A data cross-border risk assessment method and system based on subjective and objective fusion empowerment

Abstract

The application belongs to the technical field of data security, and discloses a data cross-border risk assessment method and system based on subjective and objective fusion empowerment, which comprises the following steps: obtaining identified risk factors in the data cross-border field; subjectively empowering the identified risk factors to obtain subjective weights and subjective risk evaluations of each risk factor given by each expert; evaluating the subjective risk evaluations of the risk factors to determine the objective weights of each expert; determining the risk weight of each risk factor according to the subjective weight of the risk factor and the objective weight of the corresponding expert; and evaluating the cross-border risk of target data in the data cross-border field according to the risk factors in the target data and the corresponding risk weights. By constructing a subjective and objective combination empowerment mode, the application can realize subjective and objective fusion evaluation of data cross-border risk assessment, thereby improving the scientificity and objectivity of data cross-border risk assessment.

Description

Technical Field

[0001] This invention belongs to the field of data security technology and relates to a method and system for cross-border data risk assessment based on a fusion of subjective and objective assessments. This method is applied to the analysis of cross-border data security risks, specifically applicable to the security prevention and control of cross-border data flows and the deployment of risk measures, guiding production practices and reducing cross-border data risk losses. Background Technology

[0002] As the fifth major factor of production, the cross-border flow of data is of great significance to the global economy and national security. However, the complexity of this business process, the large number of participants, and the involvement of multiple fields make cross-border data security risks both diverse and complex. Currently, cross-border data risk assessment still relies heavily on subjective expert review. The core reason is the lack of key supporting conditions required for risk assessment: on the one hand, historical data on cross-border data risks is incomplete, inaccurate, and has a limited sample size, making it difficult to form a sufficiently reliable quantitative analysis basis and to achieve objective assessment entirely based on data models. On the other hand, cross-border data business involves multiple overlapping fields, is related to dynamically updated compliance regulations of various countries, includes complex technical transmission links, and is affected by differences in the operating procedures of different participants. These complex and dynamic variables cannot be fully covered by fixed standards and require experts to combine industry experience, understanding of regulations, and technical knowledge to make subjective judgments and supplements on potential risks.

[0003] However, expert subjective judgment is prone to limitations of experience and subjective bias, which can significantly impact the assessment results. It also makes it difficult to accurately identify new or hidden risks. Therefore, there is an urgent need for a data-driven cross-border risk assessment model that combines subjective and objective weighting. This model should fully leverage the experiential advantages of expert subjective judgment while avoiding the significant impact of subjective bias on risk assessment results, thereby enhancing the scientific rigor and objectivity of risk assessments. Summary of the Invention

[0004] This invention aims to address the shortcomings of existing methods for assessing cross-border data risks, which rely heavily on subjective evaluation and lack objective risk assessment. It proposes a method and system for assessing cross-border data risks based on a fusion of subjective and objective weighting. By constructing a combined subjective and objective weighting approach, this invention achieves a fusion of subjective and objective evaluation in cross-border data risk assessment, thereby improving the scientific rigor and objectivity of the assessment.

[0005] The technical solution adopted by the present invention to solve the above problems is: A data cross-border risk assessment method based on the integration of subjective and objective assessments includes the following steps: Acquire identified risk factors in the cross-border data sector; The identified risk factors are subjectively weighted to obtain the subjective weight and subjective risk assessment assigned to each risk factor by each expert. The subjective risk assessment of each risk element is evaluated, and the objective weight of each expert is determined. The risk weight of each risk element is determined based on its subjective weight and the objective weight of the corresponding expert. For target data in the field of cross-border data, assess the cross-border risk of the target data based on the risk elements in the target data and their corresponding risk weights.

[0006] Preferably, an objective evaluation method is used to assess the subjective weights of each risk factor, and the objective weights of each expert are determined based on the assessment results.

[0007] Preferably, the entropy weight method is used to assess the subjective weights of each risk factor, and the objective weights of each expert are determined based on the assessment results; the steps include: The subjective risk assessment of each risk element is standardized. The weight of each expert is calculated based on the standardized subjective risk assessments. Calculate the information entropy of each expert based on their respective weighting. The difference coefficient for each expert is calculated using the information entropy. The objective weight of each expert is determined based on the difference coefficient of each expert.

[0008] Preferably, the extreme value standardization method is used to standardize the risk factors.

[0009] Preferably, a subjective research method is used to subjectively assign weights to the identified risk factors, resulting in the subjective weights assigned to each risk factor by each expert.

[0010] Preferably, the subjective research method includes the expert review method or the Delphi method.

[0011] A cross-border risk assessment system based on the integration of subjective and objective risk assessment is characterized by including a risk element identification module, a subjective risk assessment module, an objective risk assessment module, a risk weight allocation module, and a risk assessment module. The risk factor identification module is used to acquire identified risk factors in the field of cross-border data. The subjective risk assessment module is used to subjectively assign weights to the identified risk elements, thereby obtaining the subjective weights and subjective risk assessments assigned to each risk element by each expert. The objective risk assessment module is used to evaluate the subjective risk assessment of each risk element and determine the objective weight of each expert based on the assessment results. The risk weight allocation module is used to determine the risk weight of each risk element based on its subjective weight and the objective weight of its corresponding expert. The risk assessment module is used to assess the cross-border risk of the target data based on the risk elements and their corresponding risk weights within the target data in the field of cross-border data.

[0012] A computing device, characterized in that it comprises: a processor and a memory storing a computer program, wherein the computer program, when run by the processor, executes the method described above.

[0013] A computer-readable storage medium, characterized in that it stores instructions that, when executed on a computer, cause the computer to perform the above-described method.

[0014] The beneficial effects of this invention are: This invention integrates subjective and objective weighting through expert review, the Delphi method, and the entropy weight method. This reduces the bias of single subjective judgments and optimizes expert weights and risk weights through objective calculations. Finally, it obtains accurate risk weight results through classification and sorting, effectively improving the scientificity and reliability of cross-border data risk assessment and providing accurate weighting basis for subsequent risk prevention and control. Attached Figure Description

[0015] Figure 1 This is a flowchart of the cross-border data risk assessment method of the present invention.

[0016] Figure 2 This is a risk factor system diagram for the present invention.

[0017] Figure 3 This is a flowchart of the risk weight determination method of the present invention. Detailed Implementation

[0018] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0019] like Figure 1 As shown, an optional embodiment of the present invention provides a data cross-border risk assessment method based on the integration of subjective and objective assessments, the steps of which include: Acquire identified risk factors in the cross-border data sector; The identified risk factors are subjectively weighted to obtain the subjective weight and subjective risk assessment assigned to each risk factor by each expert. The subjective risk assessment of each risk element is evaluated, and the objective weight of each expert is determined. The risk weight of each risk element is determined based on its subjective weight and the objective weight of the corresponding expert. For target data in the field of cross-border data, assess the cross-border risk of the target data based on the risk elements in the target data and their corresponding risk weights.

[0020] This invention, based on four modules—identification of cross-border data risk factors, subjective risk assessment, objective risk assessment, and risk weight allocation—aims to address the technical bottlenecks of existing cross-border data risk assessments that rely heavily on subjective evaluation. Considering that this research focuses on the quantitative modeling and analysis of risk factors, to avoid redundant risk factor identification work, this paper selects a list of risk factors proposed and validated in existing research in the field of cross-border data risk as the research object for risk quantification. In the subjective risk assessment stage, expert review, the Delphi method, and the DEMATEL method are used to conduct preliminary subjective weighting of risk factors, fully incorporating industry experience and professional knowledge. Then, based on the results of subjective weighting, combined with objective evaluation methods such as the entropy weight method, the expert evaluation results are quantitatively analyzed and calculated. According to the results, corresponding weights are assigned to each expert to correct subjective risk weights and reduce the bias of single subjective judgments. Finally, through the risk weight allocation module, the risk weights are classified and ranked based on the calculation results of the combined subjective and objective weighting. The entire process, through the deep integration of subjective and objective evaluations, not only makes up for the problem of excessive subjectivity in purely subjective evaluations, but also avoids the limitation of a single objective evaluation being unable to cover complex scenarios. Ultimately, it outputs scientific and accurate risk weight results, providing more reliable technical support for cross-border data risk assessment and effectively breaking through the technical bottlenecks of the existing assessment system.

[0021] Risk factor identification, as a fundamental step in this research, uses a list of risk factors proposed and validated in existing research in the field of cross-border data risk as its research object. On the one hand, this ensures the scientific validity and rationality of the sources of risk factors; on the other hand, it effectively avoids repeating the risk identification process, focusing the research emphasis on the risk quantification methods themselves. The risk factor system, such as... Figure 2 As shown.

[0022] The subjective risk assessment phase focuses on a complete list of identified cross-border data risk factors. Through a combination of expert review and the Delphi method, it systematically assigns initial subjective weights to these risk factors, fully integrating industry expertise and multi-dimensional understanding. A cross-disciplinary expert team is assembled, comprising members from data compliance and cross-border data operation companies, ensuring the team can assess risk factors from different dimensions, including regulatory interpretation, technical practice, and regulatory requirements. During the expert review phase, experts independently score the probability and impact of each risk factor based on their experience and the actual scenarios of cross-border data business, initially forming a preliminary subjective weighting for each factor. This initial subjective weighting of cross-border data risk factors provides a practically valuable initial weighting basis for the subsequent objective assessment phase.

[0023] The objective risk assessment stage is based on the weights of subjective risk elements. By introducing objective evaluation methods such as the entropy weight method, the risk weights are scientifically optimized. Specifically, the subjective risk weights obtained by expert review and the corresponding assessment results are first used as basic data and input into the objective evaluation model.

[0024] Algorithm 1: Entropy Weight Method Input: Expert subjective risk weighting index Output: Expert objective evaluation coefficient Step 1: Data Standardization. For the subjective risk assessment of each risk factor, the extreme value method is used to standardize the data.

[0025] Step 2: Calculate the indicator weighting matrix. Based on standardization, calculate the weight of each expert's subjective evaluation: .

[0026] Where m is the number of risk factors, n is the number of review experts, and the nth... The risk in the first The proportion of standardized values ​​under the subjective risk assessment of individual experts p ij This indicates the distribution of the indicator across different samples.

[0027] Step 3: Calculate the subjective risk assessment information entropy of risk factors. Based on information entropy theory, calculate the subjective risk assessment information entropy value for each expert j: .

[0028] in, No. The information entropy of a subjective risk assessment is used to measure the degree of uncertainty of that subjective risk assessment. Step 4: Calculate the difference coefficient. Calculate the difference coefficient for each expert j using information entropy: .

[0029] in, No. The entropy redundancy (or information utility value) of a subjective risk assessment reflects the amount of effective information contained in that subjective risk assessment.

[0030] Step 5: Determine the weights. Obtain the objective weights for each expert j: .

[0031] In the application of the entropy weight method, the information entropy value of each expert's evaluation result is calculated to quantify the dispersion and information validity of different expert scores. The lower the entropy value, the higher the discrimination and information value of the expert's evaluation result; conversely, the higher the entropy value, the stronger the convergence and the weaker the reference value. Based on the above objective calculation results, a corresponding weight coefficient is assigned to each expert: experts with low information entropy values ​​and high function fit are given higher weights, while those with lower entropy values ​​and lower function fit are given lower weights, thus differentiating the credibility of different expert evaluation results. Subsequently, the initial subjective risk weights of experts are corrected using this weight coefficient. For example, an expert's subjective weight is multiplied by the objective weight coefficient assigned to it, and then combined with the corrected weights of all experts for a weighted average. Finally, a risk element weight that takes into account both subjective experience and objective data support is obtained, effectively weakening the influence of a single expert's subjective preference and experience limitations on the results, making the risk weights more consistent with the actual risk characteristics of cross-border data business. The results are shown in Table 1.

[0032] Table 1. Weights of Cross-Border Risk Factors The risk weight allocation process is based on the final calculation result of the combination of subjective and objective weighting. Through classification, integration and priority ranking, the abstract weight data is transformed into a risk management reference with practical guidance.

[0033] For a target data to be crossed into the border, firstly, the risk elements in the target data are extracted, then matched with the risk elements obtained above to determine the weight of each risk element in the target data, and then the risk elements in the target data are weighted and summed or averaged to obtain the cross-border risk assessment result of the target data.

[0034] The method for determining the risk weights in the cross-border risk assessment process for this data is as follows: Figure 3 As shown, the process unfolds in four core stages. First, risk factor identification: based on literature retrieval, the system extracts existing risk factors from domestic and international journals, reports, and other materials, forming a standardized list to lay the foundation for subsequent stages. Second, subjective risk assessment: a cross-disciplinary expert team is assembled to independently score the probability of occurrence and the degree of impact of risk factors through expert review, initially forming subjective weights to provide an initial basis for objective evaluation. Next, objective risk assessment: based on the subjective weights, the entropy weight method is used to quantify the information validity of expert evaluations and judge the rationality of the assessment. Weight coefficients are then assigned to experts to adjust the subjective weights, resulting in risk weights that take into account both experience and data. Finally, risk weight allocation: based on the combined weighting results, risk factors are categorized, integrated, and ranked, transforming the weight data into a risk management reference, improving the scientific rigor and practical guidance of the assessment.

[0035] An optional embodiment of the present invention also provides a data cross-border risk assessment system based on the integration of subjective and objective risk assessment, characterized in that it includes a risk element identification module, a subjective risk assessment module, an objective risk assessment module, a risk weight allocation module, and a risk assessment module; The risk factor identification module is used to acquire identified risk factors in the field of cross-border data. The subjective risk assessment module is used to subjectively assign weights to the identified risk elements, thereby obtaining the subjective weights and subjective risk assessments assigned to each risk element by each expert. The objective risk assessment module is used to evaluate the subjective risk assessment of each risk element and determine the objective weight of each expert based on the assessment results. The risk weight allocation module is used to determine the risk weight of each risk element based on its subjective weight and the objective weight of its corresponding expert. The risk assessment module is used to assess the cross-border risk of the target data based on the risk elements and their corresponding risk weights within the target data in the field of cross-border data.

[0036] An optional embodiment of the present invention also provides a computing device, characterized in that it includes: a processor and a memory storing a computer program, wherein the computer program is executed by the processor to perform the above-described method.

[0037] An optional embodiment of the present invention also provides a computer-readable storage medium, characterized in that it stores instructions that, when executed on a computer, cause the computer to perform the above-described method.

[0038] Case Validation. Currently, there are relatively few domestic cases involving penalties for cross-border data issues. To address this deficiency in empirical research, this paper selects a recent penalty case against TikTok by the Irish Data Protection Commission (DPC) as the research subject, conducting a risk retrospective analysis to examine and demonstrate the value and significance of the proposed cross-border data risk assessment model in practical applications.

[0039] Based on the announcement issued by the Irish Data Protection Commission (DPC) and in conjunction with the risk factor system constructed in this paper, a mapping analysis is performed on the compliance issues described in the announcement and their corresponding risk factors to reveal the correlation between the issues stated in the announcement and the risk factors. The specific content is as follows, where the items in parentheses are the matching risk factor items: TikTok was found to have violated the General Data Protection Regulation (GDPR) (B10) (B3, B6, B9) by transferring EEA user data to China (D4, B5) and by failing to fulfill its data processing transparency obligations (D7, D8). It also stored a small amount of EEA user data (C1, C2) on servers in China (F2, F4, F5, F6, B8). Furthermore, TikTok failed to conduct necessary assessments (D6) and did not continue to provide the required high level of protection within the EU when personal data was transferred to other countries (B7, C1).

[0040] Based on the above risk factor matching results and combined with the data cross-border risk assessment model proposed in this paper, the results of this risk case analysis are shown in Table 2.

[0041] Table 2: Cross-border Risk Case Analysis Although specific embodiments of the invention have been disclosed for illustrative purposes to aid in understanding and implementing the invention, those skilled in the art will understand that various substitutions, variations, and modifications are possible without departing from the spirit and scope of the invention and the appended claims. Therefore, the invention should not be limited to the content disclosed in the preferred embodiments, and the scope of protection claimed by the invention is defined by the claims.

Claims

1. A data cross-border risk assessment method based on the integration of subjective and objective assessments, comprising the following steps: Acquire identified risk factors in the cross-border data sector; The identified risk factors are subjectively weighted to obtain the subjective weight and subjective risk assessment assigned to each risk factor by each expert. The subjective risk assessment of each risk element is evaluated, and the objective weight of each expert is determined. The risk weight of each risk element is determined based on its subjective weight and the objective weight of the corresponding expert. For target data in the field of cross-border data, assess the cross-border risk of the target data based on the risk elements in the target data and their corresponding risk weights.

2. The method according to claim 1, characterized in that, An objective evaluation method was used to assess the subjective weights of each risk factor, and the objective weights of each expert were determined based on the assessment results.

3. The method according to claim 2, characterized in that, The subjective weights of each risk factor are evaluated using the entropy weight method, and the objective weights of each expert are determined based on the evaluation results. The steps include: The subjective risk assessment of each risk element is standardized. The weight of each expert is calculated based on the standardized subjective risk assessments. Calculate the information entropy of each expert based on their respective weighting. The difference coefficient for each expert is calculated using the information entropy. The objective weight of each expert is determined based on the difference coefficient of each expert.

4. The method according to claim 3, characterized in that, The extreme value standardization method is used to standardize the risk factors.

5. The method according to claim 1, characterized in that, The identified risk factors were subjectively weighted using a subjective research method, resulting in the subjective weights assigned to each risk factor by the experts.

6. The method according to claim 5, characterized in that, The subjective research methods include expert review or the Delphi method.

7. A cross-border data risk assessment system based on the integration of subjective and objective assessments, characterized in that, It includes a risk factor identification module, a subjective risk assessment module, an objective risk assessment module, a risk weight allocation module, and a risk evaluation module; The risk factor identification module is used to acquire identified risk factors in the field of cross-border data. The subjective risk assessment module is used to subjectively assign weights to the identified risk elements, thereby obtaining the subjective weights and subjective risk assessments assigned to each risk element by each expert. The objective risk assessment module is used to evaluate the subjective risk assessment of each risk element and determine the objective weight of each expert based on the assessment results. The risk weight allocation module is used to determine the risk weight of each risk element based on its subjective weight and the objective weight of its corresponding expert. The risk assessment module is used to assess the cross-border risk of the target data based on the risk elements and their corresponding risk weights within the target data in the field of cross-border data.

8. A computing device, characterized in that, include: A processor, a memory storing a computer program, wherein the computer program, when executed by the processor, performs the method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, A storage instruction that, when executed on a computer, causes the computer to perform the method as described in any one of claims 1 to 6.

Images