Universe risk data analysis method and device

Abstract

The invention provides a global risk data analysis method. The method comprises the following steps: acquiring a plurality of nodes in a network and risk data associated with the nodes; based on a preset node attribution rule, the nodes are divided into intra-domain nodes and extra-domain nodes, the intra-domain nodes belong to the current management domain, and the extra-domain nodes are external nodes which do not belong to the current management domain and have interaction behaviors with the intra-domain nodes; performing real-time analysis on the risk data of the intra-domain nodes by adopting a first analysis strategy, and storing an analysis result in a local encrypted database; performing aggregation analysis on the risk data of the out-of-domain node by adopting a second analysis strategy, and storing an analysis result in a distributed edge node in an anonymization form; and generating risk early warning information according to an analysis result, and dynamically allocating computing resources based on the node type to execute subsequent response operation.

Description

Technical Field

[0001] This invention relates to the fields of network security and big data analytics, specifically to a method and apparatus for comprehensive risk data analysis, which is particularly suitable for the collaborative processing of risk identification, resource optimization, and privacy protection in large-scale heterogeneous network environments. Background Technology

[0002] As digital systems become increasingly complex, the number of nodes in networks surges, and cross-domain interactions become more frequent. Traditional, unified risk data analysis methods face two major challenges: first, the difficulty in evenly allocating computing resources leads to response delays at critical nodes; second, the excessive collection and plaintext storage of data from external nodes poses a privacy risk. Existing technologies typically employ centralized analysis models that fail to distinguish between data processing paths from trusted internal nodes and untrusted external nodes, resulting in high system load, poor compliance, and low response efficiency.

[0003] While some solutions attempt to incorporate edge computing or data anonymization mechanisms, they lack a structural division based on the concept of "domain," hindering fine-grained control of analysis strategies and intelligent adaptation of resource scheduling. Therefore, a technical solution is urgently needed that can combine node affiliation attributes, differentiate the processing of risky data, and balance performance and security. Summary of the Invention

[0004] This invention proposes a method for comprehensive risk data analysis, characterized by the following steps: acquiring risk data of multiple nodes in a network and their associated data; classifying the nodes into intra-domain nodes and extra-domain nodes based on preset node affiliation rules, wherein intra-domain nodes are nodes belonging to the current management domain, and extra-domain nodes are external nodes that do not belong to the current management domain but interact with the intra-domain nodes; performing real-time analysis on the risk data of the intra-domain nodes using a first analysis strategy and storing the analysis results in a local encrypted database; performing aggregated analysis on the risk data of the extra-domain nodes using a second analysis strategy and storing the analysis results in anonymized form on distributed edge nodes; generating risk warning information based on the analysis results and dynamically allocating computing resources based on node type to execute subsequent response operations.

[0005] The preset node affiliation rules include one or more of the following: the network segment to which the node's IP address belongs, the organization identifier, the digital certificate issuance domain, or the access permission level.

[0006] The first analysis strategy includes: fine-grained analysis of risk data, real-time behavioral modeling, anomaly detection, and source tracing.

[0007] The second analysis strategy includes: performing statistical aggregation, trend prediction, and cross-domain correlation analysis on risk data after de-identification, without retaining the original individual records.

[0008] The local encrypted database uses a transparent data encryption mechanism based on the Chinese national cryptographic algorithm SM4, and only authorized service processes are allowed to access it.

[0009] The distributed edge nodes use a blockchain structure for log storage to ensure the immutability and audit traceability of the off-site data analysis process.

[0010] After generating risk warning information, further adjust the computing resource quota according to the node type: allocate more CPU / memory resources to high-risk nodes within the domain for in-depth analysis, and limit the upper limit of resource usage for nodes outside the domain to prevent overload.

[0011] This invention also proposes a global risk data analysis device, characterized by comprising: a data acquisition module for acquiring risk data of multiple nodes in a network and their associated data; a node partitioning module for partitioning the nodes into intra-domain nodes and extra-domain nodes based on preset node affiliation rules; an analysis strategy execution module for performing real-time analysis of the risk data of intra-domain nodes using a first analysis strategy and performing aggregated analysis of the risk data of extra-domain nodes using a second analysis strategy; a storage control module for storing intra-domain analysis results in a local encrypted database and storing extra-domain analysis results in anonymized form on distributed edge nodes; and an early warning and resource scheduling module for generating risk early warning information and dynamically allocating computing resources based on node type.

[0012] The present invention also proposes a computer-readable medium storing computer program instructions thereon, which, when executed by a processor, enable the processor to implement a global risk data analysis method.

[0013] The present invention also proposes a computer program product, including computer program code configured to execute a global risk data analysis method at runtime, wherein the computer program product is deployed as a software module in a cloud server, a local data center, or a hybrid architecture platform.

[0014] The beneficial effects of the present invention include: (1) By using multi-dimensional node affiliation rules based on IP network segments, organization identifiers, digital certificate issuance domains or access permission levels, network nodes are accurately divided into intra-domain nodes and extra-domain nodes, and differentiated analysis strategies are adopted for each. This improves the accuracy of risk identification while effectively reducing privacy compliance risks, and is especially suitable for complex network environments involving cross-organizational interactions; (2) By storing the analysis results of intra-domain nodes in a local database encrypted with the SM4 algorithm and restricting access to authorized service processes, combined with storing the analysis results of extra-domain nodes in an anonymized form in a distributed edge node with a blockchain structure, a unified system of secure storage and audit traceability is achieved. At the same time, after generating risk warnings, the computing resource quota is dynamically adjusted to prioritize the analysis resource investment of high-risk intra-domain nodes, while setting a resource usage limit for extra-domain nodes. This optimizes the system resource allocation efficiency, prevents resource overload caused by large-scale low-risk external requests, and improves the stability and responsiveness of the overall analysis system. Attached Figure Description

[0015] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0016] To better illustrate the specific technical solutions of the present invention, the technical terms involved in the present invention will be explained as follows: Comprehensive risk data analysis refers to the entire process of collecting, classifying, analyzing, and responding to various security event logs in a hybrid network environment that includes internal management nodes and external interaction nodes.

[0017] Domain-specific nodes: Network entities belonging to the current security management domain, including servers, office terminals, database hosts, etc. within the organization, with trusted identity identifiers (such as registered accounts, CA certificates) and located within the controlled network.

[0018] External nodes: External network entities that do not belong to the current management domain but communicate with nodes within the domain. They are usually access source IPs from the Internet or third-party service interfaces, and their identities are untrusted or not fully authenticated.

[0019] De-identification: Remove information from the data that can directly or indirectly identify an individual through methods such as hash transformation, field truncation, and information replacement, ensuring that the original subject cannot be restored.

[0020] Local encrypted database: A secure storage system deployed on the organization's internal network. It uses the national cryptographic algorithm SM4 to transparently encrypt static data and ensures read and write security through process-level access control.

[0021] Distributed edge nodes: Lightweight data processing units distributed at the network boundary, used to cache and store the anonymized analysis results after aggregation, supporting offline queries and local decision-making.

[0022] Blockchain-based log storage: A chained hash structure links log digests sequentially, with each subsequent record containing the hash value of the previous one, thus ensuring tamper-proof and traceable operation records.

[0023] This invention proposes a method for comprehensive risk data analysis, characterized by the following steps: acquiring risk data of multiple nodes in a network and their associated data; classifying the nodes into intra-domain nodes and extra-domain nodes based on preset node affiliation rules, wherein intra-domain nodes belong to the current management domain, and extra-domain nodes are external nodes that do not belong to the current management domain but interact with the intra-domain nodes; performing real-time analysis on the risk data of the intra-domain nodes using a first analysis strategy and storing the analysis results in a local encrypted database; performing aggregated analysis on the risk data of the extra-domain nodes using a second analysis strategy and storing the analysis results in anonymized form on distributed edge nodes; generating risk warning information based on the analysis results and dynamically allocating computing resources based on node type to execute subsequent response operations.

[0024] The preset node affiliation rules include one or more of the following: the network segment to which the node's IP address belongs, the organization identifier, the digital certificate issuance domain, or the access permission level.

[0025] The first analysis strategy includes: fine-grained analysis of risk data, real-time behavioral modeling, anomaly detection, and source tracing.

[0026] The fine-grained parsing includes: performing structured parsing of log data generated by nodes within the domain by field, extracting key information such as source IP address, destination IP address, communication port, transmission protocol type, event timestamp, operating system user account, process name, and executed command; configuring dedicated parsing templates for log formats output by different devices, and combining regular expression matching and syntax tree structure analysis to identify potential malicious operation patterns; and converting unstructured text logs into event records in a unified format, including standardized fields and context labels, for use by subsequent processing modules. Real-time behavior modeling includes: extracting users' daily active time periods, frequently used login locations, frequently accessed server lists, and typical process startup sequences as user features based on each user's and terminal's historical operation records; the system updates these user features at fixed intervals, and triggers an initial alarm when the real-time collected operation behavior exceeds the set range and meets predefined combination conditions; the system supports manually adjusting the judgment threshold according to organizational strategies to adapt to the work habits of different personnel and reduce false alarms; Anomaly detection includes: setting up multi-layered detection rules. The first layer uses a pre-set rule set for pattern comparison; the second layer introduces statistical analysis methods to calculate the mean and variance within the sliding window based on changes in operation frequency and resource consumption, and to detect abnormal fluctuations that significantly deviate from the normal range. The two types of detection results complement each other and are weighted to generate the final risk level. Source tracing includes: after discovering a suspicious event, using user account, host MAC address or session ID as an index, performing cross-system correlation queries in locally stored terminal logs, network traffic metadata, and application access logs, and reconstructing the entire process of the attacker from initial access to privilege escalation and lateral movement through time series alignment and behavior path connection, generating a visual event chain diagram that includes time nodes, affected assets, and operation content.

[0027] The second analysis strategy includes: performing statistical aggregation, trend prediction, and cross-domain correlation analysis on risk data after de-identification, without retaining the original individual records.

[0028] De-identification processing includes: de-identifying the identity-related information in the risk data of external nodes, including truncating the host part of the source IP address while retaining the subnet prefix, performing a one-way hash transformation on the user identifier, and deleting fields that can identify the device model or geographical location. The processed data cannot be restored to the original individual, ensuring that it does not constitute personal information and meets privacy protection requirements.

[0029] Statistical aggregation includes counting and summarizing de-identified risk events by attack type, target port, geographic region, etc., using minute or hourly time windows, generating aggregation results, which are stored in the form of indicators for subsequent trend analysis and visualization.

[0030] Trend forecasting includes: based on historical aggregate results, using moving averages, linear growth models, or seasonal exponential smoothing methods, analyzing the changing trends of external threat activities to provide forward-looking references for adjusting defense strategies.

[0031] Cross-domain correlation analysis includes comparing the aggregated results of external risks collected within this domain with anonymized threat summaries shared with other collaborative security domains to identify similar attack patterns that occur simultaneously across multiple networks.

[0032] All raw logs from external nodes are temporarily cached in memory for real-time processing and are immediately cleared after processing. They are not retained in any persistent storage media. The system design prohibits writing raw records to disk, thus eliminating the risk of sensitive data retention.

[0033] The local encrypted database uses a transparent data encryption mechanism based on the Chinese national cryptographic algorithm SM4, and only authorized service processes are allowed to access it.

[0034] The distributed edge nodes use a blockchain structure for log storage to ensure the immutability and audit traceability of the off-site data analysis process.

[0035] After generating risk warning information, further adjust the computing resource quota according to the node type: allocate more CPU / memory resources to high-risk nodes within the domain for in-depth analysis, and limit the upper limit of resource usage for nodes outside the domain to prevent overload.

[0036] This invention also proposes a global risk data analysis device, characterized by comprising: a data acquisition module for acquiring risk data of multiple nodes in a network and their associated data; a node partitioning module for partitioning the nodes into intra-domain nodes and extra-domain nodes based on preset node affiliation rules; an analysis strategy execution module for performing real-time analysis of the risk data of intra-domain nodes using a first analysis strategy and performing aggregated analysis of the risk data of extra-domain nodes using a second analysis strategy; a storage control module for storing intra-domain analysis results in a local encrypted database and storing extra-domain analysis results in anonymized form on distributed edge nodes; and an early warning and resource scheduling module for generating risk early warning information and dynamically allocating computing resources based on node type.

[0037] The present invention also proposes a computer-readable medium storing computer program instructions thereon, which, when executed by a processor, enable the processor to implement a global risk data analysis method.

[0038] The present invention also proposes a computer program product, including computer program code configured to execute a global risk data analysis method at runtime, wherein the computer program product is deployed as a software module in a cloud server, a local data center, or a hybrid architecture platform.

[0039] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of the present invention without departing from the spirit and scope of the claims. All of these forms are within the protection scope of the present invention.

Claims

1. A method for comprehensive risk data analysis, characterized in that, Includes the following steps: Obtain risk data for multiple nodes in the network and their associated nodes; Based on preset node affiliation rules, the nodes are divided into intra-domain nodes and extra-domain nodes. Intra-domain nodes are nodes that belong to the current management domain, and extra-domain nodes are external nodes that do not belong to the current management domain but have interactive behavior with intra-domain nodes. The risk data of the nodes within the domain are analyzed in real time using the first analysis strategy, and the analysis results are stored in a local encrypted database. The risk data of the off-domain nodes are aggregated and analyzed using a second analysis strategy, and the analysis results are stored in anonymized form on distributed edge nodes. Risk warning information is generated based on the analysis results, and computing resources are dynamically allocated based on node type to perform subsequent response operations.

2. The method as described in claim 1, characterized in that, The preset node affiliation rules include one or more of the following: the network segment to which the node's IP address belongs, the organization identifier, the digital certificate issuance domain, or the access permission level.

3. The method as described in claim 2, characterized in that, The first analysis strategy includes: fine-grained analysis of risk data, real-time behavioral modeling, anomaly detection, and source tracing; The fine-grained parsing includes: performing structured parsing of log data generated by nodes within the domain by field, extracting key information such as source IP address, destination IP address, communication port, transmission protocol type, event timestamp, operating system user account, process name, and executed command; configuring dedicated parsing templates for log formats output by different devices, and combining regular expression matching and syntax tree structure analysis to identify potential malicious operation patterns; and converting unstructured text logs into event records in a unified format, including standardized fields and context labels, for use by subsequent processing modules. Real-time behavior modeling includes: extracting users' daily active time periods, frequently used login locations, frequently accessed server lists, and typical process startup sequences as user features based on each user's and terminal's historical operation records; the system updates these user features at fixed intervals, and triggers an initial alarm when the real-time collected operation behavior exceeds the set range and meets predefined combination conditions; the system supports manually adjusting the judgment threshold according to organizational strategies to adapt to the work habits of different personnel and reduce false alarms; Anomaly detection includes: setting up multi-layered detection rules. The first layer uses a pre-set rule set for pattern comparison; the second layer introduces statistical analysis methods to calculate the mean and variance within the sliding window based on changes in operation frequency and resource consumption, and to detect abnormal fluctuations that significantly deviate from the normal range. The two types of detection results complement each other and are weighted to generate the final risk level. Source tracing includes: after discovering a suspicious event, using user account, host MAC address or session ID as an index, performing cross-system correlation queries in locally stored terminal logs, network traffic metadata, and application access logs, and reconstructing the entire process of the attacker from initial access to privilege escalation and lateral movement through time series alignment and behavior path connection, generating a visual event chain diagram that includes time nodes, affected assets, and operation content.

4. The method as described in claim 3, characterized in that, The second analysis strategy includes: performing statistical aggregation, trend prediction, and cross-domain correlation analysis on risk data after de-identification, without retaining the original individual records.

5. The method as described in claim 1, characterized in that, The local encrypted database uses a transparent data encryption mechanism based on the Chinese national cryptographic algorithm SM4, and only authorized service processes are allowed to access it.

6. The method as described in claim 1, characterized in that, The distributed edge nodes use a blockchain structure for log storage to ensure the immutability and audit traceability of the off-site data analysis process.

7. The method according to any one of claims 1 to 6, characterized in that, After generating risk warning information, further adjust the computing resource quota according to the node type: allocate more CPU / memory resources to high-risk nodes within the domain for in-depth analysis, and limit the upper limit of resource usage for nodes outside the domain to prevent overload.

8. A comprehensive risk data analysis device, characterized in that, include: The data acquisition module is used to acquire risk data of multiple nodes in the network and their associated data. The node partitioning module is used to partition the nodes into intra-domain nodes and extra-domain nodes based on preset node affiliation rules. The analysis strategy execution module is used to perform real-time analysis on the risk data of nodes within the domain using the first analysis strategy, and to perform aggregated analysis on the risk data of nodes outside the domain using the second analysis strategy. The storage control module is used to store intra-domain analysis results in a local encrypted database and to store extra-domain analysis results in anonymized form on distributed edge nodes. The early warning and resource scheduling module is used to generate risk warning information and dynamically allocate computing resources based on node type.

9. A computer-readable medium having stored thereon computer program instructions that, when executed by a processor, cause the processor to implement the global risk data analysis method as described in any one of claims 1 to 7.

10. A computer program product comprising computer program code configured to execute the global risk data analysis method as described in any one of claims 1 to 7 at runtime, wherein... The computer program products are deployed as software modules on cloud servers, local data centers, or hybrid architecture platforms.

Images