Intelligent operation risk prevention and control method, device and equipment based on digital twinning and behavior analysis

Abstract

The embodiment of the invention relates to the technical field of operation risk control, and discloses an intelligent operation risk prevention and control method, device and equipment based on digital twinning and behavior analysis, and the method comprises the steps: obtaining an operation intention and operation key features of a to-be-executed operation; performing prediction processing on the operation intention, the knowledge graph and the operation key features by using a risk assessment model, and outputting an operation risk score of the to-be-executed operation, wherein context information, operation environment information and historical operation information related to the to-be-executed operation are stored in the knowledge graph; simulation execution of the to-be-executed operation in the digital twin environment is determined based on the operation risk score, and simulation feedback information is collected; and generating an operation authority for executing the to-be-executed operation based on the simulation feedback information so as to execute the to-be-executed operation based on the operation authority in the real environment. By fusing various information, the operation risk is scored by using the risk assessment model before the to-be-executed operation is executed, so that the accuracy, timeliness and intelligent level of high-risk operation identification are improved.

Description

Technical Field

[0001] This invention relates to the field of operational risk management technology, and in particular to an intelligent operational risk prevention and control method, device and equipment based on digital twin and behavioral analysis. Background Technology

[0002] In existing technologies for operational risk management, high-risk operations are primarily identified and blocked through post-event audits using a combination of manual methods and fixed rules. This approach is inefficient in preventing the timely blocking of high-risk operations and has low efficiency in identifying them. Furthermore, fixed rules typically involve checking the format of operational commands to determine if an operation is high-risk. Therefore, existing operational management technologies suffer from poor accuracy and efficiency in identifying high-risk operations, as well as significant delays in blocking them. Summary of the Invention

[0003] The purpose of this invention is to provide at least one intelligent operation risk prevention and control method, device and equipment based on digital twin and behavior analysis, which can at least solve the technical problems of poor accuracy and low efficiency in identifying high-risk operations and high delay in blocking high-risk operations when performing operation control. It can at least improve the accuracy and efficiency of identifying high-risk operations and reduce the delay in blocking high-risk operations.

[0004] To address the aforementioned technical problems, at least one embodiment of this application provides an intelligent operational risk prevention and control method based on digital twins and behavioral analysis, comprising: acquiring the operational intent and key operational features of an operation to be executed, wherein the key operational features include the technical attributes and operational behavioral characteristics of the operation to be executed; using a risk assessment model to predict and process the operational intent, knowledge graph, and key operational features, and outputting an operational risk score for the operation to be executed, wherein the knowledge graph stores contextual information, operational environment information, and historical operational information related to the operation to be executed; determining, based on the operational risk score, to simulate the execution of the operation to be executed in a digital twin environment, and collecting simulation feedback information; generating operational permissions for executing the operation to be executed based on the simulation feedback information, so as to execute the operation to be executed in a real environment based on the operational permissions.

[0005] This solution integrates the operational intent, technical attributes, and multimodal operational behavior characteristics of the operation to be executed, and combines this with a knowledge graph containing embedded contextual information, environmental status, and historical behavior. It utilizes a risk assessment model to score the operational risk before execution, significantly improving the accuracy, timeliness, and intelligence of high-risk operation identification, thereby increasing identification efficiency. Furthermore, by conducting accurate risk assessments before execution, high-risk operations can be easily intercepted upon identification, greatly reducing delays in blocking them. In addition, by pre-simulating the execution of the operation in a digital twin environment isolated from the production environment and collecting simulated feedback information, the solution accurately assesses the potential impact before actual execution, dynamically generating minimal operational permissions, thus shifting from "passive defense" to "proactive prediction—simulation verification—dynamic authorization—final execution." This not only effectively solves the problems of low risk identification efficiency, high false positive / false negative rates, and large blocking delays in traditional solutions, but also fundamentally avoids the risk of system interruption and data leakage due to misoperation or malicious commands, significantly improving the security, compliance, and automation of operations and maintenance.

[0006] In some examples, determining to simulate the execution of the operation to be performed in the digital twin environment based on the operation risk score includes: if the operation risk score is lower than a preset risk threshold, then determining to simulate the execution of the operation to be performed in the digital twin environment; if the operation risk score is not lower than the preset risk threshold, then generating an interception operation to intercept the operation to be performed.

[0007] In some examples, generating the operation permission to perform the operation to be performed based on the simulated feedback information includes: obtaining the business impact model corresponding to the operator; analyzing and predicting the simulated feedback information based on the business impact model to predict the operation impact information; generating temporary operation permission based on the operation impact information and the simulated feedback information; and using the temporary operation permission as the operation permission to perform the operation to be performed.

[0008] In some examples, generating temporary operation permissions based on the operation impact information and the simulated feedback information includes: if the operation impact information does not contain or does not simultaneously contain deletion of critical data, permission overreach behavior, and service availability fluctuations, generating temporary operation permissions based on ABAC permission rules, the operation impact information, and the simulated feedback information; wherein, the temporary operation permissions only include the operation resources and operation types for executing the operation to be executed as fed back in the simulated feedback information, are limited to the impact range determined in the operation impact information, and are the minimum operation permissions that match the operator information in the simulated feedback information, the operator information including the operator's identity and responsibilities.

[0009] In some examples, the temporary operation permission includes an operation period, and the method further includes: if the current time is not within the operation period, and any time within the operation period is earlier than the current time, then the temporary operation permission is revoked.

[0010] In some examples, the method further includes: acquiring multimodal behavioral characteristics of the operator, wherein the multimodal behavioral characteristics are the operator's operational behavior acquired when simulating the execution of the operation to be executed in a digital twin environment; performing behavioral anomaly analysis on the multimodal behavioral characteristics based on a local behavioral model to obtain at least one abnormal operational behavior; generating an internal threat alert based on at least one of the abnormal operational behaviors and temporarily blocking the operation to be executed; verifying the internal threat alert, and if the verification is successful, lifting the temporary blockage on the operation to be executed.

[0011] In some examples, the method further includes: sending the model parameters of the local behavior models to a central server, so that the central server can perform aggregate training on the acquired model parameters of each local behavior model based on a federated learning mechanism to obtain a global behavior model for cross-regional analysis of operator behavior.

[0012] At least one embodiment of this application also provides an intelligent operation risk prevention and control device based on digital twin and behavior analysis, comprising: an acquisition unit, configured to acquire the operation intent and key operation features of an operation to be executed, wherein the key operation features include the technical attributes and operation behavior features of the operation to be executed; a prediction unit, configured to use a risk assessment model to predict the operation intent, knowledge graph and key operation features and output an operation risk score for the operation to be executed, wherein the knowledge graph stores context information, operation environment information and historical operation information related to the operation to be executed; a determination unit, configured to determine, based on the operation risk score, to simulate the execution of the operation to be executed in a digital twin environment and collect simulation feedback information; and a generation unit, configured to generate operation permissions for executing the operation to be executed based on the simulation feedback information, so as to execute the operation to be executed in a real environment based on the operation permissions.

[0013] At least one embodiment of this application also provides an electronic device, including: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the above-described intelligent operation risk prevention and control method based on digital twin and behavior analysis.

[0014] At least one embodiment of this application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described intelligent operation risk prevention and control method based on digital twins and behavior analysis. Attached Figure Description

[0015] One or more embodiments are illustrated by way of example with reference to the accompanying drawings, and these illustrative descriptions do not constitute a limitation on the embodiments.

[0016] Figure 1 This is a flowchart of an intelligent operational risk prevention and control method based on digital twin and behavior analysis provided in one embodiment of this application; Figure 2 This is a schematic diagram illustrating the identification of high-risk operations provided in one embodiment of this application; Figure 3 This is a schematic diagram illustrating the generation of temporary operation permissions provided in one embodiment of this application; Figure 4 This is a schematic diagram illustrating the identification of abnormal operational behavior provided in one embodiment of this application; Figure 5 This is a schematic diagram of an intelligent operational risk prevention and control device based on digital twin and behavior analysis provided in another embodiment of this application; Figure 6 This is a schematic diagram of the structure of an electronic device provided in another embodiment of this application. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the various embodiments of this application will be described in detail below with reference to the accompanying drawings. However, those skilled in the art will understand that many technical details have been provided in the various embodiments of this application to help readers better understand this application. However, the technical solutions claimed in this application can be implemented even without these technical details and various changes and modifications based on the following embodiments. The division of the various embodiments below is for the convenience of description and should not constitute any limitation on the specific implementation of this application. The various embodiments can be combined with and referenced by each other without contradiction.

[0018] It should be noted that the acquisition or use of data in the embodiments of this application requires the user's consent. The relevant data can only be obtained after the user's authorization, and the acquisition or use of the data complies with the provisions of relevant laws and regulations.

[0019] To facilitate understanding of the embodiments of this application, the relevant content of the intelligent operation risk prevention and control method based on digital twin and behavior analysis will be introduced first.

[0020] In existing technologies for operational risk management, high-risk operations are primarily identified and blocked through post-event audits using a combination of manual methods and fixed rules. This approach is inefficient in preventing the timely blocking of high-risk operations and has low efficiency in identifying them. Furthermore, fixed rules typically involve checking the format of operational commands to determine if an operation is high-risk. Therefore, existing operational management technologies suffer from poor accuracy and efficiency in identifying high-risk operations, as well as significant delays in blocking them.

[0021] To address the aforementioned technical problems, this invention proposes an intelligent operational risk prevention and control method based on digital twins and behavioral analysis. The implementation details of this embodiment of the intelligent operational risk prevention and control method based on digital twins and behavioral analysis are described below. The following implementation details are provided for ease of understanding and are not essential for implementing this solution.

[0022] Example 1: The intelligent operation risk prevention and control method based on digital twin and behavior analysis in this embodiment can be applied to electronic devices with communication, computing, and data storage capabilities. Its specific process can be as follows: Figure 1 As shown, it includes: Step 110: Obtain the operation intent and key characteristics of the operation to be executed. The key characteristics of the operation include the technical attributes and operational behavior characteristics of the operation to be executed.

[0023] Here, "operation to be executed" refers to an operation initiated by an operator but not yet executed or completed. For example, an operation to be executed could be a server restart initiated by an operations engineer, a database deletion operation initiated by a database administrator, or an operation granting database permissions to user B for database C initiated by a system administrator. "Operation intent" refers to the purpose for which the operator initiates the operation to be executed. "Key operation characteristics" refers to the core information set that characterizes the nature, risks, impacts, and modes of the operation to be executed, used to assess its operational risks. "Technical attributes" refers to the inherent technical parameters and static characteristics of the operation to be executed, including one or more of the following: operation object, execution method, scope of impact, permissions, execution environment, and resource consumption information. "Operational behavior characteristics" refers to the dynamic behavior patterns, time patterns, command composition, and interactive behaviors corresponding to the execution of the operation to be executed. Operational behavior characteristics include at least an operation command sequence and an operation command timing sequence. An operation command sequence refers to the combination of operation commands that the operator must execute sequentially when completing the operation to be executed. An operation command timing sequence refers to the time distribution, frequency, and intervals of the executed operation commands.

[0024] Specifically, Natural Language Processing (NLP) technology can be used to parse the operation to be executed in order to obtain the operation intent and key features of the operation. For example, when an operator initiates the operation "Query the travel expense reimbursement records of the sales department in the third quarter of 2024" on the terminal interface of the audit system, NLP is used to perform word segmentation on the operation to be executed, dividing the operation into multiple words, namely "query", "sales department", "2024", "third quarter", "of", "travel expenses", "reimbursement", and "records", and the part of speech of each word is labeled, corresponding to verb, noun, time word, time word, auxiliary word, noun, verb, and noun, respectively. Based on the verb-type query and the adjacent "sales department," it is inferred that "query" is a partial operational intent. Based on the verb-type "reimbursement" and the adjacent "travel expenses" and "records," it is inferred that "reimbursement expenses" is a partial operational intent. Combining these two operational intents, the operational intent is inferred to be "query reimbursement expenses." Words belonging to the target part of speech are used as key operational features. The target part of speech can be nouns, verbs, time words, etc., specifically "query," "sales department," "2024," "third quarter," "travel expenses," "reimbursement," and "records." Thus, natural language processing technology can perform deep semantic continuation on the input operation to be executed, accurately identify the operational intent of the operation to be executed, and extract structured key operational features. This overcomes the limitations of traditional keyword matching methods, which rely on poor keyword matching to determine operational intent and key features, resulting in poor accuracy and low generalization ability. By achieving a leap from "literal matching" to "semantic understanding," the intelligence level of operational intent recognition and the completeness of key feature extraction are significantly improved, providing a highly reliable decision-making basis for subsequent operational risk scoring and assessment.

[0025] Step 120: Use the risk assessment model to predict and process the operation intention, knowledge graph and key operation features and output the operation risk score of the operation to be executed. The knowledge graph stores contextual information, operation environment information and historical operation information related to the operation to be executed.

[0026] The risk assessment model is a deep reinforcement learning model that combines a knowledge graph with key operational features and intentions to assess risk and obtain an operational risk score. The operational risk score is a quantitative indicator used to evaluate the potential risk level of executing the operation; a higher score indicates a higher risk level. The knowledge graph is a structured semantic network used to represent entities and relationships between them; entities can be operators, servers, or databases. Contextual information refers to real-time dynamic environmental information related to the operation, used to determine the rationality and compliance of the operation in the current time, space, and business state. It also includes the current state of assets related to the operation, determining whether they are in a state that meets operational requirements. Operational environment information refers to the status and configuration information of the basic infrastructure supporting the operation, such as network topology, system resources, and security configurations. Historical operation information refers to past operation records related to the operation.

[0027] Specifically, a risk assessment model is used to predict and process operational intent, knowledge graph, and key operational features, and output an operational risk score for the operation to be executed. This includes: querying the knowledge graph to obtain contextual information, operational environment information, and historical operation information related to the operation to be executed; encoding the operational intent, key operational features, and contextual information, operational environment information, and historical operation information extracted from the knowledge graph, fusing them to generate a joint state vector, which serves as the input to the risk assessment model; and using the risk assessment model to predict and process the joint state vector to dynamically generate an operational risk score for the operation to be executed. The risk assessment model is a neural network model based on deep reinforcement learning, and its score generation process comprehensively considers at least the risk level of the operational intent, the degree of matching of operational permissions in the key operational features, the environmental stability described by the operational environment information, the environmental rationality described by the contextual information, and the sensitivity of the command.

[0028] Therefore, by constructing a multi-dimensional risk assessment mechanism that integrates operational intent, key operational features, and a knowledge graph, the accuracy of identifying potential security threats and the level of intelligent response are significantly improved. Specifically, based on acquiring operational intent and key operational features, contextual information, operational environment information, and historical operational information are further extracted from the knowledge graph and uniformly encoded into a joint state vector as input to a deep reinforcement learning model, achieving a leap from isolated command analysis to global situational awareness. During the scoring process, this model comprehensively considers multiple dimensions of factors, including the risk level of operational intent, operational permission matching, environmental stability, contextual rationality, and command sensitivity, enabling dynamic and accurate quantification of operational risks and effectively distinguishing between normal operational behavior and potential malicious operations. Compared to traditional risk judgment methods that rely on static rules or keyword matching, this solution possesses stronger semantic understanding capabilities, contextual adaptability, and the ability to generalize abnormal behavior recognition, significantly reducing the false positive and false negative rates of high-risk operations.

[0029] Step 130: Based on the operational risk score, determine the operation to be performed in the digital twin environment and collect simulation feedback information.

[0030] Among them, simulated feedback information refers to a set of structured response data generated when an operation to be executed is performed in a digital twin environment. The response data includes each execution process of the operation to be executed and the corresponding execution results. The response data includes, but is not limited to, the operation resources, operation type, operation path, execution sequence, call chain and response status of service interfaces, permission verification process and out-of-bounds access attempts, and chain reactions of downstream dependent components. It can be used to predict and reflect the technical impact and business consequences that the operation to be executed may cause if it is executed in a real production environment.

[0031] Specifically, in step 130 above, determining to simulate the execution of the operation to be executed in the digital twin environment based on the operation risk score includes: if the operation risk score is lower than a preset risk threshold, then determining to simulate the execution of the operation to be executed in the digital twin environment; if the operation risk score is not lower than the preset risk threshold, then generating an interception operation to intercept the operation to be executed.

[0032] The preset risk threshold is a pre-set value used to determine whether the operation to be executed, corresponding to the operation risk score, is a dangerous operation. If the operation risk score is not lower than the preset risk threshold, the operation to be executed is considered a high-risk operation and cannot be executed. If the operation risk score is lower than the preset risk threshold, the operation to be executed is considered a medium-to-low-risk operation and can be executed in the digital twin environment. The digital twin environment is a virtual environment that is isolated from the production environment but identical to it. Containerization technology is used in the sandbox environment to quickly clone the operating state and configuration of the production environment, establishing a digital twin environment that is completely isolated from the production environment but functionally identical. Therefore, the digital twin environment not only replicates the infrastructure of the production environment but also includes the current data state and operating parameters of the production environment, ensuring consistency between the digital twin environment and the production environment. This ensures that simulating the execution of the operation to be executed in the digital twin environment can realistically reflect the impact on the production environment.

[0033] For example, such as Figure 2 As shown, the operation to be executed first undergoes NLP processing to obtain the operation intent and key operation features. A risk assessment model is then used to predict the operation intent, knowledge graph, and key operation features, outputting an operation risk score for the operation to be executed. If the operation risk score is lower than a preset risk threshold, the operation to be executed is simulated in a digital twin environment; if the operation risk score is not lower than the preset risk threshold, an interception operation is generated to intercept the operation to be executed.

[0034] Furthermore, to ensure the efficiency of simulating and executing operations within a digital twin environment, lightweight virtualization technologies can be used to quickly build the digital twin environment, enabling rapid start-up and shutdown. Lightweight virtualization technologies include containers, gVisor, Firecracker, and eBPF (extended Berkeley Packet Filter, a programmable engine).

[0035] In some examples, the method also includes optimizing the risk assessment model based on simulated feedback and pending operations. Thus, by continuously optimizing the risk assessment model using simulated feedback and pending operations, the risk assessment model achieves self-evolution in its risk identification capabilities. Each operational simulation provides the risk assessment model with realistic, high-fidelity training data, enabling it to continuously adapt to new attack patterns and complex operational scenarios. Ultimately, the risk assessment model possesses stronger generalization ability and prediction accuracy.

[0036] Step 140: Generate operation permissions for the operation to be executed based on the simulated feedback information, so as to execute the operation to be executed in the real environment based on the operation permissions.

[0037] Specifically, in step 140 above, generating the operation permission to execute the operation to be executed based on the simulated feedback information includes: obtaining the business impact model corresponding to the operator; analyzing and predicting the simulated feedback information based on the business impact model to predict the operation impact information; generating temporary operation permission based on the operation impact information and the simulated feedback information; and using the temporary operation permission as the operation permission to execute the operation to be executed.

[0038] Operational impact information refers to a set of structured data regarding the technical and business impacts caused by the execution of an operation. This information may include one or more of the following: operational resources, operational scope, data change scope, service availability fluctuations, permission overreach, and chain reactions of dependent components. Temporary operational permissions refer to permissions temporarily granted to the operator performing the operation. These permissions are only effective under certain conditions, such as a specified time period, a specified operational scope, a specified operation type, and a specified operator. The business impact model refers to a personalized risk profile and behavioral prediction model built for each operator (user, role, or organizational unit) to assess the potential impact of their execution of a specific operation on system stability, data security, and business continuity.

[0039] Furthermore, temporary operation permissions are generated based on operation impact information and simulated feedback information. This includes: if the operation impact information contains deletion of critical data, permission overreach, or service availability fluctuations, an interception alarm is generated to intercept the operation to be executed. If the operation impact information does not contain or does not simultaneously contain deletion of critical data, permission overreach, or service availability fluctuations, temporary operation permissions are generated based on ABAC permission rules, operation impact information, and simulated feedback information. These temporary operation permissions only include the operation resources and operation type for executing the operation to be executed as reported in the simulated feedback information, are limited to the impact scope determined in the operation impact information, and are the minimum operation permissions that match the operator information in the simulated feedback information, including the operator's identity and responsibilities.

[0040] ABAC permission rules are a dynamic access control mechanism that uses multi-dimensional attributes (such as operation type, operation resources, operator information, and operation scope) as the core judgment criteria to determine the minimum permissions that satisfy these attributes. Temporary operation permissions include operation time period, operation scope, and operation type. The operation scope refers to the range of resources available for the operation to be performed. Temporary operation permissions are used to strictly limit the operator to only be able to perform operations of the same type on resources within the operation scope during the operation time period.

[0041] In some examples, temporary operation permissions include an operation period, and the method also includes: if the current time is not within the operation period, and any time within the operation period is earlier than the current time, then the temporary operation permission is revoked.

[0042] For example, such as Figure 3 As shown, the operation to be executed is simulated in the digital twin environment, and simulated feedback information is collected. Based on the business impact model, the simulated feedback information is analyzed and predicted to obtain the operation impact information. If the impact assessment of the operation impact information is satisfactory, a temporary operation permission is generated. If any time within the operation period corresponding to the temporary operation permission is earlier than the current time, the temporary operation permission is revoked. If the impact assessment of the operation impact information is unsatisfactory, an interception alarm is generated to intercept the operation to be executed.

[0043] Specifically, if the operational impact information includes deletion of critical data, unauthorized access, or fluctuations in service availability, the impact assessment of the operational impact information is considered unsuccessful. If the operational impact information does not contain, or does not simultaneously contain, deletion of critical data, unauthorized access, or fluctuations in service availability, the impact assessment of the operational impact information is considered successful.

[0044] Therefore, by constructing a digital twin environment that is completely isolated from the production environment, dynamic and refined control of temporary operation permissions for operations to be performed can be achieved while ensuring the safety of the production environment. Temporary operation permissions can be revoked after the operation period, forming a complete closed loop of permission lifecycle management of "pre-rehearsal-authorization-revocation".

[0045] In some examples, the method further includes: acquiring the multimodal behavioral characteristics of the operator, which are the operator's operational behaviors obtained when simulating the execution of the operation to be executed in a digital twin environment; performing behavioral anomaly analysis on the multimodal behavioral characteristics based on a local behavioral model to obtain at least one abnormal operational behavior; generating an internal threat alert based on at least one abnormal operational behavior and temporarily blocking the operation to be executed; verifying the internal threat alert, and if the verification is successful, lifting the temporary blockade on the operation to be executed.

[0046] Among them, the operator's multimodal behavioral characteristics refer to data reflecting the operator's operating habits and interaction patterns, obtained when the operator simulates the execution of the operation to be performed in a digital twin environment. Examples include the operator's keyboard behavior (e.g., typing speed, keystroke duration, key pressure, double-key interval, etc.), mouse behavior (mouse movement trajectory, click frequency, hover time, dragging mode, etc.), conversational interaction patterns (e.g., number of command input corrections, frequently used keys, etc.), and operation sequence (the intervals between the operator pressing keys, using the mouse, and entering commands). The local behavior model refers to a model specifically designed to identify whether the operator's multimodal behavioral characteristics are abnormal, built based on the operator's historical multimodal behavioral characteristics.

[0047] For example, such as Figure 4As shown, the local behavior model is used to analyze the multimodal behavioral characteristics of the operator. If abnormal operational behavior is found, an internal threat alarm is generated. If no abnormal operational behavior is found, the operator's behavior is determined to be normal and no alarm is generated.

[0048] Specifically, if no abnormal operation occurs or the temporary block on the operation to be executed is lifted, the operation will be executed in the production environment based on temporary operation permissions. If the temporary block on the operation to be executed is not lifted within a preset time, an interception alarm will be generated to block the operation, preventing it from being executed in the production environment. The production environment refers to the actual environment in which the operation to be executed is performed.

[0049] Specifically, internal threat alerts include unusual operational behavior. If management determines that the unusual operational behavior is a non-compliant but non-routine action, the verification is approved; if management confirms that the behavior has malicious intent or a serious risk of unauthorized access, the verification is rejected.

[0050] Specifically, multimodal behavioral characteristics of operators can be collected in real time based on low-intrusion terminal agents.

[0051] In addition, the method also includes optimizing the local behavior model based on multimodal behavioral features and the results of anomaly analysis.

[0052] Therefore, by collecting multimodal behavioral characteristics (such as keyboard actions, mouse movement trajectories, and operation sequences) of operators in real time during the execution of tasks within the digital twin environment, and performing fine-grained anomaly analysis based on a localized behavioral model, potential internal threat behaviors (such as account impersonation and unauthorized operation patterns) can be accurately identified without relying on static permission rules. When abnormal operation behavior is detected, the system immediately generates an internal threat alert and temporarily blocks the operation, achieving proactive risk interception and effectively preventing the spread of misoperations or malicious behavior to the digital twin environment. Simultaneously, a manual verification mechanism is introduced, automatically lifting the block after confirming a false alarm or a legitimate special operation, balancing security and operational efficiency. This mechanism achieves closed-loop control of "behavior perception, risk interception, and response recovery," significantly improving the detection capability and handling flexibility of concealed internal threats, and enhancing the overall system's proactive defense level and behavioral compliance auditing capabilities.

[0053] In some examples, the method also includes sending the model parameters of the local behavior models to a central server, which then performs aggregate training on the acquired model parameters of each local behavior model based on a federated learning mechanism, to obtain a global behavior model for cross-regional analysis of operator behavior.

[0054] Specifically, sending the model parameters of the local behavior model to the central server includes: sending the optimized model parameters of the local behavior model to the central server.

[0055] Specifically, before sending the model parameters of the local behavior model to the central server, the method further includes: encrypting the model parameters and sending the encrypted model parameters to the central server.

[0056] Therefore, a federated learning architecture is adopted, uploading only encrypted model parameters to a central server for secure aggregation and global model updates. Under the premise of data remaining within its domain and privacy being protected, collaborative learning of user behavior patterns and sharing of threat awareness capabilities across departments and network domains are achieved. This effectively breaks down the data silos problem in traditional security systems, constructing a highly privacy-protected, low-impact, and continuously evolving organization-wide intelligent threat awareness network. It can not only identify known attack patterns but also discover new internal threats through anomaly detection, significantly enhancing the ability to detect hidden internal anomalies such as internal threats, account theft, and privilege abuse. This improves the accuracy of identifying dangerous and abnormal operations.

[0057] In summary, this application obtains the operational intent and key operational features of the operation to be executed, including the technical attributes and behavioral characteristics of the operation. It then uses a risk assessment model to predict and process the operational intent, knowledge graph, and key operational features, outputting an operational risk score for the operation. The knowledge graph stores contextual information, operational environment information, and historical operation information related to the operation. Based on the operational risk score, it determines whether to simulate the execution of the operation in a digital twin environment and collects simulation feedback information. Finally, it generates operational permissions for the operation based on the simulation feedback information, enabling the operation to be executed in a real environment based on these permissions. By integrating the operational intent, technical attributes, and multimodal behavioral characteristics of the operation to be executed, and combining this with the knowledge graph containing embedded contextual information, environmental state, and historical behavior, the application utilizes a risk assessment model to score the operational risk before the operation is executed. This significantly improves the accuracy, timeliness, and intelligence of high-risk operation identification, thereby increasing identification efficiency. Furthermore, by conducting accurate risk assessment before the operation is executed, it is easier to intercept high-risk operations when they are identified, greatly reducing the delay in blocking high-risk operations. Furthermore, by rehearsing the execution of pending operations and collecting simulated feedback information in a digital twin environment isolated from the production environment, the potential impact of pending operations can be accurately assessed before actual execution. Minimum operation permissions are dynamically generated, achieving a shift from "passive defense" to "proactive prediction—simulation verification—dynamic authorization—final execution," and significantly reducing the risks of directly executing pending operations in the production environment. This not only effectively solves the problems of low risk identification efficiency, high false positive and false negative rates, and large blocking delays in traditional solutions, but also fundamentally avoids the risks of system interruptions and data leaks caused by misoperation or malicious commands, greatly improving the security, compliance, and automation of operation and maintenance.

[0058] Example 2: Another embodiment of this application relates to an intelligent operation risk prevention and control device based on digital twin and behavior analysis. The implementation details of this embodiment are described below. The following content is only for ease of understanding and is not essential for implementing this solution. A schematic diagram of the intelligent operation risk prevention and control device 50 based on digital twin and behavior analysis in this embodiment can be seen as follows: Figure 5 As shown, it includes an acquisition unit 501, a prediction unit 502, a determination unit 503, and a generation unit 504.

[0059] The acquisition unit 501 is used to acquire the operation intent and key operation features of the operation to be executed. The key operation features include the technical attributes and operation behavior features of the operation to be executed.

[0060] The prediction unit 502 is used to use a risk assessment model to predict the operation intention, knowledge graph and key operation features and output the operation risk score of the operation to be executed. The knowledge graph stores context information, operation environment information and historical operation information related to the operation to be executed.

[0061] The determining unit 503 is used to determine, based on the operation risk score, to simulate the execution of the operation to be performed in the digital twin environment, and to collect simulation feedback information.

[0062] The generation unit 504 is used to generate operation permissions for executing the operation to be executed based on the simulated feedback information, so as to execute the operation to be executed in a real environment based on the operation permissions.

[0063] In some examples, when the determining unit 503 is used to determine, based on the operation risk score, to simulate the execution of the operation to be executed in the digital twin environment, it is specifically used to: if the operation risk score is lower than a preset risk threshold, determine to simulate the execution of the operation to be executed in the digital twin environment; if the operation risk score is not lower than the preset risk threshold, generate an interception operation to intercept the operation to be executed.

[0064] In some examples, when the generation unit 504 is used to generate the operation permission to perform the operation to be performed based on the simulated feedback information, it is specifically used to: obtain the business impact model corresponding to the operator; analyze and predict the simulated feedback information based on the business impact model to predict the operation impact information; generate temporary operation permission based on the operation impact information and the simulated feedback information; and use the temporary operation permission as the operation permission to perform the operation to be performed.

[0065] In some examples, the generation unit 504, when generating temporary operation permissions based on the operation impact information and the simulated feedback information, is specifically used to: generate temporary operation permissions based on ABAC permission rules, the operation impact information, and the simulated feedback information if the operation impact information does not contain or does not simultaneously contain deletion of key data, permission overreach behavior, and service availability fluctuations; wherein the temporary operation permissions only include the operation resources and operation types for executing the operation to be executed as fed back in the simulated feedback information, are limited to the impact range determined in the operation impact information, and are the minimum operation permissions that match the operator information in the simulated feedback information, the operator information including the operator's identity and responsibilities.

[0066] In some examples, the temporary operation permission includes an operation period, and the generation unit 504 is further configured to: revoke the temporary operation permission if the current time is not within the operation period and any time within the operation period is earlier than the current time.

[0067] In some examples, the acquisition unit 501 is further configured to: acquire the multimodal behavioral characteristics of the operator, wherein the multimodal behavioral characteristics are the operator's operational behavior acquired when simulating the execution of the operation to be executed in a digital twin environment; perform behavioral anomaly analysis on the multimodal behavioral characteristics based on a local behavioral model to obtain at least one abnormal operational behavior; generate an internal threat alert based on at least one of the abnormal operational behaviors and temporarily block the operation to be executed; verify the internal threat alert, and if the verification is successful, lift the temporary block on the operation to be executed.

[0068] In some examples, the generation unit 504 is also used to: send the model parameters of the local behavior model to the central server, so that the central server can aggregate and train the model parameters of each local behavior model based on the federated learning mechanism to obtain a global behavior model for cross-regional analysis of operator behavior.

[0069] It is worth mentioning that all units involved in this embodiment are logical units. In practical applications, a logical unit can be a physical unit, a part of a physical unit, or a combination of multiple physical units. Furthermore, to highlight the innovative aspects of this application, this embodiment does not introduce units that are not closely related to solving the technical problems proposed in this application; however, this does not mean that other units are absent in this embodiment.

[0070] Example 3: Another embodiment of this application relates to an electronic device, such as... Figure 6 As shown, it includes: at least one processor 901; and a memory 902 communicatively connected to the at least one processor 901; wherein the memory 902 stores instructions executable by the at least one processor 901, the instructions being executed by the at least one processor 901 to enable the at least one processor 901 to execute the intelligent operation risk prevention and control method based on digital twin and behavior analysis in the above embodiments.

[0071] The memory and processor are connected via a bus, which can include any number of interconnecting buses and bridges, connecting various circuits of one or more processors and memories. The bus can also connect various other circuits, such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and will not be described further herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be a single element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by the processor is transmitted over the wireless medium via an antenna, which further receives data and transmits it to the processor.

[0072] The processor manages the bus and general processing, and also provides various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory is used to store data used by the processor during operation.

[0073] Example 4: Another embodiment of this application relates to a computer-readable storage medium storing a computer program. When executed by a processor, the computer program implements the method embodiments described above.

[0074] That is, those skilled in the art will understand that all or part of the steps in the methods of the above embodiments can be implemented by a program instructing related hardware. This program is stored in a storage medium and includes several instructions to cause a device (which may be a microcontroller, chip, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0075] Those skilled in the art will understand that the above embodiments are specific embodiments for implementing this application, and in practical applications, various changes can be made to them in form and detail without departing from the spirit and scope of this application.

Claims

1. A method for intelligent operational risk prevention and control based on digital twins and behavioral analysis, characterized in that, include: Obtain the operational intent and key operational features of the operation to be executed, including the technical attributes and operational behavior characteristics of the operation to be executed; The risk assessment model is used to predict the operation intention, knowledge graph and key operation features and output the operation risk score of the operation to be executed. The knowledge graph stores context information, operation environment information and historical operation information related to the operation to be executed. Based on the operational risk score, determine the operation to be performed in a simulated digital twin environment and collect simulation feedback information; Based on the simulated feedback information, operation permissions are generated to execute the operation to be executed, so that the operation to be executed can be performed in a real environment based on the operation permissions.

2. The intelligent operational risk prevention and control method based on digital twin and behavioral analysis according to claim 1, characterized in that, The step of determining the simulated execution of the operation to be performed in the digital twin environment based on the operational risk score includes: If the operation risk score is lower than a preset risk threshold, then it is determined that the operation to be performed will be simulated in a digital twin environment. If the operation risk score is not lower than the preset risk threshold, an interception operation is generated to intercept the operation to be executed.

3. The intelligent operational risk prevention and control method based on digital twin and behavioral analysis according to claim 1, characterized in that, The step of generating operation permissions for the pending operation based on the simulated feedback information includes: Obtain the business impact model corresponding to the operator; Based on the business impact model, the simulated feedback information is analyzed and predicted to obtain operational impact information; Temporary operation permissions are generated based on the operation impact information and the simulation feedback information; The temporary operation permission is used as the operation permission to execute the operation to be executed.

4. The intelligent operational risk prevention and control method based on digital twin and behavioral analysis according to claim 1, characterized in that, The generation of temporary operation permissions based on the operation impact information and the simulated feedback information includes: If the operation impact information does not contain or does not simultaneously contain deletion of critical data, permission overreach behavior, and service availability fluctuations, temporary operation permissions are generated based on ABAC permission rules, the operation impact information, and the simulated feedback information. The temporary operation permission includes only the operation resources and operation type for executing the operation to be executed as reported in the simulated feedback information, and is limited to the scope of influence determined in the operation influence information. It is also the minimum operation permission that matches the operator information in the simulated feedback information, whereby the operator information includes the operator's identity and responsibilities.

5. The intelligent operational risk prevention and control method based on digital twin and behavioral analysis according to claim 4, characterized in that, The temporary operation permission includes an operation period, and the method further includes: If the current time is not within the operation period, and any time within the operation period is earlier than the current time, then the temporary operation permission is revoked.

6. The intelligent operational risk prevention and control method based on digital twin and behavioral analysis according to claim 1, characterized in that, The method further includes: The multimodal behavioral characteristics of the operator are obtained, which are the operator's operational behaviors obtained when the operation to be performed is simulated in a digital twin environment; Based on the local behavior model, the multimodal behavior features are analyzed for behavioral anomalies to obtain at least one abnormal operation behavior. An internal threat alert is generated based on at least one of the aforementioned abnormal operation behaviors, and the operation to be executed is temporarily blocked; the internal threat alert is verified, and if the verification is successful, the temporary block on the operation to be executed is lifted.

7. The intelligent operational risk prevention and control method based on digital twin and behavioral analysis according to claim 6, characterized in that, The method further includes: The model parameters of the local behavior models are sent to the central server, which then performs aggregate training on the acquired model parameters of each local behavior model based on the federated learning mechanism, to obtain a global behavior model for cross-regional analysis of operator behavior.

8. An intelligent operational risk prevention and control device based on digital twin and behavioral analysis, characterized in that, include: The acquisition unit is used to acquire the operation intent and key operation features of the operation to be executed, including the technical attributes and operation behavior features of the operation to be executed. The prediction unit is used to use a risk assessment model to predict the operation intention, knowledge graph and key operation features and output the operation risk score of the operation to be executed. The knowledge graph stores context information, operation environment information and historical operation information related to the operation to be executed. The determining unit is used to determine, based on the operation risk score, how to simulate the execution of the operation to be performed in the digital twin environment, and to collect simulation feedback information; The generation unit is used to generate operation permissions for executing the operation to be executed based on the simulated feedback information, so as to execute the operation to be executed in a real environment based on the operation permissions.

9. An electronic device, characterized in that, include: At least one processor; as well as, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, which, when executed by the at least one processor, enables the at least one processor to perform the intelligent operational risk prevention and control method based on digital twins and behavioral analysis as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the intelligent operation risk prevention and control method based on digital twin and behavior analysis as described in any one of claims 1 to 7.

Images