Network space data security compliance management system based on artificial intelligence technology

Abstract

The invention discloses a network space data security compliance management system based on an artificial intelligence technology, and the system comprises a real-time compliance response module which is used for analyzing a supervision file and outputting structured clause information; the deep data cognition module is used for processing the service data and generating a scene label; the dynamic strategy management module is connected with the real-time compliance response module and the depth data cognition module, and is used for receiving the clause information and the scene label, compiling the clause information and the scene label into an executable strategy code, and carrying out strategy conflict resolution based on a conflict arbitration algorithm; the risk assessment model is connected with the dynamic strategy management module and the depth data cognition module; a unified management module; all the modules are in interactive connection with a block chain network through a system bus to form a closed-loop governance system from data analysis, strategy generation, risk assessment to audit execution. According to the method, the data security and the compliance check automation level are comprehensively improved, and meanwhile, the compliance cost is remarkably reduced, and the overall improvement of the whole-process management efficiency is realized.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, specifically a cyberspace data security compliance management system based on artificial intelligence technology. Background Technology

[0002] In today's rapidly developing digital economy, data has become a core driver of business growth, but the accompanying data security risks and compliance challenges are also becoming increasingly severe. Globally, data breaches are frequent, privacy infringement lawsuits are surging, and governments worldwide are enacting stringent data protection regulations, placing unprecedented compliance pressure on businesses. At the same time, the increased complexity of data flows brought about by digital transformation, the challenges of managing multi-cloud environments, and the growing awareness of consumer privacy are all forcing companies to re-examine their data security management methods.

[0003] In the past, enterprises mainly relied on manual audits, decentralized security tools, and static compliance strategies to cope with regulatory requirements. However, this approach is no longer suitable for the dynamically changing threat environment and regulatory framework. The explosive growth in data volume has rendered traditional management methods inefficient, while differentiated compliance standards across regions and industries have left enterprises struggling to cope. For example, the financial industry must simultaneously meet the local storage requirements of the Data Security Act and the cross-border transfer rules of the GDPR, while healthcare data is subject to the dual constraints of the Personal Information Protection Act and industry-specific regulations.

[0004] Existing data security management systems largely rely on traditional technologies such as firewalls and intrusion detection, which are insufficient to effectively address complex and ever-changing security threats and compliance requirements. Furthermore, these systems often lack intelligent management tools, failing to achieve real-time monitoring and early warning for data security.

[0005] Against this backdrop, data security compliance management systems have emerged. They are not only essential tools for enterprises to meet regulatory requirements, but also strategic support for realizing the secure release of data value. Through capabilities such as automated data discovery, intelligent compliance analysis, and real-time risk monitoring, these systems help enterprises shift from passive compliance to proactive governance, building a data security system adapted to future development while meeting legal requirements. Summary of the Invention

[0006] This invention provides a cyberspace data security compliance management system, method, electronic device, and storage medium based on artificial intelligence technology to solve the problems existing in the background technology.

[0007] In a first aspect, the present invention provides a cyberspace data security compliance management system based on artificial intelligence technology, comprising: The real-time compliance response module is used to parse regulatory documents and output structured clause information; The deep data cognition module is used to process business data and generate scene tags; The dynamic policy management module connects the real-time compliance response module and the deep data cognition module. It is used to receive the clause information and scenario tags, compile them into executable policy code, and resolve policy conflicts based on the conflict arbitration algorithm. The risk assessment model connects the dynamic strategy management module and the deep data cognition module. It is used to perform risk assessment based on the fusion matrix and risk entropy algorithm, and output a risk heat map to the dynamic strategy management module to guide strategy orchestration. The unified governance module, connected to the dynamic policy management module, is used to execute policies and perform auditing and evidence storage through blockchain sharding technology. Each module interacts and connects with the blockchain network through a system bus, forming a closed-loop governance system from data parsing, strategy generation, risk assessment to execution auditing.

[0008] Optionally, the real-time compliance response module includes a natural language processing engine based on the Transformer-XL architecture, with the following hyperparameters configured: no fewer than 12 layers, no fewer than 1024 hidden units, no fewer than 16 heads, and a sequence length of no less than 10240 characters.

[0009] Optionally, the deep data cognition module adopts an architecture that integrates a visual-text aligned multimodal pre-trained model with a heterogeneous graph neural network to process heterogeneous data such as text, images, and logs.

[0010] Optionally, the dynamic policy management module includes: Finite state converters are used to construct policy state machines; The strategy is a code compiler used to generate executable strategies; A conflict arbitration algorithm based on Nash equilibrium is used to resolve policy conflicts within 50 milliseconds.

[0011] Optionally, the fusion matrix constructed by the risk assessment model is a fusion matrix of the DSM matrix and the ATT&CK framework; The risk entropy value algorithm is: R = α·log(1+β^γ); Where R is the risk entropy value, α is the data value coefficient, β is the threat intensity coefficient, and γ is the exposure surface coefficient.

[0012] Optionally, the data value coefficient α is quantified based on multiple dimensions such as data type, sensitivity, data volume, usage frequency, and storage location; the threat intensity coefficient β is quantified based on multiple dimensions such as threat type, frequency, source, and impact range; and the exposure surface coefficient γ is quantified based on multiple dimensions such as data access permissions, network exposure, encryption status, and security protection measures.

[0013] In a second aspect, the present invention provides a method for cyberspace data security compliance management based on artificial intelligence technology, wherein the method, based on the system described in the first aspect, includes: The real-time compliance response module parses regulatory documents and outputs structured clause information. The deep data cognition module processes business data and generates scene tags. The dynamic policy management module receives the terms information and scenario tags, compiles them into executable policy code, and resolves policy conflicts. Risk assessment is conducted using a risk assessment model, and a risk heatmap is generated to guide strategy development. Strategies are implemented and audited using a unified governance module; Each step is connected to the blockchain network via a system bus, forming a closed-loop governance process.

[0014] Optionally, the method for parsing regulatory documents includes: using the Transformer-XL model to perform semantic parsing of the regulatory text and dynamically updating the compliance knowledge graph.

[0015] Optionally, the method for resolving policy conflicts includes: The optimal strategy combination is calculated based on Nash equilibrium theory, and conflict resolution is completed within 50 milliseconds.

[0016] Optionally, the method for conducting risk assessment includes: calculating the risk entropy value based on the DSM-ATT&CK fusion matrix and the risk entropy value formula, and generating a risk heat map.

[0017] Optionally, the method for auditing and storing evidence includes: using blockchain sharding technology to distribute policy execution events to different shards for processing and storage.

[0018] Thirdly, embodiments of the present invention provide an electronic device, including a processor, a communication interface, a memory, and a bus, wherein the processor, the communication interface, and the memory communicate with each other through the bus, and the processor can call logical instructions in the memory to execute the cyberspace data security compliance management method based on artificial intelligence technology as described in the second aspect.

[0019] Fourthly, embodiments of the present invention provide a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the cyberspace data security compliance management method based on artificial intelligence technology as described in the second aspect.

[0020] The beneficial effects of the cyberspace data security compliance management system based on artificial intelligence technology in this invention are: This system achieves second-level semantic parsing and dynamic knowledge graph construction for ultra-long regulatory documents through a real-time compliance response module based on the Transformer-XL architecture, significantly improving the efficiency of compliance interpretation. It utilizes a multi-modal fusion-based deep data cognition module to accurately identify heterogeneous data scenarios, significantly improving metadata annotation and classification accuracy. It innovatively employs a Nash equilibrium algorithm to drive policy conflict resolution and finite state converters to manage the policy lifecycle, achieving millisecond-level policy optimization and deployment. Through the DSM-ATT&CK fusion matrix and risk entropy algorithm, it quantitatively assesses data asset risks, effectively improving threat prediction accuracy. Finally, it builds a trusted audit and traceability system based on blockchain sharding and CRDT synchronization protocol, comprehensively improving data security and the automation level of compliance checks while achieving a significant reduction in compliance costs and an overall leap in the efficiency of the entire governance process. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is an architecture diagram of the cyberspace data security compliance management system based on artificial intelligence technology in an embodiment of the present invention; Figure 2 This is a flowchart illustrating the operation of the cyberspace data security compliance management system based on artificial intelligence technology in this embodiment of the invention. Figure 3 This is a structural diagram of the Transformer-XL model in an embodiment of the present invention; Figure 4 This is a flowchart of strategy conflict resolution in an embodiment of the present invention; Figure 5 This is a flowchart of a cyberspace data security compliance management method based on artificial intelligence technology, as described in an embodiment of the present invention. Figure 6 This is a structural block diagram of the electronic device in an embodiment of the present invention. Detailed Implementation

[0023] To better understand the purpose, technical solution, and advantages of this application, the application is described and explained below in conjunction with the accompanying drawings and embodiments.

[0024] Unless otherwise defined, the technical or scientific terms used in this application shall have the general meaning understood by one of ordinary skill in the art to which this application pertains. Words such as “a,” “an,” “an,” “the,” “the,” and “these” used in this application do not indicate quantitative limitation and may be singular or plural. The terms “comprising,” “including,” “having,” and any variations thereof used in this application are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or device that comprises a series of steps or modules (units) is not limited to the listed steps or modules (units) but may include steps or modules (units) not listed, or may include other steps or modules (units) inherent to these processes, methods, products, or devices. Words such as “connected,” “linked,” and “coupled” used in this application are not limited to physical or mechanical connections but may include electrical connections, whether direct or indirect. “Multiple” used in this application refers to two or more. “And / or” describes the relationship between related objects, indicating that three relationships may exist; for example, “A and / or B” can represent: A alone, A and B simultaneously, and B alone. Normally, the character " / " indicates that the objects before and after it are in an "or" relationship. The terms "first," "second," "third," etc., used in this application are merely to distinguish similar objects and do not represent a specific order of objects.

[0025] like Figure 1 and Figure 2 As shown, this embodiment of the invention provides a cyberspace data security compliance management system based on artificial intelligence technology, including: The real-time compliance response module is used to parse regulatory documents and output structured clause information; In this embodiment, the real-time compliance response module includes a natural language processing engine based on the Transformer-XL architecture, with the following hyperparameters configured: no fewer than 12 layers, no fewer than 1024 hidden units, no fewer than 16 heads, and a sequence length of no less than 10240 characters.

[0026] The deep data cognition module is used to process business data and generate scene tags; The deep data cognition module adopts an architecture that integrates a vision-text aligned multimodal pre-trained model with a heterogeneous graph neural network to process heterogeneous data such as text, images, and logs.

[0027] The dynamic policy management module connects the real-time compliance response module and the deep data cognition module. It is used to receive clause information and scenario tags, compile them into executable policy code, and resolve policy conflicts based on the conflict arbitration algorithm. The dynamic policy management module includes: Finite state converters are used to construct policy state machines; The strategy is a code compiler used to generate executable strategies; A conflict arbitration algorithm based on Nash equilibrium is used to resolve policy conflicts within 50 milliseconds.

[0028] The risk assessment model connects the dynamic strategy management module and the deep data cognition module. It is used to perform risk assessment based on the fusion matrix and risk entropy algorithm, and outputs a risk heat map to the dynamic strategy management module to guide strategy orchestration. The fusion matrix for constructing the risk assessment model is a fusion matrix of the DSM matrix and the ATT&CK framework; The risk entropy algorithm is: R = α·log(1 + β^γ); Where R is the risk entropy value, α is the data value coefficient, β is the threat intensity coefficient, and γ is the exposure surface coefficient. Furthermore, the data value coefficient α is quantified based on multiple dimensions including data type, sensitivity, data volume, usage frequency, and storage location; the threat intensity coefficient β is quantified based on multiple dimensions including threat type, frequency, source, and impact scope; and the exposure surface coefficient γ is quantified based on multiple dimensions including data access permissions, network exposure, encryption status, and security protection measures.

[0029] The unified governance module connects to the dynamic policy management module and is used to execute policies and perform auditing and evidence storage through blockchain sharding technology. The protocol combines dynamic policy hashing with off-chain verification using zero-knowledge proofs in blockchain sharding for evidence storage (covering the entire lifecycle from policy generation to deployment to auditing). It also claims the combined benefits of this technology combination: compliance response speed improved by ≥47 times (actual test ≤8 seconds), policy activation latency ≤50ms, and annualized compliance costs reduced by 92%.

[0030] Each module interacts and connects with the blockchain network through a system bus, forming a closed-loop governance system from data parsing, strategy generation, risk assessment to execution auditing.

[0031] It should be noted that the compliance management system in this application also includes a data awareness layer, which is used to receive externally input regulatory documents and business data.

[0032] It also includes a data processing and decision-making layer and a data execution and auditing layer. Among them, the real-time compliance response module, the deep data cognition module, the dynamic strategy management module, and the risk assessment model are components of the data processing and decision-making layer. The data processing and decision-making layer is connected to the data perception layer and is used to intelligently process the received data and generate strategies. Specifically, the real-time compliance response module is used to parse regulatory documents, build and dynamically update a compliance knowledge graph, and output structured clause information; As the system's sensory nerve center, the real-time compliance response module undertakes the intelligent analysis function of the regulatory environment. Its built-in Transformer NLP engine can break through the limitations of traditional text processing and realize the semantic deconstruction of regulatory documents with tens of thousands of words. At the same time, it relies on compliance knowledge graph technology to build a precise mapping network between clauses and control measures.

[0033] More specifically, the Transformer-XL architecture breaks through the contextual limitations of traditional NLP, utilizes a multi-head attention mechanism to achieve semantic deconstruction of regulatory provisions, and its compliance knowledge graph adopts dynamic ontology modeling technology to support real-time reasoning of millions of triple relationships, accurately constructing a mapping network between legal provisions and control measures.

[0034] For example, such as Figures 1 to 3 As shown, the process begins with input layer processing: After the regulatory documents are uploaded, a format check is performed to ensure the file type meets system requirements. OCR technology is used to extract text from the image format files, converting them into a processable text format. The text is then cleaned to remove irrelevant characters and noise, improving the accuracy of subsequent processing. Next, the Transformer-XL layer is implemented, initializing the Transformer-XL model and setting hyperparameters (such as the number of layers, heads, and hidden layer dimensions). The preprocessed regulatory text is input into the model, and a multi-head attention mechanism is used for deep text parsing. Positional encoding technology preserves the sequential information in the text, ensuring the accuracy of the parsing results. Then, a compliance knowledge graph layer is constructed, collecting relevant laws, regulations, industry standards, and other data sources for knowledge extraction and organization. The ontology structure of the compliance knowledge graph is built using the ontology modeling tool RDF. Dynamic ontology modeling technology is employed to support real-time updates and inference of triple relationships in the graph. Finally, a mapping network layer is generated, automatically matching regulatory clauses and control measures based on the compliance knowledge graph. Factors such as the constraints and applicable scenarios of the clauses are considered to ensure the accuracy and enforceability of the mapping relationships. The mapping network is continuously optimized and updated to adapt to the ever-changing regulatory environment. The final output layer processes the parsed regulatory information in a structured format for subsequent processing. API interfaces or message queues are provided to enable data interaction with other modules. Output data is encrypted and protected for privacy to ensure data security.

[0035] In this embodiment, the hyperparameters are configured as follows: Number of layers: Set to 12 layers to balance the expressive power and computational complexity of the model.

[0036] Number of hidden units: The number of hidden units per layer is set to 1024 to provide sufficient representation capacity.

[0037] Number of heads: The number of heads in the multi-head attention mechanism is set to 16 to capture more contextual information.

[0038] Sequence length: Considering the length of regulatory documents, the sequence length is set to 10240 characters to support the parsing of very long texts.

[0039] Memory length: Set to the same as the sequence length, i.e., 10240, to make full use of historical information.

[0040] Learning rate: The initial learning rate was set to 3e-5, and the Adam optimizer was used for training.

[0041] Dropout rate: Set to 0.1 to prevent overfitting.

[0042] Batch size: Set to 64 based on hardware resources to balance training speed and model stability.

[0043] Among them, the model tuning methods are: Learning rate scheduling: A linear decaying learning rate scheduling strategy is adopted. As the number of training steps increases, the learning rate is gradually reduced to stabilize the model training process.

[0044] Early stopping: Monitor model performance on the validation set and stop training early when performance no longer improves to avoid overfitting.

[0045] Gradient clipping: Set a gradient clipping threshold to prevent gradient explosion.

[0046] Weight initialization: The Xavier initialization method is used to accelerate model convergence.

[0047] Model ensemble: By training multiple models and averaging their outputs, the generalization ability and stability of the model can be improved.

[0048] The deep data cognition module is used to process business data, identify data scenarios, and generate data asset association maps and scenario tags; The deep data cognition module, as the core brain of data understanding, integrates the multimodal BERT model and graph neural network technology to form a contextualized cognitive ability for heterogeneous data such as text, images, and logs, and constructs a dynamically updated data asset association map.

[0049] Employing a vision-text aligned multimodal pre-training framework, an improved heterogeneous graph neural network can simultaneously process structured and unstructured data streams, achieving a metadata annotation accuracy of 92.4% in complex scenarios such as medical images and financial transaction logs. Furthermore, it continuously optimizes scene perception capabilities through self-supervised learning.

[0050] This module employs a visual-text aligned multimodal pre-training framework, combined with an improved heterogeneous graph neural network, aiming to achieve efficient and accurate data processing and cognition.

[0051] Specifically, the multimodal pre-training framework is as follows: Framework selection: The ViLBERT multimodal pre-trained model was selected. Its model performs well in the joint learning of visual and text data and can capture cross-modal correlation information.

[0052] Data preprocessing: For heterogeneous input data (such as medical images, financial transaction logs, etc.), preprocessing is performed first, including image enhancement, text cleaning, word segmentation, etc., to ensure data quality and consistency.

[0053] Feature extraction: Feature vectors for images and text are extracted using the feature extractor in the pre-trained model. For image data, a convolutional neural network (CNN) is used to extract spatial features; for text data, BERT or its variants are used to extract semantic features.

[0054] Visual-text alignment: Design alignment mechanisms, such as using contrastive learning or cross-modal attention mechanisms, to map image features and text features to the same space, achieving cross-modal alignment and fusion. This helps the model understand the relationship between images and text, improving the accuracy of scene recognition.

[0055] An example of an improved heterogeneous graph neural network is shown below: Graph construction: The preprocessed data is constructed into a heterogeneous graph, where nodes represent data entities (such as objects in an image or words in a text) and edges represent relationships between entities (such as spatial relationships in an image or semantic relationships in a text).

[0056] Heterogeneous Graph Convolution: Design a Heterogeneous Graph Convolutional Neural Network (GNN) to perform convolution operations on heterogeneous graphs. During the convolution process, consider the features of different types of nodes and edges, and use an attention mechanism to dynamically adjust the weights between nodes to achieve more refined feature aggregation.

[0057] Scene awareness optimization: By introducing a contrastive self-supervised learning mechanism, the model can automatically learn the inherent structure and patterns of data without external labels. This helps the model understand data more accurately in complex scenarios and improves the accuracy of metadata annotation.

[0058] Dynamic updates and iterations: As new data continues to flow in, an incremental learning mechanism is designed to enable the model to continuously learn and optimize on new data, thereby continuously improving its scene perception capabilities.

[0059] The specific implementation is as follows: Data preparation: Collect and organize data from complex scenarios such as medical images and financial transaction logs to ensure data diversity and representativeness.

[0060] Model training: The model is pre-trained using a multimodal pre-training framework and then fine-tuned on a specific task. During training, the cross-entropy loss function is used to optimize the model parameters.

[0061] Performance Evaluation: The model's performance is evaluated on the test set, including metrics such as metadata annotation accuracy and scene classification accuracy. The effectiveness and superiority of the model are verified by comparing it with other state-of-the-art methods.

[0062] Deployment and Application: The trained model is deployed to the actual system and integrated with other modules such as the real-time compliance response module and the dynamic policy management module to work collaboratively. In practical applications, the model is continuously optimized and updated based on feedback and data changes.

[0063] In this embodiment, the hyperparameters of the ViLBERT multimodal pre-trained model are configured as follows: Number of layers: Set to 12 layers to balance the model's expressive power and computational complexity. As a variant of BERT, ViLBERT's number of layers can be adjusted according to specific task requirements.

[0064] Number of hidden units: The number of hidden units per layer is usually set to 768 to provide sufficient representational power.

[0065] Number of heads: The number of heads in a multi-head attention mechanism is generally set to 8 to capture more contextual information.

[0066] Sequence length: Considering the alignment requirements of text and images, the sequence length should be set to a length that can accommodate the feature vectors of text and images, which is 256.

[0067] Number of image regions: For image data, it is divided into multiple regions, each represented by a feature vector. The number of regions can be adjusted according to the image size and resolution.

[0068] Learning rate: The initial learning rate is set to 3e-5 to avoid the model converging to a local optimum too quickly in the early stages of training.

[0069] The optimization parameters for training the ViLBERT multimodal pre-trained model are as follows: Optimizer: The Adam optimizer is used, which has adaptive learning rate adjustment capabilities and can better optimize the model.

[0070] Learning rate scheduling: A cosine decay learning rate scheduling strategy is adopted. As the number of training steps increases, the learning rate is gradually reduced to stabilize the model training process.

[0071] Batch size: Set to 64 based on hardware resources to balance training speed and model stability. For multimodal data, the batch size should take into account the combination of text and image data.

[0072] Training rounds: Set to 20 rounds based on task complexity and data volume. During training, the model's convergence can be monitored using the performance on the validation set, and training can be stopped when appropriate.

[0073] Gradient clipping: Set a gradient clipping threshold to prevent gradient explosion.

[0074] Weight initialization: The Xavier initialization method is used to accelerate model convergence.

[0075] The improved hyperparameters of the heterogeneous graph neural network are as follows: Number of graph convolutional layers: Set to 4 layers to capture deep relationships between nodes.

[0076] Node embedding dimension: set to 128 based on task requirements and data scale.

[0077] Attention Head Count: In the multi-head attention mechanism, the number of heads is set to 8 to capture different types of node relationships.

[0078] Dropout rate: To prevent overfitting, a dropout operation is usually set after the graph convolutional layer, with the dropout rate set to 0.3.

[0079] The improved training optimization parameters for heterogeneous graph neural networks are as follows: Optimizer: The Adam optimizer is also used.

[0080] Learning rate: The initial learning rate is set to 1e-3 and adjusted according to the training progress.

[0081] Batch size: Since the graph data is large, the batch size can be set to a small value, such as 16.

[0082] Training rounds: Set to 180 rounds based on task complexity and graph data size.

[0083] Early stopping: Monitor model performance on the validation set and stop training early when performance no longer improves.

[0084] The dynamic policy management module is connected to the real-time compliance response module and the deep data cognition module respectively. It is used to receive structured clause information and scenario tags, compile them into executable policy code, and resolve policy conflicts based on the conflict arbitration algorithm. A policy state machine model is constructed using finite state converters, and the policy as code technology is combined to realize the programmable expression of the policy, and it has an intelligent arbitration mechanism for real-time conflict resolution. By innovatively integrating the symbolic logic of finite state converters with the executable nature of policies as code, a conflict arbitration algorithm based on Nash equilibrium was developed, which supports state switching and conflict resolution for more than 2000 policy rules within 50 milliseconds. The design details are as follows: Finite state transitions define a family of states, each representing a stage or mode of policy execution. Transition rules between states are defined based on input events or conditions. These rules are represented in symbolic logic for ease of understanding and maintenance. Each state transition can be associated with one or more output actions, such as executing a specific policy or sending an alarm.

[0085] Policy as code: Representing policy rules in code form facilitates programming and automated execution. It allows for modification, extension, and reuse as needed, and is encapsulated in containers for easy deployment and management on containerized platforms such as Kubernetes.

[0086] like Figure 4 As shown, the conflict arbitration algorithm based on Nash equilibrium works as follows: First, the algorithm detects whether there are conflicts between policy rules, such as two rules attempting to modify the same data item simultaneously but with different values. Detected conflicts are evaluated, calculating the priority and influence of each policy rule. Based on Nash equilibrium theory, the algorithm finds a solution acceptable to all policy rules, meaning no single rule can achieve a better result by unilaterally changing its policy, ensuring conflict resolution and state switching are completed within 50 milliseconds.

[0087] The specific implementation process is as follows: State machine model construction: Use the YAKINDU Statechart Tools finite state converter to build a state machine model, define states, transition rules and output actions, and draw state diagrams.

[0088] Strategy code writing and testing: Write strategy code using the Java programming language, and perform unit testing, integration testing and performance testing on the strategy code to ensure its correctness and efficiency.

[0089] Conflict arbitration algorithm implementation: A conflict arbitration algorithm based on Nash equilibrium was implemented using the Java programming language. The algorithm was simulated and its performance was tested to ensure that it could resolve conflicts within 50 milliseconds.

[0090] Specifically, policy rule input: The system receives policy rules from different sources.

[0091] Conflict detection: The system detects whether there are conflicts between these policy rules.

[0092] Is there a conflict?: Determine if there is a conflict between policy rules. (Yes: Proceed to the conflict resolution process. No: Directly output the policy rules without conflict).

[0093] Assess strategy priority and impact: Assess the priority and impact of detected conflicting strategies.

[0094] Calculating the optimal solution based on Nash equilibrium theory: Using Nash equilibrium theory, a solution acceptable to all policy rules is calculated.

[0095] Policy rule adjustment: Adjust policy rules based on calculation results to eliminate conflicts.

[0096] Conflict resolution: Adjust the strategy rules to achieve conflict resolution.

[0097] Output conflict-free policy rules: Output the final set of conflict-free policy rules.

[0098] This flowchart illustrates the specific implementation process of the Nash equilibrium algorithm in policy conflict resolution, ensuring that policy conflict detection and resolution are completed within 50 milliseconds.

[0099] More specifically, conflict detection: The dynamic policy management module first receives policy requests or updates from multiple data sources, including the real-time compliance response module and the deep data cognition module. The system matches the new policy requests with the existing policy library to detect potential policy conflicts. Conflicts may manifest as two or more policies attempting to modify the same data item simultaneously, but with different conditions or values.

[0100] Conflict Assessment: For detected conflicts, the system calculates the priority and impact of each conflicting strategy. Priority may be based on the strategy's source (e.g., regulatory requirements, business needs), execution order, or importance level. Impact assesses the potential impact of the strategy on the overall system security and compliance. Conflicting strategies and their interrelationships are constructed as a conflict graph, where nodes represent strategies and edges represent conflict relationships between strategies.

[0101] Nash Equilibrium Analysis: The system generates all possible strategy combinations, each representing a strategy execution plan. For each strategy combination, the system calculates its benefit (or cost), which can be quantified based on multiple dimensions such as security improvement, compliance satisfaction, and business continuity. Applying Nash equilibrium theory, the system seeks a strategy combination such that, under this combination, no single strategy can achieve a higher benefit by unilaterally changing its execution method. In other words, each strategy is optimal in its current execution state, given the execution states of other strategies.

[0102] Conflict resolution: Based on the results of Nash equilibrium analysis, the system selects the strategy combination with the highest payoff as the optimal solution. For strategies not selected, the system may make necessary adjustments (such as modifying execution conditions, priorities, or abandoning them entirely) to ensure consistency with the optimal strategy combination. The dynamic strategy management module makes an arbitration decision based on the optimal strategy combination to determine the final strategy to be executed.

[0103] Implementation and Feedback: The arbitrated strategy is deployed to the system for execution, ensuring that all relevant components and nodes are configured and operate according to the new strategy. The system continuously monitors the effectiveness of strategy implementation and assesses its impact on data security and compliance. Based on monitoring results and actual operational conditions, the system may trigger a new round of conflict detection and resolution processes to adapt to evolving security threats and compliance requirements.

[0104] Integration and Deployment: Integrate the state machine model, policy code, and conflict arbitration algorithm into the dynamic policy management module. Deploy the module into the intelligent data security compliance management system to integrate and collaborate with other modules (such as the real-time compliance response module and the deep data cognition module).

[0105] Continuous optimization and iteration: Based on feedback and data changes in practical applications, the dynamic policy management module is continuously optimized and iterated. The state machine model, policy code, and conflict arbitration algorithm are constantly updated to adapt to new security threats and compliance requirements.

[0106] The risk assessment model, connected to the dynamic strategy management module and the deep data cognition module, is used to receive strategy and data information, perform dynamic risk assessment based on the fusion matrix and risk entropy algorithm, generate a risk heat map and feed it back to the dynamic strategy management module to guide strategy orchestration. As a security sentinel of the system, the risk assessment model integrates the quantitative assessment of the DSM matrix, the ATT&CK threat framework, and real-time threat intelligence to construct a three-dimensional analysis system encompassing data value, threat behavior, and exposure dimensions.

[0107] The DSM-ATT&CK fusion matrix is ​​constructed and combined with real-time threat intelligence streams to form a dynamic risk modeling engine. Its pioneering data exposure surface quantification algorithm can accurately calculate the risk entropy value of 72 threat scenarios. The design process is as follows: Integrating the DSM and ATT&CK frameworks: DSM (Data Security Matrix) is used to assess the value, sensitivity, and potential threats of data assets. ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a framework describing the tactics, techniques, and knowledge of cyber attackers. Integrating these two frameworks creates a comprehensive risk assessment model that considers both the characteristics of data assets and attacker behavior.

[0108] Real-time threat intelligence stream integration: Integrates real-time threat intelligence from multiple sources, including vulnerability announcements, malware activity, and hacking incidents. This intelligence is combined with the DSM-ATT&CK matrix to dynamically update the risk model.

[0109] Data Exposure Surface Quantization Algorithm: Develop an algorithm to quantify the degree of data exposure in a specific threat scenario. The algorithm considers the attributes of data assets (such as type, location, access permissions, etc.) and relevant information from threat intelligence.

[0110] The specific implementation process is as follows: Constructing the DSM-ATT&CK Fusion Matrix: Define data asset categories: Based on factors such as data type, sensitivity, and business value, data assets are divided into different categories. Map the ATT&CK framework: Map the tactics, techniques, and knowledge within the ATT&CK framework to the data asset categories, establishing a correspondence. Construct the matrix: Using data asset categories as rows and elements from the ATT&CK framework as columns, construct the DSM-ATT&CK fusion matrix. Each element in the matrix represents the risk level of a specific data asset under a specific threat.

[0111] Integrating Real-Time Threat Intelligence Streams: Threat Intelligence Collection: Collect real-time threat intelligence from multiple reliable sources (such as security vendors, government agencies, industry organizations, etc.). Intelligence Processing and Analysis: Clean, deduplicate, classify, and prioritize the collected threat intelligence. Extract threat information related to data assets, such as vulnerability IDs, attack methods, and malware names. Intelligence Integration: Integrate the processed threat intelligence into the DSM-ATT&CK matrix and update the risk levels in the matrix.

[0112] Develop a data exposure surface quantification algorithm: Define algorithm parameters: Determine the parameters required for the algorithm, such as data asset attributes, threat intelligence characteristics, and the risk entropy calculation formula. Algorithm implementation: Based on the risk entropy formula *R=α·log(1+β^γ)*, develop a data exposure surface quantification algorithm. Here, α represents the value coefficient of the data asset, β represents the threat intensity coefficient, and γ represents the exposure surface coefficient. The algorithm calculates the risk entropy value of the data under a specific threat scenario based on these coefficients and relevant information in the threat intelligence. Algorithm optimization: Through actual testing and data analysis, optimize and adjust the algorithm to improve its accuracy and reliability.

[0113] It should be noted that the quantification standard for the data value coefficient α is as follows: The data value coefficient α is used to quantify the value of data assets. Its quantification criteria can be based on a comprehensive evaluation of multiple attributes of the data, including, but not limited to, the following aspects: Data type: Sensitive data (such as personally identifiable information, financial information, medical records, etc.) has a high alpha value because its leakage could cause serious harm to individuals or organizations. Business-critical data (such as customer data, transaction records, etc.) has a medium alpha value because it is crucial to business operations. Public or non-sensitive data has a low alpha value because the risk of leakage is relatively small.

[0114] Data sensitivity: The alpha value increases for highly sensitive data, such as data containing personal privacy or trade secrets. The alpha value decreases for low-sensitivity data, such as publicly available information.

[0115] Data volume: For large amounts of data, the α value may need to be increased appropriately, as the larger the data volume, the higher the potential risk. For small amounts of data, the α value may need to be decreased appropriately.

[0116] Data usage frequency: Frequently used data may have a higher alpha value because frequent use increases the risk of data leakage. Data used only occasionally may have a lower alpha value.

[0117] Data storage location: The α value increases for data stored in core business systems or high-security storage facilities. The α value decreases for data stored on edge devices or low-security storage facilities.

[0118] Taking all the above factors into account, a specific α value can be assigned to each data asset, which reflects the value and sensitivity of the data asset.

[0119] The quantification criteria for the threat intensity coefficient β are as follows: The threat intensity coefficient β is used to quantify the severity of a threat. Its quantification criteria can be based on a comprehensive assessment of multiple attributes of the threat, including but not limited to the following aspects: Threat Type: Advanced Persistent Threats (APTs) have high beta values ​​because these threats are typically highly complex and stealthy. Common malware or hacking attacks have medium beta values. Misoperations or internal leaks may have low beta values, but still require attention.

[0120] Threat frequency: Threats that occur frequently have an increased beta value, while threats that occur only occasionally have a decreased beta value.

[0121] Threat source: Known high-risk sources (such as specific hacking groups or malware families) have increased beta values. Unknown or low-risk sources have decreased beta values.

[0122] Threat impact scope: Threats with a wide impact scope have an increased beta value, while threats with a limited impact scope have a decreased beta value.

[0123] The quantification criteria for the exposure surface coefficient γ are as follows: The exposure surface coefficient γ is used to quantify the degree of data exposure in a specific threat scenario. Its quantification standard can be comprehensively evaluated based on the data exposure and protective measures, including but not limited to the following aspects: Data access permissions: Data with open access permissions has a higher γ value because it is easier for unauthorized access to be made, while data with strictly restricted access permissions has a lower γ value.

[0124] Network exposure status: The gamma value of data directly exposed to the Internet increases, while the gamma value of data protected by security measures such as firewalls or VPNs decreases.

[0125] Data encryption status: Unencrypted data has a higher γ value, while encrypted data has a lower γ value.

[0126] Security measures: Data lacking effective security measures shows an increased γ value, while data with multi-layered security measures deployed shows a decreased γ value.

[0127] The risk entropy value R is calculated as follows: After determining the specific values ​​of the three coefficients α, β, and γ, the risk entropy value of the data under a specific threat scenario can be calculated using the risk entropy formula. This value reflects the degree of risk faced by the data; a higher value indicates a greater risk.

[0128] By comprehensively assessing three dimensions—data value, threat intensity, and exposure—the risk entropy formula provides enterprises with a quantitative risk assessment tool, helping them to more accurately identify and manage data security risks.

[0129] Model Application and Feedback: Risk Assessment: Use the constructed risk assessment model to assess the risks of data in the enterprise's cyberspace, generating risk reports and early warning information. Strategy Formulation: Based on the risk assessment results, formulate corresponding security strategies and compliance check measures to reduce data risks. Feedback and Updates: Collect feedback information from practical applications to continuously optimize and update the model, ensuring its timeliness and accuracy.

[0130] The data execution and audit layer, connected to the data processing and decision-making layer, is used to execute strategies and perform audit and evidence storage. The unified governance module is a component of the data execution and audit layer. Specifically, the unified governance module is connected to the dynamic strategy management module and the risk assessment model. It is used to deploy execution strategy containers and audit and store the strategy execution process and risk assessment results through blockchain sharding technology. At the same time, it realizes strategy synchronization in a distributed environment through the CRDT protocol. It provides support, with its standardized middleware ensuring seamless synchronization of strategies in complex environments, and blockchain evidence storage technology building an immutable audit and traceability chain, forming a trusted governance closed loop covering the entire lifecycle.

[0131] The real-time compliance response module, deep data cognition module, dynamic strategy management module, risk assessment model, and unified governance module are interconnected through a system bus and blockchain network, forming a closed-loop governance system from data perception, processing, decision-making to execution and auditing.

[0132] Achieving audit and evidence storage at tens of thousands of TPS through blockchain sharding technology, with its CRDT conflict resolution protocol ensuring 99.999% policy synchronization accuracy among distributed nodes. Blockchain sharding is an effective method to improve the processing capacity of a blockchain system. By dividing the entire blockchain network into multiple small shards, each shard independently processes transactions and stores data, significantly improving system throughput and scalability. The specific audit and evidence storage process involves generating a transaction containing event details when a policy update or risk assessment result event requiring audit occurs. Based on hash values ​​and timestamp rules, the transaction is allocated to different shards. Nodes within each shard independently process their assigned transaction, including verifying transaction validity and executing transaction logic. Nodes within a shard reach consensus using the DPoS consensus algorithm and add the transaction to the shard chain. For transactions requiring cross-shard verification or processing, coordination is achieved through cross-shard communication mechanisms. After a transaction is confirmed, its hash value and related information are stored on the blockchain as immutable audit evidence.

[0133] CRDT is a data structure used in distributed systems to maintain consistency across multiple replicas without a central coordinator. CRDT ensures data consistency across different replicas after concurrent modifications by defining a series of operations and merge rules. The specific policy synchronization process involves: defining a new security policy or updating an existing policy (by assigning precise timestamps to each policy update operation to ensure the order of operations); distributing the policy to each node in the distributed system; and each node applying the received policy locally and updating its own security configuration. During policy application, if different nodes concurrently modify the same data item, CRDT will detect the conflict. Based on the CRDT's merge rules, the conflict is automatically resolved to ensure data consistency across all nodes. Once the conflict is resolved, each node confirms the synchronization result, ensuring the policy is consistently applied throughout the system.

[0134] The system's modules form a closed-loop governance network that enables two-way communication. Regulatory texts and business data first converge at the perception layer. Regulatory documents are injected into the compliance response system via a blockchain-based notarization channel, while business data flows are accessed by the data cognition system via a middleware bus. The outputs of the two perception modules are deeply aggregated within the strategy management framework, where semantic vectors and data tags are compiled into executable strategy code. The strategy management module acts as the central nervous system, driving the risk assessment model to conduct comprehensive analysis and simultaneously injecting risk signals back into the knowledge graph for dynamic updates through feedback loops. The governance module serves as the foundational support infrastructure, with its blockchain nodes connecting all functional modules in a peer-to-peer manner. This not only provides textual traceability and notarization for the compliance response system and maintains the data lineage chain for the data cognition system, but also captures real-time state changes of the strategy engine for distributed ledger recording. Ultimately, this forms a verifiable governance closed loop that runs through the entire chain of analysis, decision-making, and execution, enabling risk warning signals to reach all terminal systems within 150 milliseconds.

[0135] The system's operation begins with dual-source perception of the regulatory environment and business scenarios: when new regulatory documents are uploaded to the compliance response system, its NLP engine immediately initiates a multi-stage parsing process, extracting the obligated parties and constraints through semantic role labeling, and simultaneously updating the clause mapping relationships in the knowledge graph; at the same time, business data flows through the multimodal cognitive system, triggering dynamic scenario classification, and the graph neural network generates scenario-sensitive labels while constructing the data asset association topology. In the strategy generation stage, dual-source feature vectors are fed into the strategy management framework, and the finite state converter compiles them into machine-executable code, which is then optimized by a conflict detection algorithm to output a containerized strategy package. Subsequently, the three-dimensional risk assessment model initiates multi-dimensional parallel computation: data value weights are industry-specifically calibrated through the DSM matrix, threat levels are mapped to 114 attack modes in the ATT&CK tactical framework, and threat intelligence APIs inject vulnerability situational data in real time. The three are integrated to generate a risk heatmap to guide strategy prioritization. Finally, in the execution and verification phase, the containerization strategy is deployed in seconds on the Kubernetes cluster, and all operation traces are timestamped and stored through blockchain sharding technology. Supervisors can trace back the entire decision-making chain through the audit trail interface. The entire process from data input to policy effectiveness is compressed to within 15 seconds, and the governance strategy is dynamically evolved through a continuous risk reassessment mechanism.

[0136] This intelligent data security compliance management system achieves second-level parsing of 10,000-character-level regulatory texts through the Transformer-XL architecture (average response speed improved by 47 times). Combined with multimodal alignment technology, it improves the scene classification accuracy to F1=0.924, which can significantly reduce the cost of manual compliance. Its risk modeling integrates the DSM matrix, ATT&CK framework and real-time threat intelligence, which improves the APT attack prediction accuracy by 62% and achieves policy conflict resolution in 50ms through the Nash equilibrium algorithm. The blockchain evidence storage base reconstructs the audit process, improving traceability efficiency and reducing verification costs.

[0137] like Figure 5 As shown, this embodiment of the invention also provides a method for cyberspace data security compliance management based on artificial intelligence technology, including: S100: Parse regulatory documents through the real-time compliance response module and output structured clause information; S200 processes business data through the deep data cognition module to generate scene tags; S300 receives clause information and scenario tags through the dynamic policy management module, compiles them into executable policy code, and resolves policy conflicts. S400: Conduct risk assessments using a risk assessment model and output a risk heatmap to guide strategy planning; S500: Implement policies and perform audit and evidence storage through the unified governance module; Each step is connected to the blockchain network via a system bus, forming a closed-loop governance process.

[0138] Methods for parsing regulatory documents include: using the Transformer-XL model to perform semantic parsing of regulatory texts and dynamically updating the compliance knowledge graph.

[0139] Methods for resolving strategic conflicts include: The optimal strategy combination is calculated based on Nash equilibrium theory, and conflict resolution is completed within 50 milliseconds.

[0140] The methods for conducting risk assessment include: calculating the risk entropy value based on the DSM-ATT&CK fusion matrix and the risk entropy value formula, and generating a risk heat map.

[0141] Methods for auditing and evidence preservation include: using blockchain sharding technology to distribute policy execution events to different shards for processing and evidence preservation.

[0142] Figure 6 A structural block diagram of the electronic device provided in the embodiments of the present invention, such as... Figure 6 As shown, the electronic device may include a processor 610, a communications interface 620, a memory 630, and a communication bus 640, wherein the processor 610, the communications interface 620, and the memory 630 communicate with each other via the communication bus 640. The processor 610 can call logical instructions in the memory 630 to execute the following methods: S100: Parse regulatory documents through the real-time compliance response module and output structured clause information; S200 processes business data through the deep data cognition module to generate scene tags; S300 receives clause information and scenario tags through the dynamic policy management module, compiles them into executable policy code, and resolves policy conflicts. S400: Conduct risk assessments using a risk assessment model and output a risk heatmap to guide strategy planning; S500: Implement policies and perform audit and evidence storage through the unified governance module; Each step is connected to the blockchain network via a system bus, forming a closed-loop governance process.

[0143] Furthermore, the logical instructions in the aforementioned memory 630 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0144] This invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, is implemented to perform the methods provided in the above embodiments.

[0145] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of various embodiments or some parts of embodiments.

[0146] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A cyberspace data security compliance management system based on artificial intelligence technology, characterized in that, include: The real-time compliance response module is used to parse regulatory documents and output structured clause information; The deep data cognition module is used to process business data and generate scene tags; The dynamic policy management module connects the real-time compliance response module and the deep data cognition module. It is used to receive the clause information and scenario tags, compile them into executable policy code, and resolve policy conflicts based on the conflict arbitration algorithm. The risk assessment model connects the dynamic strategy management module and the deep data cognition module. It is used to perform risk assessment based on the fusion matrix and risk entropy algorithm, and output a risk heat map to the dynamic strategy management module to guide strategy orchestration. The unified governance module, connected to the dynamic policy management module, is used to execute policies and perform auditing and evidence storage through blockchain sharding technology. Each module interacts and connects with the blockchain network through a system bus, forming a closed-loop governance system from data parsing, strategy generation, risk assessment to execution auditing.

2. The cyberspace data security compliance management system based on artificial intelligence technology according to claim 1, characterized in that, The real-time compliance response module includes a natural language processing engine based on the Transformer-XL architecture, with the following hyperparameters configured: no fewer than 12 layers, no fewer than 1024 hidden units, no fewer than 16 heads, and a sequence length of no less than 10240 characters.

3. The cyberspace data security compliance management system based on artificial intelligence technology according to claim 1, characterized in that, The deep data cognition module adopts an architecture that integrates a visual-text aligned multimodal pre-trained model with a heterogeneous graph neural network to process heterogeneous data such as text, images, and logs.

4. The cyberspace data security compliance management system based on artificial intelligence technology according to claim 1, characterized in that, The dynamic policy management module includes: Finite state converters are used to construct policy state machines; The strategy is a code compiler used to generate executable strategies; A conflict arbitration algorithm based on Nash equilibrium is used to resolve policy conflicts within 50 milliseconds.

5. The cyberspace data security compliance management system based on artificial intelligence technology according to claim 1, characterized in that, The risk assessment model is constructed by fusing the DSM matrix and the ATT&CK framework. The risk entropy value algorithm is: R = α·log(1+β^γ); Where R is the risk entropy value, α is the data value coefficient, β is the threat intensity coefficient, and γ is the exposure surface coefficient.

6. The cyberspace data security compliance management system based on artificial intelligence technology according to claim 1, characterized in that, The data value coefficient α is quantified based on multiple dimensions, including data type, sensitivity, data volume, usage frequency, and storage location; the threat intensity coefficient β is quantified based on multiple dimensions, including threat type, frequency, source, and impact range; and the exposure surface coefficient γ is quantified based on multiple dimensions, including data access permissions, network exposure, encryption status, and security protection measures.

7. A method for cyberspace data security compliance management based on artificial intelligence technology, based on the system described in any one of claims 1-6, characterized in that, The method includes: The real-time compliance response module parses regulatory documents and outputs structured clause information. The deep data cognition module processes business data and generates scene tags. The dynamic policy management module receives the terms information and scenario tags, compiles them into executable policy code, and resolves policy conflicts. Risk assessment is conducted using a risk assessment model, and a risk heatmap is generated to guide strategy development. The strategy is executed and audited using the unified governance module; Each step is connected to the blockchain network via a system bus, forming a closed-loop governance process.

8. The cyberspace data security compliance management method based on artificial intelligence technology according to claim 7, characterized in that, The method for parsing regulatory documents includes: using the Transformer-XL model to perform semantic parsing of the regulatory text and dynamically updating the compliance knowledge graph.

9. The cyberspace data security compliance management method based on artificial intelligence technology according to claim 7, characterized in that, The methods for resolving strategy conflicts include: The optimal strategy combination is calculated based on Nash equilibrium theory, and conflict resolution is completed within 50 milliseconds.

10. The cyberspace data security compliance management method based on artificial intelligence technology according to claim 7, characterized in that, The method for risk assessment includes: calculating the risk entropy value based on the DSM-ATT&CK fusion matrix and the risk entropy value formula, and generating a risk heat map.

11. The cyberspace data security compliance management method based on artificial intelligence technology according to claim 7, characterized in that, The method for auditing and storing evidence includes: using blockchain sharding technology to distribute policy execution events to different shards for processing and evidence storage.

Images