Data vulnerability analysis method and system based on artificial intelligence

Abstract

The invention relates to the technical field of data analysis, in particular to a data vulnerability analysis method and system based on artificial intelligence, and the method comprises the steps: obtaining log record data, and carrying out the matching sorting according to the log record data, and obtaining a circulation data set; constructing a node connection relationship according to the circulation data set, and determining a complete path map; obtaining a node access record, screening potential hidden danger nodes, obtaining a data interaction frequency after obtaining a hidden danger node list, and carrying out threshold comparison according to the data interaction frequency to obtain a risk association chain directory; performing data analysis according to the risk association chain directory to obtain an abnormal operation sequence; performing legality comparison according to the abnormal operation sequence to obtain a preliminary comparison set, and performing threshold comparison to obtain a final vulnerability position; and performing repair path simulation based on the final vulnerability position to obtain an optimized circulation track. According to the method, vulnerability positioning and path repairing of a data circulation full link are realized.

Description

Technical Field

[0001] This invention relates to the field of data analysis technology, and in particular to a data vulnerability analysis method and system based on artificial intelligence. Background Technology

[0002] In one existing technology, system logs are scanned based on rule matching and statistical analysis to identify operation records with abnormal access permissions. Potential security risks are assessed by setting access frequency thresholds. Upon detecting abnormal access, relevant nodes are marked and alarm information is generated. However, when faced with complex data interaction scenarios, this existing technology lacks the ability to perform correlation analysis on complex data. It cannot fully capture the correlation between data at different stages, struggles to reconstruct the complete data flow path from source to destination, and easily overlooks abnormal behaviors hidden within vast data networks. This limitation makes it difficult to analyze abnormal operations scattered across various nodes in a chain, to identify security vulnerabilities arising from collaboration between multiple nodes, and even more difficult to pinpoint the specific location and propagation path of the problem.

[0003] In summary, existing technologies lack the ability to track and repair the entire data flow chain, leading to inaccurate vulnerability location in complex network environments. Summary of the Invention

[0004] This invention provides a data vulnerability analysis method and system based on artificial intelligence to achieve vulnerability location analysis.

[0005] Firstly, in order to solve the above-mentioned technical problems, the present invention provides a data vulnerability analysis method based on artificial intelligence, comprising: Obtain log data, match and sort the log data to obtain a flow dataset; Based on the aforementioned data transfer dataset, node connection relationships are constructed to determine the complete path graph; Based on the complete path map, node access records are obtained, and potential hidden danger nodes are filtered according to the node access records to obtain a list of hidden danger nodes. Based on the list of potential hazards, the data interaction frequency is obtained, and a threshold comparison is performed according to the data interaction frequency to obtain a risk association chain directory. Data analysis is performed based on the aforementioned risk association chain directory to obtain abnormal operation sequences; Based on the abnormal operation sequence, a legality comparison is performed to obtain a preliminary comparison set. Based on the preliminary comparison set, a threshold comparison is performed to obtain the final vulnerability location. Based on the final vulnerability location, a repair path simulation was performed to obtain an optimized flow trajectory.

[0006] In one optional implementation, the step of acquiring log record data and matching and sorting the log record data to obtain a flow dataset includes: Obtain log data, extract timestamps and event identifiers from the log data to obtain a log dataset; The event identifiers are matched and sorted according to the log dataset to obtain a set of flow paths; The missing flow sequences are obtained by filtering the set of flow paths, and the missing flow sequences are supplemented and repaired to obtain the flow dataset.

[0007] In one optional implementation, the step of constructing node connection relationships and determining the complete path graph based on the flow dataset includes: Based on the aforementioned data transfer dataset, path nodes are extracted to obtain preliminary path nodes; Based on the initial path nodes, the connection relationships between the nodes are constructed to obtain the direct connection path; Based on the direct connection path, add auxiliary information to the preliminary path node to obtain the complete path node. Then, organize the direct connection path and the complete path node to obtain the complete path map.

[0008] In one optional implementation, the step of obtaining node access records based on the complete path graph, and filtering potential hidden danger nodes according to the node access records to obtain a list of hidden danger nodes, includes: Node operation logs are obtained based on the complete path graph. Node access records are extracted from the node operation logs. If the node access records do not meet the preset permission standards, suspected potential nodes are marked and integrated to obtain preliminary marking results. Access frequency data is extracted from the preliminary marking results. If the access frequency data exceeds a preset frequency threshold, potential hidden danger nodes are marked and integrated to obtain a list of hidden danger nodes.

[0009] In one optional implementation, the step of obtaining the data interaction frequency based on the list of potential hazards, and performing a threshold comparison based on the data interaction frequency to obtain a risk association chain directory, includes: The data interaction frequency of nodes within the cluster is obtained from the list of potential hazards. If the data interaction frequency exceeds a preset frequency threshold, it is determined to be a risk critical chain. The risk critical chains are then integrated to obtain a preliminary screening set. Based on the analysis of the interaction fluctuations in the preliminary screening set, if the interaction fluctuations exceed the preset fluctuation limit, they are identified as risk association chains. The risk association chains are then statistically analyzed to obtain a risk association chain directory.

[0010] In one optional implementation, the step of performing data analysis based on the risk association chain directory to obtain the abnormal operation sequence includes: Extract node data volume information from the risk association chain directory. If the data volume information exceeds a preset data volume threshold, it is determined to be redundant data volume information. Extract the redundant data volume information and organize it to obtain a preliminary extraction set. Based on the preliminary extraction set, the operation time period is extracted, and the operation time period is classified to obtain the classification result. If the classification result deviates from the preset classification standard, it is judged as an abnormal operation, and an abnormal operation sequence is obtained.

[0011] In one optional implementation, the step of performing a legitimacy comparison based on the abnormal operation sequence to obtain a preliminary comparison set, and performing a threshold comparison based on the preliminary comparison set to obtain the final vulnerability location, includes: Information modification operations are obtained based on the abnormal operation sequence and their legality is compared. If the information modification operation does not meet the legality standard, it is judged as an illegal operation. The illegal operations are integrated to obtain a preliminary comparison set. The proportion of illegal operations is calculated based on the preliminary comparison set and compared. If the proportion exceeds a preset illegal threshold, it is identified as a vulnerability node. The vulnerability nodes are then integrated to obtain the final vulnerability location.

[0012] In one optional implementation, the step of simulating the remediation path based on the final vulnerability location to obtain an optimized flow trajectory includes: Interaction information is extracted from the final vulnerability location and compared. If it exceeds the preset interaction standard, it is determined to be a path node to be adjusted, and a set to be adjusted is obtained. The redundancy of information is calculated for the set to be adjusted, and the set is sorted according to the redundancy to obtain a priority repair order. Based on the priority repair sorting, a simulation correction is performed to generate the corrected path and obtain the optimized flow trajectory.

[0013] Secondly, the present invention provides a data vulnerability analysis system based on artificial intelligence, comprising: The data acquisition module is used to acquire log data, match and sort the log data to obtain a circulating dataset; The graph construction module is used to construct node connection relationships based on the flow dataset and determine the complete path graph; The hazard identification module is used to obtain node operation logs based on the complete path map, filter potential hazard nodes according to the node operation logs, and obtain a list of hazard nodes. The risk assessment module is used to obtain the data interaction frequency based on the list of hidden danger nodes, and to perform threshold comparison based on the data interaction frequency to obtain a risk association chain directory. The anomaly analysis module is used to perform data analysis based on the risk association chain directory to obtain anomaly operation sequences; The vulnerability location module is used to perform a legality comparison based on the abnormal operation sequence to obtain a preliminary comparison set, and to perform a threshold comparison based on the preliminary comparison set to obtain the final vulnerability location; The path repair module is used to simulate the repair path based on the final vulnerability location to obtain an optimized flow trajectory.

[0014] Compared with the prior art, the present invention has the following beneficial effects: (1) This invention extracts timestamps and event identifiers from log data and constructs a complete path map by connecting nodes, thereby achieving accurate tracking and restoration of the entire data flow chain. This method can fully capture the correlation between data in different links and accurately restore the complete flow path of data from source to destination, thus effectively solving the problems of existing technologies lacking correlation analysis capabilities and easily ignoring hidden abnormal behaviors.

[0015] (2) This invention forms a list of potential hazards by clustering and grouping the list of potential hazards, and identifies risk association chains based on data interaction frequency and fluctuation, thereby realizing the serial analysis of dispersed abnormal operations. This method overcomes the limitation of traditional technologies in identifying security risks generated by the collaboration between multiple nodes, and can perform correlation analysis on abnormal behaviors scattered across various nodes, accurately discover complex security risks generated by the collaboration between nodes, and improve the comprehensiveness and accuracy of vulnerability identification.

[0016] (3) This invention achieves precise vulnerability location by analyzing data change patterns in the risk association chain directory and combining legality comparison and threshold comparison to pinpoint the final vulnerability location. This method effectively solves the problem of inaccurate vulnerability location in complex network environments by extracting multi-dimensional features such as redundant data volume, operation time period, and association chain length, and by performing legality judgment and log threshold comparison on information modification operations, thus improving the reliability of vulnerability location.

[0017] (4) This invention simulates the repair path based on the final vulnerability location, and generates an optimized flow trajectory by calculating information redundancy and prioritizing it, thus realizing intelligent and systematic vulnerability repair. By identifying the path nodes to be adjusted and simulating corrections according to priority, this method can provide the system with a clear repair guidance plan, avoiding resource waste and secondary risks caused by blind repair. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of a data vulnerability analysis method based on artificial intelligence provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of the structure of a data vulnerability analysis system based on artificial intelligence provided in an embodiment of the present invention. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] Reference Figure 1 This invention provides a data vulnerability analysis method based on artificial intelligence, comprising: S11 is used to obtain log record data, and to match and sort the log record data to obtain a flow dataset. S12 is used to construct node connection relationships based on the flow dataset and determine the complete path map; S13 is used to obtain node access records based on the complete path map, filter potential hidden danger nodes according to the node access records, and obtain a list of hidden danger nodes. S14, used to obtain the data interaction frequency based on the list of hidden danger nodes, and to perform threshold comparison based on the data interaction frequency to obtain the risk association chain directory; S15, used to perform data analysis based on the risk association chain directory to obtain an abnormal operation sequence; S16 is used to perform a legality comparison based on the abnormal operation sequence to obtain a preliminary comparison set, and to perform a threshold comparison based on the preliminary comparison set to obtain the final vulnerability location; S17 is used to simulate the repair path based on the final vulnerability location to obtain an optimized flow trajectory.

[0021] In step S11, log record data is obtained, and the log record data is matched and sorted to obtain a transfer dataset, including: Obtain log data, extract timestamps and event identifiers from the log data to obtain a log dataset; The event identifiers are matched and sorted according to the log dataset to obtain a set of flow paths; The missing flow sequences are obtained by filtering the set of flow paths, and the missing flow sequences are supplemented and repaired to obtain the flow dataset.

[0022] The log data consists of multiple stored log records, reflecting all user data operations. Each log record includes key fields such as timestamp, event identifier, operation type, user identifier, and access result. The timestamp and event identifier are extracted from the log records. The timestamp records the precise time the operation occurred; the event identifier includes the order number and the event operation, used to uniquely identify a data operation. For example, order number 001 was entered on October 1, 2025 at 10:00:00, with a timestamp of "2025.10.01, 10:00:00" and an event identifier of "Order_001, Init", where the order number is Order_001 and the event operation is Init; at 10:01:00, the order inventory check was completed, with a timestamp of "2025.10.01, 10:01:00" and an event identifier of "Order_001_StockCheck", where the order number is Order_001 and the event operation is StockCheck. When acquiring log data, the timestamp and event identifier are extracted and used as log record numbers, resulting in two log record numbers: "2025.10.01, 10:00:00, Order_001, Init" and "2025.10.01, 10:00:01, Order_001, StockCheck". After processing, the log dataset is obtained.

[0023] Furthermore, the event identifiers are matched and sorted according to the log dataset. This matching and sorting consists of two parts: order matching and time sorting. Order matching establishes relationships between different log records based on event identifiers. Specifically, the order number of each log record in the log dataset is first read. Log records with the same order number are grouped into the same order, thus completing event matching. Time sorting, based on event matching, combines timestamps to sort the events of the same order chronologically, constructing flow paths according to the order in which operations occur. Ultimately, flow paths from the data source to the data destination are formed for different orders. These paths are then integrated to obtain a set of flow paths.

[0024] Further, the set of workflow paths is filtered to identify missing workflow sequences. Each workflow path is verified through logical integrity checks. These checks compare the event operation sequences within the workflow path with a preset business process. Paths that do not conform to the preset business process are marked as missing workflow paths. After compiling all missing workflow paths, the missing workflow sequence is obtained. The preset business process is an order business process defined by business analysts and system administrators based on actual conditions during the initial system deployment. The preset business process consists of twelve event operations in sequence: "Order Creation," "Inventory Check," "Order Payment," "Order Approval," "Order Modification," "Order Confirmation," "Logistics Allocation," "Order Shipment," "Goods Delivery," "Order Receipt," "Order Completion," and "User Feedback."

[0025] When reading log data, it is normal for some orders to be missing events following the current progress, as some orders are still in progress. It is only necessary to ensure that the events in the workflow are continuous. For example, in the workflow for order number "Order_047", if the events "Order Creation" and "Order Payment" are detected, and compared with the preset business process, it is found that "Order Creation" and "Order Payment" are not consecutive events. Therefore, "Order Creation" is determined to be the event before the interruption, and "Order Payment" is determined to be the event after the interruption. Thus, the workflow for order number "Order_047" is considered a missing workflow.

[0026] Furthermore, missing workflow sequences are supplemented and repaired. First, the timestamps of the pre-interruption and post-interruption events in the missing workflow path are located, and the time interval between the two timestamps is used as the search time window, which includes the endpoints of the two timestamps. Then, the missing event operation is inferred based on a preset business process, and log records that meet the following conditions are searched in the log data: the timestamp is within the search time window, and the event operation and order number are consistent with the missing event operation. When there are missing log records and a corresponding record cannot be found through exact matching, a manual review process is triggered, where business personnel manually supplement the record based on other supporting information. Finally, the selected log records are added to the corresponding positions in the missing workflow sequence to obtain a complete workflow path. After organizing all complete workflow paths, a complete workflow sequence is obtained.

[0027] For example, in the missing workflow path with order number "Order_022", the event operation before the interruption was "Order Confirmation" with a timestamp of "2025.04.01, 12:21:00"; the event operation after the interruption was "Order Shipment" with a timestamp of "2025.04.01, 17:43:00". According to the business process rules, it is inferred that the missing event operation should be "Logistics Allocation". The time period from 2025.04.01, 12:21:00 to 2025.04.01, 17:43:00 is used as the search time window, and log records that meet the following conditions are searched in the log record data: the timestamp is within the period from 2025.04.01, 12:21:00 to 2025.04.01, 17:43:00, the event operation is "Logistics Allocation", and the order number is "Order_022". The system retrieves a log record with an event operation of "logistics allocation", a timestamp of "2025.04.01, 14:41:00" and an order number of "Order_022". Finally, the system adds the log record to the missing flow path of the order number "Order_022".

[0028] In step S12, node connection relationships are constructed based on the flow dataset to determine the complete path graph, including: Based on the aforementioned data transfer dataset, path nodes are extracted to obtain preliminary path nodes; Based on the initial path nodes, the connection relationships between the nodes are constructed to obtain the direct connection path; Based on the direct connection path, add auxiliary information to the preliminary path node to obtain the complete path node. Then, organize the direct connection path and the complete path node to obtain the complete path map.

[0029] The node extraction refers to the application of graph theory algorithms to abstract the data flow process into a directed graph. This directed graph consists of a set of nodes (corresponding to the set of vertices in graph theory) and a set of edges, where vertices represent the stages of data processing and edges represent the directions of data flow.

[0030] The node (corresponding to vertices in graph theory) extraction steps include: first, identifying the event operation type of each flow record in the flow dataset, extracting all operation steps involved in the data flow process. Each operation step refers to a specific operation step in the data processing flow, representing a processing stage the data undergoes in the business process. By parsing the event identifiers in the flow records, event operation information can be obtained, such as "order creation," "inventory check," and "order payment." Subsequently, the extracted event operations are merged and grouped according to a preset merging principle, grouping multiple specific operations belonging to the same processing stage into the same graph node (corresponding to a graph vertex in graph theory). The preset merging principle categorizes event operations based on their functional relevance. If multiple event operations are in the same processing stage in the business process and jointly complete a certain business function, these operations are merged into one node. Operations not explicitly defined by the preset merging principle are treated as independent nodes. Generally, the pre-defined merging principle merges "Order Creation," "Inventory Check," and "Order Payment" into the Order Creation node; "Order Review," "Order Modification," and "Order Confirmation" into the Order Review node; "Logistics Allocation," "Order Shipment," and "Goods Delivery" into the Logistics Transportation node; and "Order Receipt," "Order Completion," and "User Feedback" into the Order Completion node. After merging, the initial path nodes are obtained.

[0031] Edge (i.e., connection relationship) construction is based on preliminary path nodes. Further, connections between nodes are built based on these preliminary path nodes to obtain direct connection paths. For each log record in the flow dataset, a directed edge is established between the node to which the current log record belongs and the node to which the next log record belongs. This process strictly adheres to the no-self-loop principle, meaning that directed edges from one node to itself are not allowed in the connection graph. Before establishing a directed connection, node identity is compared to determine if the node identifier of the current log record is the same as that of the next log record. If the node identifiers are the same, it is determined to be a state transition within the same node, belonging to an internal operation sequence, and is not reflected in the inter-node connection relationship; therefore, the connection establishment step for that record is skipped. The directed connection represents the directionality of data flow from one processing stage to the next. By traversing all records in the flow dataset, connections between nodes are established one by one, forming direct connection paths between nodes.

[0032] Specifically, the graph theory algorithm employs a topological sorting algorithm based on depth-first search (DFS). Its implementation includes: calculating the in-degree of each node; counting the in-degree of each node (the number of edges pointing to that node); adding nodes with an in-degree of 0 to a processing queue; performing topological sorting, removing nodes from the queue, adding them to the topological sequence, and reducing the in-degree of adjacent nodes; if any node is not added to the sequence, it indicates the existence of a cycle in the graph, and anomaly handling is performed. The algorithm's time complexity is O(V+E), where V is the number of nodes and E is the number of edges. This algorithm ensures that the data flow path satisfies the characteristics of a directed acyclic graph, avoiding logical loops.

[0033] For example, for the flow path of order number "Order_022", the in-degree of each node is first calculated: order creation node (in-degree 0) → order approval node (in-degree 1) → logistics and transportation node (in-degree 1). Topological sorting starts from the order creation node to ensure that the path directionality is consistent with the business logic.

[0034] For example, the data flow dataset contains the following record sequence: Order number "Order_022" undergoes an "order review" operation at time T1, an "order modification" operation at time T2, an "order confirmation" operation at time T3, and a "logistics allocation" operation at time T4. According to the preset merging rules, operations from T1 to T3 belong to the order review node, while operation T4 belongs to the logistics transportation node. Therefore, when constructing the connection relationship, operations from T1 to T3 are considered as internal flows within the "order review node," and no new inter-node connections are established; while the flow from T3 to T4 represents data flowing from the "order review node" to the "order shipment node," requiring the establishment of a directed edge between these two nodes.

[0035] Finally, additional information is added to each vertex based on the direct connection paths. This information corresponds to the attributes of the vertices in the graph. The vertices, their attributes, and directed edges are integrated to generate a complete path graph. This graph is a complete directed graph. The additional information includes the number of log records, branches, and convergences of each node. The number of log records refers to the total number of log records within a node, which can be obtained by directly traversing and counting the log records within the node. The number of branches refers to the number of directed edges connecting the current node to other nodes. The number of convergences refers to the number of directed edges connecting the current node to the current node.

[0036] For example, if an order with order number "Order_123" is in transit and the customer applies for a return and refund, and after the refund application is approved, the user signs for the goods and resends them, then the logistics node for order number "Order_123" will have directed edges starting from the current node and connecting to the order approval node (logistics transit to order approval) and the order completion node (goods delivered to user's signature), with a branch count of 2. If an order with order number "Order_456" is replaced due to a quality issue after the order is signed for, and the merchant resends the goods and the user signs for them again, then the logistics node for order number "Order_456" will have directed edges ending at the current node, receiving directed edges from the order approval node (order confirmation to logistics allocation) and from the order completion node (order signature confirmation to logistics allocation), with a convergence count of 2.

[0037] In step S13, node access records are obtained based on the complete path map, and potential hidden danger nodes are filtered according to the node access records to obtain a list of hidden danger nodes, including: Node operation logs are obtained based on the complete path graph. Node access records are extracted from the node operation logs. If the node access records do not meet the preset permission standards, suspected potential nodes are marked and integrated to obtain preliminary marking results. Access frequency data is extracted from the preliminary marking results. If the access frequency data exceeds a preset frequency threshold, potential hidden danger nodes are marked and integrated to obtain a list of hidden danger nodes.

[0038] It should be noted that the node access records are obtained from the complete path graph generated based on the directed graph structure described above. These node access records refer to the user access records stored on each node in the complete path graph. Each node generates a corresponding access record when it is accessed, detailing key information such as the user's role, access time, operation type, and access permissions.

[0039] Furthermore, the access records are compared and verified against preset permission standards. These preset permission standards are permission control specifications formulated based on business security requirements and data confidentiality levels, clearly defining the access permissions that users with different roles have for different nodes. Preset permission standards are typically stored in the form of a permission matrix, where rows represent user role types (e.g., "regular customer service personnel," "auditor," "supervisor," etc.), and columns represent combinations of node types and operation types (e.g., "order creation node - view," "order approval node - modify," etc.).

[0040] It's worth noting that the elements in the matrix are Boolean values. The value specification is as follows: when an element is "true" or "1", it indicates that the user role has legitimate permission to perform the operation on that node; when an element is "false" or "0", it indicates that the user role does not have permission to perform the operation. During permission comparison, the legitimacy of the access behavior is determined by querying the element value at the corresponding position in the matrix. First, the user role information, node type information, and operation type information in the access record are read, and the corresponding permission configuration is searched in the preset permission standard matrix. If the access record shows that a user performed an operation on a node, but the user role does not have permission to perform that operation according to the preset permission standard, then the access record is determined to be an unauthorized access record, and the node is marked as a suspected potential node. These suspected potential nodes are then integrated to obtain the preliminary marking results.

[0041] For example, user "User_A" has the role of "Regular Customer Service Personnel," which, according to the preset permission standards, is only authorized to modify the order creation node, but not the order approval node. When analyzing the access records for the node with order number "Order_078," an access record was found showing that user "User_A" performed a modification operation on the order approval node at 10:23:00 on November 15, 2025. By comparing this with the preset permission standards, it was found that this access behavior exceeded the permission scope of the "Regular Customer Service Personnel" role. Therefore, this access record was determined to be an unauthorized access record, and the order approval node with order number "Order_078" was marked as a suspected potential vulnerability node.

[0042] It should be noted that access frequency data is extracted from the preliminary marking results. Access frequency data refers to the statistical information on the number of times a node is accessed within a time window. To ensure the accuracy of the analysis, when extracting access frequency data, the hourly interval is used as a time window, such as 9:00:00-9:59:59, 10:00:00-10:59:59, etc. Subsequently, the number of unauthorized access records for each suspected potential node in the preliminary marking results within this time window is counted. After the statistics are completed, the number of accesses per hour is organized in chronological order to obtain the access frequency data.

[0043] Furthermore, the access frequency data is compared with a preset frequency threshold. The preset frequency threshold is a baseline value derived from statistical analysis of access patterns during normal operation, representing the upper limit of a reasonable range for node access frequency under normal business scenarios; it is normally set to 30 times per hour. If a suspected potential node has an access frequency exceeding the preset frequency threshold, it is marked as a potential potential node. All nodes marked as potential potential nodes are integrated and summarized to obtain a list of potential nodes.

[0044] For example, when analyzing the access frequency in the preliminary labeling results, it was found that the logistics transportation node with order number "Order_089" was accessed 112 times between 14:00:00 and 14:59:59 on November 20, 2025, far exceeding the preset frequency threshold. This may be due to malicious users using automated scripts to batch query logistics information for data scraping, or a system vulnerability causing a query request to get stuck in a loop. Therefore, this node was marked as a potential vulnerability node.

[0045] In step S14, in an optional implementation, obtaining the data interaction frequency based on the list of potential hazards, and performing a threshold comparison based on the data interaction frequency to obtain the risk association chain directory, includes: The data interaction frequency of nodes within the cluster is obtained from the list of potential hazards. If the data interaction frequency exceeds a preset frequency threshold, it is determined to be a risk critical chain. The risk critical chains are then integrated to obtain a preliminary screening set. Based on the analysis of the interaction fluctuations in the preliminary screening set, if the interaction fluctuations exceed the preset fluctuation limit, they are identified as risk association chains. The risk association chains are then statistically analyzed to obtain a risk association chain directory.

[0046] It should be noted that the nodes within the cluster refer to the set of nodes that have a direct connection with potential hazard nodes in the complete path graph. Specifically, taking each potential hazard node in the hazard node list as the center, the cluster expands outward to retrieve adjacent nodes with which it has a data flow relationship, forming a node cluster centered on that hazard node. The data interaction frequency refers to the number of times data transmission occurs between potential hazard nodes and adjacent nodes within a preset statistical time period.

[0047] It is worth noting that when calculating the data interaction frequency, a statistical time window is first determined. This statistical time window is based on the hour and is set to a size of 3 hours. Examples include 9:00:00-11:59:59 and 12:00:00-14:59:59. Whenever data is transmitted between a potential hazard node and its adjacent nodes, a transmission record containing a timestamp and a flow identifier is left in the corresponding access record. The total number of these transmission records is counted, and the sum is divided by the time window size to obtain the data interaction frequency between nodes.

[0048] For example, the potential hidden danger node for order number "Order_156" is the order review node. Analysis revealed that there were 144 data interactions between the order review node and the logistics transportation node within 3 hours from 00:00 to 02:59 on November 22, 2025. Therefore, the data interaction frequency during this period is 144 ÷ 3 = 48 times / hour.

[0049] Furthermore, the data interaction frequency is compared and verified with a preset frequency threshold. The preset frequency threshold is a baseline value for data interaction frequency derived from statistical analysis of historical operational data, representing a reasonable upper limit for data interaction frequency between nodes under normal business scenarios. Based on historical experience, it is generally set to 20 times / hour. During the comparison process, if the data interaction frequency between a pair of nodes in the cluster exceeds the preset frequency threshold, the connection relationship between that pair of nodes is determined to be a risky critical chain. All identified risky critical chains are integrated and summarized, recording information such as the node location and interaction frequency value of each risky critical chain. After integration, a preliminary screening set is obtained.

[0050] After obtaining the initial screening set, the interaction fluctuation is analyzed based on the initial screening set. The interaction fluctuation refers to the standard deviation of the data interaction frequency between nodes. The standard deviation is calculated as follows: First, the 12-hour workday is divided into 1-hour time segments. For each risk critical chain in the initial screening set, the data interaction frequency within each time segment is statistically analyzed, and the arithmetic mean and overall standard deviation are calculated based on the data interaction frequency within 12 hours.

[0051] Furthermore, the calculated fluctuation amplitude index is compared with a preset fluctuation upper limit. The preset fluctuation upper limit is the upper standard deviation determined based on statistical analysis of data interaction patterns during normal operation, representing a reasonable fluctuation range for the frequency of data interaction between nodes under normal business scenarios. It is generally set to 10.00. If the fluctuation standard deviation of a certain risk critical chain exceeds the upper or lower limit of the preset fluctuation upper limit, it indicates that the data interaction pattern on that chain is abnormal, and the risk critical chain is determined to be a risk-related chain. After the determination is completed, risk-related chains associated with the same node are merged, and all risk-related chains are statistically analyzed to obtain a risk-related chain directory.

[0052] For example, an analysis was conducted on a critical risk chain in the initial screening set. This chain connects the order approval node and the order completion node for order number "Order_203". The interaction frequencies of this chain during 12 time segments on Monday working hours were calculated to be 14, 21, 30, 23, 15, 24, 2, 68, 82, 24, 31, and 13 times respectively. The overall standard deviation of this time series was calculated to be 22.15, exceeding the preset fluctuation limit of 10.00. Therefore, this critical risk chain was determined to be a risk-related chain, and its relevant information was recorded in the risk-related chain directory.

[0053] In step S15, data analysis is performed based on the risk association chain directory to obtain an abnormal operation sequence, including: Extract node data volume information from the risk association chain directory. If the data volume information exceeds a preset data volume threshold, it is determined to be redundant data volume information. Extract the redundant data volume information and organize it to obtain a preliminary extraction set. Based on the preliminary extraction set, the operation time period is extracted, and the operation time period is classified to obtain the classification result. If the classification result deviates from the preset classification standard, it is judged as an abnormal operation, and an abnormal operation sequence is obtained.

[0054] First, extract node data volume information from the risk association chain directory. This node data volume information refers to the total amount of data processed by each node in the risk association chain within 24 hours, including data inflow, outflow, and internal data storage. Statistics are calculated starting from the hour, e.g., from 00:00:00 on November 23, 2025 to 23:59:59 on November 23, 2025. For each node, calculate the total amount of data received, sent, and temporarily stored within the node during this time period. The total data volume is measured in megabytes (MB) and is obtained by summing the data packet size of each data transmission recorded in the node access record. After completing the data volume statistics, calculate the node's comprehensive data volume index using the following formula:

[0055] Among them, V total The total data volume of a node (in MB), w in V represents the weighting coefficient of the total amount of data received. in w represents the total amount of data received by the node during the statistical period (in MB). out V represents the weighting coefficient of the total amount of data sent. out V represents the total amount of data sent by the node within the statistical period (unit: MB). storage w represents the amount of data temporarily stored within a node (in MB). storage The weighting coefficient represents the amount of data temporarily stored within a node.

[0056] It should be noted that the weighting coefficients are set based on business importance and data flow characteristics. For the order creation node, its main function is to receive and initialize order data; the amount of incoming data is a core monitoring metric, therefore w is set... in =0.50、w out =0.30、w storage =0.20; For the order review node, since its core function is data review rather than large-scale data transmission, anomalies in stored data are more likely to reflect potential risks, therefore w is set to 0.20. in =0.25、w out =0.25、w storage =0.50; For logistics transportation nodes, data outflow is a key indicator, reflecting the efficiency of logistics information transmission. Setting w... in =0.20、w out =0.60、w storage =0.20; For the order completion node, its main functions are final confirmation and feedback information. Inflow and outflow data are equally important, so w is set to... in =0.40、w out =0.40、w storage =0.20.

[0057] Furthermore, the extracted node data volume information is compared with preset data volume thresholds. These preset data volume thresholds are determined based on statistical analysis of historical operational data and represent a reasonable upper limit for node data volume within 24 hours under normal business scenarios. For order creation nodes, the preset data volume threshold is set to 500MB; for order approval nodes, it is set to 300MB; for logistics and transportation nodes, it is set to 800MB; and for order completion nodes, it is set to 200MB. If the comprehensive data volume index of a node exceeds its corresponding preset data volume threshold, the data volume information of that node is determined to be redundant. All redundant data volume information is then processed to obtain a preliminary extraction set.

[0058] For example, when analyzing the risk association chain of order number "Order_267", it was found that the order review node for this order had an inflow of 450MB of data, an outflow of 520MB of data, and a storage of 380MB of data within 24 hours from 00:00:00 to 23:59:59 on November 25, 2025. The calculated comprehensive data volume index was (0.25×450+0.25×520+0.5×380)=432.5MB. This value significantly exceeds the preset data volume threshold of 300MB for the order review node. Therefore, it was determined that the node contained redundant data information, and it was recorded in the preliminary extraction set.

[0059] It is worth noting that the operation time periods are further extracted based on the preliminary extraction set. The operation time periods refer to the main distribution time periods during which data processing operations occur at the nodes. The 24 hours are divided into three time period categories: "Working Hours" (10:00:00-17:59:59), "Non-Working Hours" (18:00:00-22:59:59, 6:00:00-9:59:59), and "Late Night Hours" (23:00:00-23:59:59, 00:00:00-6:59:59), each lasting 8 hours. Access records for each abnormal node in the preliminary extraction set are read, and the timestamp information of the access records is extracted. By statistically analyzing the distribution of timestamps for all data processing operations across each time period, the time period with the highest distribution is selected as the main time period. When multiple time periods have the same and highest distribution, the main time periods are selected in the order of late night, non-working hours, and working hours. After classification, a classification label containing the time period category is generated for each abnormal node and organized to obtain the classification results.

[0060] The classification results are compared and verified with preset classification standards. These preset standards are a baseline classification model established based on statistical analysis of operational patterns during normal operation. This model clearly defines the compliant distribution patterns of different types of nodes over operational time periods. Based on business experience and historical data analysis, the preset classification standards stipulate that the operations of order creation nodes should primarily occur during working hours, order review nodes should primarily occur during working hours, logistics and transportation nodes should primarily occur during both working and non-working hours, and order completion nodes should primarily occur during both working and non-working hours. During the comparison process, if the main operational time period category of the classification result for an abnormal node does not match the preset standards, the operation of that node within its main operational time period is determined to be an abnormal operation. All abnormal operations are integrated and statistically analyzed to obtain an abnormal operation sequence.

[0061] For example, when analyzing the order review node with order number "Order_289" in the initial extracted set, the number of timestamps of the data processing operation during working hours is 122, the number during non-working hours is 153, and the number during late night is 3. Therefore, the main time period of this node is non-working hours, which deviates from the preset classification standard. Thus, the operation of this node is determined to be an abnormal operation and is recorded in the abnormal operation sequence.

[0062] In step S16, a legality comparison is performed based on the abnormal operation sequence to obtain a preliminary comparison set. A threshold comparison is then performed based on the preliminary comparison set to obtain the final vulnerability location, including: Information modification operations are obtained based on the abnormal operation sequence and their legality is compared. If the information modification operation does not meet the legality standard, it is judged as an illegal operation. The illegal operations are integrated to obtain a preliminary comparison set. The proportion of illegal operations is calculated based on the preliminary comparison set and compared. If the proportion exceeds a preset illegal threshold, it is identified as a vulnerability node. The vulnerability nodes are then integrated to obtain the final vulnerability location.

[0063] It should be noted that the information modification operation refers to the action of changing the data content within a node, including changes to key information such as order amount modification, delivery address change, and logistics status update. The modification legality standard is an operational specification pre-set by the system administrator according to business rules, clearly defining the preconditions and authorization requirements that different types of information modification operations must meet. As required, all modifications to order amount and shipment quantity require approval from a superior, while modifications to other parts of the order only require approval from an auditor. During legality comparison, each modification operation in the abnormal operation sequence is read and compared item by item with the compliance requirements specified in the modification legality standard.

[0064] For example, if the order amount for order number "Order_312" is modified at the order approval node, but the operation log shows that there is no corresponding supervisor approval record for the modification operation in the approval log, it indicates that the modification operation was not approved by the supervisor. Therefore, this information modification operation is determined to be inconsistent with the legality standard and marked as an illegal operation. All illegal operations are integrated and summarized, and detailed information such as operation time, operation node, and operation type is recorded to obtain a preliminary comparison set.

[0065] Further, the proportion of illegal operations is calculated based on the preliminary comparison set. The proportion of illegal operations is calculated using the following formula:

[0066] Among them, R illegal N represents the proportion of illegal operations. illegal N represents the number of illegal operations within a node. total This represents the total number of information modification operations within a node. The calculated illegal operation ratio is compared with a preset illegal threshold, which is set at 15% according to security requirements. If the illegal operation ratio of a node exceeds the preset illegal threshold, it indicates that the node has a serious security vulnerability and is identified as a vulnerable node. For example, the logistics transportation node with order number "Order_345" had a total of 128 modification operations, of which 23 were judged as illegal operations. The calculated illegal operation ratio is (23 / 128)×100%=17.97%, which exceeds the preset illegal threshold of 15%, therefore, this node is identified as a vulnerable node.

[0067] In real-world, complex attack scenarios, malicious behavior is often not concentrated on a single node but rather distributed across multiple related nodes through coordinated operations to evade detection. Therefore, risk assessments of a single node may not fully reflect the overall security status. To address this issue, a comprehensive risk assessment mechanism for clusters of related nodes is introduced. By analyzing the relationships between nodes and risk propagation paths, this mechanism effectively identifies distributed attack behaviors.

[0068] Specifically, for a target node initially identified as a vulnerable node, further identification is made of all its adjacent nodes with direct connections in the complete path graph, including downstream nodes originating from the vulnerable node and upstream nodes ending at the vulnerable node. These nodes, together with the vulnerable node, form an associated node cluster. When conducting a comprehensive risk assessment of this associated node cluster, the proportion of illegal operations for each node in the cluster is first calculated, followed by the calculation of the connection weight for each node. The connection weight comprehensively considers two dimensions: the number of branches and the number of convergences. The connection weight is calculated using the formula:

[0069] Among them, W i B represents the connection weight of the i-th node. i C represents the number of branches at the i-th node. i Let represent the number of nodes converging at node i, and n represent the total number of nodes in the cluster. Normalization is applied to ensure that the sum of the connection weights of all nodes is 1. Then, the comprehensive risk coefficient of the cluster of associated nodes is calculated. This comprehensive risk coefficient is calculated by weighted averaging, which combines the local risks of each node in the cluster according to its importance in the network. The formula is as follows:

[0070] Among them, R cluster R represents the overall risk coefficient of the associated node cluster. illegal，i W represents the proportion of illegal operations on the i-th node in the cluster. i This represents the connection weight of the node, and n represents the total number of nodes in the cluster.

[0071] Furthermore, the calculated comprehensive risk coefficient is compared with a preset cluster risk threshold. This preset cluster risk threshold is a cluster-level risk assessment standard based on historical attack cases and security expert experience. To improve the control requirements for distributed collaborative attacks, this threshold is 15% lower than the preset illegal threshold for a single node, and is typically set at 10%. If the comprehensive risk coefficient R of a certain associated node cluster... cluster If the risk exceeds a preset cluster risk threshold by 10%, the cluster is deemed to pose a risk of coordinated attack, and all nodes in the entire associated node cluster are marked as vulnerable nodes. The final vulnerability location is then determined by integrating and statistically analyzing all vulnerable nodes.

[0072] For example, the order review node with order number "Order_412" was initially identified as a vulnerable node, with an illegal operation rate of 18.5%. Its associated node cluster was identified, including the node itself, the upstream order creation node, and the downstream logistics and transportation node, totaling three nodes. Statistics showed that the illegal operation rate of the order creation node was 8.2%, and that of the logistics and transportation node was 12.7%. The connection weights of each node were calculated: the order review node had 2 branches and 1 convergence point, with a weight of 0.43; the order creation node had 1 branch and 0 convergence point, with a weight of 0.14; and the logistics and transportation node had 1 branch and 2 convergence points, with a weight of 0.43. Substituting these values ​​into the formula, the overall cluster risk coefficient was calculated to be (18.5% × 0.43 + 8.2% × 0.14 + 12.7% × 0.43) = 14.6%, exceeding the preset cluster risk threshold of 10%. Therefore, all nodes in this associated node cluster were marked as vulnerable nodes.

[0073] In step S17, the simulation of the repair path based on the final vulnerability location to obtain the optimized flow trajectory includes: Interaction information is extracted from the final vulnerability location and compared. If it exceeds the preset interaction standard, it is determined to be a path node to be adjusted, and a set to be adjusted is obtained. The redundancy of information is calculated for the set to be adjusted, and the set is sorted according to the redundancy to obtain a priority repair order. Based on the priority repair sorting, a simulation correction is performed to generate the corrected path and obtain the optimized flow trajectory.

[0074] First, interaction information is extracted from the final vulnerability location. This interaction information refers to the data transmission characteristics between the vulnerable node and its neighboring nodes, including key parameters such as the number of data transmissions, the amount of data transmitted, and the data transmission time distribution. When extracting interaction information, each vulnerable node recorded in the final vulnerability location is first located, and then the complete path graph is traversed to identify all neighboring nodes directly connected to that vulnerable node. For each pair of connected nodes, their data interaction characteristics within a preset statistical period are statistically analyzed from the node access records.

[0075] The preset statistical period is usually set to 7 working days to ensure that the statistical data can cover the entire business cycle and reflect the real data flow pattern.

[0076] Furthermore, the extracted interaction information is compared and verified with preset interaction standards. These preset interaction standards are a set of benchmark values ​​determined based on statistical analysis of data interaction patterns during normal operation, including threshold requirements in the following four dimensions: First, the transmission frequency standard, stipulating that the number of data transmissions between adjacent nodes within 7 working days should not exceed 100 times; second, the transmission volume standard, stipulating that the total data transmission volume between adjacent nodes within 7 working days should not exceed 4000MB; third, the time distribution standard, stipulating that the proportion of transmissions during working hours should not be less than 70%; and fourth, the transmission success rate standard, stipulating that the data transmission success rate between adjacent nodes should not be less than 95%. The transmission success rate is calculated using the following formula:

[0077] Among them, S rate N represents the transmission success rate. success N represents the number of successfully transmitted data. total This represents the total number of data transmission attempts. A transmission success rate below 95% indicates frequent transmission failures or retransmissions during data interaction between nodes, which may reflect abnormal conditions such as unstable network connections, insufficient node processing capacity, or malicious interference.

[0078] During the comparison process, the interaction information of each pair of adjacent nodes is checked item by item to see if it meets the preset interaction standards. If a pair of nodes exceeds the reasonable range specified by the preset interaction standards in any dimension, such as the number of transmissions, the amount of transmission, the time distribution, or the transmission success rate, it is determined that the connection path between the node pair is abnormal and needs to be adjusted and optimized. All nodes that need adjustment are marked as nodes of the path to be adjusted and then integrated and summarized to obtain the set to be adjusted.

[0079] For example, in the aforementioned case with order number "Order_378", the extracted interaction information was compared and verified. It was found that the number of data transmissions between the order review node and the vulnerable node was 156, exceeding the preset interaction standard's limit of 100; the total data transmission volume was 4223MB, exceeding the preset interaction standard's limit of 4000MB; the transmission rate during working hours was 78%, meeting the standard of not less than 70%; and the number of successfully completed data transmissions was 153, with a transmission success rate of 153 / 155 = 98.7%, meeting the standard of a transmission success rate greater than 95%. Based on this comprehensive judgment, this node exceeds the preset interaction standard in both the number of transmissions and the amount of data transmitted, and the order review node is marked as a path node requiring adjustment.

[0080] Furthermore, information redundancy is calculated for the set to be adjusted. Information redundancy is a comprehensive indicator used to measure the integrity and reliability of node data records, reflecting whether a node maintains complete operation records and data traceability capabilities during data flow. Information redundancy is calculated using the following formula:

[0081] in, Indicates the information redundancy of a node. This indicates the number of operation logs actually recorded by the node. This represents the arithmetic mean of the number of operation logs for all nodes of the same type.

[0082] For example, for the order review node marked as a path node to be adjusted in the aforementioned order number "Order_378", its operation log records are extracted for information redundancy calculation. Statistics show that this node actually recorded 234 operation log entries (N... record =234), the arithmetic mean of all order review nodes is 189 operation logs (N). average =189), substitute into the calculation =234÷189=1.23 The information redundancy of this node is 1.23.

[0083] Furthermore, all nodes in the set to be adjusted are sorted according to the information redundancy. The sorting principle follows the order of information redundancy values ​​from high to low, that is, nodes with higher information redundancy are ranked higher. After sorting, a priority repair sorting list is generated, containing node identifiers, information redundancy values, and sorting sequence numbers.

[0084] Finally, simulation corrections are performed based on the prioritized repair order to generate the corrected paths. These simulation corrections involve constructing a virtual simulation environment to replan and optimize the data flow paths of the nodes to be adjusted, verifying the feasibility and effectiveness of the repair plan without affecting actual business operations.

[0085] It should be noted that the construction of the virtual simulation environment is achieved through four collaborative operational steps: simulating data flow, performing rule verification, monitoring performance, and implementing rollback protection. The data flow simulation step replicates the data transmission behavior between nodes in a real business scenario based on the node connection relationships recorded in the complete path graph and historical data interaction patterns. The rule verification step monitors in real time whether the data flow conforms to preset interaction standards and modification legality standards, integrating threshold comparison operations for data transmission and permission verification and legality judgment operations for data modification to ensure that all simulated behaviors comply with established specifications. The performance monitoring step is responsible for collecting key indicators in real time during the simulation process, such as data transmission frequency, transmission volume, transmission time distribution, and transmission success rate, providing quantitative evidence for evaluating the effectiveness of the remediation plan. The rollback protection step is used to immediately terminate the simulation and restore the environment to its pre-correction state when a defect is found in the remediation plan, thereby avoiding irreversible damage to the virtual environment.

[0086] The data required to construct the virtual simulation environment primarily comes from complete path graphs, final vulnerability location analysis results, and historical log data. First, node information is extracted from the complete path graph, including node type, directed connections between nodes, and the number of branches and convergences. This information forms the basic architecture of the data flow network in the virtual environment. Then, combined with the final vulnerability location analysis results, the state characteristics of the nodes to be patched are extracted from the previous analysis data, including the proportion of illegal operations, data interaction frequency, comprehensive data volume indicators, and operation time period distribution. This data is used to accurately recreate the operational state of the vulnerable nodes in the real environment. Finally, data flow samples under normal business scenarios are extracted from historical log data. Statistical analysis yields baseline characteristics such as data transmission frequency distribution, data volume distribution, and time distribution for each type of node during normal operation, serving as a reference and verification standard during the simulation and patching process.

[0087] The simulation correction process processes each path node to be adjusted sequentially according to the priority order of repair. For each node, the specific dimensions and degree of exceeding the preset interaction standard are first analyzed, and then a targeted correction strategy is formulated. After the virtual simulation environment is set up, the correction is carried out according to the preset correction strategy. The correction strategy is as follows: for nodes that exceed the transmission count limit, multiple small data transmissions are merged into a small large data transmission to reduce the number of transmissions while keeping the total data transmission volume unchanged; for nodes that exceed the transmission volume limit, only the changed data portion is transmitted instead of the full data to reduce the data volume; for nodes with abnormal time distribution, a time window adjustment strategy is adopted to migrate data transmission operations during non-working hours to working hours.

[0088] After applying the above correction strategy in the simulation environment, the success of the correction is verified from four dimensions. First, compliance indicators require that the corrected data flow path fully comply with all dimensions of the preset interaction standard, including threshold constraints such as no more than 100 transmissions, no more than 4000MB of transmission volume, a transmission ratio of no less than 70% during working hours, and a transmission success rate of no less than 95%. The compliance rate for this indicator must reach 100%. Second, stability indicators require that the overall standard deviation of the corrected data interaction frequency does not exceed the preset fluctuation limit of 10.00. Third, security indicators require that the proportion of illegal operations at all nodes in the corrected path is lower than the preset illegal threshold of 15%, and the comprehensive risk coefficient of the associated node cluster is lower than the preset cluster risk threshold of 10%. If all corrected parameters meet the standard requirements, the correction scheme is confirmed to be effective, and the corrected node connection relationships and data flow rules are recorded as the corrected path. If some parameters still do not meet the standard, the correction strategy parameters are adjusted, and the simulation is repeated until a corrective scheme that meets the requirements is found. After completing the simulation correction for all path nodes to be adjusted, all corrected paths are integrated to form a complete optimized flow trajectory.

[0089] For example, for the logistics transportation node with order number "Order_401" that ranks first in the aforementioned priority repair sorting, analysis revealed that the number of transmissions between this node and the order approval node was 134, exceeding the 100-transmission standard; the transmission volume was 289MB, meeting the 300MB standard. A batch transmission optimization strategy was used for simulation correction, reducing the original 134 transmissions of 2.16MB each to 34 transmissions of 8.5MB each, keeping the total transmission volume approximately 289MB unchanged. After the simulation correction, the number of transmissions decreased to 34, meeting the preset interaction standard. The effectiveness of this correction scheme was confirmed, the corrected path was generated and recorded in the optimized flow trajectory, completing the repair path simulation for this node.

[0090] In summary, this invention provides an artificial intelligence-based data vulnerability analysis method that can track and repair the entire data flow chain, solving the problem of inaccurate vulnerability location in complex network environments.

[0091] Reference Figure 2 This invention provides an artificial intelligence-based data vulnerability analysis system, comprising: The data acquisition module is used to acquire log data, match and sort the log data to obtain a circulating dataset; The graph construction module is used to construct node connection relationships based on the flow dataset and determine the complete path graph; The hazard identification module is used to obtain node operation logs based on the complete path map, filter potential hazard nodes according to the node operation logs, and obtain a list of hazard nodes. The risk assessment module is used to obtain the data interaction frequency based on the list of hidden danger nodes, and to perform threshold comparison based on the data interaction frequency to obtain a risk association chain directory. The anomaly analysis module is used to perform data analysis based on the risk association chain directory to obtain anomaly operation sequences; The vulnerability location module is used to perform a legality comparison based on the abnormal operation sequence to obtain a preliminary comparison set, and to perform a threshold comparison based on the preliminary comparison set to obtain the final vulnerability location; The path repair module is used to simulate the repair path based on the final vulnerability location to obtain an optimized flow trajectory.

[0092] This invention also provides an electronic device. The electronic device includes a processor, a memory, and a computer program stored in the memory and executable on the processor, such as an artificial intelligence-based data vulnerability analysis program. When the processor executes the computer program, it implements the steps described in the various embodiments of the artificial intelligence-based data vulnerability analysis system, for example... Figure 1 The step S11 shown. Alternatively, when the processor executes the computer program, it implements the functions of each module / unit in the above-described device embodiments, such as the data preprocessing module.

[0093] For example, the computer program may be divided into one or more modules / units, which are stored in the memory and executed by the processor to complete the present invention. The one or more modules / units may be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of the computer program in the electronic device.

[0094] The electronic device may be a desktop computer, laptop, handheld computer, or smart tablet, etc. The electronic device may include, but is not limited to, a processor and memory. Those skilled in the art will understand that the above components are merely examples of electronic devices and do not constitute a limitation on the electronic device. It may include more or fewer components than described above, or combine certain components, or different components. For example, the electronic device may also include input / output devices, network access devices, buses, etc.

[0095] The processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor. The processor is the control center of the electronic device, connecting all parts of the electronic device via various interfaces and lines.

[0096] The memory can be used to store the computer programs and / or modules. The processor implements various functions of the electronic device by running or executing the computer programs and / or modules stored in the memory and by calling data stored in the memory. The memory may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, phonebook, etc.). In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, RAM, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0097] Wherein, if the modules / units integrated in the electronic device are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in the computer-readable medium can be appropriately added or removed according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electrical carrier signals and telecommunication signals.

[0098] It should be noted that the device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the device embodiments provided by this invention, the connection relationships between modules indicate that they have communication connections, which can be specifically implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.

[0099] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. In particular, it should be noted that any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention for those skilled in the art.

Claims

1. A data vulnerability analysis method based on artificial intelligence, characterized in that, include: Obtain log data, match and sort the log data to obtain a flow dataset; Based on the aforementioned data transfer dataset, node connection relationships are constructed to determine the complete path graph; Based on the complete path map, node access records are obtained, and potential hidden danger nodes are filtered according to the node access records to obtain a list of hidden danger nodes. Based on the list of potential hazards, the data interaction frequency is obtained, and a threshold comparison is performed according to the data interaction frequency to obtain a risk association chain directory. Data analysis is performed based on the aforementioned risk association chain directory to obtain abnormal operation sequences; Based on the abnormal operation sequence, a legality comparison is performed to obtain a preliminary comparison set. Based on the preliminary comparison set, a threshold comparison is performed to obtain the final vulnerability location. Based on the final vulnerability location, a repair path simulation was performed to obtain an optimized flow trajectory.

2. The data vulnerability analysis method based on artificial intelligence according to claim 1, characterized in that, The process of acquiring log record data, matching and sorting the log record data to obtain a flow dataset includes: Obtain log data, extract timestamps and event identifiers from the log data to obtain a log dataset; The event identifiers are matched and sorted according to the log dataset to obtain a set of flow paths; The missing flow sequences are obtained by filtering the set of flow paths, and the missing flow sequences are supplemented and repaired to obtain the flow dataset.

3. The data vulnerability analysis method based on artificial intelligence according to claim 1, characterized in that, The step of constructing node connection relationships and determining the complete path graph based on the flow dataset includes: Based on the aforementioned data transfer dataset, path nodes are extracted to obtain preliminary path nodes; Based on the initial path nodes, the connection relationships between the nodes are constructed to obtain the direct connection path; Based on the direct connection path, add auxiliary information to the preliminary path node to obtain the complete path node. Then, organize the direct connection path and the complete path node to obtain the complete path map.

4. The data vulnerability analysis method based on artificial intelligence according to claim 1, characterized in that, The process involves obtaining node access records based on the complete path graph, filtering potential hazard nodes based on these records, and obtaining a list of hazard nodes, including: Node operation logs are obtained based on the complete path graph. Node access records are extracted from the node operation logs. If the node access records do not meet the preset permission standards, suspected potential nodes are marked and integrated to obtain preliminary marking results. Access frequency data is extracted from the preliminary marking results. If the access frequency data exceeds a preset frequency threshold, potential hidden danger nodes are marked and integrated to obtain a list of hidden danger nodes.

5. The data vulnerability analysis method based on artificial intelligence according to claim 1, characterized in that, The process involves obtaining the data interaction frequency based on the list of potential hazards, performing threshold comparisons based on the data interaction frequency, and obtaining a risk association chain directory, including: The data interaction frequency of nodes within the cluster is obtained from the list of potential hazards. If the data interaction frequency exceeds a preset frequency threshold, it is determined to be a risk critical chain. The risk critical chains are then integrated to obtain a preliminary screening set. Based on the analysis of the interaction fluctuations in the preliminary screening set, if the interaction fluctuations exceed the preset fluctuation limit, they are identified as risk association chains. The risk association chains are then statistically analyzed to obtain a risk association chain directory.

6. The data vulnerability analysis method based on artificial intelligence according to claim 1, characterized in that, The step of analyzing data based on the risk association chain directory to obtain the abnormal operation sequence includes: Extract node data volume information from the risk association chain directory. If the data volume information exceeds a preset data volume threshold, it is determined to be redundant data volume information. Extract the redundant data volume information and organize it to obtain a preliminary extraction set. Based on the preliminary extraction set, the operation time period is extracted, and the operation time period is classified to obtain the classification result. If the classification result deviates from the preset classification standard, it is judged as an abnormal operation, and an abnormal operation sequence is obtained.

7. The data vulnerability analysis method based on artificial intelligence according to claim 1, characterized in that, The step of performing a legality comparison based on the abnormal operation sequence to obtain a preliminary comparison set, and then performing a threshold comparison based on the preliminary comparison set to obtain the final vulnerability location includes: Information modification operations are obtained based on the abnormal operation sequence and their legality is compared. If the information modification operation does not meet the legality standard, it is judged as an illegal operation. The illegal operations are integrated to obtain a preliminary comparison set. The proportion of illegal operations is calculated based on the preliminary comparison set and compared. If the proportion exceeds a preset illegal threshold, it is identified as a vulnerability node. The vulnerability nodes are then integrated to obtain the final vulnerability location.

8. The data vulnerability analysis method based on artificial intelligence according to claim 1, characterized in that, The simulation of the remediation path based on the final vulnerability location to obtain the optimized flow trajectory includes: Interaction information is extracted from the final vulnerability location and compared. If it exceeds the preset interaction standard, it is determined to be a path node to be adjusted, and a set to be adjusted is obtained. The redundancy of information is calculated for the set to be adjusted, and the set is sorted according to the redundancy to obtain a priority repair order. Based on the priority repair sorting, a simulation correction is performed to generate the corrected path and obtain the optimized flow trajectory.

9. A data vulnerability analysis system based on artificial intelligence, characterized in that, include: The data acquisition module is used to acquire log data, match and sort the log data to obtain a circulating dataset; The graph construction module is used to construct node connection relationships based on the flow dataset and determine the complete path graph; The hazard identification module is used to obtain node access records based on the complete path map, filter potential hazard nodes according to the node access records, and obtain a list of hazard nodes. The risk assessment module is used to obtain the data interaction frequency based on the list of hidden danger nodes, and to perform threshold comparison based on the data interaction frequency to obtain a risk association chain directory. The anomaly analysis module is used to perform data analysis based on the risk association chain directory to obtain anomaly operation sequences; The vulnerability location module is used to perform a legality comparison based on the abnormal operation sequence to obtain a preliminary comparison set, and to perform a threshold comparison based on the preliminary comparison set to obtain the final vulnerability location; The path repair module is used to simulate the repair path based on the final vulnerability location to obtain an optimized flow trajectory.

Images