Data security control method and system

Abstract

The invention discloses a data security management and control method and system, which are applied to a network security system comprising a plurality of data source nodes and a central management and control node. The method comprises the following steps: gathering multi-source original security data through a central management and control node, and configuring a data source type symbol and an association or influence characteristic value for each node; according to a preset association threshold set associated with the data source type, the center node comprehensively processes the information, and constructs a system-level security situation association chain representing different security domains, asset groups and logical association among the different security domains and asset groups in the network; and finally, the specific security event or log is dynamically allocated to the specific logic security space or asset container identified by the chain. The corresponding system comprises a plurality of collaborative modules such as data aggregation and feature association, strategy library interface, associated event identification, security chain set derivation, situation topology synthesis, security event mapping and dynamic control strategy. According to the method, the transformation from fragmented alarm to global situation cognition is realized, a complex attack chain can be effectively identified, context-based accurate dynamic response is supported, and the automation and intelligence level of safe operation is improved.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to the field of data security, specifically to a data security management method and system. Background Technology

[0002] As enterprises deepen their digital transformation, the scale and complexity of information systems have increased dramatically, resulting in hybrid heterogeneous networks encompassing local data centers, multi-cloud environments, and a large number of terminal devices. Against this backdrop, network security protection faces severe challenges. Traditional data security management methods typically rely on deploying multiple independent security devices and software, such as firewalls, intrusion detection systems, antivirus software, and log auditing platforms. These systems operate independently, generating massive amounts of heterogeneous raw security data and alert events.

[0003] Existing mainstream solutions, such as security information and incident management systems, attempt to improve the situation by centrally collecting and storing these multi-source logs. However, such systems have significant limitations in practice. First, their analytical capabilities are mostly limited to real-time correlation based on predefined rules or simple statistical queries on historical logs, lacking the ability to dynamically mine deep logical connections and behavioral patterns in security data. Advanced persistent threat attack chains launched by attackers across multiple stages and assets often fail to be effectively detected by existing rules because individual events may seem harmless, leading to missed alerts or delayed detection. Second, even when a large number of alerts are generated, these alerts are usually isolated and fragmented, lacking a unified context and topological correlation. Security operations personnel struggle to quickly understand which assets the alerts occurred on, whether there are inherent connections between different alerts, and what the entire attack path and scope of impact are, falling into alert fatigue and a dilemma of judgment, resulting in low response efficiency. Finally, most existing response strategies are static and threshold-based, unable to adaptively adjust according to real-time, global threat situations. Monitoring resources are evenly distributed, failing to focus on truly high-risk chains; response actions are rigid, unable to perform precise containment for specific attack contexts. Summary of the Invention

[0004] In view of this, the present invention provides a data security management method and system to solve the above-mentioned technical problems.

[0005] A data security management method, applied to a network security system comprising multiple data source nodes and a central management node, the method comprising:

[0006] The central control node acquires and aggregates raw security data from the multiple data source nodes;

[0007] Each data source node is provided with a data source type symbol, and each data source node is provided with at least one data association feature value or data influence feature value; the data association feature value is used to indicate the security association pattern between the data generated by the node and the data of other nodes, and the data influence feature value is used to indicate the potential impact range of the security status reflected by the data of the node;

[0008] Provide a preset set of association thresholds corresponding to specific data identification chains or sensitive data identifiers, the preset set of association thresholds being associated with data source type symbols;

[0009] The central control node determines the overall security posture association chain of the system based on at least one of the preset association threshold set, the original security data, the data source type symbol, the data association feature value, and the data impact feature value; the security posture association chain is used to characterize the logical associations and chain sets between different security domains, asset groups, and their relationships in the network.

[0010] The central control node distributes the security events or logs corresponding to the multiple data source nodes to specific logical security spaces or asset containers identified in the security posture association chain.

[0011] Preferably, determining the security posture association chain includes the following steps performed by the central control node:

[0012] Construct a secure data feature chain for the multiple data source nodes, wherein the secure data feature chain contains the data feature vector of the original secure data of each node and the corresponding data source type symbol;

[0013] Multiple expected security event patterns are pre-defined, each expected security event pattern having at least one associated expected data source type symbol, and at least one of expected data association feature value and expected data influence feature value;

[0014] The central control node performs matching and analysis on the data in the security data feature chain with the multiple expected security event patterns to identify the set of related events that constitute a potential related security event chain.

[0015] Preferably, the central control node infers the expected security threat propagation direction or attack path pattern for each cluster in the set of associated events.

[0016] Preferably, the central control node derives multiple horizontal security chain sets and multiple vertical permission chain sets based on the associated event set; each of the horizontal security chain set or vertical permission chain set is logically associated with at least one cluster in the associated event set.

[0017] Preferably, identifying the set of associated events in the security data feature chain based on multiple expected security event patterns includes:

[0018] Select a target pattern from the multiple expected security event patterns;

[0019] Based on the corresponding data source type symbols, an initial subset of the multiple data source nodes is initially matched with the selected target pattern;

[0020] Calculate one or more correlation coefficient values ​​between the data feature vectors of different nodes in the initial subset;

[0021] Compare the one or more correlation scores with a predefined correlation threshold in the selected target pattern;

[0022] Based on the comparison results, node data that meets the threshold range are formally classified and assigned to a specific associated event cluster.

[0023] Alternatively, identify a set of associated events in the security data feature chain based on the multiple expected security event patterns, including:

[0024] Select a target pattern from the multiple expected security event patterns;

[0025] Based on the corresponding data source type symbol, an initial subset of the secure data feature chain is matched with the selected target pattern;

[0026] Calculate the actual aggregation direction or influence diffusion trend of the node data feature vectors in the initial subset;

[0027] The calculated actual aggregation direction or influence diffusion trend is compared with the predefined expected correlation feature value in the selected target pattern;

[0028] Based on the comparison results, node data with consistent characteristic trends are categorized and assigned to a specific cluster of related events.

[0029] Preferably, the central control node derives at least one horizontal security chain set and at least one vertical permission chain set based on the associated event set, including:

[0030] For each cluster in the set of associated events, calculate a set of feature vectors that can define a logically isolated set or a control node;

[0031] Based on the predefined associated feature values ​​in the corresponding expected security event patterns, determine whether the plane defined by the cluster is a candidate horizontal security chain set or a candidate vertical permission chain set.

[0032] The present invention also provides a data security management and control system, including at least one central management and control node, wherein the central management and control node includes:

[0033] The data aggregation and feature association module is used to acquire and aggregate raw security data from multiple data source nodes, receive the data source type symbol of each data source node, and receive or calculate at least one of the data association feature value and data influence feature value of each node.

[0034] The policy library interface module is used to receive a preset association threshold set and multiple expected security event patterns from the security policy library. The preset association threshold set is associated with a data source type symbol. Each expected security event pattern has at least one associated expected data source type symbol, and at least one of expected data association feature value and expected data influence feature value.

[0035] The associated event identification module is used to perform matching analysis on the security data feature chain composed of the original security data, data source type symbols and feature values ​​based on the multiple expected security event patterns, so as to identify the set of associated events that constitute the potential associated security event chain.

[0036] The security chain set derivation module is used to derive multiple horizontal security chain sets and vertical permission chain sets in the network based on the associated event set and the preset associated threshold set, and to infer the security threat propagation direction or attack path pattern of the associated event set.

[0037] The situation topology synthesis module is used to determine and generate a security situation association chain for the entire system based on the spatial inclusion, adjacency, or intersection relationships between the multiple horizontal security chain sets and vertical permission chain sets. This security situation association chain represents multiple logical security spaces or asset containers defined by logical chain sets; and

[0038] The security event mapping module is used to allocate the security events or logs corresponding to the multiple data source nodes to the specific logical security space or asset container identified in the security situation association chain;

[0039] The dynamic control strategy module is used to dynamically adjust the data collection frequency, alarm level or linkage response strategy of at least one data source node based on its logical position in the security situation association chain.

[0040] The chain set verification and optimization module is used to: determine multiple candidate horizontal security chain sets, compare their logical alignment, and discard candidate chain sets that do not maintain consistency within the alignment tolerance range; determine multiple candidate vertical permission chain sets, compare their logical alignment and orthogonality, and discard candidate chain sets that do not meet the preset relationship within the alignment or orthogonality tolerance range.

[0041] Preferably, the associated event identification module is configured to:

[0042] Select the target pattern from the multiple expected security event patterns;

[0043] Preliminary matching is performed based on data source type symbols to form an initial subset of data;

[0044] Calculate the correlation degree between the feature vectors of different nodes in the initial subset;

[0045] The correlation score is compared with a predefined correlation threshold in the target pattern.

[0046] Based on the comparison results, node data that meets the threshold range are categorized into a specific set of associated events.

[0047] Preferably, the associated event identification module is used for:

[0048] Select the target pattern from the multiple expected security event patterns;

[0049] Preliminary matching is performed based on data source type symbols to form an initial subset of data;

[0050] Calculate the actual aggregation direction or influence diffusion trend of the node data feature vectors in the initial subset;

[0051] The actual aggregation direction or influence diffusion trend is compared with the expected data association feature value predefined in the target pattern;

[0052] Based on the comparison results, node data with consistent characteristic trends are categorized into a specific set of related events.

[0053] Preferably, the security chain set derivation module is used for:

[0054] For each cluster in the set of associated events, calculate a set of feature vectors that can define a logically isolated set or a control node;

[0055] Based on the predefined associated feature values ​​in the corresponding expected security event patterns, determine whether the plane defined by the cluster is a candidate horizontal security chain set or a candidate vertical permission chain set.

[0056] By constructing a security posture correlation chain, the core problems of information silos and fragmented posture in traditional security management are fundamentally solved, achieving unified cyberspace security risk assessment. Through metadata such as data source type symbols and data correlation characteristic values, combined with a preset correlation threshold set, the central node can intelligently identify logical connections across domains and assets. The resulting security posture correlation chain is not a simple list of events, but a dynamic topology model that clearly represents the logical connections and chain sets between different security domains and asset groups in the network. This allows for the clear presentation of concealed attack paths, asset dependencies, and risk transmission links, transforming previously scattered and fragmented alarm information.

[0057] By calculating the correlation values ​​between the feature vectors of different nodes in the initial subset and comparing them with a predefined correlation threshold, or by calculating the actual aggregation direction or influence diffusion trend and matching it with the expected features, discrete events across time and nodes are clustered into a set of related events with inherent logic. This dynamic matching analysis based on multi-dimensional features (type, numerical correlation, behavioral trends) can accurately capture weak signals and inherent patterns of chain behaviors such as attacker lateral movement and privilege escalation, and associate seemingly unrelated low-risk alerts into high-risk attack event chains.

[0058] The dynamic management and control strategy module can dynamically adjust the data collection frequency, alarm level, or linkage response strategy of a node in real time based on its logical position in the situational awareness chain. Monitoring of core assets is automatically enhanced, attack alarms are automatically prioritized, and targeted isolation or blocking strategies are automatically triggered. This mechanism enables intelligent allocation and elastic scaling of security resources (computing, storage, attention, and response actions), ensuring that limited defensive resources are focused on the most critical risk points, thereby optimizing the overall efficiency of security operations. Attached Figure Description

[0059] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only preferred embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0060] Figure 1 This is a flowchart of the method of the present invention.

[0061] Figure 2 This is a schematic diagram of the system framework of the present invention. Detailed Implementation

[0062] To better understand the structure of the present invention and the functional features and advantages it can achieve, the preferred embodiments of the present invention will be described in detail below with reference to the drawings.

[0063] Example 1

[0064] Reference Figure 1 This invention provides a data security management method applied to a network security system comprising multiple data source nodes and a central management node. The method includes: the central management node acquiring and aggregating raw security data from the multiple data source nodes; providing a data source type symbol for each data source node, and providing at least one data association feature value or data impact feature value for each data source node; the data association feature value indicating the security association pattern between the data generated by that node and the data of other nodes, and the data impact feature value indicating the potential impact range of the security status reflected by the data of that node; providing a preset association threshold set corresponding to a specific data identification chain or sensitive data identifier, the preset association threshold set being associated with the data source type symbol; the central management node determining a security posture association chain for the entire system based on the preset association threshold set, the raw security data, the data source type symbol, and at least one of the data association feature value and the data impact feature value; the security posture association chain characterizing different security domains, asset groups, and their logical associations and chain sets within the network; and the central management node allocating security events or logs corresponding to the multiple data source nodes to specific logical security spaces or asset containers identified in the security posture association chain.

[0065] In the above embodiments, the data source type symbol is a classification identifier used to characterize nodes such as network perimeter firewalls, internal web servers, databases, employee terminals, or cloud storage bucket operation logs. It provides the first layer of filtering conditions for subsequent pattern matching. The data association feature value is a quantified or vectorized metric used to describe the extent and pattern in which the data generated by the node is associated with the data of other nodes in a security sense. For example, the association feature value of a core switch node might indicate that its logs are frequently associated with multiple server nodes within the same VLAN, while the association feature value of a single office terminal might indicate that it is mainly associated with the gateway and a few internal servers. The data impact feature value is used to assess the severity and scope of the potential impact of a security event reflected by the node should it occur. For example, the impact feature value of a database server carrying core business operations will be much higher than that of a test machine. These feature values ​​can be preset static configurations or dynamically calculated based on historical behavior.

[0066] A preset association threshold set is a series of adjustable parameters or conditions that define the quantitative standards required to determine whether scattered events are associated, thus forming an identification chain or triggering sensitive data identifiers (such as abnormal access to data with specific tags). For example, for a data breach identification chain, a preset association threshold might be set for a large number of queries occurring from a database node within 5 minutes, followed by an abnormally high volume of outbound connections from an application server node corresponding to the same IP address.

[0067] The security posture correlation chain is a dynamic, structured topological model. The central control node comprehensively utilizes the aforementioned feature values, thresholds, and raw data, and constructs this chain through correlation analysis algorithms. It represents the logical connections and chain sets between different security domains and asset groups within the network. This means that the model can graphically or relationally display the entire network's security logical view, acting as nodes or containers in a graph; the connections between nodes represent the security dependencies, normal access paths, or identified anomalous connections that exist between them. This enables security personnel to understand the relationships between assets and potential risk transmission paths from a macroscopic perspective.

[0068] The central control node distributes security events or logs corresponding to the multiple data source nodes to specific logical security spaces or asset containers identified in the security posture association chain. Distribution refers to categorizing and placing specific, atomic security events (such as a brute-force login attempt from an IP address) or log entries into corresponding logical locations defined in the global model of the security posture association chain, based on information such as their source node, target, and behavioral characteristics. For example, an attack attempt against a web server would be distributed to the web server asset container identified in the association chain; while subsequent suspicious connection events initiated from that server to the internal database would be distributed to the lateral movement chain set connecting the web server container and the database container.

[0069] In some embodiments, determining the security situation association chain includes the following steps performed by the central control node: constructing a security data feature chain for the plurality of data source nodes, the security data feature chain containing data feature vectors from the original security data of each node and corresponding data source type symbols; pre-setting a plurality of expected security event patterns, each expected security event pattern having at least one associated expected data source type symbol, and at least one of expected data association feature values ​​and expected data impact feature values; and having the central control node perform matching analysis between the data in the security data feature chain and the plurality of expected security event patterns to identify a set of associated events constituting a potential associated security event chain.

[0070] In the above embodiments, constructing a secure data feature chain involves extracting key attributes from each piece of raw data and converting it into a machine-readable and computable data feature vector. The data feature vector contains multiple dimensions, such as: timestamp, source IP address, destination IP address, port, protocol, operation type (login, query, download), status code, data size, process hash, etc. Simultaneously, this vector is bound to the data source type symbol of the node that generated the data. In this way, massive amounts of data from thousands of nodes with diverse formats are transformed into a chain-like data stream (feature chain) composed of a unified format feature vector and type symbol, thus preparing for subsequent pattern matching analysis through standardization.

[0071] Anticipated security incident patterns are formal descriptions of known attacks, complex threat scenarios, or internal breach processes. Each pattern predefines its typical characteristics: 1) Expected data source type symbols: indicating which types of nodes the pattern typically involves. For example, a ransomware propagation pattern might be associated with endpoint types and file server types. 2) Expected data association characteristics: describing the strength of association, temporal relationship, or causal pattern that related node data should exhibit in this pattern. 3) Expected data impact characteristics: defining the potential scope or severity level of impact of an event conforming to this pattern.

[0072] The central control node continuously compares and matches the real-time constructed security data feature chain with multiple expected security event patterns in the knowledge base. The analysis not only checks whether the features of a single event are similar to the local features of a certain pattern, but more importantly, it examines whether a series of events spanning different data source nodes and exhibiting a temporal sequence, the combination of their combined feature vector sequences, the combination of data source types, and the correlation features between events, highly match the complete description of a certain expected pattern. When a sufficiently high match is found, the system identifies and aggregates this series of originally scattered events into a set of related events. This set represents a potentially related security event chain that is currently occurring or has already occurred and has a complete logical structure.

[0073] In some embodiments, the central control node infers the expected direction of security threat propagation or attack path pattern for each cluster in the associated event set. Based on the identification of the associated event set, the intent and path of threat behavior are predicted. The associated event set contains event evidence of multiple steps taken by the attacker. The central control node analyzes the temporal sequence of these events, their spatial movement trajectory, and the logic of the behavior itself. Based on these analyses, and combined with pre-defined attack pattern knowledge, the system infers the most likely direction of the attacker's next action or potential attack path. For example, if the cluster shows that an attacker has compromised a web server located in the DMZ and discovered its connection configuration with the internal database server, the system may infer that the expected direction of security threat propagation is a lateral movement from the DMZ web server to the internal core database server. This inference can provide crucial intelligence support for proactive defense, transforming passive response into proactive early warning.

[0074] In some embodiments, the central control node derives multiple horizontal security chain sets and multiple vertical permission chain sets based on the associated event set; each horizontal security chain set or vertical permission chain set is logically associated with at least one cluster in the associated event set. Horizontal security chain sets primarily describe a set of access or connection chains that may be exploited between assets within the same security level or trust domain. For example, an SMB shared access path from one PC to another on an office network, or a chain of mutual access relationships between servers within a subnet. These chain sets are potential channels for attackers to move laterally. Vertical permission chain sets primarily describe a set of privilege escalation or access penetration paths that cross different security levels or permission boundaries (such as from ordinary user privileges to administrator privileges, from the external network to the internal core network). For example, a path to obtain a server shell by exploiting an application vulnerability, or an access chain to access specific resources on the internal network from the external network via VPN. The system reverse-engineers and plots these potential horizontal and vertical chain sets based on the abnormal relationships between nodes exposed in the associated event set. Each derived chain set is logically linked to at least one attack cluster, indicating that the chain set has been verified to be actually exploitable.

[0075] In some embodiments, identifying a set of associated events in the security data feature chain based on multiple expected security event patterns includes: selecting a target pattern from the multiple expected security event patterns; performing preliminary matching between an initial subset of the multiple data source nodes and the selected target pattern based on the corresponding data source type symbols; calculating one or more correlation values ​​between the data feature vectors of different nodes in the initial subset; comparing the one or more correlation values ​​with a predefined correlation threshold in the selected target pattern; and based on the comparison results, formally classifying and assigning node data that meets the threshold range to a specific associated event cluster. The analysis engine selects a target pattern to be detected from the pattern library, such as a data leakage pattern. The first step is preliminary screening, filtering an initial subset from all data source nodes based on the expected data source type symbols in the target pattern, containing only nodes of these related types, significantly narrowing the analysis scope. The second step is correlation calculation: within this initial subset, the system does not view the events of each node in isolation, but calculates the correlation values ​​between the data feature vectors generated by different nodes. This value can be derived using various algorithms, such as those based on the temporal density of events within a time window, the overlap of attributes like IP addresses / user accounts, or causal probability models based on behavioral sequences. The third step is threshold determination: the calculated correlation value is compared to a predefined correlation threshold in the target pattern. This threshold is the minimum standard for determining whether a series of events is sufficient to constitute the required correlation strength for the pattern. Finally, cluster generation: only events whose correlation values ​​all reach or exceed the threshold are formally categorized and assigned to a cluster representing this data breach event. This method emphasizes precise numerical measurement and objective threshold determination.

[0076] Alternatively, the associated event set in the security data feature chain can be identified based on the multiple expected security event patterns, including: selecting a target pattern from the multiple expected security event patterns; matching an initial subset of the security data feature chain with the selected target pattern based on the corresponding data source type symbol; calculating the actual aggregation direction or influence diffusion trend of the node data feature vectors in the initial subset; comparing the calculated actual aggregation direction or influence diffusion trend with the predefined expected association feature values ​​in the selected target pattern; and classifying and assigning node data with consistent feature trends to a specific associated event cluster based on the comparison results. Further, a target pattern is selected and preliminary data source type screening is performed. The actual aggregation direction or influence diffusion trend exhibited by the node event feature vectors. For example, the actual aggregation direction may refer to the direction vector of a network connection request spreading from a terminal to other terminals in a specific order; the influence diffusion trend may refer to the time / space diffusion pattern of a file encryption alarm event starting from a few nodes and then growing exponentially in a short period of time. Then, trend matching is performed: the calculated actual trend is compared with the predefined expected association feature values ​​in the target pattern to check whether their shape or direction is consistent. Finally, clustering: grouping event data that conform to the expected trend model into the same cluster.

[0077] In some embodiments, the central control node derives at least one horizontal security chain set and at least one vertical permission chain set based on the associated event set, including: for each cluster in the associated event set, calculating a set of feature vectors that can define a logically isolated set or a control node; and determining whether the plane defined by the cluster is a candidate horizontal security chain set or a candidate vertical permission chain set based on predefined associated feature values ​​in the corresponding expected security event pattern. For each identified associated event set, a more universal security link model needs to be extracted. The first step is to calculate boundary features: the system analyzes all nodes, network segments, user roles, etc., involved in all events within the cluster, and calculates a set of feature vectors through clustering algorithms or rule extraction. This set can logically define a relatively independent set or a key control node. The second step is link type determination: the system checks the corresponding expected security event pattern used when the cluster was identified. The predefined expected data association feature values ​​in this pattern contain semantic information about the attack dimension. For example, if the feature values ​​suggest that the attack behavior mainly spreads at the same permission level, the system determines that the logical plane defined by the cluster is a candidate horizontal security chain set. If the feature value suggests that the attack behavior is intended to break through the permission boundary, then it is judged as a candidate vertical permission chain set.

[0078] Example 2

[0079] Reference Figure 2The present invention also provides a data security management and control system, including at least one central management and control node. The central management and control node includes: a data aggregation and feature association module, used to acquire and aggregate raw security data from multiple data source nodes, receive the data source type symbol of each data source node, and receive or calculate at least one of data association feature value and data impact feature value for each node; a policy library interface module, used to receive a preset association threshold set and multiple expected security event patterns from a security policy library, wherein the preset association threshold set is associated with the data source type symbol, and each expected security event pattern has at least one associated expected data source type symbol, and at least one of expected data association feature value and expected data impact feature value; an association event identification module, used to perform matching analysis on the security data feature chain composed of the raw security data, data source type symbol, and feature value based on the multiple expected security event patterns, to identify the set of associated events constituting a potential associated security event chain; and a security chain set derivation module, used to derive multiple security chain sets in the network based on the set of associated events and the preset association threshold set. The system comprises a horizontal security chain set and a vertical permission chain set, and infers the security threat propagation direction or attack path pattern of the associated event set; a situation topology synthesis module, used to determine and generate the overall security situation association chain of the system based on the spatial inclusion, adjacency or intersection relationships between the multiple horizontal security chain sets and the vertical permission chain sets, which represents multiple logical security spaces or asset containers defined by logical chain sets; a security event mapping module, used to allocate the security events or logs corresponding to the multiple data source nodes to specific logical security spaces or asset containers identified in the security situation association chain; a dynamic management strategy module, used to dynamically adjust the data collection frequency, alarm level or linkage response strategy of at least one data source node in the security situation association chain based on the logical position of the node; and a chain set verification and optimization module, used to: determine multiple candidate horizontal security chain sets, compare their logical alignment, and discard candidate chain sets that do not maintain consistency within the alignment tolerance range; determine multiple candidate vertical permission chain sets, compare their logical alignment and orthogonality, and discard candidate chain sets that do not meet the preset relationship within the alignment or orthogonality tolerance range.

[0080] Preferably, the associated event identification module performs the following steps: selecting a target pattern from the plurality of expected security event patterns; performing preliminary matching based on data source type symbols to form an initial subset of data; calculating the correlation degree values ​​between the feature vectors of different nodes in the initial subset; comparing the correlation degree values ​​with a predefined correlation threshold in the target pattern; and classifying the node data that meets the threshold range into a specific associated event set based on the comparison results.

[0081] Preferably, the associated event identification module is used to: select a target pattern from the plurality of expected security event patterns; perform preliminary matching based on data source type symbols to form an initial subset of data; calculate the actual aggregation direction or influence diffusion trend of the node data feature vectors in the initial subset; compare the actual aggregation direction or influence diffusion trend with the expected data association feature values ​​predefined in the target pattern; and classify the node data with consistent feature trends into a specific associated event set according to the comparison results.

[0082] Preferably, the security chain set derivation module is used to: calculate a set of feature vectors that can define a logical isolation set or control node for each cluster in the associated event set; and determine whether the plane defined by the cluster is a candidate horizontal security chain set or a candidate vertical permission chain set based on the predefined associated feature values ​​in the corresponding expected security event mode.

[0083] The principle of this application is as follows: After the system starts, the data aggregation and feature association module first automatically discovers and registers all data source nodes in the network (such as firewalls, IDS, terminal agents, servers, and cloud service log interfaces, etc.), establishes secure connections with these nodes through pre-configured credentials or certificates, and simultaneously receives global policy information predefined and continuously updated by the security administrator from the policy library interface module, including a complete dictionary of data source type symbols, a set of dynamic calculation rules bound to each type symbol, a large set of preset association thresholds, and a formally described library of expected security event patterns; subsequently, the system enters a normalized real-time operation cycle, the specific operation process of which is as follows: The aggregation and feature association module continuously and asynchronously retrieves massive amounts of raw, secure data streams from all registered data source nodes using various protocols and streaming technologies, including Syslog, SIEM interface, API retrieval, and Kafka message queues. Upon data entry into the system, the module performs real-time parsing and standardization, transforming unstructured log entries into structured event objects containing key fields such as timestamps, source addresses, destination addresses, operation behaviors, and result statuses. Each event object is immediately tagged with a data source type symbol from its source node. Simultaneously, based on preset dynamic calculation rules and combining historical data with real-time context, the module performs data processing on each data source... Nodes periodically calculate or update their data association and data impact features. These evolving features are appended to every subsequent event object generated from that node, forming a security data feature chain rich in contextual information. Next, the associated event identification module, as the core analysis engine, begins operation. It consumes this ever-growing security data feature chain in real time and synchronously obtains the latest expected security event patterns from the policy library interface module. Internally, it runs a high-performance, complex event processing engine and a graph computation model. This module operates concurrently and in multiple modes: for example, targeting the ransomware lateral propagation pattern, it first retrieves the expected data source type symbol defined in the pattern from... An initial subset of events is selected from the feature chain, and then one of two complementary analysis paths is used for in-depth mining. On the first path, the correlation value of event sequences between different terminal nodes in the subset is calculated and compared with the correlation threshold predefined in the pattern. If the correlation of multiple consecutive events exceeds the threshold, they are determined to constitute a potential ransomware propagation cluster. On the second path, which focuses more on behavioral dynamics, the spread trend of events within the subset is analyzed, an actual propagation direction vector is calculated, and this trend is matched with the expected worm-like spread feature model in the pattern. If the match is successful, these events are also classified into a set of related events.Regardless of the path taken, once a set of related events is identified, the module immediately creates a unique tracking ID for it and outputs a complete cluster report containing all member events, timelines, common characteristics, and initial confidence levels. Subsequently, the security chain set inference module receives these related event reports. Its responsibility is to abstract the inherent vulnerability structure of the network from specific attack instances. For each newly reported cluster, the module first analyzes the assets, accounts, and network paths involved in the events within the cluster, calculating a set of feature vectors that characterize its activity range and boundaries. Then, it queries the original expected security event pattern that triggered the cluster's identification. Based on the semantics implied by the expected data association feature values ​​in the pattern, the module determines the logical platform exposed by this cluster. The module primarily presents a candidate set of horizontal security chains, representing a potential unauthorized access channel between servers within the same trust domain that an attacker could exploit. Simultaneously, based on the temporal and spatial sequences of events within the cluster, the module infers the attacker's possible next move on this chain. In addition to horizontal chains, for clusters involving privilege escalation, the module derives candidate vertical permission chains, identifying vulnerable paths that privileges traverse. Meanwhile, the chain verification and optimization module performs parallel quality checks on all newly derived candidate chain sets: it retrieves existing, verified chain set models from the system's historical knowledge graph and compares the logical alignment of the new candidate horizontal chain sets with existing chain sets in the same logical region. If the new chain set aligns with the existing model... If significant inconsistencies exist within the alignment tolerance range, the candidate chain set may be temporarily discarded or marked for review due to noise or false alarms. For candidate vertical permission chain sets, their orthogonality is additionally verified to ensure that they clearly describe the transition of permission levels rather than the confusion of horizontal relationships. High-quality chain sets that pass the verification are sent to the situation topology synthesis module. This module acts as a global situation map editor, treating newly arrived horizontal and vertical chain sets as tiles or layers depicting the network risk landscape. Through intelligent spatial relationship algorithms, it analyzes whether these chain sets contain, are adjacent, or intersect. Based on these relationships, the module dynamically updates and synthesizes a global, multi-layered security situation association chain. This association chain is essentially a logical network model in the form of a digital twin. The model clearly defines logical security spaces such as core production areas, office network VLANs, and third-party access areas, as well as logical asset containers such as web server clusters and database asset containers. It also marks the identified risk chains connecting these spaces and containers. Almost simultaneously with the update of the situation model, the security event mapping module starts working. It continuously monitors the raw, unaggregated single security event streams. For each newly arrived event, the module quickly parses its key attributes and performs real-time querying and matching in the latest security situation association chain model. Through efficient search algorithms, it accurately assigns or maps the event to its logical security space and asset container, enabling isolated events to instantly acquire rich topological context.Finally, the dynamic control strategy module performs closed-loop control based on the above-mentioned full-chain analysis results: It monitors the change in the logical position of each data source node in the real-time updated security situation correlation chain. For example, once a certain terminal node is classified into a high-confidence ransomware propagation cluster by the associated event recognition module, and the situation topology shows that it is located on the horizontal chain set connecting the key file server, this module will automatically issue the following instructions: 1) Increase the data collection frequency for this node, and command its terminal agent to report process and network connection details from the regular once every 5 minutes to once every 30 seconds; 2) Automatically elevate the level of any suspicious alarms generated by this node to emergency; 3) Trigger the preset linkage response strategy, such as immediately sending an instruction to the network access control system through the integration interface to temporarily isolate this node to the restricted VLAN, and simultaneously create a work order with the highest priority in the security operation center work order system; The entire operation process is not a one-way linear process, but a highly collaborative and circular feedback real-time dynamic system: The optimization result of the chain set verification module will be fed back to the derivation module to improve the subsequent derivation algorithm; The new data generated after the execution of the dynamic control strategy will be collected by the data aggregation module to start a new round of analysis cycle; The policy library interface module will also regularly receive manual or machine learning-based tuning updates for thresholds and patterns according to the operation results.;

[0084] The above is only a preferred embodiment of the present invention and does not impose any form of limitation on the present invention. Any person skilled in the art can make many possible changes and modifications to the technical solution of the present invention or modify it into an equivalent embodiment with equivalent changes without departing from the scope of the technical solution of the present invention. Therefore, all changes, modifications, equivalent changes, and modifications made to the above embodiments based on the technology of the present invention without departing from the content of the technical solution of the present invention fall within the protection scope of this technical solution.

Claims

1. A data security management method, characterized in that, The method is applied to a network security system comprising a plurality of data source nodes and a central management node, and the method comprises: obtaining and aggregating raw security data from the plurality of data source nodes by the central management node; providing a data source type symbol for each data source node, and providing at least one data correlation characteristic value or data impact characteristic value for each data source node; the data correlation characteristic value is used to indicate the security correlation mode of the data generated by the node with other node data, and the data impact characteristic value is used to indicate the potential impact range of the security situation reflected by the node data; providing a preset correlation threshold set corresponding to a specific data identification chain or sensitive data identification, which is associated with the data source type symbol; determining a security posture correlation chain of the system as a whole by the central management node according to the preset correlation threshold set, the raw security data, the data source type symbol, and at least one of the data correlation characteristic value and the data impact characteristic value; the security posture correlation chain is used to represent different security domains, asset groups and the logical correlation and chain set therebetween in the network; allocating the security events or logs corresponding to the plurality of data source nodes to the specific logical security space or asset container identified in the security posture correlation chain by the central management node.

2. The data security management method of claim 1, wherein, Determining the security posture correlation chain comprises the following steps performed by the central management node: constructing a security data feature chain of the plurality of data source nodes, which comprises a data feature vector in the raw security data of each node and a corresponding data source type symbol; pre-setting a plurality of expected security event modes, each of which has at least one associated expected data source type symbol, and at least one of an expected data correlation characteristic value and an expected data impact characteristic value; matching and analyzing the data in the security data feature chain with the plurality of expected security event modes by the central management node, so as to identify a set of correlated events constituting a potential correlation security event chain.

3. The data security management method of claim 2, wherein, inferring the expected security threat propagation direction or attack path mode for each cluster in the set of correlated events by the central management node.

4. The data security management method of claim 3, wherein, deriving a plurality of horizontal security chain sets and a plurality of vertical authority chain sets from the set of correlated events by the central management node; each of the horizontal security chain set or the vertical authority chain set is logically associated with at least one cluster in the set of correlated events.

5. The data security management method of claim 2, wherein, Identifying the set of correlated events in the security data feature chain according to a plurality of expected security event modes comprises: selecting a target mode from the plurality of expected security event modes; preliminarily matching an initial subset of the plurality of data source nodes with the selected target mode based on the corresponding data source type symbol; calculating one or more correlation degree values between different node data feature vectors in the initial subset; comparing the one or more correlation degree values with a predefined correlation threshold in the selected target mode; based on the comparison result, formally classifying and assigning the node data meeting the threshold range to a specific correlated event cluster; Or, identifying a set of correlated events in the security data feature chain according to the plurality of expected security event patterns comprises: selecting a target pattern from the plurality of expected security event patterns; matching an initial subset of the security data feature chain with the selected target pattern based on corresponding data source type symbols; calculating actual aggregation direction or influence diffusion trend of node data feature vectors in the initial subset; comparing the calculated actual aggregation direction or influence diffusion trend with predefined expected correlation feature values in the selected target pattern; based on the comparison result, categorizing and assigning node data with consistent feature trend to a specific correlated event cluster.

6. The data security management method of claim 2, wherein, Deriving at least one horizontal security chain set and at least one vertical authority chain set from the set of correlated events by the central control node comprises: calculating a feature vector set capable of defining a logical isolation set or control node for each cluster in the set of correlated events; judging whether the plane defined by the cluster is a candidate horizontal security chain set or a candidate vertical authority chain set according to predefined correlation feature values in the corresponding expected security event pattern.

7. A data security management system, characterized by, The central control node comprises: a data aggregation and feature correlation module for obtaining and aggregating raw security data from a plurality of data source nodes, receiving data source type symbols of each data source node, and receiving or calculating at least one of data correlation feature values and data influence feature values of each node; a policy library interface module for receiving a set of preset correlation thresholds and a plurality of expected security event patterns from a security policy library, the set of preset correlation thresholds being associated with data source type symbols, each of the plurality of expected security event patterns having at least one associated expected data source type symbol, and at least one of expected data correlation feature values and expected data influence feature values; a correlated event identification module for performing matching analysis on a security data feature chain composed of the raw security data, data source type symbols and feature values based on the plurality of expected security event patterns, to identify a set of correlated events constituting a potential correlated security event chain; a security chain set derivation module for deriving a plurality of horizontal security chain sets and vertical authority chain sets in the network and inferring security threat propagation direction or attack path pattern of the set of correlated events according to the set of correlated events and the set of preset correlation thresholds; a situation topology synthesis module for determining and generating a security situation correlation chain of the system as a whole according to spatial inclusion, adjacency or intersection relationship between the plurality of horizontal security chain sets and vertical authority chain sets, the security situation correlation chain representing a plurality of logical security spaces or asset containers defined by the logical chain sets; and a security event mapping module for assigning security events or logs corresponding to the plurality of data source nodes to specific logical security spaces or asset containers identified in the security situation correlation chain. A central control node comprises: a data aggregation and feature correlation module for obtaining and aggregating raw security data from a plurality of data source nodes, receiving data source type symbols of each data source node, and receiving or calculating at least one of data correlation feature values and data influence feature values of each node; a policy library interface module for receiving a set of preset correlation thresholds and a plurality of expected security event patterns from a security policy library, the set of preset correlation thresholds being associated with data source type symbols, each of the plurality of expected security event patterns having at least one associated expected data source type symbol, and at least one of expected data correlation feature values and expected data influence feature values; a correlated event identification module for performing matching analysis on a security data feature chain composed of the raw security data, data source type symbols and feature values based on the plurality of expected security event patterns, to identify a set of correlated events constituting a potential correlated security event chain; a security chain set derivation module for deriving a plurality of horizontal security chain sets and vertical authority chain sets in the network and inferring security threat propagation direction or attack path pattern of the set of correlated events according to the set of correlated events and the set of preset correlation thresholds; a situation topology synthesis module for determining and generating a security situation correlation chain of the system as a whole according to spatial inclusion, adjacency or intersection relationship between the plurality of horizontal security chain sets and vertical authority chain sets, the security situation correlation chain representing a plurality of logical security spaces or asset containers defined by the logical chain sets; and a security event mapping module for assigning security events or logs corresponding to the plurality of data source nodes to specific logical security spaces or asset containers identified in the security situation correlation chain. A dynamic control strategy module is configured to dynamically adjust the data collection frequency, alarm level or linkage response strategy of at least one data source node according to the logical position of the node in the security situation correlation chain. A chain set verification and optimization module is configured to determine a plurality of candidate horizontal security chain sets, compare their logical alignment degrees, and discard the candidate chain sets that do not maintain consistency within the alignment degree tolerance range; determine a plurality of candidate vertical authority chain sets, compare their logical alignment degrees and orthogonality, and discard the candidate chain sets that do not satisfy the preset relationship within the alignment degree or orthogonality tolerance range.

8. The data security management system of claim 7, wherein, The correlation event identification module is configured to: select a target mode from the plurality of expected security event modes; perform preliminary matching based on the data source type symbols to form an initial data subset; calculate the correlation degree values between the different node data feature vectors in the initial subset; compare the correlation degree values with the predefined correlation threshold values in the target mode; according to the comparison result, classify the node data that meets the threshold range into a specific correlation event set.

9. The data security management system of claim 7, wherein, The correlation event identification module is configured to: select a target mode from the plurality of expected security event modes; perform preliminary matching based on the data source type symbols to form an initial data subset; calculate the actual aggregation direction or influence diffusion trend of the node data feature vectors in the initial subset; compare the actual aggregation direction or influence diffusion trend with the predefined expected data correlation feature values in the target mode; according to the comparison result, classify the node data with consistent feature trends into a specific correlation event set.

10. The data security management system of claim 7, wherein, The security chain set derivation module is configured to: for each cluster in the correlation event set, calculate a feature vector set that can define a logical isolation set or control node; according to the predefined correlation feature values in the corresponding expected security event mode, determine whether the plane defined by the cluster is a candidate horizontal security chain set or a candidate vertical authority chain set.

Images