A quantitative risk assessment method and system based on real-time information flow analysis

Abstract

The present application relates to the technical field of network security, and provides a quantitative risk assessment method and system based on real-time information flow analysis. A dynamic information flow analysis algorithm is constructed by an information flow graph model, potential threats are found by using statistical anomaly detection, and finally mixed quantitative risk assessment calculation is performed by fusing time sequence attenuation analysis and multi-factor weighted scoring. Thus, static and passive security detection is changed into a dynamic, active and adaptive security risk assessment system, which provides support for improving the agility and effectiveness of security defense.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, and more specifically, to a quantitative risk assessment method and system based on real-time information flow analysis. Background Technology

[0002] Security risk assessment is a crucial step in responding to cyberattacks. The comprehensiveness, dynamism, and quantifiability of risk assessments are essential for maintaining the continuous security of systems. With the rapid development and deep integration of technologies such as cloud computing, big data, the Internet of Things, and mobile internet, the structure of modern information systems is becoming increasingly complex, distributed, and dynamic. Against this backdrop, the scope of cyberattacks has expanded dramatically, and attack methods have become more covert, complex, and persistent, posing a severe challenge to the risk assessment component of existing cybersecurity defense systems.

[0003] As cyberattacks become increasingly covert and complex, the limitations of traditional risk assessment methods are becoming more apparent. For example, traditional firewalls and intrusion detection / prevention technologies, based on predefined rules and signature databases, perform access control and abnormal traffic detection at network boundaries. However, because they only focus on local and partial information, they cannot understand and assess the security status from the perspective of the entire system's information flow, easily overlooking the traces left by attackers in a complete attack chain. At the same time, most existing risk assessment reports are based on periodic detection reports and rely on manual analysis. Due to the long execution cycle from detection to report generation and low dynamic flexibility, security response is delayed, creating a huge security window. Furthermore, traditional security assessment quantification standards are based on a single attack behavior, lacking time-series risk decay analysis and weighted factor analysis that incorporate information flow. This results in rigid security quantification indicators that cannot be dynamically and adaptively adjusted according to real-time risk status, business context, and user behavior, making risk assessment systems exceptionally vulnerable to new types of attacks.

[0004] To address the aforementioned issues, existing technologies urgently need improvement. Summary of the Invention

[0005] The purpose of this application is to provide a quantitative risk assessment method and system based on real-time information flow analysis, which can deeply integrate information flow analysis for real-time risk assessment. It aims to transform static and passive security detection into a dynamic, proactive, and adaptive security risk assessment system, thereby providing support for improving the agility and effectiveness of security defense.

[0006] Firstly, this application provides a quantitative risk assessment method based on real-time information flow analysis, applied to a network system, including:

[0007] Real-time monitoring and collection of information flow events in the network system, marking the security attributes of objects in the information flow events, and generating monitoring data;

[0008] A directed graph model is constructed and dynamically updated based on the monitoring data; wherein, the vertices of the directed graph model represent the monitored objects, and the directed edges represent the information flow between the objects; the weights of the directed edges are used to quantify the intensity of the information flow.

[0009] Based on the information flow paths formed between objects in the directed graph model and the security attributes of the object markers, a compliance check is performed on the information flow paths.

[0010] In response to the compliance of the information flow path, behavioral features are extracted from the directed graph model and compared with a normal behavior baseline established based on historical data, thereby identifying abnormal behavioral events that deviate from the baseline.

[0011] The event risk value corresponding to the abnormal behavior event is calculated according to the multi-factor weighted scoring model, and the event risk value is dynamically adjusted according to the preset time-series decay model to generate a comprehensive risk score; the event risk level is determined according to the comprehensive risk score.

[0012] Furthermore, the security attributes include security level, department, and data classification; the method also includes: unifying the information flow event format of the monitoring data into a triplet format containing source object, operation type, and target object.

[0013] Furthermore, the step of constructing and dynamically updating a directed graph model based on the monitoring data includes:

[0014] The source object and target object of the information flow event are created as corresponding vertices in the system, and each vertex is assigned a set of attributes; the attributes include a unique identifier and a security attribute identifier;

[0015] For each information flow event, a directed edge is created in the directed graph model from the source object vertex to the target object vertex, and an initial weight is assigned to each directed edge.

[0016] Furthermore, the step of constructing and dynamically updating a directed graph model based on the monitoring data also includes updating the weights of the directed edges using an exponentially weighted moving average method; the update formula is:

[0017] Among them, W new (e) represents the updated weight of directed edge e; W current_event The instantaneous weight calculated for the current information flow event; W old (e) represents the weight of the directed edge e before the update; α is the smoothing factor, and 0 < α ≤ 1.

[0018] Furthermore, the behavioral characteristics include node characteristics, path characteristics, structural characteristics, and information flow temporal characteristics.

[0019] Furthermore, the event risk value corresponding to the abnormal behavior event is calculated according to the multi-factor weighted scoring model, including: determining the event risk value based on the severity score of the abnormal behavior event, the business value score of the object affected by the abnormal behavior event, the probability score of the actual attack of the abnormal behavior event, and the exploitability score of the vulnerability of the abnormal behavior event.

[0020] Furthermore, the dynamic adjustment of the event risk value includes:

[0021] The event type of the abnormal behavior event is determined, and a basic attenuation coefficient is determined based on the event type; the event type includes at least persistent, latent, explosive, and transient types;

[0022] Based on the severity score of the abnormal behavior event, the value score of the involved asset, and the current security context information score, the basic attenuation coefficient is dynamically adjusted to calculate the adaptive attenuation coefficient of the event.

[0023] Determine the current lifecycle stage of the abnormal behavior event and the corresponding decay function for that lifecycle stage; calculate the decay of the event risk value based on the decay function and the adaptive decay coefficient, and determine the adjusted event risk value.

[0024] Furthermore, the generation of the comprehensive risk score includes: determining the sum of the adjusted event risk values ​​corresponding to all abnormal behavior events of the network system within a preset time period as the comprehensive risk score;

[0025] Determining the event risk level based on the comprehensive risk score includes: applying an S-shaped function to map the comprehensive risk score to a preset event risk level.

[0026] Secondly, this application also proposes a quantitative risk assessment system based on real-time information flow analysis, including:

[0027] The data acquisition module is used to monitor and collect information flow events in the network system in real time, mark the security attributes of objects in the information flow events, and generate monitoring data.

[0028] An information flow graph construction module is used to construct and dynamically update a directed graph model based on the monitoring data; wherein, the vertices of the directed graph model represent the monitored objects, and the directed edges represent the information flow between the objects; the weights of the directed edges are used to quantify the intensity of the information flow.

[0029] The path compliance check module is used to perform compliance checks on the information flow path based on the information flow path formed between objects in the directed graph model and the security attributes of the object markers.

[0030] The abnormal behavior detection module is used to extract behavioral features from the directed graph model in response to the compliance of the information flow path, and compare them with the normal behavior baseline established based on historical data, thereby identifying abnormal behavior events that deviate from the baseline.

[0031] The risk assessment module is used to calculate the event risk value corresponding to the abnormal behavior event according to the multi-factor weighted scoring model, and dynamically adjust the event risk value according to the preset time-series decay model to generate a comprehensive risk score; and determine the event risk level based on the comprehensive risk score.

[0032] Thirdly, this application also proposes an electronic device comprising: one or more processors, and a memory for storing one or more computer programs; the computer programs are configured to be executed by the one or more processors, the programs including steps for performing the quantitative risk assessment method based on real-time information flow analysis as described in the first aspect.

[0033] As described above, the quantitative risk assessment method and system based on real-time information flow analysis provided in this application constructs a dynamic information flow graph model, mapping discrete multi-layered security events as vertices and edges in the graph, thus achieving a global and interconnected perception of network security risks. This model can connect cross-layer attack chains, forming complete attack paths and providing a unified visual view, significantly improving the efficiency of analyzing complex and covert attacks. Secondly, through an automated data processing pipeline and real-time updates of the dynamic graph, the system achieves real-time and automated risk assessment, transforming security assessment from a static snapshot to dynamic continuous monitoring, and supporting instant linkage with control devices, greatly shortening response time. Finally, a hybrid quantitative model combining multi-factor weighted scoring and adaptive temporal decay analysis is proposed. This model introduces a decay coefficient that dynamically adjusts with event type, severity, asset value, and attack context, and employs a segmented decay mechanism to distinguish different stages of risk evolution, making the risk assessment results more accurate, dynamic, and adaptive, truly reflecting the real-time changes in the system's security status, and improving the agility and effectiveness of security defense. Attached Figure Description

[0034] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0035] Figure 1 This is a flowchart illustrating the steps of the quantitative risk assessment method based on real-time information flow analysis disclosed in the embodiments of the present invention.

[0036] Figure 2 This is a flowchart of the quantitative risk assessment method based on real-time information flow analysis disclosed in the embodiments of the present invention;

[0037] Figure 3 This is a schematic diagram of the structure of a quantitative risk assessment system based on real-time information flow analysis disclosed in an embodiment of the present invention;

[0038] Figure 4 This is an operation flowchart of the quantitative risk assessment system based on real-time information flow analysis disclosed in the embodiments of the present invention. Detailed Implementation

[0039] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which these embodiments belong; the terminology used herein and in the specification of the application is for the purpose of describing particular embodiments only and is not intended to limit these embodiments; the terms "comprising" and "having," and any variations thereof, in the specification of these embodiments and the foregoing drawings, are intended to cover non-exclusive inclusion. The terms "first," "second," etc., in the specification of these embodiments and the foregoing drawings are used to distinguish different objects, not to describe a particular order.

[0040] The implementation details of the technical solution in this embodiment are described below:

[0041] In today's complex and ever-changing cyberattack environment, enterprise information systems face increasingly severe security challenges. Traditional static cybersecurity risk assessment systems struggle to translate real-time insights into effective quantitative assessment actions. Existing security risk assessment mechanisms suffer from the following limitations:

[0042] 1. Lack of global information flow analysis. Traditional risk assessment systems typically consist of various heterogeneous security devices, such as firewalls, intrusion detection systems, and endpoint detection and response platforms. These devices only monitor and analyze at their own isolated levels (such as the network layer, host layer, and application layer), lacking unified information flow modeling and correlation analysis capabilities. This prevents security management from understanding the full picture of an attack activity from a system-wide perspective. For example, a successful APT attack may begin with a phishing email (endpoint security), then involve lateral movement (network traffic analysis), and finally steal core data (database access logs). Existing isolated analysis models easily overlook these weak signals that should be related, treating them as independent low-risk events, thus failing to form a complete understanding of the attack chain. Security policies generated and deployed accordingly are inevitably localized and one-sided, unable to implement global and coordinated defenses throughout the data lifecycle.

[0043] 2. Delayed Risk Response. Current security assessment methods rely on a workflow of "periodic detection + behavioral analysis." This periodic detection model, due to its fixed action time, long processing time, and lack of dynamic flexibility, creates a significant "security window." During this period, attackers can gain a foothold within the system and achieve their attack objectives. This severe lag in security risk assessment results in the loss of the optimal opportunity to immediately contain and eliminate threats during the attack phase.

[0044] 3. Rigid Risk Quantification. Traditional risk quantification indicators are set based on risk assessments and business forecasts at the initial stage of system deployment, such as risk assessment based on attack actions (e.g., access behavior). However, in a network environment where internal user behavior and external threats are constantly changing, static quantification indicators cannot comprehensively analyze the risk level of a single action based on changes in information flow. They generally suffer from incomplete perception, insufficient security quantification, and low flexibility in adjustment, making risk assessment unable to serve as a dynamic and schedulable resource to support real-time security goals.

[0045] This embodiment proposes a quantitative risk assessment method based on real-time information flow analysis, applied to a network system, such as... Figure 1 As shown, the method includes:

[0046] S101, Real-time monitoring and collection of information flow events in the network system, marking the security attributes of objects in the information flow events, and generating monitoring data.

[0047] Furthermore, the security attributes include security level, department, and data classification; the method also includes: unifying the information flow event format of the monitoring data into a triplet format containing source object, operation type, and target object.

[0048] Specifically, in this embodiment, the first step is data sampling, which involves real-time monitoring and acquisition of information flow events within the network system. Data sampling is a preprocessing step in this embodiment, performed by a collector deployed in the network device. It primarily enables real-time monitoring of source data such as system calls, process changes, and traffic variations, providing raw data support for subsequent security risk assessments. Specifically, it includes the following sub-steps:

[0049] 1. Source data acquisition: Each collector monitors the flow of information events in the network system in real time, such as traffic changes, access behavior, process creation, and network connection, based on its own monitoring functions, and then classifies and packages the acquired information.

[0050] 2. Object Attribute Tagging: Utilizing its built-in lightweight tagging program, the system tags security attributes for each object (such as users, processes, files, and network nodes), forming an object attribute tagging library. Attributes include security level, department, data category, etc.

[0051] 3. Format standardization processing: After the object attributes are marked, the format conversion program accesses the tag library and uniformly processes the data format after security marking into the information triplet format (i.e., source object, operation type, target object), while recording behavior logs such as data volume, operation result, and timestamp.

[0052] S102, construct and dynamically update a directed graph model based on the monitoring data; wherein, the vertices of the directed graph model represent the monitored objects, and the directed edges represent the information flow between the objects; the weights of the directed edges are used to quantify the intensity of the information flow.

[0053] Furthermore, the step of constructing and dynamically updating a directed graph model based on the monitoring data includes: creating the source object and target object of the information flow event as corresponding vertices in the system, and assigning a set of attributes to each vertex; the attributes include a unique identifier and a security attribute identifier; for each information flow event, creating a directed edge in the directed graph model from the source object vertex to the target object vertex, and assigning an initial weight to each directed edge.

[0054] Specifically, in this embodiment, the information flow graph construction aims to build a dynamic, global directed graph model, namely the information flow graph, from the collected and standardized information flow data, thereby formally representing a panoramic view of the information flow in the system.

[0055] The process begins with constructing the original flow model. A graph model is used to aggregate continuous, discrete information flow events into a static, global system snapshot. First, vertices are created and attributes are assigned. The source and target objects in the information flow tripartite are created as corresponding vertices in the system. Each vertex V is assigned a set of attributes and stored in the vertex attribute set A(v), including unique identifiers and security attribute identifiers. Next, edges are created and their weights initialized. Each directed edge E in the graph model represents a channel through which information flows from the source object vi to the target object vj. For each successfully recorded information flow event, the system creates a directed edge from the source object vertex to the target object vertex in the graph, and each edge E is assigned an initial weight W. init The weights are calculated based on the operation type and source data, aiming to quantify the strength and risk level of the information flow. For example, for data read / send operations, the weight W is W0. init The weights are quantized using (e) = log(1 + data volume). For the same pair of objects performing the same operation multiple times within a time window, the weights are accumulative: W(e) = Σ W_init(e). Finally, based on the vertices and edges of the information flow graph, a directed graph G = (V, E, W) is constructed, where: V is the set of vertices, representing all monitored objects in the system; E is the set of directed edges, representing the information flow between objects; and W is the edge weight, representing the intensity of the information flow, calculated by the flow rate or operation frequency per unit time.

[0056] Furthermore, after the initial graph model is constructed, the system enters a continuously running dynamic update phase to ensure that the graph model remains consistent with the real-time system state. The system continuously monitors and acquires new information stream events from the data acquisition layer. For each newly arriving event, the following operations are performed:

[0057] (a) Vertex Management: Check whether the source and target objects in the event already exist in the graph. If they do not exist, create them dynamically and assign them attributes.

[0058] (b) Edge Management: Check if the corresponding edge E exists. If it exists, adjust its weight according to the weight update function; if it does not exist, create a new edge and initialize its weight. The weight of the directed edge is updated using an exponentially weighted moving average method, and the update formula is:

[0059] Among them, W new (e) represents the updated weight of directed edge e; W current_event The instantaneous weight calculated for the current information flow event; W old (e) represents the weight of directed edge e before the update; α is the smoothing factor, and 0 < α ≤ 1. The larger the value of α, the faster the graph model responds to new events.

[0060] (c) Data Lifecycle Management: The system implements a sliding window mechanism. All edges in the graph are scanned periodically (e.g., every minute). For edges that have not been triggered by new events for a long period (e.g., more than 24 hours), their weights are gradually reduced using a decay function. When the weight falls below a certain threshold, the edge is removed from the graph. Conversely, if a vertex is no longer connected to any edge, that vertex is also removed.

[0061] S103, Based on the information flow path formed between objects in the directed graph model and the security attributes of the object markers, perform a compliance check on the information flow path.

[0062] Specifically, in this embodiment, the compliance check step aims to perform in-depth analysis of the constructed information flow graph to identify potential risk paths. It includes the following sub-steps:

[0063] 1. Path Query: Uses graph query algorithms to find information flow paths between specific objects. For example, query all possible paths from "suspected compromised host" to "core database".

[0064] 2. Compliance Check: Multi-level security flow detection is achieved through lattice security theory. Each security object is stored in a security lattice L, where the security level of each object is determined based on the object security attribute labeling in step 1.2. The security flow strategy requires that information can only flow from a lower security level to a higher security level or flow at the same level. The function ρ = (v i , v j Assign security levels to objects for each information flow (v) i , v j ), will check whether its security attributes satisfy ρ(v i ) ≤ ρ(v j If the conditions are not met, the information flow is considered irregular and recorded as an abnormal event.

[0065] S104, in response to the compliance of the information flow path, extract behavioral features from the directed graph model and compare them with the normal behavior baseline established based on historical data, thereby identifying abnormal behavioral events that deviate from the baseline.

[0066] Furthermore, the behavioral characteristics include node characteristics, path characteristics, structural characteristics, and information flow temporal characteristics.

[0067] Specifically, in this embodiment, this abnormal behavior event step aims to identify abnormal behaviors that deviate from the normal baseline based on a dynamic information flow graph using a statistical detection algorithm, and specifically includes the following sub-steps:

[0068] 1. Feature Extraction: First, features are extracted from the information flow graph, including graph features such as nodes, paths and structures, as well as temporal features of the information flow (such as traffic).

[0069] 2. Establish a baseline: Use historical data to establish a baseline for normal behavior, including the normal range and distribution of each feature.

[0070] 3. Behavioral comparison: The current graph features and time series features are compared with the baseline to filter and record abnormal nodes, paths and traffic.

[0071] S105, calculate the event risk value corresponding to the abnormal behavior event according to the multi-factor weighted scoring model, and dynamically adjust the event risk value according to the preset time-series decay model to generate a comprehensive risk score; determine the event risk level according to the comprehensive risk score.

[0072] Furthermore, the event risk value corresponding to the abnormal behavior event is calculated according to the multi-factor weighted scoring model, including: determining the event risk value based on the severity score of the abnormal behavior event, the business value score of the object affected by the abnormal behavior event, the probability score of the actual attack of the abnormal behavior event, and the exploitability score of the vulnerability of the abnormal behavior event.

[0073] Furthermore, the dynamic adjustment of the event risk value includes: determining the event type of the abnormal behavior event; determining a basic attenuation coefficient based on the event type; the event type includes at least persistent, latent, explosive, and transient events; dynamically adjusting the basic attenuation coefficient based on the severity score of the abnormal behavior event, the value score of the involved assets, and the current security context information score, and calculating an adaptive attenuation coefficient for the event; determining the current lifecycle stage of the abnormal behavior event and determining the attenuation function corresponding to that lifecycle stage; and calculating the attenuation of the event risk value based on the attenuation function and the adaptive attenuation coefficient to determine the adjusted event risk value.

[0074] Specifically, in this embodiment, the comprehensive risk scoring aims to quantify risk by combining detected anomalies with other contextual information (asset value, threat intelligence, etc.), and specifically includes the following steps:

[0075] 1. Multi-factor weighted scoring: This method uses a quantitative risk calculation model for weighted scoring. The risk value calculation model for an event is expressed as follows:

[0076]

[0077] Where S represents the severity of the event, which is a predefined severity score for each event; V represents the asset value, which represents the business value of the affected object; T represents the threat credibility, which represents the probability that the event is a real attack; and E represents the vulnerability exploitability, which represents the exploitability of the vulnerability.

[0078] Suppose the system has n risk events at time t, then the risk value of each event is R. i Overall risk value R total It can be calculated as follows:

[0079]

[0080] Among them, R i For a single risk value, R total This is the overall risk value.

[0081] 2. Time-series decay analysis: Since the impact of risk events decays over time, a decay factor is introduced to gradually reduce the contribution of past events to the current risk value. Let event i occur at time t. i If the current time is t, then the exponential decay model is:

[0082]

[0083] Where λ is the decay coefficient. To dynamically adjust the relationship between risk and time, this embodiment proposes an adaptive decay model based on the above exponential decay model. Its decay coefficient λ is not a fixed constant, but a dynamically adjusted function of event type, severity, asset value, and contextual factors. This model can more accurately reflect the change of risk over time. The model includes the following sub-steps:

[0084] 2.1 Establishing Event Types: This embodiment first divides events into four categories (types can be expanded): c i ∈ {persistent, latent, explosive, transient}, and assign a basic decay coefficient λ to each type. base (c i The details are shown in the table below:

[0085] Table 1 Mapping Table of Basic Attenuation Coefficients for Event Types

[0086]

[0087] Then, based on the event type, query the table above to obtain the basic attenuation coefficient λ. base .

[0088] 2.2 Introduction of Multi-Factor Adjustment: After the basic attenuation coefficient is determined, it is dynamically adjusted by introducing multiple factors. The calculation formula is as follows:

[0089] λ adaptive (e i ,t) = λ base (c i ) * f S (S i ) * f V (V i ) * f C (C i ,t);

[0090] Where, λ base (c i ) is the basic attenuation coefficient; f S (S i ) is the severity adjustment factor; f V (V i ) is the asset value adjustment factor; f C (C i ,t) is the context adjustment factor. Its specific calculation formula is as follows:

[0091] f S (S i ) = 1 - k S * S i , where k S To adjust the coefficient, k S ∈ [0,1);

[0092] f V (V i ) = 1 – k V * V i , where k V To adjust the coefficient, k V ∈ [0,1);

[0093] f C (C i , t) = 1 - [w1* g(phase) + w2* score ti + w3* A(t)], where w1, w2, w3 are weights, g(phase) is the attack phase mapping function, and score ti Threat intelligence credibility, where A(t) represents the activity level of related activities.

[0094] Through dynamic calculation, the attenuation coefficient can be correlated with the severity of risk, asset value, and attack stage in the following ways:

[0095] High severity => slow decay => small λ => therefore f S It should be small;

[0096] High asset value => slow decay => small λ => f V It should be small;

[0097] Later attack phase => slower decay => smaller λ => f C It should be small.

[0098] 2.3 Attenuation Piecewise Calculation: After the attenuation coefficient is adjusted, this embodiment uses a piecewise function to calculate the current risk value R. i (t i The calculation of the exponential decay model is as follows: First, the event cycle is divided into three phases: latency, activity, and decay. Let the latency period be T1, the activity period be T2-T1, and the decay period begin at T2. Then, different decay coefficients λ1, λ2, and λ3 are assigned to each phase, where λ1 < λ2 < λ3 (i.e., the latency period has the slowest decay, and the decay period has the fastest decay). The improved exponential decay model is then:

[0099]

[0100] ;

[0101] ;

[0102] Wherein, λ1, λ2, and λ3 are the adaptive decay coefficients for each stage; T1, T2, and T3 are the time periods for each life cycle; λ1, λ2, and λ3 can be dynamically calculated based on the event type and the aforementioned adjustment factors. This mathematical model extends the traditional simple exponential decay into a highly adaptive and context-aware intelligent decay model, capable of more accurately simulating the dynamic evolution of risk over time in real-world environments.

[0103] Furthermore, generating a comprehensive risk score includes: determining the sum of adjusted event risk values ​​corresponding to all abnormal behavior events of the network system within a preset time period as a comprehensive risk score; determining the event risk level based on the comprehensive risk score includes: applying an S-shaped function to map the comprehensive risk score to a preset event risk level.

[0104] Specifically, in this embodiment, the system smoothly maps the calculated comprehensive risk value Rtotal to a preset risk level (such as low, medium, high, severe) using an S-shaped function, which is expressed as follows:

[0105]

[0106] Here, k controls the steepness of the mapping curve, and Rthreshold is the threshold center for risk level classification. Through this mapping, continuous, numerical risk scores are converted into discrete, easy-to-understand and easy-to-operate risk levels, thereby directly supporting the decision-making and response of security personnel.

[0107] like Figure 2 The diagram shows the flowchart of the quantitative risk assessment method based on real-time information flow analysis in this embodiment. First, a data collector is deployed on network devices (such as servers and cloud platforms) to sample and standardize the data format. Then, an information flow graph model is constructed from the sampled data, including recording data such as access objects, information flow direction, and information flow data volume, as well as calculating the mean and standard deviation, and defining a baseline for normal behavior. Next, the information flow path is queried and its compliance is analyzed. Based on the path's compliance determination, high-risk warnings or abnormal behavior detection are issued. Specifically, path compliance is determined using a behavior detection algorithm to identify abnormal behaviors deviating from the normal baseline and anomaly statistics are performed. Then, a multi-factor weighted scoring model and time-series decay analysis are used to comprehensively score the abnormal behavior. Finally, an S-shaped function is applied to map the comprehensive risk score to the risk level.

[0108] Secondly, this embodiment also proposes a quantitative risk assessment system based on real-time information flow analysis, such as... Figure 3 As shown, it includes:

[0109] Data acquisition module 301 is used to monitor and acquire information flow events in the network system in real time, mark the security attributes of objects in the information flow events, and generate monitoring data;

[0110] The information flow graph construction module 302 is used to construct and dynamically update a directed graph model based on the monitoring data; wherein, the vertices of the directed graph model represent the monitored objects, and the directed edges represent the information flow between the objects; the weight of the directed edges is used to quantify the intensity of the information flow.

[0111] The path compliance check module 303 is used to perform compliance checks on the information flow path based on the information flow path formed between objects in the directed graph model and the security attributes of the object markers.

[0112] The abnormal behavior detection module 304 is used to extract behavioral features from the directed graph model in response to the compliance of the information flow path, and compare them with the normal behavior baseline established based on historical data, thereby identifying abnormal behavior events that deviate from the baseline.

[0113] The risk assessment module 305 is used to calculate the event risk value corresponding to the abnormal behavior event according to the multi-factor weighted scoring model, and dynamically adjust the event risk value according to the preset time-series decay model to generate a comprehensive risk score; and determine the event risk level according to the comprehensive risk score.

[0114] In one embodiment, the data acquisition module 301 is primarily used to perform data acquisition. This module is responsible for collecting information flow events from various devices and nodes in the network in real time. Deployed in network servers, terminal devices, cloud hosts, and network devices, it captures multi-source logs and event data, including system calls, process behaviors, network traffic, file access, and user operations, through a lightweight proxy. The acquisition module also has preliminary data classification capabilities, structuring raw events according to a predefined information flow triad template and adding metadata such as timestamps and device identifiers. Subsequently, it transmits the data to the central processing unit through a secure channel, providing high-quality, standardized data input for subsequent analysis.

[0115] The information flow graph construction module 302 is the core modeling and analysis engine of the system, responsible for dynamically constructing a global directed graph model from the collected and standardized information flow events. The module is implemented based on a graph computing framework, creating corresponding vertices for each information object (such as users, processes, and files) and associating them with security attributes and business tags. Based on the flow relationships in the events, directed edges are established between objects, and initial weights are calculated according to the event type and data volume, quantified using Winit(e) = log(1 + data volume). Finally, based on the vertices and edges of the information flow graph, a directed graph G = (V, E, W) is constructed, where: V is the set of vertices, representing all monitored objects in the system; E is the set of directed edges, representing the information flow between objects; and W is the edge weight, representing the intensity of the information flow. Simultaneously, the module supports real-time dynamic updates, continuously adjusting edge weights using an exponentially weighted moving average algorithm to ensure that the graph representation is consistent with the current system state.

[0116] The path compliance check module 303 focuses on checking the security policy compliance of information flow paths. The module has a built-in graph path query engine that can quickly retrieve all reachable paths between specific objects based on security policy requirements, such as all information flows from a "suspected compromised host" to the "core database." Simultaneously, the module dynamically assigns security level attributes to each object and strictly enforces a mandatory access control policy that "information is only allowed to flow from lower security levels to higher security levels or at the same level." For each detected information flow, the module automatically checks whether the security levels of its source and target objects meet policy constraints. Once a violation is detected, it is immediately marked as a policy anomaly event, and the complete violation path, timestamp, and relevant contextual information are recorded.

[0117] The behavioral anomaly detection module 304 uses statistical algorithms to identify abnormal behaviors that deviate from the normal baseline based on the constructed information flow graph. The module first extracts multi-dimensional features from the graph, including graph structure features (such as node degree, path length, and clustering coefficient) and temporal behavioral features (such as traffic volatility, operation frequency, and time series patterns). Based on historical normal data, the module establishes a behavioral baseline model, defining the reasonable range and distribution pattern of each feature value. In the real-time detection phase, by comparing the current features with the baseline model, the module can accurately filter out abnormal nodes, abnormal paths, and abnormal traffic sequences, and generate structured abnormal event records, providing a basis for subsequent risk assessment.

[0118] The risk assessment module 305 can be divided into a multi-factor weighted scoring module, a time-series decay analysis module, and a risk level mapping module.

[0119] The multi-factor weighted scoring submodule enables quantitative risk assessment of abnormal events, comprehensively determining the risk value of an event through a multi-factor fusion calculation model. The module uses the formula Ri=S×V×T×E for calculation, where: S represents the severity of the event, with a preset score based on the event type and impact; V represents the asset value of the affected object, supporting dynamic adjustment according to business importance; T represents threat credibility, assessed by combining internal behavioral confidence and external threat intelligence; and E represents the exploitability of associated vulnerabilities, assigned a value with reference to standards such as general vulnerability scoring systems. This module supports dynamic configuration and strategy optimization of weighting factors, ensuring that the risk scoring can flexibly adapt to changes in different business scenarios and security postures.

[0120] The time-series decay analysis submodule, in order to characterize the dynamic evolution of risk over time, introduces an exponential decay mechanism to attenuate the impact of historical risk events. The module is based on the formula... The calculation is performed, where λ is an adaptive decay coefficient based on factors such as event severity and asset value, used to control the rate at which the risk value decreases over time; t i Let t be the time the event occurred, and t be the current system time. This model allows the module to "softly forget" historical risk events, preventing earlier or already addressed events from interfering with the assessment of the current risk status. This enhances the dynamic adaptability and timeliness of the entire risk assessment system, more accurately reflecting the system's real-time security level.

[0121] The risk level mapping submodule is responsible for mapping the calculated comprehensive risk value to an intuitive and actionable risk level. This module uses an S-shaped function. Achieving a smooth mapping, where the k parameter controls the steepness of the level transition curve, affecting the sensitivity to risk changes; R thresholdThis module sets the threshold center for risk level classification. The output is typically mapped to four levels: "low," "medium," "high," and "severe," and supports flexible adjustment of the numerical range for each level through configuration. Furthermore, this module provides risk visualization capabilities, generating various forms of situational awareness views such as risk dashboards, heatmaps, and time-series trend charts to assist security personnel in making rapid decisions and coordinating responses.

[0122] This embodiment uses a typical ransomware lateral movement attack detection event as an example to fully demonstrate the implementation process of this system. The system's software program is deployed on one or more high-performance computing servers interconnected via a network. These servers are equipped with multi-core central processing units, large-capacity memory, high-speed solid-state drives, and professional graphics processing units. For example... Figure 4 The diagram shown is an operation flowchart of the quantitative risk assessment system based on real-time information flow analysis in this embodiment. The specific steps are as follows:

[0123] Step 1: Data Acquisition and Standardization. Data Acquisition: The terminal agent deployed on Host_OA and the network switch captures a network connection event initiated by the process ransom.exe to Host_Data:445, while the network traffic probe captures the corresponding TCP SYN packet.

[0124] Standardized processing: The acquisition module performs security marking and format conversion on the source and target objects. For example, the acquisition module marks the source object ransom.exe as a process, with an internal security level and the host Host_OA; and the target object Host_Data:445 as a network service, with a secret security level and the host Host_Data. Subsequently, the module formats the event into a standard triple: { Source object: “Host_OA::ransom.exe”, Operation type: “Network connection attempt”, Target object: “Host_Data::SMB(445)”, Timestamp: t1, Metadata: {Protocol: TCP, Destination port:445}}, and sends it to the central server through an encrypted channel.

[0125] Step 2: Dynamic Information Flow Graph Construction and Update. The information flow graph construction module receives the triplet sent in Step 1, checks if the graph contains vertices Host_OA::ransom.exe and Host_Data::SMB(445), and creates them if they do not exist; then it checks if there is a directed edge e from the source vertex to the target vertex. Since this is the first attempt, a new edge is created; and according to formula W... init(e) = log(1 + 1) ≈ 0.69 (data volume is calculated as "1 connection") Initialize edge weights; finally update the global information flow graph G to record this connection behavior. At this moment, a new edge representing a suspicious lateral movement attempt is added to the information flow graph, and the system obtains a global, visualized attack path starting point.

[0126] Step 3: Data Flow Path Compliance Analysis. The path compliance detection module performs the following operations:

[0127] Path lookup: Based on graph G, the module quickly queries all existing and potential paths from Host_OA to Host_Data.

[0128] Compliance check: The module reads the flag attributes of the vertex Host_OA (security level internal) and Host_Data (security level secret).

[0129] Based on the information flow policy (information is only allowed to flow from low to high or at the same level), this attempt to access from internal to secret was determined to have violated the security policy.

[0130] Finally, a policy violation event is generated, the event severity Spolicy is quantified to 0.9 (range 0-1), and the violation path details are recorded.

[0131] Step 4: Behavioral Anomaly Detection. The behavioral anomaly detection module performs the following operations:

[0132] Feature extraction: The module extracts the recent out-degree connectivity features of the Host_OA node from graph G (such as the number of new external connections in the last hour).

[0133] Baseline establishment: Query historical baselines. Host_OA is the office host. The average number of new external connections per hour over the past week was μ=0.5, and the standard deviation was σ=0.7.

[0134] Behavioral comparison: The current Host_OA initiated a connection to the critical server port 445 within a short period of time, which is a significant deviation from the baseline.

[0135] The final anomaly score was Sanomaly = 0.6, indicating that the event was statistically significant.

[0136] Step 5: Hybrid Quantitative Risk Assessment Calculation. The multi-factor weighted scoring module and the time-series decay analysis module work together to perform the following operations:

[0137] 1. Multi-factor weighted scoring. The multi-factor weighted scoring module performs a comprehensive analysis, mainly by executing the following steps:

[0138] Event severity S: Combining policy violation and statistical anomaly, S = 0.7 * S policy + 0.3 * S anomaly =0.7*0.9 + 0.3*0.6 = 0.81;

[0139] Asset Value V: Query the asset database and define the asset value V. Since Host_Data is the core database server, assign V = 1.0.

[0140] Threat credibility T: Querying the threat intelligence database, the hash value of ransom.exe does not match any known malware, but its lateral movement behavior pattern is highly suspicious, so a value of T = 0.7 is assigned.

[0141] Vulnerability exploitability E: A query of the EASM system reveals a known high-risk vulnerability (CVSS 8.5) in the Host_Data SMB service, with a normalized E = 0.85.

[0142] Finally, calculate the initial risk value: R initial = S × V × T × E = 0.81 * 1.0 * 0.7 * 0.85≈ 0.48.

[0143] 2. Time series decay analysis. The time series decay analysis module performs the following operations:

[0144] Event type determined: This lateral movement behavior is of the burst type (C3). The base decay coefficient λ is obtained from the table. base =0.2.

[0145] Calculate the adaptive attenuation factor: Severity adjustment: f S (0.81) = 1 - 0.3*0.81 ≈ 0.76 (assuming k) S =0.3). Asset value adjustment: f V (1.0) = 1 - 0.2 * 1.0 = 0.80 (assuming k) V =0.2). Context adjustment: Assuming there are no other strongly related activities, threat intelligence is not updated, and the attack is in its early stages, f C ≈ 1.0. λ adaptive = 0.2 * 0.76 * 0.80 * 1.0 ≈ 0.12.

[0146] Risk value decay: Assuming 2 hours have passed since the event (Δt=2), a segmented decay model is adopted (currently in the active period, using λ2=λ). adaptive =0.12): R current(t) = 0.48 * exp(-0.12 * 2) ≈ 0.48 *0.787 ≈ 0.38.

[0147] Step 6: Risk Level Mapping and Visualization. The risk level mapping module performs the following operations: Assuming there are no other active high-risk events in the system at this time, and the current overall risk value R_total ≈ 0.38. Using a sigmoid function mapping, with parameter k=5, R... threshold =0.3, L=4.

[0148] RiskLevel = floor( 4 / (1 + exp(-5*(0.38-0.3))) ) = floor( 4 / (1 +exp(-0.4)) ) ≈ floor( 4 / (1 + 0.67) ) ≈ floor(2.40) = 2.

[0149] Mapping result 2 corresponds to a "high" risk level. On the risk dashboard of the system console, the line connecting Host_OA and Host_Data turns red and a "High Risk: Suspected Lateral Movement" alert pops up. Simultaneously, a risk detection report is automatically uploaded to the network controller via a preset interface. The network controller then issues an instruction to temporarily block all access from Host_OA to the network segment where Host_Data resides, effectively preventing further spread of the attack. An alert ticket is also sent to security personnel.

[0150] This specific embodiment fully demonstrates how the present invention transforms a theoretical model into a practically operable hardware and software system. Through a real attack scenario, it illustrates how the system progresses from risk detection to visualized output, verifying its beneficial effects in solving technical problems such as "fragmented perception, delayed response, and rigid quantification." Those skilled in the art can adjust and implement this embodiment in conjunction with specific network environments.

[0151] Compared with existing technologies, the quantitative risk assessment method and system based on real-time information flow analysis provided by this invention has achieved significant technological progress and brought about many beneficial effects by introducing core technologies such as dynamic information flow graph modeling, context-aware multi-factor fusion scoring, and adaptive time-series decay analysis.

[0152] 1. Enabled global and interconnected perception and assessment of cybersecurity risks.

[0153] This invention constructs a unified dynamic information flow graph model (G=(V,E,W)) to map discrete events at the network, host, application, and data levels as vertices and edges in the graph, thereby establishing an information flow model at the system level. This model can correlate cross-layer attack events; for example, it can link the initial intrusion (terminal event), lateral movement (network event), and data theft (data access event) in an attack into a complete attack path in the information flow graph, overcoming the limitations of traditional devices operating independently. Simultaneously, it provides security analysts with a global, visualized view of the attack landscape, greatly improving the efficiency of understanding and analyzing complex and covert attacks (such as APTs).

[0154] 2. Real-time and automated risk assessment has been achieved.

[0155] This invention transforms the assessment process into a continuous monitoring process through data processing, dynamic graph updates, and a real-time analysis system. From data acquisition and information flow graph updates to risk calculation, the entire process is automated and streamlined, significantly reducing risk response time. Simultaneously, real-time linkage with the controller effectively curbs attack spread. Furthermore, the system operates 24 / 7, using a sliding time window mechanism to ensure that the information flow graph and risk assessment always reflect the latest system status, achieving a fundamental shift from "static snapshot assessment" to "dynamic continuous monitoring."

[0156] 3. It has achieved precise, dynamic, and adaptive risk quantification.

[0157] This invention innovatively proposes a hybrid quantitative model combining "multi-factor weighted scoring" and "adaptive temporal decay analysis." By comprehensively considering the inherent attributes of events (severity, asset value, etc.), the risk value is no longer a simple score based on a single dimension, thereby improving the comprehensiveness and accuracy of risk quantification. Simultaneously, the adaptive decay model proposed in this invention, λadaptive(ei,t) = λbase(ci) × fS(Si) × fV(Vi) × fC(Ci,t), makes the decay coefficient λ no longer a constant. It can dynamically adjust according to the event type, severity, asset value, and real-time attack context, avoiding premature zeroing or persistently inflated risk values ​​caused by fixed decay, thus increasing the adaptability of risk assessment. Finally, this invention further employs a piecewise decay function, classifying risk events into latent, active, and decay periods and assigning different decay rates (λ1<λ2<λ3), more scientifically depicting the natural evolution of risk from generation and development to decline, enabling the risk assessment results to more realistically and dynamically reflect the actual security status of the system.

[0158] Thirdly, this application also proposes an electronic device comprising: one or more processors, and a memory for storing one or more computer programs; the computer programs are configured to be executed by the one or more processors, the programs including steps for performing the quantitative risk assessment method based on real-time information flow analysis as described in the first aspect.

[0159] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A quantitative risk assessment method based on real-time information flow analysis, applied to a network system, characterized in that, include: Real-time monitoring and collection of information flow events in the network system, marking the security attributes of objects in the information flow events, and generating monitoring data; A directed graph model is constructed and dynamically updated based on the monitoring data; wherein, the vertices of the directed graph model represent the monitored objects, and the directed edges represent the information flow between the objects; the weights of the directed edges are used to quantify the intensity of the information flow. Based on the information flow paths formed between objects in the directed graph model and the security attributes of the object markers, a compliance check is performed on the information flow paths. In response to the compliance of the information flow path, behavioral features are extracted from the directed graph model and compared with a normal behavior baseline established based on historical data, thereby identifying abnormal behavioral events that deviate from the baseline. The event risk value corresponding to the abnormal behavior event is calculated according to a multi-factor weighted scoring model, and the event risk value is dynamically adjusted according to a preset time-series decay model to generate a comprehensive risk score; the event risk level is determined based on the comprehensive risk score; wherein, the event risk value... S represents the severity score of the predefined abnormal behavior event; V represents the business value score of the object affected by the abnormal behavior event; T represents the probability score of a real attack by the abnormal behavior event. Assess the exploitability of this vulnerability due to its unusual behavior.

2. The quantitative risk assessment method based on real-time information flow analysis according to claim 1, characterized in that, The security attributes include security level, department, and data classification; the method further includes unifying the information flow event format of the monitoring data into a triplet format containing source object, operation type, and target object.

3. The quantitative risk assessment method based on real-time information flow analysis according to claim 2, characterized in that, The step of constructing and dynamically updating a directed graph model based on the monitoring data includes: The source object and target object of the information flow event are created as corresponding vertices in the system, and each vertex is assigned a set of attributes; the attributes include a unique identifier and a security attribute identifier; For each information flow event, a directed edge is created in the directed graph model from the source object vertex to the target object vertex, and an initial weight is assigned to each directed edge.

4. The quantitative risk assessment method based on real-time information flow analysis according to claim 3, characterized in that, The step of constructing and dynamically updating a directed graph model based on the monitoring data further includes updating the weights of the directed edges using an exponentially weighted moving average method; the update formula is: Among them, W new (e) represents the updated weight of directed edge e; W current_event The instantaneous weight calculated for the current information flow event; W old (e) represents the weight of the directed edge e before the update; α is the smoothing factor, and 0 < α ≤ 1.

5. The quantitative risk assessment method based on real-time information flow analysis according to claim 1, characterized in that, The behavioral characteristics include node characteristics, path characteristics, structural characteristics, and information flow temporal characteristics.

6. The quantitative risk assessment method based on real-time information flow analysis according to claim 1, characterized in that, The step of dynamically adjusting the event risk value according to a preset time-series decay model includes: The event type of the abnormal behavior event is determined, and a basic attenuation coefficient is determined based on the event type; the event type includes at least persistent, latent, explosive, and transient types; Based on the severity score of the abnormal behavior event, the value score of the involved asset, and the current security context information score, the basic attenuation coefficient is dynamically adjusted to calculate the adaptive attenuation coefficient of the event. Determine the current lifecycle stage of the abnormal behavior event and the corresponding decay function for that lifecycle stage; calculate the decay of the event risk value based on the decay function and the adaptive decay coefficient, and determine the adjusted event risk value.

7. The quantitative risk assessment method based on real-time information flow analysis according to claim 6, characterized in that, The process of generating a comprehensive risk score includes: determining the sum of the adjusted event risk values ​​corresponding to all abnormal behavior events of the network system within a preset time period as the comprehensive risk score; Determining the event risk level based on the comprehensive risk score includes: applying an S-shaped function to map the comprehensive risk score to a preset event risk level.

8. A quantitative risk assessment system based on real-time information flow analysis, applied to a network system, characterized in that, include: The data acquisition module is used to monitor and collect information flow events in the network system in real time, mark the security attributes of objects in the information flow events, and generate monitoring data. An information flow graph construction module is used to construct and dynamically update a directed graph model based on the monitoring data; wherein, the vertices of the directed graph model represent the monitored objects, and the directed edges represent the information flow between the objects; the weights of the directed edges are used to quantify the intensity of the information flow. The path compliance check module is used to perform compliance checks on the information flow path based on the information flow path formed between objects in the directed graph model and the security attributes of the object markers. The abnormal behavior detection module is used to extract behavioral features from the directed graph model in response to the compliance of the information flow path, and compare them with the normal behavior baseline established based on historical data, thereby identifying abnormal behavior events that deviate from the baseline. The risk assessment module is used to calculate the event risk value corresponding to the abnormal behavior event based on a multi-factor weighted scoring model, and dynamically adjust the event risk value according to a preset time-series decay model to generate a comprehensive risk score; and determine the event risk level based on the comprehensive risk score; wherein, the event risk value... S represents the severity score of the predefined abnormal behavior event; V represents the business value score of the object affected by the abnormal behavior event; T represents the probability score of a real attack by the abnormal behavior event. Assess the exploitability of this vulnerability due to its unusual behavior.

9. An electronic device, the electronic device comprising: One or more processors, a memory for storing one or more computer programs; characterized in that the computer programs are configured to be executed by the one or more processors, the programs including steps for performing the quantitative risk assessment method based on real-time information flow analysis as described in any one of claims 1-7.

Images