An industrial sensitive data security management platform and method

Abstract

The application discloses an industrial sensitive data security management platform and method, relates to the field of industrial data security management, and collects multi-dimensional industrial data source information through a data discovery and classification grading module, fuses AI deep learning and traditional matching algorithm to analyze data sensitive information, obtains data sensitivity judgment results and business value evaluation, and constructs a multi-dimensional classification grading matrix and a visual data asset map; an access control strategy is generated through a differentiated protection module; global protection measures are deployed based on the access control strategy, permission control, data encryption storage transmission and differentiated desensitization are implemented; the protection effect is verified through a continuous monitoring and auditing module, abnormal behavior is monitored and traced, and a response and recovery module responds to industrial sensitive data security events and restores business; the problems of difficulty in controlling industrial sensitive data in the whole life cycle and insufficient protection pertinence are effectively solved, and the efficiency and stability of data security protection are improved.

Description

Technical Field

[0001] This invention relates to the field of industrial data security management, specifically to an industrial sensitive data security management platform and method. Background Technology

[0002] In the process of industrial digitalization and intelligent transformation, industrial systems have gradually shifted from traditional closed models to open internet architectures. The deep application of technologies such as the Internet of Things, the Industrial Internet, and edge computing has led to an exponential increase in the generation of sensitive industrial data, such as production process parameters, equipment operating data, core formula information, and customer privacy data. This type of data not only concerns the core business interests of enterprises but also directly affects the safety of production operations and the security of critical infrastructure. However, existing technologies still have many shortcomings:

[0003] On the one hand, the entire lifecycle of sensitive industrial data covers multiple stages, including collection, transmission, storage, processing, sharing, archiving, and destruction. The data forms, flow paths, and security risks vary significantly across these stages. However, existing management solutions often adopt a segmented control model, lacking a unified collaborative mechanism across stages. On the other hand, existing protection solutions often draw on data security technologies from the general IT field, failing to fully adapt to the characteristics of industrial scenarios. Industrial data is characterized by high real-time requirements, diverse protocol types, and strong data correlation. General protection technologies often struggle to balance protection effectiveness with production continuity, resulting in insufficient targeting of sensitive data protection for industrial scenarios and low efficiency and stability of data security protection.

[0004] To address the aforementioned shortcomings, a technical solution is provided. Summary of the Invention

[0005] The purpose of this invention is to solve the problem of low efficiency and stability in data security protection, and to propose an industrial sensitive data security management platform and method.

[0006] The objective of this invention can be achieved through the following technical solutions:

[0007] An industrial sensitive data security management platform, comprising:

[0008] Data discovery and classification module: It adopts a multi-algorithm fusion mechanism, combining AI deep learning algorithms with traditional pattern matching algorithms to achieve full coverage identification of structured and unstructured data in industrial environments;

[0009] Differentiated protection module: Based on a multi-dimensional classification and grading matrix and a visualized data asset map, it implements differentiated security protection measures for different levels and types of industrial sensitive data;

[0010] Continuous monitoring and auditing module: Used for real-time tracking, behavioral analysis and security auditing of the entire lifecycle of industrial sensitive data activities, ensuring that data access and operation behaviors comply with security policy requirements, and monitoring anomalies and potential risks;

[0011] Response and Recovery Module: Used to respond to and restore business operations in the event of industrial sensitive data security incidents, ensuring that the spread of risks is prevented and data integrity is restored in the event of data breaches, tampering, or misuse.

[0012] The specific implementation process of the continuous monitoring and auditing module also includes:

[0013] Real-time matching is performed based on predefined security rules, and multi-dimensional behavioral feature vectors are extracted by combining an integrated isolated forest and autoencoder machine learning architecture, including access frequency features, data sensitivity features, operation sequence features, and context features.

[0014] The key parameter set of the baseline model output by machine learning includes the mean vector of the feature vectors. and standard deviation vector ;

[0015] Extract feature vectors consistent with those used in the training phase from the real-time data stream. Low-dimensional representation is obtained based on feature encoding function. ;

[0016] Through formula The user behavior deviation is calculated, where, Indicates the number of feature dimensions; Indicates the first The standard deviation corresponding to each feature dimension;

[0017] Using a sliding time window as the unit, statistical distribution of user behavior deviation is calculated using the formula. The dynamic threshold is obtained, where, This represents the mean deviation of all user behaviors within the sliding time window. This represents the standard deviation of the deviation of all user behaviors within the sliding time window. Indicates the sensitivity coefficient;

[0018] When user behavior deviates from a dynamic threshold, an abnormal event alarm is triggered. Simultaneously, the portion exceeding the dynamic threshold is compared to a preset range to determine the risk level, categorized as low, medium, high, and urgent. This also triggers audit trails and source tracing analysis.

[0019] The specific implementation process of the audit trail and source tracing analysis is as follows:

[0020] Based on standardized logs generated from multi-source data collection, all data access events are recorded with high fidelity. Each event is assigned a unique event ID, timestamp, user identity, data asset identifier, operation type, and context attributes. Event data is injected into a time-series database to support time-range queries and stored in a graph database to maintain event relationships.

[0021] When a user's behavior deviation exceeds the dynamic threshold and an alarm is triggered, source tracing analysis is automatically initiated:

[0022] Extracting related event sequences based on alarm event IDs, using formulas... The event correlation is obtained, where, These represent two independent events. This indicates the number of attribute dimensions, including users, data assets, and operation types; Indicates the first The influence weighting factor of each attribute;

[0023] If the correlation between events exceeds a preset threshold, a potential correlation is determined, and a timeline sequence centered on the alarm event is constructed. Pattern matching is performed based on a predefined tracing rule base, and each rule outputs a suspicion score. The overall root cause probability is obtained based on a weighted fusion formula. At the same time, graph database path analysis is used to trace the spread path of the alarm event and assess the scope of the alarm event's impact on related data assets.

[0024] As a further improvement of the present invention, the specific implementation process of the data discovery and classification module is as follows:

[0025] It employs a distributed scanning engine that supports multiple data source interfaces, including relational databases, non-relational databases, file management, and cloud storage. It collects industrial data from multiple data sources in the industrial environment through distributed crawling technology. A semantic recognition algorithm based on deep learning identifies sensitive information types, including core process parameters and intellectual property data. A regular expression matching algorithm matches sensitive data in fixed formats, and a keyword matching algorithm filters data based on a predefined sensitive word library.

[0026] By weighted fusion of the three types of algorithm identification results, the data sensitivity determination result is obtained; based on the sensitivity determination results including public, internal, sensitive and confidential, and the business value including core, important and general, a multi-dimensional classification and grading system is constructed, and a multi-dimensional classification and grading matrix is ​​formed by combining two-dimensional cross mapping; a visual data asset map containing data storage location, access path and topological relationship is constructed using graph database technology.

[0027] As a further improvement of the present invention, the specific implementation process of the differentiated protection module is as follows:

[0028] Based on a multidimensional classification and grading matrix and a visualized data asset map, a policy generation engine matches data element attributes with predefined rules, defines a data access rule base, and generates executable access control policies, which are then deployed to storage nodes, API gateways, and application terminals by a unified policy management center.

[0029] A dual access control system is employed, combining role-based and attribute-based access control: role-based access control assigns data access permissions and operation scopes based on user roles, while attribute-based access control makes real-time decisions based on dynamic attributes, using formulas... Received access request The decision result is either true or false, that is, allow access or deny access. These represent the logical disjunction and logical conjunction operators, respectively. This represents the rule index number, indicating any rule in the access control policy. This indicates the total number of rules in the access control policy; Indicates the condition index number within a single rule. Indicates the first The number of conditions contained in a rule; Indicates an access request Extract the first The first rule in the article The actual value of the attribute specified by each condition. Indicates the first Rule No. The set of allowed values ​​specified by each condition;

[0030] For sensitive data and core business data, we implement encrypted storage and transmission protection mechanisms. At the same time, we implement differentiated data anonymization strategies for different levels of sensitive data.

[0031] As a further improvement of the present invention, the specific implementation process of the continuous monitoring and auditing module includes:

[0032] Based on the data storage location and access path defined by the visualized data asset map, a log collection agent is deployed to collect data access logs, network traffic logs, and user behavior logs in real time. The collected multi-source logs are standardized through a log aggregation engine, and the processed logs are injected into a time-series database and a graph database for associated storage.

[0033] Real-time matching is performed based on predefined security rules. The rule base includes access to core process data outside of working hours, multiple accesses to multiple confidential data assets by the same account within a short period of time, and unauthorized attempts to read intellectual property data using equipment serial numbers.

[0034] Through formula The calculation yields the result of determining the policy violation trigger signal: "triggered" or "not triggered," indicating whether the violation signal was triggered or not. Representing attributes With allowed value set The matching condition refers to the condition when belong hour, The result is a trigger, when Not belonging to hour, The result was "not triggered".

[0035] As a further improvement of the present invention, the specific implementation process of the response and recovery module is as follows:

[0036] Based on the abnormal alarms and risk levels output by the continuous monitoring and auditing module, a tiered response is triggered:

[0037] When the risk level is low or medium, an incident ticket is generated and the security administrator is notified to handle it manually; when the risk level is high or urgent, an automated response plan is immediately activated, including real-time blocking of access sessions, temporary freezing of user accounts, and isolation of affected data storage nodes or API gateway routes.

[0038] Based on a multi-dimensional classification and grading matrix and a visualized data asset map, priority is given to restoring data with confidential sensitivity or core business value.

[0039] Based on the source analysis output of the continuous monitoring and auditing module, through formulas The event impact score is calculated, where, This indicates the number of impact dimensions, including data sensitivity, business interruption time, and recovery costs; Indicates the first The influence weighting factors for each dimension are dynamically adjusted based on the business value dimension. Indicates the first Quantized values ​​for each dimension;

[0040] The higher the impact score of an event, the higher its priority level, driving improvement measures, including updating the access rule base, adjusting encryption policies, and enhancing monitoring rules. At the same time, all improvement measures are injected into the policy management center and visualized through the data asset map.

[0041] A second aspect of this invention provides a method for managing the security of sensitive industrial data, comprising the following steps:

[0042] S1. Data Discovery and Classification: Industrial data is collected based on a distributed scanning engine that supports multiple data source interfaces. Sensitive data is identified by combining deep learning semantic recognition, regular expression matching, and keyword matching. Sensitivity determination results are obtained based on weighted fusion. A multi-dimensional classification matrix is ​​formed by combining business value, and a visual data asset map containing data topology relationships is constructed using a graph database.

[0043] S2. Differentiated Protection: Based on a multi-dimensional classification and grading matrix and a data asset map, an access rule base is defined, and dual access control based on roles and attributes is adopted. For sensitive data and core business data, an encrypted storage and transmission protection mechanism is implemented. At the same time, a differentiated data desensitization strategy is implemented for sensitive data of different levels.

[0044] S3. Continuous monitoring and auditing: Deploy a log collection agent based on the asset map, collect multi-dimensional logs, and store them in a time-series database and graph database after standardization; analyze user behavior through rule engine and machine learning, calculate user behavior deviation and dynamic threshold, alarm when thresholds are exceeded and determine risk level, record events with high fidelity and trace the correlation when alarms are triggered.

[0045] S4. Response and Recovery: Based on alarms and risk levels, a tiered response is triggered. Priority is given to recovering data assets with a sensitivity level of confidential or core business value and verifying their integrity. After the response is completed, the root cause analysis process is initiated. Based on the root cause analysis results, improvement measures are driven and injected into the strategy center, and visualized through a data asset map.

[0046] Compared with the prior art, the beneficial effects of the present invention are:

[0047] This invention constructs a multi-algorithm fusion mechanism for comprehensive identification of sensitive industrial data. By combining a two-dimensional cross-mapping analysis of data sensitivity and business value, it forms a multi-dimensional classification and grading matrix and a visualized data asset map supported by a graph database. This generates a differentiated security protection system and a dynamic monitoring and auditing mechanism. Based on the multi-dimensional classification and grading results, it optimizes the targeting of protection strategies and optimizes response and recovery priorities by combining event impact scoring. This effectively solves the problems of difficult management and control of sensitive industrial data security and insufficient protection targeting, significantly improving the efficiency and stability of sensitive industrial data security protection. Attached Figure Description

[0048] To facilitate understanding by those skilled in the art, the present invention will be further described below with reference to the accompanying drawings;

[0049] Figure 1 This is the overall system block diagram of the present invention. Detailed Implementation

[0050] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0051] It should be understood that the terms “comprising” and “including” used in this disclosure and claims indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0052] It should also be understood that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this disclosure. As used in this disclosure and claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in this disclosure and claims refers to any combination and all possible combinations of one or more of the associated listed items, and includes such combinations.

[0053] like Figure 1 As shown, the present invention is an industrial sensitive data security management platform, including a data discovery and classification module, a differentiated protection module, a continuous monitoring and auditing module, and a response and recovery module.

[0054] Data discovery and classification module: Employing a multi-algorithm fusion mechanism, this module combines AI deep learning algorithms with traditional pattern matching algorithms to achieve full-coverage identification of structured and unstructured data in industrial environments. The specific implementation process is as follows:

[0055] The data scanning engine performs a comprehensive scan of multi-dimensional data sources in the industrial environment, including databases, file management, applications, and network traffic. The scanning process uses distributed crawling technology to collect industrial data from multi-dimensional data sources. The scanning engine supports multiple data source interfaces, including relational databases, non-relational databases, file management, and cloud storage.

[0056] Deep learning-based semantic recognition algorithms use trained neural networks to semantically understand industrial data content and identify the types of sensitive information contained in industrial data, including core process parameters, intellectual property data, operational data, and core data.

[0057] Core process data includes production formula, process parameters, control logic, and quality inspection data;

[0058] Intellectual property data includes design drawings, R&D documents, patent technical documents, and BOM (Bill of Materials).

[0059] Operational data includes production scheduling, capacity data, supply chain information, and cost data;

[0060] The core data includes the industrial control account, password, and configuration information;

[0061] Based on regular expression matching algorithms, precise matching is performed on sensitive data with fixed formats; sensitive data with fixed formats include ID card numbers, bank card numbers, and industrial equipment serial numbers.

[0062] Based on keyword matching algorithms, filtering is performed using a predefined sensitive word database;

[0063] The recognition results of the three types of algorithms are comprehensively evaluated by weighted fusion to form the final data sensitivity determination result;

[0064] A multi-dimensional classification and grading system is constructed based on data sensitivity assessment results and business value. The sensitivity dimension includes four levels: public, internal, sensitive, and confidential. The business value dimension includes three levels: core, important, and general. A multi-dimensional classification and grading matrix is ​​formed based on two-dimensional cross-mapping. Data with a sensitivity level of confidential and core business value is automatically classified as the highest protection level. Data with a sensitivity level of public and general business value is classified as the lowest level. Other combinations are mapped to the corresponding level based on rules.

[0065] Based on the output of the multi-dimensional classification and grading matrix, a visualized data asset map is constructed. The map uses graph database technology to store the topological relationships of data assets, including the storage location, access path, association, and flow trajectory of the data. The data asset map supports multi-dimensional querying and filtering. Administrators can locate the data assets they need to query or filter based on data type, sensitivity level, or storage location.

[0066] The differentiated protection module, based on a multi-dimensional classification and grading matrix and a visualized data asset map, implements differentiated security protection measures for different levels and types of industrial sensitive data. The specific implementation process is as follows:

[0067] Based on a two-dimensional cross-mapping of data sensitivity level and business value dimension, access rule bases are defined for different data assets. The access rule base is used to define access control logic for different categories of data assets. Based on the classification and grading results driven by the multi-dimensional classification and grading matrix, the policy generation engine generates executable access control policies by matching the meta-attributes of data with predefined rules.

[0068] In terms of permission allocation mechanism, a dual mechanism combining role-based access control and attribute-based access control is used. Role-based access control allocates data access permissions based on the user's functional role in the organization, with different roles corresponding to different data views and operation scopes. Attribute-based access control makes real-time decisions based on dynamic attributes, including user identity, access time, data sensitivity tags, operation type, and access environment.

[0069] When an access request is detected, the user's basic permissions are determined based on the user's identity. If the requested operation and access data are not within the scope of basic permissions, the request is directly rejected.

[0070] If access requests are pre-screened via access control, then attribute-based access control is executed using the formula. Received access request The decision result is either true or false, that is, allow access or deny access. These represent the logical disjunction and logical conjunction operators, respectively. This represents the rule index number, indicating any rule in the access control policy. This indicates the total number of rules in the access control policy; Indicates the condition index number within a single rule. Indicates the first The number of conditions contained in a rule; Indicates an access request Extract the first The first rule in the article The actual value of the attribute specified by each condition. Indicates the first Rule No. The set of allowed values ​​specified by each condition;

[0071] All access control policies are automatically deployed and updated in real time through a unified policy management center. Policy instructions are sent to data storage nodes, API gateways and application terminals to form a globally consistent access control system.

[0072] For sensitive data and core business data, implement encrypted storage and transmission protection mechanisms:

[0073] Based on a multi-dimensional classification and grading matrix and a data asset map, data assets that need to be encrypted and protected are identified. When data is identified as sensitive or confidential, or when business value is core or important, an encryption protection mechanism is automatically triggered.

[0074] For encrypted storage of static data, the following process is adopted:

[0075] Encryption policy binding: The policy management center associates encryption policies with storage locations in the data asset map, and automatically triggers the encryption process when data is written to the specified location;

[0076] Algorithm selection engine: Based on data sensitivity level and security compliance requirements, encryption algorithms are selected; core process parameters and intellectual property data are preferentially selected using the national cryptographic algorithm SM4, while other data are selected using the AES256 algorithm;

[0077] Key Management: The encryption keys for the data to be encrypted are generated and managed uniformly by the key management device; the key management device uses the master key to encrypt and protect the encryption keys, ensuring the security of the DEK itself;

[0078] Encryption execution: When data is written to the storage medium, the data block is encrypted by the encryption engine, and the encrypted data is stored in association with the key index;

[0079] For dynamic data transmission, the following protection mechanism is adopted:

[0080] Encryption-triggered transmission: When data flows across network boundaries or is transmitted between different scenarios, the TLS protocol encrypted channel is automatically enabled based on data classification and grading labels.

[0081] Certificate Management: Unified management of the digital certificate lifecycle, including issuance, renewal, and revocation, through key management devices;

[0082] End-to-end protection: Establish a secure transmission channel between the API gateway and the business unit to ensure that data is not stolen or tampered with during transmission;

[0083] Implement differentiated data anonymization strategies for different levels of sensitive data:

[0084] For data with a public or internal sensitivity level and general business value, a reversible, lightweight data anonymization method is used in non-production environments, including development and testing environments; specifically including:

[0085] Generalization: Perform range-based processing on data values, such as converting a specific age into an age range, or converting a precise salary into a salary range;

[0086] Masking: Preserving some data features while hiding key information, such as displaying the original data 11010119XX01011234 as 110101********1234 after masking.

[0087] For data classified as sensitive or confidential, or data of core or critical business value, irreversible and strong desensitization methods must be used in non-production environments:

[0088] Data replacement: A cryptographic hash function with salt is used to generate an irreversible hash value, while ensuring the consistency of the de-identification results of the same original data in different scenarios;

[0089] Encryption and desensitization: Format-preserving encryption technology is used to encrypt data while maintaining its format, such as keeping the bank card number length and verification rules unchanged.

[0090] Fake data generation: Generating simulated data that conforms to rules based on data feature patterns, completely deviating from the original information.

[0091] The continuous monitoring and auditing module is used to track, analyze, and audit the entire lifecycle of industrial sensitive data in real time, ensuring that data access and operation behaviors always comply with security policy requirements and monitoring anomalies and potential risks; the specific implementation process is as follows:

[0092] Multi-source data acquisition and log aggregation: Based on the data storage locations, access paths, and flow relationships defined in the data asset map, a lightweight log acquisition agent is deployed to collect the following multi-dimensional log data in real time:

[0093] Data access logs include user query operations on structured databases, read and write behavior of file management, and data request records through API gateways;

[0094] Network traffic logs: Capture sensitive data transmission events in the network through mirrored traffic or deep packet inspection techniques;

[0095] User behavior logs: Record high-risk behaviors including user login, permission changes, and data export;

[0096] All logs are standardized through a unified log aggregation engine and then injected into a time-series database and a graph database for associated storage.

[0097] Real-time behavior analysis and anomaly detection: Employing a combination of rule engines and machine learning, dynamic risk assessment and anomaly detection are performed on data access behavior.

[0098] Real-time matching is performed based on a predefined security rule base, which includes access to core process data outside of working hours, multiple accesses to multiple confidential data assets by the same account within a short period of time, and unauthorized attempts to read intellectual property data using equipment serial numbers.

[0099] Through formula The calculation yields the result of determining the policy violation trigger signal: "triggered" or "not triggered," indicating whether the violation signal was triggered or not. Representing attributes With allowed value set The matching condition refers to the condition when belong hour, The result is a trigger, when Not belonging to hour, The result was "not triggered".

[0100] A hybrid detection architecture integrating isolated forest and autoencoder is adopted. The isolated forest identifies rare anomalous samples in high-dimensional features through a random partitioning strategy, while the autoencoder learns the distribution of normal behavior features through the encoding and decoding reconstruction process.

[0101] Multi-dimensional behavioral feature vectors are extracted from historical logs in time-series databases, including access frequency features, data sensitivity features, operation sequence features, and context features.

[0102] The key parameter set of the baseline model output by machine learning includes the mean vector of the feature vectors. and standard deviation vector ;

[0103] Extract feature vectors consistent with those used in the training phase from the real-time data stream. Low-dimensional representation is obtained based on feature encoding function. ;

[0104] Through formula The user behavior deviation is calculated, where, Indicates the number of feature dimensions; Indicates the first The standard deviation corresponding to each feature dimension;

[0105] User behavior deviation indicates the overall degree of deviation between current user behavior and historical baseline. The higher the user behavior deviation, the greater the degree of deviation between the current user behavior and the historical normal baseline.

[0106] Using a sliding time window as the unit, statistical distribution of user behavior deviation is calculated using the formula. The dynamic threshold is calculated, where, This represents the mean deviation of all user behaviors within the sliding time window. This represents the standard deviation of the deviation of all user behaviors within the sliding time window. Indicates the sensitivity coefficient;

[0107] When a user's behavior deviates from the dynamic threshold, an abnormal event alarm is triggered. At the same time, the risk level is determined by comparing the portion exceeding the dynamic threshold with a preset range, including low, medium, high, and emergency.

[0108] Audit trail and source tracing analysis: This is used to fully record, analyze correlations, and trace the root causes of access to and manipulation of sensitive industrial data, and to locate the source of anomalies and the scope of impact when security incidents occur. The specific implementation process is as follows:

[0109] Based on the standardized logs generated during the multi-source data collection and log aggregation phases, all data access events are recorded with high fidelity, and each event is assigned a unique event ID, timestamp, user identity, data asset identifier, operation type, and context attributes; all event data is injected into a time-series database for time-range queries, and simultaneously stored in a graph database to maintain the relationships between events;

[0110] When a user's behavior deviation exceeds a dynamic threshold and triggers an alarm, source tracing analysis is automatically initiated. Based on the event ID of the alarm event, a sequence of related events is extracted and analyzed using a formula. The event correlation degree is calculated, where, These represent two independent events. This indicates the number of attribute dimensions, including users, data assets, and operation types; Indicates the first The influence weighting factor of each attribute;

[0111] When the correlation between events exceeds a preset threshold, it is determined that the events are potentially related; a timeline sequence centered on the alarm event is constructed based on the potentially related events.

[0112] Pattern matching is performed based on a predefined source tracing rule base, which includes continuous abnormal access patterns, data export behavior immediately after permission changes, and batch data reading at unusual times. Each rule outputs a suspicion score, and the overall root cause probability is obtained through a weighted fusion formula. At the same time, the path analysis function of the graph database is used to trace the spread path of alarm events and assess the impact of alarm events on related data assets.

[0113] The response and recovery module is used to respond to and restore business operations in the event of security incidents involving sensitive industrial data, ensuring that in the event of data breaches, tampering, or misuse, the spread of risks can be stopped in a timely manner and data integrity can be restored. The specific implementation process is as follows:

[0114] Based on the abnormal alarms and risk level assessment results output by the continuous monitoring and auditing module, a tiered response mechanism is automatically triggered:

[0115] When the risk level is low or medium, an event ticket is generated and the safety administrator is notified for manual review and handling.

[0116] When the risk level is high or urgent, immediately activate the automated response plan, including real-time blocking of access sessions, temporary freezing of user accounts, and isolation of affected data storage nodes or API gateway routes.

[0117] Implement a data recovery mechanism to address data corruption, loss, or tampering incidents;

[0118] The recovery process is based on a data classification and grading matrix and a visualized data asset map, prioritizing the recovery of data assets with a sensitivity level of confidential or core business value.

[0119] Recovery strategy selection: Based on data importance and business impact, a differentiated recovery strategy is adopted:

[0120] For core business data, recovery is performed from near real-time backups; backup data is protected by an encrypted storage mechanism, and data integrity hash values ​​must be verified during recovery.

[0121] For general data, restore from daily incremental backups and roll back to a safe state via version control;

[0122] Resume execution process:

[0123] Triggered recovery: When data tampering or loss is detected, the scope of affected data is confirmed based on the audit logs, and recovery operations are authorized through the policy management center;

[0124] Recovery Verification: Digital signatures and checksums are used to verify the integrity of the recovered data, ensuring that no new risks are introduced;

[0125] Business recovery: Automatically restart affected business processes and monitor data flow through the API gateway to ensure that the transmission encryption protection mechanism is working properly;

[0126] Once the response is complete, the root cause analysis process is initiated. Based on the source analysis output from the continuous monitoring and auditing module, the results are analyzed using a formula. The event impact score is calculated, where, This indicates the number of impact dimensions, including data sensitivity, business interruption time, and recovery costs; Indicates the first The influence weighting factors for each dimension are dynamically adjusted based on the business value dimension. Indicates the first The quantitative values ​​of each dimension, such as the data sensitivity level mapped to numerical values, include Public = 1, Internal = 2, Sensitive = 3, Confidential = 4;

[0127] The higher the impact score of an event, the higher its priority level and the more it drives improvement measures, including updating the access rule base, adjusting encryption policies, and enhancing monitoring rules.

[0128] Meanwhile, all improvements are injected into the strategy management center and visualized through a data asset map.

[0129] This invention relates to a method for managing the security of sensitive industrial data, comprising:

[0130] S1. Data Discovery and Classification: Industrial data is collected through a distributed scanning engine that supports multiple data source interfaces. Sensitivity assessment results are obtained by combining deep learning semantic recognition of sensitive information, regular expression matching of fixed-format data, and keyword matching for data filtering, based on a weighted fusion of the results of these three algorithms. A multi-dimensional classification and grading system is constructed based on the data sensitivity assessment results and business value. A multi-dimensional classification and grading matrix is ​​formed by combining two-dimensional cross-mapping. A visual asset map containing data topology relationships is constructed using a graph database, supporting multi-dimensional queries.

[0131] S2. Differentiated Protection: A data access rule base is defined based on a multi-dimensional classification and grading matrix and a visualized data asset map; in terms of permission allocation mechanism, dual permission control based on role and attribute is adopted; at the same time, for sensitive, confidential or high business value data, SM4 or AES256 encryption is statically selected and TLS protocol is dynamically enabled for transmission; based on the classification and grading results, de-identification is performed, with reversible de-identification used for public, internal and general data, and irreversible de-identification used for sensitive and confidential data, to achieve differentiated security protection;

[0132] S3. Continuous Monitoring and Auditing: Based on the data asset map, a log collection agent is deployed to collect multi-dimensional log data, including data access, network traffic, and user behavior logs. After standardized processing, the data is stored in a time-series database and a graph database. A rule engine is used to match security rules, and machine learning is combined to analyze behavior, calculate user behavior deviation and dynamic thresholds. If the threshold is exceeded, an alarm is triggered and the risk level is determined. At the same time, all data operation events are recorded with high fidelity, and related events are traced when an alarm is triggered.

[0133] S4. Response and Recovery: Based on the abnormal alarms and risk level judgment results output by the continuous monitoring and auditing module, the hierarchical response mechanism is automatically triggered: work orders are issued for low and medium risks, and high and emergency risks are automatically blocked; core data is restored based on hierarchical priority, and business is restarted after verifying the integrity of the restored data; the root cause analysis of the event impact score is calculated, and improvement measures are injected into the strategy center and visualized on the asset map.

[0134] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to any specific implementation. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.

Claims

1. An industrial sensitive data security management platform, characterized in that, include: Data discovery and classification module: It adopts a multi-algorithm fusion mechanism, combining AI deep learning algorithms with traditional pattern matching algorithms to achieve full coverage identification of structured and unstructured data in industrial environments; Differentiated protection module: Based on a multi-dimensional classification and grading matrix and a visualized data asset map, it implements differentiated security protection measures for different levels and types of industrial sensitive data; Continuous monitoring and auditing module: Used for real-time tracking, behavioral analysis and security auditing of the entire lifecycle of industrial sensitive data activities, ensuring that data access and operation behaviors comply with security policy requirements, and monitoring anomalies and potential risks; Response and Recovery Module: Used to respond to and restore business operations in the event of industrial sensitive data security incidents, ensuring that the spread of risks is prevented and data integrity is restored in the event of data breaches, tampering, or misuse. The specific implementation process of the continuous monitoring and auditing module also includes: Real-time matching is performed based on predefined security rules, and multi-dimensional behavioral feature vectors are extracted by combining an integrated isolated forest and autoencoder machine learning architecture, including access frequency features, data sensitivity features, operation sequence features, and context features. The key parameter set of the baseline model output by machine learning includes the mean vector of the feature vectors. and standard deviation vector ; Extract feature vectors consistent with those used in the training phase from the real-time data stream. Low-dimensional representation is obtained based on feature encoding function. ; Through formula The user behavior deviation is calculated, where, Indicates the number of feature dimensions; Indicates the first The standard deviation corresponding to each feature dimension; Using a sliding time window as the unit, statistical distribution of user behavior deviation is calculated using the formula. The dynamic threshold is obtained, where, This represents the mean deviation of all user behaviors within the sliding time window. This represents the standard deviation of the deviation of all user behaviors within the sliding time window. Indicates the sensitivity coefficient; When user behavior deviates from a dynamic threshold, an abnormal event alarm is triggered. Simultaneously, the portion exceeding the dynamic threshold is compared to a preset range to determine the risk level, categorized as low, medium, high, and urgent. This also triggers audit trails and source tracing analysis. The specific implementation process of the audit trail and source tracing analysis is as follows: Based on standardized logs generated from multi-source data collection, all data access events are recorded. Each event is assigned a unique event ID, timestamp, user identity, data asset identifier, operation type, and context attributes. Event data is injected into a time-series database to support time-range queries and stored in a graph database to maintain event relationships. When a user's behavior deviation exceeds the dynamic threshold and an alarm is triggered, source tracing analysis is automatically initiated: Extracting related event sequences based on alarm event IDs, using formulas... The event correlation is obtained, where, These represent two independent events. This indicates the number of attribute dimensions, including users, data assets, and operation types; Indicates the first The influence weighting factor of each attribute; If the correlation between events exceeds a preset threshold, a potential correlation is determined, and a timeline sequence centered on the alarm event is constructed. Pattern matching is performed based on a predefined tracing rule base, and each rule outputs a suspicion score. The overall root cause probability is obtained based on a weighted fusion formula. At the same time, graph database path analysis is used to trace the spread path of the alarm event and assess the scope of the alarm event's impact on related data assets.

2. The industrial sensitive data security management platform according to claim 1, characterized in that, The specific implementation process of the data discovery and classification / grading module is as follows: It employs a distributed scanning engine that supports multiple data source interfaces, including relational databases, non-relational databases, file management, and cloud storage, and collects industrial data from multi-dimensional data sources in the industrial environment through distributed crawling technology. Deep learning-based semantic recognition algorithms identify sensitive information types, including core process parameters and intellectual property data; regular expression matching algorithms match sensitive data in fixed formats; and keyword matching algorithms filter data based on a predefined sensitive word library. By weighted fusion of the three types of algorithm identification results, the data sensitivity determination result is obtained; based on the sensitivity determination results including public, internal, sensitive and confidential, and the business value including core, important and general, a multi-dimensional classification and grading system is constructed, and a multi-dimensional classification and grading matrix is ​​formed by combining two-dimensional cross mapping; a visual data asset map containing data storage location, access path and topological relationship is constructed using graph database technology.

3. The industrial sensitive data security management platform according to claim 1, characterized in that, The specific implementation process of the differentiated protection module is as follows: Based on a multidimensional classification and grading matrix and a visualized data asset map, a policy generation engine matches data element attributes with predefined rules, defines a data access rule base, and generates executable access control policies, which are then deployed to storage nodes, API gateways, and application terminals by a unified policy management center. A dual access control system is employed, combining role-based and attribute-based access control: role-based access control assigns data access permissions and operation scopes based on user roles, while attribute-based access control makes real-time decisions based on dynamic attributes, using formulas... Received access request The decision result is either true or false, that is, allow access or deny access. These represent the logical disjunction and logical conjunction operators, respectively. This represents the rule index number, indicating any rule in the access control policy. This indicates the total number of rules in the access control policy; Indicates the condition index number within a single rule. Indicates the first The number of conditions contained in a rule; Indicates an access request Extract the first The first rule in the article The actual value of the attribute specified by each condition. Indicates the first Rule No. The set of allowed values ​​specified by each condition; For sensitive data and core business data, we implement encrypted storage and transmission protection mechanisms. At the same time, we implement differentiated data anonymization strategies for different levels of sensitive data.

4. The industrial sensitive data security management platform according to claim 1, characterized in that, The specific implementation process of the continuous monitoring and auditing module includes: Based on the data storage location and access path defined by the visualized data asset map, a log collection agent is deployed to collect data access logs, network traffic logs, and user behavior logs in real time. The collected multi-source logs are standardized through a log aggregation engine, and the processed logs are injected into a time-series database and a graph database for associated storage. Real-time matching is performed based on predefined security rules. The rule base includes access to core process data outside of working hours, multiple accesses to multiple confidential data assets by the same account within a short period of time, and unauthorized attempts to read intellectual property data using equipment serial numbers. Through formula The calculation yields the result of determining the policy violation trigger signal: "triggered" or "not triggered," indicating whether the violation signal was triggered or not. Representing attributes With allowed value set The matching condition refers to the condition when belong hour, The result is a trigger, when Not belonging to hour, The result was "not triggered".

5. The industrial sensitive data security management platform according to claim 1, characterized in that, The specific implementation process of the response and recovery module is as follows: Based on the abnormal alarms and risk levels output by the continuous monitoring and auditing module, a tiered response is triggered: When the risk level is low or medium, an incident ticket is generated and the security administrator is notified to handle it manually; when the risk level is high or urgent, an automated response plan is immediately activated, including real-time blocking of access sessions, temporary freezing of user accounts, and isolation of affected data storage nodes or API gateway routes. Based on a multi-dimensional classification and grading matrix and a visualized data asset map, priority is given to restoring data with confidential sensitivity or core business value. Based on the source analysis output of the continuous monitoring and auditing module, through formulas The event impact score is calculated, where, This indicates the number of impact dimensions, including data sensitivity, business interruption time, and recovery costs; Indicates the first The influence weighting factors for each dimension are dynamically adjusted based on the business value dimension. Indicates the first Quantized values ​​for each dimension; The higher the impact score of an event, the higher its priority level, driving improvement measures, including updating the access rule base, adjusting encryption policies, and enhancing monitoring rules. At the same time, all improvement measures are injected into the policy management center and visualized through the data asset map.

6. A method applied to an industrial sensitive data security management platform according to any one of claims 1-5, comprising the following steps: S1. Data Discovery and Classification: Industrial data is collected based on a distributed scanning engine that supports multiple data source interfaces. Sensitive data is identified by combining deep learning semantic recognition, regular expression matching, and keyword matching. Sensitivity determination results are obtained based on weighted fusion. A multi-dimensional classification and grading matrix is ​​formed by combining business value, and a visual data asset map containing data topology relationships is constructed using a graph database; S2. Differentiated Protection: Based on a multi-dimensional classification and grading matrix and a data asset map, an access rule base is defined, and dual access control based on roles and attributes is adopted. For sensitive data and core business data, an encrypted storage and transmission protection mechanism is implemented. At the same time, a differentiated data desensitization strategy is implemented for sensitive data of different levels. S3. Continuous monitoring and auditing: Deploy a log collection agent based on the asset map, collect multi-dimensional logs, and store them in a time-series database and graph database after standardization; analyze user behavior through rule engine and machine learning, calculate user behavior deviation and dynamic threshold, alarm when thresholds are exceeded and determine risk level, record events with high fidelity and trace the correlation when alarms are triggered. S4. Response and Recovery: Based on alarms and risk levels, a tiered response is triggered. Priority is given to recovering data assets with a sensitivity level of confidential or core business value and verifying their integrity. After the response is completed, the root cause analysis process is initiated. Based on the root cause analysis results, improvement measures are driven and injected into the strategy center, and visualized through a data asset map.

Images