Network security insurance pre-insurance dynamic risk assessment method and system based on PIPDR2 model

Abstract

The invention discloses a dynamic risk assessment method and system before network security insurance protection based on a PIPDR2 model, and the method comprises the steps: building and determining the PIPDR2 model, and enabling the PIPDR2 model to comprise a PIPDR2 risk assessment factor layer and a risk assessment index layer; a security policy factor module, a risk identification factor module, a security defense factor module, a security detection factor module, a security response factor module and a security recovery factor module are configured in the PIPDR2 risk assessment factor layer; in the risk evaluation index layer, corresponding risk evaluation indexes are configured for each evaluation factor module in the PIPDR2 risk evaluation factor layer based on network security level protection evaluation data; on the basis, an analytic hierarchy process (AHP) is adopted to carry out risk quantitative evaluation. According to the scheme, risk quantification, accurate premium pricing and continuous optimization are realized by integrating the equal insurance evaluation data and the AHP, and the collaborative efficiency of insurance products and safety protection is improved.

Description

Technical Field

[0001] This invention relates to the field of cybersecurity insurance technology, specifically to pre-insurance dynamic risk assessment technology for cybersecurity insurance. Background Technology

[0002] The risk assessment models currently used for pre-insurance risk assessment in cybersecurity insurance have the following problems in practical applications:

[0003] 1. Insufficient data support: Domestic insurance companies lack historical data on cybersecurity risks, and traditional actuarial models are unable to quantify the risks of new types of attacks (such as AI-driven ransomware);

[0004] 2. Static nature of models: Existing risk assessment models (such as P2DR and IPDRR) lack dynamic closed-loop mechanisms and cannot respond to technological evolution and threat changes in real time;

[0005] 3. Missing links: Traditional models do not fully incorporate the needs of insurance business (such as premium pricing and liability definition), resulting in poor compatibility between the assessment results and insurance terms;

[0006] 4. Compliance challenges: Cybersecurity Level Protection (Level Protection) assessment data has not been effectively integrated into the insurance assessment system, resulting in low assessment efficiency and serious duplication of investment.

[0007] Therefore, it is evident that addressing the issues of insufficient dynamism, weak data support, and poor model adaptability in existing cybersecurity insurance risk assessments is a pressing problem that needs to be solved in this field. Summary of the Invention

[0008] To address the problems existing in current cybersecurity insurance risk assessment schemes, the present invention aims to provide a dynamic risk assessment scheme based on the PIPDR2 full lifecycle model. This scheme integrates information security level assessment data with the Analytic Hierarchy Process (AHP) to achieve risk quantification, accurate premium pricing, and continuous optimization, thereby improving the synergistic effectiveness of insurance products and security protection.

[0009] To achieve the above objectives, the present invention provides a dynamic risk assessment method for cybersecurity insurance pre-insurance based on the PIPDR2 model. The risk assessment method performs dynamic risk assessment for cybersecurity insurance pre-insurance by constructing and determining the PIPDR2 model.

[0010] The PIPDR2 model includes a PIPDR2 risk assessment factor layer and a risk assessment index layer. The PIPDR2 risk assessment factor layer is configured with a security strategy factor module, a risk identification factor module, a security defense factor module, a security detection factor module, a security response factor module, and a security recovery factor module.

[0011] The security policy factor module is used to evaluate the top-level design and system completeness of enterprise network security management;

[0012] The risk identification factor module is used to discover key enterprise assets, potential threats and vulnerabilities, and to identify risk priorities.

[0013] The security defense factor module is used to evaluate the effectiveness of an enterprise's technical protection measures;

[0014] The security detection factor module is used to evaluate an enterprise's real-time threat monitoring and anomaly detection capabilities.

[0015] The security response factor module is used to evaluate the efficiency of an enterprise's emergency response to security incidents;

[0016] The security recovery factor module is used to assess an enterprise's ability to ensure business continuity after an attack.

[0017] The risk assessment indicator layer is configured with corresponding risk assessment indicators for each assessment factor module in the PIPDR2 risk assessment factor layer based on network security level protection assessment data. The analytic hierarchy process is used to assign weights to each PIPDR2 risk assessment factor in the PIPDR2 risk assessment factor layer, and quantitative assessment is completed in combination with dynamic data collection.

[0018] To achieve the above objectives, this invention provides a dynamic risk assessment system for pre-insurance cybersecurity insurance based on the PIPDR2 model. The risk assessment system constructs a PIPDR2 model, which includes a PIPDR2 risk assessment factor layer and a risk assessment index layer. The PIPDR2 risk assessment factor layer is configured with a security strategy factor module, a risk identification factor module, a security defense factor module, a security detection factor module, a security response factor module, and a security recovery factor module.

[0019] The security policy factor module is used to evaluate the top-level design and system completeness of enterprise network security management;

[0020] The risk identification factor module is used to discover key enterprise assets, potential threats and vulnerabilities, and to identify risk priorities.

[0021] The security defense factor module is used to evaluate the effectiveness of an enterprise's technical protection measures;

[0022] The security detection factor module is used to evaluate an enterprise's real-time threat monitoring and anomaly detection capabilities.

[0023] The security response factor module is used to evaluate the efficiency of an enterprise's emergency response to security incidents;

[0024] The security recovery factor module is used to assess an enterprise's ability to ensure business continuity after an attack.

[0025] The risk assessment indicator layer is configured with corresponding risk assessment indicators for each assessment factor module in the PIPDR2 risk assessment factor layer based on network security level protection assessment data. The analytic hierarchy process is used to assign weights to each PIPDR2 risk assessment factor in the PIPDR2 risk assessment factor layer, and quantitative assessment is completed in combination with dynamic data collection.

[0026] Furthermore, the security strategy factor module is configured to assess the top-level design and system completeness of an enterprise's cybersecurity management by reviewing whether the enterprise has written security management systems, security audit mechanisms, job descriptions, and other relevant documents.

[0027] Furthermore, the risk identification factor module is configured to obtain an asset list using the asset management system, obtain system vulnerability data through vulnerability scanning tools, and analyze external threats in conjunction with a threat intelligence platform.

[0028] Furthermore, the security defense factor module can assess the effectiveness of an enterprise's technical protection measures by checking firewall policy configuration, network boundary isolation, encrypted data transmission, and the deployment of strong identity authentication.

[0029] Furthermore, the security detection factor module is configured to analyze whether there is anomaly detection capability by checking the deployment and alarm logs of the intrusion detection / prevention system and the security information and event management system.

[0030] Furthermore, the safety response factor module is configured to assess the enterprise's emergency response efficiency for safety incidents by reviewing the completeness of the emergency response plan, emergency drill records, and reports on the handling of real safety incidents.

[0031] Furthermore, the security recovery factor module is configured to assess an enterprise's business continuity assurance capabilities after an attack by checking data backup strategies, disaster recovery system construction status, and business recovery plans.

[0032] The present invention provides a dynamic risk assessment solution for cybersecurity insurance based on the PIPDR2 model. By integrating information security level assessment data with the AHP (Analytic Hierarchy Process), it achieves risk quantification, accurate premium pricing, and continuous optimization, thereby improving the synergistic effectiveness of insurance products and security protection.

[0033] Furthermore, the present invention has the following advantages over the prior art:

[0034] (1) Improved assessment efficiency: Reduce pre-insurance assessment time by 80% by utilizing information security data;

[0035] (2) Dynamic adaptability: Through a closed-loop optimization mechanism, the model update cycle is shortened to 3 months;

[0036] (3) Premium accuracy: Risk quantification error is reduced to ±5%, and the rationality of premium pricing is improved by 30%;

[0037] (4) Enhanced enterprise protection: The compliance rate of safety rectification of insured enterprises has increased to 95%. Attached Figure Description

[0038] The present invention will be further described below with reference to the accompanying drawings and specific embodiments.

[0039] Figure 1 This is an architecture diagram of the PIPDR2 model in this invention;

[0040] Figure 2 This is a framework diagram of the pre-insurance dynamic risk assessment system for cybersecurity insurance in this invention;

[0041] Figure 3 This is a diagram of the architecture of the pre-insurance risk assessment model initially determined in this invention example;

[0042] Figure 4 This is an example diagram of the risk assessment item scoring table in an embodiment of the present invention;

[0043] Figure 5 This is an example diagram of the risk level assessment table in an embodiment of the present invention;

[0044] Figure 6 This is an architecture diagram of the optimized risk assessment model in an example of the present invention. Detailed Implementation

[0045] To make the technical means, creative features, objectives and effects of this invention easier to understand, the invention will be further described below with reference to specific illustrations.

[0046] To address the current issues of insufficient dynamism, weak data support, and poor model adaptability in cybersecurity insurance risk assessment, this invention constructs a PIPDR2 (Policy, Identify, Protect, Detect, Respond, Recover) full lifecycle dynamic risk assessment model for cybersecurity insurance. Based on this model, it integrates cybersecurity level protection assessment data with the AHP (Analytic Hierarchy Process) algorithm, thereby achieving cybersecurity insurance risk quantification, accurate premium pricing, and continuous optimization.

[0047] See Figure 1 The diagram shown is an example of the structure of the PIPDR2 cybersecurity insurance dynamic risk assessment model (hereinafter referred to as the PIPDR2 model) provided by this invention.

[0048] Based on the diagram, this PIPDR2 model adopts a two-layer architecture, including the PIPDR2 risk assessment factor layer and the risk assessment indicator layer.

[0049] The PIPDR2 risk assessment factor layer in this PIPDR2 model is configured with corresponding PIPDR2 risk assessment factors, which can be used to calculate and assess the overall safety status of the insured unit from multiple dimensions and to conduct sub-risk assessments.

[0050] The risk assessment indicator layer in this PIPDR2 model works in conjunction with the PIPDR2 risk assessment factor layer. Based on the network security level protection assessment data, it can configure corresponding risk assessment indicators for each assessment factor module in the PIPDR2 risk assessment factor layer, and use the analytic hierarchy process to assign weights to each PIPDR2 risk assessment factor in the PIPDR2 risk assessment factor layer, and complete the quantitative assessment by combining dynamic data collection.

[0051] Specifically, the PIPDR2 risk assessment factor layer is configured with a security strategy factor module, a risk identification factor module, a security defense factor module, a security detection factor module, a security response factor module, and a security recovery factor module.

[0052] The security policy factor module is used to assess the top-level design and system completeness of an enterprise's cybersecurity management.

[0053] Furthermore, this security strategy factor module reviews whether the company has written security management systems, security audit mechanisms, job descriptions, and other relevant documents. For example, scoring can be achieved through document review and interviews.

[0054] The risk identification factor module is used to discover critical enterprise assets, potential threats and vulnerabilities, and to prioritize risks.

[0055] Furthermore, this risk identification factor module can utilize the asset management system to obtain an asset list, acquire system vulnerability data through vulnerability scanning tools (such as Nessus), analyze external threats in conjunction with a threat intelligence platform (such as Microstep Online), and assess asset coverage, vulnerability discovery rate, and threat intelligence matching degree.

[0056] The security defense factor module is used to evaluate the effectiveness of an enterprise's technical protection measures.

[0057] Furthermore, this security defense factor module can check the deployment status of firewall policy configuration, network boundary isolation, data encryption transmission (such as HTTPS enablement rate), and strong authentication (such as two-factor authentication).

[0058] The security detection factor module is used to assess an enterprise's real-time threat monitoring and anomaly detection capabilities.

[0059] Furthermore, this security detection factor module can analyze whether there is anomaly detection capability by checking the deployment and alarm logs of intrusion detection / prevention systems (IDS / IPS) and security information and event management (SIEM) systems; and assess monitoring coverage, alarm accuracy, and log retention duration.

[0060] The safety response factor module is used to evaluate an organization's efficiency in responding to safety incidents.

[0061] Furthermore, the Safety Response Factor module can review the completeness of emergency response plans, emergency drill records, and reports on the handling of real safety incidents (MTTR - Mean Time to Repair) to assess the efficiency of an enterprise's emergency response to safety incidents.

[0062] The Security Recovery Factor module is used to assess an enterprise's ability to ensure business continuity after an attack.

[0063] Furthermore, the security recovery factor module can check data backup strategies (backup cycle, integrity verification), disaster recovery system construction status, and business recovery plans (RTO - recovery time target / RPO - recovery point target); based on this, it conducts assessments through backup and recovery drills and document reviews.

[0064] For the six security strategy factor modules configured in the PIPDR2 risk assessment factor layer—security strategy factor module, risk identification factor module, security defense factor module, security detection factor module, security response factor module, and security recovery factor module—the risk assessment indicator layer in the PIPDR2 model is specifically designed based on the Cybersecurity Classified Protection (CCP 2.0) and the risk control requirements of the insurance industry. Each factor module is configured with specific and measurable assessment indicators, and the Analytic Hierarchy Process (AHP) is used for weight allocation, combined with dynamic data collection to complete the quantitative assessment.

[0065] The following section provides a detailed explanation of the composition of each functional module in this PIPDR2 model and the equipment and devices that may be involved.

[0066] In some embodiments of the present invention, the security policy factor module (Policy) in the PIPDR2 risk assessment factor layer is specifically used to assess the institutionalization and compliance level of enterprise network security management, and reduce systemic risks through a standardized policy system.

[0067] In its specific implementation, this security strategy factor module can use the "security management system" data (such as privacy protection agreements, data storage specifications, etc.) in the information security compliance assessment report to conduct a percentage-based quantitative score on the completeness, update frequency, and implementation effectiveness of the strategy documents through expert review or automated compliance inspection tools. This evaluates whether the company has established a standardized management process covering the entire data lifecycle, and the score results serve as a key basis for insurance underwriting.

[0068] As further explanation, this security strategy factor module integrates data such as the "security management system item" in the information security compliance assessment report, internal enterprise documents (privacy protection agreement, data classification and grading standards), and third-party audit reports (such as ISO 27001 certification results). It then uses NLP technology (such as the BERT model) to automatically parse the enterprise's security strategy documents (such as the "Privacy Protection Agreement") and automatically identify missing key compliance clauses (such as GDPR data cross-border transmission requirements), thereby completing automated compliance checks.

[0069] As a further explanation, this security strategy factor module also constructs a knowledge graph to link laws and regulations (such as the Personal Information Protection Law) with corporate policy provisions, forming a traceable chain of compliance evidence.

[0070] Furthermore, when assessing the security status of the insured entity, this security policy factor module primarily relies on the network security level protection assessment results, combined with the following indicators:

[0071] Compliance: Check whether the privacy policy clearly defines the authorization principles, and whether the storage and transfer of personal information comply with legal requirements;

[0072] System completeness: Assess whether the security management system covers the entire data lifecycle and whether a dedicated management position has been established;

[0073] Cross-border data management: Review whether risk assessments are conducted and reports are retained for cross-border data transfers.

[0074] As further explanation, the security strategy factor module also includes a quantitative evaluation model, which is configured to perform quantitative evaluation based on the following indicators:

[0075] Completeness (weight 40%): Check whether the policy covers the entire data lifecycle (collection, storage, transmission, destruction).

[0076] Timeliness (weight 30%): Policy update frequency (e.g., whether it is revised annually) and version management records.

[0077] Implementation (weight 30%): Verify the implementation of policies through log auditing (such as the consistency between access control policies and actual permission configurations).

[0078] This quantitative evaluation model automatically scores indicators based on predefined rules, while also dynamically adjusting the weights of the indicators.

[0079] As further explanation, the security policy factor module is equipped with a dynamic optimization mechanism that can automatically trigger a review of the policy module and mark weak points when an insurance claim event occurs (such as a violation due to a missing policy). Furthermore, the security policy factor module can also work in conjunction with the Security Operations Center (SOC) to monitor policy execution anomalies in real time (such as data transmission not encrypted according to the policy) and generate optimization suggestions.

[0080] As further explanation, in practical implementation, this security policy factor module can support the unified processing of structured data (such as information security assessment forms) and unstructured data (such as PDF protocol text), and establish the relationship between policy terms, regulations, and actual operations through knowledge graph technology.

[0081] It can automatically identify conflicts between policy terms and the latest regulations (such as the differences between GDPR and the Personal Information Protection Act) by combining rule engines and machine learning, and output compliance gap reports.

[0082] In some embodiments of the present invention, the risk identification factor module (Identify) in the PIPDR2 risk assessment factor layer is designed to systematically discover potential vulnerabilities and threat exposures in enterprise network assets, so as to provide basic data support for risk assessment.

[0083] Specifically, this module is mainly based on the vulnerability scanning results (such as system vulnerabilities detected by Nessus), asset lists (such as CMDB data), and threat intelligence (such as attack logs) in the information security assessment report. It uses a weighted calculation method to derive a risk identification score by quantitatively analyzing indicators such as vulnerability severity (CVSS score), asset criticality level, and historical attack frequency, thereby objectively reflecting the security status of the insured unit in terms of asset vulnerability management.

[0084] Furthermore, when assessing the insured entity, the risk identification factor module (Identify) primarily relies on the results of the graded protection assessment and supplementary inspections, as detailed below:

[0085] Vulnerability management: Assess whether storage devices, databases, etc., have exploitable system vulnerabilities (such as unpatched high-risk vulnerabilities);

[0086] Asset identification: Check whether a complete inventory of personal information assets has been established and is updated regularly;

[0087] Threat analysis: Review historical security incident records and the effectiveness of responses.

[0088] As further explanation, when implementing the risk identification factor module (Identify), data is first collected from three levels: the asset layer, the vulnerability layer, and the threat layer to form a multi-dimensional data system.

[0089] Among them, asset-level data: obtain a list of IT assets such as servers and databases through the CMDB system, and automatically discover unregistered assets by combining network mapping tools (such as Nmap);

[0090] Vulnerability layer data: CVE vulnerability data from integrated vulnerability scanning tools (Nessus / OpenVAS), and the latest threat intelligence obtained by connecting to the National Vulnerability Database (CNNVD);

[0091] Threat layer data: Collect SIEM system alarm logs, EDR endpoint detection records, and external threat intelligence (such as MITRE ATT&CK attack patterns).

[0092] Next, an asset-vulnerability-threat correlation graph is constructed based on the formed multi-dimensional data system;

[0093] Here, the Neo4j graph database is used to build a three-dimensional relationship model, and the single-point risk value (CVSS score × asset value coefficient) is quantitatively calculated. At the same time, a time decay factor is introduced to dynamically adjust the weight of historical vulnerabilities (e.g., the weight of vulnerabilities discovered within 3 months is increased by 30%).

[0094] Based on this, attack path simulation is performed, and the Monte Carlo algorithm is used to predict the most likely combination of vulnerabilities to be exploited.

[0095] As a further explanation, the risk identification factor module (Identify) can provide dynamic visualization output.

[0096] For example, a risk heatmap dashboard can be built to display risk distribution in layers according to business units, automatically generate a list of the top 5 key risks, mark the priority of remediation, and support timeline comparison to track changes in risk trends.

[0097] In some embodiments of the present invention, the Security Defense Factor Module (Protect) in the PIPDR2 Risk Assessment Factor Layer is designed to assess the effectiveness of an enterprise’s technical protection measures in order to verify whether security control measures can effectively defend against potential attacks.

[0098] Specifically, this module, based on the technical protection data (such as firewall configuration, access control policies, and encryption implementation) in the information security assessment report, uses a combination of automated tool scanning (such as port detection and encryption protocol analysis) and manual verification to quantify key indicators such as network boundary protection strength and data encryption coverage, ultimately forming a 100-point defense capability score, providing insurance companies with an objective basis for assessing the level of technical protection.

[0099] Furthermore, when assessing the security defense status of the insured entity, this Security Defense Factor module (Protect) primarily relies on the results of the graded protection assessment, combined with the following key indicators:

[0100] Access control: Check the implementation of identity authentication, access control, and security audit policies (such as protection against unauthorized access);

[0101] Data protection: Assess the level of encryption of personal information (e.g., HTTPS / VPN coverage for transmission encryption) and storage security (e.g., physical environment access control systems);

[0102] Compliance: Review whether the business system follows the principle of minimizing data collection to avoid unauthorized data collection.

[0103] As further explanation, this security defense module (Protect) first constructs a three-layer defense evaluation framework in its implementation:

[0104] Boundary protection layer: Automatically detects the completeness of ACL rules and evaluates the effectiveness of network isolation through firewall policy analysis tools;

[0105] Access Control Layer: Interacts with the IAM system to verify RBAC implementation and check the rationality of privileged account permission allocation;

[0106] Data protection layer: Employs encrypted traffic analysis techniques (such as SSL / TLS decryption) to verify the proportion of encrypted transmission of sensitive data.

[0107] Next, based on the constructed three-layer defense evaluation framework, a red team / blue team exercise verification mechanism was implemented to conduct dynamic defense effectiveness testing, including:

[0108] (1) The automated penetration testing platform periodically simulates ATT&CK TTPs attack chains;

[0109] (2) Real-time recording of key indicators such as the interception rate and average blocking time of the defense system;

[0110] (3) Verify the effectiveness of the defense strategy by combining the results of threat hunting.

[0111] Finally, a quantitative evaluation is conducted using a quantitative evaluation model, primarily assessing the following three aspects:

[0112] Basic configuration (30%): Check the security device policy update time and vulnerability patch coverage;

[0113] Real-world performance (50%): Calculate the defense success rate based on attack and defense drill data;

[0114] Defense in depth (20%): Assess the depth of defense layers (e.g., the ability to coordinate WAF+IPS+EDR).

[0115] In some embodiments of the present invention, the security detection factor module (Detect) in the PIPDR2 risk assessment factor layer is designed to evaluate an enterprise’s real-time threat monitoring and anomaly detection capabilities, thereby verifying the discoverability and timeliness of response to security incidents.

[0116] Specifically, this module, based on security monitoring data (such as SIEM alarm logs and intrusion detection system coverage) in the information security compliance assessment report and actual exercise results (such as penetration test reports), analyzes indicators such as the completeness of monitoring tool deployment, alarm accuracy, and mean time to detection (MTTD). It uses a combination of automated log analysis and manual verification to quantitatively assess the enterprise's security situation awareness capabilities and provide real-time data support for dynamic risk assessment.

[0117] Furthermore, this safety detection module (Detect) primarily assesses insured entities based on the following indicators:

[0118] Monitoring coverage: Check the deployment scope and policy integrity of intrusion detection / prevention systems (IDS / IPS) and situational awareness platforms;

[0119] Anomaly detection capability: Evaluate the system's effectiveness in detecting risks such as cross-domain transmission and unconventional access;

[0120] Log analysis performance: Verify whether the mechanisms for collecting, storing, and analyzing security logs meet audit requirements.

[0121] As further explanation, in its specific implementation, this security detection factor module (Detect) first performs multi-source data collection and analysis to construct a three-layer detection data source:

[0122] Log layer: Aggregates logs from network devices, security devices, and business systems through the SIEM system;

[0123] Traffic layer: Deploy network traffic probes (such as Zeek / Suricata) to extract full traffic metadata;

[0124] Endpoint layer: EDR agent collects 50+ types of terminal behavior data (such as process tree, registry changes, etc.).

[0125] Next, based on the intelligent threat detection engine, multimodal detection is performed, specifically including:

[0126] Rule detection: Matching known threat features based on the Snort / YARA rule base;

[0127] Anomaly detection: Isolation forest algorithm is used to identify behaviors that deviate from the baseline;

[0128] UEBA Analysis: Constructing a baseline model of user / device behavior based on LSTM neural networks;

[0129] Threat Hunting: Uncovering hidden attack chains through graph calculations.

[0130] Finally, dynamic performance evaluation is conducted based on the Testing Quality Index (DQI).

[0131] The testing quality indicators (DQI) here are as follows:

[0132] Detection rate: Detection coverage was verified through injection test attacks;

[0133] Timeliness: Statistics on the time difference between the occurrence of an attack and the alert (MTTD);

[0134] Accuracy: Calculated based on the confusion matrix to determine the false positive / false negative ratio;

[0135] Contextualization: Evaluate the ability to perform event correlation analysis (e.g., linking login anomalies with data breaches).

[0136] In some embodiments of the present invention, the security response factor module (Respond) in the PIPDR2 risk assessment factor layer is designed to assess an enterprise’s emergency response efficiency to security incidents in order to ensure that losses can be quickly contained after an attack occurs.

[0137] Specifically, based on emergency response records (such as incident handling reports and SOC work order data) and practical exercise results (such as red team / blue team response time) provided by the insured, this module objectively evaluates the timeliness of the entire process from incident discovery to handling closed loop by quantitatively analyzing indicators such as average response time (MTTR), emergency plan completeness, and team collaboration efficiency. Combined with log auditing and process traceability, it provides key evidence for insurance companies to measure the potential scale of losses.

[0138] Furthermore, the Respond module primarily assesses insured entities based on the following indicators:

[0139] Response mechanism: Check the completeness and operability of the emergency plan, including incident classification, handling procedures, etc.;

[0140] Response timeliness: Assess the time efficiency from incident discovery to resolution (e.g., cases requiring hourly response).

[0141] Collaboration Capabilities: This assesses cross-departmental collaboration and coordination mechanisms with insurance companies. Scoring is based on simulated attack and defense drills, historical event reviews, and document audits, with a focus on the company's ability to complete emergency responses within the timeframes stipulated in the insurance terms.

[0142] As further explanation, in its specific implementation, this security response factor module (Respond) first constructs a response capability assessment system, establishing a three-level assessment index:

[0143] (1) Infrastructure layer (30% weight): Check the completeness of the emergency plan, the organizational structure of the response team, and the availability of toolchains;

[0144] (2) Process execution layer (40% weight): Verify the effectiveness of event classification and grading, notification process and escalation mechanism through attack and defense drills;

[0145] (3) Practical effectiveness layer (30% weight): Analyze historical security incident handling reports and calculate KPIs such as average response time (MTTR) and secondary incident rate.

[0146] Next, multimodal data was acquired, and four-dimensional data fusion was implemented:

[0147] (1) Process data: Extract fields such as response timestamp, responsible person, and handling action from the SOC work order system;

[0148] (2) Exercise data: Record the response time in the red-blue confrontation (such as the number of minutes from alarm to containment);

[0149] (3) Equipment data: Collect automatic response action logs from the EDR / XDR platform;

[0150] (4) Personnel data: Evaluate team collaboration efficiency through questionnaires (e.g., cross-departmental collaborative scoring).

[0151] Next, based on the aforementioned data, an intelligent response assessment is conducted using a response maturity model:

[0152] Automated scoring: Scoring response elements based on predefined rules (e.g., plan update frequency > quarterly = 5 points);

[0153] Time series analysis: Detecting response efficiency trends (using the ARIMA model to predict improvement potential);

[0154] Root cause reasoning: Locating response bottlenecks using decision tree algorithms (e.g., 80% of delays originate from the approval process).

[0155] In some embodiments of the present invention, the Security Recovery Factor Module (Recover) in the PIPDR2 Risk Assessment Factor Layer is designed to assess an enterprise's business continuity assurance capabilities after an attack. Its core purpose is to verify whether the system and data can be quickly restored to normal operation to reduce losses.

[0156] Specifically, based on disaster recovery drill records (such as RTO / RPO compliance rate), backup effectiveness test reports (such as data recovery success rate), and historical event recovery logs, this module quantifies key indicators such as backup coverage, disaster recovery plan completeness, and actual recovery timeliness. Combined with automated verification tools and manual auditing, it objectively assesses the business resilience level of insured entities, providing quantitative basis for insurance companies to calculate potential business interruption risks.

[0157] Furthermore, the Recovery module primarily assesses insured entities based on three core indicators:

[0158] Disaster recovery system construction: check data backup strategies (such as backup frequency, offline storage) and disaster recovery drill records;

[0159] Recovery timeliness: Assess the achievement of system recovery time objectives (RTO) and recovery point objectives (RPO);

[0160] Improvement mechanisms: Rectification measures and defense upgrade plans after an incident is reviewed.

[0161] As further explanation, this security recovery factor module (Recover) includes the following in its specific implementation:

[0162] First, a recovery capacity assessment system is established, which mainly includes the following components:

[0163] Business continuity metrics: Based on the recovery requirements of Cybersecurity Classified Protection 2.0, quantitatively assess backup coverage (e.g., critical system RPO ≤ 15 minutes) and disaster recovery drill frequency (e.g., one full drill every six months).

[0164] Data recovery verification: Regularly verify the recoverability of backup data using automated testing tools (such as Veeam SureBackup), and record the recovery success rate and time taken.

[0165] Disaster recovery architecture review: Examine the architecture design of multi-active deployment, off-site disaster recovery, etc., and evaluate the degree of automation of failover (e.g., DNS failover time < 5 minutes).

[0166] Next, multi-source data collection and analysis, including the following three aspects:

[0167] Backup logs: Extract data such as backup integrity and encryption status from backup systems (such as Commvault).

[0168] Exercise report: Analyze disaster recovery exercise records, and statistically analyze the RTO (Recovery Time Objective) achievement rate and the number of manual intervention steps.

[0169] Historical event database: Analyzes actual recovery cases over the past 12 months to calculate average recovery time and business impact (e.g., revenue loss per hour).

[0170] Finally, dynamic recovery scoring is performed based on the dynamic recovery scoring model.

[0171] The dynamic recovery scoring model here is configured to perform dynamic weight allocation:

[0172] Backup effectiveness (40%): Data backup frequency and encryption coverage.

[0173] Exercise maturity (30%): scenario coverage, team collaboration efficiency.

[0174] Architecture redundancy (30%): Cross-availability zone deployment and automatic failover capability.

[0175] The dynamic recovery scoring model here is configured to be corrected in real time, dynamically adjusting the score based on actual disaster events (such as ransomware attacks) (e.g., reducing the weight of unverified backup data by 20%).

[0176] In some embodiments of the present invention, this risk assessment index layer is based on the PIPDR2 risk assessment factor layer. It decomposes complex risk assessment problems into multi-level structured indicators through the analytic hierarchy process (AHP) and achieves a scientific transformation from qualitative to quantitative analysis.

[0177] Furthermore, this risk assessment indicator layer is mainly implemented through the following scheme:

[0178] 1. Hierarchical model construction;

[0179] This design employs a three-tiered tree structure: Target layer: The top tier represents the overall risk assessment objective (e.g., the safety risk value R);

[0180] Criterion layer: The middle layer consists of the six modules of PIPDR2 (Policy, Identify, Protect, Detect, Respond, Recover);

[0181] Solution layer: The bottom layer consists of specific evaluation indicators.

[0182] In practical implementation, raw data is extracted from the information security compliance assessment report to construct an indicator correlation matrix. For example, the "Security Defense (Protect)" module is broken down into sub-indicators such as "Access Control" and "Data Encryption." Each sub-indicator is mapped to the technical requirements of Information Security Compliance Compliance 2.0 (such as the Secure Computing Environment clause in GB / T 22239-2019) to ensure the compliance of the assessment basis.

[0183] 2. Judgment matrix and weight calculation;

[0184] To construct the correlation matrix of indicators, a judgment matrix is ​​built using the Analytic Hierarchy Process (AHP) to quantify the weight of each indicator.

[0185] As an example, a judgment matrix is ​​constructed based on expert scores. An automated weight calculation tool is used to automatically generate the matrix and verify its consistency after inputting the expert score table.

[0186] 3. Dynamic weight adjustment mechanism

[0187] To adapt to changes in the security environment, a dynamic weight update logic is designed:

[0188] Real-time feedback: When a certain type of attack occurs frequently (such as ransomware), the threat intelligence platform will automatically trigger adjustments to the weights of relevant indicators (such as increasing the weight of "data backup");

[0189] Strategy iteration: Train a logistic regression model based on insurance company claims data every quarter and optimize weight allocation (such as the impact coefficient of response time on claim amount).

[0190] 4. Risk value calculation and level mapping;

[0191] A risk assessment model is constructed to complete the calculation of risk values ​​and level mapping. By obtaining indicator scores and combining them with a weight library, risk values ​​and visual reports are output in real time.

[0192] As an example, risk assessment models calculate and determine risk values ​​using a weighted summation method:

[0193]

[0194] Indicator Score: The results of the information security assessment are converted into a percentage system (e.g., a "vulnerability repair rate" of 90% will receive 90 points).

[0195] Level classification: preset thresholds (e.g., low risk > 90 points) and linked to insurance terms (e.g., high-risk enterprises are required to make mandatory rectifications).

[0196] As further explanation, the process of calculating the risk value based on this risk assessment indicator layer is as follows:

[0197] (1) Setting evaluation indicators;

[0198] (1.1) Obtaining indicators and classification: Based on the Cybersecurity Classified Protection 2.0 standard: extract the evaluation items corresponding to the six elements of PIPDR2 (Policy, Identify, Protect, Detect, Respond, Recover) from the Basic Requirements for Cybersecurity Classified Protection (GB / T22239-2019).

[0199] For example:

[0200] Security Policy: Corresponds to the "Security Management System" clauses of the Information Security Compliance Standard (such as compliance with privacy protection agreements).

[0201] Security Protection: This corresponds to the "secure computing environment" requirements of the information security level (such as access control and data encryption).

[0202] Supplement industry-specific indicators: Add specific indicators (such as cross-border data transmission risk assessment) based on the needs of different insurance types (such as personal information security insurance).

[0203] (1.2) Quantification of indicators;

[0204] Qualitative indicators: Whether they are met is determined through expert review or compliance inspection (e.g., whether the privacy protection agreement declares authorization and consent), and converted into a percentage score (e.g., meeting = 100 points, partially meeting = 70 points).

[0205] Quantitative indicators: Specific values ​​are measured using technical tools (such as "HTTPS encrypted transmission coverage") and converted into scores proportionally (e.g., coverage ≥ 95% = 100 points, 80% - 94% = 80 points).

[0206] (1.3) Dynamic adjustment of indicators;

[0207] Automated updates: Real-time data acquisition (such as the number of vulnerabilities and the frequency of log alerts) is achieved through API integration with vulnerability scanning tools (such as Nessus) and SIEM systems (such as Splunk).

[0208] Manual intervention: Regularly add new indicators (such as "compliance of facial recognition data storage") based on new regulations (such as the Personal Information Protection Law).

[0209] (2) The evaluation factors and indicators are well matched;

[0210] (2.1) Weight allocation in the Analytic Hierarchy Process (AHP)

[0211] First, construct a judgment matrix: invite cybersecurity experts to compare the importance of each indicator at the same level in pairs to form a judgment matrix.

[0212] Next, the weights are calculated: the weights of each indicator are obtained through the eigenvector method and then passed through a consistency test (CR≤0.1).

[0213] (2.2) Risk value calculation: The total score is obtained by multiplying the score of each indicator by its weight and summing them up through weighted summation.

[0214] First, single-indicator scoring: For example, "Vulnerability Risk Value" = (Number of high-risk vulnerabilities × 1.5 + Number of medium-risk vulnerabilities × 1.0) / Total number of assets.

[0215] Next, weighted aggregation is performed: Total score = Σ(indicator score × weight).

[0216] (2.3) Dynamic correction;

[0217] Here, closed-loop optimization is used: after the protection is completed, the indicator weights are adjusted (e.g., the weight of "response time" is increased) or new indicators (e.g., "supply chain software hash whitelist") are added based on security events (such as ransomware attacks).

[0218] (3) Output of Quantitative Risk Value:

[0219] Risk levels: Low risk (>90 points), Medium risk (60-89 points), High risk (<60 points).

[0220] Improvement suggestions: such as "Vulnerability remediation priority list" and "Disaster recovery drill plan".

[0221] The resulting PIPDR2 model incorporates several key elements. The Policy factor corresponds to the management aspect of Cybersecurity Classified Protection 2.0, emphasizing the establishment and implementation of security management systems and organizations. The Identify factor combines management and technical aspects of Cybersecurity Classified Protection 2.0, covering key areas such as risk assessment, asset identification, and threat management. The Protect, Detect, Respond, and Recover factors correspond to the technical requirements of protection, detection, response, and recovery capabilities in Cybersecurity Classified Protection 2.0, respectively. This PIPDR2 model comprehensively covers all aspects of cybersecurity risk assessment and fully integrates the technical standards and management requirements of Cybersecurity Classified Protection assessment, contributing to accurate cybersecurity risk assessment and providing a scientific basis for insurance pricing and claims decisions.

[0222] As a further explanation, the present invention also introduces an evaluation and optimization mechanism to improve the accuracy of quantitative analysis of cybersecurity risks. This evaluation and optimization mechanism updates risk weights through a "evaluation-optimization-re-evaluation" cycle.

[0223] The PIPDR2-based dynamic risk assessment scheme for pre-insurance cybersecurity insurance, as presented in this invention, can be implemented as a corresponding software program to form a PIPDR2-based dynamic risk assessment system for pre-insurance cybersecurity insurance. When running, this software program executes the aforementioned PIPDR2-based dynamic risk assessment method for pre-insurance cybersecurity insurance and implements the corresponding functions, while storing the results in a suitable storage medium for processor retrieval and execution.

[0224] See Figure 2The resulting cybersecurity insurance pre-insurance dynamic risk assessment system 100 based on the PIPDR2 model is mainly composed of a data input unit 110, a PIPDR2 model 120, a risk quantification assessment unit 130, and an assessment optimization unit 140 working together.

[0225] The data input unit 110 serves as the data port for the entire system, used to input, output, and preprocess the data required for system operation. The specific configuration of the data input unit 110 is not limited and can be determined according to actual needs.

[0226] The PIPDR2 model 120 in this system integrates information security assessment data with the AHP (Analytic Hierarchy Process) algorithm to perform risk quantification calculation and optimization.

[0227] The configuration scheme of the PIPDR2 model 120 is as described above, and will not be repeated here.

[0228] The risk quantification assessment unit 130 in this system is configured to interact with the PIPDR2 model 120, enabling the use of the analytic hierarchy process (AHP) in the PIPDR2 model to perform quantitative analysis of cybersecurity risks.

[0229] The composition scheme of the risk quantification assessment unit 130 is as described above with the implementation scheme of AHP and dynamic weight adjustment mechanism, and will not be elaborated here.

[0230] The evaluation and optimization unit 140 in this system interacts with the risk quantification and evaluation unit 130 and the PIPDR2 model 120. It can optimize the PIPDR2 model 120 through a "evaluation-optimization-re-evaluation" cyclical risk weight update mechanism, thereby further improving the accuracy of quantitative analysis of cybersecurity risks.

[0231] The configuration of the evaluation and optimization unit 140 is as described in the aforementioned evaluation and optimization mechanism implementation scheme, and will not be elaborated here.

[0232] The following specific application examples further illustrate the application and implementation process of the present invention.

[0233] This example illustrates how a cybersecurity insurance product, personal information insurance, was launched in partnership with Insurance Company B, and implemented through e-commerce company A. The entire implementation process includes the following stages:

[0234] (1) Determine the pre-insurance risk assessment model: In this example, the pre-insurance risk assessment model is first determined. The corresponding pre-insurance risk assessment model is as follows: Figure 3 As shown, a corresponding dynamic risk assessment system for cybersecurity insurance based on the PIPDR2 model is constructed.

[0235] (2) Current situation analysis: For Company A, the current situation analysis is conducted. In this case, the overall construction status of Company A in the four aspects of risk assessment factors involved in personal information insurance, namely "security strategy", "risk identification", "security defense" and "security detection", is presented in the "Company A PIPDR2 Model Current Situation Analysis Report".

[0236] (3) Data input: Further obtain the Level 3 Information Security Protection Assessment Report of Company A, extract compliance data (such as privacy protection agreement, encrypted transmission coverage) and input it into the system.

[0237] (4) Improvement of evaluation indicators: To address the missing parts in the information security level assessment report, network security experts were organized to design the "Supplementary Table of Personal Information Risk Assessment Indicators", thereby completing the improvement of the evaluation indicators.

[0238] (5) Supplementing data: At the same time, further technical inspections, questionnaires, and personal interviews were conducted on Company A to improve the assessment indicators for personal information risk assessment, thereby completing the data supplementation.

[0239] (6) Risk assessment: After the above data preparation and improvement are completed, a risk assessment is carried out based on the system. The system combines the information security level protection score and supplementary materials to calculate the risk value and obtain the risk assessment score of Company A. The total score is: 12.7+6.7+3.7+7.7+21.4+13.1+3.9+9.9+6.6+7.7=93.4 points, as shown in 4.

[0240] (7) Risk Level Assessment: The risk level is assessed based on the score, and the requirements for insurance correlation analysis and handling are determined. (See attached document) Figure 5 As shown.

[0241] (8) Personal Information Insurance Policy Signing: Based on this, according to the risk level determined by the pre-insurance risk assessment, the policy is signed and the policy details are determined. The signing of the personal information insurance policy is completed.

[0242] (9) Handling Security Incidents During Policy Implementation: If Company A encounters a security incident during policy execution, such as an attacker pushing a disguised patch containing malicious code to internal terminals via the software update server of a supply chain partner, resulting in the intrusion of multiple servers, the theft of a large amount of data, and the delay of several projects, the company will immediately activate the backup network and disconnect some internal applications from external connections. The company will also contact Insurance Company B to initiate the security incident emergency response service, loss assessment process, and claims process during policy implementation.

[0243] (10) Security Emergency Response Service: The security expert team of Insurance Company B confirmed through reverse analysis that the attacker hijacked the digital signature verification process and used an undisclosed vulnerability in the Windows kernel (CVE-2024-XXXXX) to carry out a fileless attack. It was ultimately determined to be a 0-day supply chain attack incident launched by a national APT organization.

[0244] (11) Economic loss assessment: The assessment team's investigation showed that Company A suffered direct business losses of XX million yuan due to server shutdown, XX million yuan in liquidated damages for delays in 3 R&D projects, and an estimated XX million yuan in data recovery costs and goodwill losses, totaling XXX million yuan.

[0245] (12) Insurance claims decision: Based on the terms of the personal information security insurance, the claims team confirmed that this attack falls under the coverage of "advanced persistent threat" and determined the compensation amount to be RMB XXX million after deducting the deductible.

[0246] (13) Rectification recommendations output: Insurance Company B’s cybersecurity experts require Company A to complete three rectifications within 90 days: deploy and establish a third-party software hash whitelist mechanism, implement zero-trust network architecture transformation, and carry out security training services such as red team and blue team exercises. The rectification compliance rate will affect the renewal conditions.

[0247] (14) Rectification and Supervision Implementation: Insurance Company B officially issued a "Notice of Compliance Rectification for Personal Information Security Insurance" to Company A, requiring it to complete the repair of all high-risk vulnerabilities by XX / XX / 202X and submit a penetration test report certified by CNCERT every quarter, otherwise the exclusion clause of the policy will be triggered.

[0248] (15) Rectification Implementation: After the incident, Company A immediately established a special rectification working group, which, together with leading domestic cybersecurity vendors and the CNCERT technical team, promoted the rectification in three phases.

[0249] (16) Policy Claims: After Company A completed the rectification, Insurance Company B organized cybersecurity experts to conduct a professional assessment of the rectification items. The experts determined that Company A's rectification results met all the requirements of the "Personal Information Security Insurance Compliance Rectification Notice" and satisfied the policy claims conditions. Subsequently, Insurance Company B, based on the "Insurance Claims Decision" during the policy period, provided an insurance payout of XXX million yuan.

[0250] (17) Risk Assessment Model Optimization: After friendly consultation, Insurance Company B and Company A optimized the PIPDR2 personal information security risk assessment model in detail, adding assessment factors related to the rectification, enabling the model to provide real-time feedback on Company A's security status, resulting in more reasonable scoring and better preparation for policy renewal. This also indirectly enhanced Company A's overall personal information security capabilities; the optimized risk assessment model, as shown in the image... Figure 6 As shown.

[0251] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of this invention is defined by the appended claims and their equivalents.

Claims

1. A dynamic risk assessment method for cybersecurity insurance pre-insurance based on the PIPDR2 model, characterized in that, The risk assessment method uses a defined PIPDR2 model for pre-insurance dynamic risk assessment of cybersecurity insurance. The PIPDR2 model includes a PIPDR2 risk assessment factor layer and a risk assessment index layer. The PIPDR2 risk assessment factor layer is configured with a security strategy factor module, a risk identification factor module, a security defense factor module, a security detection factor module, a security response factor module, and a security recovery factor module. The security policy factor module is used to evaluate the top-level design and system completeness of enterprise network security management; The risk identification factor module is used to discover key enterprise assets, potential threats and vulnerabilities, and to identify risk priorities. The security defense factor module is used to evaluate the effectiveness of an enterprise's technical protection measures; The security detection factor module is used to evaluate an enterprise's real-time threat monitoring and anomaly detection capabilities. The security response factor module is used to evaluate the efficiency of an enterprise's emergency response to security incidents; The security recovery factor module is used to assess an enterprise's ability to ensure business continuity after an attack. The risk assessment indicator layer is configured with corresponding risk assessment indicators for each assessment factor module in the PIPDR2 risk assessment factor layer based on network security level protection assessment data. The analytic hierarchy process is used to assign weights to each PIPDR2 risk assessment factor in the PIPDR2 risk assessment factor layer, and quantitative assessment is completed in combination with dynamic data collection.

2. A dynamic risk assessment system for cybersecurity insurance pre-insurance based on the PIPDR2 model, characterized in that, The risk assessment system constructs a PIPDR2 model, which includes a PIPDR2 risk assessment factor layer and a risk assessment index layer. The PIPDR2 risk assessment factor layer is configured with a security strategy factor module, a risk identification factor module, a security defense factor module, a security detection factor module, a security response factor module, and a security recovery factor module. The security policy factor module is used to evaluate the top-level design and system completeness of enterprise network security management; The risk identification factor module is used to discover key enterprise assets, potential threats and vulnerabilities, and to identify risk priorities. The security defense factor module is used to evaluate the effectiveness of an enterprise's technical protection measures; The security detection factor module is used to evaluate an enterprise's real-time threat monitoring and anomaly detection capabilities. The security response factor module is used to evaluate the efficiency of an enterprise's emergency response to security incidents; The security recovery factor module is used to assess an enterprise's ability to ensure business continuity after an attack. The risk assessment indicator layer is configured with corresponding risk assessment indicators for each assessment factor module in the PIPDR2 risk assessment factor layer based on network security level protection assessment data. The analytic hierarchy process is used to assign weights to each PIPDR2 risk assessment factor in the PIPDR2 risk assessment factor layer, and quantitative assessment is completed in combination with dynamic data collection.

3. The pre-insurance dynamic risk assessment system for cybersecurity insurance based on the PIPDR2 model according to claim 2, characterized in that, The security strategy factor module is configured to assess the top-level design and completeness of an enterprise's cybersecurity management system by reviewing whether the enterprise has written security management systems, security audit mechanisms, job descriptions, and other relevant documents.

4. The pre-insurance dynamic risk assessment system for cybersecurity insurance based on the PIPDR2 model according to claim 2, characterized in that, The risk identification factor module is configured to obtain an asset list using the asset management system, acquire system vulnerability data through vulnerability scanning tools, and analyze external threats in conjunction with a threat intelligence platform.

5. The pre-insurance dynamic risk assessment system for cybersecurity insurance based on the PIPDR2 model according to claim 2, characterized in that, The security defense factor module can assess the effectiveness of an enterprise's technical protection measures by checking firewall policy configuration, network boundary isolation, data encryption transmission, and the deployment of strong identity authentication.

6. The pre-insurance dynamic risk assessment system for cybersecurity insurance based on the PIPDR2 model according to claim 2, characterized in that, The security detection factor module is configured to analyze whether there is an abnormal behavior monitoring capability by checking the deployment and alarm logs of the intrusion detection / prevention system and the security information and event management system.

7. The pre-insurance dynamic risk assessment system for cybersecurity insurance based on the PIPDR2 model according to claim 2, characterized in that, The safety response factor module is configured to assess the company's emergency response efficiency for safety incidents by reviewing the completeness of emergency response plans, emergency drill records, and reports on the handling of real safety incidents.

8. The pre-insurance dynamic risk assessment system for cybersecurity insurance based on the PIPDR2 model according to claim 2, characterized in that, The security recovery factor module is configured to assess an enterprise's business continuity assurance capabilities after an attack by checking its data backup strategy, disaster recovery system construction status, and business recovery contingency plan.

Images