Data transaction security assessment method based on gated attention feedforward network

Abstract

The invention relates to a data transaction security assessment method based on a gated attention feedforward network. The method comprises the following steps: calculating a data exposure surface element, a data value density element and an operation anomaly index element through audit data; standardizing the elements respectively and then combining the elements into a data security situation feature vector; weighting the data security situation feature vector based on a gating attention mechanism to obtain a security risk feature vector; constructing a reset gate and an update gate by adopting a parameterized correction linear unit, and performing deep coupling on the security risk feature vector through the reset gate, the update gate and an interaction head to obtain a deep coupling feature; performing linear mapping and fusion on the deep coupling features through a deep feed-forward network, and outputting a comprehensive risk score; and determining a data transaction risk level based on the comprehensive risk score and a preset threshold. According to the method, real-time, dynamic, quantitative and interpretable security risk assessment of the target data assets in the data transaction platform can be realized.

Description

Technical Field

[0001] This application relates to the field of data transaction security prediction technology, and in particular to a data transaction security assessment method based on a gated attention feedforward network. Background Technology

[0002] Data element trading platforms, as key infrastructure driving the deepening development of the digital economy, aim to promote the efficient circulation and market-based allocation of data resources. However, data elements face complex and ever-changing security threats during the dynamic circulation process of trading, sharing, and transmission. Traditional data security assessment methods have the following limitations: First, the assessment methods are static and rigid. Most methods are based on fixed security strategies, periodic manual audits, or rule engines, making it difficult to respond in real time to the rapidly changing security events during the transaction process, resulting in significant lag in assessment results. Second, the determination of risk weights is subjective. Existing solutions often rely on the experience of domain experts to pre-set the weights of various security attributes. Such static weights cannot objectively and adaptively reflect the true differences in the importance of various risk factors under different transaction models and data types. Third, complex risk correlations are difficult to characterize. The overall risk in data trading scenarios is often not a simple sum of individual risk factors, but rather stems from their complex nonlinear interactions. Traditional models lack the ability to explicitly model such high-order, dynamic correlations.

[0003] In summary, existing technologies have not yet effectively solved common problems such as assessment lag, rigid weights, weak interaction relationship modeling, and insufficient platform-level universality. Current data trading platforms lack an intelligent security assessment method that can perceive dynamic risks in real time, adaptively focus on core threats, deeply mine complex risk correlations, and have strong scenario generalization capabilities. Summary of the Invention

[0004] To address the shortcomings of existing data transaction security assessment technologies, such as assessment lag, rigid risk weights, difficulty in characterizing complex risk relationships, and insufficient scenario adaptability, it is necessary to provide a data transaction security assessment method based on gated attention feedforward networks, including: S1: Collect audit data of the target data assets in real time from the data trading platform, and calculate the data exposure surface element, data value density element, and operation anomaly index element based on the audit data; standardize each element and combine them into a data security situation feature vector; S2: Weight the data security situation feature vector based on the gating attention mechanism to obtain the security risk feature vector; S3: A reset gate and an update gate are constructed using a parameterized modified linear unit. The reset gate is used to modulate the security risk feature vector. The modulated security risk feature vector is then fused through several interaction heads to obtain candidate interaction features. Residual connections are performed based on the update gate, candidate interaction features, and security risk feature vector to obtain deeply coupled features. S4: The deep coupling features are linearly mapped and fused through a deep feedforward network containing several fully connected layers to output a comprehensive risk score; the risk level of data transactions is determined based on the comprehensive risk score and a preset threshold.

[0005] Preferably, the audit data includes all access logs of the target data asset within a preset time window, the security classification level, compliance constraint identifier, and recent price of the target data asset, and all API call and operation logs of the target data asset.

[0006] Preferably, each access log entry includes an access timestamp and the access subject. Data exposure surface elements are calculated based on all access timestamps and access subjects. The formula for calculating data exposure surface elements is: ; ; ; ; in, Indicates data exposure surface elements, This represents the first preset weighting coefficient. Indicates the dispersion of the access subjects. This represents the second preset weighting coefficient. Indicates the density of access behavior. This indicates the number of entities accessing the target data asset. This represents the maximum number of entities accessing all data assets. Represents a very small number; This indicates the average access frequency of the target data asset. This indicates the highest average access frequency across all data assets. Indicates within the preset time window Total number of visits to the target data assets.

[0007] Preferably, based on the security classification level, compliance constraint identifier, and recent price of the target data asset, the data value density element is calculated using the following formula: ; in, Indicates the data value density element. This represents the third preset weighting coefficient. Describes the minimum-maximum normalization function. Indicates the security classification level of the target data asset. This represents the fourth preset weighting coefficient. Indicates the compliance constraint identifier of the target data asset. This represents the fifth preset weighting coefficient. This indicates the recent price of the target data asset.

[0008] Preferably, all API calls and operation logs of the target data asset include request timestamps, IP address hash values, operation types, data access volume, and request results. The request timestamps, IP address hash values, operation types, data access volume, and request results are standardized and then combined into a behavioral feature vector. The behavioral feature vector is then input into a pre-trained unsupervised anomaly detection model and mapped to operation anomaly index elements.

[0009] Preferably, S2 includes: S2.1: The data security situation feature vector is mapped to the original attention score vector through a fully connected layer, and the data security situation feature vector is mapped to the dynamic gating signal vector through a gating mechanism; the original attention score vector and the dynamic gating signal vector are multiplied element by element to obtain the modulated attention score vector; S2.2: Normalize the modulated attention score vector using the Softmax function to obtain the attention weight vector; S2.3: Multiply the data security situation feature vector element-wise with the attention weight vector to obtain a weighted feature vector; S2.4: Perform a residual concatenation between the weighted feature vector and the data security situation feature vector to obtain the security risk feature vector.

[0010] Preferably, S3 includes: S3.1: A reset gate and an update gate are constructed using a parameterized modified linear unit and a sigmoid function, and the reset gate is multiplied element-wise with the security risk feature vector to obtain the modulated security risk feature vector; S3.2: The modulated security risk feature vector is passed through several independent interaction heads, and any one of the interaction heads maps the modulated security risk feature vector to the corresponding interaction feature based on the hyperbolic tangent function of the corresponding hyperparameter; S3.3: The interaction features corresponding to each interaction head are fused by average pooling to obtain the candidate interaction features; S3.4: Based on the updated gate, the security risk feature vector and the candidate interaction feature are weighted and fused to obtain the gated fused interaction feature; S3.5: Perform residual connection between the security risk feature vector and the interaction feature after gating fusion to obtain the deep coupling feature.

[0011] Preferably, the expressions for the reset gate and the update gate are: ; ; in, This indicates that the door is being reset. Indicates an update to the door. This represents the Sigmoid function. Represents a parameterized modified linear unit. Represents a security risk feature vector. This represents the first weight matrix. This represents the second weight matrix. This represents the third weight matrix. This represents the fourth weight matrix. This represents the first bias vector. This represents the second bias vector.

[0012] Preferably, in S4, the linear mapping and fusion of deeply coupled features through a deep feedforward network containing several fully connected layers includes: S4.1: Construct a deep feedforward network containing several fully connected layers, and input the deep coupling features into the deep feedforward network. Each fully connected layer outputs the corresponding deep feature representation. The working principle of any fully connected layer is as follows: ; ; in, Indicates the first The depth feature representation output by the fully connected layer. Indicates the first The parameterized adaptive piecewise activation function defined in the fully connected layer. Indicates the first The weight matrix of the fully connected layer. Indicates the first The bias vector of the fully connected layer. Indicates the first The depth feature representation output by the fully connected layer. This represents a parameterized adaptive piecewise activation function. Representing an algebraic expression, Represents the hyperbolic tangent function. Indicates the first scalar parameter. Indicates the second scalar parameter. Indicates the third scalar parameter. This represents the fourth scalar parameter; the input to the first fully connected layer is a deeply coupled feature. S4.2: Linearly map the depth feature representations output by each fully connected layer to obtain the corresponding preliminary risk assessment value. The calculation formula is as follows: ; in, Representation of deep features The corresponding preliminary risk assessment value, Representation of deep features The corresponding mapping weight vector, Representation of deep features The corresponding bias scalar, Indicates transpose; S4.3: Based on the preset fusion weights for each fully connected layer, all preliminary risk assessment values ​​are weighted and summed to output the comprehensive risk score.

[0013] Preferably, in S4, determining the data transaction risk level based on a comprehensive risk score and a preset threshold includes: The total number of data transaction risk levels is pre-set to C based on an expert experience evaluation mechanism, and the number of preset thresholds is set to C-1. , This represents the first preset threshold. This indicates the second preset threshold. This indicates the preset threshold C-1; data transaction risk levels are arranged from low to high. When the comprehensive risk score is less than the first preset threshold At that time, the data transaction risk level of the target data asset was determined to be the lowest risk. When the comprehensive risk score is greater than or equal to the (k-1)th preset threshold and less than the kth preset threshold, the data transaction risk level of the target data asset is determined to be the kth data transaction risk level, k∈[2,C-1]; When the comprehensive risk score is greater than or equal to the preset threshold of C-1 At that time, the data transaction risk level of the target data asset was determined to be the highest risk.

[0014] Beneficial effects: This method calculates data exposure surface elements, data value density elements, and operational anomaly index elements from audit data; after standardizing each element, it combines them into a data security situation feature vector; based on a gating attention mechanism, it weights the data security situation feature vector to obtain a security risk feature vector; it constructs reset gates and update gates using parameterized modified linear units, and deeply couples the security risk feature vector through the reset gate, update gate, and interaction head to obtain deeply coupled features; it linearly maps and fuses the deeply coupled features through a deep feedforward network to output a comprehensive risk score; based on the comprehensive risk score and a preset threshold, it determines the data transaction risk level. This method can achieve real-time, dynamic, quantitative, and interpretable security risk assessment of target data assets within a data trading platform. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 This is a flowchart of a data transaction security assessment method based on a gated attention feedforward network, as described in this application. Detailed Implementation

[0017] To make the above-mentioned objectives, features, and advantages of this application more apparent and understandable, the specific embodiments of this application are described in detail below with reference to the accompanying drawings. Many specific details are set forth in the following description to provide a thorough understanding of this application. However, this application can be implemented in many other ways different from those described herein, and those skilled in the art can make similar modifications without departing from the spirit of this application. Therefore, this application is not limited to the specific embodiments disclosed below.

[0018] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "multiple" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0019] like Figure 1 As shown, this embodiment provides a data transaction security assessment method based on a gated attention feedforward network, including: S1: Collect audit data of the target data assets in real time from the data trading platform, and calculate the data exposure surface element, data value density element, and operation anomaly index element based on the audit data; after standardizing each element, combine them into a data security situation feature vector.

[0020] In this embodiment, the audit data includes all access logs of the target data asset within a preset time window, the security classification level, compliance constraint identifier, and recent price of the target data asset, as well as all API call and operation logs of the target data asset.

[0021] Specifically, the calculation process for data exposure surface element, data value density element, and operational anomaly index element includes: Each access log entry includes an access timestamp and the accessing entity. Data exposure surface features are calculated based on all access timestamps and accessing entities. The formula for calculating data exposure surface features is: ; ; ; ; ; in, This represents the data exposure surface element. A higher value indicates that the data is accessed by more different entities at a higher frequency, and the wider its exposure to potential threats. This represents the first preset weighting coefficient. Indicates the dispersion of the access subjects. This represents the second preset weighting coefficient. Indicates the density of access behavior. This indicates the number of entities accessing the target data asset. This represents the maximum number of entities accessing all data assets. Represents a very small number; This indicates the average access frequency of the target data asset. This indicates the highest average access frequency across all data assets. Indicates within the preset time window Total number of visits to the target data assets.

[0022] The data value density element is calculated based on the target data asset's security classification level, compliance constraint identifier (1 if protected by specific regulations, 0 otherwise), and recent price (including recent listing or transaction prices). The formula for calculating the data value density element is as follows: ; ; in, This represents the data value density element. The value reflects the severity of potential losses implied by the data's inherent sensitivity, compliance requirements, and market value. This represents the third preset weighting coefficient. This represents the minimum-maximum normalization function, which is used to... , Mapped to the interval [0,1] respectively. Indicates the security classification level of the target data asset. This represents the fourth preset weighting coefficient. Indicates the compliance constraint identifier of the target data asset. This represents the fifth preset weighting coefficient. This indicates the recent price of the target data asset.

[0023] All API calls and operation logs for the target data assets include request timestamps (hourly timestamps), IP address hashes (data source), operation types (queries and / or downloads), data access volume, and request results (success / failure). These data are then standardized and combined to form a behavioral feature vector. The behavioral feature vector is input into a pre-trained unsupervised anomaly detection model. This is mapped to operational anomaly index elements.

[0024] In this embodiment, the pre-trained model The model employs the Isolation Forest algorithm. It is trained on a massive amount of historical normal operation logs accumulated by the platform. Its core principle is to "isolate" data points by randomly partitioning the feature space. Normal data points, due to their dense distribution, typically require longer random paths to be isolated, while abnormal points can be quickly isolated using shorter paths. The model maps the average path length required to isolate the current behavior feature vector to a normalized anomaly score, which serves as the operational anomaly index element. Output, The higher the value, the more the current behavior pattern deviates from the historical normal baseline.

[0025] In this embodiment, each element is standardized using Z-score, and after eliminating the dimensions, they are combined to form a data security situation feature vector. , recorded as .

[0026] S2: The data security situation feature vector is weighted based on the gating attention mechanism to obtain the security risk feature vector.

[0027] Specifically, the steps include: S2.1: The data security posture feature vector is mapped to the original attention score vector through a fully connected layer. The calculation formula is as follows: ; in, Represents the original attention score vector. This initially reflects the inherent importance of the characteristics. This represents the first attention weight matrix. , This represents the first attention bias vector. , , , These represent the original attention scores of the corresponding elements after standardization.

[0028] Meanwhile, to introduce dynamic scene perception capabilities, a parallel gating mechanism is constructed. The data security situation feature vector is mapped to a dynamic gating signal vector through the gating mechanism, and the calculation formula is as follows: ; in, Represents the dynamic gating signal vector. and The dynamic gating signal vector Able to base on input features The current specific security situation it represents dynamically adjusts the attention scores of each feature. This represents the Sigmoid function. Represents the gate weight matrix. , This represents the gating bias vector. , , , These represent the gating signals for the corresponding elements after standardization.

[0029] The original attention score vector is element-wise multiplied with the dynamic gating signal vector to achieve scene-adaptive modulation of the original attention score vector, resulting in the modulated attention score vector. The calculation formula is as follows: ; in, This represents the modulated attention score vector. It represents the Hadamah accumulation. This indicates transpose.

[0030] S2.2: Normalize the modulated attention score vector using the Softmax function to obtain the attention weight vector, calculated as follows: ; ; in, Indicates the first The attention weights of each standardized element. Indicates the first The original attention scores of each standardized element. Indicates the first The attention weights of each standardized element. Indicates the first The standardized gating signal corresponding to each element. Indicates the first The standardized gating signal corresponding to each element. Indicates the first The attention score of each standardized element. Indicates the first Attention scores for each standardized element.

[0031] S2.3: Multiply the data security situation feature vector element-wise with the attention weight vector to adaptively reconstruct the data security situation feature vector to highlight key risk driving factors, resulting in a weighted feature vector. The calculation formula is as follows: ; in, Represents the weighted eigenvector. This represents the attention weight vector.

[0032] S2.4: To further preserve the complete information flow of the original features and enhance the training stability of the model, the weighted feature vector is residually concatenated with the data security situation feature vector to obtain the security risk feature vector, calculated as follows: ; in, Represents a security risk feature vector. , This represents the learnable residual connection weight matrix. , , , These represent the safety risk characteristics of the corresponding elements after standardization. The data security risk features, which are dynamically focused and enhanced by the gating attention mechanism, will be sent to the subsequent feature interaction layer for in-depth relationship mining.

[0033] This step aims to adaptively evaluate and assign dynamic importance weights to these three core risk elements in the current context through a learnable gated attention mechanism, thereby addressing the problem of insufficient scenario adaptability caused by fixed weights or reliance on expert experience in traditional evaluation models.

[0034] S3: A reset gate and an update gate are constructed using a parameterized modified linear unit. The reset gate is used to modulate the security risk feature vector. The modulated security risk feature vector is then fused through several interaction heads to obtain candidate interaction features. Residual connections are performed based on the update gate, candidate interaction features, and security risk feature vector to obtain deeply coupled features.

[0035] Specifically, the steps include: S3.1: The reset gate and update gate are constructed using a parameterized modified linear unit and a sigmoid function. The reset gate determines how much historical risk association information (or the state at the previous moment, which in static evaluation refers to the baseline association pattern of the feature) should be combined with the current input feature to generate a new interaction representation. The update gate controls how much newly generated interaction information should be integrated into the final output feature. The expressions for the reset and update gates are: ; ; in, This indicates that the door is being reset. Indicates an update to the door. And the value range of each element is between (0,1). This represents the Sigmoid function. Represents a parameterized modified linear unit. Represents a security risk feature vector. This represents the first weight matrix. This represents the second weight matrix. This represents the third weight matrix. This represents the fourth weight matrix. , This represents the first bias vector. This represents the second bias vector. .

[0036] The reset gate is multiplied element-wise with the security risk feature vector to filter out the feature basis used to generate new interaction information, resulting in the modulated security risk feature vector. The calculation formula is as follows: ; in, This represents the modulated security risk feature vector.

[0037] S3.2: The modulated security risk feature vector is passed through Q independent interaction heads. Each interaction head maps the modulated security risk feature vector to the corresponding interaction feature based on the hyperbolic tangent function of the corresponding hyperparameter. The working principle is as follows: ; in, Indicates the first The interaction features corresponding to each interaction header. , This represents the hyperbolic tangent function, used to constrain the output within the range (-1, 1), which helps stabilize training. Indicates the first Learnable weights of each interactive head , Indicates the first The offset of each interaction header. .

[0038] S3.3: The interaction features corresponding to each interaction head are fused through average pooling to obtain the candidate interaction features. The calculation formula is as follows: ; in, Representing candidate interaction features, It gathers information on risk factors from multiple perspectives.

[0039] S3.4: Based on the updated gate-weighted fusion of the security risk feature vector and the candidate interaction feature, a balanced control of the old and new information is achieved, resulting in the gated fused interaction feature, calculated as follows: ; in, This indicates the interactive features after gating fusion. , , , These represent the standardized, gated, fused interactive feature elements, respectively, and the gates are updated. This determines what proportion of attention should be focused on newly discovered complex interactions at the present moment.

[0040] S3.5: To further promote gradient flow, enhance the model's ability to represent deep features, and retain the original important information extracted in step S2, the safety risk feature vector is residually connected with the gated fused interaction feature to obtain the deep coupling feature, calculated as follows: ; in, Indicates deep coupling characteristics. , , , These represent the deeply coupled feature elements of the corresponding elements after standardization. This represents the learnable weight matrix. Used to adjust the scale of jump connections. This is the final output of this step. It not only contains the weight information of the original risk features, but also deeply encodes the complex and dynamic coupling relationship between these features, providing a highly expressive feature representation for the final risk quantification.

[0041] The core objective of this step is to explicitly mine and model the complex nonlinear coupling relationships among the three core elements: data exposure surface, value density, and operational anomaly index. These relationships are difficult to capture using traditional linear or simple nonlinear models. Therefore, an enhanced gating mechanism is first introduced to finely control the information flow during the interaction process. Traditional gating units typically use single-layer linear transformations, which have limited expressive power. This invention employs a structure containing two-layer nonlinear transformations to generate the reset gate. With the update gate To enhance the ability to perceive complex risk characteristics and patterns.

[0042] S4: The deep coupling features are linearly mapped and fused through a deep feedforward network containing several fully connected layers to output a comprehensive risk score; the risk level of data transactions is determined based on the comprehensive risk score and a preset threshold.

[0043] Specifically, the steps include: S4.1: Construct a system containing A fully connected layer deep feedforward network is used, and the deep coupling features are input into the deep feedforward network. Each fully connected layer outputs the corresponding depth feature representation. The working principle of any fully connected layer is as follows: ; ; in, Indicates the first The depth feature representation output by the fully connected layer. Indicates the first The parameterized adaptive piecewise activation function defined in the fully connected layer. Indicates the first The weight matrix of the fully connected layer. Indicates the first The bias vector of the fully connected layer. Indicates the first The depth feature representation output by the fully connected layer. This represents a parameterized adaptive piecewise activation function that applies different learnable transformations depending on the sign of the input value. Representing an algebraic expression, Represents the hyperbolic tangent function. Indicates the first scalar parameter. Indicates the second scalar parameter. Indicates the third scalar parameter. The fourth scalar parameter is represented; the input to the first fully connected layer is a deeply coupled feature; the weight matrix and bias vector of all fully connected layers are also represented. The scalar parameters in the function are all optimized and updated synchronously during model training using a gradient descent-based optimization algorithm.

[0044] S4.2: Linearly map the depth feature representations output by each fully connected layer to obtain the corresponding preliminary risk assessment value. The calculation formula is as follows: ; in, Representation of deep features The corresponding preliminary risk assessment value, Representation of deep features The corresponding mapping weight vector, Representation of deep features The corresponding bias scalar, Indicates transpose; S4.3: Based on the preset fusion weights for each fully connected layer, all preliminary risk assessment values ​​are weighted and summed to output the comprehensive risk score. The calculation formula is: ; ; in, This represents the overall risk score. Indicates the first The pre-defined fusion weights of the fully connected layer, and .

[0045] The method of determining the risk level of data transactions based on a comprehensive risk score and a preset threshold includes: The total number of data transaction risk levels is pre-set to C based on an expert experience evaluation mechanism. An ordered regression method based on learnable thresholds is then used to set the number of preset thresholds to C-1. , This represents the first preset threshold. This indicates the second preset threshold. This represents the (C-1)th preset threshold, and these preset thresholds are optimized together with other parameters of the model during training; data transaction risk levels are arranged from low to high; When the comprehensive risk score is less than the first preset threshold At that time, the data transaction risk level of the target data asset was determined to be the lowest risk. When the comprehensive risk score is greater than or equal to the (k-1)th preset threshold and less than the kth preset threshold, the data transaction risk level of the target data asset is determined to be the kth data transaction risk level, k∈[2,C-1]; When the comprehensive risk score is greater than or equal to the preset threshold of C-1 At that time, the data transaction risk level of the target data asset was determined to be the highest risk. The output of this step is the evaluation tuple (overall risk score). Data transaction risk level This completed the automated and quantitative assessment of data asset security risks.

[0046] For example, if C=3, corresponding to "low risk, medium risk, high risk", then the number of preset thresholds is 2, including the first preset threshold. Second preset threshold Data transaction risk level The judgment rules are as follows: like ,but ; like ,but ; like ,but .

[0047] This step receives the deeply coupled features from the output of step S3 as input. The input features are then abstracted and transformed layer by layer through a deep feedforward network containing learnable nonlinear functions to extract a high-order representation suitable for the final risk decision.

[0048] The data transaction security assessment method based on a gated attention feedforward network provided in this embodiment has the following beneficial effects: This method calculates data exposure surface elements, data value density elements, and operational anomaly index elements from audit data; after standardizing each element, it combines them into a data security situation feature vector; based on a gating attention mechanism, it weights the data security situation feature vector to obtain a security risk feature vector; it constructs reset gates and update gates using parameterized modified linear units, and deeply couples the security risk feature vector through the reset gate, update gate, and interaction head to obtain deeply coupled features; it linearly maps and fuses the deeply coupled features through a deep feedforward network to output a comprehensive risk score; based on the comprehensive risk score and a preset threshold, it determines the data transaction risk level. This method can achieve real-time, dynamic, quantitative, and interpretable security risk assessment of target data assets within a data trading platform.

[0049] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0050] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A data transaction security assessment method based on a gated attention feedforward network, characterized in that, include: S1: Collect audit data of the target data assets in real time from the data trading platform, and calculate the data exposure surface element, data value density element, and operation anomaly index element based on the audit data; standardize each element and combine them into a data security situation feature vector; S2: Weight the data security situation feature vector based on the gating attention mechanism to obtain the security risk feature vector; S3: A reset gate and an update gate are constructed using a parameterized modified linear unit. The reset gate is used to modulate the security risk feature vector. The modulated security risk feature vector is then fused through several interaction heads to obtain candidate interaction features. Residual connections are performed based on the update gate, candidate interaction features, and security risk feature vector to obtain deeply coupled features. S4: A deep feedforward network containing several fully connected layers is used to linearly map and fuse deeply coupled features, and output a comprehensive risk score. The risk level of data transactions is determined based on a comprehensive risk score and a preset threshold.

2. The method according to claim 1, characterized in that, The audit data includes all access logs of the target data asset within a preset time window, the security classification level, compliance constraint identifier, and recent price of the target data asset, as well as all API call and operation logs of the target data asset.

3. The method according to claim 2, characterized in that, Each access log entry includes an access timestamp and the accessing entity. Data exposure surface features are calculated based on all access timestamps and accessing entities. The formula for calculating data exposure surface features is: ； ； ； ； in, Indicates data exposure surface elements, This represents the first preset weighting coefficient. Indicates the dispersion of the access subjects. This represents the second preset weighting coefficient. Indicates the density of access behavior. This indicates the number of entities accessing the target data asset. This represents the maximum number of entities accessing all data assets. Represents a very small number; This indicates the average access frequency of the target data asset. This indicates the highest average access frequency across all data assets. Indicates within the preset time window Total number of visits to the target data assets.

4. The method according to claim 2, characterized in that, Based on the security classification level, compliance constraint identifier, and recent price of the target data asset, the data value density element is calculated using the following formula: ； in, Indicates the data value density element. This represents the third preset weighting coefficient. Describes the minimum-maximum normalization function. Indicates the security classification level of the target data asset. This represents the fourth preset weighting coefficient. Indicates the compliance constraint identifier of the target data asset. This represents the fifth preset weighting coefficient. This indicates the recent price of the target data asset.

5. The method according to claim 2, characterized in that, All API calls and operation logs of the target data asset include request timestamps, IP address hash values, operation types, data access volume, and request results. The request timestamps, IP address hash values, operation types, data access volume, and request results are standardized and then combined into behavioral feature vectors. The behavioral feature vectors are then input into a pre-trained unsupervised anomaly detection model and mapped to operation anomaly index elements.

6. The method according to claim 1, characterized in that, S2 include: S2.1: The data security situation feature vector is mapped to the original attention score vector through a fully connected layer, and the data security situation feature vector is mapped to the dynamic gating signal vector through a gating mechanism; the original attention score vector and the dynamic gating signal vector are multiplied element by element to obtain the modulated attention score vector; S2.2: Normalize the modulated attention score vector using the Softmax function to obtain the attention weight vector; S2.3: Multiply the data security situation feature vector element-wise with the attention weight vector to obtain a weighted feature vector; S2.4: Perform a residual concatenation between the weighted feature vector and the data security situation feature vector to obtain the security risk feature vector.

7. The method according to claim 1, characterized in that, S3 include: S3.1: A reset gate and an update gate are constructed using a parameterized modified linear unit and a sigmoid function, and the reset gate is multiplied element-wise with the security risk feature vector to obtain the modulated security risk feature vector; S3.2: The modulated security risk feature vector is passed through several independent interaction heads, and any one of the interaction heads maps the modulated security risk feature vector to the corresponding interaction feature based on the hyperbolic tangent function of the corresponding hyperparameter; S3.3: The interaction features corresponding to each interaction head are fused by average pooling to obtain the candidate interaction features; S3.4: Based on the updated gate, the security risk feature vector and the candidate interaction feature are weighted and fused to obtain the gated fused interaction feature; S3.5: Perform residual connection between the security risk feature vector and the interaction feature after gating fusion to obtain the deep coupling feature.

8. The method according to claim 7, characterized in that, The expressions for the reset and update gates are: ； ； in, This indicates that the door is being reset. Indicates an update to the door. This represents the Sigmoid function. Represents a parameterized modified linear unit. Represents a security risk feature vector. This represents the first weight matrix. This represents the second weight matrix. This represents the third weight matrix. This represents the fourth weight matrix. This represents the first bias vector. This represents the second bias vector.

9. The method according to claim 1, characterized in that, In S4, the linear mapping and fusion of deeply coupled features through a deep feedforward network containing several fully connected layers includes: S4.1: Construct a deep feedforward network containing several fully connected layers, and input the deep coupling features into the deep feedforward network. Each fully connected layer outputs the corresponding deep feature representation. The working principle of any fully connected layer is as follows: ； ； in, Indicates the first The depth feature representation output by the fully connected layer. Indicates the first The parameterized adaptive piecewise activation function defined in the fully connected layer. Indicates the first The weight matrix of the fully connected layer. Indicates the first The bias vector of the fully connected layer. Indicates the first The depth feature representation output by the fully connected layer. This represents a parameterized adaptive piecewise activation function. Representing an algebraic expression, Represents the hyperbolic tangent function. Indicates the first scalar parameter. Indicates the second scalar parameter. Indicates the third scalar parameter. This represents the fourth scalar parameter; the input to the first fully connected layer is a deeply coupled feature. S4.2: Linearly map the depth feature representations output by each fully connected layer to obtain the corresponding preliminary risk assessment value. The calculation formula is as follows: ； in, Representation of deep features The corresponding preliminary risk assessment value, Representation of deep features The corresponding mapping weight vector, Representation of deep features The corresponding bias scalar, Indicates transpose; S4.3: Based on the preset fusion weights for each fully connected layer, all preliminary risk assessment values ​​are weighted and summed to output the comprehensive risk score.

10. The method according to claim 1, characterized in that, In S4, the determination of the data transaction risk level based on the comprehensive risk score and a preset threshold includes: The total number of data transaction risk levels is pre-set to C based on an expert experience evaluation mechanism, and the number of preset thresholds is set to C-1. , This represents the first preset threshold. This indicates the second preset threshold. This indicates the preset threshold C-1; data transaction risk levels are arranged from low to high. When the comprehensive risk score is less than the first preset threshold At that time, the data transaction risk level of the target data asset was determined to be the lowest risk. When the comprehensive risk score is greater than or equal to the (k-1)th preset threshold and less than the kth preset threshold, the data transaction risk level of the target data asset is determined to be the kth data transaction risk level, k∈[2,C-1]; When the comprehensive risk score is greater than or equal to the preset threshold of C-1 At that time, the data transaction risk level of the target data asset was determined to be the highest risk.

Images