Digital asset-based destructive risk assessment system and management method

Abstract

The invention discloses a digital asset-based impairment risk assessment system and management method, and relates to the technical field of network security and risk assessment, and the system comprises a data acquisition unit, a traceability analysis unit and a prediction output unit. The data acquisition unit is used for acquiring system operation state data, business transaction data and security log data in real time, integrating the data into basic data, marking abnormal events according to a preset security threshold value, comprehensively and accurately acquiring digital asset related information through multi-dimensional data acquisition and integration, and combining with accurate risk traceability analysis so as to improve the risk traceability of the digital asset. According to the method, key factors causing digital asset damage and mutual relations thereof can be deeply analyzed, so that the accuracy of digital asset damage risk assessment is greatly improved, and asset owners and managers can take targeted prevention measures in time by predicting the probability of occurrence of digital asset damage risks in advance, so that the risk assessment accuracy is improved. The risk that the digital assets are damaged is effectively reduced, and the risk prevention capability of the digital assets is enhanced.

Description

Technical Field

[0001] This invention relates to the field of cybersecurity and risk assessment technology, specifically to a damage risk assessment system and management method based on digital assets. Background Technology

[0002] In today's digital age, digital assets have become an important component of wealth for businesses and individuals, encompassing various types of data, software, and cryptocurrencies. With the widespread adoption of digital assets, the risks they face are also becoming increasingly prominent, such as system failures, cyberattacks, and business anomalies. These risks can lead to serious consequences such as loss, leakage, and devaluation of digital assets, causing significant economic losses to asset owners. Currently, the assessment of risks to digital assets mainly relies on traditional security monitoring methods and simple risk analysis approaches. Traditional methods typically focus only on single aspects of data, such as monitoring only the system's operational status or analyzing only security logs, lacking comprehensive collection and analysis of multi-dimensional data. During the risk assessment process, it is often difficult to comprehensively and accurately identify the key factors that lead to damage to digital assets and their interrelationships. When a system malfunctions, traditional methods can only determine that a system failure exists, but cannot deeply analyze how the failure is transmitted through business transaction links, ultimately causing damage to digital assets. In addition, existing technologies are also relatively crude in predicting the probability of risk occurrence, mostly based on experience-based judgments or simple statistical models, lacking scientific and accurate prediction methods, which makes it impossible to effectively prevent the occurrence of risks to digital assets in advance.

[0003] Therefore, in view of this, the present invention proposes a damage risk assessment system and management method based on digital assets to make up for and improve the shortcomings of the prior art. Summary of the Invention

[0004] To address the aforementioned technical problems, this invention provides a damage risk assessment system and management method based on digital assets, thereby resolving the corresponding technical issues raised in the background section.

[0005] To achieve the above objectives, the technical solution adopted by the present invention is: a damage risk assessment system based on digital assets, including a data acquisition unit, a source analysis unit, and a prediction output unit; The data acquisition unit is used to collect system operation status data, business transaction data, and security log data in real time and integrate them into basic data. According to the preset security threshold, it marks abnormal events and extracts system stability characteristics, business activity characteristics, and security threat characteristics from the basic data and sends them to the source tracing and analysis unit. The source tracing and analysis unit includes an association module and a reconstruction module. The association module is used to construct a multi-dimensional feature association graph using a graph neural network algorithm, with system stability features, business activity features, and security threat features as nodes, to analyze the relationship between each node and determine the feature transmission path. The quantization module is used to trace back along the feature transmission path from the anomaly point of the abnormal event based on the multi-dimensional feature association map, and combined with time series analysis to determine the time sequence of the anomaly occurrence of each feature, reconstruct the complete event development process from the initial anomaly of the digital asset to the final damage, form an event full-link model, and analyze the contribution of each link in the event full-link model to the final damage. By using a preset contribution threshold, the contribution of each link to the final damage is compared to locate the link that plays a key role in determining the damage to the digital asset, and the link is used as the damage trigger point. The influence coefficient of the trigger point on the degree of damage is quantified, and the quantified influence coefficient is sent to the prediction output unit. The prediction output unit is used to obtain the quantified impact coefficient and construct a risk occurrence probability prediction model. The quantified impact coefficient is substituted into the risk occurrence probability prediction model to predict the probability of digital assets suffering damage risks, and an assessment report is generated and pushed to the management end.

[0006] As a preferred approach, the specific process for extracting system stability features, business activity features, and security threat features from the basic data is as follows: S101. Based on the preset security threshold, the collected system operation status data, business transaction data, and security log data are compared with the preset security threshold. If the compared data exceeds the preset security threshold, it is marked as an abnormal event. The data that exceeds the preset security threshold is identified, and the corresponding features extracted from the data are taken as the abnormal points of the abnormal event. Extract system stability characteristics, business activity characteristics, and security threat characteristics from system operation status data, business transaction data, and security log data, respectively; S102, The system stability characteristics include average response time and system availability; The response time of each business request is statistically analyzed from the system operation status data, and the average response time is calculated. Its formula is: Where n is the total number of business requests, It is the response time of the i-th business request; The system's uptime is calculated from the system's operational status data. and total running time The system availability A is calculated using the following formula: ; S103, The business activity characteristics include the rate of change, peak transaction periods, and low transaction periods; Count the number of business transactions in adjacent time periods from the business transaction data and calculate the rate of change. Its formula is: ,in, This represents the number of business transactions during the current time period. This represents the number of business transactions in the previous time period; The number of business transactions in each time period is counted from the business transaction data, and the number of business transactions is sorted in descending order of numerical value. The top three time periods in terms of the number of business transactions are identified as peak transaction periods, and the bottom three time periods in terms of the number of business transactions are identified as low transaction periods. S104. The security threat characteristics include abnormal login IP addresses and malware attack types; From the security log data, count the IP addresses that failed to log in and the corresponding number of login failures, and filter out the IP addresses whose number of login failures exceeds the preset failure threshold as abnormal login IP addresses; Security event alarm entries are filtered from security log data, and classified according to preset classification rules to determine the type of malware attack.

[0007] As a preferred method, the specific process for determining the feature propagation path is as follows: S201. Using system stability characteristics, business activity characteristics, and security threat characteristics as nodes, a multi-dimensional feature association graph is constructed using a graph neural network algorithm. Where V is the set of nodes and E is the set of edges; S202. Calculate the correlation between nodes by calculating the cosine similarity of their feature vectors. Its formula is: ; Where a and b represent two nodes in the multidimensional feature association graph; Let a be the feature vector of node a; Let b be the feature vector of node b; S203. Obtain the number of times different features simultaneously occur abnormally from the historical security event database, and the total number of security events NS, and count the number of times each pair of features simultaneously occurs abnormally. By calculating the correlation ratio of each pair of features Obtain the edge weights. Its formula is: ,in, For adjustment coefficients; S204. Obtain the marked abnormal events and the abnormal points of the abnormal events. Use the depth-first search algorithm to start from the abnormal point, prioritize visiting nodes with high correlation and large edge weights, record the access path, and determine the feature propagation path from the abnormal point to other nodes.

[0008] As a preferred approach, the specific process for analyzing the contribution of each link in the event's entire chain model to the final damage is as follows: S301. Based on the determined feature propagation path, starting from the anomaly point of the abnormal event, trace back along the feature propagation path, and combine with time series analysis to record the anomaly occurrence time of each feature. Where l represents the feature anomaly index, arranged in chronological order to obtain the time series of feature anomaly occurrences. Where j is the total number of characteristic anomalies; S302. Based on the time sequence of abnormal occurrences and the feature propagation path, the abnormal features that occur first are taken as the starting point, and the abnormal features that occur later are connected in sequence according to the relationship specified in the feature propagation path to form an abnormal feature sequence. Based on the sequence of abnormal features, starting from the first abnormal feature in the sequence, and following the transmission relationship specified in the feature transmission path, the occurrence of the next abnormal feature triggered by each abnormal feature is deduced step by step, so as to reconstruct the complete event development process from the initial abnormality of digital assets to the final damage. Construct a flowchart, representing each anomaly feature with a node, and arrows between nodes to indicate feature transmission relationships. Also, mark the time of anomaly occurrence near the nodes. The flowchart presents the complete event development process from the initial anomaly to the final damage of digital assets, thus forming a full-chain event model. Based on the established event end-to-end model, the contribution of each link in the event end-to-end model to the final damage is analyzed, and the formula is as follows: ; in, This represents the weight coefficient of the i-th stage; This indicates the degree of abnormality in the i-th stage; This represents the transmission strength between the i-th link and the (i+1)-th link.

[0009] As a preferred approach, the specific process for quantifying the influence coefficient of this trigger point on the degree of damage is as follows: S401. Based on the preset contribution threshold, compare the contribution of each link in the event end-to-end model to the final damage with the preset contribution threshold. Based on the comparison results, the link whose contribution exceeds the preset contribution threshold is taken as the damage trigger point. S402. Use the analytic hierarchy process (AHP) to quantify damage trigger points and construct a judgment matrix. ,in, To represent the importance of factor p relative to factor q, calculate the eigenvectors of the judgment matrix. ,in, The relative importance weights of factor p; S403. Based on the eigenvector W of the judgment matrix, select the component value of the corresponding eigenvector and determine this component value as the influence coefficient of the damage trigger point on the degree of damage. , where e is the factor number corresponding to the damage trigger point.

[0010] As a preferred method, the specific process for predicting the probability of digital assets suffering damage is as follows: S501. Obtain the quantified impact coefficients and construct a risk occurrence probability prediction model using a logistic regression model. The formula is as follows: ; in, This indicates the probability of digital assets suffering damage. Y is a binary variable, where Y=1 indicates that harm has been suffered and Y=0 indicates that no harm has been suffered. It is the intercept term; It is a regression coefficient, corresponding to the influence coefficient of the k-th damage trigger point. ; m represents the total number of damage trigger points; S502. Substitute the quantified impact coefficient into the risk occurrence probability prediction model to calculate the probability P of digital assets suffering damage risk, and generate an assessment report based on the obtained probability and push it to the management end.

[0011] The damage risk assessment and management method based on digital assets includes the following steps: Step 1: Collect system operation status data, business transaction data, and security log data in real time and integrate them into basic data. Mark abnormal events according to preset security thresholds, and extract system stability characteristics, business activity characteristics, and security threat characteristics from the basic data. Step 2: Using a graph neural network algorithm, construct a multi-dimensional feature association graph with system stability features, business activity features, and security threat features as nodes, analyze the relationships between nodes, and determine the feature transmission path; Step 3: Based on the multi-dimensional feature association map, starting from the anomaly point of the abnormal event, trace back along the feature transmission path, and combine time series analysis to determine the time sequence of the anomaly occurrence of each feature. Reconstruct the complete event development process from the initial anomaly of the digital asset to the final damage, form an event full-link model, and analyze the contribution of each link in the event full-link model to the final damage. By using a preset contribution threshold, compare the contribution of each link to the final damage to locate the link that plays a key role in determining the damage to the digital asset, and take this link as the damage trigger point, quantify the influence coefficient of the trigger point on the degree of damage. Step 4: Obtain the quantified impact coefficient and construct a risk occurrence probability prediction model. Substitute the quantified impact coefficient into the risk occurrence probability prediction model to predict the probability of digital assets suffering damage risks, generate an assessment report and push it to the management end.

[0012] Compared with existing technologies, the beneficial effects of this invention are as follows: By collecting system operation status data, business transaction data, and security log data, and marking abnormal events according to preset security thresholds, system stability characteristics, business activity characteristics, and security threat characteristics are extracted and used as nodes to construct a multi-dimensional feature correlation graph, determine the feature transmission path, reconstruct the complete event development process from the initial anomaly of digital assets to the final damage, form an event full-link model, and analyze the contribution of each link in the event full-link model to the final damage, locate the links that play a key decisive role in the damage to digital assets and use them as damage trigger points, and quantify the influence coefficient of the trigger point on the degree of damage. A risk probability prediction model is constructed to predict the probability of digital assets suffering damage, and an assessment report is generated and pushed to the management end. Through multi-dimensional data collection and integration, relevant information on digital assets is obtained comprehensively and accurately. Combined with precise risk tracing analysis, the key factors leading to digital asset damage and their interrelationships can be deeply analyzed, thereby greatly improving the accuracy of the assessment of digital asset damage risks. By predicting the probability of digital asset damage risks in advance, asset owners and managers can take timely and targeted preventive measures, effectively reduce the risk of digital asset damage, and enhance the risk prevention capabilities for digital assets. Attached Figure Description

[0013] Figure 1 This is a schematic diagram of the overall structure of a preferred embodiment of the present invention; Figure 2 This is a schematic diagram of the management method process shown in this invention. Detailed Implementation

[0014] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0015] Embodiments of the present invention: Please refer to Figure 1 and Figure 2 As shown, the damage risk assessment system based on digital assets includes a data acquisition unit, a source analysis unit, and a prediction output unit. The data acquisition unit is used to collect system operation status data, business transaction data, and security log data in real time and integrate them into basic data. According to the preset security threshold, it marks abnormal events and extracts system stability characteristics, business activity characteristics, and security threat characteristics from the basic data and sends them to the source tracing and analysis unit. The source tracing and analysis unit includes an association module and a reconstruction module. The association module is used to construct a multi-dimensional feature association graph using graph neural network algorithms, with system stability features, business activity features, and security threat features as nodes, to analyze the relationship between each node and determine the feature transmission path. The quantification module is used to trace back along the feature transmission path from the anomaly point of the abnormal event based on the multi-dimensional feature correlation map. Combined with time series analysis, it determines the time sequence of the anomaly occurrence of each feature, reconstructs the complete event development process from the initial anomaly of the digital asset to the final damage, forms the event full-link model, and analyzes the contribution of each link in the event full-link model to the final damage. By using a preset contribution threshold, the contribution of each link to the final damage is compared to locate the link that plays a key role in determining the damage to the digital asset. This link is then used as the damage trigger point, and the influence coefficient of the trigger point on the degree of damage is quantified. The quantified influence coefficient is then sent to the prediction output unit. The prediction output unit is used to obtain the quantified impact coefficient and build a risk occurrence probability prediction model. The quantified impact coefficient is substituted into the risk occurrence probability prediction model to predict the probability of digital assets suffering damage risks, and an assessment report is generated and pushed to the management end.

[0016] The specific process for extracting system stability features, business activity features, and security threat features from the basic data is as follows: S101. Based on the preset security threshold, the collected system operation status data, business transaction data, and security log data are compared with the preset security threshold. If the compared data exceeds the preset security threshold, it is marked as an abnormal event. The data that exceeds the preset security threshold is identified, and the corresponding features extracted from the data are taken as the abnormal points of the abnormal event. Extract system stability characteristics, business activity characteristics, and security threat characteristics from system operation status data, business transaction data, and security log data, respectively; S102. System stability characteristics include average response time and system availability; The response time of each business request is statistically analyzed from the system operation status data, and the average response time is calculated. Its formula is: Where n is the total number of business requests, It is the response time of the i-th business request; The system's uptime is calculated from the system's operational status data. and total running time The system availability A is calculated using the following formula: ; S103. Business activity characteristics include rate of change, peak transaction periods, and low transaction periods. Count the number of business transactions in adjacent time periods from the business transaction data and calculate the rate of change. Its formula is: ,in, This represents the number of business transactions during the current time period. This represents the number of business transactions in the previous time period; The number of business transactions in each time period is counted from the business transaction data, and the number of business transactions is sorted in descending order of numerical value. The top three time periods in terms of the number of business transactions are identified as peak transaction periods, and the bottom three time periods in terms of the number of business transactions are identified as low transaction periods. S104. Security threat characteristics include abnormal login IP addresses and malware attack types; From the security log data, count the IP addresses that failed to log in and the corresponding number of login failures, and filter out the IP addresses whose number of login failures exceeds the preset failure threshold as abnormal login IP addresses; Security event alarm entries are filtered from security log data, and classified according to preset classification rules to determine the type of malware attack.

[0017] The specific process for determining the feature propagation path is as follows: S201. Using system stability characteristics, business activity characteristics, and security threat characteristics as nodes, a multi-dimensional feature association graph is constructed using a graph neural network algorithm. Where V is the set of nodes and E is the set of edges; S202. Calculate the correlation between nodes by calculating the cosine similarity of their feature vectors. Its formula is: ; Where a and b represent two nodes in the multidimensional feature association graph; Let a be the feature vector of node a; Let b be the feature vector of node b; S203. Obtain the number of times different features simultaneously occur abnormally from the historical security event database, and the total number of security events NS, and count the number of times each pair of features simultaneously occurs abnormally. By calculating the correlation ratio of each pair of features Obtain the edge weights. Its formula is: ,in, For adjustment coefficients; S204. Obtain the marked abnormal events and the abnormal points of the abnormal events. Use the depth-first search algorithm to start from the abnormal point, prioritize visiting nodes with high correlation and large edge weights, record the access path, and determine the feature propagation path from the abnormal point to other nodes.

[0018] The specific process for analyzing the contribution of each link in the event's entire chain model to the final damage is as follows: S301. Based on the determined feature propagation path, starting from the anomaly point of the abnormal event, trace back along the feature propagation path, and combine with time series analysis to record the anomaly occurrence time of each feature. Where l represents the feature anomaly index, arranged in chronological order to obtain the time series of feature anomaly occurrences. Where j is the total number of characteristic anomalies; S302. Based on the time sequence of abnormal occurrences and the feature propagation path, the abnormal features that occur first are taken as the starting point, and the abnormal features that occur later are connected in sequence according to the relationship specified in the feature propagation path to form an abnormal feature sequence. Based on the sequence of abnormal features, starting from the first abnormal feature in the sequence, and following the transmission relationship specified in the feature transmission path, the occurrence of the next abnormal feature triggered by each abnormal feature is deduced step by step, so as to reconstruct the complete event development process from the initial abnormality of digital assets to the final damage. Construct a flowchart, representing each anomaly feature with a node, and arrows between nodes to indicate feature transmission relationships. Also, mark the time of anomaly occurrence near the nodes. The flowchart presents the complete event development process from the initial anomaly to the final damage of digital assets, thus forming a full-chain event model. Based on the established event end-to-end model, the contribution of each link in the event end-to-end model to the final damage is analyzed, and the formula is as follows: ; in, This represents the weight coefficient of the i-th stage; This indicates the degree of abnormality in the i-th stage; This represents the transmission strength between the i-th link and the (i+1)-th link.

[0019] The specific process for quantifying the impact coefficient of this trigger point on the degree of damage is as follows: S401. Based on the preset contribution threshold, compare the contribution of each link in the event end-to-end model to the final damage with the preset contribution threshold. Based on the comparison results, the link whose contribution exceeds the preset contribution threshold is taken as the damage trigger point. S402. Use the analytic hierarchy process (AHP) to quantify damage trigger points and construct a judgment matrix. ,in, To represent the importance of factor p relative to factor q, calculate the eigenvectors of the judgment matrix. ,in, The relative importance weights of factor p; S403. Based on the eigenvector W of the judgment matrix, select the component value of the corresponding eigenvector and determine this component value as the influence coefficient of the damage trigger point on the degree of damage. , where e is the factor number corresponding to the damage trigger point.

[0020] The specific process for predicting the probability of digital assets suffering damage is as follows: S501. Obtain the quantified impact coefficients and construct a risk occurrence probability prediction model using a logistic regression model. The formula is as follows: ; in, This indicates the probability of digital assets suffering damage. Y is a binary variable, where Y=1 indicates that harm has been suffered and Y=0 indicates that no harm has been suffered. It is the intercept term; It is a regression coefficient, corresponding to the influence coefficient of the k-th damage trigger point. ; m represents the total number of damage trigger points; S502. Substitute the quantified impact coefficient into the risk occurrence probability prediction model to calculate the probability P of digital assets suffering damage risk, and generate an assessment report based on the obtained probability and push it to the management end.

[0021] The damage risk assessment and management method based on digital assets includes the following steps: Step 1: Collect system operation status data, business transaction data, and security log data in real time and integrate them into basic data. Mark abnormal events according to preset security thresholds, and extract system stability characteristics, business activity characteristics, and security threat characteristics from the basic data. Step 2: Using a graph neural network algorithm, construct a multi-dimensional feature association graph with system stability features, business activity features, and security threat features as nodes, analyze the relationships between nodes, and determine the feature transmission path; Step 3: Based on the multi-dimensional feature association map, starting from the anomaly point of the abnormal event, trace back along the feature transmission path, and combine time series analysis to determine the time sequence of the anomaly occurrence of each feature. Reconstruct the complete event development process from the initial anomaly of the digital asset to the final damage, form an event full-link model, and analyze the contribution of each link in the event full-link model to the final damage. By using a preset contribution threshold, compare the contribution of each link to the final damage to locate the link that plays a key role in determining the damage to the digital asset, and take this link as the damage trigger point, quantify the influence coefficient of the trigger point on the degree of damage. Step 4: Obtain the quantified impact coefficient and construct a risk occurrence probability prediction model. Substitute the quantified impact coefficient into the risk occurrence probability prediction model to predict the probability of digital assets suffering damage risks, generate an assessment report and push it to the management end.

[0022] By collecting system operation status data, business transaction data, and security log data, and marking abnormal events according to preset security thresholds, system stability characteristics, business activity characteristics, and security threat characteristics are extracted and used as nodes to construct a multi-dimensional feature correlation map, determine the feature transmission path, and reconstruct the complete event development process from the initial anomaly of digital assets to the final damage, forming an event full-link model. The contribution of each link in the event full-link model to the final damage is analyzed, identifying the key links that play a decisive role in the damage to digital assets and designating them as damage trigger points. The influence coefficient of these trigger points on the degree of damage is quantified, and a risk occurrence probability prediction model is constructed to predict the probability of digital assets suffering damage risks. An assessment report is generated and pushed to the management end. Through multi-dimensional data collection and integration, comprehensive and accurate information related to digital assets is obtained. Combined with precise risk tracing analysis, the key factors leading to digital asset damage and their interrelationships can be deeply analyzed, thereby greatly improving the accuracy of digital asset damage risk assessment. By predicting the probability of digital asset damage risks in advance, asset owners and managers can take timely and targeted preventive measures, effectively reducing the risk of digital asset damage and enhancing the risk prevention capabilities for digital assets.

[0023] The size of the interval and threshold is set to facilitate comparison. The size of the threshold depends on the amount of sample data and the number of bases set by those skilled in the art for each set of sample data; as long as it does not affect the ratio between the parameter and the quantized value.

[0024] The above formulas are all dimensionless calculations. The formulas are derived from software simulations based on a large amount of collected data to obtain the most recent real-world results. The preset parameters in the formulas are set by those skilled in the art according to the actual situation. In the two embodiments provided in this application, it should be understood that the disclosed apparatus and system can be implemented in other ways; for example, the apparatus embodiments described above are merely illustrative, and the division of modules is merely a logical functional division. In actual implementation, there may be other division methods, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed; furthermore, the coupling or direct coupling or communication connection between the shown or discussed mutuals can be through some interfaces, and the indirect coupling or communication connection between the apparatus or modules can be electrical, mechanical or other forms. The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A damage risk assessment system based on digital assets, characterized in that, It includes a data acquisition unit, a source analysis unit, and a prediction output unit; The data acquisition unit is used to collect system operation status data, business transaction data, and security log data in real time and integrate them into basic data. According to the preset security threshold, it marks abnormal events and extracts system stability characteristics, business activity characteristics, and security threat characteristics from the basic data and sends them to the source tracing and analysis unit. The source tracing and analysis unit includes an association module and a reconstruction module. The association module is used to construct a multi-dimensional feature association graph using a graph neural network algorithm, with system stability features, business activity features, and security threat features as nodes, to analyze the relationship between each node and determine the feature transmission path. The quantization module is used to trace back along the feature transmission path from the anomaly point of the abnormal event based on the multi-dimensional feature association map, and combined with time series analysis to determine the time sequence of the anomaly occurrence of each feature, reconstruct the complete event development process from the initial anomaly of the digital asset to the final damage, form an event full-link model, and analyze the contribution of each link in the event full-link model to the final damage. By using a preset contribution threshold, the contribution of each link to the final damage is compared to locate the link that plays a key role in determining the damage to the digital asset, and the link is used as the damage trigger point. The influence coefficient of the trigger point on the degree of damage is quantified, and the quantified influence coefficient is sent to the prediction output unit. The prediction output unit is used to obtain the quantified impact coefficient and construct a risk occurrence probability prediction model. The quantified impact coefficient is substituted into the risk occurrence probability prediction model to predict the probability of digital assets suffering damage risks, and an assessment report is generated and pushed to the management end.

2. The damage risk assessment system based on digital assets according to claim 1, characterized in that, The specific process for extracting system stability features, business activity features, and security threat features from the basic data is as follows: S101. Based on the preset security threshold, the collected system operation status data, business transaction data, and security log data are compared with the preset security threshold. If the compared data exceeds the preset security threshold, it is marked as an abnormal event. The data that exceeds the preset security threshold is identified, and the corresponding features extracted from the data are taken as the abnormal points of the abnormal event. Extract system stability characteristics, business activity characteristics, and security threat characteristics from system operation status data, business transaction data, and security log data, respectively; S102, The system stability characteristics include average response time and system availability; The response time of each business request is statistically analyzed from the system operation status data, and the average response time is calculated. Its formula is: Where n is the total number of business requests, It is the response time of the i-th business request; The system's uptime is calculated from the system's operational status data. and total running time The system availability A is calculated using the following formula: ; S103, The business activity characteristics include the rate of change, peak transaction periods, and low transaction periods; Count the number of business transactions in adjacent time periods from the business transaction data and calculate the rate of change. Its formula is: ,in, This represents the number of business transactions during the current time period. This represents the number of business transactions in the previous time period; The number of business transactions in each time period is counted from the business transaction data, and the number of business transactions is sorted in descending order of numerical value. The top three time periods in terms of the number of business transactions are identified as peak transaction periods, and the bottom three time periods in terms of the number of business transactions are identified as low transaction periods. S104. The security threat characteristics include abnormal login IP addresses and malware attack types; From the security log data, count the IP addresses that failed to log in and the corresponding number of login failures, and filter out the IP addresses whose number of login failures exceeds the preset failure threshold as abnormal login IP addresses; Security event alarm entries are filtered from security log data, and classified according to preset classification rules to determine the type of malware attack.

3. The damage risk assessment system based on digital assets according to claim 2, characterized in that, The specific process for determining the feature propagation path is as follows: S201. Using system stability characteristics, business activity characteristics, and security threat characteristics as nodes, a multi-dimensional feature association graph is constructed using a graph neural network algorithm. Where V is the set of nodes and E is the set of edges; S202. Calculate the correlation between nodes by calculating the cosine similarity of their feature vectors. Its formula is: ； Where a and b represent two nodes in the multidimensional feature association graph; Let a be the feature vector of node a; Let b be the feature vector of node b; S203. Obtain the number of times different features simultaneously occur abnormally from the historical security event database, and the total number of security events NS, and count the number of times each pair of features simultaneously occurs abnormally. By calculating the correlation ratio of each pair of features Obtain the edge weights. Its formula is: ,in, For adjustment coefficients; S204. Obtain the marked abnormal events and the abnormal points of the abnormal events. Use the depth-first search algorithm to start from the abnormal point, prioritize visiting nodes with high correlation and large edge weights, record the access path, and determine the feature propagation path from the abnormal point to other nodes.

4. The damage risk assessment system based on digital assets according to claim 3, characterized in that, The specific process for analyzing the contribution of each link in the event's entire chain model to the final damage is as follows: S301. Based on the determined feature propagation path, starting from the anomaly point of the abnormal event, trace back along the feature propagation path, and combine with time series analysis to record the anomaly occurrence time of each feature. Where l represents the feature anomaly index, arranged in chronological order to obtain the time series of feature anomaly occurrences. Where j is the total number of characteristic anomalies; S302. Based on the time sequence of abnormal occurrences and the feature propagation path, the abnormal features that occur first are taken as the starting point, and the abnormal features that occur later are connected in sequence according to the relationship specified in the feature propagation path to form an abnormal feature sequence. Based on the sequence of abnormal features, starting from the first abnormal feature in the sequence, and following the transmission relationship specified in the feature transmission path, the occurrence of the next abnormal feature triggered by each abnormal feature is deduced step by step, so as to reconstruct the complete event development process from the initial abnormality of digital assets to the final damage. Construct a flowchart, representing each abnormal feature with a node, and the arrows between nodes indicate the feature transmission relationship. At the same time, mark the time of occurrence of the abnormality near the node. The flowchart presents the complete event development process from the initial abnormality of digital assets to the final damage, so as to form a full-link event model. Based on the established event end-to-end model, the contribution of each link in the event end-to-end model to the final damage is analyzed, and the formula is as follows: ； in, This represents the weight coefficient of the i-th stage; This indicates the degree of abnormality in the i-th stage; This represents the transmission strength between the i-th link and the (i+1)-th link.

5. The damage risk assessment system based on digital assets according to claim 4, characterized in that, The specific process for quantifying the impact coefficient of this trigger point on the degree of damage is as follows: S401. Based on the preset contribution threshold, compare the contribution of each link in the event end-to-end model to the final damage with the preset contribution threshold. Based on the comparison results, the link whose contribution exceeds the preset contribution threshold is taken as the damage trigger point. S402. Use the analytic hierarchy process (AHP) to quantify damage trigger points and construct a judgment matrix. ,in, To represent the importance of factor p relative to factor q, calculate the eigenvectors of the judgment matrix. ,in, The relative importance weights of factor p; S403. Based on the eigenvector W of the judgment matrix, select the component value of the corresponding eigenvector and determine this component value as the influence coefficient of the damage trigger point on the degree of damage. , where e is the factor number corresponding to the damage trigger point.

6. The damage risk assessment system based on digital assets according to claim 5, characterized in that, The specific process for predicting the probability of digital assets suffering damage is as follows: S501. Obtain the quantified impact coefficients and construct a risk occurrence probability prediction model using a logistic regression model. The formula is as follows: ； in, This indicates the probability of digital assets suffering damage. Y is a binary variable, where Y=1 indicates that harm has been suffered and Y=0 indicates that no harm has been suffered. It is the intercept term; It is a regression coefficient, corresponding to the influence coefficient of the k-th damage trigger point. ; m represents the total number of damage trigger points; S502. Substitute the quantified impact coefficient into the risk occurrence probability prediction model to calculate the probability P of digital assets suffering damage risk, and generate an assessment report based on the obtained probability and push it to the management end.

7. A method for damage risk assessment and management based on digital assets, applied to the damage risk assessment system based on digital assets as described in any one of claims 1-6, characterized in that, Includes the following steps: Step 1: Collect system operation status data, business transaction data, and security log data in real time and integrate them into basic data. Mark abnormal events according to preset security thresholds, and extract system stability characteristics, business activity characteristics, and security threat characteristics from the basic data. Step 2: Using a graph neural network algorithm, construct a multi-dimensional feature association graph with system stability features, business activity features, and security threat features as nodes, analyze the relationships between nodes, and determine the feature transmission path; Step 3: Based on the multi-dimensional feature association map, starting from the anomaly point of the abnormal event, trace back along the feature transmission path, and combine time series analysis to determine the time sequence of the anomaly occurrence of each feature. Reconstruct the complete event development process from the initial anomaly of the digital asset to the final damage, form an event full-link model, and analyze the contribution of each link in the event full-link model to the final damage. By using a preset contribution threshold, compare the contribution of each link to the final damage to locate the link that plays a key role in determining the damage to the digital asset, and take this link as the damage trigger point, quantify the influence coefficient of the trigger point on the degree of damage. Step 4: Obtain the quantified impact coefficient and construct a risk occurrence probability prediction model. Substitute the quantified impact coefficient into the risk occurrence probability prediction model to predict the probability of digital assets suffering damage risks, generate an assessment report and push it to the management end.

Images