Business-oriented cybersecurity asset risk pricing and management methods and systems

Abstract

This invention relates to the field of cybersecurity asset risk pricing and management technology, particularly to a method and system for cybersecurity asset risk pricing and management oriented towards business impact. It constructs a business-resource profile library by integrating historical business data, infrastructure resource data, and external environment data. A potential outage event prediction model is trained based on random forest or Long Short-Term Memory (LSTM) networks. A multi-objective cost optimization function is constructed, including resource pre-positioning costs, business interruption loss costs, and resource idle penalty costs. The optimal resource pre-positioning strategy is solved using the non-dominated sorting genetic algorithm NSGA-II or particle swarm optimization algorithm. After execution, feedback data updates the model and function, forming a closed-loop optimization. This invention achieves accurate risk prediction, dynamic cost balancing, and continuous strategy adaptation, effectively ensuring business continuity, reducing overall enterprise operating costs, and improving the targeting and effectiveness of cybersecurity asset risk pricing and management.

Description

Technical Field

[0001] This invention relates to the field of cybersecurity asset risk pricing and management technology, specifically to a cybersecurity asset risk pricing and management method and system oriented towards business impact. Background Technology

[0002] As digital transformation deepens, enterprises are increasingly reliant on network infrastructure and security assets. The stable operation of cybersecurity assets directly impacts business continuity and operational efficiency. Therefore, risk pricing and management of cybersecurity assets have become a core requirement for enterprise digital operations. However, current common methods for cybersecurity asset risk pricing and management still have several shortcomings and struggle to meet the needs of refined management in response to business impacts. Specific issues include:

[0003] Traditional methods often process historical business data, infrastructure resource data, or external environment data separately without establishing a mapping relationship between the three. This results in a fragmented relationship between business and resources, making it impossible to form a comprehensive business-resource profile. This data silo phenomenon makes subsequent risk analysis lack a comprehensive consideration of the interaction between business, resources, and environment. For example, it is impossible to accurately identify the indirect impact of changes in the external environment on specific businesses and supporting resources, thereby affecting the accuracy of risk assessment.

[0004] Existing risk prediction relies heavily on human experience or simple statistical models, failing to fully leverage the analytical capabilities of advanced algorithms such as machine learning for time-series data. This makes it difficult to dynamically capture the changing patterns of business and resources. Furthermore, traditional predictions often focus only on the probability of disruption events, neglecting to quantitatively predict the scope of affected business and the degree of resource loss after the disruption. This results in enterprises being unable to grasp the specific impact dimensions of risks in advance, and risk response measures are mostly in a reactive state, making it difficult to plan and prevent risks in advance.

[0005] In traditional resource management, cost considerations are mostly focused on the procurement costs of pre-positioned resources, without incorporating the potential losses caused by business interruptions and the penalties for unused pre-positioned resources into a unified optimization framework. This single cost-oriented decision-making model is prone to two extreme problems: either reducing resource pre-positioning to control procurement costs, resulting in significant business losses due to insufficient resources in the event of an interruption; or over-pre-positioning resources to avoid the risk of interruption, leading to a large amount of idle resources, increased maintenance costs and wasted funds, ultimately failing to achieve the optimal balance of overall operating costs.

[0006] In summary, existing methods for pricing and managing cybersecurity asset risks have significant shortcomings in data integration, risk prediction, cost optimization, and dynamic adaptation. They cannot effectively achieve accurate risk pricing and resource management centered on business impact. There is an urgent need for a technical solution that can integrate multi-source data, accurately predict risks, coordinate multi-dimensional costs, and has dynamic optimization capabilities to solve the above problems. Summary of the Invention

[0007] The purpose of this invention is to provide a method and system for pricing and managing cybersecurity asset risks oriented towards business impact, in order to solve the problems mentioned in the background art.

[0008] To achieve the above objectives, the present invention provides the following technical solution:

[0009] A business-oriented approach to pricing and managing cybersecurity asset risks includes the following steps:

[0010] Step S1: Construct a business-resource profile library. The business-resource profile library is formed by integrating historical business data, infrastructure resource data, and external environment data, and by performing data cleaning and feature extraction.

[0011] Step S2: Based on the business-resource profile library, train a potential interruption event prediction model. The potential interruption event prediction model uses machine learning algorithms, including random forest or long short-term memory network LSTM, to dynamically predict the probability and expected impact range of at least one business interruption event occurring within a preset time window in the future. The expected impact range includes the scope of affected businesses and the degree of resource loss.

[0012] Step S3: Construct a multi-objective cost optimization function, which includes resource provisioning cost, service interruption loss cost, and resource idle penalty cost, wherein:

[0013] Resource provisioning costs are calculated based on the type and quantity of provisioned resources, including hardware procurement costs and software licensing costs;

[0014] The cost of business interruption loss is quantified based on the probability and expected impact range predicted in step S2, specifically calculated through the duration of business interruption and the weight of business importance.

[0015] The resource idle penalty cost applies to pre-allocated resources that are not used, and is calculated based on the idle time and resource maintenance cost.

[0016] Step S4: Using the prediction results obtained in step S2 as input parameters, a multi-objective optimization algorithm is used to solve the multi-objective cost optimization function, and the optimal resource pre-positioning strategy for at least one service interruption event is output. The optimal resource pre-positioning strategy includes resource type, pre-positioning quantity, pre-positioning location and pre-positioning time. The multi-objective optimization algorithm includes the non-dominated sorting genetic algorithm NSGA-II or the particle swarm optimization algorithm.

[0017] Step S5: Execute the optimal resource pre-configuration strategy, and continuously collect actual business operation status data and external environment data after execution, and feed them back to the business-resource profile library to update the parameters of the potential interruption event prediction model and the weights of the multi-objective cost optimization function to form a closed-loop optimization.

[0018] As a preferred approach, the construction of the business-resource profile library in step S1 includes the following steps:

[0019] Multi-source data integration is performed, collecting historical business data, infrastructure resource data, and external environment data. Historical business data includes business traffic and business types, infrastructure resource data includes server capacity and network bandwidth, and external environment data includes weather events and social events, generating a raw dataset.

[0020] The original dataset is cleaned, including handling missing values, outliers, and duplicate values, and data standardization is performed to generate a cleaned dataset.

[0021] Based on the cleaned dataset, feature extraction is performed. Key business indicators are extracted through the business feature extraction module, resource utilization indicators are extracted through the resource feature extraction module, and environmental impact indicators are extracted through the environmental feature extraction module, generating a multi-dimensional feature set.

[0022] Multi-dimensional feature sets are associated and fused, and a business-resource association graph is constructed based on the mapping relationship between business and resources, and stored as a business-resource profile library.

[0023] As a preferred approach, training the potential disruption event prediction model in step S2 includes the following steps:

[0024] Extract historical interruption event records and corresponding multi-dimensional feature data from the business-resource profile library to generate a training dataset;

[0025] The training dataset is processed by time series slicing, and feature sequences and label sequences are divided based on a preset time window. The label sequences include labels for the probability of interruption events, the scope of affected business, and the degree of resource shortage.

[0026] Based on feature sequences and label sequences, a random forest or long short-term memory network (LSTM) algorithm is used to initialize the prediction model, and the model parameters are fitted through the training process to generate the initial prediction model.

[0027] The initial prediction model is evaluated using the validation dataset in the business-resource profiling library. Based on the evaluation results, the model hyperparameters are adjusted to generate an optimized prediction model.

[0028] The optimized prediction model is deployed as a potential interruption event prediction model, which is used to dynamically output the prediction results of interruption events within a future preset time window.

[0029] As a preferred approach, the construction of the multi-objective cost optimization function in step S3 includes the following steps:

[0030] Based on the output of the potential interruption event prediction model obtained in step S2, the probability and expected impact range of at least one business interruption event occurring within a future preset time window are obtained. The expected impact range includes the scope of affected businesses and the degree of resource loss.

[0031] Based on the degree of resource scarcity, a resource pre-determined demand set is generated, which includes the types of resources to be pre-determined and the initial quantity estimates.

[0032] Based on the set of pre-positioned resource requirements and combined with resource market price information, the pre-positioned resource cost is calculated, which includes hardware procurement costs and software licensing costs.

[0033] Based on the probability and the scope of affected businesses, combined with the business importance weights extracted from the business-resource profile library and the expected duration of the interruption, the cost of business interruption losses is quantified.

[0034] For the set of pre-set resource requirements, considering the risk of resource idleness, calculate the resource idleness penalty cost based on the resource idle time and the resource maintenance cost per unit time;

[0035] The resource pre-positioning cost, business interruption loss cost, and resource idle penalty cost are integrated into a multi-objective cost optimization function. Each cost component is defined as a function of the resource pre-positioning decision variables, which include resource type, pre-positioning quantity, pre-positioning location, and pre-positioning time.

[0036] As a preferred approach, resource provisioning costs are calculated based on the type and quantity of provisioned resources, including hardware procurement costs and software licensing fees; this includes the following steps:

[0037] Based on the set of pre-set resource requirements, we analyze the types of resources that need to be pre-set, the estimated quantity of pre-set resources, the location of pre-set resources, and the time of pre-set resources.

[0038] Based on the resource type, preset location, and preset time, obtain the corresponding hardware purchase price and software license price from the resource market price information database;

[0039] Calculate hardware procurement costs based on the pre-set quantity estimate and hardware purchase unit price;

[0040] Calculate the software license fee based on the pre-set quantity estimate and the unit price of the software license.

[0041] Integrate hardware procurement costs and software licensing costs to generate resource provisioning costs.

[0042] As a preferred approach, the cost of business interruption loss is quantified based on the probability and expected impact predicted in step S2, specifically calculated using the duration of the business interruption and the weighting of business importance; including the following steps:

[0043] From the output of the potential disruption event prediction model, obtain the probability of business disruption events and the expected impact range within a future preset time window. The expected impact range includes the scope of affected services and the degree of resource loss.

[0044] Based on the scope of affected businesses, the importance weights of the corresponding businesses are extracted from the business-resource profile library;

[0045] Based on the degree of resource shortage and combined with the business-resource relationship graph, the duration of business interruption is estimated.

[0046] The cost of business interruption is calculated based on probability, business importance weight, and business interruption duration.

[0047] As a preferred approach, the resource idle penalty cost is calculated for pre-allocated but unused resources based on idle time and resource maintenance costs; it includes the following steps:

[0048] Based on the set of pre-set resource requirements, obtain the type, estimated quantity, location, and time of the pre-set resources;

[0049] Based on historical resource usage data or resource utilization patterns in the business-resource profile library, predict the idle time of pre-set resources;

[0050] Extract the unit time maintenance cost of the corresponding resource from the resource market price information database;

[0051] Calculate the resource idle penalty cost based on the pre-set quantity estimate, idle time, and maintenance cost per unit time.

[0052] As a preferred approach, step S4 uses the prediction result obtained in step S2 as input parameters, employs a multi-objective optimization algorithm to solve the multi-objective cost optimization function, and outputs the optimal resource pre-configuration strategy for at least one service interruption event, including the following steps:

[0053] Based on the prediction results of potential interruption events obtained in step S2, the probability and expected impact range of business interruption events within a future preset time window are obtained as input parameters for the multi-objective cost optimization function.

[0054] Initialize the parameters of the multi-objective optimization algorithm, including population size, number of iterations, and algorithm-specific parameters. For the non-dominated sorting genetic algorithm NSGA-II, the algorithm-specific parameters include crossover probability and mutation probability. For the particle swarm optimization algorithm, the algorithm-specific parameters include inertia weight and learning factor.

[0055] Generate an initial solution set, which consists of a combination of multiple resource preset decision variables. Each combination of resource preset decision variables includes resource type, preset quantity, preset location, and preset time.

[0056] For each combination of resource pre-set decision variables in the initial solution set, calculate the value of the multi-objective cost optimization function to obtain the resource pre-set cost, business interruption loss cost, and resource idle penalty cost;

[0057] Based on the value of the multi-objective cost optimization function, iterative optimization is performed using a multi-objective optimization algorithm. This includes performing non-dominated sorting, crowding calculation, selection, crossover, and mutation operations on the non-dominated sorting genetic algorithm NSGA-II to generate a new generation of solution sets, and performing particle position and velocity updates on the particle swarm optimization algorithm to generate a new generation of solution sets.

[0058] After reaching the preset number of iterations or the convergence condition, the optimal combination of pre-set resource decision variables is selected from the final solution set through decision rules and output as the optimal pre-set resource strategy.

[0059] As a preferred approach, step S5, which involves implementing the optimal resource pre-configuration strategy and forming a closed-loop optimization, includes the following steps:

[0060] Execute the optimal resource provisioning strategy, complete resource deployment according to the resource type, provisioning quantity, provisioning location and provisioning time defined in the strategy, and generate resource provisioning execution records;

[0061] After resource pre-configuration is executed, the business monitoring system and environmental monitoring system continuously collect actual business operation status data and external environment data to generate a post-strategy execution dataset.

[0062] The dataset after strategy execution is linked and integrated with the pre-configured resource execution records to form optimized execution data;

[0063] The optimized execution data is fed back to the business-resource profile library. The data update module incrementally updates the historical business data, infrastructure resource data and external environment data in the profile library to generate the updated business-resource profile library.

[0064] Based on the updated business-resource profile library, the latest business interruption event records and corresponding feature data are extracted, the potential interruption event prediction model is retrained, the model parameters are adjusted according to the prediction accuracy, and the updated potential interruption event prediction model is generated.

[0065] Based on the actual resource utilization efficiency and business interruption loss in the optimized execution data, the cost deviation index of the multi-objective cost optimization function is calculated. The weight coefficients of the resource pre-set cost, business interruption loss cost and resource idle penalty cost in the multi-objective cost optimization function are dynamically adjusted according to the cost deviation index to generate the multi-objective cost optimization function with updated weights.

[0066] The updated potential interruption event prediction model and the weighted multi-objective cost optimization function are applied to the subsequent resource pre-positioning strategy generation process to form a closed-loop optimization mechanism.

[0067] A business-oriented cybersecurity asset risk pricing and management system, which is used to implement methods.

[0068] As can be seen from the technical solutions provided by the present invention above, the beneficial effects of the network security asset risk pricing and management method and system oriented towards business impact provided by the present invention are:

[0069] This invention enhances the accuracy of business interruption risk prediction and facilitates proactive risk prevention. By integrating historical business data, infrastructure resource data, and external environment data to construct a business-resource profile library, it provides comprehensive and high-quality data support for potential interruption event prediction models. Simultaneously, it employs machine learning algorithms such as Random Forest or Long Short-Term Memory (LSTM) networks to dynamically predict the probability of business interruption events, the scope of affected businesses, and the degree of resource loss within a preset future time window. This breaks away from the traditional passive risk response model, helping enterprises identify potential interruption risks in advance, buying time for the early deployment of risk prevention measures, and reducing passive losses caused by sudden risks.

[0070] Balancing multi-dimensional costs to reduce overall enterprise operating costs: This invention constructs a multi-objective cost optimization function that comprehensively considers resource pre-provisioning costs, business interruption loss costs, and resource idle penalty costs, avoiding decision-making biases caused by single cost considerations. It prevents waste of hardware procurement, software licensing, and idle maintenance costs due to excessive resource pre-provisioning, and also avoids amplified business losses when interruption events occur due to insufficient resource pre-provisioning. By solving the optimal resource pre-provisioning strategy through a multi-objective optimization algorithm, a dynamic balance of the three types of costs is achieved, ultimately reducing the overall operating costs of enterprises in network security asset risk management.

[0071] Generate precise resource provisioning strategies to ensure continuous and stable business operations. The optimal resource provisioning strategy clearly defines the resource type, provisioning quantity, provisioning location, and provisioning time. Its formulation is based on the results of business interruption risk prediction and cost optimization objectives, ensuring that resource deployment is accurately matched with business needs and risk scenarios. For example, for core businesses in high-probability interruption areas, the corresponding type and quantity of resources can be precisely configured to fill potential resource gaps. For non-core businesses in low-risk areas, the scale of resource provisioning can be reasonably controlled, which not only meets business continuity requirements but also avoids resource redundancy, effectively improving the stability and reliability of business operations.

[0072] This invention achieves closed-loop dynamic optimization to adapt to changes in business and environment. It continuously collects actual business operation status data and external environment data after strategy execution and feeds them back to the business-resource profile library, thereby updating the parameters of the potential interruption event prediction model and the weights of the multi-objective cost optimization function. As the business operation mode iterates, infrastructure is upgraded, or the external environment changes, the accuracy of the prediction model continuously improves, the cost optimization function is more in line with the actual operation scenario, and the resource pre-positioning strategy is also dynamically adjusted accordingly, forming a long-term stable iterative optimization mechanism. This ensures that the system adapts to the enterprise's development needs in the long term and avoids decision-making lag caused by static management mode.

[0073] Focusing on the core impact on business, this approach enhances the targeting of risk pricing and management. The entire methodology and system are business-impact oriented, linking the impact of business scope and resource shortages to the business during risk prediction, quantifying interruption losses by combining business importance weights during cost calculation, and prioritizing the resource needs of core businesses during strategy formulation. This business-value-centric design makes risk pricing more aligned with the actual value of the business, and resource management more focused on ensuring critical business operations, avoiding resource misallocation or risk neglect, and significantly improving the targeting and effectiveness of enterprise cybersecurity asset risk pricing and management. Attached Figure Description

[0074] Figure 1 This is a schematic diagram of the steps in the present invention for pricing and managing network security asset risks oriented towards business impact;

[0075] Figure 2This is a schematic diagram of the network security asset risk pricing and management system based on the business impact of this invention. Detailed Implementation

[0076] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0077] To better understand the above technical solutions, the following will provide a detailed explanation of the technical solutions in conjunction with the accompanying drawings and specific embodiments.

[0078] like Figure 1-2 As shown, this embodiment of the invention provides a method for pricing and managing cybersecurity asset risks oriented towards business impact, including the following steps:

[0079] Step S1: Construct a business-resource profile library. The business-resource profile library is formed by integrating historical business data, infrastructure resource data, and external environment data, and by performing data cleaning and feature extraction.

[0080] Step S2: Based on the business-resource profile library, train a potential interruption event prediction model. The potential interruption event prediction model uses machine learning algorithms, including random forest or long short-term memory network LSTM, to dynamically predict the probability and expected impact range of at least one business interruption event occurring within a preset time window in the future. The expected impact range includes the scope of affected businesses and the degree of resource loss.

[0081] Step S3: Construct a multi-objective cost optimization function, which includes resource provisioning cost, service interruption loss cost, and resource idle penalty cost, wherein:

[0082] Resource provisioning costs are calculated based on the type and quantity of provisioned resources, including hardware procurement costs and software licensing costs;

[0083] The cost of business interruption loss is quantified based on the probability and expected impact range predicted in step S2, specifically calculated through the duration of business interruption and the weight of business importance.

[0084] The resource idle penalty cost applies to pre-allocated resources that are not used, and is calculated based on the idle time and resource maintenance cost.

[0085] Step S4: Using the prediction results obtained in step S2 as input parameters, a multi-objective optimization algorithm is used to solve the multi-objective cost optimization function, and the optimal resource pre-positioning strategy for at least one service interruption event is output. The optimal resource pre-positioning strategy includes resource type, pre-positioning quantity, pre-positioning location and pre-positioning time. The multi-objective optimization algorithm includes the non-dominated sorting genetic algorithm NSGA-II or the particle swarm optimization algorithm.

[0086] Step S5: Execute the optimal resource pre-configuration strategy, and continuously collect actual business operation status data and external environment data after execution, and feed them back to the business-resource profile library to update the parameters of the potential interruption event prediction model and the weights of the multi-objective cost optimization function to form a closed-loop optimization.

[0087] In this embodiment, step S1 aims to construct a comprehensive and accurate business-resource profile library by integrating, cleaning, standardizing, extracting and fusing multi-dimensional features from multiple data sources, thus providing high-quality data support for subsequent training of potential interruption event prediction models and construction of multi-objective cost optimization functions. The detailed steps are as follows:

[0088] Step S1-1: Multi-source data integration:

[0089] The system collects three core data categories: historical business data, infrastructure resource data, and external environment data. Historical business data includes business traffic and business types. Business traffic reflects the access intensity of business at different times, and business types clarify the functional attributes and service targets of each business. Infrastructure resource data covers server capacity and network bandwidth. Server capacity reflects the processing capacity of hardware equipment, and network bandwidth determines the upper limit of data transmission rate. External environment data includes weather events and social events. Weather events involve changes in natural conditions that may affect infrastructure operation, and social events cover public affairs dynamics that may indirectly affect business operations. The three types of data are aggregated and integrated to form a raw dataset covering business operations, basic support, and external influencing factors.

[0090] Step S1-2: Data Cleaning and Standardization

[0091] The original dataset undergoes systematic processing to improve data quality. For missing values, numerical missing values ​​are imputed using the mean, and categorical missing values ​​are imputed using the mode. Outliers are identified and removed using the interquartile range. Duplicate values ​​are directly deduplicated to avoid data redundancy. After handling missing, outlier, and duplicate values, the dataset is standardized using Z-score standardization to transform feature data of different magnitudes to a uniform scale. The standardization formula is as follows: ,in, For standardized feature data, The original feature data, The value of this feature. The standard deviation of this feature is given; after the above processing, a cleaned dataset with acceptable data quality and uniform feature scale is generated.

[0092] Step S1-3: Multi-dimensional feature extraction:

[0093] Three specialized feature extraction modules extract key indicators from the cleaned dataset. The business feature extraction module focuses on core business attributes, extracting key business indicators such as business processing efficiency, business concurrency, and business reliability. Business processing efficiency reflects the speed of business completion, business concurrency reflects the business's ability to handle multiple requests simultaneously, and business reliability characterizes the probability of continuous and stable business operation. The resource feature extraction module targets the status of infrastructure resources, extracting resource utilization indicators such as server CPU utilization, memory utilization, network bandwidth utilization, and storage device utilization. These utilization indicators directly reflect the resource usage load. The environmental feature extraction module focuses on external influencing factors, extracting environmental impact indicators such as weather impact coefficient and social event impact level. The weather impact coefficient quantifies the degree of impact of weather conditions on infrastructure, and the social event impact level defines the intensity of interference of social affairs on business operations. The indicators extracted by the three modules are integrated to form a multi-dimensional feature set covering the three dimensions of business, resources, and environment.

[0094] Steps S1-4: Feature association fusion and profile database construction:

[0095] Based on the inherent mapping relationship between business and resources, multi-dimensional feature sets are correlated and fused; the infrastructure resource dependencies of each business are sorted out, the supporting role of different resources in business operation is clarified, and the mutual influence paths between environmental features and business and resources are correlated to construct a complete business-resource relationship map; this map clearly presents the relationship logic and mechanism of action among business, resources and environment, and is stored in a structured manner to finally form a comprehensive business-resource profile library that records the attribute characteristics and relationships of business and resources.

[0096] In this embodiment, step S2 is based on the multi-dimensional feature data stored in the business-resource profile library. Through training dataset construction, time series processing, model initialization training, performance evaluation and optimization, and deployment, a potential interruption event prediction model is formed that can dynamically predict business interruption events within a preset time window. This provides accurate interruption probability and expected impact range data support for the subsequent step S3 to construct a multi-objective cost optimization function. The detailed steps are as follows:

[0097] Step S2-1: Training dataset extraction and preprocessing:

[0098] Two types of core data are extracted from the business-resource profile library. One type is historical interruption event records, which cover information such as the occurrence time, duration, and final impact of all past business interruption events. The other type is multi-dimensional feature data of the corresponding time periods before and after the historical interruption events, including key business indicators, resource utilization indicators, and environmental impact indicators of that period. The two types of data are matched one by one according to the time dimension to ensure that each historical interruption event record corresponds to complete multi-dimensional feature data, forming the original training dataset.

[0099] The original training dataset undergoes quality screening, removing samples with incomplete feature data or incomplete event records, retaining only complete and valid samples. Subsequently, the multi-dimensional feature data in the valid samples is normalized, mapping all feature index values ​​to the 0-1 range to eliminate interference from differences in feature magnitudes on model training. The normalization formula is as follows: ,in, These are the normalized eigenvalues. The original data values ​​of the features, This is the minimum value of the feature index among all valid samples. This is the maximum value of the feature index among all valid samples; after filtering and normalization, a training dataset that meets the requirements for model training is generated.

[0100] Step S2-2: Time series slicing and label sequence construction:

[0101] Based on the cyclical characteristics of business operations and the common duration of impact of interruption events, a preset time window is set. The duration of the preset time window is usually between 1 hour and 72 hours, and the specific duration can be adjusted according to the actual business scenario. Using the preset time window as a unit, the multi-dimensional feature data in the training dataset is sliced ​​into time series, and continuous feature data within each preset time window is extracted to form a feature sequence. Each feature sequence corresponds to the feature changes within a complete preset time window.

[0102] For each feature sequence, a corresponding label sequence is constructed. The label sequence contains three core labels: the first is the probability of an interruption event, which identifies the probability of a business interruption event occurring within a preset time window corresponding to the feature sequence; the second is the scope of affected businesses, which clarifies the types of businesses involved and the proportion of each business type affected if an interruption event occurs within the preset time window; and the third is the degree of resource deficiency, which quantifies the proportion of infrastructure resource functionality loss caused by an interruption event within the preset time window. Through the above operations, a one-to-one correspondence between feature sequences and label sequences is established, providing structured input data for model training.

[0103] Step S2-3: Prediction model initialization and parameter fitting:

[0104] Based on the business requirements for prediction accuracy and computational efficiency, either the Random Forest algorithm or the Long Short-Term Memory (LSTM) network algorithm is selected to initialize the potential interruption event prediction model.

[0105] If the random forest algorithm is chosen, the initial parameters of the model are first set, including the number of decision trees, the maximum tree depth, and the number of features when a node splits. The number of decision trees is usually set to 50 to 200, the maximum tree depth is set to 10 to 30 layers, and the number of features when a node splits is set to the square root of the total number of features. Based on the feature sequences and label sequences in the training dataset, multiple independent decision trees are constructed. Each decision tree generates an independent prediction rule by learning the mapping relationship between the feature sequences and label sequences. Then, the prediction results of all decision trees are integrated through a voting mechanism to form the initial prediction model.

[0106] If the Long Short-Term Memory (LSTM) algorithm is chosen, a network structure is built that includes an input layer, hidden layers, and an output layer. The dimension of the input layer is consistent with the number of features in the multi-dimensional feature data. One to three hidden layers are set, with 64 to 256 neurons per layer. The output dimension of the output layer is consistent with the number of labels in the label sequence, i.e., the output dimension is 3. The network parameters are initialized using the Adam optimizer, with a learning rate of 0.001 to 0.01 and mean squared error as the loss function. The feature sequences and label sequences in the training dataset are divided into a training set and a validation set in an 8:2 ratio. The LSTM network is trained using the training set, and the network weight parameters are continuously adjusted through backpropagation to reduce the deviation between the model's predicted values ​​and the true values ​​of the label sequences, thus forming an initial prediction model.

[0107] Step S2-4: Model performance evaluation and hyperparameter tuning:

[0108] Extract multi-dimensional feature data and corresponding interruption event records that were not involved in model training from the business-resource profile library to construct a validation dataset; use the validation dataset to evaluate the performance of the initial prediction model, and use three indicators—prediction accuracy, recall, and mean squared error—to quantify the model performance.

[0109] The formula for calculating prediction accuracy is: ,in, To improve prediction accuracy, This represents the number of true positive samples, i.e., the number of samples where an interruption event actually occurred and the model predicted that an interruption event would occur. This represents the number of true negative samples, i.e., the number of samples for which no interruption event actually occurred and the model predicted no interruption event. This represents the number of false positive samples, i.e., the number of samples where the interruption event did not actually occur but the model predicted that an interruption event would occur. This represents the number of false negative samples, i.e., the number of samples in which an interruption event actually occurred but the model predicted that no interruption event would occur.

[0110] The formula for calculating recall rate is: ,in, Recall rate;

[0111] The formula for calculating the mean square error is: ,in, Mean square error, To verify the total number of samples in the dataset, For the model to the first The predicted value for each sample, For the first The true label value of each sample;

[0112] The model hyperparameters are iteratively tuned based on the results of the three evaluation metrics. If the prediction accuracy is low, the number of decision trees can be increased for the random forest algorithm, and the number of hidden layer neurons can be adjusted for the LSTM algorithm. If the recall is insufficient, the sample weight allocation can be optimized, and the training weight of samples that actually experienced interruption events can be increased. If the mean squared error is too large, the maximum tree depth can be reduced for the random forest algorithm to avoid overfitting, and the learning rate can be reduced or the number of training iterations can be increased for the LSTM algorithm. After multiple rounds of hyperparameter tuning, an optimized prediction model with satisfactory performance is generated.

[0113] Step S2-5: Model Deployment and Prediction Result Output:

[0114] The optimized prediction model will be deployed to the business operation monitoring system, enabling the model to acquire data in real time and make dynamic predictions. After the model is deployed, it will extract the latest multi-dimensional feature data from the business-resource profile library at preset time intervals, including the latest key business indicators, resource utilization indicators and environmental impact indicators, and generate real-time feature sequences according to preset time windows.

[0115] The optimized prediction model is based on real-time feature sequences and dynamically outputs prediction results within a preset future time window. The prediction results include three core components: the first is the probability of a business interruption event, represented by a value between 0 and 1, with a higher value indicating a higher likelihood of the interruption event; the second is the scope of affected businesses, clearly listing the types of businesses that may be affected by the interruption event and the expected proportion of each business type being affected; and the third is the degree of resource deficiency, quantifying the types of infrastructure resources expected to experience functional deficiencies and the proportion of each resource type being deficient. The prediction results are output in a structured data format and serve as the core input parameters for constructing the multi-objective cost optimization function in step S3.

[0116] In this embodiment, step S3 is based on the output of the potential interruption event prediction model in step S2, to clarify the resource pre-positioning requirements, quantify and calculate the resource pre-positioning cost, service interruption loss cost, and resource idle penalty cost respectively, and finally integrate them to form a multi-objective cost optimization function, providing core objective function support for step S4 to solve the optimal resource pre-positioning strategy using a multi-objective optimization algorithm; the detailed steps are as follows:

[0117] Step S3-1: Obtain the prediction results and generate a set of pre-set resource requirements:

[0118] From the potential interruption event prediction model deployed in step S2, the prediction results within a future preset time window are extracted. The results contain two core pieces of information: first, the probability of at least one business interruption event occurring; and second, the expected impact range of the interruption event, which specifically covers the scope of affected businesses and the degree of resource loss.

[0119] Based on the degree of resource shortage in the prediction results, and combined with the mapping relationship between infrastructure resources and services stored in the business-resource profile library, the shortage ratio of various resources under different business interruption scenarios is analyzed. For example, if it is predicted that a certain type of business interruption will result in a 30% loss of server processing capacity, then the amount of resources required to fill the gap for that type of server needs to be calculated. Through the above analysis, the types of resources that need to be pre-configured (such as servers, network equipment, specific software, etc.) and the initial quantity estimates of each type of resource are identified and integrated to form a set of pre-configured resource requirements.

[0120] Step S3-2: Calculate the pre-set cost of resources:

[0121] Based on the resource pre-positioning demand set generated in step S3-1, the pre-positioning resource types, initial quantity estimates, pre-positioning locations, and pre-positioning times contained therein are analyzed; from the resource market price information database, the hardware purchase price and software license price of the corresponding resources are matched and obtained according to the resource type, pre-positioning location (resource prices may vary in different regions) and pre-positioning time (resource prices may fluctuate in different time periods).

[0122] Calculate the hardware purchase cost and software license cost separately:

[0123] The formula for calculating hardware procurement costs is as follows: ,in, For hardware procurement costs, This is an initial estimate of the amount of hardware resources that need to be pre-configured. This refers to the unit price for the corresponding hardware resources.

[0124] The formula for calculating software license fees is: ,in, For software license fees, This is an initial estimate of the number of software resources that need to be pre-configured. This refers to the unit price of the corresponding software resource license;

[0125] Adding hardware procurement costs to software licensing costs yields the resource provisioning cost, calculated using the following formula: ,in, Pre-allocate costs for resources, For hardware procurement costs, Software license fees;

[0126] Step S3-3: Calculate the cost of service interruption:

[0127] From the prediction results of step S2, extract the probability of business interruption events and the scope of affected businesses within the future preset time window; based on the scope of affected businesses, retrieve the business importance weight of the corresponding business from the business-resource profile library. This weight is preset according to factors such as the business's contribution to the overall operation and user dependence, and the value ranges from 0 to 1. The larger the value, the higher the business importance.

[0128] Based on the degree of resource shortage in the prediction results, and combined with the support relationship between resources and business in the business-resource association graph, the duration of business interruption is estimated. For example, if the degree of shortage of a certain type of resource is 50% and the resource is a core support resource for the business, the duration of this interruption is estimated by referring to the business recovery time under the same resource shortage ratio in historical data.

[0129] The formula for calculating the cost of business interruption loss is as follows: ,in, To cover the costs of business interruption This represents the probability of a business interruption event occurring. Weights based on the business importance of the affected business. To estimate the duration of the business interruption, The average loss amount per unit time for affected business operations (extracted from historical business data in the business-resource profile library);

[0130] Step S3-4: Calculate the cost of resource idleness penalty:

[0131] Based on the resource pre-provisioning requirement set generated in step S3-1, obtain the type, initial quantity estimate, pre-provisioning location, and pre-provisioning time of the resources to be pre-provisioned; extract historical resource usage data or resource utilization patterns from the business-resource profile library, and combine them with the business operation plan within the future preset time window to predict the idle time of the pre-provisioned resources after deployment if they are not used; for example, if the pre-provisioned resources are only for a certain type of low-probability interruption event, and the predicted probability of the event occurring is low, then the idle time of the resource will be relatively long.

[0132] Extract the unit time maintenance cost of the corresponding resource from the resource market price information database. This cost includes the costs of resource storage, energy consumption, and routine maintenance.

[0133] The formula for calculating the cost of resource idleness penalty is: ,in, The cost of penalizing idle resources For the initial quantity estimation of pre-set resources, For the predicted resource idle time, The unit time maintenance cost of the corresponding resource;

[0134] Step S3-5: Integrate multi-objective cost optimization functions:

[0135] The resource pre-positioning cost calculated in step S3-2, the business interruption loss cost calculated in step S3-3, and the resource idle penalty cost calculated in step S3-4 are integrated to form a multi-objective cost optimization function. This function takes the resource pre-positioning decision variables as input and outputs the comprehensive result of the three types of costs. The resource pre-positioning decision variables include resource type, pre-positioning quantity, pre-positioning location, and pre-positioning time.

[0136] The multi-objective cost optimization function expression is: ,in, For multi-objective cost optimization functions, Predetermine decision variables for resources (including resource type, quantity, location, and time). For decision variables Calculated resource pre-set costs, For decision variables Calculate the cost of business interruption loss. For decision variables The calculation of resource idle penalty cost; the optimization objective of this function is to simultaneously minimize the resource provisioning cost, business interruption loss cost, and resource idle penalty cost.

[0137] In this embodiment, step S4 uses the output of the potential interruption event prediction model from step S2 as the core input, combines it with the multi-objective cost optimization function constructed in step S3, initializes the multi-objective optimization algorithm, generates an initial solution set, iteratively optimizes and determines convergence, and finally selects the optimal resource pre-configuration strategy for at least one service interruption event, providing a clear solution for the strategy execution and closed-loop optimization in step S5; the detailed steps are as follows:

[0138] Step S4-1: Input parameter confirmation and constraint condition review:

[0139] From the potential interruption event prediction model deployed in step S2, extract the probability and expected impact range of business interruption events within the future preset time window, and use them as the core input parameters of the multi-objective cost optimization function to ensure that the parameters are completely matched with the variable definition of the function in step S3.

[0140] Meanwhile, the constraints in the resource pre-provisioning process are identified, including resource supply constraints (such as the maximum market supply of specific types of resources and the resource storage capacity limit of the pre-provisioning location), time constraints (such as the shortest cycle of resource deployment and the time node for deployment to be completed before the interruption event prediction window), and cost constraints (such as the upper limit of the enterprise's total budget for resource pre-provisioning). These constraints are transformed into mathematical expressions and together with the multi-objective cost optimization function, they constitute a complete constraint system for the optimization problem.

[0141] Step S4-2: Initialize the parameters of the multi-objective optimization algorithm:

[0142] Based on the business requirements for optimization efficiency and solution accuracy, the non-dominated sorting genetic algorithm NSGA-II or the particle swarm optimization algorithm is selected as the solution tool, and the algorithm parameters are initialized.

[0143] If the non-dominated sorting genetic algorithm NSGA-II is selected, the initialization parameters include:

[0144] Population size: set to 50 to 200, which is the number of combinations of resource-preset decision variables included in the initial solution set;

[0145] Number of iterations: Set to 100 to 500, which is the maximum number of iterations for algorithm optimization;

[0146] Crossover probability: Set to 0.8 to 0.9 to control the probability of crossover operations between two parent decision variables during iteration;

[0147] Mutation probability: set to 0.01 to 0.05, used to control the probability of gene mutation occurring in a single combination of decision variables during iteration;

[0148] If the particle swarm optimization algorithm is selected, the initialization parameters include:

[0149] Population size: set to 50 to 200, which is the number of particles in the particle swarm (each particle corresponds to a set of pre-set resource decision variables).

[0150] Number of iterations: Set to 100 to 500, which is the maximum number of iterations for particle swarm optimization;

[0151] Inertia weight: The initial value is set to 0.8 to 1.2 to balance the global exploration and local exploitation capabilities of particles;

[0152] Cognitive Factor: Set to 1.5 to 2.0, used to measure the weight of a particle's memory of its own best historical position;

[0153] Social factor: set to 1.5 to 2.0, used to measure the weight of a particle in following the group's historical best position;

[0154] Particle velocity limit: Set according to the value range of the resource preset decision variables to avoid extreme values ​​when updating particle positions;

[0155] Step S4-3: Initial solution set generation and cost calculation:

[0156] Based on the constraints identified in step S4-1, multiple combinations of pre-set resource decision variables are randomly generated to form an initial solution set (the initial population in NSGA-II or the initial particle swarm in particle swarm optimization). Each combination of pre-set resource decision variables includes four core elements: resource type, pre-set quantity, pre-set location, and pre-set time. All combinations satisfy constraints such as resource supply, time, and cost.

[0157] For each combination of pre-set resource decision variables in the initial solution set, substitute them into the multi-objective cost optimization function constructed in step S3, and calculate the corresponding pre-set resource cost, business interruption loss cost and resource idle penalty cost respectively, to obtain the three-dimensional cost vector of each combination of decision variables, providing an initial cost benchmark for subsequent iterative optimization;

[0158] Step S4-4: Iterative optimization and solution update:

[0159] Based on the selected multi-objective optimization algorithm, an iterative optimization process is executed to continuously update the solution set to approximate the optimal solution;

[0160] If the non-dominated sorting genetic algorithm NSGA-II is used:

[0161] Non-dominated ranking: Perform non-dominated ranking on all combinations of pre-set resource decision variables in the current solution set, and divide them into non-dominated solution sets of different levels; the definition of a non-dominated solution set is: for any combination of decision variables in this set, there is no other combination that is better than it in all three costs;

[0162] Crowding degree calculation: For each combination of decision variables in the non-dominated solution set, the crowding degree is calculated. The crowding degree reflects the "sparseness" of the combination in the solution set. The calculation formula is as follows: ,in, For congestion level, The cost types are categorized as follows: 1 represents resource provision costs, 2 represents business interruption loss costs, and 3 represents resource idleness penalty costs. For the current combination of decision variables, and For the current combination in the th Adjacent combinations after cost sorting For combination In the The value of the item cost, For the first The maximum value of the item cost, For the first The minimum cost of the item;

[0163] Selection operation: Based on the non-dominated sorting level and crowding, the roulette wheel selection method is used to select the parent combination from the current solution set. The higher the level and the greater the crowding, the higher the probability of the combination being selected.

[0164] Crossover and mutation operations: For the selected parent combination, perform a single-point crossover operation according to the preset crossover probability to exchange some decision variables (such as exchanging the preset position or quantity of resources); then perform a random mutation operation according to the preset mutation probability to randomly adjust the value of a certain decision variable (such as fine-tuning the preset quantity) and generate the child solution set;

[0165] Solution set merging and filtering: Merge the parent solution set with the child solution set, perform non-dominated sorting and crowding calculation again, and filter out a new solution set whose number is consistent with the initial population size, and enter the next iteration;

[0166] If the particle swarm optimization algorithm is used:

[0167] Individual and group optimal updates: For each particle (a combination of pre-set resource decision variables), compare its current three-dimensional cost vector with its own historical optimal cost vector. If the current cost is better, update the individual optimal position. Then compare the individual optimal cost vectors of all particles to select the group optimal position.

[0168] Particle velocity and position update: The velocity and position of each particle are updated based on inertial weights, cognitive factors, and social factors. The calculation formula is as follows: ; ;in, For particles in The speed of generation For inertial weights, For particles in The speed of generation For cognitive factors, As a social factor, and A random number between 0 and 1 This represents the optimal position for the individual particle. For particles in The position of the generation, The optimal position for the group. For particles in The position of the generation;

[0169] Constraint satisfaction verification: Perform constraint verification on the updated particle positions (combination of resource preset decision variables). If the constraints identified in step S4-1 are not met, adjust the variable values ​​using the boundary truncation method (e.g., adjust the preset quantity that exceeds the supply limit to the maximum supply quantity) to ensure that all particles are within the feasible region.

[0170] Step S4-5: Convergence judgment:

[0171] After each iteration, a convergence check is performed, based on two core criteria:

[0172] Solution set stability criterion: Calculate the average cost deviation of non-dominated solution sets over 3 to 5 consecutive generations. If the deviation is less than a preset threshold, the solution set is considered stable. The formula for calculating the average cost deviation is: ,in, For average cost deviation, The number of combinations of decision variables in the non-dominated solution set. For the first The generation The value of a certain cost item in a combination, For the first The average cost of this type of cost is typically set to a threshold of 0.01 times the average cost of the initial solution set.

[0173] Iteration count standard: If the current iteration count reaches the maximum iteration count preset in step S4-2, the iteration is directly terminated;

[0174] If either of the two criteria is met, the iteration stops and the current non-dominated solution set is taken as the final solution set; if neither is met, the process returns to step S4-4 to continue the next iteration.

[0175] Step S4-6: Optimal resource pre-configuration strategy selection and output:

[0176] The optimal combination of pre-set resource decision variables is selected from the final solution set. A comprehensive evaluation function is constructed using a weighted assignment method. Based on the business's emphasis on the three types of costs, weights are assigned to resource pre-set costs, business interruption loss costs, and resource idle penalty costs. , , (satisfy ),

[0177] The comprehensive evaluation function is: ,in, To calculate the overall cost score, Pre-allocate costs for resources, To cover the costs of business interruption Penalties for idle resources;

[0178] Calculate the comprehensive cost score for each combination of decision variables in the final solution set, select the combination with the lowest score as the optimal resource pre-positioning strategy, and clarify the four core contents of the strategy, namely, resource type, pre-positioning quantity, pre-positioning location and pre-positioning time. Output the strategy in the form of a structured report to provide a direct basis for the strategy execution in step S5.

[0179] In this embodiment, step S5 executes the optimal resource pre-positioning strategy output in step S4. By continuously collecting actual data after the strategy execution, the data is fed back to the business-resource profile library, thereby updating the parameters of the potential interruption event prediction model and the weights of the multi-objective cost optimization function. This ultimately forms a continuously iterative closed-loop optimization mechanism to ensure the accuracy and adaptability of subsequent resource pre-positioning strategies. The detailed steps are as follows:

[0180] Step S5-1: Execute the optimal resource provisioning strategy and generate execution records:

[0181] Based on the optimal resource pre-provisioning strategy output in step S4, clarify the four core elements included: resource type, pre-provision quantity, pre-provision location, and pre-provision time. According to the pre-provision time nodes, complete the deployment of the corresponding resources at the specified pre-provision locations: for hardware resources (such as servers and network equipment), coordinate the supply chain to complete equipment procurement, transportation, installation, and debugging; for software resources (such as specific licensed software), complete authorization activation, deployment configuration, and functional testing.

[0182] During resource deployment, the actual execution status of each resource is recorded in real time, including the actual type of resource deployed, the actual quantity (if there is a market supply deviation, the reason for adjustment must be recorded), the actual deployment location, the actual completion time, any abnormal situations during the deployment process and their handling results. This information is integrated to generate a resource pre-configuration execution record to ensure that every step of the execution operation is supported by traceable data.

[0183] Step S5-2: Continuously collect data after the strategy is executed:

[0184] After the optimal resource pre-configuration strategy is executed, the business monitoring system and environmental monitoring system are activated to continuously collect two types of core data: one type is actual business operation status data, including real-time business traffic, business processing response time, business success rate, and actual utilization rate of various infrastructure resources (such as server CPU utilization, memory utilization, and network bandwidth utilization); the other type is external environment data, including real-time weather conditions, dynamics of social events in the region, and fluctuations in resource market prices.

[0185] Data collection uses a preset time interval (the interval can be dynamically adjusted according to business needs, usually from 5 minutes to 1 hour) to ensure the timeliness and continuity of the data; all collected data is sorted by timestamp to generate a dataset after strategy execution. The dataset must include key information such as collection time, data type, data value, and data collection source.

[0186] Step S5-3: Integrate and link data to form optimized execution data:

[0187] The resource pre-configuration execution record generated in step S5-1 is linked and integrated with the policy execution dataset generated in step S5-2: using the "actual deployment time" in the resource pre-configuration execution record as the base time point, relevant data in the policy execution dataset after that time point is matched. For example, the actual deployment time of a batch of servers is bound with the utilization data of the server after deployment and the corresponding business operation status data. At the same time, the "resource type" and "pre-configuration location" in the resource pre-configuration execution record are linked with the "resource utilization rate" and "regional environment data" in the policy execution dataset to ensure that the execution status of each resource can correspond to its actual impact on business operation and the external environmental conditions.

[0188] Through the above-mentioned correlation operations, data silos are eliminated, forming an integrated data set that includes "strategy execution information - actual business impact - external environmental changes", i.e., optimized execution data;

[0189] Step S5-4: Update the business resource profile library:

[0190] The optimized execution data generated in step S5-3 is imported into the update module of the business-resource profile library, and incremental updates are performed on the data in the profile library: For historical business data, real-time business traffic, response time and other data collected after strategy execution are added to enrich the historical samples of business operation status; for infrastructure resource data, the types and quantities of resources actually deployed and subsequent resource utilization data are added to improve the resource ledger and usage pattern records; for external environment data, real-time weather, social events and resource price data during strategy execution are added to expand the dataset of external influencing factors.

[0191] During the update process, the integrity of the original historical data is maintained, and only the newly added optimized execution data is stored in a structured manner to ensure that the data coverage of the business-resource profile library continues to expand and the data accuracy continues to improve, providing a high-quality data foundation for subsequent model and function updates;

[0192] Step S5-5: Update the potential disruption event prediction model:

[0193] Based on the updated business-resource profile library in step S5-4, extract the business interruption event records (if an interruption occurs) and corresponding multi-dimensional feature data (including business operation data, resource utilization data, and external environment data for that period) within the latest time period (i.e., after the execution of the optimal resource pre-configuration strategy); add this latest data to the training dataset and merge it with the original historical data to form an updated training dataset;

[0194] The potential disruption event prediction model is retrained using the random forest or long short-term memory network (LSTM) algorithm used in step S2: the updated training dataset is used as input to refit the model parameters; after training, the model's prediction accuracy is evaluated using the validation dataset in the image database. If the accuracy decreases compared to before the update, the model hyperparameters (such as the number of decision trees in the random forest and the number of hidden layer neurons in the LSTM) are adjusted until the model's prediction accuracy reaches the preset standard (usually requiring an accuracy of no less than 90%), and an updated potential disruption event prediction model is generated.

[0195] Step S5-6: Update the weights of the multi-objective cost optimization function:

[0196] Based on the optimized execution data generated in step S5-3, extract the actual cost data, including actual resource pre-configuration costs (actual hardware procurement costs and actual software licensing costs), actual business interruption loss costs (calculated based on the actual interruption duration and business loss if an interruption occurs), and actual resource idle penalty costs (calculated based on the actual idle time of resources and maintenance costs).

[0197] Calculate the deviation index of each cost item in the multi-objective cost optimization function. The deviation index is represented by the cost deviation rate, and the calculation formula is as follows: ,in, Cost deviation rate The actual value of a certain cost (extracted from the optimization execution data), This is the predicted value of the cost (the value calculated based on the original model in step S3);

[0198] Adjust the weighting coefficients of each cost in the multi-objective cost optimization function based on the cost deviation rate: If the deviation rate of a certain type of cost is high (e.g., exceeding 10%), it indicates insufficient prediction accuracy for that type of cost, and its weighting coefficient in the function needs to be increased (e.g., if the original weight is 0.3, it can be adjusted to 0.4) to enhance the attention given to this type of cost in subsequent optimization processes; if the deviation rate is low (e.g., below 5%), maintain or appropriately reduce its weighting coefficient; after adjustment, it is necessary to ensure the pre-set cost weight of resources. Business interruption loss cost weighting Weighting of resource idleness penalty costs satisfy Generate a multi-objective cost optimization function with updated weights;

[0199] Step S5-7: Form a closed-loop optimization mechanism:

[0200] The updated potential interruption event prediction model in step S5-5 and the updated multi-objective cost optimization function in step S5-6 are applied to the next resource pre-positioning strategy generation process: In the new business-resource management cycle, the updated model is used to predict future interruption events, and the updated function is used as the optimization objective. The multi-objective optimization solution process in step S4 is repeated to generate a new optimal resource pre-positioning strategy.

[0201] Through a cyclical process of "strategy execution - data collection - model and function update - new strategy generation", a continuous iterative closed-loop optimization mechanism is formed, enabling the pre-configured resource strategies to be dynamically adjusted according to actual business operations and changes in the external environment, thereby continuously improving the accuracy and effectiveness of cybersecurity asset risk pricing and management.

[0202] A business-impact-oriented cybersecurity asset risk pricing and management system, the system being used to implement methods including:

[0203] I. Data Integration and Business - Resource Profile Construction Module:

[0204] This module is the system's data foundation support module. Its core function is to integrate multi-source data and build a business-resource profile library to provide high-quality data for subsequent risk prediction and cost optimization.

[0205] Its operational process is as follows: First, three types of core data are collected, including historical business data reflecting the operational status of the business, infrastructure resource data reflecting the infrastructure support capabilities, and external environmental data affecting the business and resources. The collected raw data is cleaned and standardized to eliminate missing values, outliers, and duplicate values, and to unify the data scale. Then, key features of the business, resource, and environmental dimensions are extracted from the cleaned data to form a multi-dimensional feature set. Finally, based on the inherent mapping relationship between the business and resources, the multi-dimensional feature set is associated and integrated to construct a business-resource profile library containing the relationship between the business, resources, and environment. This profile library can be updated in real time to ensure the timeliness and completeness of the data.

[0206] II. Potential Interruption Event Prediction Module:

[0207] This module takes the business-resource profile library as data input, and its core function is to build and deploy a potential interruption event prediction model and dynamically output business interruption risk information within a future preset time window.

[0208] The operational process is as follows: historical interruption event records and corresponding feature data are extracted from the business-resource profile database to form a training dataset; time series processing is performed on the training dataset to divide it into feature sequences and label sequences (labels include interruption probability, affected business scope, and resource missing degree); an initial prediction model is trained using machine learning algorithms (such as random forest or long short-term memory network LSTM); the model performance is evaluated and hyperparameters are adjusted using a validation dataset to generate an optimized prediction model; after the optimized model is deployed, the latest feature data is obtained from the business-resource profile database in real time, and the prediction results of interruption events within a preset future time window are dynamically output to provide risk input for subsequent cost optimization;

[0209] III. Multi-objective cost optimization module:

[0210] This module is based on the prediction results of potential interruption events. Its core function is to calculate three types of key costs and construct a multi-objective cost optimization function to provide objective function support for strategy solving.

[0211] The operational process is as follows: First, based on the degree of resource shortage in the prediction results, analyze the types and initial quantities of resources that need to be pre-positioned to form resource pre-positioning requirements; then, calculate three types of costs respectively: resource pre-positioning cost (hardware procurement and software licensing costs calculated based on resource type, quantity, and market price), business interruption loss cost (quantified by combining interruption probability, affected business scope, business importance weight, and interruption duration), and resource idle penalty cost (calculated based on the idle time and maintenance cost of pre-positioned resources); finally, integrate the three types of costs into a multi-objective cost optimization function, which takes resource pre-positioning decision variables (resource type, quantity, location, and time) as input and clarifies the optimization objective of "minimizing the three types of costs";

[0212] IV. Optimal Resource Pre-set Strategy Solution Module:

[0213] This module takes a multi-objective cost optimization function and interruption prediction results as input. Its core function is to solve the optimal resource pre-positioning strategy through a multi-objective optimization algorithm, providing specific solutions for enterprise resource deployment.

[0214] Its operation process is as follows: First, determine the optimization algorithm (such as the non-dominated sorting genetic algorithm NSGA-II or the particle swarm optimization algorithm) and initialize the algorithm parameters (such as population size, number of iterations, etc.); generate an initial solution set based on the resource pre-set constraints (such as resource supply limit, time node requirements, budget constraints), and each solution set corresponds to a set of resource pre-set decision variables; for each combination in the initial solution set, substitute it into the multi-objective cost optimization function to calculate the cost value, and then continuously approach the optimal solution through algorithm iterative optimization (such as non-dominated sorting and crossover mutation in NSGA-II, and speed and position updates in the particle swarm algorithm); when the iteration reaches the preset number or the solution set tends to stabilize, stop the iteration, and select the combination with the best comprehensive cost from the final solution set to form the optimal resource pre-set strategy that includes resource type, pre-set quantity, pre-set location, and pre-set time;

[0215] V. Closed-loop optimization module:

[0216] This module is the core of the system's dynamic iteration. Its core function is to execute the optimal resource pre-positioning strategy and feed back data, update key system components, and form a continuous optimization mechanism.

[0217] Its operational process is as follows: First, resources are deployed according to the optimal resource pre-provisioning strategy, and the actual execution status is recorded to form a resource pre-provisioning execution record; then, actual data after strategy execution is continuously collected, including business operation status data (such as business traffic and resource utilization) and external environment data; the execution record and collected data are correlated and integrated to form optimized execution data containing "strategy execution - business impact - environmental changes"; this data is fed back to the business-resource profile library to complete the incremental update of the profile library; based on the updated profile library, the potential interruption event prediction model is retrained to optimize prediction accuracy, and the weights of the multi-objective cost optimization function are adjusted according to the deviation between actual cost and predicted cost; the updated model and function will be applied to the next round of strategy generation to achieve closed-loop iteration of the system and ensure that the resource pre-provisioning strategy always adapts to changes in business and risks.

[0218] The entire system is centered around "business impact," with each module working in close collaboration: the profile library built by the data integration module provides the foundation for the prediction module; the risk results from the prediction module provide the basis for the cost optimization module; the cost optimization function provides the objective for the strategy solving module; and the feedback data after strategy execution provides the input for the closed-loop module. Ultimately, through closed-loop iteration, the system achieves the goals of "more accurate risk prediction, more reasonable cost control, and more efficient resource deployment," helping enterprises to achieve refined risk pricing and management of cybersecurity assets while ensuring business security.

[0219] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A business-impact-oriented approach to pricing and managing cybersecurity asset risks, characterized by: Includes the following steps: Step S1: Construct a business-resource profile library. This library is formed by integrating historical business data, infrastructure resource data, and external environment data, and performing data cleaning and feature extraction. Specifically, it includes: Multi-source data integration is performed, collecting historical business data, infrastructure resource data, and external environment data. Historical business data includes business traffic and business types, infrastructure resource data includes server capacity and network bandwidth, and external environment data includes weather events and social events, generating a raw dataset. The original dataset is cleaned, including handling missing values, outliers, and duplicate values, and data standardization is performed to generate a cleaned dataset. Based on the cleaned dataset, feature extraction is performed. Key business indicators are extracted through the business feature extraction module, resource utilization indicators are extracted through the resource feature extraction module, and environmental impact indicators are extracted through the environmental feature extraction module, generating a multi-dimensional feature set. Multi-dimensional feature sets are correlated and fused, and a business-resource association graph is constructed based on the mapping relationship between business and resources, and stored as a business-resource profile library; Step S2: Based on the business-resource profile library, train a potential interruption event prediction model. This model employs machine learning algorithms, including random forests or Long Short-Term Memory (LSTM) networks, to dynamically predict the probability and expected impact range of at least one business interruption event occurring within a preset time window. The expected impact range includes the scope of affected businesses and the degree of resource loss, including: Extract historical interruption event records and corresponding multi-dimensional feature data from the business-resource profile library to generate a training dataset; The training dataset is processed by time series slicing, and feature sequences and label sequences are divided based on a preset time window. The label sequences include labels for the probability of interruption events, the scope of affected business, and the degree of resource shortage. Based on feature sequences and label sequences, a random forest or long short-term memory network (LSTM) algorithm is used to initialize the prediction model, and the model parameters are fitted through the training process to generate the initial prediction model. The initial prediction model is evaluated using the validation dataset in the business-resource profiling library. Based on the evaluation results, the model hyperparameters are adjusted to generate an optimized prediction model. The optimized prediction model is deployed as a potential interruption event prediction model, which is used to dynamically output the prediction results of interruption events within a future preset time window; Step S3: Construct a multi-objective cost optimization function, which includes resource pre-configuration cost, service interruption loss cost, and resource idle penalty cost, wherein: The resource pre-configuration cost is calculated based on the type and quantity of pre-configured resources, including hardware procurement costs and software licensing costs, and includes the following steps: Based on the set of pre-set resource requirements, we analyze the types of resources that need to be pre-set, the estimated quantity of pre-set resources, the location of pre-set resources, and the time of pre-set resources. Based on the resource type, preset location, and preset time, obtain the corresponding hardware purchase price and software license price from the resource market price information database; Calculate hardware procurement costs based on the pre-set quantity estimate and hardware purchase unit price; Calculate the software license fee based on the pre-set quantity estimate and the unit price of the software license. Integrate hardware procurement costs and software licensing costs to generate resource provisioning costs; The cost of business interruption loss is quantified based on the probability and expected impact range predicted in step S2, specifically calculated through the duration of business interruption and the weight of business importance. The resource idle penalty cost is applied to resources that are pre-set but not used, and is calculated based on idle time and resource maintenance costs. Constructing a multi-objective cost optimization function includes the following steps: Based on the output of the potential interruption event prediction model obtained in step S2, the probability and expected impact range of at least one business interruption event occurring within a future preset time window are obtained. The expected impact range includes the scope of affected businesses and the degree of resource loss. Based on the degree of resource scarcity, a resource pre-determined demand set is generated, which includes the types of resources to be pre-determined and the initial quantity estimates. Based on the set of pre-positioned resource requirements and combined with resource market price information, the pre-positioned resource cost is calculated, which includes hardware procurement costs and software licensing costs. Based on the probability and the scope of affected businesses, combined with the business importance weights extracted from the business-resource profile library and the expected duration of the interruption, the cost of business interruption losses is quantified. For the set of pre-set resource requirements, considering the risk of resource idleness, calculate the resource idleness penalty cost based on the resource idle time and the resource maintenance cost per unit time; The resource pre-positioning cost, business interruption loss cost, and resource idle penalty cost are integrated into a multi-objective cost optimization function. Each cost component is defined as a function of the resource pre-positioning decision variables, which include resource type, pre-positioning quantity, pre-positioning location, and pre-positioning time. Step S4: Using the prediction results obtained in step S2 as input parameters, a multi-objective optimization algorithm is used to solve the multi-objective cost optimization function, and the optimal resource pre-positioning strategy for the at least one service interruption event is output. The optimal resource pre-positioning strategy includes resource type, pre-positioning quantity, pre-positioning location and pre-positioning time. The multi-objective optimization algorithm includes the non-dominated sorting genetic algorithm NSGA-II or the particle swarm optimization algorithm. Step S5: Execute the optimal resource pre-configuration strategy, and continuously collect actual business operation status data and external environment data after execution, feeding them back to the business-resource profile library to update the parameters of the potential interruption event prediction model and the weights of the multi-objective cost optimization function, forming a closed-loop optimization, including: Execute the optimal resource provisioning strategy, complete resource deployment according to the resource type, provisioning quantity, provisioning location and provisioning time defined in the strategy, and generate resource provisioning execution records; After resource pre-configuration is executed, the business monitoring system and environmental monitoring system continuously collect actual business operation status data and external environment data to generate a post-strategy execution dataset. The dataset after strategy execution is linked and integrated with the pre-configured resource execution records to form optimized execution data; The optimized execution data is fed back to the business-resource profile library. The data update module incrementally updates the historical business data, infrastructure resource data and external environment data in the profile library to generate the updated business-resource profile library. Based on the updated business-resource profile library, the latest business interruption event records and corresponding feature data are extracted, the potential interruption event prediction model is retrained, the model parameters are adjusted according to the prediction accuracy, and the updated potential interruption event prediction model is generated. Based on the actual resource utilization efficiency and business interruption loss in the optimized execution data, the cost deviation index of the multi-objective cost optimization function is calculated. The weight coefficients of the resource pre-set cost, business interruption loss cost and resource idle penalty cost in the multi-objective cost optimization function are dynamically adjusted according to the cost deviation index to generate the multi-objective cost optimization function with updated weights. The updated potential interruption event prediction model and the weighted multi-objective cost optimization function are applied to the subsequent resource pre-positioning strategy generation process to form a closed-loop optimization mechanism.

2. The method for pricing and managing cybersecurity asset risks based on business impact as described in claim 1, characterized in that: The cost of business interruption loss is quantified based on the probability and expected impact range predicted in step S2, specifically calculated through the duration of business interruption and the weight of business importance; including the following steps: From the output of the potential disruption event prediction model, obtain the probability of business disruption events and the expected impact range within a future preset time window. The expected impact range includes the scope of affected services and the degree of resource loss. Based on the scope of affected businesses, the importance weights of the corresponding businesses are extracted from the business-resource profile library; Based on the degree of resource shortage and combined with the business-resource relationship graph, the duration of business interruption is estimated. The cost of business interruption is calculated based on probability, business importance weight, and business interruption duration.

3. The method for pricing and managing cybersecurity asset risks based on business impact as described in claim 1, characterized in that: The resource idle penalty cost applies to pre-allocated resources that are not used, and is calculated based on idle time and resource maintenance costs; it includes the following steps: Based on the set of pre-set resource requirements, obtain the type, estimated quantity, location, and time of the pre-set resources; Based on historical resource usage data or resource utilization patterns in the business-resource profile library, predict the idle time of pre-set resources; Extract the unit time maintenance cost of the corresponding resource from the resource market price information database; Calculate the resource idle penalty cost based on the pre-set quantity estimate, idle time, and maintenance cost per unit time.

4. The method for pricing and managing cybersecurity asset risks based on business impact as described in claim 1, characterized in that: Step S4 uses the prediction result obtained in step S2 as input parameters, employs a multi-objective optimization algorithm to solve the multi-objective cost optimization function, and outputs the optimal resource pre-configuration strategy for at least one service interruption event, including the following steps: Based on the prediction results of potential interruption events obtained in step S2, the probability and expected impact range of business interruption events within a future preset time window are obtained as input parameters for the multi-objective cost optimization function. Initialize the parameters of the multi-objective optimization algorithm, including population size, number of iterations, and algorithm-specific parameters. For the non-dominated sorting genetic algorithm NSGA-II, the algorithm-specific parameters include crossover probability and mutation probability. For the particle swarm optimization algorithm, the algorithm-specific parameters include inertia weight and learning factor. Generate an initial solution set, which consists of a combination of multiple resource preset decision variables. Each combination of resource preset decision variables includes resource type, preset quantity, preset location, and preset time. For each combination of resource pre-set decision variables in the initial solution set, calculate the value of the multi-objective cost optimization function to obtain the resource pre-set cost, business interruption loss cost, and resource idle penalty cost; Based on the value of the multi-objective cost optimization function, iterative optimization is performed using a multi-objective optimization algorithm. This includes performing non-dominated sorting, crowding calculation, selection, crossover, and mutation operations on the non-dominated sorting genetic algorithm NSGA-II to generate a new generation of solution sets, and performing particle position and velocity updates on the particle swarm optimization algorithm to generate a new generation of solution sets. After reaching the preset number of iterations or the convergence condition, the optimal combination of pre-set resource decision variables is selected from the final solution set through decision rules and output as the optimal pre-set resource strategy.

5. A cybersecurity asset risk pricing and management system oriented towards business impact, characterized by: The system is used to perform the method according to any one of claims 1-4.

Images