the trigger preconditions to extract matching transmission feature fragments; Associate and compare the feature information in the processing interaction feature set with the processing interaction feature items in the trigger preconditions to extract matching interaction feature fragments; Associate and compare the feature information in the interpretation feedback feature set with the interpretation feedback feature items in the trigger preconditions to extract matching interpretation feature fragments.

[0105] Step S1441: For each device operation feature sequence in the device operation feature set, extract the operation initiator description, operation object identifier description, operation instruction type description, operation execution duration description, and operation result feedback description from the device operation feature sequence one by one, and compare them with the operation behavior feature items in the triggering preconditions.

[0106] Iterate through each device operation feature sequence in the device operation feature set. For each sequence, extract the following descriptions in sequence: operation initiator description, operation object identifier description, operation instruction type description, operation execution duration description, and operation result feedback description. Compare each extracted description with the specific requirements of the operation behavior feature items in the trigger preconditions to check for any matches.

[0107] Step S1442: If any segment of the description in the device operation feature sequence is completely consistent with the corresponding description in the operation behavior feature item, or if the segment of the description contains the core elements of the corresponding description of the operation behavior feature item and there is no contradictory information, then the segment of the description is marked as a candidate operation feature segment, and the position of the candidate operation feature segment in the device operation feature sequence and the corresponding operation occurrence time are recorded.

[0108] During the comparison process, if a segment of description in the device operation feature sequence is completely identical to the corresponding description in the operation behavior feature item, or if the segment, while not identical, contains the core elements of the corresponding description of the operation behavior feature item and does not contain any information contradicting the core elements, then the segment is marked as a candidate operation feature fragment. Simultaneously, the specific position of this candidate operation feature fragment in the device operation feature sequence is recorded, such as its position within the sequence's elements, and the time of the operation corresponding to that fragment, for subsequent analysis.

[0109] Step S1443: Summarize the candidate operation feature fragments in all device operation feature sequences to form a matching operation feature fragment.

[0110] The candidate operation feature segments marked in all device operation feature sequences are summarized, and duplicate or redundant segments are removed to finally form matching operation feature segments. The above segments are the parts of the device operation feature set that match the operation behavior feature items that trigger the preconditions.

[0111] Step S1444: For each transmission link feature sequence in the transmission link feature set, extract the transmission link identifier description, data sender identifier description, data receiver identifier description, data transmission direction description, data transmission time period description, and data transmission type description from the transmission link feature sequence one by one, and compare them with the transmission link feature items in the triggering preconditions.

[0112] Each transmission link feature sequence in the transmission link feature set is processed, and the transmission link identifier description, data sender identifier description, data receiver identifier description, data transmission direction description, data transmission time period description, and data transmission type description are extracted one by one. These descriptions are then compared item by item with the requirements of each transmission link feature item in the triggering preconditions.

[0113] Step S1445: If any segment of the description in the transmission link feature sequence is completely consistent with the corresponding description in the transmission link feature item, or if the segment of the description matches the corresponding description in the transmission link feature item in terms of key information and there is no conflict in the secondary information, then the segment of the description is marked as a candidate transmission feature segment, and the position of the candidate transmission feature segment in the transmission link feature sequence and the corresponding transmission occurrence time are recorded.

[0114] During the comparison, if a segment of the description in the transmission link feature sequence is completely consistent with the corresponding description in the transmission link feature item, or if the segment of the description matches the corresponding description in the transmission link feature item in terms of key information, such as the transmission link identifier, data sender and receiver identifiers, but there is no conflict in secondary information, such as the specific details of the transmitted data, then the segment of the description is marked as a candidate transmission feature segment, and its position in the sequence and the time of transmission are recorded.

[0115] Step S1446: Summarize the candidate transmission feature segments in all transmission link feature sequences to form a matching transmission feature segment.

[0116] Candidate transmission feature segments from all transmission link feature sequences are aggregated, and after filtering and deduplication, matching transmission feature segments are formed.

[0117] Step S1447: For each processing interaction feature sequence in the processing interaction feature set, extract the interaction initiating module identifier, interaction receiving module identifier, processing task type description, processing parameter setting description, and processing result quality description from the processing interaction feature sequence one by one, and compare them with the processing interaction feature items in the triggering preconditions.

[0118] For each processing interaction feature sequence in the processing interaction feature set, extract the interaction initiating module identifier, interaction receiving module identifier, processing task type description, processing parameter setting description, and processing result quality description, and compare them item by item with the processing interaction feature items in the triggering preconditions.

[0119] Step S1448: If any segment of the description in the processing interaction feature sequence is completely consistent with the corresponding description in the processing interaction feature item, or if the description of the processing task type and the description of the processing parameter settings in the segment meet the core requirements of the processing interaction feature item, then the segment is marked as a candidate interaction feature fragment, and the position of the candidate interaction feature fragment in the processing interaction feature sequence and the corresponding interaction occurrence time are recorded.

[0120] If a segment of the processing interaction feature sequence is completely consistent with the corresponding description of the processing interaction feature item, or if the description of the processing task type and the description of the processing parameter settings meet the core requirements of the processing interaction feature item, then it is marked as a candidate interaction feature segment, and its position and the time of interaction are recorded.

[0121] Step S1449: Summarize all candidate interaction feature fragments in the processed interaction feature sequences to finally form the matched interaction feature fragments.

[0122] All candidate interaction feature fragments in the processed interaction feature sequences are aggregated and then processed to form matching interaction feature fragments.

[0123] Step S14410: For each interpretation feedback feature sequence in the interpretation feedback feature set, extract the interpretation task identifier description, interpretation algorithm type description, interpretation result accuracy description, and interpretation anomaly prompt description from the interpretation feedback feature sequence one by one, and compare them with the interpretation feedback feature items in the triggering preconditions item by item.

[0124] For each interpretation feedback feature sequence in the interpretation feedback feature set, extract the interpretation task identifier description, interpretation algorithm type description, interpretation result accuracy description, and interpretation anomaly prompt description, and compare them item by item with the interpretation feedback feature items in the triggering preconditions.

[0125] Step S14411: If any segment of the description in the interpretation feedback feature sequence is completely consistent with the corresponding description in the interpretation feedback feature item, or if the interpretation algorithm type description and the interpretation error message description in the segment meet the key requirements of the interpretation feedback feature item, then the segment is marked as a candidate interpretation feature fragment, and the position of the candidate interpretation feature fragment in the interpretation feedback feature sequence and the corresponding interpretation completion time are recorded.

[0126] If a segment of the interpretation feedback feature sequence is completely consistent with the corresponding description of the interpretation feedback feature item, or if the interpretation algorithm type description and interpretation anomaly prompt description in the segment meet the key requirements of the interpretation feedback feature item, then it is marked as a candidate interpretation feature segment, and its position and interpretation completion time are recorded.

[0127] Step S14412: Summarize all candidate interpretation feature fragments in the interpretation feedback feature sequences to form matching interpretation feature fragments.

[0128] Summarize all candidate interpretation feature fragments from the interpretation feedback feature sequences to form a matching interpretation feature fragment.

[0129] Step S145: Combine the matched operation feature fragments, transmission feature fragments, interaction feature fragments, and interpretation feature fragments to form a signal matching set corresponding to the triggering precondition. If the signal matching set contains the matching fragments corresponding to all key feature items in the triggering precondition, then it is determined that the triggering precondition is satisfied.

[0130] The extracted matching operation feature fragments, transmission feature fragments, interaction feature fragments, and interpretation feature fragments are combined to form a signal matching set corresponding to the trigger precondition. It is then checked whether this signal matching set contains matching fragments corresponding to all key feature items in the trigger precondition, i.e., operation behavior feature items, transmission link feature items, processing interaction feature items, interpretation feedback feature items, etc. If all are included, the trigger precondition is determined to be satisfied.

[0131] Step S146: Compare the current resolution parameter description in the current parameter set with the resolution adaptation parameter item in the system parameter constraints to determine whether the current resolution parameter description is within the allowable value range of the resolution adaptation parameter item; compare the current band parameter description with the band compatibility parameter item to determine whether the current band parameter description meets the requirements of the band compatibility parameter item; compare the current correction error parameter description with the correction error parameter item to determine whether the current correction error parameter description is within the allowable value range of the correction error parameter item; if all key parameter items meet the requirements, then the system parameter constraints are determined to be satisfied.

[0132] The system compares the current resolution parameter description in the current parameter set with the resolution adaptation parameter in the system parameter constraints to check if the current resolution parameter is within the allowed value range specified by the resolution adaptation parameter. It then compares the current band parameter description with the band compatibility parameter to determine if the current band parameter meets the requirements of the band compatibility parameter, such as compatibility with other related band parameters. Finally, it compares the current correction error parameter description with the correction error parameter to check if the current correction error parameter is within the allowed value range of the correction error parameter. Only when the comparison results for all key parameter items meet the requirements is the system parameter constraint considered satisfied.

[0133] Step S147: Filter out all risk transmission paths that simultaneously contain both the met triggering preconditions and the met system parameter constraints, and mark all risk transmission paths that simultaneously contain both the met triggering preconditions and the met system parameter constraints as active risk transmission paths.

[0134] All risk propagation paths in the risk propagation path network are screened, and each path is checked to see if both the triggering preconditions and system parameter constraints are met. Risk propagation paths that simultaneously meet both conditions are marked as active risk propagation paths, indicating that under the current system operating state and task parameters, the risk on these paths may propagate.

[0135] Step S148: For each risk event node in each activated risk transmission path, extract the signal matching set associated with the triggering preconditions corresponding to the risk event node and the current parameter set fragment associated with the system parameter constraints corresponding to the risk event node. Associate the feature fragments in the signal matching set with the historical feature descriptions of the risk event node, and extract the overlapping feature parts as signal matching features. Associate the current parameter set fragments with the historical parameter descriptions of the risk event node, and extract the degree of fit of the parameter values ​​as parameter matching features.

[0136] For each risk event node in each activated risk transmission path, based on the triggering preconditions corresponding to that node, find the associated signal matching set; based on the system parameter constraints corresponding to that node, extract the associated current parameter set fragment. Perform correlation analysis between the feature fragments in the signal matching set and the historical feature descriptions of that risk event node, identifying the overlapping feature portions, and using these overlapping portions as the signal matching features of that node. Correlate the current parameter set fragments with the historical parameter descriptions of that risk event node, analyze the degree of fit between the current and historical parameters, and extract the descriptions of this degree of fit as parameter matching features.

[0137] Step S149: Based on the overlapping feature part in the signal matching feature and the matching degree description in the parameter matching feature, combined with the position of the risk event node in the activation risk transmission path and the parameter transmission coefficient description in the path, generate risk event node activation features that include feature overlap description, parameter matching degree description, position correlation degree description and parameter influence degree description.

[0138] The composite signal matching features, specifically the overlapping feature portion (feature overlap description), reflect the degree of overlap between the current signal and historical features. The parameter matching features, specifically the matching degree description (parameter matching degree description), indicate the matching status between the current parameters and historical parameters. The position of the risk event node in the activation risk transmission path, specifically the positional correlation description, illustrates the node's importance or stage within the path. Finally, the parameter transmission coefficient description within the path, specifically the parameter influence description, reflects the degree of influence of preceding node parameters on the current node's parameters. Combining these descriptions generates the risk event node activation feature, which comprehensively reflects the probability and influencing factors of the risk event node being activated under current conditions.

[0139] Step S150: Based on the activated risk transmission path and the activation characteristics of the risk event nodes, and combined with the phase correlation of the information system tasks, deduce the possible risk event sequences, risk event correlations, and risk impact parameter change trends that may occur in different subsequent task phases of the information system, and form the information system security risk prediction results.

[0140] Step S151: Determine the standard phase division of the information system task and form a task phase sequence. The task phase sequence includes the task preparation phase, equipment debugging phase, data acquisition phase, data transmission phase, data processing phase, data interpretation phase, and result output phase. Describe the core task description of each task phase and the connection conditions between phases.

[0141] Based on the information system's business processes and functional modules, the standard phases of the task are determined. The task preparation phase mainly involves task planning and resource allocation; the equipment debugging phase involves checking and debugging relevant equipment to ensure its normal operation; the data acquisition phase collects the data required for the task; the data transmission phase transmits the collected data to the designated processing module; the data processing phase processes and analyzes the data; the data interpretation phase interprets the processed data and extracts useful information; and the result output phase outputs the interpreted results in an appropriate format. Simultaneously, the core tasks of each phase are described, as well as the transition conditions between phases, such as the data acquisition phase only proceeding after the equipment debugging phase is completed and the equipment is in normal working order.

[0142] Step S152: Traverse each activated risk transmission path, record the order of risk event nodes in the activated risk transmission path, the activation characteristics of each risk event node, and the system task stage associated with the risk event node, and establish the correspondence between risk event nodes and task stages.

[0143] Each activated risk propagation path is traversed, recording the order of risk event nodes in the path (i.e., the chronological order in which risk events occur); the activation characteristics of each risk event node; and the system task stage associated with that risk event node (i.e., in which task stage the risk event at that node might occur). Based on these records, a correspondence between risk event nodes and task stages is established, clarifying in which task stage each risk event node might appear.

[0144] Step S153: For each activated risk transmission path, extract the last risk event node of the activated risk transmission path, mark the risk event node as the current termination risk node, determine the current task stage corresponding to the current termination risk node, and search in the risk transmission path network for all subsequent risk transmission path segments that are triggered by the current termination risk node and are compatible with subsequent task stages.

[0145] For each activated risk propagation path, find the last risk event node in the path and mark it as the current termination risk node. Based on the previously established correspondence, determine the current task stage corresponding to the current termination risk node. Then, search the risk propagation path network for all risk propagation path segments that use the current termination risk node as the triggering source event, and ensure that these segments fit into subsequent task stages after the current task stage.

[0146] Step S154: Associate the triggering preconditions in the subsequent risk transmission path segments with the current operating state signal set, and match the system parameter constraints in the subsequent risk transmission path segments with the current system task parameter set and the expected parameter change descriptions of the subsequent task stages. Extract the signal matching features and parameter matching features corresponding to the subsequent risk transmission path segments. Combine the risk event node activation features of the current termination risk node and the parameter transmission coefficient descriptions in the subsequent risk transmission path segments to determine the activation probability features of the subsequent risk transmission path segments.

[0147] Step S1541: Analyze the triggering preconditions in the subsequent risk transmission path segments, and extract the key feature items contained in the triggering preconditions. The key feature items include operation behavior feature items, transmission link feature items, processing interaction feature items, and interpretation feedback feature items.

[0148] The triggering preconditions in subsequent risk transmission path segments are analyzed to extract key feature items. These key feature items are consistent with the previously mentioned operational behavior feature items, transmission link feature items, processing interaction feature items, and interpretation feedback feature items, and are the key basis for determining whether the triggering conditions are met.

[0149] Step S1542: Extract signal segments corresponding to key feature items from the current running state signal set, combine them with the core task description of the subsequent task stage, predict the new signal features that the core task may generate, and add them to the signal segments to form an extended signal segment set.

[0150] Based on key features, corresponding signal segments are extracted from the current operating state signal set. Simultaneously, combined with the core task description of subsequent task phases, new signal features that may be generated during the execution of this core task are predicted, such as specific equipment operation signals and data transmission signals. These predicted new signal features are then added to the extracted signal segments to form an expanded signal segment set.

[0151] Step S1543: Compare the signal segments in the extended signal segment set with the key feature items of the triggering precondition, extract the matching signal segments, form the subsequent signal matching set, and generate the subsequent signal matching degree feature based on the number of matching segments, the matching completeness, and the adaptability of the added signal features in the subsequent signal matching set. The subsequent signal matching degree feature includes a description of the number of matching segments, a description of the matching completeness of the segments, and a description of the adaptability of the added features.

[0152] The signal segments in the extended signal segment set are compared with the key feature terms of the triggering preconditions to extract matching signal segments, forming a subsequent signal matching set. Based on the number of matching segments in the subsequent signal matching set (i.e., how many segments match), the matching completeness (i.e., the degree of matching between each matching segment and the key feature term), and the adaptability of the newly added signal features (i.e., the degree of adaptability between the predicted newly added signal features and the key feature terms), subsequent signal matching degree features are generated.

[0153] Step S1544: Analyze the system parameter constraints in the subsequent risk transmission path segment, and extract the key parameter items contained in the system parameter constraints. The key parameter items include resolution adaptation parameter items, band compatibility parameter items, and correction error parameter items.

[0154] The system parameter constraints in the subsequent risk transmission path segments are analyzed, and key parameter items are extracted, such as resolution adaptation parameters, band compatibility parameters, and correction error parameters.

[0155] Step S1545: Extract the current parameter descriptions corresponding to the key parameter items from the current system task parameter set, combine them with the expected parameter change descriptions of subsequent task stages, deduce the expected parameter ranges of the key parameter items in subsequent task stages, and form an expected parameter description set.

[0156] Extract the current parameter descriptions corresponding to the key parameter items from the current system task parameter set, and combine them with the expected parameter change descriptions for subsequent task stages, such as the possible trends of parameter increase, decrease, or stability, to deduce the expected parameter ranges for key parameter items in subsequent task stages, thus forming an expected parameter description set.

[0157] Step S1546: Merge the parameter ranges in the current parameter description and the expected parameter description set to form a parameter prediction set. Compare the parameter prediction set with the key parameter items of the system parameter constraints to determine whether the parameter prediction set meets the allowable value range requirements of the key parameter items. Generate subsequent parameter matching degree features, which include the current parameter fit description, the expected parameter adaptability description, and the parameter change compatibility description.

[0158] The parameter ranges in the current parameter description and the expected parameter description set are merged, and the changes in the current and expected parameters are comprehensively considered to form a parameter prediction set. This parameter prediction set is compared with the key parameter items of the system parameter constraints to determine whether they meet the allowable value range requirements. Based on the degree of fit between the current parameters and the key parameter items (current parameter fit description), the degree of fit between the expected parameters and the key parameter items (expected parameter fit description), and the compatibility between the parameter change trend and the key parameter item constraints (parameter change compatibility description), subsequent parameter matching features are generated.

[0159] Step S1547: Extract the feature overlap description, parameter fit description, location correlation description, and parameter influence description from the risk event node activation features of the current termination risk node. Perform correlation calculations with the fragment matching completeness description and the newly added feature fit description from the subsequent signal matching degree features to generate feature correlation values.

[0160] From the activation features of the risk event nodes of the current termination risk node, extract feature overlap description, parameter fit description, location correlation description, and parameter influence description. Correlate the feature overlap description with the fragment matching completeness description and the new feature fit description from the subsequent signal matching degree features. For example, generate feature correlation values ​​by comprehensively evaluating overlap, completeness, and fit, which reflect the degree of correlation between the current node features and the signal features of subsequent paths.

[0161] Step S1548: Perform correlation calculations between the parameter fit description, parameter influence description, and the current parameter fit description, expected parameter fit description, and parameter change compatibility description in the subsequent parameter matching feature. Combine this with the parameter transmission coefficient description in the subsequent risk transmission path segment to generate parameter correlation values.

[0162] The parameter fit description, parameter influence description, and the current parameter fit description, expected parameter fit description, and parameter change compatibility description in the subsequent parameter matching feature are correlated and calculated. Then, combined with the parameter transmission coefficient description in the subsequent risk transmission path segment, a parameter correlation value is generated, which reflects the degree of correlation between the current node parameter and the subsequent path parameter constraints.

[0163] Step S1549: Based on the feature correlation value, parameter correlation value, and the number of matching segments in the subsequent signal matching degree features, construct an activation probability assessment model, calculate the activation probability value of the subsequent risk transmission path segments through the activation probability assessment model, and generate activation probability features containing activation probability description, feature correlation description, and parameter correlation description.

[0164] An activation probability assessment model is constructed using feature correlation values, parameter correlation values, and the number of matching segments in subsequent signal matching features as input. This model calculates the activation probability values ​​of subsequent risk transmission path segments, and generates activation probability features based on these probability values, including activation probability descriptions, feature correlation descriptions (i.e., descriptions of feature correlation values), and parameter correlation descriptions (i.e., descriptions of parameter correlation values).

[0165] Step S155: Based on the activation probability description, feature overlap description, and parameter fit description in the activation probability features, select subsequent risk transmission path segments whose activation probability meets the preset requirements. Then, splice the subsequent risk transmission path segments whose activation probability meets the preset requirements with the original activation risk transmission path in the order of task stage connection to form an extended risk transmission path covering multiple subsequent task stages.

[0166] Based on the activation probability description (the magnitude of the activation probability), feature overlap description (the degree of feature overlap), and parameter fit description (the degree of parameter fit) in the activation probability characteristics, preset requirements are set, such as the activation probability exceeding a certain threshold and feature overlap and parameter fit reaching a certain level. Subsequent risk transmission path segments that meet the preset requirements are selected and spliced ​​with the original activation risk transmission path according to the connection order of task stages to form an extended risk transmission path. This extended risk transmission path can cover multiple subsequent task stages.

[0167] Step S156: Extract the newly added risk event nodes in the extended risk transmission path, and form a sequence of risk events that may occur in different subsequent task stages according to the order of the newly added risk event nodes in the extended risk transmission path and the corresponding task stages. Each task stage corresponds to one or more risk event nodes in the risk event sequence.

[0168] Newly added risk event nodes are extracted from the extended risk transmission path, i.e., nodes that were not present in the original activated risk transmission path. These newly added nodes are then organized into a sequence of risk events that may occur in subsequent task stages, according to their order in the extended risk transmission path and their corresponding task stages. Each task stage may correspond to one or more risk event nodes in the sequence.

[0169] Step S157: Analyze the triggering association between adjacent risk event nodes in the risk event sequence. Combine the activation characteristics of each adjacent risk event node and the system parameter constraints associated with each node to calculate the association strength value between adjacent risk event nodes. The association strength value integrates the matching degree of the triggering preconditions, the degree of satisfaction of system parameter constraints, and the influence of parameter transfer coefficients.

[0170] This study analyzes adjacent risk event nodes in a risk event sequence to investigate their triggering relationships. By combining the activation characteristics of each adjacent node, such as feature overlap and parameter fit, with their associated system parameter constraints, and comprehensively considering the matching degree of triggering preconditions, the satisfaction degree of system parameter constraints, and the influence of parameter transmission coefficients, the association strength value between adjacent risk event nodes is calculated. This value reflects the strength of risk transmission between adjacent nodes.

[0171] Step S158: Based on the association strength value, determine the association strength features that include the strength level description, the influence transmission direction description, and the parameter influence magnitude description. The association strength features of all adjacent risk event node pairs are arranged in the order of the risk event node pairs to form the risk event association relationship.

[0172] Based on the calculated association strength values, the association strength characteristics are determined. The strength level description categorizes the association strength values ​​into different levels, such as strong association, medium association, and weak association; the influence transmission direction description indicates from which node the risk influence is transmitted to which node; and the parameter influence magnitude description describes the magnitude of the influence of the parameter transmission coefficient on the association strength. The association strength characteristics of all adjacent risk event node pairs are arranged in the order of the node pairs to form the risk event association relationship.

[0173] Step S159: For each risk event node in the risk event sequence, combine the parameter fit description, parameter impact description and expected parameter change description in the risk event node activation characteristics of that risk event node, deduce the possible range and rate of change of key influencing parameters when the risk event occurs, and form the trend of risk impact parameter changes.

[0174] For each risk event node in the risk event sequence, we utilize the parameter fit description (the degree of fit between the current parameter and the constraint), parameter influence description (the degree of influence of the parameters of the preceding node on the parameter of this node), and expected parameter changes in subsequent task stages (the normal trend of parameter change). By combining this information, we deduce the possible range and rate of change of key influencing parameters when the risk event corresponding to that risk event node occurs, thus forming the trend of risk-influencing parameter changes.

[0175] Step S1591: Extract the key impact parameters from the risk-related system parameter description corresponding to the risk event node, and determine the type of the key impact parameters. The types of key impact parameters include resolution parameters, band parameters, and data correction error parameters.

[0176] Extract key influencing parameters from the risk-related system parameter description corresponding to the risk event node, and determine their types, such as resolution parameters, band parameters, data correction error parameters, etc.

[0177] Step S1592: Extract the parameter fit description and parameter influence description from the activation features of the risk event node. The parameter fit description reflects the degree of fit between the current parameter and the system parameter constraints corresponding to the risk event node, and the parameter influence description reflects the degree of influence of the key influence parameters of the preceding risk event node on the key influence parameters of this risk event node.

[0178] Extract the parameter fit description and parameter influence description from the node activation features of the risk event node, and clarify the degree of fit between the current parameter and the system parameter constraints, as well as the degree of influence of the parameters of the preceding node on the node parameter.

[0179] Step S1593: Based on the expected parameter changes in subsequent task phases, determine the baseline range of change for key influencing parameters in subsequent task phases. The baseline range of change is the normal range of change for key influencing parameters when no risk event occurs.

[0180] Based on the expected parameter changes in subsequent task phases, determine the normal range of change of key influencing parameters in subsequent task phases, i.e., the baseline range of change, in the absence of risk events.

[0181] Step S1594: Based on the parameter fit description, if the fit between the current parameter and the system parameter constraint corresponding to the risk event node does not reach the preset fit standard, it is determined that the change range of the key influencing parameter when the risk event corresponding to the risk event node occurs will exceed the baseline change range, and the upper and lower limits of the change will be expanded on the basis of the baseline change range; if the fit between the current parameter and the system parameter constraint corresponding to the risk event node reaches the preset fit standard, it is determined that the change range of the key influencing parameter will be within the baseline change range, and the upper and lower limits of the change will be narrowed on the basis of the baseline change range to form a preliminary change range.

[0182] According to the parameter fit description, if the fit between the current parameter and the system parameter constraint does not meet the preset standard, it indicates that there is a large deviation in the parameter. When a risk event occurs, the parameter change will exceed the baseline range. Therefore, the upper and lower limits of the change are expanded based on the baseline range. If the fit meets the preset standard, the parameter deviation is small and the change will be within the baseline range. Therefore, the upper and lower limits of the change are narrowed to form a preliminary change range.

[0183] Step S1595: According to the parameter influence description, if the influence of the key influence parameter of the preceding risk event node on the key influence parameter of this risk event node reaches the preset influence standard, then the initial change range is adjusted according to the parameter transfer coefficient description, taking into account the actual changes of the key influence parameter of the preceding risk event node; if the influence of the key influence parameter of the preceding risk event node on the key influence parameter of this risk event node does not reach the preset influence standard, then the initial change range is adjusted based on the historical changes of the key influence parameter of this risk event node to form a parameter change description.

[0184] Based on the parameter influence description, if the influence of the preceding node parameter on the node parameter reaches the preset standard, the initial change range is adjusted according to the parameter transfer coefficient description, taking into account the actual changes of the preceding node parameter; if the influence does not reach the preset standard, the initial change range is adjusted according to the historical changes of the key influencing parameters of the node, forming the final parameter change description.

[0185] Step S1596: For each type of key impact parameter, repeat the above steps to generate the corresponding parameter change description, summarize the parameter change descriptions of all key impact parameters, classify and organize them according to the type of key impact parameter, and form the risk impact parameter change trend corresponding to the risk event node.

[0186] For each key impact parameter type, repeat the above steps to generate its own parameter change description. Summarize all the parameter change descriptions for key impact parameters, categorize them by parameter type, and form the risk impact parameter change trend corresponding to that risk event node.

[0187] Step S1597: Traverse all risk event nodes in the risk event sequence, repeat the above steps to generate the risk impact parameter change trend corresponding to each risk event node, arrange them in the order of the risk event nodes in the risk event sequence to form a set of risk impact parameter change trends.

[0188] Traverse all nodes in the risk event sequence, generate a risk impact parameter change trend for each node, and arrange them in order of node in the sequence to form a set of risk impact parameter change trends.

[0189] Step S1510: Summarize the risk event sequences, risk event relationships, and risk impact parameter change trends corresponding to all extended risk transmission paths, and organize them into a structured security risk prediction result according to the task stage sequence. The security risk prediction result includes a list of risk events for each task stage, a relationship graph between risk events, and a risk impact trend table of key parameters.

[0190] The sequence of risk events, their correlations, and the changing trends of risk impact parameters corresponding to all extended risk transmission paths are summarized. These results are then organized according to the chronological order of the task phases to form a structured security risk prediction result. This result includes a list of potential risk events for each task phase, clearly outlining the risk events for each phase; a correlation graph between risk events, visually demonstrating the triggering and impact relationships between them; and a risk impact trend table for key parameters, detailing the changing trends of these parameters under the influence of risk events.

[0191] Based on the same inventive concept, please refer to Figure 2This paper shows a schematic block diagram of an information security risk prediction system 100 based on big data analysis, provided in an embodiment of this application, for performing the above-described information security risk prediction method based on big data analysis. The information security risk prediction system 100 based on big data analysis may include a communication unit 110, a machine-readable storage medium 120, and a processor 130.

[0192] In this embodiment, the machine-readable storage medium 120 can be integrated into the processor 130 and can communicate and interact with external systems through the communication unit 110. The machine-readable storage medium 120 stores machine-executable instructions for executing the scheme of this application, and the processor 130 executes the machine-executable instructions stored in the machine-readable storage medium 120 to implement the information security risk prediction method combined with big data analysis provided in the aforementioned method embodiments.

[0193] It should be noted that, in order to simplify the description of the present invention and thus help to understand one or more embodiments of the invention, multiple features may sometimes be grouped into one embodiment, drawing or description thereof in the foregoing description of the embodiments of the present invention.

Claims

1. A method for predicting information security risks by combining big data analysis, characterized in that, The method includes: Collect a set of historical security risk events for the information system and a set of related elements corresponding to each historical security risk event; Based on the set of historical security risk events and the set of related elements, the triggering associations and influence relationships of related system parameters among different historical security risk events are analyzed. The preconditions and parameter constraints corresponding to the triggering associations are extracted, and these are linked together in the triggering order and parameter constraint relationships to form a risk transmission path network. This risk transmission path network contains multiple risk transmission paths, each containing sequentially associated risk event nodes, triggering preconditions between nodes, and system parameter constraints corresponding to the nodes. Analyzing the triggering associations and influence relationships of related system parameters among different historical security risk events, and extracting the preconditions and parameter constraints corresponding to the triggering associations, includes: from the set of historical security risk events... The process extracts the occurrence period description, end period description, and associated system task phase description for each historical security risk event. Based on the temporal overlap between the occurrence period description and the end period description, and combined with the sequential logic of the system task phases, the time-task phase correlation characteristics between different historical security risk events are determined. The core triggering factors of different historical security risk events are compared to identify historical security risk event groups with common core triggering factors. The numerical correlation relationships of key impact parameters corresponding to historical security risk events within a group are analyzed to determine the factor-parameter correlation characteristics between historical security risk events within a group. Finally, combining the time-task phase correlation characteristics with the factor-parameter correlation characteristics, the correlation characteristics between different historical security risk events are determined. The system identifies correlations and parameter influence relationships, marking preceding historical security risk events with triggering correlations as trigger source events and subsequent historical security risk events as triggered events. It records the influence of key influencing parameters of the trigger source events on the triggered events. A risk transmission path network is formed by connecting the trigger source event, precondition description, parameter constraint, and triggered event in the triggering order to form basic risk transmission segments. Each basic risk transmission segment contains one trigger source event, one precondition description, one parameter constraint, and one triggered event. All basic risk transmission segments are summarized, and the identical triggered events and corresponding parameter constraints in different basic risk transmission segments are identified. The process involves concatenating other basic risk transmission fragments that use the triggered event as the trigger source event and have inherited parameter constraints with the original fragment to form a longer risk transmission path containing multi-stage parameter constraints. The transmission relationships of key impact parameters corresponding to each risk event node in each concatenated risk transmission path are analyzed, and parameter transmission coefficient descriptions are supplemented. These parameter transmission coefficient descriptions reflect the degree of influence of the key impact parameters of the preceding node on the key impact parameters of the following node. All concatenated risk transmission paths, unconcatenated basic risk transmission fragments, and supplemented parameter transmission coefficient descriptions are integrated to assign a unique path identifier to each risk transmission path, marking the system task type adaptation range corresponding to the risk transmission path, thus forming a risk transmission path network. Real-time acquisition of the current operating status signal set and the current system task parameter set of the information system; The current running status signal set is associated with the triggering preconditions in the risk transmission path network, and the current system task parameter set is matched with the system parameter constraints in the risk transmission path network. Risk transmission paths that simultaneously satisfy the triggering preconditions and parameter constraints are selected as active risk transmission paths. Signal matching features and parameter matching features corresponding to each risk event node in the active risk transmission path are extracted and fused to generate risk event node activation features. Based on the activation risk transmission path and the activation characteristics of the risk event nodes, and combined with the phase correlation of information system tasks, the sequence of risk events, the correlation of risk events, and the changing trend of risk impact parameters that may occur in different subsequent task phases of the information system are deduced, thus forming the security risk prediction result of the information system.

2. The information security risk prediction method combining big data analysis according to claim 1, characterized in that, Also includes: The risk triggering source description and risk-related system parameter description in the set of associated elements corresponding to each historical security risk event are analyzed. The core triggering factors in the risk triggering source description and the key influencing parameters in the risk-related system parameter description are extracted. The core triggering factors include equipment operation behavior factors, data transmission protocol factors, data processing parameter factors, and data interpretation algorithm factors. The key influencing parameters include data resolution threshold parameters, data band compatibility parameters, and data correction error parameters. Data interpretation refers to interpreting the processed data to extract useful information. Furthermore, from the set of associated elements corresponding to the triggering source event, extract the risk impact range description fragment and the risk association system parameter description fragment related to the triggered event. Combine the risk triggering source description and the risk association system parameter description of the triggered event to form the precondition description and parameter constraint conditions corresponding to the trigger association. The precondition description includes the impact characteristics of the triggering source event and the triggering requirement characteristics of the triggered event. The parameter constraint conditions include the allowable value range description of the key impact parameters corresponding to the triggered event.

3. The information security risk prediction method combining big data analysis according to claim 1, characterized in that, The process involves associating the current operating state signal set with the triggering preconditions in the risk transmission path network, and simultaneously matching the current system task parameter set with the system parameter constraints in the risk transmission path network. Risk transmission paths that simultaneously satisfy both the triggering preconditions and parameter constraints are selected as active risk transmission paths. Signal matching features and parameter matching features corresponding to each risk event node in the active risk transmission path are extracted and fused to generate active risk event node features, including: The triggering preconditions and system parameter constraints contained in each risk transmission path in the risk transmission path network are analyzed. Key feature items in each triggering precondition and key parameter items in each system parameter constraint are extracted. The key feature items include operation behavior feature items, transmission link feature items, processing interaction feature items, and interpretation feedback feature items. The key parameter items include resolution adaptation parameter items, band compatibility parameter items, and correction error parameter items. From the current operating status signal set, separate the device operation record signal, data transmission link signal, data processing interaction signal, and data interpretation feedback signal, and extract the feature information from each signal to form the device operation feature set, transmission link feature set, processing interaction feature set, and interpretation feedback feature set; Extract parameter numerical descriptions corresponding to key parameter items from the current system task parameter set to form the current parameter set, which includes current resolution parameter description, current band parameter description, and current correction error parameter description; The system compares and correlates feature information from the device operation feature set with operation behavior feature items in the trigger preconditions to extract matching operation feature fragments; it compares and correlates feature information from the transmission link feature set with transmission link feature items in the trigger preconditions to extract matching transmission feature fragments; it compares and correlates feature information from the processing interaction feature set with processing interaction feature items in the trigger preconditions to extract matching interaction feature fragments; and it compares and correlates feature information from the interpretation feedback feature set with interpretation feedback feature items in the trigger preconditions to extract matching interpretation feature fragments. The operation feature fragments, transmission feature fragments, interaction feature fragments, and interpretation feature fragments are combined and matched to form a signal matching set corresponding to the triggering precondition. If the signal matching set contains the matching fragments corresponding to all key feature items in the triggering precondition, it is determined that the triggering precondition is satisfied. The system compares the current resolution parameter description in the current parameter set with the resolution adaptation parameter item in the system parameter constraints to determine whether the current resolution parameter description is within the allowable value range of the resolution adaptation parameter item; it then compares the current band parameter description with the band compatibility parameter item to determine whether the current band parameter description meets the requirements of the band compatibility parameter item; finally, it compares the current correction error parameter description with the correction error parameter item to determine whether the current correction error parameter description is within the allowable value range of the correction error parameter item; if all key parameter items meet the requirements, the system parameter constraints are determined to be satisfied. Filter out all risk transmission paths that simultaneously contain both the met triggering preconditions and the met system parameter constraints, and mark all such risk transmission paths as active risk transmission paths. For each risk event node in each activated risk transmission path, extract the signal matching set associated with the triggering preconditions of the risk event node and the current parameter set fragment associated with the system parameter constraints of the risk event node. Associate the feature fragments in the signal matching set with the historical feature descriptions of the risk event node, and extract the overlapping feature parts as signal matching features. Associate the current parameter set fragments with the historical parameter descriptions of the risk event node, and extract the degree of fit of the parameter values ​​as parameter matching features. Based on the overlapping features in the signal matching features and the degree of fit in the parameter matching features, combined with the location of the risk event node in the activation risk transmission path and the parameter transmission coefficient description in the path, a risk event node activation feature is generated that includes feature overlap description, parameter fit description, location correlation description, and parameter influence description.

4. The information security risk prediction method combining big data analysis according to claim 3, characterized in that, The step of separating device operation record signals, data transmission link signals, data processing interaction signals, and data interpretation feedback signals from the current operating status signal set, and extracting feature information from each signal to form device operation feature sets, transmission link feature sets, processing interaction feature sets, and interpretation feedback feature sets, includes: The current operating status signal set is subjected to signal classification preprocessing to remove invalid interference segments from the signals. The invalid interference segments include blank signal segments with no actual operation records, silent signal segments with no data transmission records, idle signal segments with no processing interaction records, and unresponsive signal segments with no interpretation feedback records. Based on the signal source identifier and signal content characteristics, the preprocessed signals are divided into four categories: device operation record signals, data transmission link signals, data processing interaction signals, and data interpretation feedback signals. The signal source identifier includes the device operation module identifier, data transmission module identifier, data processing module identifier, and data interpretation module identifier. For equipment operation record signals, extract the descriptions of operation initiator, operation object, operation instruction type, operation execution duration, and operation result feedback from the signals. Arrange the descriptions of operation initiator, operation object, operation instruction type, operation execution duration, and operation result feedback in chronological order of operation occurrence to form a equipment operation feature sequence. Each equipment operation feature sequence corresponds to one equipment operation process, and multiple equipment operation feature sequences form a set of equipment operation features. For data transmission link signals, extract the following descriptions from the signals: transmission link identifier, data sender identifier, data receiver identifier, data transmission direction, data transmission period, data transmission volume, data transmission type, and transmission stability. Arrange these descriptions in chronological order of transmission occurrence to form a transmission link feature sequence. Each transmission link feature sequence corresponds to one data transmission process, and multiple transmission link feature sequences form a transmission link feature set. For data processing interaction signals, extract the interaction initiating module identifier, interaction receiving module identifier, processing task type description, processing parameter setting description, processing progress feedback description, processing result quality description, and processing time description from the signals. Arrange the interaction initiating module identifier, interaction receiving module identifier, processing task type description, processing parameter setting description, processing progress feedback description, processing result quality description, and processing time description in chronological order of interaction occurrence to form a processing interaction feature sequence. Each processing interaction feature sequence corresponds to one data processing interaction process, and multiple processing interaction feature sequences form a processing interaction feature set. For the data interpretation feedback signal, extract the following descriptions from the signal: interpretation task identifier description, interpretation algorithm type description, interpretation data source description, interpretation result accuracy description, interpretation anomaly prompt description, and interpretation completion time period description. Arrange these descriptions in chronological order of interpretation occurrence to form an interpretation feedback feature sequence. Each interpretation feedback feature sequence corresponds to one data interpretation process, and multiple interpretation feedback feature sequences form an interpretation feedback feature set.

5. The information security risk prediction method combining big data analysis according to claim 3, characterized in that, The steps involve: associating and comparing the feature information in the device operation feature set with the operation behavior feature items in the trigger preconditions to extract matching operation feature fragments; associating and comparing the feature information in the transmission link feature set with the transmission link feature items in the trigger preconditions to extract matching transmission feature fragments; and associating and comparing the feature information in the processing interaction feature set with the processing interaction feature items in the trigger preconditions to extract matching interaction feature fragments. The feature information in the interpretation feedback feature set is correlated and compared with the interpretation feedback feature items in the triggering preconditions to extract the matching interpretation feature fragments, including: For each device operation feature sequence in the device operation feature set, extract the operation initiator description, operation object identifier description, operation instruction type description, operation execution duration description, and operation result feedback description from the device operation feature sequence one by one, and compare them with the operation behavior feature items in the triggering preconditions. If any segment of the description in the device operation feature sequence is completely consistent with the corresponding description in the operation behavior feature item, or if the segment contains the core elements of the corresponding description of the operation behavior feature item and there is no contradictory information, then the segment is marked as a candidate operation feature segment, and the position of the candidate operation feature segment in the device operation feature sequence and the corresponding operation occurrence time are recorded. Summarize candidate operation feature fragments from all device operation feature sequences to form matching operation feature fragments; For each transmission link feature sequence in the transmission link feature set, the transmission link identifier description, data sender identifier description, data receiver identifier description, data transmission direction description, data transmission time period description, and data transmission type description are extracted one by one and compared with the transmission link feature items in the triggering preconditions. If any segment of the description in the transmission link feature sequence is completely consistent with the corresponding description in the transmission link feature item, or if the segment of the description matches the corresponding description in the transmission link feature item in terms of key information and there is no conflict in the secondary information, then the segment of the description is marked as a candidate transmission feature segment, and the position of the candidate transmission feature segment in the transmission link feature sequence and the corresponding transmission occurrence time are recorded. Candidate transmission feature segments from all transmission link feature sequences are aggregated to form matching transmission feature segments; For each processing interaction feature sequence in the processing interaction feature set, extract the interaction initiation module identifier, interaction receiving module identifier, processing task type description, processing parameter setting description, and processing result quality description from the processing interaction feature sequence one by one, and compare them with the processing interaction feature items in the triggering preconditions. If any segment of the processing interaction feature sequence is completely consistent with the corresponding description in the processing interaction feature item, or if the processing task type description and processing parameter setting description in the segment meet the core requirements of the processing interaction feature item, then the segment is marked as a candidate interaction feature fragment, and the position of the candidate interaction feature fragment in the processing interaction feature sequence and the corresponding interaction occurrence time are recorded. All candidate interaction feature fragments in the processed interaction feature sequences are summarized to form the final matched interaction feature fragments; For each interpretation feedback feature sequence in the interpretation feedback feature set, the interpretation task identifier description, interpretation algorithm type description, interpretation result accuracy description, and interpretation anomaly prompt description are extracted one by one from the interpretation feedback feature sequence and compared with the interpretation feedback feature items in the triggering preconditions. If any segment of the description in the interpretation feedback feature sequence is completely consistent with the corresponding description in the interpretation feedback feature item, or if the interpretation algorithm type description and the interpretation error message description in the segment meet the key requirements of the interpretation feedback feature item, then the segment is marked as a candidate interpretation feature fragment, and the position of the candidate interpretation feature fragment in the interpretation feedback feature sequence and the corresponding interpretation completion time are recorded. Summarize all candidate interpretation feature fragments from the interpretation feedback feature sequences to form a matching interpretation feature fragment.

6. The information security risk prediction method combining big data analysis according to claim 1, characterized in that, Based on the activated risk transmission path and the activation characteristics of the risk event nodes, and combined with the phase correlation of information system tasks, the system derives the possible risk event sequences, risk event correlations, and risk impact parameter change trends for different subsequent task phases of the information system, forming the information system's security risk prediction results, including: The standard phase division of information system tasks is determined, forming a task phase sequence. The task phase sequence includes the task preparation phase, equipment debugging phase, data acquisition phase, data transmission phase, data processing phase, data interpretation phase, and result output phase. The core task description of each task phase and the connection conditions between phases are described. Traverse each activation risk transmission path, record the order of risk event nodes in the activation risk transmission path, the activation characteristics of each risk event node, and the system task stage associated with that risk event node, and establish the correspondence between risk event nodes and task stages. For each activated risk transmission path, the last risk event node of the activated risk transmission path is extracted, and the risk event node is marked as the current termination risk node. The current task stage corresponding to the current termination risk node is determined, and all subsequent risk transmission path segments that are triggered by the current termination risk node and are adapted to subsequent task stages are searched from the risk transmission path network. The triggering preconditions in subsequent risk transmission path segments are associated with the current running state signal set. At the same time, the system parameter constraints in subsequent risk transmission path segments are matched with the current system task parameter set and the expected parameter change description of subsequent task stages. The signal matching features and parameter matching features corresponding to subsequent risk transmission path segments are extracted. Combined with the risk event node activation features of the current termination risk node and the parameter transmission coefficient description in subsequent risk transmission path segments, the activation probability features of subsequent risk transmission path segments are determined. Based on the activation probability description, feature overlap description, and parameter fit description in the activation probability characteristics, subsequent risk transmission path segments with activation probabilities that meet preset requirements are selected. These subsequent risk transmission path segments with activation probabilities that meet preset requirements are then spliced ​​together with the original activation risk transmission path in the order of task stage connection to form an extended risk transmission path covering multiple subsequent task stages. Extract newly added risk event nodes in the extended risk transmission path, and form a sequence of risk events that may occur in different subsequent task stages according to the order of the newly added risk event nodes in the extended risk transmission path and the corresponding task stages. Each task stage corresponds to one or more risk event nodes in the risk event sequence. The triggering association between adjacent risk event nodes in the risk event sequence is analyzed. Combining the activation characteristics of each adjacent risk event node and the system parameter constraints associated with each node, the association strength value between adjacent risk event nodes is calculated. The association strength value integrates the matching degree of the triggering preconditions, the degree of satisfaction of the system parameter constraints, and the influence of the parameter transfer coefficient. Based on the correlation strength value, the correlation strength characteristics, including the strength level description, the influence transmission direction description, and the parameter influence magnitude description, are determined. The correlation strength characteristics of all adjacent risk event node pairs are arranged in the order of the risk event node pairs to form the risk event correlation relationship. For each risk event node in the risk event sequence, by combining the parameter fit description, parameter impact description and expected parameter change description in the activation characteristics of the risk event node, the possible range and rate of change of the key impact parameters when the risk event occurs are deduced, thus forming the trend of risk impact parameter changes. The risk event sequences, risk event relationships, and risk impact parameter change trends corresponding to all extended risk transmission paths are summarized and organized into a structured security risk prediction result according to the task stage sequence. The security risk prediction result includes a list of risk events for each task stage, a relationship graph between risk events, and a risk impact trend table of key parameters.

7. The information security risk prediction method combining big data analysis according to claim 6, characterized in that, The process involves associating the triggering preconditions in subsequent risk transmission path segments with the current operating state signal set, and matching the system parameter constraints in subsequent risk transmission path segments with the current system task parameter set and the expected parameter change descriptions for subsequent task stages. This process extracts signal matching features and parameter matching features corresponding to subsequent risk transmission path segments. Combined with the risk event node activation features of the current termination risk node and the parameter transfer coefficient descriptions in subsequent risk transmission path segments, the activation probability features of subsequent risk transmission path segments are determined, including: Analyze the triggering preconditions in subsequent risk transmission path segments, and extract the key feature items contained in the triggering preconditions. The key feature items include operational behavior feature items, transmission link feature items, processing interaction feature items, and interpretation feedback feature items. Extract signal segments corresponding to key feature items from the current running state signal set, combine them with the core task description of the subsequent task stage, predict the new signal features that the core task may generate, and add them to the signal segments to form an extended signal segment set; The signal segments in the extended signal segment set are compared with the key feature items of the triggering preconditions, and the matching signal segments are extracted to form a subsequent signal matching set. Based on the number of matching segments, the matching completeness, and the adaptability of the newly added signal features in the subsequent signal matching set, a subsequent signal matching degree feature is generated. The subsequent signal matching degree feature includes a description of the number of matching segments, a description of the segment matching completeness, and a description of the adaptability of the newly added features. The system parameter constraints in the subsequent risk transmission path segment are analyzed, and the key parameter items contained in the system parameter constraints are extracted. The key parameter items include resolution adaptation parameter items, band compatibility parameter items, and correction error parameter items. Extract the current parameter descriptions corresponding to the key parameter items from the current system task parameter set, combine them with the expected parameter change descriptions in subsequent task stages, deduce the expected parameter ranges of the key parameter items in subsequent task stages, and form an expected parameter description set. The parameter range in the current parameter description and the expected parameter description set are merged to form a parameter prediction set. The parameter prediction set is compared with the key parameter items of the system parameter constraints to determine whether the parameter prediction set meets the allowable value range requirements of the key parameter items. Subsequent parameter matching degree features are generated, which include the current parameter fit degree description, the expected parameter adaptability description, and the parameter change compatibility description. Extract the feature overlap description, parameter fit description, location correlation description, and parameter influence description from the risk event node activation features of the current termination risk node. Then, perform correlation calculations with the fragment matching completeness description and the new feature fit description from the subsequent signal matching degree features to generate feature correlation values. The parameter fit description, parameter impact description, and the current parameter fit description, expected parameter fit description, and parameter change compatibility description in the subsequent parameter matching feature are correlated and calculated. Combined with the parameter transmission coefficient description in the subsequent risk transmission path segment, parameter correlation values ​​are generated. Based on the description of the number of matching segments in the feature correlation value, parameter correlation value, and subsequent signal matching degree features, an activation probability assessment model is constructed. The activation probability value of subsequent risk transmission path segments is calculated through this activation probability assessment model, generating activation probability features that include activation probability description, feature correlation description, and parameter correlation description.

8. The information security risk prediction method combining big data analysis according to claim 6, characterized in that, For each risk event node in the risk event sequence, combining the parameter fit description, parameter impact description, and expected parameter change description in the risk event node activation characteristics, the possible range and rate of change of key influencing parameters when the risk event occurs are deduced, forming a trend of risk impact parameter changes, including: Extract the key impact parameters from the risk-related system parameter description corresponding to the risk event node, and determine the type of the key impact parameters. The types of key impact parameters include resolution parameters, band parameters, and data correction error parameters. Extract the parameter fit description and parameter influence description from the activation features of the risk event node. The parameter fit description reflects the degree of fit between the current parameter and the system parameter constraints corresponding to the risk event node, and the parameter influence description reflects the degree of influence of the key influence parameters of the preceding risk event node on the key influence parameters of this risk event node. Based on the expected parameter changes in subsequent task phases, determine the baseline range of change for key impact parameters in subsequent task phases. The baseline range of change is the normal range of change for key impact parameters when no risk event occurs. Based on the parameter fit description, if the fit between the current parameter and the system parameter constraint corresponding to the risk event node does not reach the preset fit standard, it is determined that the change range of the key influencing parameter will exceed the baseline change range when the risk event corresponding to the risk event node occurs, and the upper and lower limits of the change are expanded on the basis of the baseline change range; if the fit between the current parameter and the system parameter constraint corresponding to the risk event node reaches the preset fit standard, it is determined that the change range of the key influencing parameter will be within the baseline change range, and the upper and lower limits of the change are narrowed on the basis of the baseline change range to form a preliminary change range; According to the parameter impact description, if the impact of the key impact parameter of the preceding risk event node on the key impact parameter of this risk event node reaches the preset impact standard, then the initial change range is adjusted according to the parameter transfer coefficient description, taking into account the actual changes of the key impact parameter of the preceding risk event node; if the impact of the key impact parameter of the preceding risk event node on the key impact parameter of this risk event node does not reach the preset impact standard, then the initial change range is adjusted based on the historical changes of the key impact parameter of this risk event node, forming a parameter change description. For each key impact parameter type, repeat the above steps to generate the corresponding parameter change description, summarize all key impact parameter parameter change descriptions, classify and organize them according to the type of key impact parameter, and form the risk impact parameter change trend corresponding to the risk event node; Traverse all risk event nodes in the risk event sequence, repeat the above steps to generate the risk impact parameter change trend corresponding to each risk event node, and arrange them in order of the risk event nodes in the risk event sequence to form a set of risk impact parameter change trends.

9. An information security risk prediction system combining big data analysis, characterized in that, include: processor; A machine-readable storage medium for storing machine-executable instructions of the processor; The processor is configured to execute the information security risk prediction method combining big data analysis as described in any one of claims 1 to 8 by executing the machine-executable instructions.

10. A computer program product, characterized in that, The computer program product includes machine-executable instructions stored in a computer-readable storage medium. A processor of a computer device reads the machine-executable instructions from the computer-readable storage medium and executes the machine-executable instructions, causing the computer device to perform the information security risk prediction method combined with big data analysis as described in any one of claims 1 to 8.

Images