Multistage risk management and control digital safety monitoring management method

Abstract

The invention discloses a multi-level risk management and control digital safety monitoring management method. The method comprises the following steps: firstly, collecting system and supervision index data and determining a risk level; secondly, extracting supervision historical data to form an operation sequence, converting the operation sequence into a dynamic directed graph, constructing a cause and effect graph model to output a baseline, and setting a threshold value; triggering deep temporary verification according to different levels of user super-operation times, detecting an artifact attack, and closing a session and performing early warning if an exception occurs; after verification is passed, behavior and supervision features are captured at the key business process node for secondary authority authentication; after the authentication is passed, performing short-time dynamic authorization and recording changes; according to the scheme, through acquisition of insurance data hierarchical management and control, a model is constructed in combination with historical operation to identify abnormity, attack is blocked by using a dynamic threshold value and deep verification, risks are prevented and controlled through secondary authentication of key nodes, short-time dynamic authorization gives consideration to flexibility and security, the real-time defense capability of a system for sensitive data leakage and other risks is improved, the false alarm rate is reduced, and the safety of the system is improved. And a full-life-cycle intelligent safety protection system is formed.

Description

Technical Field

[0001] This disclosure relates to the field of security monitoring technology, and in particular to a multi-level risk control digital security monitoring and management method. Background Technology

[0002] In the process of digital transformation of insurance business, business systems process massive amounts of insurance application data daily, covering highly sensitive content such as user identity information, health records, and financial documents. The risk of data leakage increases exponentially with the abuse of access permissions. Traditional access control relies on static role assignment, which is difficult to adapt to the differentiated operational needs of multi-level users (such as ordinary customers, agents, and risk control specialists), and lacks in-depth analysis of the temporal logic of operational behaviors. This allows attackers to bypass single-access verification by forging legitimate operation sequences. For example, attackers may use low-privilege accounts to frequently probe sensitive data interfaces, or carry out covert attacks by mimicking the operation intervals in normal business flows. Existing systems, unable to identify the causal dependencies between operations, struggle to effectively detect such complex threats.

[0003] Existing insurance system security monitoring solutions mostly focus on single-point attack defense, such as threshold alerts based on operation frequency or static feature comparison, but lack the ability to model the dynamic evolution of user behavior. On the one hand, user operating habits will fluctuate reasonably with changes in business scenarios (such as insurance purchase, claims, and renewal), and static baselines are prone to false alarms. On the other hand, attackers can use AI to generate adversarial examples to forge multimodal behavioral characteristics (such as simulating normal operation intervals and conditional probabilities), rendering traditional detection models ineffective. In addition, the lack of a multi-level user permission cross-verification mechanism means that low-privilege users may access highly sensitive data indirectly, and the system cannot trace the causal transmission path in the operation chain, making it difficult to locate the source of the attack and prevent the spread of risk. Summary of the Invention

[0004] This application provides a multi-level risk control and digital security monitoring management method. Through the integration of multi-dimensional technologies, it can achieve the following core effects in insurance business scenarios, effectively improving the accuracy of security protection and business continuity.

[0005] This application provides a multi-level risk control and digital security monitoring management method, including: S1, collect system data and regulatory indicator data, and determine the data risk level based on the threat level of the regulatory data; S2, extract historical regulatory data to calculate the conditional probability and time interval distribution between user operations to form an operation sequence, transform the operation sequence into a dynamic directed graph, construct a causal graph model by introducing a time decay factor, output the causal probability baseline and set an abnormal deviation threshold; S3: When users of different levels exceed the number of operations, deep temporary verification is triggered to perform causal behavior analysis and detect whether there is an artifact attack. If the verification is abnormal, the session is forcibly closed and an alert is issued. S4. After successful verification, secondary user authorization authentication is performed based on the user's behavioral characteristics and regulatory-related characteristics captured at key business process nodes. S5 grants short-term dynamic authorization based on behavioral characteristics after authentication, and records all authorization change records.

[0006] Preferably, the step of constructing a causal graph model by introducing a time decay factor to output a causal probability baseline and setting an abnormal deviation threshold specifically includes: extracting historical operation records from the insurance business system for the past n months, filtering out complete sessions containing L1-L3 level sensitivity data, and grouping them by user role; decomposing each session into an ordered list of operation events, calculating the time interval and logical association between adjacent operations; constructing a dynamic directed graph based on the time interval and logical association between adjacent operations, where nodes represent operation events, edges represent causal dependencies between operations, and the direction is from the preceding operation to the following operation; statistically analyzing the probability of the following operation occurring after the preceding operation in historical data, calculating the average time interval between adjacent operations, and converting it into a standardized score; weighting and summing the conditional probability and the time interval score to obtain the final weight of the edge, and assigning weights to historical data according to their time proximity; inputting the directed graph with comprehensive weights into a causal graph neural network, training the model, and outputting the causal probability baseline for each operation pair.

[0007] Preferably, step S3, detecting whether an artifact attack occurs, includes: recording each user's operation behavior in real time, classifying and statistically analyzing operation frequency according to user level, and setting a dynamic threshold based on the number of operations per hour plus a weighted average of sensitive operations; dynamically calculating the current number of operations using a sliding time window algorithm, and automatically triggering a deep temporary verification (DTV) when the cumulative value exceeds the threshold; extracting causal features from the user's last 5 operations by slicing them, and using a CGNN to calculate the deviation between the current sequence and the causal probability baseline; verifying whether the time interval between operations conforms to the user's historical pattern, training an isolated forest model based on the user's historical behavior, and calculating the anomaly score of the current operation; and when two consecutive forgery attack candidates are detected, starting fine-tuning of the CGNN model, adding new attack samples to the training set, and iteratively updating the causal probability baseline.

[0008] Preferably, the secondary user authentication specifically includes: dividing business process nodes according to data sensitivity, determining the behavioral features to be captured for each node, collecting behavioral data in real time, training an unsupervised model based on historical user behavior data, generating a normal behavior baseline for each node, and extracting static and dynamic features; calculating anomaly scores for each captured feature, combining all feature scores, and weightedly calculating the total risk score; setting authentication trigger conditions, and dynamically selecting the authentication method according to the risk level; if authentication is successful, allowing continued operation to proceed to step S5, and recording this operation as a trusted sample for updating the baseline model; if authentication fails, immediately terminating the current session, locking user permissions, and triggering an artifact attack warning.

[0009] Preferably, S4, capturing behavioral characteristics of key business process nodes, specifically includes: Real-time acquisition of system operation feature data and user biometric monitoring data; extraction of behavioral patterns and generation of physiological state entropy values ​​through time-series analysis. Decision hesitation patterns are modeled based on physiological state entropy values, cognitive load and risk preference are quantified, and cognitive risk entropy values ​​are generated. A comprehensive risk score is generated by weighted fusion of information entropy and cognitive risk entropy values, forming a risk profile for the current user; A baseline model is built based on the current user's historical behavior data. The current user's behavior baseline is calibrated by combining the normal behavior baseline of the node, and a dynamic live secondary user permission authentication fingerprint containing the time dimension is generated. When the overall risk score exceeds the individual baseline, secondary user authorization authentication is triggered.

[0010] Preferably, the comprehensive risk score includes: the comprehensive risk score calculation formula is: ,in, , The probability of a certain behavioral pattern occurring; ,in, The probability of a certain decision path.

[0011] Preferably, the probability of a certain decision path includes: user operation business process, recording response latency, option switching frequency, and operation cancellation / retry count data, combined with the physiological state entropy value of S41, to construct a joint feature vector. We model normal and abnormal decision paths using hidden Markov models and calculate the probability of deviation from the baseline; we also statistically analyze user acceptance rates of high-risk options to quantify the unpredictability of decision-making patterns.

[0012] Preferably, in S41, the biological characteristics specifically include: Based on user biometrics, distribution parameters are calculated periodically to establish an individual biological behavior evolution tree; A Gaussian process regression model is trained based on a behavioral evolution tree to predict the reasonable range of variation in the biometrics of legitimate users, and the sensitivity threshold of the baseline model is dynamically adjusted. An adversarial behavior drift detection mechanism is introduced to distinguish between normal evolutionary trees and aggressive mimicry behavior; The current risk score is correlated with the user's historical action chain to quantify the causal relationship between the current action and the historical behavior. The identification features of the attack mimicry behavior are adjusted based on the strength of the association, and the defense strategy is dynamically adjusted accordingly.

[0013] Preferably, the step of establishing an individual biological behavior evolution tree includes: periodically collecting user biometric data, establishing a time series database for each type of feature, and recording the collection timestamp and feature value distribution; calculating the statistical mean, variance, higher-order moments, and dynamic rate of change for the feature data within each time window, and generating a feature evolution vector; constructing a tree structure with the time axis as the horizontal axis and the feature parameters as the vertical axis, where nodes represent feature states and edges represent parameter change trends; using a hidden Markov model to label legitimate user behavior patterns, and distinguishing between normal evolution branches and abnormal branches based on the labeling results.

[0014] Preferably, the introduction of the adversarial behavior drift detection mechanism specifically includes: calculating the linear / nonlinear trend of each feature branch in the individual biological behavior evolution tree, and marking normal evolutionary trends and potential abnormal trends based on historical data; collecting biometric imitation patterns in known attack cases to extract key features, and converting the imitation behavior into quantifiable indicators; using CUSUM or Bayesian change point detection algorithms to identify abnormal jumps in feature parameters, and combining the historical evolution tree to determine whether the jumps conform to the laws of natural physiological changes; for detected mutation points, calculating the convergence speed of feature parameters to the historical baseline or target user pattern; if the convergence speed is significantly faster than the natural evolution rate, it is marked as a potential attack imitation; comparing the biometric drift direction with the operational behavior logic, jointly analyzing the drift synchronization of multimodal features, and if the drift directions of multimodal features are inconsistent, the attack credibility is improved.

[0015] One or more technical solutions provided in this application have at least the following technical effects or advantages: By collecting insurance data and categorizing it hierarchically, precise access control is achieved. A causal graph model is constructed based on historical operations to intelligently identify abnormal behavior patterns. Dynamic thresholds and deep verification are used to promptly block artifact attacks. At critical nodes, secondary authentication using multi-dimensional behavioral characteristics enables adaptive risk control. Finally, short-term dynamic authorization balances business flexibility and data security. This solution significantly improves the insurance system's real-time defense capabilities against risks such as sensitive data leakage and permission abuse, while reducing false positive rates, ensuring traceable compliance audits, and forming an intelligent security protection system covering the entire data lifecycle.

[0016] By fusing and analyzing multimodal biometrics and operational behaviors in real time, it is possible to accurately capture subtle fluctuations in the user's physiological and cognitive states, generate dynamic risk profiles, and effectively distinguish between human operations and automated attack behaviors. Combined with an adaptive baseline constructed using Gaussian mixture models and hidden Markov models, the authentication threshold can be intelligently adjusted according to changes in user behavior patterns and environment, reducing false alarm rates while improving the timeliness of risk response, ultimately forming a dynamic liveness authentication mechanism that balances security and user experience.

[0017] By constructing an individual biological behavior evolution tree and dynamically analyzing biometric drift, a high-precision distinction is achieved between legitimate user behavior patterns and attack imitation behaviors. Combined with a Gaussian process regression model to predict the reasonable range of feature variation, the defense sensitivity can be dynamically adjusted to reduce the false alarm rate. At the same time, by quantifying the causal strength of the current operation by associating it with historical operation chains, potential attack behaviors that deviate from normal patterns can be accurately identified. Furthermore, the accuracy of attack credibility judgment is improved based on multimodal feature synchronization analysis. Ultimately, an adaptive, low-interference dynamic defense strategy is formed, effectively balancing security and user experience. Attached Figure Description

[0018] Figure 1 This is a flowchart illustrating a multi-level risk control digital security monitoring and management method according to an embodiment of the present invention. Detailed Implementation

[0019] To facilitate understanding of the present invention, a more complete description of this application will be given below with reference to the accompanying drawings, which illustrate preferred embodiments of the invention. However, the invention can be implemented in many different forms and is not limited to the embodiments described herein. Rather, these embodiments are provided to enable a more thorough and complete understanding of the disclosure of the present invention.

[0020] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by a user of the art to which this invention pertains; the terminology used herein in the description of the invention is for the purpose of describing particular embodiments only and is not intended to limit the invention; the term "and / or" as used herein includes any and all combinations of one or more of the associated listed items.

[0021] Example 1: Figure 1 This is a flowchart illustrating a multi-level risk control digital security monitoring and management method according to an embodiment of the present invention.

[0022] like Figure 1 As shown, a multi-level risk control digital security monitoring and management method includes the following steps: S1 collects system data and regulatory indicator data, and determines the data risk level based on the threat level of the regulatory data.

[0023] Specifically, this involves collecting basic data from the insurance business system (policy number, policy type, policyholder information, premium amount, and policy timestamp), operational behavior data (user role, operation type, operation object ID and its sensitivity level), device behavior data (mouse movement trajectory, keyboard typing rhythm, and touch screen pressure distribution), and regulatory indicator data (such as the frequency of key operations related to regulatory compliance and abnormal transaction indicators). It also involves standardizing the time format of the data and mapping text fields (e.g., unifying "Male / Female" to "M / F").

[0024] Each operation record and regulatory data record is tagged according to the data sensitivity level (L1-L3) associated with the operation object and the risk level of the regulatory indicators. For example, when querying L2 level policy details, the operation record is tagged as "POLICY_QUERY_L2"; if an abnormal transaction regulatory indicator appears, it is tagged as "RISK_TRANSACTION_ALERT_X (X is the specific risk level identifier)".

[0025] The standardized data is categorized into sensitivity and access levels according to hierarchical standards, and risk levels are determined in conjunction with regulatory requirements. L1 (Public Data): Basic policy information that can be publicly queried (e.g., policyholder's name, policy effective date), stored in a public database table, with access control set to "readable by all users", and a low risk level.

[0026] L2 (Internal Data): Policy details requiring authorized access (e.g., sum assured, beneficiary information) are stored in an internal database. Access control is set to "assigned by user role," and the risk level is medium.

[0027] L3 (Highly Sensitive Data): Data involving core risk control or privacy (e.g., policy decryption keys, large claim review records) is stored in an independent security domain after being encrypted with AES-256. Access is only allowed through a dedicated API, and each access must be logged. The risk level is high.

[0028] For regulatory indicator data, the risk level is determined according to the preset regulatory rules. If a minor violation occurs, the risk level is medium; if a serious violation occurs, the risk level is high.

[0029] S2 extracts historical regulatory data to calculate the conditional probability and time interval distribution between user operations to form an operation sequence. The operation sequence is then transformed into a dynamic directed graph. By introducing a time decay factor, a causal graph model is constructed to output a causal probability baseline and set an abnormal deviation threshold.

[0030] Specifically, historical operation records and regulatory data records for the past 6 months are extracted from the insurance business system and regulatory system. Complete sessions containing L1-L3 level sensitivity data and regulatory risk data are selected (e.g., "Login → Query L2 policy → Download L3 claims record → Detect regulatory abnormal transaction indicator → Logout") and grouped by user role. Each session is broken down into an ordered list of operation events (e.g., [LOGIN, POLICY_QUERY_L2, CLAIM_DOWNLOAD_L3, RISK_TRANSACTION_ALERT_X, LOGOUT]). The time interval between adjacent operations (e.g., POLICY_QUERY_L2 and CLAIM_DOWNLOAD_L3 are 120 seconds apart) and logical correlation (e.g., POLICY_QUERY_L2 must occur before 90% of CLAIM_DOWNLOAD_L3 operations) are calculated. At the same time, the correlation between regulatory indicators and operations is analyzed (e.g., whether there is a specific operation sequence before a specific regulatory abnormal indicator occurs).

[0031] A dynamic directed graph is constructed based on the time intervals between adjacent operations, logical connections, and the relationship between regulatory indicators and operations. Nodes represent operation events and regulatory indicator events (e.g., POLICY_QUERY_L2, CLAIM_DOWNLOAD_L3, RISK_TRANSACTION_ALERT_X), and edges represent causal dependencies between operations or between operations and regulatory indicators, with the direction pointing from the preceding operation or indicator to the subsequent operation (e.g., POLICY_QUERY_L2→CLAIM_DOWNLOAD_L3, POLICY_QUERY_L2→RISK_TRANSACTION_ALERT_X (if such a relationship exists)). The probability of a subsequent operation or indicator occurring after the preceding operation is statistically analyzed in historical data (e.g., P(CLAIM_DOWNLOAD_L3|POLICY_QUERY_L2)=0.85, P(RISK_TRANSACTION_ALERT_X|POLICY_QUERY_L2)=0.1 (hypothetical values)). Calculate the average time interval between adjacent operations (e.g., the average interval between POLICY_QUERY_L2 and CLAIM_DOWNLOAD_L3 is 120 seconds) and convert it into a standardized score (the shorter the interval, the higher the score).

[0032] The final edge weight is obtained by weighting and summing the conditional probability (70%), the time interval score (30%), and the weight considering the correlation with regulatory indicators (determined based on the importance of the regulatory indicators). For example, 0.85 × 0.7 + 0.9 × 0.3 × 0.8 (assuming a regulatory indicator correlation weight of 0.8) = 0.772, where 0.9 is the standardized time interval score. Historical data is weighted according to its time proximity (e.g., 80% weight for data from the most recent month, and 20% weight for data from the last 1-3 months), making the model more focused on recent operational patterns and changes in regulatory indicators.

[0033] The weighted directed graph is input into a causal graph neural network (CGNN) to train the model, which outputs the causal probability baselines for each operation pair and the operation-regulatory indicator pair (e.g., P(CLAIM_DOWNLOAD_L3|POLICY_QUERY_L2)=0.82, P(RISK_TRANSACTION_ALERT_X|POLICY_QUERY_L2)=0.08). A sub-model is trained separately for each user role to adapt to the different operational habits and regulatory risks of different roles. Initial thresholds are set based on business experience and regulatory requirements (e.g., measured probability / baseline probability <0.7 is suspicious, <0.5 is high risk). The distribution of deviation values ​​for normal operations is statistically analyzed weekly, and the thresholds are automatically updated (e.g., using the 95th percentile as the new threshold to avoid false alarms). A causal graph visualization report is generated, displaying edge weights, historical probability distributions, and correlations with regulatory indicators.

[0034] S3: When users of different levels exceed the number of operations, deep temporary verification is triggered to perform causal behavior analysis and detect whether artifact attacks occur. If the verification is abnormal, the session is forcibly closed and an alert is issued.

[0035] Specifically, the system records each user's operational behavior (including timestamps, operation types, data sensitivity levels, and device fingerprints) and regulatory indicator data in real time. Operation frequency and the frequency of abnormal regulatory indicators are categorized and statistically analyzed by user level. The basic threshold for setting dynamic thresholds is the number of operations per hour plus a weighted average of sensitive operations and a threshold for the number of abnormal regulatory indicators. A sliding time window algorithm dynamically calculates the current number of operations and the number of abnormal regulatory indicators. When the cumulative value exceeds the threshold, the system automatically triggers a deep temporary verification (DTV).

[0036] The system segments the user's five most recent actions (e.g., "Login" → "Query" → "Download" → "Decrypt" → "Export") and correlates them with regulatory indicators to extract causal features (e.g., "Decryption" usually occurs after "Download," and no abnormal regulatory indicators appear after downloading data is considered normal). A CGNN is used to calculate the deviation (range 0-1) between the current sequence and the causal probability baseline; a smaller deviation indicates a more abnormal causal relationship. The system also verifies whether the time interval between operations conforms to the user's historical patterns (e.g., "Decryption" operations typically take 2 minutes; if it only takes 5 seconds this time, it's marked as abnormal) and whether regulatory indicators are within normal ranges (e.g., abnormal transaction indicators do not exceed thresholds). An Isolation Forest model is trained based on the user's historical behavior (operation frequency, time period, frequently used functions) and historical regulatory data to calculate the anomaly score (range 0-10) for the current operation. If the causal deviation value is <0.6 and the anomaly score for regular operations is >7, or if a regulatory indicator shows a serious anomaly, the operation is marked as a "candidate for forgery / attack or candidate for illegal operation."

[0037] When a "forged attack candidate or violation candidate" is detected 5-n times consecutively (n=2 in this application, which can be adjusted according to the application scenario in actual applications), the CGNN model is fine-tuned to adjust the hidden layer weights to strengthen the feature weights of the current attack mode or violation mode; new attack samples or violation samples are added to the training set, and the causal probability baseline is iteratively updated. If the CGNN outputs an abnormal confidence level ≥7, the following defense action is executed: Decoy defense: automatically inject forged high-value data paths and monitor whether attackers attempt to access them (triggering IP blocking or session termination); and the following defense action is executed: behavioral tracing: based on the causal graph, reverse trace the attack starting point or violation source, generate a time series graph (e.g., "IPX → simulate user A → attempt to decrypt L3 data → regulatory abnormal transaction indicators appear"), and associate it with the historical attack feature library and violation operation library to match known attack modes or violation modes.

[0038] The simulated user's permissions will be temporarily downgraded (access to L3 and higher data will be prohibited). Simultaneously, the user's behavior baseline will be reconstructed based on normal operations and compliance data from the past 30 days (originally 7 days, extending the historical data range). If the user requires urgent restoration of permissions, manual approval (confirmed by a superior administrator) is required to lift the restrictions ahead of schedule.

[0039] Generate attack path reports or violation operation reports (including causal time sequence diagrams, attack source IP or violation operation association information, attack methods or violation operation descriptions) and system self-healing instructions (user permission recovery time ≤ 30 seconds, previously < 1 minute). Automatically add newly detected artifact attack patterns or violation operation patterns to the database, match historical similar attacks or violations (by calculating feature vector distance through cosine similarity), and output defense suggestions.

[0040] S4. After successful verification, secondary user authorization authentication is performed based on the user's behavioral characteristics captured at key business process nodes and regulatory-related characteristics.

[0041] Specifically, business process nodes are divided according to data sensitivity and regulatory requirements. The behavioral and regulatory characteristics to be captured at each node are determined, and behavioral data (environmental characteristics: device type, operating system version, browser fingerprint, IP geolocation; operation characteristics: mouse trajectory, keyboard typing rhythm, touch pressure (mobile), page dwell time; business characteristics: operation object ID, data sensitivity level, correlation with historical operations (whether the same request is submitted repeatedly)) and regulatory characteristics (such as whether the operation complies with regulatory procedures, whether regulatory warning indicators are triggered, etc.) are collected in real time.

[0042] An unsupervised model is trained based on historical user behavior data and regulatory historical data to generate normal behavior baselines and compliance baselines for each node. Static features (user role, department, historical permission usage frequency (daily / weekly / monthly access to L1-L3 data), historical regulatory compliance records) and dynamic features (deviation of current operation from the baseline (e.g., standard deviation of input speed, cosine similarity of accessed data fields), deviation of current regulatory indicators from the compliance baseline) are extracted. An anomaly score (range 0-10) is calculated for each captured feature. All feature scores are combined and weighted to calculate a total risk score (weights are dynamically adjusted based on business sensitivity and regulatory importance).

[0043] Set authentication trigger conditions: Condition 1: Total risk score ≥ threshold; Condition 2: Triggered by specific high-risk characteristics (such as the occurrence of serious regulatory violations). Secondary authentication will be initiated if either condition is met. The authentication method will be dynamically selected based on the risk level (e.g., low risk (score 5-7): SMS verification code + device fingerprint verification; medium risk (score 7-9): biometrics (fingerprint / face) + hardware token; high risk (score ≥ 9): manual review (notifying the user's immediate supervisor to confirm the legality of the operation and verify regulatory compliance).

[0044] If authentication is successful, the user is allowed to continue to step S5, and this operation is recorded as a trusted sample for updating the baseline model. If authentication fails, the current session is immediately terminated, user privileges are locked, an artifact attack warning or violation operation warning is triggered, and the operation log (including behavioral characteristics, environmental data, and regulatory indicator data) is pushed to the security operations center.

[0045] Provide a fast appeal channel for legitimate users who are mistakenly blocked. After manual review, mark the operation as a whitelist sample and adjust the model threshold (reduce the risk score weight of the corresponding node for that user). If it is confirmed to be a artifact attack or a violation, extract the attack method, environmental characteristics, and violation details to update the threat intelligence database and violation database. Synchronize the new attack pattern or violation pattern to the CGNN causal verification model (refer to the S3 process) to enhance subsequent detection capabilities. Fully update the baseline model weekly, remove expired data (historical operation and regulatory data older than 90 days), and include new user behavior samples and compliance regulatory samples (which must be manually reviewed to confirm their legality and compliance).

[0046] S5, once certified, grants short-term dynamic authorization based on behavioral characteristics and regulatory requirements, and records all authorization changes.

[0047] Among them, short-term dynamic authorization can temporarily upgrade the permissions of the currently requested user.

[0048] Specifically, after successful authentication, the system temporarily elevates the user's permission level based on their current operational needs and regulatory requirements (limited to the current session, and only allowing access to higher-sensitivity data associated with the operation object, while ensuring compliance with regulatory requirements). For example, if an underwriter originally had access to L1-L2 data, but needed to decrypt L3-level policies in accordance with regulatory decryption procedures, L3 data decryption permissions would be temporarily granted, and the user would automatically revert to L2 permissions after decryption.

[0049] The technical solutions described in the embodiments of this application above have at least the following technical effects or advantages: By collecting insurance data and categorizing it hierarchically, precise access control is achieved. A causal graph model is constructed based on historical operations to intelligently identify abnormal behavior patterns. Dynamic thresholds and deep verification are used to promptly block artifact attacks. At critical nodes, secondary authentication using multi-dimensional behavioral characteristics enables adaptive risk control. Finally, short-term dynamic authorization balances business flexibility and data security. This solution significantly improves the insurance system's real-time defense capabilities against risks such as sensitive data leakage and permission abuse, while reducing false positive rates, ensuring traceable compliance audits, and forming an intelligent security protection system covering the entire data lifecycle.

[0050] Example 2: In Example 1, when the basic risk score generated based on user operation behavior characteristics does not reach the preset static threshold, the system directly uses a general behavioral baseline model for secondary authentication triggering. However, due to the individual differences and dynamic evolution of user behavior patterns, the distribution range of basic risk scores varies significantly among different users (or the same user at different times). Furthermore, the general baseline model is difficult to adapt to the dual constraints of common group behavior and individual behavioral characteristics, which can easily lead to false authentication triggers in low-risk user groups, while in high-risk user groups, the lenient baseline may result in missed detections.

[0051] In some embodiments, key business process nodes capture behavioral characteristics, and step S4 further includes: S41 collects system operation feature data and user biometric monitoring data in real time, and extracts behavioral patterns through time series analysis to generate physiological state entropy values.

[0052] Specifically, embedded sensors (infrared eye trackers, cameras, pressure-sensitive input devices) synchronously capture eye-tracking monitoring data (gaze coordinates, pupil diameter changes, blink frequency), micro-expression monitoring data (intensity and duration of facial muscle motor units (AUs),) and operational feature monitoring data (keyboard keystroke intervals, mouse movement speed / acceleration, touch pressure fluctuations). The data is aligned with timestamps, and cluster analysis is performed on the eye-tracking monitoring data to identify gaze hotspots and abnormal saccade patterns. Micro-expression temporal analysis detects the frequency and intensity of transient muscle contractions. Fourier transform is performed on the operational feature monitoring data to extract rhythmic anomalies (periodic fluctuations in non-human operational features). The extracted behavioral patterns are converted into probability distributions, and information entropy is calculated. in, This represents the probability of a certain behavioral pattern occurring.

[0053] S42, based on physiological state entropy values, models decision hesitation patterns, quantifies cognitive load and risk preference, and generates cognitive risk entropy values.

[0054] Specifically, during user operation processes, data such as response latency, option switching frequency, and operation undo / retry counts are recorded. Combined with the physiological state entropy value of S41, a joint feature vector is constructed. We model normal and abnormal decision paths using Hidden Markov Models (HMMs) and calculate the probability of deviation from the baseline. We also statistically analyze user acceptance rates for high-risk options to quantify the unpredictability of decision-making patterns. ,in, The probability of a certain decision path is calculated using a Hidden Markov Model (HMM) based on historical data and real-time features, and is used to quantify the unpredictability of decision-making patterns. The HMM models decision paths and outputs the probability of each path. The probability of deviation from the normal baseline is calculated; the acceptance rate of high-risk options by users is statistically analyzed to further quantify the unpredictability of decision-making patterns and serve as a basis for further analysis. The basis for the definition of distribution.

[0055] S43 generates a comprehensive risk score by weighted fusion of information entropy and cognitive risk entropy, forming a risk profile of the current user.

[0056] The formula for calculating the comprehensive risk score is as follows: .

[0057] S44: Construct a baseline model based on the current user's historical behavior data, calibrate the current user's behavior baseline by combining the node's normal behavior baseline, and generate a dynamic live secondary user permission authentication fingerprint that includes the time dimension.

[0058] Specifically, normal behavioral segments are extracted from historical user data, the mean and standard deviation of entropy values ​​at each level are calculated, and a Gaussian Mixture Model (GMM) is established as a baseline. The baseline distribution of similar users is aggregated, thresholds are adjusted to adapt to group characteristics, and user baselines are updated in real time. If the current score remains below the baseline, the threshold is gradually tightened; if environmental changes are detected, the threshold is temporarily relaxed.

[0059] S45: When the overall risk score exceeds the individual baseline, secondary user authorization authentication is triggered.

[0060] The technical solutions described in the embodiments of this application above have at least the following technical effects or advantages: By fusing and analyzing multimodal biometrics and operational behaviors in real time, it is possible to accurately capture subtle fluctuations in the user's physiological and cognitive states, generate dynamic risk profiles, and effectively distinguish between human operations and automated attack behaviors. Combined with an adaptive baseline constructed using Gaussian mixture models and hidden Markov models, the authentication threshold can be intelligently adjusted according to changes in user behavior patterns and environment, reducing false alarm rates while improving the timeliness of risk response, ultimately forming a dynamic liveness authentication mechanism that balances security and user experience.

[0061] Example 3: In Example 2, dynamic assessment of user behavior risk was achieved through real-time entropy analysis and dynamic baseline calibration. However, when facing the covert threat of attackers mimicking the biological behavior of legitimate users over a long period, the following limitations still exist: First, existing baseline models are built based on short-cycle behavioral data, making it difficult to capture the natural evolution of biological characteristics over time, and easily misjudging the physiological changes of legitimate users as abnormal. Second, attackers can evade short-term anomaly detection through gradual feature theft (such as slowly adjusting the keyboard typing rhythm to the target user's mode), while existing models lack the ability to identify the convergence process of biological characteristics. Third, the causal analysis of the operation chain only focuses on the temporal correlation of the current session and fails to establish the causal coupling relationship of cross-cycle behavioral patterns, resulting in insufficient ability to lock down long-term latent attacks.

[0062] In some embodiments, in step S41, the biometrics further includes: S411 calculates distribution parameters periodically based on user biometrics to establish an individual biological behavior evolution tree.

[0063] Specifically, user biometric data is collected periodically (monthly or quarterly), including eye movement trajectories (gaze sequence), operational stress (keyboard / touchscreen stress values), and micro-expressions (facial muscle motor unit intensity). A time-series database is established for each type of feature, recording the collection timestamps and feature value distribution. For the feature data within each time window, statistical parameters (mean, variance, higher-order moments) and dynamic change rates are calculated to generate feature evolution vectors (e.g., [t1: mean pupil size = 3.2mm, t2: 3.5mm, t3: 3.7mm]).

[0064] A tree structure is constructed with the time axis as the horizontal axis and the feature parameters as the vertical axis. Nodes represent feature states and edges represent parameter change trends. Hidden Markov Models (HMMs) are used to label legitimate user behavior patterns, and normal evolutionary branches and abnormal branches are distinguished based on the labeling results.

[0065] S412 trains a Gaussian process regression model based on a behavioral evolution tree to predict the reasonable range of variation in the biometrics of legitimate users and dynamically adjusts the sensitivity threshold of the baseline model.

[0066] S413 introduces an adversarial behavior drift detection mechanism to distinguish between normal evolutionary trees and aggressive mimicry behavior.

[0067] Specifically, the linear / non-linear trends of the time series of each feature branch in the evolutionary tree of individual biological behavior are calculated, and normal evolutionary trends and potential abnormal trends are marked based on historical data. Biological imitation patterns in known attack cases are collected, key features are extracted, and the imitation behavior is transformed into quantifiable indicators.

[0068] Using CUSUM or Bayesian change point detection algorithms, anomalous jumps in feature parameters are identified. Combined with historical evolution trees, it is determined whether these jumps conform to natural physiological changes. For detected mutation points, the convergence rate of feature parameters to the historical baseline or the target user's pattern is calculated. If the convergence rate is significantly faster than the natural evolution rate, it is marked as a potential attack imitation. Simultaneously, the drift direction of biometric features is compared with the logic of operational behavior. The synchronicity of drifts in multimodal features such as eye movements, operational stress, and micro-expressions is jointly analyzed. If the drift directions of multimodal features are inconsistent, the attack credibility is increased.

[0069] S414 performs correlation analysis between the current risk score and the user's historical operation chain to quantify the causal relationship between the current operation and historical behavior.

[0070] Specifically, the risk score of the current operation (based on biometric drift risk detected by S413) is mapped to the corresponding time window of the historical operation chain. The time distribution between the current operation and the previous historical operation is calculated to verify whether the current operation conforms to the permission transfer rules in the historical path (e.g., user A does not have direct export permissions, but in the past, exports were achieved through report forwarding by user B). The transmission path of the risk score in the historical operation chain is analyzed. Weights are assigned to temporal dependency, business logic consistency, and risk propagation pattern, and the total similarity score between the current operation and the historical path is calculated (e.g., temporal matching degree 0.8×0.4 + logical matching degree 0.6×0.3 + risk transmission matching degree 0.7×0.3 = 0.71). Based on the total similarity score, the causal strength is divided into three levels: strong correlation, medium correlation, and weak correlation. For weakly correlated operations, their deviation from the historical pattern is further analyzed, and these deviation features are marked as potential attack indicators for use in adjusting the S415 strategy.

[0071] S415 adjusts the identification features of attack mimicry behavior based on the correlation strength and dynamically adjusts the defense strategy.

[0072] The technical solutions described in the embodiments of this application above have at least the following technical effects or advantages: By constructing an individual biological behavior evolution tree and dynamically analyzing biometric drift, a high-precision distinction is achieved between legitimate user behavior patterns and attack imitation behaviors. Combined with a Gaussian process regression model to predict the reasonable range of feature variation, the defense sensitivity can be dynamically adjusted to reduce the false alarm rate. At the same time, by quantifying the causal strength of the current operation by associating it with historical operation chains, potential attack behaviors that deviate from normal patterns can be accurately identified. Furthermore, the accuracy of attack credibility judgment is improved based on multimodal feature synchronization analysis. Ultimately, an adaptive, low-interference dynamic defense strategy is formed, effectively balancing security and user experience.

[0073] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. For those skilled in the art, the present invention can have various modifications and variations. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A multi-level risk control and digital security monitoring management method, characterized in that, include: S1, collect system data and regulatory indicator data, and determine the data risk level based on the threat level of the regulatory data; S2, extract historical regulatory data to calculate the conditional probability and time interval distribution between user operations to form an operation sequence, transform the operation sequence into a dynamic directed graph, construct a causal graph model by introducing a time decay factor, output the causal probability baseline and set an abnormal deviation threshold; S3: When users of different levels exceed the number of operations, deep temporary verification is triggered to perform causal behavior analysis and detect whether there is an artifact attack. If the verification is abnormal, the session is forcibly closed and an alert is issued. S4. After successful verification, secondary user authorization authentication is performed based on the user's behavioral characteristics and regulatory-related characteristics captured at key business process nodes. S5, once certified, grants short-term dynamic authorization based on behavioral characteristics and regulatory requirements, and records all authorization changes.

2. The multi-level risk control digital security monitoring and management method as described in claim 1, characterized in that, The method of constructing a causal graph model by introducing a time decay factor to output a causal probability baseline and setting an abnormal deviation threshold specifically includes: extracting historical operation records from the insurance business system for the past n months, filtering out complete sessions containing L1-L3 level sensitivity data, and grouping them by user role; decomposing each session into an ordered list of operation events, calculating the time interval and logical association between adjacent operations; constructing a dynamic directed graph based on the time interval and logical association between adjacent operations, where nodes represent operation events and edges represent causal dependencies between operations, with the direction pointing from the preceding operation to the following operation; statistically analyzing the probability of the following operation occurring after the preceding operation in historical data, calculating the average time interval between adjacent operations, and converting it into a standardized score; weighting and summing the conditional probability and the time interval score to obtain the final weight of the edge, and assigning weights to historical data according to their time proximity; inputting the directed graph with the combined weights into a causal graph neural network, training the model, and outputting the causal probability baseline for each operation pair.

3. The multi-level risk control digital security monitoring and management method as described in claim 1, characterized in that, S3, the detection of artifact attacks, includes: real-time recording of each user's operation behavior, classifying and statistically analyzing operation frequency according to user level, and setting a dynamic threshold based on the number of operations per hour plus a weighted average of sensitive operations; dynamically calculating the current number of operations using a sliding time window algorithm, and automatically triggering DTV (Deep Temporary Verification) when the cumulative value exceeds the threshold; extracting causal features from the user's last 5 operations, and using CGNN (Current Characteristic Neural Network) to calculate the deviation between the current sequence and the causal probability baseline; verifying whether the time interval between operations conforms to the user's historical pattern, training an isolated forest model based on the user's historical behavior, and calculating the anomaly score of the current operation; and when two consecutive forgery attack candidates are detected, starting CGNN model fine-tuning, adding new attack samples to the training set, and iteratively updating the causal probability baseline.

4. The multi-level risk control digital security monitoring and management method as described in claim 1, characterized in that, The secondary user authentication process specifically includes: dividing business process nodes according to data sensitivity, determining the behavioral features to be captured for each node, collecting behavioral data in real time, training an unsupervised model based on historical user behavior data, generating a normal behavior baseline for each node, and extracting static and dynamic features; calculating anomaly scores for each captured feature, combining all feature scores, and weighted to calculate a total risk score; setting authentication trigger conditions, and dynamically selecting the authentication method according to the risk level; if authentication is successful, allowing continued operation to proceed to step S5, and recording this operation as a trusted sample for updating the baseline model; if authentication fails, immediately terminating the current session, locking user permissions, and triggering an artifact attack warning.

5. The multi-level risk control digital security monitoring and management method as described in claim 1, characterized in that, The S4, capturing behavioral characteristics of key business process nodes, specifically includes: Real-time acquisition of system operation feature data and user biometric monitoring data; extraction of behavioral patterns and generation of physiological state entropy values ​​through time-series analysis. Decision hesitation patterns are modeled based on physiological state entropy values, cognitive load and risk preference are quantified, and cognitive risk entropy values ​​are generated. A comprehensive risk score is generated by weighted fusion of information entropy and cognitive risk entropy values, forming a risk profile for the current user; A baseline model is built based on the current user's historical behavior data. The current user's behavior baseline is calibrated by combining the normal behavior baseline of the node, and a dynamic live secondary user permission authentication fingerprint containing the time dimension is generated. When the overall risk score exceeds the individual baseline, secondary user authorization authentication is triggered.

6. The multi-level risk control digital security monitoring and management method as described in claim 5, characterized in that, The comprehensive risk score includes the following: The comprehensive risk score calculation formula is as follows: ,in, , The probability of a certain behavioral pattern occurring; ,in, The probability of a certain decision path.

7. The multi-level risk control digital security monitoring and management method as described in claim 6, characterized in that, The probability of a certain decision path includes: user operation business process, recording response latency, option switching frequency, and operation cancellation / retry count data, combined with the physiological state entropy value of S41, to construct a joint feature vector. We model normal and abnormal decision paths using hidden Markov models and calculate the probability of deviation from the baseline; we also statistically analyze user acceptance rates of high-risk options to quantify the unpredictability of decision-making patterns.

8. The multi-level risk control digital security monitoring and management method as described in claim 5, characterized in that, In S41, the biological characteristics specifically include: Based on user biometrics, distribution parameters are calculated periodically to establish an individual biological behavior evolution tree; A Gaussian process regression model is trained based on a behavioral evolution tree to predict the reasonable range of variation in the biometrics of legitimate users, and the sensitivity threshold of the baseline model is dynamically adjusted. An adversarial behavior drift detection mechanism is introduced to distinguish between normal evolutionary trees and aggressive mimicry behavior; The current risk score is correlated with the user's historical action chain to quantify the causal relationship between the current action and the historical behavior. The identification features of the attack mimicry behavior are adjusted based on the strength of the association, and the defense strategy is dynamically adjusted accordingly.

9. The multi-level risk control digital security monitoring and management method as described in claim 8, characterized in that, The process of establishing an individual biological behavior evolution tree includes: periodically collecting user biometric data; establishing a time series database for each type of feature, recording the collection timestamp and feature value distribution; calculating the statistical mean, variance, higher-order moments, and dynamic rate of change for the feature data within each time window, and generating a feature evolution vector; constructing a tree structure with the time axis as the horizontal axis and the feature parameters as the vertical axis, where nodes represent feature states and edges represent parameter change trends; using a hidden Markov model to label legitimate user behavior patterns, and distinguishing between normal evolution branches and abnormal branches based on the labeling results.

10. The multi-level risk control digital security monitoring and management method as described in claim 8, characterized in that, The introduced adversarial behavior drift detection mechanism specifically includes: calculating the linear / nonlinear trend of each feature branch in the individual biological behavior evolution tree, and marking normal evolutionary trends and potential abnormal trends based on historical data; collecting biometric imitation patterns in known attack cases to extract key features, and converting the imitation behavior into quantifiable indicators; using CUSUM or Bayesian change point detection algorithms to identify abnormal jumps in feature parameters, and combining the historical evolution tree to determine whether the jumps conform to the laws of natural physiological changes; for detected mutation points, calculating the convergence speed of feature parameters to the historical baseline or target user pattern; if the convergence speed is significantly faster than the natural evolution rate, it is marked as a potential attack imitation; comparing the biometric drift direction with the operational behavior logic, jointly analyzing the drift synchronization of multimodal features, and if the drift directions of multimodal features are inconsistent, the attack credibility is improved.

Images