Risk diffusion prediction method, system and equipment for data assets and medium

Abstract

The invention provides a risk diffusion prediction method and system for data assets, equipment and a medium. The method comprises the following steps: acquiring data interaction information flow in real time; wherein the data interaction information is used for representing data interaction behaviors among different data assets; based on the data interaction information flow, determining a data interaction behavior corresponding to each data asset, and obtaining the data asset corresponding to the risk source according to the data interaction behavior; in a pre-constructed graph structure, predicting a risk diffusion condition from the risk source to other data assets, and obtaining a risk diffusion prediction result; wherein the graph structure is constructed by the following steps: based on a historical data interaction information flow obtained in advance, determining data interaction behaviors among data assets corresponding to the historical data interaction information flow, taking the data assets as asset nodes, and connecting the asset nodes with the data interaction behaviors by directed edges, thereby forming the graph structure. According to the invention, the timeliness and accuracy of risk identification are improved.

Description

Technical Field

[0001] This application relates to the field of data analysis technology, and in particular to a method, system, device and medium for predicting the risk diffusion of data assets. Background Technology

[0002] As enterprise information systems continue to expand, a large number of objects are gradually formed within enterprises for storing, processing, and transmitting data, such as database tables, business services, interfaces, and data synchronization tasks. Many of these objects contain user privacy or important business data, and any abnormal access or leakage can pose significant security risks to the enterprise. Existing data security technologies typically focus on detecting individual data assets or single access behaviors, such as determining whether a particular access is abnormal or whether a certain field is sensitive. While these technologies can detect abnormal behavior that has already occurred, they are largely reactive and provide alerts after the fact.

[0003] However, in real-world operating environments, various data assets commonly have relationships of access, synchronization, and sharing. When one data asset experiences an anomaly, the risk often spreads gradually along these relationships, affecting multiple downstream objects. Existing technologies typically lack systematic analysis of the relationships between data assets, making it difficult to predict in advance which objects the risk might spread to, and also making it difficult to explain the causes and paths of risk spread to security personnel, resulting in insufficiently targeted risk mitigation. Therefore, there is a need to provide a method, system, device, and medium for predicting the risk spread of data assets. Summary of the Invention

[0004] This application provides a method, system, device, and medium for predicting the risk diffusion of data assets, in order to solve the technical problem that it is difficult to accurately and timely predict the risk diffusion between data assets in the prior art.

[0005] This application provides a method for predicting the risk diffusion of data assets. The method includes: acquiring data interaction information flow in real time; wherein the data interaction information is used to characterize the data interaction behavior between different data assets; determining the data interaction behavior corresponding to each data asset based on the data interaction information flow, and thereby obtaining the data asset corresponding to the risk source; predicting the risk diffusion from the risk source to other data assets in a pre-constructed graph structure, and obtaining the risk diffusion prediction result; wherein the graph structure is constructed in the following way: based on the pre-acquired historical data interaction information flow, determining the data interaction behavior between each corresponding data asset, and taking each data asset as an asset node, connecting the asset nodes with data interaction behavior with directed edges, thereby forming a graph structure.

[0006] In one embodiment of this application, the step of determining the data interaction behavior corresponding to each data asset based on the data interaction information flow, and thereby obtaining the data asset corresponding to the risk source, includes: analyzing the data interaction behavior of each data asset based on the data interaction information flow, generating corresponding data usage information; determining the data asset with attack behavior based on the data usage information, and using it as the data asset corresponding to the risk source.

[0007] In one embodiment of this application, the step of determining the association between various data assets based on pre-acquired historical data interaction information flow and forming a graph structure accordingly includes: taking each data asset in the historical data interaction information flow as an asset node, and determining the directed edges between asset nodes according to the data flow direction in each historical data interaction information flow to form an initial graph structure; in the initial graph structure, determining the edge weights of each directed edge based on the data interaction behavior between each asset node to form a graph structure with edge weights; wherein the edge weights are used to characterize the data interaction intensity between corresponding asset nodes; in the graph structure with edge weights, assigning a preset initial risk value to each asset node to form a final graph structure.

[0008] In one embodiment of this application, the edge weight ,in, For asset nodes and asset nodes The boundary rights between them , and The preset weighting coefficients, Within the preset sampling period, asset nodes and asset nodes The number of interactions between them This represents the maximum number of interactions between asset nodes in the graph structure. Within the sampling period, asset nodes and asset nodes The amount of data interaction between them This represents the maximum amount of data interaction between asset nodes in the graph structure. Within the sampling period, asset nodes and asset nodes The degree of data overlap between them.

[0009] In one embodiment of this application, the step of predicting the risk diffusion from a risk source to other data assets and obtaining the risk diffusion prediction result in a pre-constructed graph structure includes: updating the initial risk value of the asset node corresponding to the risk source to a preset first risk value in the graph structure; wherein the first risk value is greater than the initial risk value of the remaining asset nodes; iteratively updating the risk value of each asset node based on the directed edges between asset nodes and their corresponding edge weights, and obtaining the final risk value of each asset node when a preset update termination condition is reached; wherein, during the first update, the risk value of each asset node is the corresponding initial risk value; selecting the asset nodes with the highest risk values ​​from the remaining asset nodes, excluding the asset node corresponding to the risk source, as target asset nodes; wherein K is a positive integer; determining the propagation link from the risk source to each target asset node based on the graph structure, and using the target asset nodes and their corresponding propagation links as the risk diffusion prediction result.

[0010] In one embodiment of this application, the updated risk value is: ,in, Let the risk value of the i-th asset node be the risk value after the (t+1)-th update. Let be the initial risk value for the i-th asset node. The preset diffusion control coefficient, Let be the edge weight from the j-th asset node to the i-th asset node. Let the risk value of the j-th asset node be the risk value after the t-th update. The preset sensitivity coefficient, The sensitivity preset for the i-th asset node.

[0011] In one embodiment of this application, after obtaining the risk diffusion prediction result, the method further includes: updating the corresponding edge weights based on the risk prediction result to obtain the updated graph structure.

[0012] This application also provides a risk diffusion prediction system for data assets. The system includes: a data acquisition module for acquiring data interaction information flow in real time; wherein the data interaction information is used to characterize the data interaction behavior between different data assets; a risk source determination module for determining the data interaction behavior corresponding to each data asset based on the data interaction information flow, and thereby obtaining the data asset corresponding to the risk source; and a risk propagation prediction module for predicting the risk diffusion from the risk source to other data assets in a pre-constructed graph structure, and obtaining the risk diffusion prediction result. The graph structure is constructed in the following way: based on the pre-acquired historical data interaction information flow, the data interaction behavior between the corresponding data assets is determined, and each data asset is used as an asset node. The asset nodes with data interaction behavior are connected by directed edges to form a graph structure.

[0013] This application also provides an electronic device, including: one or more processors; and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the electronic device enables the data asset risk diffusion prediction method described above.

[0014] This application also provides a computer-readable storage medium storing a computer program that, when executed by a computer's processor, causes the computer to perform any of the above-described methods for predicting the risk diffusion of data assets.

[0015] The beneficial effects of this application are as follows: This application proposes a method, system, device, and medium for predicting the risk diffusion of data assets. By acquiring data interaction information flow in real time and analyzing the interaction behavior between different data assets, it can promptly identify abnormal interaction patterns during the actual operation of data assets, thereby accurately identifying the risk source data asset as the starting point of the risk. Based on historical data interaction information, a directed graph structure reflecting the actual flow of data is constructed. Within this graph structure, the diffusion process of risk from the risk source to other data assets is predicted and analyzed. This allows risk assessment to move beyond being limited to a single data asset and instead quantify the propagation trend and impact range of risk among multiple related data assets. Compared to methods based solely on static data attributes or single-point alarms, this application improves the timeliness and accuracy of risk identification by starting from the dynamic interaction relationships between data assets, thereby effectively reducing the security impact of risk diffusion. Attached Figure Description

[0016] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application. It is obvious that the drawings described below are merely some embodiments of this application, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0017] In the attached diagram: Figure 1 A flowchart illustrating a method for predicting the risk diffusion of data assets provided in an embodiment of this application; Figure 2 This is a structural block diagram of a data asset risk diffusion prediction system provided in one embodiment of this application; Figure 3 This is a schematic diagram of the structure of an electronic device provided in one embodiment of this application. Detailed Implementation

[0018] The following specific examples illustrate the implementation of this application. Those skilled in the art can easily understand other advantages and effects of this application from the content disclosed in this specification. This application can also be implemented or applied through other different specific embodiments. Various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this application. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0019] It should be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of this application. The drawings only show the components related to this application and are not drawn according to the actual number, shape and size of the components in the actual implementation. In the actual implementation, the form, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0020] In the following description, numerous details are explored to provide a more thorough explanation of embodiments of the present application. However, it will be apparent to those skilled in the art that embodiments of the present application may be practiced without these specific details. In other embodiments, well-known structures and devices are shown in block diagram form rather than in detail to avoid obscuring embodiments of the present application.

[0021] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in the technical solution of this application all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0022] The inventors discovered that as enterprises increase their level of informatization, a large amount of data assets gradually accumulate within them, including but not limited to database tables, log data, interface data, and data processed by application services. These data assets typically have complex data interactions and business dependencies. Once an abnormal access or data breach occurs to a data asset, the risk is often not limited to that single asset but may gradually spread across multiple data assets along data flows or business relationships. However, most existing data security technologies focus on identifying static sensitive data itself or issuing alerts for single assets after a data breach occurs, making it difficult to assess the potential impact of the risk on other related data assets from an overall perspective.

[0023] In real-world security incidents, enterprises often struggle to answer questions such as "Which data assets might be further affected by the current risk event?" and "What data asset might be affected next?" Existing situational awareness or security monitoring solutions typically only detect hot or sensitive data objects, lacking the ability to comprehensively model data flow and business relationships between data assets. They cannot represent the propagation capabilities and paths of risks across different data assets, leading to a reactive approach after a risk occurs, making it difficult to implement timely preventative measures. Therefore, there is an urgent need for a technical solution that can construct relationships between data assets, quantify the probability of risk propagation between assets, and output an interpretable risk transmission chain. This would transform risk situational awareness into proactive prediction and early warning capabilities, reducing the security impact of risk spread.

[0024] This application provides a method for predicting the risk diffusion of data assets. By acquiring data interaction information flow in real time and analyzing the interaction behavior between different data assets, it can promptly identify abnormal interaction patterns during the actual operation of data assets, thereby accurately identifying the risk source data asset as the starting point of the risk. Based on historical data interaction information, a directed graph structure reflecting the actual flow of data is constructed. Within this graph structure, the diffusion process of risk from the risk source to other data assets is predicted and analyzed. This allows risk assessment to move beyond a single data asset and quantify the propagation trend and impact range of risk among multiple related data assets. Compared to methods based solely on static data attributes or single-point alarms, this application improves the timeliness and accuracy of risk identification by starting from the dynamic interaction relationships between data assets. It can not only identify potentially affected data assets in advance but also provide more forward-looking decision-making basis for risk warning and security governance, thereby effectively reducing the security impact of risk diffusion.

[0025] like Figure 1 As shown, the method for predicting the risk diffusion of data assets includes the following steps: S100, Real-time acquisition of data interaction information flow; wherein, data interaction information is used to characterize the data interaction behavior between different data assets.

[0026] The system collects data interaction information between various data assets in real time. This information records specific interaction events between data assets, including but not limited to data call records, data read / write records, data transmission records, and data synchronization records. By continuously collecting this data interaction information within a preset sampling period, a data interaction information stream reflecting the interactions between data assets is formed. Data assets represent objects used to store, process, or transmit data within the enterprise information system, including but not limited to database tables, data services, log sources, application interfaces, and business systems. By mapping this data interaction information to corresponding data assets, a foundational data support can be provided for subsequent analysis of the relationships between data assets and the propagation of risks.

[0027] S200. Based on the data interaction information flow, determine the data interaction behavior corresponding to each data asset, and obtain the data asset corresponding to the risk source accordingly.

[0028] Each data interaction message in the data interaction information flow is parsed and processed to identify the data assets involved in the data interaction, and each data interaction message is mapped to a corresponding data asset. For each data asset, its data interaction participation is statistically summarized within a preset sampling period to determine the corresponding data interaction behavior. Data interaction behavior characterizes the way and extent in which a data asset interacts with other data assets within the sampling period, including but not limited to the number of interactions, interaction frequency, interaction direction, and the scale of data involved, reflecting the activity level and behavioral characteristics of the data asset in the overall data interaction network. Based on the determined data interaction behavior, a risk assessment is performed on each data asset, and the data assets corresponding to risk sources are identified accordingly. Risk sources represent data assets identified as potentially causing risk diffusion within the current analysis period.

[0029] In an optional embodiment of this application, step S200 includes the following process: based on the data interaction information flow, analyze the data interaction behavior of each data asset and generate corresponding data usage information; based on the data usage information, determine the data assets with attack behavior and identify them as the data assets corresponding to the risk source.

[0030] Based on preset data asset identification rules, each data interaction message in the data interaction information flow is parsed and processed to extract the data asset identifiers participating in the data interaction. The data asset identifier, as a unique identifier indicating the data asset participating in the data interaction, can include, but is not limited to, database identifiers, data table identifiers, data service identifiers, log source identifiers, or interface identifiers. Through the above parsing process, the original, discrete data interaction information can be uniformly mapped to the corresponding data assets, thereby achieving asset-level normalized expression for different types of data interaction events. For each data asset, its related data interaction information is statistically and aggregated within a preset sampling period to determine the data interaction behavior corresponding to the data asset, and further generate data usage information reflecting the operational status of the data asset. Data usage information is used to characterize the actual usage of the data asset within the sampling period, including but not limited to the number of data interactions, interaction frequency, data interaction volume, interaction direction distribution, or interaction object range, and the data usage information can be one or any combination of the above, without specific limitations. Data usage information is matched with preset attack behavior judgment criteria. When the data usage information of a data asset meets the attack behavior judgment criteria, the data asset is determined to have an attack or abnormal risk and is identified as the data asset corresponding to the risk source. For example, when the data interaction frequency or data interaction volume of a database is significantly higher than its historical baseline within a unit of time, or when the scope of its interaction objects expands abnormally, the database can be identified as a risk source and used as the starting point for subsequent risk diffusion prediction.

[0031] Understandably, the number of risk sources is not limited; there can be one or more. When there are multiple risk sources, joint risk diffusion prediction can be carried out based on each risk source in the data asset association structure to comprehensively assess the propagation trend and impact range of risks when multiple starting points exist simultaneously.

[0032] S300. In a pre-constructed graph structure, predict the risk diffusion from the risk source to other data assets and obtain the risk diffusion prediction result. The graph structure is constructed in the following way: based on the pre-acquired historical data interaction information flow, determine the data interaction behavior between the corresponding data assets, and take each data asset as an asset node. Connect the asset nodes with data interaction behavior with directed edges to form a graph structure.

[0033] Based on a pre-constructed data asset graph structure, this study predicts and analyzes the diffusion process of risks among data assets. The graph structure is built upon historical data interaction information flows, where each data asset is abstracted as an asset node. These asset nodes form directed connections based on historical data interaction behavior, reflecting the actual flow direction of data between different assets. In this graph structure, the asset node corresponding to the data asset identified as a risk source serves as the starting point for risk propagation, transforming the risk diffusion problem into a propagation calculation problem within the directed graph structure. Specifically, based on the directed edges between asset nodes, risk propagation is modeled along the data interaction direction. Combining the correlation strength between nodes, the degree of risk impact on each asset node is calculated step-by-step, simulating the process of risk diffusion from the risk source to other data assets. By calculating the risk propagation process within the graph structure, it is possible to predict which data assets may be affected by the risk and the possible propagation paths, obtaining risk diffusion prediction results that characterize the scope, direction, and degree of risk diffusion. These risk diffusion prediction results not only indicate potentially affected data assets but also provide a basis for subsequent risk warnings and security governance.

[0034] In an optional embodiment of this application, the graph structure generation process includes: taking each data asset in the historical data interaction information flow as an asset node, and determining the directed edges between the asset nodes according to the data flow direction in each historical data interaction information to form an initial graph structure; in the initial graph structure, determining the edge weights of each directed edge based on the data interaction behavior between each asset node to form a graph structure with edge weights; wherein, the edge weights are used to characterize the data interaction intensity between the corresponding asset nodes; in the graph structure with edge weights, assigning a preset initial risk value to each asset node to form the final graph structure.

[0035] The historical data interaction information flow is parsed and processed. Based on the data asset identifiers obtained from the parsing, each data asset participating in the historical data interaction information flow is mapped to an asset node in a graph structure. Further, based on the data flow direction recorded in the historical data interaction information, the transmission direction of data between different data assets is determined, and directed edges are established between the corresponding asset nodes accordingly, forming an initial graph structure representing the data transmission direction between data assets. The directed edges point from the asset node of the data sender to the asset node of the data receiver. Further, the interaction behavior between each data asset in the historical data interaction information flow is analyzed in the initial graph structure to quantify the data interaction intensity between asset nodes. Specifically, within a preset sampling period, for each asset node, the data interaction intensity between that asset node and its corresponding asset node is statistically analyzed along its corresponding directed edge, and corresponding edge weights are formed accordingly, resulting in a graph structure with edge weights. The data interaction intensity includes, but is not limited to, the number of data interactions, the amount of data interaction, and the degree of data sharing, and can be a weighted combination of one or more of these, without specific limitations. The edge weights are used to represent the probability of risk transmission between corresponding asset nodes. In a graph structure with edge weights, an initial risk value is initialized for each directed edge to characterize the basic risk state of each data asset before the risk diffusion prediction begins, thus obtaining the final graph structure. In an optional embodiment of this application, the edge weight ,in, For asset nodes and asset nodes The boundary rights between them , and The preset weighting coefficients, Within the preset sampling period, asset nodes and asset nodes The number of interactions between them This represents the maximum number of interactions between asset nodes in the graph structure. Within the sampling period, asset nodes and asset nodes The amount of data interaction between them This represents the maximum amount of data interaction between asset nodes in the graph structure. Within the sampling period, asset nodes and asset nodes The degree of data overlap between them.

[0036] Specifically, when constructing the data asset association graph structure, it is necessary to quantify the association strength between asset nodes to reflect the ability of risk to propagate between different data assets. Therefore, within a preset sampling period, for any two asset nodes with data interaction relationships, the number of data interactions and the corresponding data interaction volume are counted within that sampling period, and the data overlap between these two asset nodes is further analyzed. To eliminate the impact of differences in asset size and business volume on the calculation results, the number of interactions and the data interaction volume are normalized to allow for comparison under a unified dimension. Based on preset weight coefficients, the number of interactions, the data interaction volume, and the data overlap are weighted and fused to obtain the edge weights between asset nodes.

[0037] In an optional embodiment of this application, the step of predicting the risk diffusion from a risk source to other data assets and obtaining the risk diffusion prediction result in a pre-constructed graph structure includes: updating the initial risk value of the asset node corresponding to the risk source to a preset first risk value in the graph structure; wherein the first risk value is greater than the initial risk value of the remaining asset nodes; iteratively updating the risk value of each asset node based on the directed edges between asset nodes and their corresponding edge weights, and obtaining the final risk value of each asset node when a preset update termination condition is reached; wherein, during the first update, the risk value of each asset node is the corresponding initial risk value; selecting the asset nodes with the highest risk values ​​from the remaining asset nodes, excluding the asset node corresponding to the risk source, as target asset nodes; wherein K is a positive integer; determining the propagation link from the risk source to each target asset node based on the graph structure, and using the target asset nodes and their corresponding propagation links as the risk diffusion prediction result.

[0038] The asset nodes corresponding to identified risk sources are used as the starting point for risk diffusion prediction, and a preset first risk value is used as the initial risk value for that asset node. This first risk value is higher than the initial risk values ​​of other asset nodes, indicating that the asset has been detected as having an attack or abnormal behavior. The initial risk values ​​of the remaining asset nodes are kept at a lower level to reflect their basic risk status before the risk diffusion begins. This method clearly defines the starting point and initial risk distribution of risk diffusion within the graph structure. Based on the directed edges and their corresponding weights between the asset nodes in the graph structure, the risk values ​​are iteratively updated. In each iteration, the risk values ​​of adjacent asset nodes are weighted and aggregated according to the propagation direction defined by the directed edges to obtain the updated risk value of the current asset node, thus representing the process of risk gradually spreading along the data asset interaction relationship. Furthermore, the influence of the initial risk value on the final result is preserved in the iterative update to avoid the risk source information being completely diluted after multiple rounds of propagation. When the change in risk value of each asset node in two adjacent iterations is lower than a preset threshold or the number of iterations reaches a preset upper limit, the risk propagation process is determined to have reached a stable state, and the risk value at this point is taken as the final risk value of each asset node. After obtaining the final risk value, from the asset nodes other than the asset node corresponding to the risk source, the asset nodes with the highest final risk values ​​are selected as target asset nodes. Furthermore, in the graph structure, based on each directed edge, the propagation link from the risk source to each target asset node is determined. The propagation link is used to characterize the main propagation path of risk in the data asset association graph structure, so that the risk diffusion prediction results can not only indicate the potentially affected data assets, but also clarify the specific direction and transmission relationship of risk diffusion, providing an interpretable decision-making basis for subsequent security handling and risk governance.

[0039] Considering that when risk propagation calculations are based solely on graph structure and edge weights, the risk value of an asset node is primarily determined by the risk status of its neighboring nodes, while this approach can depict the propagation process of risk along data interaction relationships, it fails to reflect the differences in the security importance and risk tolerance of different data assets. In real-world scenarios, even data assets in the same propagation position may experience significantly different consequences once affected by risk. For example, assets involving core business data or highly sensitive data should have their risks amplified. Therefore, this application introduces sensitivity into its risk propagation prediction, ensuring that the risk assessment results are not only affected by external propagation but also comprehensively reflect the importance and sensitivity attributes of the asset itself, thereby improving the accuracy of the risk propagation prediction results. Optionally, the updated risk value can be calculated as follows: ,in, Let the risk value of the i-th asset node be the risk value after the (t+1)-th update. Let be the initial risk value for the i-th asset node. The preset diffusion control coefficient, Let be the edge weight from the j-th asset node to the i-th asset node. Let the risk value of the j-th asset node be the risk value after the t-th update. The preset sensitivity coefficient, A sensitivity is preset for the i-th asset node. During the risk value update process, this sensitivity is also incorporated into the risk propagation calculation to correct the risk value of the asset node in each iteration. The sensitivity coefficient is... This is used to control the weight of an asset's inherent sensitivity in the overall risk assessment. When an asset node has high sensitivity, even if the propagation risk from neighboring nodes is low, its updated risk value will still be relatively high, thus avoiding underestimation of the risk of highly sensitive assets. By combining sensitivity with the propagation results of the graph structure, collaborative modeling of external propagation risk and the asset's inherent risk attributes is achieved, making the risk diffusion prediction results more consistent with the distribution of security risks in real business environments.

[0040] Understandably, the above sensitivity This parameter represents the sensitivity level of the i-th data asset node itself. It can be pre-determined based on factors such as the type of data asset, the sensitivity level of the data it contains, business importance, or compliance requirements. For example, data assets containing user privacy information, financial data, or core business data can have a higher sensitivity value; while assets used only for temporary caching or log recording can have a relatively lower sensitivity value. Sensitivity can be automatically generated through manual configuration, rule matching, or by combining existing data classification and grading results; the specific method is not limited.

[0041] In an optional embodiment of this application, after obtaining the risk diffusion prediction result, the method further includes: updating the corresponding edge weights based on the risk prediction result to obtain an updated graph structure. Specifically, based on the risk level and risk propagation path corresponding to each asset node in the risk diffusion prediction result, the strength of the association between asset nodes is adjusted, and the edge weights of the corresponding directed edges are updated accordingly. Through this method, the updated graph structure can dynamically reflect the impact of changes in risk status on the association between data assets, thereby more accurately depicting the propagation trend of risk among data assets in subsequent risk analysis or prediction processes, and improving the real-time performance and adaptability of overall risk modeling.

[0042] like Figure 2As shown, the risk diffusion prediction system for data assets includes: a data acquisition module 210, a risk source determination module 220, and a risk propagation prediction module 230. The data acquisition module 210 is used to acquire data interaction information streams in real time; wherein, the data interaction information is used to characterize the data interaction behavior between different data assets. The risk source determination module 220 is used to determine the data interaction behavior corresponding to each data asset based on the data interaction information stream, and thereby obtain the data asset corresponding to the risk source. The risk propagation prediction module 230 is used to predict the risk diffusion from the risk source to other data assets in a pre-constructed graph structure, and obtain the risk diffusion prediction result. The graph structure is constructed as follows: based on the pre-acquired historical data interaction information stream, the data interaction behavior between the corresponding data assets is determined, and each data asset is used as an asset node. Asset nodes with data interaction behavior are connected by directed edges, thereby forming a graph structure.

[0043] Specific limitations regarding the risk diffusion prediction system for data assets can be found in the limitations on the risk diffusion prediction method for data assets described above, and will not be repeated here. Each module in the aforementioned risk diffusion prediction system for data assets can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device in hardware format, or stored in the memory of a computer device in software format, so that the processor can call the corresponding operations of each module.

[0044] It should be noted that, in order to highlight the innovative aspects of this application, this embodiment does not introduce modules that are not closely related to solving the technical problems proposed in this application, but this does not mean that there are no other modules in this embodiment.

[0045] like Figure 3 As shown, the electronic device 3 may include a memory 31, a processor 32 and a bus, and may also include a computer program stored in the memory 31 and capable of running on the processor 32, such as a risk diffusion prediction program for data assets.

[0046] The memory 31 includes at least one type of readable storage medium, including flash memory, portable hard drive, multimedia card, card-type memory (e.g., SD or DX memory), magnetic memory, disk, optical disk, etc. In some embodiments, the memory 31 can be an internal storage unit of the electronic device 3, such as a portable hard drive. In other embodiments, the memory 31 can be an external storage device of the electronic device 3, such as a plug-in portable hard drive, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the electronic device 3. Furthermore, the memory 31 can include both internal and external storage units of the electronic device 3. The memory 31 can be used not only to store application software and various types of data installed on the electronic device 3, such as code for predicting the risk diffusion of data assets, but also to temporarily store data that has been output or will be output.

[0047] In some embodiments, processor 32 may be composed of integrated circuits, such as a single packaged integrated circuit or multiple integrated circuits with the same or different functions, including combinations of one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and various control chips. Processor 32 is the control unit of electronic device 3, connecting various components of the entire electronic device 3 via various interfaces and lines. It executes programs or modules stored in memory 31 (such as a data asset risk diffusion prediction program) and calls data stored in memory 31 to perform various functions of electronic device 3 and process data.

[0048] Processor 32 executes the operating system of electronic device 3 and various installed applications. Processor 32 executes applications to implement the steps in the aforementioned data asset risk diffusion prediction method.

[0049] For example, a computer program may be divided into one or more modules, one or more of which are stored in memory 31 and executed by processor 32 to complete this application. One or more modules may be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of the computer program in electronic device 3. For example, the computer program may be divided into a data acquisition module 210, a risk source identification module 220, and a risk propagation prediction module 230.

[0050] The integrated unit implemented as a software functional module described above can be stored in a computer-readable storage medium, which can be non-volatile or volatile. The software functional module stored in the storage medium includes several instructions to cause a computer device (which may be a personal computer, computer equipment, or network device, etc.) or processor to execute some functions of the data asset risk diffusion prediction method of the various embodiments of this application.

[0051] The above embodiments are merely illustrative of the principles and effects of this application and are not intended to limit this application. Any person skilled in the art can modify or alter the above embodiments without departing from the spirit and scope of this application. Therefore, all equivalent modifications or alterations made by those skilled in the art without departing from the spirit and technical concept disclosed in this application should still be covered by the claims of this application.

Claims

1. A method for predicting the risk diffusion of data assets, characterized in that, The method includes: Real-time acquisition of data interaction information flow; whereby data interaction information is used to characterize the data interaction behavior between different data assets; Based on the data interaction information flow, the data interaction behavior corresponding to each data asset is determined, and the data asset corresponding to the risk source is obtained accordingly. In a pre-constructed graph structure, the risk diffusion from the risk source to other data assets is predicted, and the risk diffusion prediction result is obtained. The graph structure is constructed in the following way: Based on the pre-acquired historical data interaction information flow, the data interaction behavior between the corresponding data assets is determined, and each data asset is treated as an asset node. The asset nodes with data interaction behavior are connected by directed edges to form a graph structure.

2. The method for predicting the risk diffusion of data assets according to claim 1, characterized in that, Based on the data interaction information flow, the steps of determining the data interaction behavior corresponding to each data asset and thereby obtaining the data asset corresponding to the risk source include: Based on the data interaction information flow, analyze the data interaction behavior of each data asset and generate corresponding data usage information; Based on the data usage information, identify the data assets that have been targeted by attacks and designate them as the data assets corresponding to the risk sources.

3. The method for predicting the risk diffusion of data assets according to claim 1, characterized in that, The steps of determining the relationships between various data assets based on pre-acquired historical data interaction information flows, and forming a graph structure accordingly, include: Each data asset in the historical data interaction information flow is taken as an asset node, and the directed edges between asset nodes are determined according to the data flow direction in each historical data interaction information to form an initial graph structure. In the initial graph structure, the edge weights of each directed edge are determined based on the data interaction behavior between each asset node, forming a graph structure with edge weights; wherein, the edge weights are used to characterize the data interaction strength between the corresponding asset nodes. In a graph structure with edge weights, each asset node is assigned a preset initial risk value to form the final graph structure.

4. The method for predicting the risk diffusion of data assets according to claim 3, characterized in that, The edge weight ,in, For asset nodes and asset nodes The boundary rights between them , and The preset weighting coefficients, Within the preset sampling period, asset nodes and asset nodes The number of interactions between them This represents the maximum number of interactions between the asset nodes in the graph structure. Within the sampling period, asset nodes and asset nodes The amount of data interaction between them This represents the maximum amount of data interaction between the asset nodes in the graph structure. Within the sampling period, asset nodes and asset nodes The degree of data overlap between them.

5. The method for predicting the risk diffusion of data assets according to claim 3, characterized in that, In a pre-constructed graph structure, the steps for predicting the risk diffusion from the risk source to other data assets and obtaining the risk diffusion prediction results include: In the graph structure, the initial risk value of the asset node corresponding to the risk source is updated to a preset first risk value; wherein, the first risk value is greater than the initial risk value of the remaining asset nodes; Based on the directed edges between asset nodes and their corresponding edge weights, the risk value of each asset node is iteratively updated, and the final risk value of each asset node is obtained when the preset update termination condition is met; wherein, during the first update, the risk value of each asset node is the corresponding initial risk value. Apart from the asset nodes corresponding to the risk sources, select the K asset nodes with the highest risk values ​​from the remaining asset nodes as target asset nodes; where K is a positive integer. Based on the graph structure, the propagation links from the risk source to each target asset node are determined, and the target asset nodes and their corresponding propagation links are used as the risk diffusion prediction results.

6. The method for predicting the risk diffusion of data assets according to claim 5, characterized in that, The updated risk value is: ,in, Let the risk value of the i-th asset node be the risk value after the (t+1)-th update. Let be the initial risk value for the i-th asset node. The preset diffusion control coefficient, Let be the edge weight from the j-th asset node to the i-th asset node. Let the risk value of the j-th asset node be the risk value after the t-th update. The preset sensitivity coefficient, The sensitivity preset for the i-th asset node.

7. The method for predicting the risk diffusion of data assets according to claim 1, characterized in that, After obtaining the risk diffusion prediction result, the method further includes: updating the corresponding edge weights based on the risk prediction result to obtain the updated graph structure.

8. A risk diffusion prediction system for data assets, characterized in that, The system includes: The data acquisition module is used to acquire data interaction information streams in real time; among which, data interaction information is used to characterize the data interaction behavior between different data assets. The risk source determination module is used to determine the data interaction behavior corresponding to each data asset based on the data interaction information flow, and thereby obtain the data asset corresponding to the risk source. The risk propagation prediction module is used to predict the risk propagation from the risk source to other data assets in a pre-built graph structure, and obtain the risk propagation prediction result. The graph structure is constructed in the following way: Based on the pre-acquired historical data interaction information flow, the data interaction behavior between the corresponding data assets is determined, and each data asset is treated as an asset node. The asset nodes with data interaction behavior are connected by directed edges to form a graph structure.

9. An electronic device, characterized in that, The electronic device includes: One or more processors; A storage device for storing one or more programs, which, when executed by one or more processors, cause the electronic device to implement the risk diffusion prediction method for data assets as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, It stores a computer program that, when executed by the computer's processor, causes the computer to perform the risk diffusion prediction method for the data asset as described in any one of claims 1 to 7.

Images