Multi-dimensional information entropy and dynamic weight adaptive security situation assessment method

Abstract

The invention discloses a multi-dimensional information entropy and dynamic weight adaptive security situation assessment method, and relates to the technical field of data processing, and the security situation assessment method constructs a set of security situation assessment system integrating quantitative perception, dynamic fusion and prospective prediction. By introducing calculation of behavior entropy, access entropy and flow entropy, abstract anomalies are converted into quantifiable indexes; a dynamic weight fusion mechanism based on an entropy value change rate is utilized, so that the real-time performance and accuracy of risk assessment are remarkably improved; probabilistic prediction of short-term risk transition is realized in combination with a Markov chain model, and passive response is changed into active defense; and finally, through full-closed-loop operation of data acquisition, calculation, response and optimization, continuous self-adaptive improvement of the safety capability of the data intermediate station is realized. The security situation assessment method is rapid, efficient, safe and reliable, and is suitable for industry scenes such as medical treatment, government affairs, finance and the like having relatively high requirements on data security of a data-in-data station.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, in particular to a multi-dimensional information entropy and dynamic weight adaptive security posture assessment method. BACKGROUND

[0002] With the deepening of digital transformation, data center has become the core hub of enterprises to gather multi-source heterogeneous data, but its characteristics of "fast data flow, high asset value and complex access scene" also make traditional security protection face a series of prominent pain points.

[0003] Firstly, the traditional method mainly relies on qualitative permission control, which is difficult to quantitatively analyze various behaviors of the platform, resulting in a lack of fine security control strategy; secondly, in the security posture assessment process, the weight mechanism is often static, which cannot dynamically adjust the priority according to real-time threats, restricting the accuracy of risk assessment; in addition, the existing security response is mainly based on fixed templates, which is difficult to combine with specific scenes for short-term risk prediction, resulting in a lack of active defense capability of the system; finally, the overall technical system has not formed a full closed-loop assessment capability combining digitalization, multi-dimension, dynamic and forward-looking. SUMMARY

[0004] The purpose of the present application is to provide a multi-dimensional information entropy and dynamic weight adaptive security posture assessment method, which can realize real-time quantitative evaluation, short-term risk prediction and adaptive defense response of the security state of data center.

[0005] The embodiments of the present application are implemented as follows: A multi-dimensional information entropy and dynamic weight adaptive security posture assessment method comprises the following steps: S1, real-time collection of multi-source security log data generated by data center; S2, based on information entropy theory, respectively calculating the entropy values of multi-source security log data in different dimensions to quantify the security state in different aspects; S3, dynamically adjusting the weight of each dimension entropy value in the comprehensive risk assessment according to the change rate of the entropy value in the adjacent evaluation period, and fusing the multi-dimensional entropy values based on the dynamic weight to obtain the comprehensive risk score at the current time; S4, determining the current security state level according to the comprehensive risk score, and predicting the probability of system transition to a higher risk level within a specified time in the future based on the Markov chain model; S5, executing corresponding adaptive security response measures according to the current security state level and the transition probability; S6, based on the execution effect of the security response measures, iteratively optimizing the parameters of the Markov chain model and the risk assessment threshold.

[0006] Furthermore, in other preferred embodiments of the present invention, the multi-source security log data includes user behavior data, data access data, and network traffic data.

[0007] Furthermore, in other preferred embodiments of the present invention, in step S2, the formula for calculating the entropy value is: , in, The entropy value. For the first i Class feature combination in the first t The probability of a given moment occurring.

[0008] Furthermore, in other preferred embodiments of the present invention, the entropy value corresponding to user behavior data is behavior entropy, which is calculated based on a combination of behavioral features consisting of user access time, operation type, and access data sensitivity level; the entropy value corresponding to data access data is access entropy, which is calculated based on different access subjects accessing a single data asset; the entropy value corresponding to network traffic data is traffic entropy, which is calculated based on a combination of traffic features consisting of source IP address, destination IP address, port number, and data packet size.

[0009] Furthermore, in other preferred embodiments of the present invention, the process of dynamically adjusting the weights in step S3 includes: S31. Assign initial weights to the entropy values ​​of each dimension, and the sum of the initial weights is 1; S32. Calculate the absolute difference between the entropy values ​​of each dimension in the current period and the previous period as the gradient; S33. Calculate the adjusted weights according to the weight adjustment formula; S34. Normalize the adjusted weights to obtain the final weights used for fusion.

[0010] Furthermore, in other preferred embodiments of the present invention, the weighting adjustment formula is as follows: W x ( t ) = W x0 × (1 +α × G x ( t )), In the formula, W x0 As the initial weights, G x ( t ) represents the gradient, and α is a predefined weight adjustment coefficient.

[0011] Furthermore, in other preferred embodiments of the present invention, the formula for calculating the comprehensive risk score in step S3 is as follows: , In the formula, R ( t The comprehensive risk score is as follows: W x '( t The weights are the normalized weights. H x ( t ) represents the entropy value of each dimension.

[0012] Furthermore, in other preferred embodiments of the present invention, step S4 includes: S41. Based on multiple preset risk thresholds, map the comprehensive risk score to discrete safety status levels. S42. Construct the initial state transition probability matrix of the Markov chain based on historical safe state data; S43. Determine the number of transfer cycles based on the ratio of the prediction time window to the evaluation period; S44. If the current system is in the [number]th [stage]... i The safety status level is calculated using the transition probability calculation formula, which determines the total probability that the system will transition to a higher risk level within a future prediction time window.

[0013] Furthermore, in other preferred embodiments of the present invention, the probability calculation formula is as follows: , In the formula, P is the initial state transition probability matrix, and k is the number of transition cycles. From the i Safety status level passed k After the [number]th cycle, it transitions to the [number]th cycle. j The probability of a security status level, Δ t To predict the time window, t For the evaluation period.

[0014] Furthermore, in other preferred embodiments of the present invention, in step S5, the adaptive security response measures are selected based on a combination of the current security status level and the transition probability. The response measures include one or more of the following: routine monitoring, triggering secondary authentication, temporarily restricting data access permissions, initiating dynamic data desensitization, improving the network transmission encryption level, and isolating high-risk data sources.

[0015] The beneficial effects of the embodiments of the present invention are: This invention provides a multi-dimensional information entropy and dynamic weight adaptive security posture assessment method. This method constructs a security posture assessment system that integrates quantitative perception, dynamic fusion, and forward-looking prediction. By introducing the calculation of behavioral entropy, access entropy, and traffic entropy, abstract anomalies are transformed into quantifiable indicators. A dynamic weight fusion mechanism based on the entropy change rate significantly improves the real-time performance and accuracy of risk assessment. Combined with a Markov chain model, it enables probabilistic prediction of short-term risk transitions, transforming passive response into proactive defense. Finally, through a closed-loop operation of "data collection-computation-response-optimization," it achieves continuous adaptive improvement of the data platform's security capabilities. This security posture assessment method is fast, efficient, secure, and reliable, and is suitable for industry scenarios such as healthcare, government affairs, and finance, where data platform security requirements are high. Attached Figure Description

[0016] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 The flowchart illustrates a security posture assessment method based on multi-dimensional information entropy and dynamic weights, as provided in an embodiment of the present invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to represent selected embodiments of the invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] The abbreviations and key terms used in the following embodiments are defined as follows: Example

[0020] This embodiment provides a security posture assessment method based on multi-dimensional information entropy and dynamic weight adaptation, which includes: S1. Real-time acquisition of multi-source security log data generated by the data platform.

[0021] Furthermore, multi-source security log data includes user behavior data, data access data, and network traffic data. Data collection is achieved by deploying multi-source data collection modules, which are connected to the data platform's storage module (Doris), computing module (Flink), service module (API gateway), and network devices (routers, firewalls).

[0022] User behavior data includes user ID, access time (accurate to the second), operation type (query / modify / download / delete), and the sensitivity level of the accessed data (ordinary / confidential / top secret, pre-labeled by the data platform classification and grading module).

[0023] Data access data includes the access subject (user / application system), target data asset ID (database table name / API interface name / data file name), and access frequency within a unit of time (5 minutes).

[0024] Network traffic data includes source IP address, destination IP address, port number, packet size (categorized as less than 1KB / 1KB~10MB / more than 10MB), and traffic frequency per unit time.

[0025] Preprocess the collected multi-source security log data, including cleaning up null values ​​(such as removing abnormal logs with "user ID is empty"), standardizing the format (such as unifying the access time to the "yyyy-MM-dd HH:mm:ss" format), and associating data (such as associating user behavior data with data access data by "user ID", and associating data access data with network traffic data by "destination IP").

[0026] Data collection and preprocessing can provide complete, standardized, and relevant raw data for subsequent entropy calculations, avoiding deviations in entropy calculations caused by missing data or disordered formats.

[0027] Furthermore, the security posture assessment method based on multi-dimensional information entropy and dynamic weight adaptive provided in this embodiment also includes: S2. Based on the information entropy theory, calculate the entropy values ​​of multi-source security log data in different dimensions to quantify the security status at different levels.

[0028] Furthermore, the entropy value is calculated based on the Multi-Dimensional Information Entropy Perception (MIEP) algorithm. The formula for calculating the entropy value is as follows: , in, The entropy value. For the first i Class feature combination in the first t The probability of a given moment occurring.

[0029] Furthermore, this embodiment employs "behavioral entropy ( H behavior ), access entropy ( H access ), flow entropy ( H flow The information entropy of the three core dimensions quantifies the security status of different levels of the data platform, providing basic indicators for subsequent risk assessment.

[0030] Among them, the entropy value corresponding to user behavior data is behavioral entropy, which is calculated based on user behavior characteristics, including user access time (e.g., whether the operation occurred outside of working hours), operation type (e.g., query, modification, download), and access sensitivity level (e.g., ordinary data, confidential data). This is a set of behavioral feature combinations constructed from the above data. X ={ x 1, x 2,..., x n For example, "non-working hours (22:00~06:00) + download + confidential data" is... x 1. "Working hours (06:00~22:00) + Query + Regular data" is... x 2.

[0031] Calculate the probability of the occurrence of each combination of behaviors within the evaluation period of the statistical unit. p ( x i )= x i Number of occurrences / Total number of actions. Substituting this into the entropy calculation formula, we get: .

[0032] Behavioral entropy can quantify the uncertainty of user behavior sequences and reflect the degree of abnormality in user operation patterns. H behavior A sudden increase may indicate chaotic operations following account theft (such as a combination of multiple unusual behaviors within a short period of time). H behavior A sudden drop may indicate an automated attack (such as the regular behavior of web crawlers or batch operation tools).

[0033] The entropy value corresponding to data access is the access entropy, which is calculated based on different access subjects accessing a single data asset. In the calculation, firstly (1) the scope of the data asset is determined: such as database tables, API interfaces, data files, etc. Then, for a single data asset (such as a "patient information table"), a set of access subjects is constructed. Y ={ y 1, y 2,..., y m},For example, y 1 for users u 1, y 2 for users u 2.

[0034] The frequency of visits by each user within the evaluation period is statistically analyzed, and the probability is calculated. p ( y j )= y j Number of visits / Total number of visits to this asset. Substituting this into the entropy calculation formula, we get: .

[0035] Access entropy is used to quantify the concentration of access to data assets, reflecting whether data assets have become the focus of attacks. H access A sharp decrease indicates that a small number of entities are concentrated in accessing the asset (such as a user frequently downloading a confidential data table within a short period of time), which may pose a risk of data breach.

[0036] The entropy value corresponding to network traffic data is traffic entropy, which is calculated based on extracted traffic features, such as source IP address, destination IP address, port number, and packet size, forming a set of traffic feature combinations. Z ={ z 1, z 2,..., z k For example, "Source IP=192.168.1.100+Destination IP=10.0.0.5+Port=3306+Packet size=10MB or more" is considered... z 1.

[0037] Calculate the probability of each flow combination occurring within the evaluation period of the statistical unit. p ( z l )= z l Number of occurrences / Total number of occurrences. Substituting this into the entropy calculation formula, we get: .

[0038] Access entropy is used to quantify the randomness of network traffic characteristics and reflects network layer attack behaviors (such as DDoS and port scanning). H flow A sudden drop may indicate a DDoS attack (such as a large number of packets coming from the same source IP). H flow A sudden increase may indicate a port scan (such as a large number of probe requests from different ports appearing in a short period of time).

[0039] This step transforms the "security status" of the three types of data into quantifiable entropy values: behavioral entropy reflects the degree of abnormality in user operations, access entropy reflects the risk of data assets being attacked in a concentrated manner, and traffic entropy reflects the possibility of network layer attacks, providing "perception indicators" for subsequent risk assessment.

[0040] Furthermore, the security posture assessment method based on multi-dimensional information entropy and dynamic weight adaptive provided in this embodiment also includes: S3. Based on the rate of change of the entropy values ​​of each dimension in adjacent assessment periods, dynamically adjust their weights in the comprehensive risk assessment, and integrate the entropy values ​​of multiple dimensions based on the dynamic weights to obtain the comprehensive risk score at the current moment.

[0041] Furthermore, the dynamic weight adaptation is based on the Dynamic Weight Adaptive Fusion (DWAF) algorithm. Compared to traditional multi-indicator fusion which uses fixed weights and cannot adapt to real-time threat scenarios, the algorithm in this embodiment achieves automatic weight optimization based on threat activity through four steps: "weight initialization—gradient calculation—weight adjustment—normalization—comprehensive scoring," thereby improving the accuracy of risk assessment.

[0042] Specifically, the process of dynamically adjusting weights includes: S31. Assuming the window time is defined as t (e.g., 1 minute / 5 minutes, which can be configured according to the real-time requirements of the data platform), the three entropy indicators are as follows: H b = H behavior , H a = H access , H f = H flow Assign initial weights to the entropy values ​​of each dimension, respectively. W b0 , W a0 , W f0 ,in W b0 ,W a0 , W f0 The values ​​of all three are in the range of (0,1), and the sum of the three is 1.

[0043] S32. Calculate the absolute difference between the entropy values ​​of each dimension in the current period and the previous period, and use this as the gradient. , in, G b ( t ), G a ( t ), G f ( t ), which are the gradients of behavioral entropy, access entropy, and traffic entropy, respectively. The larger the gradient, the more drastic the abnormal changes in that dimension.

[0044] S33. Calculate the adjusted weights according to the weight adjustment formula; the weights are adjusted based on the gradient size: the larger the gradient of the indicator, the higher its risk indication priority in the current period, and the weight is increased accordingly.

[0045] Optionally, the weight adjustment formula is as follows: W x ( t ) = W x0 × (1 +α × G x ( t )), In the formula, W x0 As the initial weights, G x ( t ) is the gradient, and α is a predefined weight adjustment coefficient (default 0.5, value range 0<α<1), used to control the sensitivity of weight changes and avoid sudden weight changes caused by short-term fluctuations.

[0046] The weights of the three indicators are adjusted separately, that is .

[0047] S34. Normalize the adjusted weights to obtain the final weights used for fusion.

[0048] To ensure that the sum of the adjusted weights is 1 and to avoid weight overflow, normalization is performed: .

[0049] Furthermore, the normalized weights are multiplied by their corresponding entropy values ​​and summed to obtain the comprehensive risk score for the current period. The calculation formula is as follows: , In the formula, R ( t The comprehensive risk score is as follows: W x '( t The weights are the normalized weights. H x ( t ) represents the entropy value of each dimension.

[0050] The three indicators corresponding to this embodiment can also be denoted as: .

[0051] R ( t The value range of ) is [0, +∞). The higher the score, the higher the security risk of the current data platform.

[0052] This step addresses the shortcomings of traditional static weighting, which applies a "one-size-fits-all" approach. By using dynamic weighting, it allows high-risk dimensions (with large gradients) to have a higher weighting in the assessment, thus increasing the overall risk score. R ( t It can accurately reflect the real-time threat situation and is the core step of "risk quantification".

[0053] Furthermore, the security posture assessment method based on multi-dimensional information entropy and dynamic weight adaptive provided in this embodiment also includes: S4. Determine the current security status level based on the comprehensive risk score, and predict the probability of the system transitioning to a higher risk level within a specified time in the future based on the Markov chain model.

[0054] To achieve "proactive defense," this embodiment introduces a Markov chain model, which uses the Markov Chain-Based Risk Transition Prediction Algorithm (MCBRTP) to predict future Δ states based on historical security state transition patterns. t The probability of the system transitioning to a higher risk level within a given timeframe. Specifically, this includes: S41. Based on multiple preset risk thresholds, the comprehensive risk score is mapped to discrete safety status levels.

[0055] In this embodiment, according to R ( t The range of values ​​for ) divides the system security status into 4 discrete levels: S1 (Security):R ( t )< T 1 ( T 1 = 0.8, low-risk threshold, based on historical risk events (I = 0.8, low-risk threshold, calibrated based on historical risk events). S2 (Low Risk): T 1≤ R ( t )< T 2 ( T 2=1.5 (medium risk threshold). S3 (Medium Risk): T 2≤ R ( t )< T 3 ( T 3=2.2 (high-risk threshold); S4 (High Risk): R ( t )≥ T 3.

[0056] S42. Based on at least 6 months of historical security data from the platform (including...) R ( t (Sequence and security status records) and industry baselines are used to statistically analyze the transition frequency between each state and calculate the transition probability matrix. P 初始 =[ p ij ] 4×4 ,Right now , The matrix satisfies (The sum of the probabilities of each row is 1), ensuring statistical validity.

[0057] For example .

[0058] At the same time, based on the calculation obtained in step S3 R ( t Match the corresponding security status. S i For example, calculated R ( t If ) = 1.02, then T 1 (0.8) ≤ 1.02 < T 2 (1.5), current state is S 2.

[0059] S43. Determine the number of transfer cycles based on the ratio of the prediction time window to the evaluation cycle.

[0060] For example, the prediction time window Δ t The evaluation period is set to 30 minutes.t If the time is set to 5 minutes, then the number of transfer cycles is determined. k =Δ t / t= 6.

[0061] S44. If the current system is in the [number]th [stage]... i The safety status level is calculated using the transition probability calculation formula, which determines the total probability that the system will transition to a higher risk level within a future prediction time window.

[0062] Furthermore, the probability calculation formula is as follows: , In the formula, P is the initial state transition probability matrix, and k is the number of transition cycles. From the i Safety status level passed k After the [number]th cycle, it transitions to the [number]th cycle. j The probability of a security status level ( j > i ), Δ t To predict the time window, t For the evaluation period.

[0063] For example, the current state is S 2, P 6 [2][3]=0.4, P 6 [2][4]=0.1, then Prob jump ( t +30)=0.4+0.1=0.5, meaning the probability of transitioning to medium / high risk within 30 minutes is 50%.

[0064] This step upgrades the approach from "current risk assessment" to "short-term trend prediction," identifying the possibility of risk escalation in advance and providing a basis for decision-making for subsequent "proactive defense," thus avoiding the passivity of the traditional "post-event response" approach.

[0065] Furthermore, the security posture assessment method based on multi-dimensional information entropy and dynamic weight adaptive provided in this embodiment also includes: S5. Based on the current security status level and transition probability, execute the corresponding adaptive security response measures.

[0066] Furthermore, adaptive security response measures are selected based on a combination of the current security status level and the probability of transition. These response measures include one or more of the following: routine monitoring, triggering secondary authentication, temporarily restricting data access permissions, initiating dynamic data desensitization, increasing the encryption level of network transmission, and isolating high-risk data sources.

[0067] Response measures can be constructed R (t ), Prob jump The corresponding relational database, for example: when R ( t )< T 1 ( S 1. Safety) and Prob jump If the value is less than 0.3, perform "routine monitoring" to record only the entropy value and risk score, without interfering with business operations.

[0068] when T 1≤ R ( t )< T 2 ( S 2, low risk), and 0.3≤ Prob jump <0.6; Implement "light response", including triggering two-factor authentication (such as SMS verification code) for suspicious users, temporarily restricting data access permissions (such as prohibiting the download of confidential data), etc.

[0069] when T 2≤ R ( t )< T 3 ( S 3. Medium risk), and 0.6≤ Prob jump <0.8; Implement "Medium Response", including initiating dynamic desensitization of high-risk data (such as upgrading a mobile phone number from "138****5678" to "*******5678"), and upgrading the encryption level of network transmission (upgrading from TLS1.2 to TLS1.3).

[0070] when R ( t )≥ T 3 ( S 4. High risk), and Prob jump If the value is ≥0.8, a "severe response" will be executed, including isolating high-risk data sources (such as suspending external access interfaces for the data asset), freezing suspicious user accounts, and sending emergency alerts (including entropy change curves and abnormal data details) to security operations personnel.

[0071] After the response measures are implemented, a response log is recorded, including the response time, the strategy implemented, the scope of business affected, and user feedback (such as whether the secondary authentication was successful).

[0072] This step can automatically match differentiated defense strategies based on risk level and predicted probability, achieving a balance between "security protection" and "business availability"—avoiding excessive protection in low-risk scenarios that could impact business, while ensuring that risk spread can be quickly contained in high-risk scenarios. It is the core step of "risk management".

[0073] Furthermore, the security posture assessment method based on multi-dimensional information entropy and dynamic weight adaptive provided in this embodiment also includes: S6. Based on the effectiveness of security response measures, iteratively optimize the parameters and risk assessment threshold of the Markov chain model.

[0074] Specifically, it includes the following steps: S61. Deploy the situational awareness and continuous learning module to collect data from the entire process of steps S1 to S5, including raw data collection, entropy calculation results, R ( t ), Prob jump Response measures and their effectiveness (e.g., whether the risk has been downgraded after the response).

[0075] S62. Optimize the Markov chain transition probability matrix: Statistically analyze the newly added "state transition samples" (e.g., after the response in step S5, if the original state was...). S 2. Low risk) remains unchanged S 2, then add 1 more. S 2→ S Two samples were used, and the transition probability was recalculated.

[0076] .

[0077] Example of an optimized matrix: .

[0078] S63, Optimize weight adjustment coefficient α Based on historical response results, if it is found α If the weight change is too slow when the value is 0.5 (high-risk dimensions are not being addressed in a timely manner), then adjust accordingly. α =0.6, to enhance weight sensitivity.

[0079] S64, Optimize risk thresholds ( T 1, T 2, T 3) If found R ( t ) = 1.5 (original) T 2) If the actual risk level has reached medium to high, then... T 2. Lowered to 1.4 to ensure that the threshold matches the actual business risks.

[0080] S65. Generate a model optimization report, showing a comparison of indicators before and after optimization (such as the risk prediction accuracy improving from 80% to 85%), for security operations and maintenance personnel to review.

[0081] This step enables the entire method to "learn on its own," continuously iteratively optimizing model parameters (transition matrix, ... α (Thresholds) make risk assessment and prediction increasingly aligned with the actual business scenarios of enterprises, and prevent the model from becoming ineffective due to business changes.

[0082] Figure 1 The system architecture and implementation process for implementing this multi-dimensional information entropy and dynamic weight adaptive security posture assessment method are demonstrated. The process logic is as follows: 1) Start The process begins.

[0083] 2) Step-1 Execute Unit-1: Real-time Data Collection to access user behavior data, access data, and traffic data.

[0084] Execute Unit-2: Data Preprocessing to output standardized raw data.

[0085] 3) Step-2: Execute Unit-3:MIEP (Unit-3:MIEP algorithm) to achieve "behavioral entropy ( H behavior ), access entropy ( H access ), flow entropy ( H flow The calculation is based on the entropy value calculation formula, and outputs three types of entropy values.

[0086] 4) Stpe-3: Execute Unit-4: DWAF (Unit-4: DWAF algorithm) to achieve " W b0 , W a0 , W f0 set up, G b ( t ), G a ( t ), G f ( t )calculate, W b (t ), W a ( t ), W f ( t "Weight adjustment and normalization" operation.

[0087] Execute Unit-5: Comprehensive Risk Score to achieve " R ( t The "Calculate" operation outputs a comprehensive risk score.

[0088] 5) Step-4: Execute Unit-6: MCBRTP (Unit-6: MCBRTP algorithm) to achieve "safe state partitioning" S 1. S 2. S 3. S 4) Matrix exponentiation ( p n ), calculation of transition probability ( Prob jump ( t +Δ t ))"operate.

[0089] Execute Unit-7: Transition Probability Matrix to store the initial and updated transition probability matrices from Step 4. p 更新后 () is used by the prediction model.

[0090] 6) Stpe-5: Execute Unit-8: Intelligent Decision to achieve " R ( t )and Prob jump "Match response strategy" operation; Execute Unit-9: Response Strategy to implement specific response measures such as "two-factor authentication, access control, and data masking," and record the response log. Execute Unit-10: Continuous Learning to collect data from the entire process of Steps 1-5, providing data support for model optimization; 7) Stpe-6: Execute Unit-11: Model Parameter Optimization, "Transition matrix, α The "coefficient and risk threshold optimization" operation outputs the optimized model parameters and feeds them back to Step 1, forming a closed loop.

[0091] 8) End The process is complete.

[0092] Test case This experimental example simulates the daily operation of a data platform, including five typical scenarios (normal access, internal data theft, DDoS attack, malicious API calls, and privilege abuse). One hundred independent experimental samples are randomly generated, each containing three types of raw data: user behavior logs, data access records, and network traffic data. The security posture assessment method provided in Example 1 is tested. The core parameter settings are as follows: (1) Evaluation cycle: t 0=5, risk prediction window Δ t =30 ( k =6).

[0093] (2) Initial weights: W b0 =0.3, W a0 =0.4, W f0 =0.3, α =0.5.

[0094] (3) Weighting adjustment coefficient α =0.5, risk threshold T 1 = 0.8 (safe / low risk) T 2 = 1.5 (low / medium risk) T 3 = 2.2 (medium / high risk).

[0095] (4) The initial Markov transition probability matrix is ​​as follows: .

[0096] A comparison is made between the traditional static weighting algorithm (Comparison Example 1) and the single-dimensional entropy algorithm (Comparison Example 2): (1) Traditional static weight algorithm: fixed weight W b0 =0.3, W a0 =0.4, W f0 =0.3, α =0.5, no dynamic adjustment or risk prediction function.

[0097] (2) Single-dimensional entropy algorithm: Risk is assessed based on a single entropy, without multi-dimensional fusion and weighting mechanism.

[0098] Record the responses of the three algorithms to 100 independent experimental samples and calculate their respective accuracy. Accuracy ), accuracy ( Precision ), recall rate ( Recall (and F1 score and risk prediction accuracy).

[0099] The accuracy rate is the proportion of correctly predicted samples to the total number of samples, and its formula is: , In the formula, TP The number of correct samples predicted as "at risk" TN This represents the number of correct samples predicted as "risk-free".

[0100] Precision rate is the proportion of samples predicted as "at risk" that are actually "at risk," and its formula is: , In the formula, TP The number of correct samples predicted as "at risk" FP This represents the number of samples that were actually "at risk" but were not reported.

[0101] Recall is the proportion of actual "at-risk" samples that are correctly predicted, and its formula is: , In the formula, TP The number of correct samples predicted as "at risk" FN The number of samples that were actually "risk-free" but were mistakenly reported as "risky".

[0102] F The 1-score is the harmonic mean of precision and recall, and its formula is: .

[0103] The risk prediction accuracy rate is the percentage of samples that predict a "risk transition probability ≥ 0.5" and where the actual risk escalates.

[0104] The statistical results of 100 experiments are shown in Table 1.

[0105] Table 1. Statistical analysis of the results of 100 experiments Performance metrics Example Comparative Example 1 Comparative Example 2 Example vs Comparative Example 1 Improvement Example vs Comparative Example 2 Improvement Accuracy 91% 72% 75% 26.4% 21.3% Precision 89% 65% 70% 36.9% 27.1% Recall 87% 55% 62% 58.2% 40.3% F1-Score 88% 59% 66% 49.2% 33.3% Risk prediction accuracy 83% - (no prediction function) - (no prediction function) - - False positive rate 6% 18% 15% 66.7% 60.0% False negative rate 13% 45% 38% 71.1% 65.8% As shown in Table 1, the security situation assessment method provided by this invention achieves an accuracy of 91%, which is 26.4% higher than the static weight algorithm (72%) and 21.3% higher than the single entropy algorithm (75%). The false alarm rate is only 6%, a 66.7% reduction compared to the static weight algorithm (18%). The core reason is that the dynamic weight can automatically adjust the priority according to the entropy gradient—for example, during a DDoS attack, when the traffic entropy gradient suddenly increases (from 1.2 to 2.8), the traffic entropy weight dynamically increases from 0.3 to 0.6, ensuring that the risk is accurately identified.

[0106] This security posture assessment method achieves a recall rate of 87%, which is 58.2% higher than the static weighted algorithm (55%) and 40.3% higher than the single entropy algorithm (62%). It is particularly effective in identifying low-frequency, unknown threats such as "internal data theft" and "privilege abuse." The core reason is that multi-dimensional entropy values ​​perceive risks across the entire "user-data-network" chain—for example, during internal data theft, behavioral entropy (rising from 0.6 to 1.9) and access entropy (falling from 1.8 to 0.5) show synchronous anomalies. The security posture assessment method provided in this embodiment accurately identifies risks through the superposition of these two anomalies.

[0107] This security situation assessment method achieves a risk prediction accuracy of 83%, predicting the probability of risk escalation 30 minutes in advance (e.g., in 30 samples with a "risk transition probability ≥ 0.5", 25 actually resulted in escalation). In contrast, the two control algorithms lacked predictive capabilities and could only provide "post-event response". The core reason is that the Markov chain transition matrix can quantify state transition patterns—such as low risk (…). S 2) When the probability of the risk escalating to medium risk within 30 minutes is predicted to be 40% through matrix exponentiation, a "mild response" can be triggered in advance to contain the risk.

[0108] This security posture assessment method achieved an F1 score of 88%, a 49.2% improvement over the static weight algorithm (59%) and a 33.3% improvement over the single entropy algorithm (66%). This demonstrates that the algorithm strikes a balance between precision and recall—avoiding false positives of legitimate access (6% false positive rate) while ensuring no threat is missed (13% false negative rate). This characteristic makes it suitable for the complex scenarios of data platforms characterized by "multi-source heterogeneity and high-frequency flow," whereas contrasting algorithms often exhibit the contradiction of "more false positives or more false negatives" (such as the static weight algorithm). F 1. Only 59%, which cannot balance accuracy and recall.

[0109] In summary, this invention provides a multi-dimensional information entropy and dynamic weight adaptive security posture assessment method. This method constructs a security posture assessment system that integrates quantitative perception, dynamic fusion, and forward-looking prediction. By introducing the calculation of behavioral entropy, access entropy, and traffic entropy, abstract anomalies are transformed into quantifiable indicators. A dynamic weight fusion mechanism based on the rate of change of entropy values ​​significantly improves the real-time performance and accuracy of risk assessment. Combined with a Markov chain model, it enables probabilistic prediction of short-term risk transitions, transforming passive response into proactive defense. Finally, through a closed-loop operation of "data collection-computation-response-optimization," it achieves continuous adaptive improvement of the data platform's security capabilities. This security posture assessment method is fast, efficient, secure, and reliable, and is suitable for industry scenarios such as healthcare, government affairs, and finance, where data platform security requirements are high.

[0110] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A security posture assessment method based on multi-dimensional information entropy and dynamic weight adaptive methods, characterized in that, Includes the following steps: S1. Real-time acquisition of multi-source security log data generated by the data platform; S2. Based on the information entropy theory, calculate the entropy values ​​of the multi-source security log data in different dimensions to quantify the security status at different levels; S3. Based on the rate of change of the entropy values ​​of each dimension in adjacent assessment periods, dynamically adjust their weights in the comprehensive risk assessment, and fuse the entropy values ​​of multiple dimensions based on the dynamic weights to obtain the comprehensive risk score at the current moment. S4. Determine the current security status level based on the comprehensive risk score, and predict the probability of the system transitioning to a higher risk level within a specified time period based on the Markov chain model. S5. Based on the current security status level and the transition probability, execute the corresponding adaptive security response measures; S6. Based on the effectiveness of the security response measures, iteratively optimize the parameters and risk assessment threshold of the Markov chain model.

2. The security situation assessment method according to claim 1, characterized in that, The multi-source security log data includes user behavior data, data access data, and network traffic data.

3. The security situation assessment method according to claim 2, characterized in that, In step S2, the formula for calculating the entropy is: ， in, The entropy value. For the first i Class feature combination in the first t The probability of a given moment occurring.

4. The security situation assessment method according to claim 3, characterized in that, The entropy value corresponding to the user behavior data is behavior entropy, which is calculated based on a combination of behavioral characteristics consisting of user access time, operation type, and access data sensitivity level; the entropy value corresponding to the data access data is access entropy, which is calculated based on different access subjects accessing a single data asset; the entropy value corresponding to the network traffic data is traffic entropy, which is calculated based on a combination of traffic characteristics consisting of source IP address, destination IP address, port number, and data packet size.

5. The security situation assessment method according to claim 4, characterized in that, The process of dynamically adjusting the weights in step S3 includes: S31. Assign initial weights to the entropy values ​​of each dimension, and the sum of the initial weights is 1; S32. Calculate the absolute difference between the entropy values ​​of each dimension in the current period and the previous period as the gradient; S33. Calculate the adjusted weights according to the weight adjustment formula; S34. Normalize the adjusted weights to obtain the final weights used for fusion.

6. The security situation assessment method according to claim 5, characterized in that, The weight adjustment formula is as follows: W x ( t )= W x0 × (1 +α × G x ( t )) ， In the formula, W x0 As the initial weights, G x ( t ) represents the gradient, and α is a predefined weight adjustment coefficient.

7. The security situation assessment method according to claim 6, characterized in that, The formula for calculating the comprehensive risk score in step S3 is as follows: ， In the formula, R ( t The comprehensive risk score is as follows: W x '( t The weights are the normalized weights. H x ( t ) represents the entropy value of each dimension.

8. The security situation assessment method according to claim 7, characterized in that, Step S4 includes: S41. Based on multiple preset risk thresholds, map the comprehensive risk score to discrete security status levels; S42. Construct the initial state transition probability matrix of the Markov chain based on historical safe state data; S43. Determine the number of transfer cycles based on the ratio of the prediction time window to the evaluation period; S44. If the current system is in the [number]th [stage]... i The safety status level is calculated using the transition probability calculation formula, which determines the total probability that the system will transition to a higher risk level within the predicted time window.

9. The security situation assessment method according to claim 8, characterized in that, The probability calculation formula is as follows: ， In the formula, P is the initial state transition probability matrix, and k is the number of transition cycles. From the i Safety status level passed k After the [number]th cycle, it transitions to the [number]th cycle. j The probability of a security status level, Δ t To predict the time window, t For the evaluation period.

10. The security situation assessment method according to claim 9, characterized in that, In step S5, adaptive security response measures are selected based on a combination of the current security status level and the transition probability. The response measures include one or more of the following: routine monitoring, triggering secondary authentication, temporarily restricting data access permissions, initiating dynamic data desensitization, improving network transmission encryption level, and isolating high-risk data sources.

Images