An artificial intelligence-based data security evaluation method and system

Abstract

The present application relates to the technical field of data security evaluation, and specifically includes a data security evaluation method and system based on artificial intelligence, which comprises: obtaining security event information and setting an evaluation feature vector; constructing a security evaluation architecture based on a deep belief network; determining the average absolute error value, and if it is less than the preset error threshold, confirming the correction effectiveness; generating a security evaluation report based on the probability distribution corresponding to the correction effectiveness, and configuring a security protection strategy in combination with different stages. The technical problems of difficulty in effectively processing security event information at different stages in the digital full life cycle, the inability of the security evaluation report to directly guide the configuration of the security protection strategy, and the limitation of the security protection strategy are solved, the consistency of risk evaluation and actual distribution is ensured by combining the average absolute error correction mechanism, the deviation between the evaluation result and the actual risk is effectively reduced, the effectiveness of the security protection strategy is improved, and the technical effect of guaranteeing the data security of the digital full life cycle is achieved.

Description

Technical Field

[0001] This invention relates to the field of data security assessment technology, specifically to a data security assessment method and system based on artificial intelligence. Background Technology

[0002] The entire data lifecycle encompasses multiple stages, including collection, storage, transmission, and use. Data security assessment, as a crucial step in ensuring data security throughout its entire lifecycle, can promptly identify potential risks, quantify the security situation, and provide a basis for developing targeted protection strategies.

[0003] Current data security assessment methods mostly rely on single feature analysis, which makes it difficult to handle the complex and diverse security event information throughout the entire digital lifecycle. This results in a large discrepancy between the assessment results and the actual risk distribution. In addition, the assessment reports cannot directly guide the configuration of security protection strategies at different stages, causing a lag in risk response and failing to meet the refined needs of data security protection throughout the entire lifecycle.

[0004] In summary, existing technologies suffer from several technical problems: they struggle to effectively process security incident information at different stages of the digital lifecycle; security assessment reports cannot directly guide the configuration of security protection strategies; and the security protection strategies themselves are limited. Summary of the Invention

[0005] This application provides an artificial intelligence-based data security assessment method and system, aiming to solve the technical problems in the prior art, such as the difficulty in effectively processing security event information at different stages of the digital lifecycle, the inability of security assessment reports to directly guide the configuration of security protection strategies, and the insufficient limitations of security protection strategies.

[0006] In view of the above problems, the technical solution to achieve the present application is as follows:

[0007] In a first aspect, this application provides an artificial intelligence-based data security assessment method, comprising: acquiring security event information throughout the entire digital lifecycle; extracting time-series and semantic sequence features through feature processing; setting an assessment feature vector; constructing a security assessment architecture based on a deep belief network: using the assessment feature vector as input layer neurons, constructing a feature mapping relationship through a multi-layer Restricted Boltzmann Machine (RBM), wherein the first layer RBM performs a nonlinear transformation on the time-series features, and the second layer RBM processes the cross-correlation between the semantic sequence features and the time-series features; determining the average absolute error value relative to the actual risk distribution, and confirming the correction as effective when the average absolute error value is less than a preset error threshold; generating a security assessment report based on the probability distribution corresponding to various data security risk levels with effective correction, and configuring security protection strategies in conjunction with different stages of the digital lifecycle.

[0008] Preferably, the output layer uses the softmax activation function to output the data security risk level; the deep belief network is pre-trained using a historical security event dataset, and the network parameters are optimized by a contrastive divergence algorithm so that the prediction accuracy of the security assessment architecture on the validation set corresponding to the data security risk level meets the preset accuracy threshold.

[0009] Preferably, the probability adjustment coefficient is determined by the path rules of the decision tree, and the corresponding probability value is adjusted proportionally according to the feature contribution. After correction, the sum of the adjusted probability values ​​corresponding to the data security risk status under each data security risk level remains 1. The average absolute error value with respect to the actual risk distribution is determined by the validation set.

[0010] Preferably, when the mean absolute error value is not less than a preset error threshold, the feature selection and path rules of one or more corresponding decision trees are back-analyzed, and the probability adjustment coefficients are re-optimized; based on the probability distributions corresponding to various data security risk levels that have been effectively corrected, a security assessment report containing confidence intervals, key risk causes, and risk evolution trends for various data security risk levels is generated.

[0011] Preferably, based on the security assessment architecture, multiple decision trees are generated, and the information gain ratio is used as the feature splitting criterion. Key features that are highly correlated with probability deviation in the assessment feature vector are selected as the splitting basis. Among them, error correction is performed on the probability distribution corresponding to various data security risk levels output by the deep belief network for each decision tree.

[0012] Preferably, each decision tree uses the cross-entropy loss between the probability distribution output by the deep belief network and the actual risk label as the target value; simultaneously, the target value is minimized by gradient descent, and the splitting threshold and path weight of the corresponding decision tree are iteratively optimized.

[0013] Preferably, in the data acquisition phase corresponding to the entire digital lifecycle, a role-based access control policy is configured based on the access subject's permission characteristics and historical abnormal access records in the evaluation feature vector. A multi-factor authentication mechanism is set for sensitive data acquisition, while limiting the acquisition frequency and data volume limit for a single subject. In the data storage phase corresponding to the entire digital lifecycle, static data is encrypted and stored based on the storage medium vulnerability characteristics and encryption strength indicators in the vulnerability scan results of the security event information. An off-site disaster recovery backup scheme is configured, and the backup frequency is positively correlated with the data update frequency.

[0014] Preferably, during the data transmission phase, based on the risk distribution of transmission periods in the time series characteristics and the transmission protocol vulnerability information in the semantic sequence characteristics, an encrypted transmission protocol is enabled to perform fragmented encryption and digital signature on the transmitted data packets, and a transmission timeout retransmission mechanism and real-time blocking rules for abnormal transmission behavior are set; during the data usage phase, based on the prediction of risk evolution trends and the analysis of key risk causes, a data desensitization processing mechanism is deployed to mask sensitive fields in unnecessary scenarios.

[0015] Preferably, the security event information includes access logs, abnormal behavior records, vulnerability scan results, and encryption strength indicators. Encryption algorithm complexity and key rotation frequency features are extracted from the encryption strength indicators and quantified into an encryption security coefficient. This encryption security coefficient serves as a correction factor for the probability adjustment coefficient, adjusting the risk probability as needed. The encryption strength indicator measures the security protection strength during data transmission and data storage. Simultaneously, the data transmission link status is cross-verified with the IP address location in the access logs to identify cross-regional abnormal transmission behavior, serving as a supplement to the abnormal behavior records.

[0016] In a second aspect, this application provides an artificial intelligence-based data security assessment system, comprising: a feature processing module for acquiring security event information throughout the entire digital lifecycle, extracting time-series and semantic-series features, and setting an assessment feature vector; a feature mapping module for constructing a security assessment architecture based on a deep belief network, using the assessment feature vector as input layer neurons and constructing a feature mapping relationship through multiple layers of restricted Boltzmann machines, wherein the first layer of the restricted Boltzmann machine performs a nonlinear transformation on the time-series features, and the second layer of the restricted Boltzmann machine processes the cross-correlation between the semantic-series features and the time-series features; a preset error threshold comparison module for determining the average absolute error value compared with the actual risk distribution, and confirming the correction as effective when the average absolute error value is less than a preset error threshold; and a security protection strategy configuration module for generating a security assessment report based on the probability distribution corresponding to various data security risk levels with effective correction, and configuring security protection strategies in conjunction with different stages of the entire digital lifecycle.

[0017] In summary, one or more technical solutions provided in this application achieve the technical effect of using multilayer restricted Boltzmann machines based on deep belief networks to perform feature nonlinear transformation and feature cross-correlation mapping, combined with the mean absolute error correction mechanism to ensure the consistency between risk assessment and actual distribution, accurately assess the deep fusion and risk level of security event features, effectively reduce the deviation between assessment results and actual risks, improve the effectiveness of security protection strategies, and ensure data security throughout the entire digital lifecycle. Attached Figure Description

[0018] Figure 1 This application provides a flowchart illustrating a data security assessment method based on artificial intelligence.

[0019] Figure 2 This application provides a schematic diagram of the structure of a data security assessment system based on artificial intelligence.

[0020] Figure labeling: Feature processing module M100, feature mapping module M200, preset error threshold comparison module M300, security protection strategy configuration module M400. Detailed Implementation

[0021] Example 1: The present application will be described in detail below with reference to the accompanying drawings, as follows... Figure 1 As shown, this application provides a data security assessment method based on artificial intelligence, wherein the method includes:

[0022] S1: Obtain security event information throughout the entire digital lifecycle, extract time-series and semantic-series features through feature processing, and set evaluation feature vectors; S2: Construct a security evaluation architecture based on deep belief networks: use the evaluation feature vectors as input layer neurons, and construct feature mapping relationships through multi-layer restricted Boltzmann machines, wherein the first layer of restricted Boltzmann machine performs nonlinear transformation on the time-series features, and the second layer of restricted Boltzmann machine processes the cross-correlation between the semantic-series features and the time-series features.

[0023] Specifically, security event information throughout the entire digital lifecycle refers to various security-related event information generated during the entire lifecycle of data, from generation, storage, transmission, use to destruction, such as access logs, abnormal behavior records, and vulnerability scan results. Feature processing extracts time-series and semantic-sequence features. This involves analyzing and processing this security event information to extract features with temporal order (time-series features) and features containing semantic information (semantic-sequence features). For example, time-series features could be the time point and frequency of a security event, while semantic-sequence features could be keywords or behavior types in the event description. These extracted features are then combined into an evaluation feature vector, which serves as input to the subsequent deep belief network model.

[0024] Deep belief networks (DBNs) are used to learn high-level feature representations of data. The Restricted Boltzmann Machine (RBM) is the fundamental building block in DBNs; it is an unsupervised learning algorithm capable of learning the distributional characteristics of data. Constructing feature mapping relationships through multiple layers of RBMs means using these layers to map the input evaluation feature vectors to a higher-level feature space, thereby better capturing complex patterns and relationships within the data.

[0025] S3: Determine the average absolute error value between the actual risk distribution and the actual risk distribution. When the average absolute error value is less than the preset error threshold, confirm that the correction is effective. S4: Based on the probability distribution of various data security risk levels corresponding to the effective correction, generate a security assessment report and configure security protection strategies in combination with different stages of the digital life cycle.

[0026] Specifically, the mean absolute error (MAE) is a statistical indicator that measures the difference between predicted and actual values. It is calculated by summing the absolute values ​​of the differences between predicted and actual values ​​and then dividing by the sample size. It is used to assess the difference between the data security risk level predicted by the deep belief network model and the actual risk distribution. When this error value is less than a preset error threshold, it indicates that the deviation between the model's prediction and the actual situation is within an acceptable range. At this point, the correction is confirmed to be effective, meaning that the model, after correction, can reflect the actual risk distribution more accurately.

[0027] The probability distribution corresponding to data security risk levels refers to the probability of each risk level occurring as predicted by the model. For example, the probability of a data security event being low-risk is 0.7, medium-risk is 0.2, and high-risk is 0.1. Based on these probability distributions, a security assessment report is generated. The report includes a comprehensive assessment of data security risks, such as the distribution of risk levels and key risk triggers. Furthermore, according to different stages of the digital lifecycle, such as data collection, storage, transmission, and usage, corresponding security protection strategies are configured to address potential security risks at different stages.

[0028] Furthermore, by constructing feature mapping relationships through multi-layered restricted Boltzmann mechanisms, the method of this application includes:

[0029] The output layer uses the softmax activation function to output the data security risk level; the deep belief network is pre-trained using a historical security event dataset, and the network parameters are optimized by a contrastive divergence algorithm so that the prediction accuracy of the security assessment architecture on the validation set for the data security risk level meets the preset accuracy threshold.

[0030] Specifically, the Softmax activation function is commonly used in multi-class classification problems. It transforms the input feature vector into an output in the form of a probability distribution. In data security risk assessment, the Softmax activation function maps the output of the deep belief network to a probability distribution for each risk level, such as the probabilities of low, medium, and high risk. This probability distribution output more intuitively reflects the likelihood of each risk level, facilitating subsequent security assessment and decision-making.

[0031] Pre-training refers to the initial training of a deep belief network using a historical security event dataset before training the network itself. This allows the network to learn the basic characteristics and patterns of the data. The historical security event dataset contains past security events and their corresponding risk level labels, which are used to initialize the network's weights and parameters. The contrastive divergence algorithm is a training algorithm used to optimize Restricted Boltzmann Machines (RBMs). It optimizes network parameters by minimizing the difference between the model distribution and the data distribution. After optimizing the network parameters using the contrastive divergence algorithm, the network's prediction accuracy for the data security risk levels on the validation set can reach a preset accuracy threshold, thus ensuring that the model's performance meets the requirements of practical applications.

[0032] Furthermore, to determine the average absolute error value between the actual risk distribution and the target risk distribution, the method of this application includes:

[0033] The probability adjustment coefficient is determined by the path rules of the decision tree, and the corresponding probability value is adjusted proportionally according to the feature contribution. After correction, the sum of the adjusted probability values ​​corresponding to the data security risk status under each data security risk level remains 1. The average absolute error value with respect to the actual risk distribution is determined by the validation set.

[0034] Specifically, the path rules of a decision tree refer to the rules followed by the path from the root node to the leaf node. These rules are based on the splitting conditions of the features. The path rules of a decision tree are used to determine the probability adjustment coefficients, that is, to adjust the probability values ​​output by the deep belief network according to the contribution of the features. Feature contribution refers to the importance of each feature to the final classification result in the decision tree, and can usually be measured by metrics such as information gain, gain ratio, or Gini impurity.

[0035] Proportional adjustment of probability values ​​based on feature contribution refers to adjusting the probability values ​​output by the deep belief network according to the contribution of each feature. For example, if a feature has a higher contribution, its impact on the probability value adjustment will be greater. The adjusted probability values ​​must meet one condition: the sum of the adjusted probability values ​​corresponding to the data security risk states under each data security risk level after correction must remain 1, meaning the adjusted probability distribution is still an effective probability distribution, and the sum of all probability values ​​is 1. The mean absolute error (MAE) is an indicator that measures the difference between predicted and actual values. It is calculated by summing the absolute values ​​of the differences between predicted and actual values ​​and dividing by the sample size. The MAE is determined using a validation set to evaluate the model's correction effectiveness.

[0036] Furthermore, when the mean absolute error value is less than a preset error threshold, the correction is confirmed to be effective. The method of this application also includes:

[0037] When the mean absolute error value is not less than the preset error threshold, the feature selection and path rules of one or more decision trees corresponding to the back-analysis are analyzed, and the probability adjustment coefficient is re-optimized; based on the probability distribution corresponding to various data security risk levels that have been effectively corrected, a security assessment report containing the confidence intervals of various data security risk levels, key risk causes and risk evolution trends is generated.

[0038] Specifically, backtracking analysis refers to the reverse examination and analysis of the model's decision-making process during model calibration when the calibration results fail to meet expectations (i.e., the mean absolute error is not less than a preset error threshold). The object of backtracking analysis is the feature selection and path rules of one or more corresponding decision trees, that is, checking which features in the decision tree are selected as split nodes and whether the path rules for these features are reasonable. Through backtracking analysis, the reasons for calibration failure can be found, such as the contribution of certain features being overestimated or underestimated, or the path rules being set inappropriately.

[0039] Re-optimizing the probability adjustment coefficient refers to readjusting the probability adjustment coefficient based on the results of backtracking analysis. This includes recalculating feature contribution, adjusting feature weights, or modifying path rules to achieve more accurate predictions in the next correction. A confidence interval is a statistical method for quantifying the uncertainty of a prediction, representing the probability that the predicted value might fall within a certain range. In data security risk assessment, a confidence interval can provide an estimate of the credibility of a risk level prediction. For example, if the probability of predicting a medium risk level is 0.3, a confidence interval of [0.25, 0.35] indicates a high confidence that the actual probability is between 25% and 35%. Key risk triggers refer to the main factors leading to data security risks. These factors can be identified by analyzing features in security incident information. For example, frequent abnormal access behavior and unencrypted sensitive data transmission may be key risk triggers. Risk evolution trend refers to the trend of risk change over time. Analyzing historical data can predict the future direction of risk changes. For example, if the frequency of exploitation of a system vulnerability gradually increases, it indicates that the risk evolution trend of that vulnerability is upward.

[0040] Furthermore, by optimizing network parameters through a comparative divergence algorithm, the method of this application also includes:

[0041] Based on the security assessment architecture, multiple decision trees are generated. The information gain ratio is used as the feature splitting criterion, and key features that are highly correlated with probability deviation in the assessment feature vector are selected as the splitting basis. Among them, error correction is performed on the probability distribution corresponding to various data security risk levels output by the deep belief network for each decision tree.

[0042] Specifically, information gain ratio is a metric used for feature selection in decision trees. It is the ratio of information gain to the intrinsic value of a feature (i.e., the splitting information content of the feature). Information gain ratio measures the effectiveness and relevance of a feature in a classification task, while avoiding the problem of excessively high information gain due to too many feature values. As a feature splitting criterion, information gain ratio is used to select key features highly correlated with probability bias from the evaluation feature vector as the basis for splitting. These key features can better reflect the distribution characteristics of data security risk levels, thereby improving the classification performance of the decision tree.

[0043] Error correction refers to adjusting the probability distribution output by the deep belief network to reduce the deviation between the predicted and actual values. Each decision tree performs error correction on the probability distribution of various data security risk levels output by the deep belief network. In this way, the decision tree can refine and adjust the probability distribution based on key features, thereby improving the accuracy of the overall assessment.

[0044] Furthermore, the method of this application includes:

[0045] Each decision tree uses the cross-entropy loss between the probability distribution output by the deep belief network and the actual risk label as its target value; simultaneously, the target value is minimized using gradient descent, and the splitting threshold and path weights of the corresponding decision tree are iteratively optimized.

[0046] Specifically, cross-entropy loss is used as a loss function for classification problems to measure the difference between the probability distribution output by the model and the actual label distribution. The goal of each decision tree is to minimize the cross-entropy loss between the probability distribution output by the deep belief network and the actual risk labels. The smaller the cross-entropy loss, the closer the model's prediction is to reality. Gradient descent is used to minimize the objective function (such as cross-entropy loss) by iteratively adjusting the model parameters. Furthermore, in the optimization process of the decision tree, gradient descent is used to adjust the split threshold and path weights of the decision tree. The split threshold determines the split point of the feature in the decision tree, while the path weights determine the contribution of the path from the root node to the leaf node to the final prediction result.

[0047] Furthermore, by configuring security protection strategies at different stages of the digital lifecycle, the method in this application includes:

[0048] During the data acquisition phase corresponding to the entire digital lifecycle, a role-based access control policy is configured based on the access subject's permission characteristics and historical abnormal access records in the evaluation feature vector. A multi-factor authentication mechanism is set for sensitive data acquisition, while limiting the acquisition frequency and data volume limit for a single subject. During the data storage phase corresponding to the entire digital lifecycle, static data is encrypted and stored based on the storage medium vulnerability characteristics and encryption strength indicators in the vulnerability scan results of the security event information. An off-site disaster recovery backup scheme is configured, and the backup frequency is positively correlated with the data update frequency.

[0049] Specifically, the digital lifecycle refers to the entire process of data from generation, collection, storage, processing, transmission, use to destruction, with particular focus on security protection strategy configuration during the data collection and data storage phases. Evaluation feature vectors are vectors obtained by extracting features from security event information throughout the digital lifecycle, including access subject permission characteristics, historical abnormal access records, vulnerability scan results, encryption strength indicators, and other information. These features guide the configuration of security protection strategies. Role-based access control (RBAC) is a common access control method that assigns access permissions based on user responsibilities or roles. During the data collection phase, RBAC policies are configured based on the access subject's permission characteristics and historical abnormal access records to restrict access to sensitive data.

[0050] Multi-factor authentication is a security-enhancing authentication method that requires users to provide two or more authentication factors, such as passwords, fingerprints, and SMS verification codes. When collecting sensitive data, setting up a multi-factor authentication mechanism can effectively prevent unauthorized access. Storage media vulnerability characteristics refer to potential security vulnerabilities or weaknesses in storage devices, such as inadequate hard drive encryption mechanisms or software vulnerabilities in the storage system. Based on these characteristics, encrypting static data can effectively prevent data leakage. Encryption strength metrics are used to measure the security of data encryption, such as the complexity of the encryption algorithm and key length. Based on the encryption strength metrics, configuring off-site disaster recovery backup solutions ensures rapid data recovery in the event of failures or attacks.

[0051] Furthermore, the method of this application includes:

[0052] During the data transmission phase, based on the risk distribution of transmission periods in the time series characteristics and the transmission protocol vulnerability information in the semantic sequence characteristics, an encrypted transmission protocol is enabled to perform fragmented encryption and digital signature on the transmitted data packets, and a transmission timeout retransmission mechanism and real-time blocking rules for abnormal transmission behavior are set. During the data usage phase, based on the prediction of risk evolution trends and the analysis of key risk causes, a data desensitization processing mechanism is deployed to mask sensitive fields in unnecessary scenarios.

[0053] Specifically, the data transmission phase refers to the process of transferring data from one system or device to another. During this phase, the data faces risks such as data leakage, tampering, and transmission interruption. To address these risks, a security protection strategy based on time series characteristics and semantic sequence characteristics is proposed. The risk distribution of transmission periods in the time series characteristics refers to the risk level of data transmission in different time periods. For example, transmission at night or on holidays may face higher risks because monitoring and maintenance may be weaker during these periods. The transmission protocol vulnerability information in the semantic sequence characteristics refers to vulnerability information related to the data transmission protocol. For example, some protocols may have known security vulnerabilities that attackers may exploit to steal or tamper with data.

[0054] Encrypted transmission protocols are technologies that ensure data is not stolen or tampered with during transmission, such as using SSL / TLS protocols; fragmented encryption refers to dividing data into multiple fragments and encrypting each fragment individually, so that even if an attacker intercepts part of the data, they cannot recover the complete data content. At the same time, digital signatures are used to verify the integrity and origin of the data, ensuring that the data has not been tampered with during transmission; transmission timeout retransmission mechanism means that if a data packet does not reach its destination within a specified time during data transmission, the data packet is automatically retransmitted to ensure reliable data transmission.

[0055] Real-time blocking rules for abnormal transmission behavior refer to immediately interrupting transmission when abnormal transmission behavior is detected (such as abnormal duplication of data packets, abnormal transmission speed, etc.) to prevent potential security threats. During the data usage phase, data is accessed and processed by users or systems. To protect data security, risk evolution trend prediction and key risk factor analysis are proposed. These analyses identify risk factors that may lead to data leakage or misuse. Data desensitization mechanisms refer to processing sensitive data so that it cannot be directly identified or used in non-essential scenarios. For example, masking can be used to replace parts of sensitive fields with random characters or asterisks.

[0056] Furthermore, the method of this application includes:

[0057] The security event information includes access logs, abnormal behavior records, vulnerability scan results, and encryption strength indicators. Encryption algorithm complexity and key rotation frequency features are extracted from the encryption strength indicators and quantified into an encryption security coefficient. This encryption security coefficient serves as a correction factor for the probability adjustment coefficient, adjusting the risk probability as needed. The encryption strength indicator measures the security protection strength during data transmission and data storage. Simultaneously, the data transmission link status is cross-verified with the IP address location in the access logs to identify cross-regional abnormal transmission behavior, serving as a supplement to the abnormal behavior records.

[0058] Specifically, security incident information refers to various security-related information generated throughout the entire data lifecycle, including access logs, abnormal behavior records, vulnerability scan results, and encryption strength indicators. This information serves as the foundational data source for assessing data security risks.

[0059] Encryption strength metrics are used to measure the security of data encryption, including features such as encryption algorithm complexity and key rotation frequency. Encryption algorithm complexity refers to the strength of the encryption algorithm; for example, AES-256 is more complex than AES-128 and therefore more secure. Key rotation frequency refers to how frequently the encryption key is changed; a higher key rotation frequency reduces the risk of the key being compromised.

[0060] The encryption security coefficient is an indicator derived by quantifying the complexity of the encryption algorithm and the frequency of key rotation, used to evaluate the security of encryption measures. This coefficient can serve as a correction factor for the probability adjustment coefficient, allowing for a floating adjustment of the risk probability. For example, a higher encryption security coefficient indicates stronger encryption measures, and the risk probability can be appropriately reduced.

[0061] Data transmission link status refers to the current state of the link during data transmission, including network latency and packet loss rate. Cross-validating the data transmission link status with the IP address geolocation in the access logs can identify abnormal cross-regional transmission behavior. For example, if the geolocation of an IP address does not match the expected geolocation of the data transmission, it may indicate abnormal behavior.

[0062] In summary, the beneficial effects of the embodiments of this application are:

[0063] This application provides an artificial intelligence-based data security assessment method and system. It utilizes a multi-layered restricted Boltzmann machine (RBM) based on deep belief networks to acquire security event information throughout the digital lifecycle. Feature processing extracts time-series and semantic-series features, and an evaluation feature vector is set. A security assessment architecture based on deep belief networks is constructed: the evaluation feature vector is used as an input layer neuron, and a feature mapping relationship is built through a multi-layered restricted Boltzmann machine. The first layer of the restricted Boltzmann machine performs a nonlinear transformation on the time-series features, and the second layer of the restricted Boltzmann machine processes the cross-correlation between the semantic-series features and the time-series features. The average absolute error (ASE) value is determined, and when the ASE value is less than a preset error threshold, the correction is confirmed to be effective. Based on the probability distribution corresponding to various data security risk levels with effective correction, a security assessment report is generated, and security protection strategies are configured according to different stages of the digital lifecycle.

[0064] Example 2, based on the same inventive concept as the artificial intelligence-based data security assessment method in the foregoing examples, such as... Figure 2 As shown in the figure, this application provides a data security assessment system based on artificial intelligence, wherein the system includes:

[0065] Feature processing module M100: Acquires security event information throughout the entire digital lifecycle, extracts time series features and semantic sequence features, and sets evaluation feature vectors.

[0066] Feature Mapping Module M200: Constructs a security evaluation architecture based on deep belief networks: The evaluation feature vector is used as an input layer neuron, and a feature mapping relationship is constructed through a multi-layer restricted Boltzmann machine. The first layer of the restricted Boltzmann machine performs a nonlinear transformation on the time series features, and the second layer of the restricted Boltzmann machine processes the cross-correlation between the semantic sequence features and the time series features.

[0067] Preset error threshold comparison module M300: Determines the average absolute error value with respect to the actual risk distribution. When the average absolute error value is less than the preset error threshold, the correction is confirmed to be effective.

[0068] Security protection strategy configuration module M400: Based on the probability distribution corresponding to various data security risk levels that have been calibrated and are effective, it generates a security assessment report and configures security protection strategies in combination with different stages of the digital life cycle.

[0069] Furthermore, the feature mapping module M200 is used to perform the following method:

[0070] The output layer uses the softmax activation function to output the data security risk level; the deep belief network is pre-trained using a historical security event dataset, and the network parameters are optimized by a contrastive divergence algorithm so that the prediction accuracy of the security assessment architecture on the validation set for the data security risk level meets the preset accuracy threshold.

[0071] Furthermore, the preset error threshold comparison module M300 is used to perform the following method:

[0072] The probability adjustment coefficient is determined by the path rules of the decision tree, and the corresponding probability value is adjusted proportionally according to the feature contribution. After correction, the sum of the adjusted probability values ​​corresponding to the data security risk status under each data security risk level remains 1. The average absolute error value with respect to the actual risk distribution is determined by the validation set.

[0073] Furthermore, the preset error threshold comparison module M300 is also used to perform the following method:

[0074] When the mean absolute error value is not less than the preset error threshold, the feature selection and path rules of one or more decision trees corresponding to the back-analysis are analyzed, and the probability adjustment coefficient is re-optimized; based on the probability distribution corresponding to various data security risk levels that have been effectively corrected, a security assessment report containing the confidence intervals of various data security risk levels, key risk causes and risk evolution trends is generated.

[0075] Furthermore, the feature mapping module M200 is also used to perform the following method:

[0076] Based on the security assessment architecture, multiple decision trees are generated. The information gain ratio is used as the feature splitting criterion, and key features that are highly correlated with probability deviation in the assessment feature vector are selected as the splitting basis. Among them, error correction is performed on the probability distribution corresponding to various data security risk levels output by the deep belief network for each decision tree.

[0077] Furthermore, the feature mapping module M200 is also used to perform the following method:

[0078] Each decision tree uses the cross-entropy loss between the probability distribution output by the deep belief network and the actual risk label as its target value; simultaneously, the target value is minimized using gradient descent, and the splitting threshold and path weights of the corresponding decision tree are iteratively optimized.

[0079] Furthermore, the security protection strategy configuration module M400 is used to perform the following methods:

[0080] During the data acquisition phase corresponding to the entire digital lifecycle, a role-based access control policy is configured based on the access subject's permission characteristics and historical abnormal access records in the evaluation feature vector. A multi-factor authentication mechanism is set for sensitive data acquisition, while limiting the acquisition frequency and data volume limit for a single subject. During the data storage phase corresponding to the entire digital lifecycle, static data is encrypted and stored based on the storage medium vulnerability characteristics and encryption strength indicators in the vulnerability scan results of the security event information. An off-site disaster recovery backup scheme is configured, and the backup frequency is positively correlated with the data update frequency.

[0081] Furthermore, the security protection strategy configuration module M400 is also used to perform the following methods:

[0082] During the data transmission phase, based on the risk distribution of transmission periods in the time series characteristics and the transmission protocol vulnerability information in the semantic sequence characteristics, an encrypted transmission protocol is enabled to perform fragmented encryption and digital signature on the transmitted data packets, and a transmission timeout retransmission mechanism and real-time blocking rules for abnormal transmission behavior are set. During the data usage phase, based on the prediction of risk evolution trends and the analysis of key risk causes, a data desensitization processing mechanism is deployed to mask sensitive fields in unnecessary scenarios.

[0083] Furthermore, the security protection strategy configuration module M400 is also used to perform the following methods:

[0084] The security event information includes access logs, abnormal behavior records, vulnerability scan results, and encryption strength indicators. Encryption algorithm complexity and key rotation frequency features are extracted from the encryption strength indicators and quantified into an encryption security coefficient. This encryption security coefficient serves as a correction factor for the probability adjustment coefficient, adjusting the risk probability as needed. The encryption strength indicator measures the security protection strength during data transmission and data storage. Simultaneously, the data transmission link status is cross-verified with the IP address location in the access logs to identify cross-regional abnormal transmission behavior, serving as a supplement to the abnormal behavior records.

[0085] In summary, any step can be stored as a computer instruction or program in an unrestricted computer memory and can be called and recognized by an unrestricted computer processor; no further restrictions are imposed here.

[0086] Furthermore, the above technical solutions only embody the preferred technical solutions of the embodiments of this application. Any changes that those skilled in the art may make to certain parts of these solutions embody the novel principles of the embodiments of this application. Obviously, those skilled in the art can make various modifications and variations to this application without departing from the scope of this application.

Claims

1. A data security assessment method based on artificial intelligence, characterized in that, The method includes: Acquire security event information throughout the entire digital lifecycle, extract time-series and semantic sequence features through feature processing, and set evaluation feature vectors; A security assessment architecture based on deep belief networks is constructed: the assessment feature vector is used as the input layer neuron, and a feature mapping relationship is constructed through a multi-layer restricted Boltzmann machine. The first layer of the restricted Boltzmann machine performs a nonlinear transformation on the time series features, and the second layer of the restricted Boltzmann machine processes the cross-correlation between the semantic sequence features and the time series features. Determine the average absolute error value between the actual risk distribution and the target risk distribution. When the average absolute error value is less than a preset error threshold, confirm that the correction is effective. The method includes: The probability adjustment coefficient is determined by the path rules of the decision tree, and the corresponding probability value is adjusted proportionally according to the feature contribution. After correction, the sum of the adjusted probability values ​​corresponding to the data security risk status under each data security risk level remains 1. The mean absolute error between the validation set and the actual risk distribution is determined. When the mean absolute error value is not less than the preset error threshold, back-analyze the feature selection and path rules of one or more corresponding decision trees, and re-optimize the probability adjustment coefficient; Based on the probability distributions corresponding to various data security risk levels that have been effectively corrected, a security assessment report is generated that includes confidence intervals for various data security risk levels, key risk triggers, and risk evolution trends. Based on the probability distribution corresponding to various data security risk levels that have been calibrated and effectively controlled, a security assessment report is generated, and security protection strategies are configured in combination with different stages of the digital lifecycle.

2. The data security assessment method based on artificial intelligence as described in claim 1, characterized in that, The method further includes constructing feature mapping relationships through multi-layer restricted Boltzmann mechanisms: The output layer uses the softmax activation function to output the data security risk level; The deep belief network is pre-trained using a historical security event dataset, and the network parameters are optimized using a contrastive divergence algorithm so that the prediction accuracy of the security assessment architecture on the validation set corresponding to the data security risk level meets the preset accuracy threshold.

3. The data security assessment method based on artificial intelligence as described in claim 1, characterized in that, The method further includes optimizing network parameters using a comparative divergence algorithm: Based on the security assessment architecture, multiple decision trees are generated. The information gain ratio is used as the feature splitting criterion, and key features that are highly correlated with probability deviation in the assessment feature vector are selected as the splitting basis. Specifically, error correction is performed on the probability distribution corresponding to various data security risk levels output by the deep belief network for each decision tree.

4. The data security assessment method based on artificial intelligence as described in claim 3, characterized in that, The method includes: Each decision tree uses the cross-entropy loss between the probability distribution output by the deep belief network and the actual risk label as the target value. Simultaneously, the target value is minimized using gradient descent, and the splitting threshold and path weights of the corresponding decision tree are iteratively optimized.

5. The data security assessment method based on artificial intelligence as described in claim 1, characterized in that, The method involves configuring security protection strategies at different stages of the digital lifecycle, including: During the data collection phase corresponding to the entire digital lifecycle, based on the access subject's permission characteristics and historical abnormal access records in the evaluation feature vector, a role-based access control policy is configured, a multi-factor authentication mechanism is set for sensitive data collection, and the collection frequency and data volume limit for a single subject are restricted. During the data storage stage corresponding to the entire digital lifecycle, static data is encrypted and stored based on the vulnerability characteristics of the storage medium and the encryption strength index in the vulnerability scan results of the security event information. An off-site disaster recovery backup scheme is configured, and the backup frequency is positively correlated with the data update frequency.

6. The data security assessment method based on artificial intelligence as described in claim 5, characterized in that, The method includes: During the data transmission phase, based on the risk distribution of transmission periods in the time series features and the transmission protocol vulnerability information in the semantic sequence features, an encrypted transmission protocol is enabled to perform fragmented encryption and digital signature on the transmitted data packets, and a transmission timeout retransmission mechanism and real-time blocking rules for abnormal transmission behavior are set. During the data usage phase, based on the prediction of risk evolution trends and the analysis of key risk causes, a data desensitization mechanism is deployed to mask sensitive fields in non-essential scenarios.

7. The data security assessment method based on artificial intelligence as described in claim 6, characterized in that, The security incident information includes access logs, abnormal behavior records, vulnerability scan results, and encryption strength indicators. The encryption algorithm complexity and key rotation frequency features are extracted from the encryption strength index and quantified into an encryption security coefficient. The encryption security coefficient is used as a correction factor for the probability adjustment coefficient to adjust the risk probability. The encryption strength index is used to measure the security protection strength in the data transmission stage and the data storage stage. At the same time, the data transmission link status is cross-validated with the IP address location in the access log to identify abnormal cross-regional transmission behavior as a supplement to the abnormal behavior record.

8. A data security assessment system based on artificial intelligence, characterized in that, The system is used to implement the data security assessment method based on artificial intelligence as described in any one of claims 1-7, wherein the system comprises: Feature processing module: Acquires security event information throughout the entire digital lifecycle, extracts time series features and semantic sequence features, and sets evaluation feature vectors; Feature mapping module: Constructing a security evaluation architecture based on deep belief networks: The evaluation feature vector is used as an input layer neuron, and a feature mapping relationship is constructed through a multi-layer restricted Boltzmann machine. The first layer of restricted Boltzmann machine performs a nonlinear transformation on the time series features, and the second layer of restricted Boltzmann machine processes the cross-correlation between the semantic sequence features and the time series features. Preset error threshold comparison module: Determines the average absolute error value with the actual risk distribution; when the average absolute error value is less than the preset error threshold, the correction is confirmed to be effective. Security protection strategy configuration module: Based on the probability distribution corresponding to various data security risk levels that have been calibrated and are effective, it generates a security assessment report and configures security protection strategies in combination with different stages of the digital life cycle; Furthermore, the preset error threshold comparison module is used to perform the following method: The probability adjustment coefficient is determined by the path rules of the decision tree, and the corresponding probability value is adjusted proportionally according to the feature contribution. After correction, the sum of the adjusted probability values ​​corresponding to the data security risk status under each data security risk level remains 1. The average absolute error value with respect to the actual risk distribution is determined by the validation set. When the mean absolute error value is not less than the preset error threshold, the feature selection and path rules of one or more decision trees corresponding to the back-analysis are analyzed, and the probability adjustment coefficient is re-optimized; based on the probability distribution corresponding to various data security risk levels that have been effectively corrected, a security assessment report containing the confidence intervals of various data security risk levels, key risk causes and risk evolution trends is generated.

Images