A data security management method and system based on massive data analysis

Abstract

The application relates to the technical field of data management, in particular to a data security management method and system based on massive data analysis, which comprises a data security management center, a multi-source acquisition module, a security processing module, a main body risk module, a data environment module, a risk management module, a risk traceability module and a visual response module; through the whole-process design of covering data acquisition-risk assessment-prediction-traceability-response, the application realizes the leap from passive risk perception to active risk prediction, helps to deploy control measures in advance, blocks the risk before it occurs, intuitively presents the risk transmission path through the differentiated node marking and time axis dynamic demonstration, quickly locates the risk link by inputting the keywords in the query information, generates a traceability list containing operation subjects, environmental factors, behavior records and other information, and enables technical personnel to quickly understand the risk root.

Description

Technical Field

[0001] This invention relates to the field of data management technology, and in particular to a data security management method and system based on massive data analysis. Background Technology

[0002] With the deepening of digital transformation, the amount of data in various industries is growing explosively, and the data types are becoming increasingly complex (such as structured database tables, semi-structured JSON / XML files, and heterogeneous data such as unstructured documents / images / videos). The threats to data security are also becoming increasingly diverse (such as unauthorized access, data leakage, and malicious tampering).

[0003] Existing data security management technologies suffer from the following core pain points: First, traditional data security systems are mostly designed for single-source, fixed-format data, making it difficult to efficiently access multi-source heterogeneous data and lacking standardized preprocessing mechanisms, which affects the accuracy of risk assessment. Second, existing systems primarily focus on the static risks of the data itself (such as sensitive data leakage), failing to incorporate the data subject's behavior and the state of the storage / processing environment into the assessment system, and relying mainly on post-event risk perception—only triggering alarms after a risk event occurs, unable to predict future risks based on historical data and real-time characteristics, resulting in delayed security response and difficulty in proactively blocking risks and adaptively adjusting security strategies. Third, when a risk event occurs, traditional systems struggle to quickly trace the risk chain, lacking intuitive correlation diagrams and timeline demonstrations, thus prolonging the risk handling cycle.

[0004] To address the aforementioned technical shortcomings, a solution is proposed. Summary of the Invention

[0005] The purpose of this invention is to provide a data security management method and system based on massive data analysis to address the aforementioned technical deficiencies. This invention achieves a leap from passively perceiving risks to proactively predicting risks by covering the entire process of data collection, risk assessment, prediction, tracing, and response. This helps to deploy control measures in advance, preventing risks from occurring. Furthermore, through differentiated node markings and dynamic timeline demonstrations, it intuitively presents the risk transmission path and allows for quick location of risk links by inputting keywords in the query information, generating a traceability list containing information such as the operating entity, environmental factors, and behavioral records, enabling technical personnel to quickly understand the root cause of the risk.

[0006] The objective of this invention can be achieved through the following technical solution: a data security management system based on massive data analysis, comprising a data security management center, a multi-source acquisition module, a security processing module, a main risk module, a data environment module, a risk management module, a risk tracing module, and a visual response module;

[0007] The multi-source acquisition module is used to collect massive amounts of data from multiple sources and in multiple formats through the data access layer and send them to the security processing module;

[0008] The security processing module is used to preprocess massive amounts of data from multiple sources and in multiple formats to obtain heterogeneous datasets, and then send the heterogeneous datasets to the main risk module.

[0009] The subject risk module is used to perform multidimensional assessment and analysis of the subject's own risk in heterogeneous datasets. The obtained fixed risk value and behavioral deviation degree are weighted and calculated to obtain the data's own risk R1.

[0010] The data environment module is used to acquire and process environmental risk values ​​of heterogeneous dataset storage / processing nodes;

[0011] The risk management module is used to perform fusion assessment and risk prediction analysis on the data risk R1 and environmental risk value R2 of heterogeneous datasets to obtain management decision lists corresponding to low risk, medium risk and high risk.

[0012] The risk tracing module is used to construct a network diagram of the relationship between data, subject, environment and risk and to conduct risk tracing analysis, and to form a tracing list based on the obtained risk links.

[0013] Preferably, the analysis process of the main risk module is as follows:

[0014] Sensitive tags are automatically labeled in the data content based on heterogeneous datasets. Based on the sensitive tags, the proportion of fields corresponding to extremely high sensitivity, high sensitivity, medium sensitivity, and low sensitivity in the data content is obtained. The sum of the proportion of fields corresponding to extremely high sensitivity, high sensitivity, medium sensitivity, and low sensitivity and their corresponding weight coefficients is set as the sensitivity risk value.

[0015] Obtain the integrity risk value of the data content. The integrity risk value represents the degree of deviation between the current data content and the standard data content.

[0016] A fixed risk value is calculated based on the combination of sensitivity risk value × preset sensitivity risk value weighting coefficient and integrity risk value × preset integrity risk value weighting coefficient.

[0017] Preferably, historical normal behavior data of the data subject is obtained, and a baseline of normal behavior for each subject is generated based on the historical normal behavior data using statistical methods;

[0018] The current behavior data of the data subject is obtained, and the current behavior data is compared and analyzed with the normal behavior baseline to obtain the behavior deviation between the current behavior data and the normal behavior baseline.

[0019] The inherent risk R1 of the data is calculated based on a fixed risk value × a preset fixed risk value weighting coefficient + a behavioral deviation × a preset behavioral deviation weighting coefficient.

[0020] Preferably, the analysis process of the data environment module is as follows:

[0021] The physical location of the heterogeneous data set storage / treatment node is matched with the pre-divided trust area based on GIS, and the trust degree of the corresponding trust area is obtained;

[0022] The device health score of the heterogeneous data set storage / treatment node and the network environment risk are obtained at the same time, the device health score represents the output health score value obtained by inputting the device state data into the pre-set health state model; the network environment risk represents the value obtained by standardizing the number of device network parameters deviating from the pre-set threshold value;

[0023] The environment risk value R2 is calculated based on the trust degree x the pre-set trust degree weight coefficient + the device health score x the pre-set device health score weight coefficient + (1-network environment risk) x the pre-set weight coefficient.

[0024] Preferably, the analysis process of the risk management module is as follows:

[0025] The basic risk value is calculated based on the weighted sum of the data itself risk R1 and the environment risk value R2, that is, R1 x the pre-set R1 weight coefficient + (1-R2) x the pre-set R2 weight coefficient = the basic risk value;

[0026] The prediction risk value of the heterogeneous data set within the pre-set prediction time is obtained at the same time, the prediction risk value represents the output prediction value obtained by inputting the extracted features of the heterogeneous data set into the pre-set risk prediction model.

[0027] Preferably, the pre-set threshold values of the basic risk value and the prediction risk value are called, and the pre-set threshold values include the maximum value Jmax of the basic risk value, the minimum value Jmin of the basic risk value, the maximum value Ymax of the prediction risk value, and the minimum value Ymin of the prediction risk value.

[0028] The basic risk value and the prediction risk value are compared and analyzed with Jmax, Jmin, Ymax and Ymin, and low risk, medium risk and high risk are obtained, and the corresponding management decision list is obtained based on the low risk, medium risk and high risk.

[0029] Preferably, the analysis process of the risk traceability module is as follows:

[0030] The association network graph of data-subject-environment-risk is constructed based on knowledge graph technology, wherein the nodes are: heterogeneous data set (marked with a circle, and the sensitivity risk value is also marked), operation subject (square, yellow represents low risk, orange represents medium risk, and red represents high risk), environment (marked with a triangle), and risk event (marked with a rhombus, and the event type is marked).

[0031] Edges: Relationships between nodes (solid lines represent operational relationships, dashed lines represent risk transmission);

[0032] Timeline: Dynamically demonstrates the chronological process of risk transmission.

[0033] Preferably, the query information input by the operator is obtained, and keywords are extracted from the query information. The keywords include risk event ID, time, and IP address of the operator.

[0034] Based on the network diagram, the risk links corresponding to the query information are obtained, and a traceability list is formed based on the risk links. The traceability list includes the operating entity, environmental factors, and operating behavior.

[0035] The beneficial effects of this invention are as follows:

[0036] This invention preprocesses massive amounts of data from multiple sources and in multiple formats, which helps to provide a high-quality data foundation for risk assessment and significantly improves the accuracy of assessment results. At the same time, it incorporates the inherent risks of the data, environmental risks, and risks of the subject's behavior into a unified assessment system. Through weighted calculation, it achieves multi-dimensional risk fusion, avoiding the one-sidedness of single-dimensional assessment. Furthermore, it combines the predicted risk values ​​output by the risk prediction model to perform risk analysis on heterogeneous datasets, realizing a leap from passively perceiving risks to proactively predicting risks, and achieving a closed-loop mechanism of prediction-decision-feedback. This helps to deploy control measures in advance and prevent risks from occurring.

[0037] This invention constructs a network diagram of data, subject, environment, and risk based on knowledge graphs. Through differentiated node markings and dynamic timeline demonstrations, it intuitively presents the risk transmission path. Furthermore, by inputting keywords in the query information, it can quickly locate the risk link and generate a traceability list containing information such as the operating subject, environmental elements, and behavioral records, enabling technical personnel to quickly understand the root cause of the risk. Attached Figure Description

[0038] The invention will now be further described with reference to the accompanying drawings;

[0039] Fig. 1 This is a flowchart of the system of the present invention;

[0040] Fig. 2 This is a reference diagram of the method of the present invention;

[0041] Fig. 3 This is a partial analysis diagram of Embodiment 2 of the present invention. Detailed Implementation

[0042] With reference to the drawings of the embodiments of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described, obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all the other embodiments obtained by those skilled in the art without creative work belong to the scope of protection of the present application.

[0043] Reference herein to "embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the application. The appearance of the phrase in various places in the specification is not necessarily all referring to the same embodiment, nor is it necessarily referring to a separate or alternative embodiment to the other embodiments. It will be explicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments;

[0044] Embodiment one: please refer to Figs. 1 to 3 As shown in the figure, the present application is a data security management system based on massive data analysis, which comprises a data security management center, a multi-source acquisition module, a security processing module, a main risk module, a data environment module, a risk management module, a risk traceability module and a visual response module. The data security management center is in one-way communication connection with the multi-source acquisition module and the risk management module. The multi-source acquisition module is in one-way communication connection with the security processing module. The security processing module is in one-way communication connection with the main risk module. The main risk module is in one-way communication connection with the data security management center. The data security management center is in one-way communication connection with the risk traceability module. The risk management module and the risk traceability module are in one-way communication connection with the visual response module. The data security management center is in two-way communication connection with the data environment module.

[0045] The multi-source acquisition module is used for collecting massive data of multiple sources and multiple formats through a data access layer and sending the massive data to the security processing module;

[0046] Massive data of multiple sources and multiple formats are collected through a data access layer. The massive data includes data ontology, metadata and environment data.

[0047] Data ontology: structured data (such as database records), semi-structured data (such as API interface messages), unstructured data (such as documents / audio / video / binary streams), and stream data (such as real-time sensor data streams);

[0048] Metadata: data identification (such as a globally unique ID generated by a hash algorithm), sensitive label (such as automatic labeling based on content recognition: extremely high sensitivity / high sensitivity / medium sensitivity / low sensitivity), storage location (such as a cloud vendor / local path / edge node), and flow state (such as static storage / in transit / processing);

[0049] Environmental data: physical environment (such as the geographical location of the edge node, temperature and humidity), network environment (such as the encryption protocol of the transmission link, bandwidth fluctuation), resource state (such as CPU / memory usage, process load);

[0050] The security processing module is used for preprocessing massive data of multiple sources and multiple formats to obtain a heterogeneous data set, and sending the heterogeneous data set to the subject risk module.

[0051] The preprocessing of the massive data of multiple sources and multiple formats includes cleaning, standardization, etc.

[0052] The subject risk module is used for subject self-risk multidimensional evaluation analysis of the heterogeneous data set, and the specific subject self-risk multidimensional evaluation analysis process is as follows:

[0053] Based on the heterogeneous data set, the automatically labeled sensitive label in the data content is obtained, based on the sensitive label, the field proportion value corresponding to the extremely high sensitivity / high sensitivity / medium sensitivity / low sensitivity in the data content is obtained, and the sum value obtained by multiplying the field proportion value corresponding to the extremely high sensitivity / high sensitivity / medium sensitivity / low sensitivity and the corresponding weight coefficient is set as the sensitivity risk value.

[0054] That is, the sensitivity risk value = ∑ (each sensitive level corresponding field proportion value x corresponding weight coefficient).

[0055] The integrity risk value of the data content is obtained, and the integrity risk value represents the deviation degree of the current data content from the standard data content.

[0056] The fixed risk value is calculated based on the sensitivity risk value x the preset sensitivity risk value weight coefficient + the integrity risk value x the preset integrity risk value weight coefficient.

[0057] The historical normal behavior data of the data subject (such as a user, a terminal device) is obtained, and the normal behavior baseline of each subject (such as the normal access time period of user A is 8:00-18:00, and the daily download data volume is ≤100MB) is generated based on the historical normal behavior data using a statistical method (such as mean-standard deviation).

[0058] The current behavior data (such as access time, operation type (query / modification / download / delete)) of the data subject is obtained, and the current behavior data is compared and analyzed with the normal behavior baseline to obtain the behavior deviation degree of the current behavior data from the normal behavior baseline.

[0059] The data self-risk R1 is calculated based on the fixed risk value x the preset fixed risk value weight coefficient + the behavior deviation degree x the preset behavior deviation degree weight coefficient, and the data self-risk R1 is sent to the data security management center for storage.

[0060] Embodiment two: the data environment module is used for obtaining and processing the environment risk value of the heterogeneous data set storage / processing node, specifically including:

[0061] The physical location of the heterogeneous data set storage / processing node is matched with the pre-divided trust area based on the geographic information system (GIS), and the trust degree of the corresponding trust area is obtained;

[0062] The pre-divided trust area includes a trusted area: trust degree is 1, a semi-trusted area: trust degree is 0.5, and a non-trusted area: trust degree is 0.2;

[0063] At the same time, the device health score and the network environment risk of the heterogeneous data set storage / processing node are obtained, and the device health score represents the output health score value obtained by inputting the device state data (such as server CPU temperature, vibration amplitude, etc.) into the pre-set health state model;

[0064] Among them, the network environment risk represents the value of the number of device network parameters deviating from the preset threshold after standardization processing;

[0065] The environment risk value R2 is calculated based on the trust degree x the preset trust degree weight coefficient + the device health score x the preset device health score weight coefficient + (1-network environment risk) x the preset weight coefficient, and the environment risk value R2 is sent to the data security management center for storage;

[0066] The risk management module is used for fusion evaluation processing and risk prediction analysis of the data itself risk R1 and the environment risk value R2 of the heterogeneous data set, and the specific fusion evaluation processing and risk prediction analysis process is as follows:

[0067] The basic risk value is calculated based on the weighted sum of the data itself risk R1 and the environment risk value R2;

[0068] That is, R1x preset R1 weight coefficient + (1-R2) x preset R2 weight coefficient = basic risk value;

[0069] At the same time, the prediction risk value of the heterogeneous data set within the preset prediction time is obtained, and the prediction risk value represents the output prediction value obtained by inputting the extracted features (such as behavior deviation degree, sensitivity risk value) of the heterogeneous data set into the pre-set risk prediction model;

[0070] The preset threshold of the basic risk value and the prediction risk value is called, and the preset threshold includes the maximum value Jmax of the basic risk value, the minimum value Jmin of the basic risk value, the maximum value Ymax of the prediction risk value, and the minimum value Ymin of the prediction risk value;

[0071] The basic risk value and the prediction risk value are compared and analyzed with Jmax, Jmin, Ymax and Ymin:

[0072] If the base risk value < Jmin, and the predicted risk value < Ymin, it is determined as low risk;

[0073] If Jmin≤ the base risk value ≤ Jmax, and Ymax≤ the predicted risk value ≤ Ymin, it is determined as medium risk;

[0074] If the base risk value > Jmax, or the predicted risk value > Ymax, it is determined as high risk;

[0075] Based on the low risk, medium risk and high risk, the corresponding management decision list is obtained, and the management decision list is sent to the visual response module, and the visual response module immediately displays the management decision list, so as to reasonably manage the heterogeneous data set based on the management decision list, and improve the overall security of the data;

[0076] For example, the management decision list corresponding to the low risk is: record operation log, do not limit normal access, etc.

[0077] The management decision list corresponding to the medium risk is: such as limiting single data download volume ≤ 50MB, requiring secondary verification for login, etc.

[0078] The management decision list corresponding to the high risk is: such as temporarily prohibiting the subject to access sensitive data, locking the account and notifying the administrator, etc.

[0079] In summary, the system realizes the leap from passive risk perception to active risk prediction, and realizes the closed-loop mechanism of prediction-decision-feedback, which lays a precise and forward-looking decision basis for the subsequent execution of adaptive strategies.

[0080] Embodiment three: the risk tracing module is used to construct a data-subject-environment-risk association network graph and perform risk tracing analysis, and the specific risk tracing analysis process is as follows:

[0081] Based on the knowledge graph technology, the data-subject-environment-risk association network graph is constructed, wherein the nodes are: heterogeneous data set (marked with a circle, and the sensitivity risk value is also marked), operation subject (square, yellow represents low risk, orange represents medium risk, and red represents high risk), environment (triangle mark, such as current trust area, IP address) and risk event (diamond mark, mark event type);

[0082] Edge: the association relationship between nodes (solid line represents operation relationship, such as "user A downloads data B"; dotted line represents risk transmission, such as "vulnerability C causes user A to access unauthorized access");

[0083] Time axis: dynamically demonstrate the time sequence process of risk propagation (such as "09:00 vulnerability scanning-09:10 abnormal IP login-09:15 access sensitive data-09:20 blocked by the system");

[0084] That is, through the graph, the risk diffusion path of "a certain sensor firmware vulnerability-hacker exploits vulnerability to control terminal-terminal sends abnormal instructions to core database-database sensitive parameter leakage" can be directly observed;

[0085] The query information input by the operator is obtained, and key words are extracted from the query information, including risk event ID, time, operation subject IP address, etc.

[0086] Based on the association network graph, the risk link corresponding to the query information is obtained, and the traceability list is composed based on the risk link, including operation subject, environmental factors, operation behavior, etc. The traceability list is sent to the visual response module, which immediately displays the traceability list, thereby providing intuitive visual information, realizing quick tracing and global control of data flow, risk events, policy execution and other information, and enabling technical personnel to quickly understand the risk root cause.

[0087] Embodiment four: a data security management method based on massive data analysis, comprising the following steps:

[0088] Step one: acquisition and preprocessing of massive data of multiple sources and multiple formats to obtain a heterogeneous data set;

[0089] Step two: subject self-risk assessment: based on the heterogeneous data set, multi-dimensional assessment and analysis of the subject self-risk are carried out, the data self-risk R1 is calculated and stored;

[0090] Step three: environment risk acquisition: based on the geographic information system, the storage / processing node physical location is matched with the preset trust area to obtain the trust degree, combined with the device health score and network environment risk, the environment risk value R2 is calculated and stored through weighted calculation;

[0091] Step four: risk fusion evaluation and prediction: calculate the basic risk value and obtain the predicted risk value within the preset prediction time, compare the basic risk value, the predicted risk value and the preset threshold value, determine the risk level and generate the corresponding management decision list;

[0092] Step five: risk traceability and visual response: build an association network graph of data-subject-environment-risk for risk traceability analysis, obtain the traceability list, and display the traceability list;

[0093] To sum up, the application is helpful to provide high-quality data basis for risk assessment by preprocessing mass data of multiple sources and multiple formats, significantly improves the accuracy of the evaluation results, and at the same time, integrates the data itself risk, environmental risk and subject behavior risk into a unified evaluation system, realizes multi-dimensional risk fusion through weighted calculation, avoids one-sidedness of single-dimensional evaluation, and realizes the leap from passive risk perception to active risk prediction by combining the prediction risk value output by the risk prediction model with the risk analysis of the heterogeneous data set, realizes the closed-loop mechanism of prediction-decision-feedback, and further helps to deploy control measures in advance to block the risk before it occurs, and based on the knowledge graph, a correlation network graph of data-subject-environment-risk is constructed, the risk transmission path is intuitively presented through differentiated node marking and time axis dynamic demonstration, and the risk link is quickly located by inputting keywords in the query information to generate a traceability list containing operation subject, environmental elements, behavior records and other information, so that the technical personnel can quickly understand the risk root.

[0094] The threshold is set for result comparison analysis to determine whether it is good or bad, and the size of the threshold is determined by combining large model analysis of sample data and artificial experience to set entry storage, and can be appropriately adjusted by seasonal or reasonable influence conditions;

[0095] The size of the coefficient is a specific value obtained by quantifying each parameter for subsequent comparison, and the size of the coefficient depends on the number of sample data and the corresponding running coefficient preliminarily set by the person skilled in the art for each group of sample data; as long as it does not affect the proportional relationship between the parameter and the quantized value.

[0096] The above is only a preferred specific embodiment of the application, but the protection scope of the application is not limited thereto, any person skilled in the art can make equivalent replacement or change according to the technical solution and the inventive concept of the application within the technical range disclosed by the application, which should be covered within the protection scope of the application.

Claims

1. A data security management system based on massive data analysis, characterized in that, It includes a data security management center, a multi-source acquisition module, a security processing module, a main risk module, a data environment module, a risk management module, a risk tracing module, and a visual response module; The multi-source acquisition module is used to collect massive amounts of data from multiple sources and in multiple formats through the data access layer and send them to the secure processing module; The security processing module is used to preprocess massive amounts of data from multiple sources and in multiple formats to obtain heterogeneous datasets, and then send the heterogeneous datasets to the main risk module. The subject risk module is used to perform multidimensional assessment and analysis of the subject's own risk in heterogeneous datasets. The obtained fixed risk value and behavioral deviation degree are weighted and calculated to obtain the data's own risk R1. The data environment module is used to acquire and process the environmental risk values ​​of heterogeneous dataset storage / processing nodes; The risk management module is used to perform fusion assessment and risk prediction analysis on the data risk R1 and environmental risk value R2 of heterogeneous datasets to obtain management decision lists corresponding to low risk, medium risk and high risk. The risk tracing module is used to construct a network diagram of the relationship between data, subject, environment and risk and to perform risk tracing analysis. Based on the obtained risk links, a tracing list is formed. The analysis process of the main risk module is as follows: Sensitive tags are automatically labeled in the data content based on heterogeneous datasets. Based on the sensitive tags, the proportion of fields corresponding to extremely high sensitivity, high sensitivity, medium sensitivity, and low sensitivity in the data content is obtained. The sum of the proportion of fields corresponding to extremely high sensitivity, high sensitivity, medium sensitivity, and low sensitivity and their corresponding weight coefficients is set as the sensitivity risk value. Obtain the integrity risk value of the data content. The integrity risk value represents the degree of deviation between the current data content and the standard data content. A fixed risk value is calculated based on the sensitivity risk value × preset sensitivity risk value weighting coefficient + integrity risk value × preset integrity risk value weighting coefficient; The historical normal behavior data of the data subjects is obtained, and statistical methods are used to generate the normal behavior baseline for each subject based on the historical normal behavior data; The current behavior data of the data subject is obtained, and the current behavior data is compared and analyzed with the normal behavior baseline to obtain the behavior deviation between the current behavior data and the normal behavior baseline. The inherent risk R1 of the data is calculated based on a fixed risk value × a preset fixed risk value weighting coefficient + a behavioral deviation degree × a preset behavioral deviation weighting coefficient. The analysis process of the data environment module is as follows: Based on GIS, the physical location of the storage / processing nodes of heterogeneous datasets is matched with pre-divided trust regions to obtain the trust level of the corresponding trust region; Simultaneously, the device health score and network environment risk of the heterogeneous dataset storage / processing node are obtained. The device health score represents the output health score value obtained by inputting device status data into a pre-set health status model. Network environment risk represents the standardized value of the number of device network parameters that deviate from preset thresholds. The environmental risk value R2 is calculated based on the trust level × preset trust level weight coefficient + device health score × preset device health score weight coefficient + (1 - network environment risk) × preset weight coefficient. The analysis process of the risk management module is as follows: The basic risk value is calculated by weighting the data's own risk R1 and the environmental risk value R2, i.e., R1 × preset R1 weight coefficient + (1-R2) × preset R2 weight coefficient = basic risk value; At the same time, the predicted risk value of the heterogeneous dataset within the preset prediction time is obtained. The predicted risk value represents the output prediction value obtained by inputting the features extracted from the heterogeneous dataset into the preset risk prediction model. Retrieve preset thresholds for basic risk value and predicted risk value. The preset thresholds include the maximum value of basic risk value Jmax, the minimum value of basic risk value Jmin, the maximum value of predicted risk value Ymax, and the minimum value of predicted risk value Ymin. The basic risk value and the predicted risk value are compared and analyzed with Jmax, Jmin, Ymax and Ymin to obtain low risk, medium risk and high risk, and the corresponding management decision list is obtained based on low risk, medium risk and high risk. The analysis process of the risk tracing module is as follows: A network graph of data, subject, environment, and risk is constructed based on knowledge graph technology, where nodes include heterogeneous datasets, operating subjects, environments, and risk events. Edges: The relationships between nodes; Timeline: Dynamically demonstrates the chronological process of risk transmission.

2. The data security management system based on massive data analysis according to claim 1, characterized in that, The system obtains the query information input by the operator and extracts keywords from the query information. The keywords include the risk event ID, time, and the IP address of the operator. Based on the network diagram, the risk links corresponding to the query information are obtained, and a traceability list is formed based on the risk links. The traceability list includes the operating entity, environmental factors, and operating behavior.

3. A data security management method based on massive data analysis, wherein the method is applied to the data security management system based on massive data analysis as described in claim 2, characterized in that, Includes the following steps: Step 1: Collect and preprocess massive amounts of data from multiple sources and in multiple formats to obtain heterogeneous datasets; Step 2: Subject's Own Risk Assessment: Conduct multi-dimensional risk assessment and analysis of the subject's own risk based on heterogeneous datasets, calculate and store the data's own risk R1; Step 3: Environmental Risk Acquisition: Based on the geographic information system, the physical location of the storage / processing node is matched with the preset trust area to obtain the trust level. Combined with the device health score and network environment risk, the environmental risk value R2 is obtained through weighted calculation and stored. Step 4: Risk Integration Assessment and Prediction: Calculate the basic risk value and obtain the predicted risk value within the preset prediction period. Compare the basic risk value and the predicted risk value with preset thresholds respectively to determine the risk level and generate the corresponding management decision list. Step 5: Risk Origin Tracing and Visual Response: Construct a network diagram of data-subject-environment-risk to conduct risk origin tracing analysis, obtain an origin tracing list, and display the origin tracing list.

Images