Multi-dimensional dynamic evaluation system for enterprise security risk

Abstract

The invention discloses a multi-dimensional dynamic evaluation system for enterprise security risks, and the system comprises a data preprocessing module which generates a plurality of pieces of preprocessed enterprise operation time sequence data; the multi-channel matrix construction module is used for constructing a two-dimensional matrix containing original data, first-order derivative data and second-order derivative data and generating a multi-channel matrix; the channel attention module is used for carrying out dimensionality reduction and dimensionality increase on the multi-channel matrix, generating a channel weight and generating a two-dimensional feature matrix; the information aggregation module is used for generating original data feature vectors; the prediction module is used for generating an original data expected vector; and the risk assessment module is used for generating the security risk of the corresponding original data. Therefore, the method can adapt to the enterprise operation time sequence data of various specifications, can systematically integrate the original information of the time sequence data, and can accurately reflect the contribution degree of each operation dimension to the overall risk of the enterprise.

Description

Technical Field

[0001] This invention relates to the field of enterprise information management technology, specifically to a multi-dimensional dynamic assessment system for enterprise security risks. Background Technology

[0002] With the advancement of digital operations and refined management in enterprises, multi-dimensional and time-series enterprise operational data are becoming increasingly abundant. Data-driven security risk assessment has become a core technology direction for enterprise risk management, used to capture operational anomalies and potential risks, and to provide support for decision-making.

[0003] Existing enterprise security risk assessment technologies typically include data collection and preprocessing, feature extraction, and risk quantification. First, operational time-series data is processed through cleaning and normalization. Then, statistical analysis or simple feature fusion methods are used to extract data features. Finally, traditional models are combined to complete risk judgment or calculation. Some solutions optimize the extraction logic for specific operational dimensions or introduce basic trend analysis to assist in the assessment.

[0004] At the same time, existing technologies have failed to build a dynamic feature extraction and risk quantification system that adapts to multi-dimensional standardized enterprise operation time-series data, and lack the ability to effectively integrate deep dynamic features of data and quantify risks. Summary of the Invention

[0005] The present invention aims to at least partially solve the technical problems in the above-mentioned technologies.

[0006] To this end, the present invention discloses a multi-dimensional dynamic assessment system for enterprise security risks, comprising:

[0007] The data preprocessing module is used to receive multiple enterprise operation time series data and preprocess them to generate multiple preprocessed enterprise operation time series data.

[0008] A multi-channel matrix construction module is used to receive the preprocessed enterprise operation time series data, construct a two-dimensional matrix containing the original data, first derivative data and second derivative data for each enterprise operation time series data, and concatenate each two-dimensional matrix to generate a multi-channel matrix.

[0009] The channel attention module is used to receive the multi-channel matrix, perform dimensionality reduction and dimensionality increase on the multi-channel matrix in sequence through two fully connected layers to generate channel weights for each two-dimensional matrix, and multiply each two-dimensional matrix and its corresponding channel weights element by element to generate a two-dimensional feature matrix.

[0010] The information aggregation module is used to aggregate information for each of the two-dimensional feature matrices through a pooling layer to generate the original data feature vector;

[0011] The prediction module is used to receive the raw data and calculate each element in the raw data based on the prediction function to generate the raw data prediction vector;

[0012] The risk assessment module is used to calculate the convolution value of the original data feature vector and the corresponding expected vector of the original data, and to generate the corresponding security risk of the original data based on the convolution value by a ratio calculation.

[0013] The multi-dimensional dynamic assessment system for enterprise security risks disclosed in this invention has at least the following beneficial effects:

[0014] (1) It has good versatility and can be adapted to various standardized enterprise operation time series data without adjusting the core logic for specific data types;

[0015] (2) It can systematically integrate the original information, dynamic change rate and change trend of time series data, and other deep features, thereby improving the completeness of feature expression;

[0016] (3) It can accurately reflect the contribution of each business dimension to the overall risk of the enterprise.

[0017] In addition, the multi-dimensional dynamic assessment system for enterprise security risks disclosed in this invention may also have the following additional technical features:

[0018] In one embodiment of the present invention, the multi-channel matrix is ​​generated in the multi-channel matrix construction module according to the following steps:

[0019] For each of the aforementioned enterprise operation time series data Build containing raw data First derivative data and second derivative data Two-dimensional matrix Each of the two-dimensional matrices The components are spliced ​​together to generate the multi-channel matrix. .

[0020] In one embodiment of the present invention, in the channel attention module, the channel weights of each two-dimensional matrix are generated according to the following steps:

[0021] For the multi-channel matrix Each channel in the vector is subjected to global average pooling to generate a global feature vector. ;

[0022] The global feature vector is sequentially passed through two fully connected layers. Depend on Reducing dimensionality to one dimension, and increasing dimensionality from one dimension to... Dimension, to generate channel weight vector ;

[0023] The two-dimensional matrix and the corresponding channel weights Element-wise multiplication to generate a two-dimensional feature matrix. .

[0024] In one embodiment of the present invention, the weights in the two fully connected layers satisfy... The bias terms in the two fully connected layers satisfy .

[0025] In one embodiment of the present invention, the original data feature vector is generated in the information aggregation module according to the following steps:

[0026] For each of the two-dimensional feature matrices Through a pooling layer Information aggregation is performed to generate feature vectors of the original data. .

[0027] In one embodiment of the present invention, the prediction module generates the original data expectation vector according to the following steps:

[0028] Receive the raw data Based on the expected function Regarding the raw data Each element in the vector is computed to generate the expected vector of the original data. .

[0029] In one embodiment of the present invention, the risk assessment module generates the security risk of the corresponding original data according to the following steps:

[0030] Calculate the feature vector of the original data and the original data expected vector convolution value The convolution value Calculation by proportion The final value is the corresponding time-series data of the enterprise's operations. Security risks.

[0031] Additional features and advantages of this invention will be set forth in the description which follows, or may be learned by practicing the invention. Attached Figure Description

[0032] The technical solution and beneficial effects of the present invention will become apparent and readily understood from the following description in conjunction with the accompanying drawings, wherein:

[0033] Figure 1 This is a flowchart of the multi-dimensional dynamic assessment system for enterprise security risks according to the present invention;

[0034] Figure 2 This is another workflow diagram of the multi-dimensional dynamic assessment system for enterprise security risks of the present invention;

[0035] Figure 3 This is another workflow diagram of the multi-dimensional dynamic assessment system for enterprise security risks of the present invention;

[0036] Figure 4 This is another workflow diagram of the multi-dimensional dynamic assessment system for enterprise security risks of the present invention;

[0037] Figure 5 This is another workflow diagram of the multi-dimensional dynamic assessment system for enterprise security risks of the present invention;

[0038] Figure 6 This is another workflow diagram of the multi-dimensional dynamic assessment system for enterprise security risks of the present invention. Detailed Implementation

[0039] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0040] The multi-dimensional dynamic assessment system for enterprise security risks disclosed in this invention will now be described with reference to the accompanying drawings.

[0041] like Figure 1 As shown, a multi-dimensional dynamic assessment system for enterprise security risks includes:

[0042] The data preprocessing module is used to receive and preprocess multiple enterprise operation time series data to generate preprocessed multiple enterprise operation time series data;

[0043] The multi-channel matrix construction module is used to receive preprocessed enterprise operation time series data, construct a two-dimensional matrix containing the original data, first derivative data and second derivative data for each enterprise operation time series data, and concatenate each two-dimensional matrix to generate a multi-channel matrix;

[0044] The channel attention module receives a multi-channel matrix, performs dimensionality reduction and dimensionality increase on the multi-channel matrix sequentially through two fully connected layers to generate channel weights for each two-dimensional matrix, and multiplies each two-dimensional matrix and its corresponding channel weights element by element to generate a two-dimensional feature matrix.

[0045] The information aggregation module is used to aggregate information for each two-dimensional feature matrix through a pooling layer to generate the original data feature vector;

[0046] The prediction module receives the raw data and calculates each element in the raw data based on the prediction function to generate the expected vector of the raw data.

[0047] The risk assessment module is used to calculate the convolution value between the feature vector of the original data and the corresponding expected vector of the original data, and to generate the corresponding security risk of the original data based on the scale of the convolution value.

[0048] In one embodiment of the present invention:

[0049] like Figure 2 As shown, in the multi-channel matrix construction module, the multi-channel matrix is ​​generated according to the following steps:

[0050] For each enterprise's time-series operational data Build containing raw data First derivative data and second derivative data Two-dimensional matrix , each two-dimensional matrix The components are spliced ​​together to generate a multi-channel matrix. .

[0051] Specifically:

[0052] Enterprise operation time series data The first representing the same enterprise Time-series data in various operational dimensions, among which, Corresponding to different time points, The range of values ​​is This indicates the total number of operational data dimensions to be evaluated for the company.

[0053] Two-dimensional matrix During the construction process, the row dimension corresponds to the first row. Raw data of various operations First derivative data and second derivative data ,in,

[0054] Raw data First-order derivative data directly reflects the basic state of this operational dimension. The second derivative data reflects the rate of change of this dimension of data over time. It reflects the increasing or decreasing trend of the rate of change;

[0055] Column dimensions correspond Data points at each time point, i.e. It covers a continuous operating cycle.

[0056] Multi-channel matrix The generation method is to splice the data according to the channel dimension, that is, the enterprise... Two-dimensional matrix corresponding to various business dimensions By sequentially connecting these data, the multi-dimensional time-series data for each operational dimension are treated as an independent channel, forming a comprehensive... There are 1 channel, each channel is 1 Multi-channel matrix of dimensionality.

[0057] For the remaining technical details of this embodiment, please refer to the above embodiments, and they will not be repeated here.

[0058] In one embodiment of the present invention:

[0059] like Figure 3 As shown, in the channel attention module, the channel weights of each two-dimensional matrix are generated according to the following steps:

[0060] For multi-channel matrix Each channel in the vector is subjected to global average pooling to generate a global feature vector. ;

[0061] The global feature vector is then passed through two fully connected layers in sequence. Depend on Reducing dimensionality to one dimension, and increasing dimensionality from one dimension to... Dimension, to generate channel weight vector ;

[0062] Two-dimensional matrix and the corresponding channel weights Element-wise multiplication to generate a two-dimensional feature matrix. .

[0063] The weights in the two fully connected layers satisfy The bias terms in the two fully connected layers satisfy .

[0064] Specifically:

[0065] Multi-channel matrix Each channel in the middle corresponds to the first one of the same enterprise. Two-dimensional matrix of various business dimensions Global average pooling calculates the average value of all elements in each channel to obtain the global feature vector. elements in , Aggregate the first The overall characteristics of the data across various operational dimensions are used to avoid interference from local data fluctuations in feature extraction.

[0066] The two subsequent fully connected layers form the core of the attention mechanism; the first fully connected layer will... The dimensionality of the global feature vector is reduced to 1 dimension, thereby uncovering the potential correlation information between different business dimensions and realizing feature fusion between dimensions;

[0067] The second fully connected layer then upscales the 1D features back to 1D. Dimension, generate channel weight vector , For the first The weighting coefficients of each channel are used to quantify the importance of data in that dimension to the enterprise's security risk assessment.

[0068] The weights of the two fully connected layers follow a truncated normal distribution. Ensure that the initial weight values ​​are concentrated within a reasonable range to avoid extreme values ​​affecting model stability, and that the bias term satisfies... Random initialization increases the model's generalization ability.

[0069] Finally, each two-dimensional matrix With corresponding weights Element-wise multiplication enhances the features of important operational dimensions and suppresses noise in secondary dimensions, ultimately generating a two-dimensional feature matrix. It retains the multi-dimensional information of a single business dimension, and also incorporates the attention weight allocation at the dimension level.

[0070] For the remaining technical details of this embodiment, please refer to the above embodiments, and they will not be repeated here.

[0071] In one embodiment of the present invention:

[0072] like Figure 4 As shown, in the information aggregation module, the original data feature vector is generated according to the following steps:

[0073] For each two-dimensional feature matrix Through a pooling layer Information aggregation is performed to generate feature vectors of the original data. .

[0074] Specifically:

[0075] Two-dimensional feature matrix Its dimensions are still The row dimensions correspond to the original data, first-order derivative data, and second-order derivative data of the k-th operational dimension after weight adjustment. The pooling layer in the information aggregation module uses element-wise multiplication for each time node. The three types of data are merged, that is The core of this operation is to deeply aggregate static values, dynamic rate of change, and acceleration of change from a single operational dimension. For example, if the original cash flow data at a certain point in time is sufficient, the first derivative is positive (cash flow growth), and the second derivative is positive (accelerated growth), then the multiplied data will amplify the positive characteristics of that point. Conversely, if the original R&D investment data is insufficient, the first derivative is negative (investment decline), and the second derivative is negative (accelerated decline), then the risk characteristics of that point will be amplified. This fusion operation is performed sequentially at each time point, ultimately generating a dimension of... Original data feature vector This vector condenses the first Multi-dimensional dynamic information at each time point in the business operations.

[0076] For the remaining technical details of this embodiment, please refer to the above embodiments, and they will not be repeated here.

[0077] In one embodiment of the present invention:

[0078] like Figure 5 As shown, in the prediction module, the original data expectation vector is generated according to the following steps:

[0079] Receive raw data Based on the expected function For raw data Each element in the vector is computed to generate the expected vector of the original data. .

[0080] Specifically:

[0081] The core of the prediction module is through the expectation function. Construct the expected time-series data for this operational dimension under ideal conditions, where the index term... To fit the long-term trend of this operational dimension data, by adjusting... To reflect specific long-term trends, for example To reflect the reasonable growth trend of this dimension, A negative value reflects a reasonable decay trend in that dimension, specifically set according to the characteristics of the operational dimension, cosine term. The combination of these two methods, used to fit the periodic fluctuations of the data, allows the expectation function to take into account both the trend and periodicity of data in a single business dimension.

[0082] For each time point in the original data elements Substituting into the expected function, we obtain the corresponding expected value. The expected values ​​at each time point are arranged in order, thus generating the first... Original data expected vector for each business dimension This vector is essentially an ideal business trajectory constructed based on the historical raw data features of this dimension.

[0083] For the remaining technical details of this embodiment, please refer to the above embodiments, and they will not be repeated here.

[0084] In one embodiment of the present invention:

[0085] like Figure 6 As shown, in the risk assessment module, the security risks of the corresponding raw data are generated according to the following steps:

[0086] Calculate the feature vector of the original data and the expected vector of the original data convolution value Convolution value Calculation by proportion The final value is the corresponding business time series data. Security risks.

[0087] Specifically:

[0088] Original data feature vector Reflects the first of the same enterprise The actual multi-dimensional dynamic characteristics of various business dimensions, and the expected vector of the original data. This reflects the time-series data trajectory under ideal conditions in this operational dimension, and the convolution value of the two... Used to quantify the degree of deviation between the actual characteristics of this dimension and the ideal trajectory.

[0089] Convolution operations can effectively capture the feature vectors of the original data. and the expected vector of the original data Regarding the correlation in the time dimension, if the actual operating characteristics in this dimension highly match the expected trajectory, then the convolution value... If the actual operating characteristics of this dimension deviate significantly from the expected trajectory, then the convolution value will be relatively large. Smaller.

[0090] Subsequent proportional calculations The degree of deviation in a single operational dimension is standardized as its proportion in the overall risk of the enterprise, with the denominator being the enterprise's risk level. The sum of the convolution values ​​of the various operational dimensions represents the total deviation level at the enterprise operational level, with the numerator being the first... The convolution values ​​of each operational dimension are used to calculate the contribution percentage of that dimension to enterprise security risk. The final result is presented as a percentage; a higher value indicates a greater deviation between the actual data and the ideal trajectory for that operational dimension, and a more significant impact on the overall enterprise security risk. This is combined with all... By calculating the risk proportions across various dimensions, a multi-dimensional and dynamic assessment of enterprise security risks can be achieved.

[0091] For the remaining technical details of this embodiment, please refer to the above embodiments, and they will not be repeated here.

[0092] In summary, the multi-dimensional dynamic assessment system for enterprise security risks disclosed in this invention has at least the following beneficial effects:

[0093] (1) It has good versatility and can be adapted to various standardized enterprise operation time series data without adjusting the core logic for specific data types;

[0094] (2) It can systematically integrate the original information, dynamic change rate and change trend of time series data, and other deep features, thereby improving the completeness of feature expression;

[0095] (3) It can accurately reflect the contribution of each business dimension to the overall risk of the enterprise.

[0096] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A multi-dimensional dynamic assessment system for enterprise security risks, characterized in that, include: The data preprocessing module is used to receive multiple enterprise operation time series data and preprocess them to generate multiple preprocessed enterprise operation time series data. A multi-channel matrix construction module is used to receive the preprocessed enterprise operation time series data, construct a two-dimensional matrix containing the original data, first derivative data and second derivative data for each enterprise operation time series data, and concatenate each two-dimensional matrix to generate a multi-channel matrix. The channel attention module is used to receive the multi-channel matrix, perform dimensionality reduction and dimensionality increase on the multi-channel matrix in sequence through two fully connected layers to generate channel weights for each two-dimensional matrix, and multiply each two-dimensional matrix and its corresponding channel weights element by element to generate a two-dimensional feature matrix. The information aggregation module is used to aggregate information for each of the two-dimensional feature matrices through a pooling layer to generate the original data feature vector; The prediction module is used to receive the raw data and calculate each element in the raw data based on the prediction function to generate the raw data prediction vector; The risk assessment module is used to calculate the convolution value of the original data feature vector and the corresponding expected vector of the original data, and to generate the corresponding security risk of the original data based on the convolution value by a ratio calculation.

2. The multi-dimensional dynamic assessment system for enterprise security risks as described in claim 1, characterized in that, In the multi-channel matrix construction module, the multi-channel matrix is ​​generated according to the following steps: For each of the aforementioned enterprise operation time series data Build containing raw data First derivative data and second derivative data Two-dimensional matrix Each of the two-dimensional matrices The components are spliced ​​together to generate the multi-channel matrix. .

3. The multi-dimensional dynamic assessment system for enterprise security risks as described in claim 2, characterized in that, In the channel attention module, the channel weights of each two-dimensional matrix are generated according to the following steps: For the multi-channel matrix Each channel in the vector is subjected to global average pooling to generate a global feature vector. ; The global feature vector is sequentially passed through two fully connected layers. Depend on Reducing dimensionality to one dimension, and increasing dimensionality from one dimension to... Dimension, to generate channel weight vector ; The two-dimensional matrix and the corresponding channel weights Element-wise multiplication to generate a two-dimensional feature matrix. .

4. The multi-dimensional dynamic assessment system for enterprise security risks as described in claim 3, characterized in that, The weights in the two fully connected layers satisfy... The bias terms in the two fully connected layers satisfy .

5. The multi-dimensional dynamic assessment system for enterprise security risks as described in claim 3, characterized in that, In the information aggregation module, the original data feature vector is generated according to the following steps: For each of the two-dimensional feature matrices Through a pooling layer Information aggregation is performed to generate feature vectors of the original data. .

6. The multi-dimensional dynamic assessment system for enterprise security risks as described in claim 5, characterized in that, In the prediction module, the original data expected vector is generated according to the following steps: Receive the raw data Based on the expected function Regarding the raw data Each element in the vector is computed to generate the expected vector of the original data. .

7. The multi-dimensional dynamic assessment system for enterprise security risks as described in claim 6, characterized in that, In the risk assessment module, the security risks of the corresponding raw data are generated according to the following steps: Calculate the feature vector of the original data and the original data expected vector convolution value The convolution value Calculation by proportion The final value is the corresponding time-series data of the enterprise's operations. Security risks.

Images