Safety life cycle management method and system based on risk control platform

Abstract

The invention discloses a safety life cycle management method and system based on a risk control platform, and relates to the technical field of asset management, and the system comprises a data acquisition module, a risk management and control module and a cycle adjustment module. The system can perform full-life-cycle safety risk detection and early warning processing on customer assets in a fixed cycle, adaptively adjust the acquisition cycle of asset data in the asset life cycle according to the actual detection condition, and is provided with a cycle adjustment module which can adjust the default cycle of customer asset data acquisition according to the risk early warning moment of a customer, thereby improving the risk early warning efficiency of the customer. Different asset full-period risk detection periods can be customized for different clients, and risk detection primary and secondary of the system for different clients can be reasonably distributed.

Description

Technical Field

[0001] This invention relates to the field of asset management technology, and more specifically, to a method and system for security lifecycle management based on a risk control platform. Background Technology

[0002] Asset lifecycle management is a deeper extension of asset management, focusing on the value changes of related assets. It covers a series of changes throughout the asset's lifespan, including acquisition, investment, returns, depreciation, maintenance expenses, repair expenses, and disposal. Its starting point is to focus on value changes, aiming to reduce holding or operating costs and increase revenue. It reflects the goal of increasing revenue and reducing expenses throughout the asset's entire lifecycle, which is of great significance to both businesses and individuals, and to both intangible and fixed assets. Current asset lifecycle management systems can monitor and trace client assets throughout their entire lifecycle; however, this management approach uses the same standards for every client and cannot adjust its management methods according to the actual situation of each client's assets, resulting in poor adaptability of the management system to different client asset management needs. Summary of the Invention

[0003] In view of the shortcomings of existing technologies, the purpose of this invention is to provide a security lifecycle management method and system based on a risk control platform.

[0004] To achieve the above objectives, the present invention provides the following technical solution:

[0005] A security lifecycle management method based on a risk control platform includes the following steps:

[0006] Step 1: Collect asset data for the same customer based on the default cycle;

[0007] Step 2: Based on the risk assessment value, issue early warnings for customer asset risks and adaptively adjust the asset data collection cycle throughout the asset lifecycle.

[0008] Furthermore, a safety lifecycle management system based on a risk control platform includes a data acquisition module, a risk management module, and a cycle adjustment module;

[0009] The data acquisition module is used to collect asset data of the same customer on the basis of the default period. The asset data of the customer after each collection is used as the input data of the risk measurement model to obtain the output data of the risk measurement model. The training label of the output data of the risk measurement model is marked as the risk measurement value.

[0010] The risk management module is used to issue early warnings about customer asset risks based on risk assessment values, and to adaptively adjust the asset data collection cycle throughout the asset lifecycle, specifically:

[0011] Set a high risk measurement value and a low risk measurement value. When the risk measurement value is greater than or equal to the high risk measurement value, mark the customer's assets as risky assets, send a risk warning signal to the customer, and mark the moment as the risk warning moment.

[0012] When the low risk measurement value is less than or equal to the high risk measurement value, the risk measurement value is marked as a value of concern. The n values ​​of concern for this customer before the current system time are obtained. All values ​​of concern are sorted according to the order of their corresponding asset data collection time. The difference between the next adjacent value of concern and the previous value of concern is calculated to obtain the value of concern. A threshold for concern is set. When the value of concern is greater than or equal to the threshold, it is marked as an increase in concern. When the value of concern is less than the threshold, it is marked as a decrease in concern. The balance value Fc for this customer is obtained. A balance threshold is set. When the balance value Fc is greater than or equal to the threshold, the next period for collecting asset data for this customer will be shortened. When the balance value Fc is less than the threshold, no action is taken.

[0013] When the risk measurement value is less than the lower risk measurement value, the next period for collecting the customer's asset data will be extended.

[0014] The cycle adjustment module is used to adjust the default cycle for collecting customer asset data, specifically:

[0015] The system retrieves all risk warning moments for the customer before the current system time, sorts them chronologically, calculates the time difference between adjacent risk warning moments, and obtains the risk warning interval. Each risk warning interval corresponds to a regular warning interval. When the risk warning interval is less than the regular warning interval, it is marked as a high-frequency warning interval, and the high-frequency warning value Yn is obtained. When the risk warning interval is greater than or equal to the regular warning interval, it is marked as a low-frequency warning interval, and the low-frequency warning value Wz is obtained. The system also retrieves the customer's warning value Pm, setting a high and low warning value. When the customer's warning value is greater than or equal to the high warning value, the default period for collecting subsequent asset data for that customer is shortened. When the customer's warning value is less than or equal to the high warning value, no action is taken. When the customer's warning value is less than the low warning value, the default period for collecting subsequent asset data for that customer is extended.

[0016] Furthermore, the risk measurement model is obtained through the following steps: acquiring multiple asset data (including but not limited to the rate of return of user assets), labeling the asset data as training data, assigning training labels to the training data, dividing the training labels into training set and validation set according to a set ratio, constructing a neural network model, iteratively training the neural network model through the training set and validation set, determining that the neural network model has completed training when the number of iterations exceeds the iteration threshold, and labeling the trained neural network model as the risk measurement model for this vulnerability type. The larger the training label value of the output data of the risk measurement model, the higher the asset risk of the customer's current assets.

[0017] Furthermore, the customer's balance value Fc is obtained through the following steps: Calculate the difference between the increase in attention metrics and the attention metrics threshold to obtain the attention metrics increase difference; sum all attention metrics increase differences and take the average to obtain the attention metrics average increase difference, which is denoted as Rk; obtain the attention metrics variable and denot it as the total number of attention metrics increase differences, which is denoted as Es; calculate the difference between the attention metrics threshold and the attention metrics decrease difference to obtain the attention metrics decrease difference; sum all attention metrics decrease differences and take the average to obtain the attention metrics average decrease difference, which is denoted as Rn; obtain the attention metrics variable and denot it as the total number of attention metrics decrease differences, which is denoted as Hw; and use the formula Fc=Rk×a1+Es×a2-Rn×a3-Hw×a4 to obtain the customer's balance value Fc, where a1 is the attention metrics average increase difference coefficient, a2 is the attention metrics increase quantity coefficient, a3 is the attention metrics average decrease difference coefficient, and a4 is the attention metrics decrease quantity coefficient.

[0018] Furthermore, the high-frequency warning value Yn is obtained through the following steps: the difference between the ordinary warning interval and the high-frequency warning interval is calculated to obtain the high-frequency warning interval difference; all high-frequency warning interval differences are summed to obtain the total difference of high-frequency warning intervals, which is marked as Sq; the total number of risk warning intervals marked as high-frequency warning intervals is obtained and marked as Gt; the high-frequency warning value Yn is obtained using the formula Yn=Sq×b1+Gt×b2, where b1 is the coefficient of the total difference of high-frequency warning intervals and b2 is the coefficient of the number of high-frequency warning intervals.

[0019] Furthermore, the low-frequency warning value Wz is obtained through the following steps: the difference between the low-frequency warning interval and the ordinary warning interval is calculated to obtain the low-frequency warning interval difference; all low-frequency warning interval differences are summed to obtain the total difference of low-frequency warning intervals, which is marked as Hb; the total number of times the risk warning interval is marked as a low-frequency warning interval is obtained and marked as Re; the low-frequency warning value Wz is obtained using the formula Wz=Hb×c1+Re×c2, where c1 is the coefficient of the total difference of low-frequency warning intervals and c2 is the coefficient of the number of low-frequency warning intervals.

[0020] Furthermore, the customer warning value Pm is obtained through the following steps: Pm = Yn × d1 - Wz × d2, where d1 is the high-frequency warning value coefficient and d2 is the low-frequency warning value coefficient.

[0021] Compared with the prior art, the present invention has the following beneficial effects:

[0022] 1. Set up risk control and data collection modules to conduct full lifecycle security risk detection and early warning processing of customer assets at fixed intervals, and adaptively adjust the asset data collection cycle according to the actual detection situation during the asset lifecycle;

[0023] 2. The cycle adjustment module can adjust the default cycle for collecting customer asset data according to the customer's risk warning time. Different full-cycle risk detection cycles for different customers can be customized to reasonably allocate the risk detection priorities of different customers. Attached Figure Description

[0024] Figure 1 This is a flowchart of the present invention. Detailed Implementation

[0025] Example 1

[0026] Reference Figure 1 A safety lifecycle management system based on a risk control platform, including a data acquisition module, a risk management module, and a cycle adjustment module.

[0027] The data acquisition module collects asset data from the same customer at a default cycle. Each collection session uses this customer's asset data as input to the risk measurement model, which then outputs the model's data. The training labels on the risk measurement model's output data are then marked as risk measurement values. The risk measurement model is obtained through the following steps: acquiring multiple asset data sets (including but not limited to user asset yield rates), labeling the asset data as training data, assigning training labels to the training data, dividing the training labels into training and validation sets according to a set ratio, constructing a neural network model, and iteratively training the neural network model using the training and validation sets. When the number of iterations exceeds a threshold, the neural network model is considered to have completed training. The trained neural network model is then marked as the risk measurement model for that vulnerability type. The higher the training label value of the risk measurement model's output data, the higher the asset risk of the customer's current assets.

[0028] The risk management module is used to provide early warnings about customer asset risks based on risk assessment values, and to adaptively adjust the asset data collection cycle throughout the asset lifecycle. Specifically:

[0029] Set a high risk measurement value and a low risk measurement value. When the risk measurement value is greater than or equal to the high risk measurement value, mark the customer's assets as risky assets, send a risk warning signal to the customer, and mark the moment as the risk warning moment.

[0030] When the low risk measure value is less than or equal to the high risk measure value, the risk measure value is marked as a measure of concern. The n measures of concern for this customer before the current system time are obtained. All measures of concern are sorted according to the chronological order of the corresponding asset data collection time. The difference between the next adjacent measures of concern after sorting and the previous measures of concern is calculated to obtain the measure of concern change value. A measure of concern threshold is set. When the measure of concern change value is greater than or equal to the measure of concern threshold, the measure of concern change value is marked as an increase in concern. When the measure of concern change value is less than the measure of concern threshold, the measure of concern change value is marked as a decrease in concern. The balance sheet value Fc of this customer is obtained through the following steps: the difference between the measure of concern increase value and the measure of concern threshold is calculated to obtain the measure of concern increase difference. The customer's balance sheet is calculated by summing the increases and decreases in the measurement metrics and taking the average. This average increase is denoted as Rk. The total number of increases in the measurement metrics is denoted as Es. The difference between the measurement threshold and the decrease is calculated to obtain the decrease. All decreases are summed and averaged to obtain the average decrease, denoted as Rn. The total number of decreases in the measurement metrics is denoted as Hw. The customer's balance sheet value Fc is obtained using the formula Fc = Rk × a1 + Es × a2 - Rn × a3 - Hw × a4, where a1 is the average increase coefficient, a2 is the increase coefficient, a3 is the decrease coefficient, and a4 is the decrease coefficient. The values ​​of a1, a2, a3, and a4 are 0.57, 0.73, 0.56, and 0.72, respectively. A threshold for risk assessment is set. When the risk assessment value Fc is greater than or equal to the threshold, the next data collection period for that customer's assets will be shortened; when Fc is less than the threshold, no action is taken. When the risk assessment value is less than the lower risk assessment value, the next data collection period for that customer's assets will be extended. The risk control module and data collection module can perform full lifecycle security risk detection and early warning processing on customer assets at fixed intervals, and adaptively adjust the asset data collection period based on actual detection results throughout the asset lifecycle.

[0031] The period adjustment module is used to adjust the default period for collecting customer asset data, specifically:

[0032] The system retrieves all risk warning times for the customer before the current system time, sorts them chronologically, calculates the time difference between adjacent risk warning times, and obtains the risk warning interval. Each risk warning interval corresponds to a regular warning interval. When a risk warning interval is less than a regular warning interval, it is marked as a high-frequency warning interval. The high-frequency warning value Yn is obtained through the following steps: calculating the difference between the regular and high-frequency warning intervals, summing all high-frequency warning interval differences to obtain the total high-frequency warning interval difference, and marking it as Sq; obtaining the total number of times a risk warning interval is marked as a high-frequency warning interval, and marking it as Gt; and using the formula Yn = Sq × b1 + Gt × b2 to obtain the high-frequency warning value Yn, where b1 is the coefficient of the total high-frequency warning interval difference, b2 is the coefficient of the number of high-frequency warning intervals, and b1 takes the value of 0.84, and b2 takes the value of 0.59. When the risk warning interval is greater than or equal to the normal warning interval, the risk warning interval is marked as a low-frequency warning interval, and the low-frequency warning value Wz is obtained. The low-frequency warning value Wz is obtained through the following steps: calculate the difference between the low-frequency warning interval and the normal warning interval to obtain the low-frequency warning interval difference; sum all the low-frequency warning interval differences to obtain the total difference of low-frequency warning intervals, and mark it as Hb; obtain the total number of times the risk warning interval is marked as a low-frequency warning interval, and mark it as Re; use the formula Wz=Hb×c1+Re×c2 to obtain the low-frequency warning value Wz, where c1 is the coefficient of the total difference of low-frequency warning intervals, c2 is the coefficient of the number of low-frequency warning intervals, the value of c1 is 0.85, and the value of c2 is 0.58. The customer's early warning value Pm is obtained through the following steps: Pm = Yn × d1 - Wz × d2, where d1 is the high-frequency early warning coefficient and d2 is the low-frequency early warning coefficient, with d1 and d2 both set to 0.88 and 0.87 respectively. High and low early warning values ​​are set for the customer. When the customer's early warning value is greater than or equal to the high value, the default period for collecting subsequent asset data for that customer is shortened. When the low value is less than or equal to the high value, no action is taken. When the low value is less than the high value, the default period for collecting subsequent asset data for that customer is extended. A period adjustment module is provided to adjust the default period for collecting customer asset data based on the customer's risk warning time. Different full-cycle risk detection periods can be customized for different customers, allowing for a reasonable allocation of the system's risk detection priorities for different customers.

[0033] Working principle:

[0034] Step 1: Collect asset data for the same customer based on the default cycle;

[0035] Step 2: Based on the risk assessment value, issue early warnings for customer asset risks and adaptively adjust the asset data collection cycle throughout the asset lifecycle.

[0036] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should also be considered within the scope of protection of this template.

[0037] The foregoing has provided a detailed description of one embodiment of the present invention, but this description is merely a preferred embodiment and should not be construed as limiting the scope of the invention. All equivalent variations and modifications made within the scope of the claims of this invention should still fall within the patent coverage of this invention.

Claims

1. A security lifecycle management method based on a risk control platform, characterized in that, Includes the following steps: Step 1: Collect asset data for the same customer based on the default cycle; Step 2: Based on the risk assessment value, issue early warnings for customer asset risks and adaptively adjust the asset data collection cycle throughout the asset lifecycle.

2. A security lifecycle management system based on a risk control platform, applied to the security lifecycle management method based on a risk control platform as described in claim 1, characterized in that, It includes a data acquisition module, a risk management module, and a periodic adjustment module; The data acquisition module is used to collect asset data of the same customer on the basis of the default period. The asset data of the customer after each collection is used as the input data of the risk measurement model to obtain the output data of the risk measurement model. The training label of the output data of the risk measurement model is marked as the risk measurement value. The risk management module is used to issue early warnings about customer asset risks based on risk assessment values, and to adaptively adjust the asset data collection cycle throughout the asset lifecycle, specifically: Set a high risk measurement value and a low risk measurement value. When the risk measurement value is greater than or equal to the high risk measurement value, mark the customer's assets as risky assets, send a risk warning signal to the customer, and mark the moment as the risk warning moment. When the low risk measurement value is less than or equal to the high risk measurement value, the risk measurement value is marked as a value of concern. The n values ​​of concern for this customer before the current system time are obtained. All values ​​of concern are sorted according to the order of their corresponding asset data collection time. The difference between the next adjacent value of concern and the previous value of concern is calculated to obtain the value of concern. A threshold for concern is set. When the value of concern is greater than or equal to the threshold, it is marked as an increase in concern. When the value of concern is less than the threshold, it is marked as a decrease in concern. The balance value Fc for this customer is obtained. A balance threshold is set. When the balance value Fc is greater than or equal to the threshold, the next period for collecting asset data for this customer will be shortened. When the balance value Fc is less than the threshold, no action is taken. When the risk measurement value is less than the lower risk measurement value, the next period for collecting the customer's asset data will be extended. The cycle adjustment module is used to adjust the default cycle for collecting customer asset data, specifically: The system retrieves all risk warning moments for the customer before the current system time, sorts them chronologically, calculates the time difference between adjacent risk warning moments, and obtains the risk warning interval. Each risk warning interval corresponds to a regular warning interval. When the risk warning interval is less than the regular warning interval, it is marked as a high-frequency warning interval, and the high-frequency warning value Yn is obtained. When the risk warning interval is greater than or equal to the regular warning interval, it is marked as a low-frequency warning interval, and the low-frequency warning value Wz is obtained. The system also retrieves the customer's warning value Pm, setting a high and low warning value. When the customer's warning value is greater than or equal to the high warning value, the default period for collecting subsequent asset data for that customer is shortened. When the customer's warning value is less than or equal to the high warning value, no action is taken. When the customer's warning value is less than the low warning value, the default period for collecting subsequent asset data for that customer is extended.

3. A safety lifecycle management system based on a risk control platform according to claim 2, characterized in that, The risk measurement model is obtained through the following steps: acquiring multiple asset data, labeling the asset data as training data, assigning training labels to the training data, dividing the training labels into training and validation sets according to a set ratio, constructing a neural network model, iteratively training the neural network model using the training and validation sets, determining that the neural network model has completed training when the number of iterations exceeds the iteration threshold, and labeling the completed neural network model as the risk measurement model for this vulnerability type. The larger the training label value of the risk measurement model's output data, the higher the asset risk of the customer's current assets.

4. A safety lifecycle management system based on a risk control platform according to claim 3, characterized in that, The customer's balance sheet value (Fc) is obtained through the following steps: Calculate the difference between the increase in the focus measure and the focus measure threshold to obtain the focus measure increase difference; sum all focus measure increase differences and take the average to obtain the average focus measure increase difference, denoted as Rk; obtain the focus measure variable value, denoted as the total number of focus measure increases, and denoted as Es; calculate the difference between the focus measure threshold and the focus measure decrease to obtain the focus measure decrease difference; sum all focus measure decrease differences and take the average to obtain the average focus measure decrease difference, denoted as Rn; obtain the focus measure variable value, denoted as the total number of focus measure decreases, and denoted as Hw; use the formula Fc = Rk × a1 + Es × a2 - Rn × a3 - Hw × a4 to obtain the customer's balance sheet value Fc, where a1 is the average focus measure increase difference coefficient, a2 is the focus measure increase quantity coefficient, a3 is the average focus measure decrease difference coefficient, and a4 is the focus measure decrease quantity coefficient.

5. A safety lifecycle management system based on a risk control platform according to claim 4, characterized in that, The high-frequency warning value Yn is obtained through the following steps: Calculate the difference between the ordinary warning interval and the high-frequency warning interval to obtain the high-frequency warning interval difference; sum all the high-frequency warning interval differences to obtain the total high-frequency warning interval difference, and mark it as Sq; obtain the risk warning interval and mark it as the total number of high-frequency warning intervals, and mark it as Gt; use the formula Yn=Sq×b1+Gt×b2 to obtain the high-frequency warning value Yn, where b1 is the coefficient of the total high-frequency warning interval difference and b2 is the coefficient of the number of high-frequency warning intervals.

6. A safety lifecycle management system based on a risk control platform according to claim 5, characterized in that, The low-frequency warning value Wz is obtained through the following steps: Calculate the difference between the low-frequency warning interval and the ordinary warning interval to obtain the low-frequency warning interval difference; sum all the low-frequency warning interval differences to obtain the total low-frequency warning interval difference, and mark it as Hb; obtain the risk warning interval and mark it as the total number of low-frequency warning intervals, and mark it as Re; use the formula Wz=Hb×c1+Re×c2 to obtain the low-frequency warning value Wz, where c1 is the coefficient of the total low-frequency warning interval difference and c2 is the coefficient of the number of low-frequency warning intervals.

7. A safety lifecycle management system based on a risk control platform according to claim 6, characterized in that, The customer warning value Pm is obtained through the following steps: Pm = Yn × d1 - Wz × d2, where d1 is the high-frequency warning value coefficient and d2 is the low-frequency warning value coefficient.

Images