Blockchain-based intelligent management and control method and system for enterprise security risks

Abstract

This invention discloses a blockchain-based intelligent management method and system for enterprise security risks, belonging to the field of enterprise information security technology. The method includes: establishing a blockchain network to generate unique hash values ​​for operational behavior data of various enterprise security data and permanently recording them; acquiring original operational behavior data authenticated by the blockchain; generating operational behavior feature vectors based on the original operational behavior data of enterprise employees; establishing an operational behavior analysis model based on the operational behavior feature vectors to generate an abnormal operational behavior severity index; establishing an enterprise employee permission analysis model based on the abnormal operational behavior severity index to generate the final permission level of enterprise employees; and adjusting the permissions of enterprise employees based on the final permission level. This invention enables real-time adjustment of enterprise employee permission levels, improves data credibility, enhances anomaly detection accuracy, and achieves dynamic permission adaptation, thereby reducing the enterprise's ability to manage security risks.

Description

Technical Field

[0001] This invention belongs to the field of enterprise information security technology, and in particular relates to a method and system for intelligent management and control of enterprise security risks based on blockchain. Background Technology

[0002] With the deepening of enterprise digital transformation, information security risk management has become a critical aspect of enterprise operations and management. Employee operational behavior data serves as a crucial basis for security risk identification, and its authenticity, completeness, and immutability directly impact the accuracy of risk assessment. However, traditional security management systems are susceptible to tampering during data collection and storage, making it difficult to ensure the credibility of operational behavior data. Blockchain technology, with its decentralized, immutable, and traceable characteristics, offers a new technological path to address this issue, and building intelligent enterprise security risk management methods based on blockchain has become an important research direction.

[0003] Currently, enterprise security risk management primarily relies on traditional information security management systems. These systems typically employ methods such as logging, behavior monitoring, and access control for security protection. Some systems use rule engines to match and detect employee actions, triggering alarms when actions violate preset rules; others use statistical analysis models to detect anomalies based on characteristics such as operation frequency and access time. Regarding access control, most systems use role-based static permission allocation mechanisms, or adjust permissions based on some behavioral analysis results.

[0004] However, existing technologies have significant drawbacks: First, operational behavior data in traditional systems is stored in centralized databases, which are vulnerable to tampering or deletion by internal personnel, making data reliability difficult to guarantee. Second, existing anomaly detection methods are mostly based on simple rules or statistical analysis, lacking in-depth fusion analysis of multi-dimensional operational behavior characteristics, resulting in limited detection accuracy. Finally, access control mechanisms lack dynamic adaptability, failing to accurately adjust permissions based on employees' real-time risk behaviors, easily leading to excessively high or low permissions, thus threatening enterprise security. Furthermore, existing systems struggle to achieve full traceability of operational behavior data, making it impossible to accurately reconstruct the operational process when a security incident occurs, hindering incident tracing and accountability. Simultaneously, traditional access control mechanisms often lag behind actual risk changes, failing to respond promptly to sudden security threats, thereby reducing the enterprise's ability to manage security risks. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a blockchain-based intelligent management method and system for enterprise security risks, thus resolving the aforementioned problems.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a blockchain-based intelligent management method for enterprise security risks, specifically comprising the following steps:

[0007] By building a blockchain network, the operational behavior data of various types of enterprise security data is generated into a unique hash value and permanently recorded to ensure the authenticity and trustworthiness of the original operational behavior data.

[0008] Obtain raw operational behavior data that has been certified by blockchain, and generate operational behavior feature vectors based on the raw operational behavior data of enterprise employees;

[0009] Based on the operational behavior feature vector, an operational behavior analysis model is established to generate an abnormal operational behavior severity index;

[0010] Based on the severity index of abnormal operation behavior, an enterprise employee permission analysis model is established to generate the final permission level of enterprise employees.

[0011] Adjust employee permissions based on their final permission level.

[0012] Based on the above technical solutions, the present invention also provides the following optional technical solutions:

[0013] Further technical solution: The method for generating the severity index of the abnormal operation behavior specifically includes:

[0014] Based on the operational behavior feature vector, an operational behavior risk index is generated;

[0015] Operational behaviors are classified according to the operational behavior risk index; the classification types include abnormal operational behaviors.

[0016] Based on the operational behavior risk index of abnormal operations, an operational behavior analysis model is established to generate an abnormal operation behavior severity index.

[0017] Further technical solutions: The specific methods for generating the operational behavior risk index include:

[0018] Through the formula:

[0019]

[0020] Generate an operational behavior risk index d;

[0021] In the formula, This represents the feature vector of the current operation behavior. This represents the mean vector of the feature vectors of normal operating behavior. This represents the covariance matrix of the feature vectors of normal operating behavior. It represents the inverse of the covariance matrix, and T represents the matrix transpose operator.

[0022] Further technical solutions: The specific methods for classifying operational behaviors include:

[0023] Compare the operational behavior risk index with the operational behavior risk index threshold;

[0024] If the risk index of an operational behavior is greater than the threshold of the operational behavior risk index, then the operational behavior is classified as an abnormal operational behavior.

[0025] Further technical solution: The operational behavior analysis model:

[0026]

[0027] In the expression, This represents the severity index of the j-th type of abnormal operation behavior. denoted by , represents the upper limit of the severity index of the j-th type of abnormal operation behavior, and d represents the operation behavior risk index. This represents the center point threshold for the j-th type of abnormal operation behavior. The center point threshold refers to the preset value of the operation behavior risk index, which measures the severity of the abnormal operation behavior. is the sensitivity coefficient for the j-th type of abnormal operation behavior.

[0028] Further technical solutions: The specific methods for generating the final permission levels of enterprise employees include:

[0029] Based on the severity index of abnormal operational behavior, a dynamic risk score for enterprise employees is generated;

[0030] An employee permission analysis model is established based on the dynamic risk scores of enterprise employees to generate the final permission level of enterprise employees.

[0031] Further technical solutions: The specific methods for generating the dynamic risk score for enterprise employees include:

[0032] Through the formula:

[0033]

[0034] Generate dynamic risk scores for enterprise employees ;

[0035] In the formula, This represents the historical dynamic risk score of the company's employees. This represents the severity index of the j-th type of abnormal operation at time t. This represents the weight coefficient of the j-th type of abnormal operation behavior. This represents the decay coefficient of the historical dynamic risk score of enterprise employees, and n represents the number of abnormal operational behaviors.

[0036] Further technical solution: The specific expression of the enterprise employee permission analysis model is as follows:

[0037]

[0038] In the expression, This indicates the final level of authority for employees within the company. This indicates the current employee access level. R represents the lowest level of authority an employee has before being stripped of their privileges, and R represents the normalized value of the employee's dynamic risk score.

[0039] A blockchain-based intelligent enterprise security risk management system is used to implement the aforementioned blockchain-based intelligent enterprise security risk management method, specifically including:

[0040] The blockchain building unit is used to build a blockchain network, generate unique hash values ​​for the operational behavior data of various types of enterprise security data and record them permanently to ensure the authenticity and trustworthiness of the original operational behavior data.

[0041] The data acquisition unit is used to acquire raw operational behavior data that has been authenticated through the blockchain, and to generate operational behavior feature vectors based on the raw operational behavior data of the company's employees.

[0042] The behavior analysis unit is used to establish an operation behavior analysis model based on the operation behavior feature vector and generate an abnormal operation behavior severity index.

[0043] The permission analysis unit is used to build an employee permission analysis model based on the severity index of abnormal operation behavior and generate the final permission level of the employee.

[0044] The control unit is used to adjust the permissions of employees based on their final permission level.

[0045] Further technical solution: The behavior analysis unit specifically includes:

[0046] The risk analysis module is used to generate an operational behavior risk index based on the operational behavior feature vector.

[0047] The behavior classification module is used to classify operational behaviors based on the operational behavior risk index; the classification types include abnormal operational behaviors.

[0048] The severity index output module is used to establish an operational behavior analysis model based on the operational behavior risk index of abnormal operational behavior and generate an abnormal operational behavior severity index.

[0049] The permission analysis unit specifically includes:

[0050] The risk scoring generation module is used to generate dynamic risk scores for enterprise employees based on the severity index of abnormal operational behaviors.

[0051] The final permission level generation module is used to establish an employee permission analysis model based on the dynamic risk scores of enterprise employees and generate the final permission level of enterprise employees.

[0052] This invention provides a blockchain-based intelligent management and control method and system for enterprise security risks, which has the following advantages compared with existing technologies:

[0053] This invention ensures the immutability of operational behavior data by building a blockchain network, generates an abnormal operation behavior severity index by combining multi-dimensional feature vectors to establish an analysis model, and realizes real-time adjustment of permission levels based on dynamic risk scoring. This improves data credibility, enhances the accuracy of anomaly detection, and enables dynamic adaptation of permissions, thereby reducing the enterprise's ability to control security risks. Attached Figure Description

[0054] Figure 1 A flowchart illustrating the blockchain-based intelligent management and control method for enterprise security risks provided by this invention.

[0055] Figure 2 A schematic diagram of the structure of the blockchain-based intelligent management and control system for enterprise security risks provided by the present invention. Detailed Implementation

[0056] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0057] The specific implementation of the present invention will be described in detail below with reference to specific embodiments.

[0058] Please see Figure 1 The present invention provides a blockchain-based intelligent management and control method for enterprise security risks, comprising the following steps:

[0059] Step S10: Build a blockchain network to generate unique hash values ​​for the operational behavior data of various types of enterprise security data and record them permanently to ensure that the original operational behavior data is authentic and trustworthy;

[0060] Step S20: Obtain the original operation behavior data after blockchain authentication, and generate operation behavior feature vectors based on the original operation behavior data of enterprise employees; the feature vector refers to a set of operation behaviors including but not limited to the time, location, corresponding personnel, access frequency, data access volume, etc.

[0061] Step S30: Based on the operational behavior feature vector, establish an operational behavior analysis model and generate an abnormal operational behavior severity index;

[0062] Step S40: Establish an employee permission analysis model based on the severity index of abnormal operation behavior, and generate the final permission level of employees.

[0063] Step S50: Adjust the permissions of employees according to their final permission level.

[0064] Among them, a blockchain network refers to a distributed ledger system composed of multiple nodes. Specifically, it can be implemented using a consortium blockchain architecture. It ensures data consistency through consensus algorithms, and its role is to prevent operation records from being tampered with.

[0065] Hash value generation refers to converting raw operational data into a fixed-length digital fingerprint, which can be achieved using the SHA-256 algorithm to ensure data integrity and verifiability.

[0066] Operational behavior feature vectors refer to mathematical representations that contain multi-dimensional behavioral features. Specifically, they can be constructed using a vector space model to comprehensively characterize employee operational patterns.

[0067] The severity index of abnormal operation behavior is a numerical indicator that quantifies the degree of risk of abnormal behavior. It can be calculated through a logistic regression model to provide a quantitative basis for permission adjustment.

[0068] The permission analysis model refers to a calculation model that maps risk indices to permission levels. Specifically, it can be implemented using a linear weighted algorithm to achieve dynamic adaptation of permissions.

[0069] Specifically, blockchain network nodes receive operational behavior data uploaded by various terminals in real time, generate unique identifiers through hash calculations, and store them in the distributed ledger. Data authenticated by the blockchain then enters the feature extraction stage, transforming discrete operation records into numerical vectors containing spatiotemporal characteristics, behavior frequency, and access scale. The analysis model calculates the deviation of the feature vectors from normal behavior patterns, outputting an index value representing the severity of risk. The permission model adjusts access permission levels based on the real-time risk index, automatically triggering permission downgrade operations when high-risk behavior is detected, forming a complete closed loop from data storage and risk identification to access control.

[0070] Compared to existing technologies, blockchain networks replace traditional centralized databases, fundamentally eliminating the possibility of data tampering. Multi-dimensional feature vector analysis overcomes the limitations of single-dimensional statistics, enabling the identification of complex abnormal behavior patterns. The dynamic permission model changes the rigid mechanism of static permission allocation, improving the timeliness of risk response. In a test case, after deploying this invention, a company found that all attempts to tamper with operation logs were blocked by the blockchain mechanism. Multi-dimensional feature analysis significantly improved the detection rate of abnormal behavior, and the response time for permission adjustments was reduced to minutes.

[0071] Through the above technical solutions, this invention ensures the immutability of operational behavior data and maintains the authenticity of audit traceability data. Multi-dimensional feature fusion analysis enhances the ability to identify complex anomaly patterns, reducing false positives and false negatives. A dynamic permission mechanism enables real-time linkage between risk response and permission adjustment, avoiding security risks caused by excessive privileges. A closed-loop management system effectively coordinates data storage, risk analysis, and permission execution, improving overall security protection effectiveness.

[0072] Preferably, the present invention further proposes a method for generating the severity index of the abnormal operation behavior, specifically including:

[0073] Step S31: Generate an operational behavior risk index based on the operational behavior feature vector;

[0074] Step S32: Classify operational behaviors according to the operational behavior risk index; the classification types include abnormal operational behaviors;

[0075] Step S33: Based on the operational behavior risk index of abnormal operation behavior, establish an operational behavior analysis model and generate an abnormal operation behavior severity index;

[0076] Among them, the operational behavior risk index is a quantitative indicator obtained by multi-dimensional feature fusion calculation. Specifically, it can be implemented using the Mahalanobis distance formula. By calculating the statistical distance between the current operational behavior feature vector and the normal behavior feature vector, the misjudgment problem caused by single-dimensional analysis can be solved.

[0077] Operational behavior classification refers to a binary judgment mechanism based on preset thresholds, which can be achieved by comparing risk indices with dynamically adjusted thresholds, and is used to screen key abnormal behaviors.

[0078] Operational behavior analysis models refer to conversion functions that map risk indices to severity levels, which can be implemented using S-curve functions.

[0079] Specifically, the operational behavior feature vector is input into the risk index calculation module, which uses the Mahalanobis distance formula to calculate the degree of deviation from the normal behavior pattern, generating a continuous risk index. This index is then passed to the classification module, where it is compared in real time with a preset threshold. If the index exceeds the threshold, it is determined to be an abnormal operational behavior. For the selected abnormal behaviors, an S-curve function is used to convert the risk index into a standardized severity index, where the function parameters can be dynamically adjusted according to different anomaly types. This forms a progressive analysis process from feature extraction and risk quantification to severity classification, enabling dynamic assessment of abnormal behaviors.

[0080] Compared to existing technologies, traditional methods rely on manual rules or single statistical indicators for anomaly detection, such as threshold alerts based solely on access frequency or data volume, failing to integrate multi-dimensional features such as time, location, and personnel. This invention, by constructing a multi-dimensional feature vector and risk index calculation model, achieves the fusion analysis of multi-dimensional data and converts the risk index into an actionable severity index, solving the problems of low detection accuracy and static risk assessment inherent in traditional methods.

[0081] Through the above technical solutions, this invention improves the detection accuracy of abnormal operation behavior and avoids false alarms or missed alarms caused by single-dimensional analysis; it realizes dynamic quantitative assessment of the severity of abnormal behavior, providing an operable decision basis for permission adjustment; and through a parameter-adjustable conversion function, it adapts to the differentiated needs of different enterprise security strategies, enhancing the applicability of the technical solutions.

[0082] Preferably, the present invention further proposes a method for generating the operational behavior risk index, specifically including:

[0083] Through the formula:

[0084]

[0085] Generate an operational behavior risk index d;

[0086] In the formula, This represents the feature vector of the current operation behavior. This represents the mean vector of the feature vectors of normal operating behavior. This represents the covariance matrix of the feature vectors of normal operating behavior. It represents the inverse of the covariance matrix, and T represents the matrix transpose operator;

[0087] Among them, the current operation behavior feature vector refers to a multi-dimensional data set composed of time, location, personnel, access frequency and data access volume. Specifically, it can be formed by normalizing the original operation behavior data using data standardization methods and then splicing them together to characterize the comprehensive features of the current operation behavior.

[0088] The mean vector of the normal operating behavior feature vector refers to the arithmetic mean of the historical normal operating behavior feature vectors. Specifically, it can be calculated by statistically analyzing historical operating behavior data and is used to establish a baseline pattern of normal operating behavior.

[0089] The covariance matrix refers to the covariance relationship matrix between the dimensions of the normal operating behavior feature vector. Specifically, it can be constructed by calculating the covariance values ​​using historical normal operating behavior feature vector samples, and is used to eliminate the correlation interference between different feature dimensions.

[0090] The inverse of the covariance matrix is ​​the result of the mathematical inverse operation of the covariance matrix, which can be achieved through matrix inversion algorithms and is used to perform linear transformations on multidimensional feature spaces.

[0091] The matrix transpose operator is a mathematical operation that converts a row vector into a column vector. Specifically, it can be achieved by swapping the row and column indices of a matrix, and is used to satisfy the dimension matching requirement of matrix multiplication.

[0092] Specifically, this technical solution quantifies the risk index by calculating the Mahalanobis distance between the current operational behavior feature vector and the mean vector of normal operational behavior. First, it obtains certified historical normal operational behavior data from the blockchain network, extracting features such as time, location, personnel, access frequency, and data access volume to construct a feature vector set. The mean vector and covariance matrix are then obtained through statistical calculations. When a new operational behavior occurs, its feature vector is input into a formula to calculate the degree of deviation from the normal pattern. The introduction of the inverse covariance matrix eliminates the influence of dimensional differences and correlations between different feature dimensions. For example, access frequency and data access volume may have a positive correlation; linear transformation of the inverse covariance matrix can eliminate such interference, making the calculation results more objectively reflect the true degree of anomaly. Matrix transpose ensures that the multiplication of vectors and inverse matrices conforms to mathematical rules, and the final output d value is the normalized multidimensional risk quantification index.

[0093] Compared to existing technologies, traditional methods typically use Euclidean distance or single-dimensional threshold comparisons for risk quantification, failing to consider the correlation between multi-dimensional features. For example, they may detect abnormal access frequency in isolation while ignoring its correlation with data access volume, leading to a high false positive rate. This invention effectively solves the problem of multi-dimensional feature coupling interference by adjusting the feature space distribution through the inverse covariance matrix. For instance, when an employee accesses data frequently but with low data volume outside of working hours, the system can accurately identify the degree of deviation of this composite feature from the normal pattern, rather than judging whether a single feature exceeds the limit in isolation.

[0094] Through the above technical solution, this invention achieves the fusion analysis of multi-dimensional operational behavior characteristics, eliminating the differences in dimensions and correlation interference between different feature dimensions, and solving the problem of misjudgment of anomalies caused by single-dimensional detection or simple statistical analysis in traditional methods. The risk quantification model constructed using statistical methods can objectively reflect the degree of deviation between operational behavior and normal patterns, providing accurate quantitative basis for subsequent anomaly classification and permission adjustment.

[0095] Preferably, the present invention further proposes that the method for classifying operational behaviors specifically includes:

[0096] Compare the operational behavior risk index with the operational behavior risk index threshold;

[0097] If the risk index of an operational behavior is greater than the threshold of the operational behavior risk index, then the operational behavior is classified as an abnormal operational behavior.

[0098] If the operational behavior risk index is less than or equal to the operational behavior risk index threshold, then the operational behavior is classified as normal operational behavior.

[0099] Among them, the operational behavior risk index threshold is a critical value used to distinguish between normal and abnormal operational behaviors. Specifically, it can be implemented using a dynamic adjustment mechanism. For example, an initial threshold can be set based on the statistical distribution of historical operational behavior risk indices and dynamically updated as new data is added. This threshold serves as a classification benchmark, providing an objective basis for anomaly determination.

[0100] Specifically, the operational behavior risk index is calculated using the Mahalanobis distance formula; a larger distance value indicates a greater deviation from the normal pattern. The calculated risk index is compared to a preset threshold. If the risk index exceeds the threshold, the operation is classified as abnormal; otherwise, it is considered normal. This classification mechanism, by combining quantitative indicators with fixed thresholds, avoids the ambiguity caused by relying on subjective rule matching in traditional methods. Furthermore, the dynamic adjustment mechanism of the threshold can be optimized based on changes in enterprise security strategies or historical data distribution. For example, the threshold can be appropriately increased during peak data access periods to reduce false positives, thereby achieving adaptive optimization of the classification criteria.

[0101] Compared to existing technologies, traditional anomaly detection methods typically rely on manually preset static rules or single-dimensional statistical thresholds, such as setting fixed thresholds based solely on access frequency or data volume. This can easily lead to misjudgments due to changes in the scenario. In contrast, this invention calculates a risk index through multi-dimensional feature fusion and combines it with a dynamic threshold adjustment mechanism, enabling a more accurate reflection of the overall risk level of operational behavior. For example, when employees are handling unexpected tasks, even if there is a sudden surge in daily data access, the risk index may still be lower than the dynamically adjusted threshold if other characteristics do not deviate from normal patterns, thus avoiding misjudgment as abnormal operation.

[0102] Through the above technical solution, this invention solves the problems of high misjudgment rate and inaccurate identification caused by the lack of dynamic quantitative classification standards in traditional methods. By using a quantitative comparison mechanism between risk indices and thresholds, objective judgment of abnormal operational behaviors is achieved, reducing the probability of misclassification due to subjective rule setting biases or insufficient single-dimensional analysis. Simultaneously, the dynamic threshold adjustment mechanism can adapt to changes in behavioral patterns under different business scenarios, improving the scenario adaptability of the classification results.

[0103] Preferably, the present invention further proposes the operational behavior analysis model:

[0104]

[0105] In the expression, This represents the severity index of the j-th type of abnormal operation behavior. denoted by , represents the upper limit of the severity index of the j-th type of abnormal operation behavior, and d represents the operation behavior risk index. This represents the center point threshold for the j-th type of abnormal operation behavior. The center point threshold refers to the preset value of the operation behavior risk index (this value is set by relevant personnel in this field) to measure whether the abnormal operation behavior is serious. Let be the sensitivity coefficient for the j-th type of abnormal operation behavior;

[0106] Among them, the upper limit of the severity index of abnormal operation behavior refers to the highest score value of a certain type of abnormal operation behavior that is set in advance. It can be set through the business risk assessment results. This parameter is used to limit the maximum impact range of different types of abnormal behavior.

[0107] The operational behavior risk index is a risk quantification value calculated through multi-dimensional feature vectors. Specifically, the Mahalanobis distance algorithm can be used to measure the degree of deviation between the current operational behavior and the normal behavior benchmark. This value reflects the degree of abnormality of the operational behavior in the multi-dimensional feature space.

[0108] The center point threshold refers to the dividing point for judging the severity of a certain type of abnormal operation behavior. Specifically, different thresholds can be set based on historical data statistics or expert experience. This parameter makes different abnormal categories have different judgment criteria.

[0109] The sensitivity coefficient is a parameter that controls the rate at which the severity index changes with the risk index. It can be adjusted according to the response speed requirements of the business scenario.

[0110] Specifically, the operational behavior analysis model maps the operational behavior risk index to a standardized severity index using a logistic function. When the operational behavior risk index is below the central threshold, the severity index rises slowly with the risk index; when the risk index approaches or exceeds the threshold, the severity index approaches the preset upper limit at an exponential rate. By setting independent upper limits, thresholds, and sensitivity coefficients for different anomaly categories, the same risk index produces differentiated severity assessment results across different anomaly categories. For example, for high-risk data tampering anomalies, even if the risk index only slightly exceeds the higher threshold, its severity index will quickly climb to near the upper limit, while for regular access frequency anomalies, the risk index must significantly exceed the lower threshold to trigger a high severity index.

[0111] Compared to existing technologies, traditional methods typically use fixed thresholds to uniformly judge all abnormal behaviors, failing to differentiate the actual severity of different categories of abnormalities and easily leading to overestimating low-risk behaviors or underestimating high-risk behaviors. This invention, however, achieves refined evaluation of different abnormal behaviors through categorized parameter configuration. For example, when an abnormal data export volume is detected, different thresholds and sensitivity parameters are used compared to those for abnormal login periods, thereby accurately reflecting the actual impact weight of the two types of behaviors in permission adjustment decisions.

[0112] Through the above technical solution, this invention solves the problem of insufficient evaluation accuracy caused by the lack of multi-dimensional feature fusion and unified threshold determination in traditional anomaly detection methods. This enables the access control system to dynamically adjust its permissions based on the actual severity of abnormal behavior. For example, when a high-risk anomaly involving core data is detected, a significant permission downgrade can be triggered immediately. For minor anomalies in routine operations, only minor permission adjustments or warnings are issued, thus ensuring security while avoiding excessive restrictions on normal business operations.

[0113] Preferably, the present invention further proposes a method for generating the final permission level of the enterprise employee, specifically including:

[0114] Step S41: Generate dynamic risk scores for enterprise employees based on the severity index of abnormal operational behavior;

[0115] Step S42: Establish an employee permission analysis model based on the dynamic risk scores of enterprise employees, and generate the final permission levels of enterprise employees;

[0116] Among them, the dynamic risk score of enterprise employees refers to a quantitative indicator that reflects the real-time safety risk status of employees. Specifically, it can be calculated by combining the time decay weighted algorithm with historical scores and the current abnormal index. This scoring mechanism can dynamically capture the changing trend of employee operational behavior.

[0117] The enterprise employee access control model refers to a mapping mechanism that converts risk scores into access levels. Specifically, it can be implemented using a normalized score difference calculation model. This model establishes a correspondence between risk levels and access control adjustments through mathematical operations.

[0118] Specifically, the dynamic risk score integrates historical security records and real-time anomaly indices to form a comprehensive evaluation value. The decay coefficient of the historical score balances the weights of historical behavior and current status. The access control model determines the final access level by calculating the difference between the basic access level and the impact value of the risk score. This calculation process uses mathematical formulas to ensure that access control adjustments have repeatable and verifiable computational logic.

[0119] Compared to existing technologies, traditional access control systems rely on fixed-period manual review or automatic adjustments based on simple thresholds, failing to respond in real-time to changes in operational risks. Existing static role-based access control mechanisms lack a feedback channel for continuous monitoring of abnormal behavior. In contrast, this invention establishes an automatic correlation mechanism between dynamic scoring and access control models, enabling the updating of access control levels.

[0120] Through the above technical solution, this invention can automatically adjust access permissions based on the real-time risk status of employee operational behavior, effectively preventing data leakage risks caused by excessively high permissions in high-risk states, while avoiding excessive restriction of permissions affecting normal business operations in low-risk states. The dynamic scoring mechanism ensures that permission adjustment decisions are based on continuously updated behavioral data analysis, and the permission model calculation process guarantees the objectivity and traceability of the adjustment results.

[0121] Preferably, the present invention further proposes a method for generating the dynamic risk score of enterprise employees, specifically including:

[0122] Through the formula:

[0123]

[0124] Generate dynamic risk scores for enterprise employees ;

[0125] In the formula, This represents the historical dynamic risk score of the company's employees. This represents the severity index of the j-th type of abnormal operation at time t. This represents the weight coefficient of the j-th type of abnormal operation behavior. This represents the decay coefficient of the historical dynamic risk score of enterprise employees, and n represents the number of abnormal operating behaviors.

[0126] Among them, the historical enterprise employee dynamic risk score refers to the historical risk data of employees accumulated over time. Specifically, the historical score can be updated using the sliding window algorithm or the exponential smoothing method to reflect the risk accumulation of employees' long-term behavioral patterns.

[0127] The severity index of abnormal operation behavior refers to the quantitative risk value of the j-th type of abnormal operation behavior detected at time t. Specifically, the risk index of operation behavior can be nonlinearly mapped by a logistic function or a probability model to characterize the immediate threat level of the current abnormal behavior.

[0128] Weighting coefficient This refers to the contribution weight of different categories of abnormal operation behaviors to the overall risk score. Specifically, it can be dynamically adjusted according to the enterprise's security strategy using the analytic hierarchy process or the entropy weight method to reflect the differentiated impact of high-risk behavior types on access control decisions.

[0129] The decay coefficient refers to the proportion of historical scores retained in dynamic assessment. It can be set through a time decay function or an empirical threshold to balance the weighting of historical and real-time behaviors in risk assessment.

[0130] Specifically, the dynamic risk scoring system integrates historical risk data and real-time abnormal behavior data through a linear combination. Historical scores, after being weighted with a decay coefficient, retain the risk characteristics of employees' long-term behavioral patterns, avoiding sudden changes in scores due to occasional abnormal events. The severity index of abnormal behavior at the current time t is weighted and summed using weighted coefficients to reflect the overall risk level of multiple types of abnormal behavior at present. This combination mechanism enables the scoring model to both capture trend changes in employee behavior and respond quickly to high-risk real-time operations.

[0131] Compared to existing technologies, traditional access control systems typically use fixed time windows to count the number of abnormal behaviors or rely solely on real-time detection results for scoring. For example, some systems simply accumulate historical scores, leading to early low-risk behaviors having a long-term impact on current access decisions; others rely entirely on real-time data and cannot identify persistent risky behaviors. This invention, by introducing a decay coefficient and a differentiated weighting mechanism, avoids the excessive accumulation of historical data while enhancing the immediate impact of key abnormal behaviors, thus solving the problem of static evaluation models' insufficient capture of temporal characteristics of behavior.

[0132] Through the above technical solution, this invention achieves dynamic fusion of historical risk data and real-time abnormal behavior, enabling employee risk scores to simultaneously reflect long-term behavioral patterns and short-term risk changes. Specifically, when an employee performs a high-risk real-time operation, the weighting coefficient... This can increase the score contribution of such behavior and trigger immediate permission adjustments; when employees exhibit low-risk abnormal behavior over a long period, the attenuation coefficient... The impact of historical scores can be gradually reduced to prevent excessive restrictions on permissions. This scoring mechanism provides enterprise access control systems with a quantitative basis for decision-making that balances temporal characteristics and the severity of behaviors.

[0133] Preferably, the present invention further proposes the following expression for the enterprise employee permission analysis model:

[0134]

[0135] In the expression, This indicates the final level of authority for employees within the company. This indicates the current employee access level. This represents the lowest level of authority an employee has before being stripped of their privileges, and R represents the normalized value of the employee's dynamic risk score.

[0136] The current employee permission level refers to the permission level currently granted to the employee. This can be achieved by querying the role configuration table in the permission management database, such as the preset permission level in the role-based access control model.

[0137] The minimum privilege level refers to the lowest level of privileges an employee is allowed to retain before privileges are revoked. This can be determined by the security policy set by the system administrator, such as retaining only basic data viewing privileges.

[0138] Normalized values ​​refer to standardized values ​​that map dynamic risk scores to the [0,1] interval. Specifically, they can be achieved using linear normalization or maximum / minimum scaling methods.

[0139] Specifically, the permission adjustment process links dynamic risk scores to permission levels through mathematical expressions. When an employee's dynamic risk score increases, the normalized value of the employee's dynamic risk score also increases, leading to an adjustment in the current employee's permission level. The lowest level of privileges an employee had before being stripped of their authority. Decreasing in direction. This model defines the degradable permission space as... This ensures that permission adjustments remain within a controllable range, preventing permissions from becoming completely invalid due to risk fluctuations. The normalization of dynamic risk scores for enterprise employees ensures that risk scores uniformly influence permission levels, eliminating the impact of numerical differences on permission calculations.

[0140] Compared to existing technologies, traditional access control systems rely on static role assignments or simple rules to trigger permission changes, such as revoking permissions only when a high-risk event is detected. This invention, however, achieves continuous and smooth adjustment of permission levels through a dynamic risk score and a mathematical mapping relationship between permission levels. For example, existing technologies may divide permissions into "normal" or "disabled" states, while this invention allows permissions to be progressively downgraded based on the degree of risk, avoiding excessive restriction that could impact business operations while responding to changes in risk in real time.

[0141] Through the above technical solution, this invention solves the problem of unreasonable permission allocation caused by the lack of dynamic adaptability in traditional permission management. By converting dynamic risk scoring into a linear function of permission levels, permissions are adjusted in real time according to the risk level. For example, when an employee exhibits moderate-risk behavior, the permission level can be reduced proportionally rather than completely disabled, ensuring both security and business continuity. Simultaneously, by setting a minimum permission level, it prevents excessive deprivation of permissions that could prevent necessary operations from being performed. This model replaces manual intervention with mathematical calculations, improving the responsiveness and accuracy of permission adjustments, thereby enhancing the enterprise's ability to manage security risks.

[0142] For preferred options, please refer to [link / reference]. Figure 2 This invention further proposes a blockchain-based intelligent enterprise security risk management system. This system is used to execute the aforementioned blockchain-based intelligent enterprise security risk management method, specifically including:

[0143] Blockchain building unit 10 is used to build a blockchain network, generate unique hash values ​​for the operational behavior data of various types of enterprise security data and record them permanently to ensure that the original operational behavior data is authentic and trustworthy.

[0144] The data acquisition unit 20 is used to acquire the original operational behavior data after blockchain authentication, and generate operational behavior feature vectors based on the original operational behavior data of enterprise employees.

[0145] The behavior analysis unit 30 is used to establish an operation behavior analysis model based on the operation behavior feature vector and generate an abnormal operation behavior severity index.

[0146] The permission analysis unit 40 is used to establish an enterprise employee permission analysis model based on the severity index of abnormal operation behavior and generate the final permission level of enterprise employees.

[0147] Control unit 50 is used to adjust the permissions of employees based on their final permission level.

[0148] Preferably, the present invention further proposes that the behavior analysis unit 30 specifically includes:

[0149] The risk analysis module is used to generate an operational behavior risk index based on the operational behavior feature vector.

[0150] The behavior classification module is used to classify operational behaviors based on the operational behavior risk index; the classification types include abnormal operational behaviors.

[0151] The severity index output module is used to establish an operational behavior analysis model based on the operational behavior risk index of abnormal operational behavior, and generate an abnormal operational behavior severity index.

[0152] Preferably, the present invention further proposes that the permission analysis unit 40 specifically includes:

[0153] The risk scoring generation module is used to generate dynamic risk scores for enterprise employees based on the severity index of abnormal operational behaviors.

[0154] The final permission level generation module is used to establish an employee permission analysis model based on the dynamic risk scores of enterprise employees and generate the final permission level of enterprise employees.

[0155] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1.A blockchain-based intelligent management and control method for enterprise security risks, characterized in that, Specifically comprising the following steps: The blockchain network is built, the operation behavior data of various types of security data of the enterprise is generated into a unique hash value and permanently recorded, and the authenticity and reliability of the original operation behavior data are ensured; The original operation behavior data authenticated through the blockchain is obtained, and an operation behavior feature vector is generated according to the original operation behavior data of the enterprise employees; An operation behavior analysis model is established according to the operation behavior feature vector, and an abnormal operation behavior severity index is generated; An enterprise employee permission analysis model is established according to the abnormal operation behavior severity index, and the most binding permission level of the enterprise employees is generated; The permission of the enterprise employees is adjusted according to the most binding permission level of the enterprise employees. The generation mode of the enterprise employee dynamic risk score specifically comprises: The expression of the enterprise employee permission analysis model is specifically: Generating enterprise employee dynamic risk scores ; in the formula, represents a historical enterprise employee dynamic risk score, represents an abnormal operation behavior severity index of the jth abnormal operation behavior at time t, represents a weight coefficient of the jth abnormal operation behavior, represents a decay coefficient of the historical enterprise employee dynamic risk score, and n represents a number of abnormal operation behaviors; The generation mode of the abnormal operation behavior severity index specifically comprises: In the expression, represents the maximum permission level of the enterprise employee, represents the current permission level of the enterprise employee, represents the minimum permission level of the enterprise employee before the enterprise employee is deprived of the permission, and R represents the normalized value of the dynamic risk score of the enterprise employee. 2.The blockchain-based enterprise security risk intelligent management and control method according to claim 1, characterized in that, An operation behavior risk index is generated according to the operation behavior feature vector; The operation behavior is classified according to the operation behavior risk index; the classification types include abnormal operation behavior; An operation behavior analysis model is established according to the operation behavior risk index of the abnormal operation behavior, and an abnormal operation behavior severity index is generated. The generation mode of the operation behavior risk index specifically comprises: 3.The blockchain-based enterprise security risk intelligent management and control method according to claim 2, characterized in that, The classification mode of the operation behavior specifically comprises: The operation behavior risk index is compared with the operation behavior risk index threshold value; The generated operation behavior risk index d; in the formula, represents the current operation behavior feature vector, represents the mean vector of the normal operation behavior feature vector, represents the covariance matrix of the normal operation behavior feature vector, represents the inverse matrix of the covariance matrix, and T represents the matrix transposition operator. 4.The blockchain-based enterprise security risk intelligent management and control method according to claim 2, characterized in that, If the operation behavior risk index is greater than the operation behavior risk index threshold value, the operation behavior is classified as abnormal operation behavior. The operation behavior analysis model: The generation mode of the most binding permission level of the enterprise employees specifically comprises: 5.The blockchain-based enterprise security risk intelligent management and control method according to claim 2, characterized in that, An enterprise employee dynamic risk score is generated according to the abnormal operation behavior severity index; In the expression, represents the abnormal operation behavior severity index of the jth type of abnormal operation behavior, represents the upper limit of the abnormal operation behavior severity index of the jth type of abnormal operation behavior, and d represents the operation behavior risk index, represents the center point threshold value of the jth type of abnormal operation behavior, and the center point threshold value refers to a preset value of the operation behavior risk index corresponding to whether the abnormal operation behavior is severe, is the sensitivity coefficient of the jth type of abnormal operation behavior. 6.The blockchain-based enterprise security risk intelligent management and control method according to claim 1, characterized in that, An enterprise employee permission analysis model is established according to the enterprise employee dynamic risk score, and the most binding permission level of the enterprise employees is generated. The system is used to execute the blockchain-based enterprise security risk intelligent management and control method according to any one of claims 1-6, and specifically comprises: The blockchain building unit is used to build a blockchain network, generate unique hash values for operation behavior data of various types of security data of the enterprise, and permanently record the operation behavior data, so as to ensure the authenticity and reliability of the original operation behavior data; 7. A blockchain-based enterprise security risk intelligent management and control system, characterized in that, The data acquisition unit is used to obtain the original operation behavior data authenticated through the blockchain, and generate an operation behavior feature vector according to the original operation behavior data of the enterprise employees; The behavior analysis unit is used to establish an operation behavior analysis model according to the operation behavior feature vector, and generate an abnormal operation behavior severity index; The permission analysis unit is used to establish an enterprise employee permission analysis model according to the abnormal operation behavior severity index, and generate the most binding permission level of the enterprise employees; The management and control unit is used to adjust the permission of the enterprise employees according to the most binding permission level of the enterprise employees. The behavior analysis unit specifically comprises: The risk analysis module is used to generate an operation behavior risk index according to the operation behavior feature vector; 8.The blockchain-based enterprise security risk intelligent management and control system according to claim 7, characterized in that, The behavior classification module is used to classify the operation behavior according to the operation behavior risk index; the classification types include abnormal operation behavior; ​ ​ A severity index output module is configured to establish an operation behavior analysis model according to the operation behavior risk index of the abnormal operation behavior, and generate an abnormal operation behavior severity index; The permission analysis unit specifically comprises: A risk score generation module is configured to generate an enterprise employee dynamic risk score according to the abnormal operation behavior severity index. A maximum permission level generation module is configured to establish an enterprise employee permission analysis model according to the enterprise employee dynamic risk score, and generate a maximum permission level of the enterprise employee.

Images