Business system security assessment method, device, equipment, storage medium and program product

Abstract

The application discloses a kind of business system security evaluation method, device, equipment, storage medium and program product, obtain the first historical data of target node in business system, and obtain reference historical data;Wherein, the reference historical data is the historical data that has confirmed existence exception in business system;Based on the reference historical data, the first historical data is carried out cluster analysis, and the second historical data that existence exception and the third historical data without exception are obtained;The target project to which the target node of the third historical data corresponds is obtained, and the project parameter of the target project is obtained;Based on the project parameter, the security of the business system is evaluated.Using the embodiment of the application, the data omission and clustering insufficient problem in the existing security evaluation mode can be effectively avoided, and the accuracy of business system security evaluation is improved.

Description

Technical Field

[0001] This invention relates to the field of network security, and in particular to a method, apparatus, device, storage medium, and program product for security assessment of business systems. Background Technology

[0002] With the widespread adoption of digitalization and cloud computing technologies, business systems are now extensively used in supply chain management, manufacturing, e-commerce, and logistics warehousing. The confidentiality of these systems directly impacts corporate interests and user data security. To prevent data leaks, tampering, and unauthorized access, various industries generally need to conduct regular security assessments of their business systems to promptly identify and remediate security vulnerabilities. Current information security assessments often employ knowledge graphs combined with graph algorithms. By analyzing system data, leaked or tampered records are located, attackers are identified, and assessment reports are generated. However, when processing massive amounts of business data, this approach suffers from drawbacks due to the large scale, multiple dimensions, and complex relationships. The knowledge graph construction process is prone to issues such as the loss of key features, missing partial data, and incomplete link information. Furthermore, the clustering process struggles to fully integrate multi-source heterogeneous data, failing to achieve full-dimensional, full-link data matching and utilization. Consequently, it cannot cover the entire business data chain, resulting in low accuracy of the assessment results. Summary of the Invention

[0003] The purpose of this invention is to provide a method, apparatus, device, storage medium, and program product for security assessment of business systems, which can effectively avoid the problems of data omission and insufficient clustering in existing security assessment methods and improve the accuracy of security assessment of business systems.

[0004] To achieve the above objectives, embodiments of the present invention provide a business system security assessment method, comprising: Obtain the first historical data of the target node in the business system, and obtain reference historical data; wherein, the reference historical data is historical data in the business system that has been confirmed to contain anomalies; Based on the reference historical data, cluster analysis is performed on the first historical data to obtain second historical data with anomalies and third historical data without anomalies. Obtain the target project to which the target node corresponding to the third historical data belongs, and obtain the project parameters of the target project; A security assessment of the business system is conducted based on the project parameters.

[0005] As an improvement to the above scheme, the step of performing cluster analysis on the first historical data based on the reference historical data to obtain second historical data with anomalies and third historical data without anomalies includes: Using the reference historical data as the first cluster center, calculate the similarity between each piece of first historical data and the first cluster center; Obtain the minimum similarity among the similarities, and use the first historical data corresponding to the minimum similarity as the second cluster center; Calculate the relative distance from each first historical data point to the first cluster center and the second cluster center, respectively; The first historical data is divided according to the relative distance to obtain second historical data with anomalies and third historical data without anomalies.

[0006] As an improvement to the above scheme, the relative distance includes a first distance between the first historical data and the first cluster center and a second distance between the first historical data and the second cluster center; the step of dividing the first historical data according to the relative distance to obtain second historical data with anomalies and third historical data without anomalies includes: If the first distance of the first historical data is less than or equal to the second distance, then the first historical data is classified as second historical data with anomalies. If the first distance of the first historical data is greater than the second distance, then the first historical data is classified as the third historical data without anomalies.

[0007] As an improvement to the above solution, the project parameters include data access records and data modification records corresponding to the target project.

[0008] As an improvement to the above solution, the security assessment of the business system based on the project parameters includes: Based on the project parameters, key projects are obtained from the reference projects; Construct a business topology diagram based on the fourth historical data corresponding to the key projects; The business topology map is analyzed using a neural network model to predict the timing of the next attack and generate security assessment information.

[0009] As an improvement to the above solution, the step of using a neural network model to analyze the business topology map to predict the time of the next attack includes: Based on the structural characteristics and node connection strength of the business topology graph, the neural network model is used to predict risk propagation patterns and speeds. Based on the risk propagation pattern and the risk propagation speed, identify the target attacker and determine the key time point when the target attacker launches the next attack.

[0010] To achieve the above objectives, embodiments of the present invention also provide a business system security assessment apparatus, comprising: The historical data acquisition module is used to acquire the first historical data of the target node in the business system, and to acquire reference historical data; wherein, the reference historical data is historical data in the business system that has been confirmed to contain anomalies; The clustering module is used to perform clustering analysis on the first historical data based on the reference historical data to obtain second historical data with anomalies and third historical data without anomalies. The project parameter acquisition module is used to acquire the target project to which the target node corresponding to the third historical data belongs, and to acquire the project parameters of the target project; The security assessment module is used to perform a security assessment on the business system based on the project parameters.

[0011] To achieve the above objectives, embodiments of the present invention also provide a business system security assessment device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the business system security assessment method as described in any of the above embodiments.

[0012] To achieve the above objectives, embodiments of the present invention also provide a computer-readable storage medium, the computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to execute the business system security assessment method as described in any of the above embodiments.

[0013] To achieve the above objectives, embodiments of the present invention also provide a computer program product, including computer instructions, which, when executed by a processor, implement the business system security assessment method as described in any of the above embodiments.

[0014] Compared to existing technologies, the business system security assessment method, apparatus, equipment, storage medium, and program products disclosed in this invention, by performing cluster analysis on the first historical data of the target node based on confirmed anomaly reference historical data, can accurately distinguish between data with and without anomalies, effectively avoiding data omissions and insufficient clustering in massive data processing, and ensuring the accuracy of data segmentation; relying on the third historical data without anomalies to locate the target project and obtain project parameters, it can ensure the authenticity and reliability of the target project location, avoid misleading project location due to anomaly data, and conduct security assessments based on project parameters, which can specifically uncover security vulnerabilities in the business system, improve the accuracy and comprehensiveness of security assessments, reduce the risk of business system data leakage and tampering, reduce security management costs, and provide reliable protection for the safe and stable operation of the business system. Attached Figure Description

[0015] Figure 1This is a flowchart of a business system security assessment method provided by an embodiment of the present invention; Figure 2 This is a flowchart of cluster analysis of the first historical data provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of the clustering effect provided in an embodiment of the present invention; Figure 4 This is a flowchart of generating security assessment information provided in an embodiment of the present invention; Figure 5 This is another flowchart of a business system security assessment method provided in an embodiment of the present invention; Figure 6 This is a structural block diagram of a business system security assessment device provided in an embodiment of the present invention; Figure 7 This is a structural block diagram of a business system security assessment device provided in an embodiment of the present invention. Detailed Implementation

[0016] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0017] See Figure 1 , Figure 1 This is a flowchart of a business system security assessment method provided by an embodiment of the present invention, which includes steps S1 to S4.

[0018] S1. Obtain the first historical data of the target node in the business system, and obtain reference historical data; wherein, the reference historical data is historical data in the business system that has been confirmed to have anomalies.

[0019] For example, a business system refers to a computer application system with data storage, business processing, and node management functions, used to achieve unified management, flow, and interaction of various types of business data. For instance, a business system could be a supply chain management system, order management system, project management system, logistics management system, or financial management system. A target node refers to an independent execution unit, device terminal, business module, organizational entity, or project unit within the business system that participates in data interaction, business execution, or information flow, used to bear the generation, transmission, processing, and storage of specific business data. First historical data refers to historical business data generated by the target node during its historical operation, including but not limited to contract information, order information, amount data, time data, quantity data, and project numbers corresponding to the target node, which can be obtained from the database corresponding to the business system according to a preset time range or data selection rules. Reference historical data refers to historical data from the target node's historical data that has been pre-determined and confirmed to be abnormal or tampered with, used as benchmark data for data partitioning and cluster analysis. Abnormality refers to the target node's historical data being illegally tampered with, forged, deleted, operated without authorization, illegally accessed, or inconsistent with real business data, including but not limited to the state where key data such as contract amount, order quantity, project number, and time information have been illegally modified.

[0020] S2. Based on the reference historical data, perform cluster analysis on the first historical data to obtain second historical data with anomalies and third historical data without anomalies.

[0021] For example, since the reference historical data is historical data in the business system that has been confirmed to be abnormal or tampered with, it can accurately characterize the feature distribution of abnormal data. Therefore, it can be used as a clustering benchmark to perform supervised clustering analysis on the first historical data, thereby improving the accuracy of distinguishing between abnormal and normal data and avoiding the clustering bias and inaccurate classification problems that are prone to occur in traditional unsupervised clustering. Before performing clustering analysis, it is also necessary to preprocess the first historical data and the reference historical data to improve the accuracy of subsequent clustering analysis. For example, feature extraction can be performed on the first historical data and the reference historical data to obtain corresponding feature information. The feature information can be a hash value obtained by encryption using a hash algorithm, or a check value obtained by other encryption algorithms. Each feature information is used as a component in a vector to complete the vectorization preprocessing of the first historical data and the reference historical data, obtaining the vector components corresponding to the first historical data and the reference historical data respectively, which facilitates the subsequent similarity and distance calculations in multi-dimensional space.

[0022] Further, see Figure 2 , Figure 2 This is a flowchart of cluster analysis of the first historical data provided in an embodiment of the present invention. In this case, step S2 specifically includes steps S21 to S24.

[0023] S21. Using the reference historical data as the first cluster center, calculate the similarity between each piece of first historical data and the first cluster center.

[0024] For example, the first cluster center refers to a cluster center composed of confirmed abnormal or tampered reference historical data, used to characterize abnormal data. Since the reference historical data is known abnormal data, directly using it as the first cluster center allows the clustering process to be based on real abnormal characteristics, avoiding classification errors caused by random initialization of cluster centers and improving the reliability of abnormal data identification.

[0025] Furthermore, based on the vector components of the vectorized reference historical data and the first historical data, combined with the correlation factor and vector magnitude, the similarity between each first historical data point and the first cluster center is calculated to characterize the degree of correlation between the first historical data and the outlier reference data. The calculation process satisfies the following formula: (1); in, Indicates the first The similarity (correlation) between the first historical data and the first cluster center is measured in the range of [0,1]. The larger the value, the higher the correlation with the outlier data. The correlation factor is used to characterize the degree of difference between the first historical data and the reference historical data in the vector magnitude dimension, and is calculated from the absolute difference of their magnitudes. This represents the total number of first historical data points contained in the first historical data set; Represents the first in the vectorized reference historical data One component; This represents the first historical data after vectorization. One component; This represents the average vector magnitude of all first historical data in the vectorized first historical data set. The vector magnitude represents the vectorized reference historical data.

[0026] S22. Obtain the minimum similarity among the similarities, and use the first historical data corresponding to the minimum similarity as the second cluster center.

[0027] For example, the first historical data with the lowest similarity to the first cluster center represents the largest difference between it and the known abnormal data, and is likely to be normal data that has not been tampered with. Therefore, determining this data as the second cluster center can enable the second cluster center to accurately represent the distribution characteristics of normal data, thereby constructing dual cluster centers corresponding to abnormal data and normal data respectively, providing a basis for subsequent accurate classification of data categories.

[0028] S23. Calculate the relative distance from each first historical data point to the first cluster center and the second cluster center, respectively.

[0029] For example, the relative distance includes a first distance between the first historical data and the first cluster center, and a second distance between the first historical data and the second cluster center. Before calculating the distance, the first historical data, the first cluster center, and the second cluster center need to be mapped to a multidimensional space of the same dimension to ensure the consistency and comparability of the distance calculation. For low-dimensional data with insufficient dimensions, dimensionality can be increased by padding with zeros, for example, using zeros as missing components in the low-dimensional first historical data to complete dimensional alignment. This is only an illustrative example and does not constitute a limitation on the embodiments of the present invention. After mapping the data to the same multidimensional space, an adaptive distance parameter is introduced based on the similarity between the first historical data and the first cluster center to perform a weighted correction on the traditional Euclidean distance, so as to more accurately represent the degree of correlation between the data. The higher the similarity between the first historical data and the first cluster center, the smaller their distance in the multidimensional space, the stronger the correlation, and the more likely they belong to the same cluster; conversely, the lower the similarity, the larger the distance, and the weaker the correlation. In this embodiment of the invention, the first historical data, the first cluster center, and the second cluster center are uniformly mapped to a multidimensional space of the same dimension to ensure that the distance calculation of each data is performed under the same feature dimension.

[0030] For example, based on the similarity between the first historical data and the first cluster center Calculate adaptive distance parameters The formula is: (2); in, This is a custom parameter used to control how quickly the distance parameter changes with similarity. When the value is larger, the distance parameter The smaller the value, the closer the data with high similarity will be to the cluster center in the distance calculation.

[0031] Based on distance parameters Calculate the relative distance (i.e., first distance / second distance) from each historical data point to the first or second cluster center, using the following formula: (3); in, This represents the first distance from the first historical data point to the first cluster center, or the second distance to the second cluster center. This represents the total number of vector components in the vectorized data. The vectorized cluster centers (first cluster center or second cluster center) are the first and second cluster centers. Each component.

[0032] S24. Divide the first historical data according to the relative distance to obtain second historical data with anomalies and third historical data without anomalies.

[0033] Further, step S24 specifically includes: if the first distance of the first historical data is less than or equal to the second distance, then the first historical data is classified as second historical data with anomalies; if the first distance of the first historical data is greater than the second distance, then the first historical data is classified as third historical data without anomalies.

[0034] For example, the first distance characterizes the correlation between the first historical data and the first cluster center (reference historical data confirmed as anomaly), and the second distance characterizes the correlation between the first historical data and the second cluster center (normal candidate data with the greatest difference from the anomaly data). When the first distance of the first historical data is less than or equal to the second distance, it indicates that the data is closer to the first cluster center based on the anomaly reference data, and has a stronger correlation with the anomaly data. Therefore, it is classified into the second historical data set containing anomalies, which corresponds to the first cluster center. When the first distance of the first historical data is greater than the second distance, it indicates that the data is closer to the second cluster center based on the normal candidate data, and has a stronger correlation with the normal data. Therefore, it is classified into the third historical data set without anomalies, which corresponds to the second cluster center. See also Figure 3 , Figure 3 This is a schematic diagram of the clustering effect provided by an embodiment of the present invention. The data is divided into two clusters based on the first distance from the first historical data to the first cluster center and the second distance to the second cluster center. After clustering, the originally mixed distribution of normal data and abnormal data is clearly separated, forming two clusters with clear boundaries. This provides an accurate and reliable data foundation for locating target projects and conducting security assessments based on the third historical data without anomalies.

[0035] In this embodiment of the invention, confirmed anomaly reference historical data is used as the first cluster center, and the second cluster center is determined by combining the first historical data with the minimum similarity. This dual-cluster-center approach accurately captures the differences between abnormal and normal data. Furthermore, by calculating the relative distances of each first historical data point to the two cluster centers for data partitioning, the problems of data omission and insufficient clustering leading to inaccurate partitioning in traditional clustering methods are effectively solved. This approach accurately separates the second historical data containing anomalies from the third historical data without anomalies, providing a precise and reliable data foundation for subsequent target project location and business system security assessment based on non-anomaly data. This further improves the accuracy and reliability of the entire security assessment process and reduces the risk of security assessment errors due to data partitioning bias.

[0036] S3. Obtain the target project to which the target node corresponding to the third historical data belongs, and obtain the project parameters of the target project.

[0037] For example, a target project refers to an independent business unit or project entity in a business system that carries out business interactions, data flow, or resource ownership of a target node. It typically corresponds to a specific project number, business module, or organizational unit under a contract in a supply chain management system. As the endpoint of business interaction, the data ownership of the target node is necessarily associated with a unique target project. By locating this target project, the business scope corresponding to abnormal or normal data can be clearly identified, thus identifying the analysis object for subsequent security assessments. Since the third historical data is confirmed to be anomaly-free through cluster analysis, its data fields (such as project numbers) have not been illegally tampered with, truly reflecting the business ownership of the target node. Therefore, the project identification information corresponding to the target node, such as the project number, can be directly extracted from the third historical data to determine the target project. Compared to directly using abnormal data (second historical data), using anomaly-free third historical data for project location avoids project identification errors caused by abnormal data tampering, ensuring the accuracy and uniqueness of target project location.

[0038] Furthermore, the project parameters include data access records and data modification records corresponding to the target project. Data access records refer to the information recorded by participating nodes (including the target node) during the business operation of the target project, showing their queries, reads, calls, or interactions with project-related data (such as contract amounts, order details, inventory information, etc.). Specifically, this may include access timestamps, access node identifiers, access data types, and access permission levels. Data modification records refer to the information recorded by the target project during its business lifecycle, showing the addition, deletion, editing, or update operations performed on project-related data. Specifically, this may include the operator performing the modification, modification time, data value before modification, data value after modification, and modification reason identifier.

[0039] S4. Conduct a security assessment of the business system based on the project parameters.

[0040] For example, data access records can reflect the interaction frequency and scope of each node in the target project, and can be used to identify abnormal access patterns, such as unauthorized access during peak hours or high-frequency unauthorized access. This is a crucial basis for assessing the security status of data flow within the project. Data modification records can trace the changes to project data, and can be used to locate unauthorized modifications and identify the source and path of data tampering. This is a vital basis for investigating security risks and conducting security tracing. By acquiring and analyzing these two types of parameters, a comprehensive and in-depth understanding of the target project's security operation status can be achieved, providing detailed and reliable data support for subsequent security assessments based on project parameters, effectively ensuring the comprehensiveness of business system security assessments.

[0041] Further, see Figure 4 , Figure 4 This is a flowchart of generating security assessment information provided in an embodiment of the present invention, where step S4 includes steps S41 to S43. See also... Figure 5 , Figure 5 This is another flowchart of a business system security assessment method provided in an embodiment of the present invention, combined with... Figure 5 Steps S41 to S43 are explained in detail.

[0042] S41. Obtain key projects from the reference projects based on the project parameters.

[0043] For example, the reference project refers to a collection of various projects that are associated with the target project and carry out supply chain business interactions. The key project refers to the reference project that has the greatest impact on the information security of the target node. For example, when an information security incident occurs in this project, it will have the most significant impact on the data information security of the entire business system.

[0044] When acquiring key projects, social network analysis can be used, and then combined with the project parameters, correlation analysis can be performed on reference projects. For example, social network analysis can reveal the interrelationships and influence of various reference projects when different security incidents occur. A security incident refers to any abnormal event that occurs during the operation of a business system that may threaten the data security of target nodes, disrupt normal business operations, or affect the integrity and confidentiality of project information. Examples include data leakage and data tampering, as well as unauthorized access (unauthorized nodes illegally accessing key project data or target node data), unauthorized operations (unauthorized addition, editing, or deletion of business data), and abnormal node interactions (abnormal data flow between the target attacker's node and other nodes), among other events affecting the information security of the business system.

[0045] Furthermore, the centrality of computational nodes can be used to quantify the impact of each reference item on the information security of the target node, thereby identifying the most influential reference item and designating it as a critical item. For example, the number of associations or data interactions between each reference item (node) and other reference items (nodes) during different security events can be counted. The more associations or interactions, the stronger the impact of the reference item on the target node during the corresponding security event. Alternatively, the number of times each reference item (node) acts as an intermediate node connecting other reference items during different security events can be calculated. The more times this happens, the stronger the bridging role of the reference item in the propagation of security events and data flow, and the greater its impact on the information security of the target node. Or, the shortest path length between each reference item (node) and other reference item nodes can be calculated. The shorter the path, the more direct and powerful the impact of the reference item on the target node's data during a security event.

[0046] S42. Construct a business topology diagram based on the fourth historical data corresponding to the key projects.

[0047] For example, the fourth historical data refers to all relevant data generated during the historical operation of the key project, including security event information, node interaction data, data access records, and data modification records corresponding to the key project. This data comprehensively reflects the business flow, node relationships, and security event status of the key project. The specific process of constructing the business topology diagram is based on graph theory principles. Using the security event information and node interaction relationships in the fourth historical data as the core, each node involved in the key project is used as the vertices of the topology diagram. The business interaction relationships, data flow relationships, and security event propagation relationships between nodes are used as the edges of the topology diagram. Simultaneously, combining the interaction frequency and / or data transmission volume between nodes, the node connection strength corresponding to each edge is marked (proportional to the interaction frequency and data transmission volume), ultimately constructing a complete business topology diagram. This business topology diagram can intuitively present the hierarchical relationships, degree of association, and security event propagation paths of each node in the key project, clearly reflecting the structural characteristics of the business system. It provides intuitive and systematic visualization support for subsequent risk analysis and attack prediction using neural network models, facilitating accurate identification of risk propagation patterns.

[0048] S43. Analyze the business topology using a neural network model to predict the next attack time and generate security assessment information.

[0049] For example, the neural network model refers to an artificial intelligence model based on a deep learning architecture, used to process temporal and graph structure features. Examples include Gated Recurrent Unit (GRU), Long Short-Term Memory (LSTM), Deep Belief Network (DBN), or Recursive Neural Network (RNN), which is particularly suitable for learning and predicting the temporal information and risk propagation patterns of security events. The target attacker refers to an entity (node) within the business system that poses an information security threat to key projects and target nodes. Specifically, it refers to the node with the highest risk level or a risk level exceeding a preset threshold, identified as the most threatening attacker after node dependency rating. Its actions may lead to security events such as data leakage and data tampering. The next attack time refers to the critical time node at which the target attacker launches the next security attack against the business system. Accurate prediction of this time node can provide early warning for security risk management, facilitating timely preventative measures.

[0050] Furthermore, step S43 specifically includes: using the neural network model to predict the risk propagation pattern and risk propagation speed based on the structural characteristics and node connection strength of the business topology graph; and identifying the target attacker and determining the key time point for the target attacker to launch the next attack based on the risk propagation pattern and the risk propagation speed.

[0051] For example, by inputting a business topology diagram into a trained neural network model, the model will comprehensively analyze and accurately predict the propagation pattern and speed of risks within the business system, combining the structural type of the topology diagram and the connection strength between nodes. The structural type can include node hierarchy and connection methods. Hierarchical relationships refer to the priority and subordinate relationships of nodes within the business system, such as key nodes and subordinate nodes, management nodes and execution nodes, etc. Connection methods refer to the interaction types between nodes, such as data access connections, data modification connections, business flow connections, etc. Connection strength refers to the strong, medium, and weak connection strength, quantified by interaction frequency and / or data transmission volume. Risk propagation patterns refer to the specific paths and methods by which security events (such as data breaches and data tampering) propagate from one node to other nodes, such as direct and rapid propagation between strongly connected nodes, indirect and slow propagation between weakly connected nodes, or hierarchical propagation from key nodes to subordinate nodes, or radial propagation from abnormal nodes to related nodes, etc. Risk propagation speed refers to how quickly a risk spreads. Specifically, it is quantified as the number of times a risk spreads from one node to adjacent nodes per unit of time. The stronger the connection and the higher the node level, the faster the risk propagation speed, and vice versa.

[0052] Based on the predicted risk propagation patterns and speeds, and combined with the hierarchical relationships of nodes in the business topology diagram, the risk level of each node in the business topology diagram is further identified. Risk level assessment needs to be determined by considering both the risk propagation pattern and speed. For example, nodes located on critical paths of risk propagation, with high connection strength and high hierarchical levels, are more likely to be affected by risks, have a wider impact, and therefore a higher risk level; conversely, nodes located on the edge of risk propagation, with weak connection strength and low hierarchical levels, have a lower risk level. After the assessment, nodes with the highest risk level or risk levels exceeding a preset threshold are included in the set of potential attackers.

[0053] This analysis examines the dependencies between nodes corresponding to potential attackers in the set of potential attackers. These dependencies refer to business and data dependencies between these nodes. For example, does an attack by one node require the permissions of another (e.g., unauthorized access dependency)? Does data tampering by one node require the modification permissions of another (e.g., data modification dependency)? Does the propagation of risk by one node require another node as an intermediary (e.g., propagation path dependency)? Stronger dependencies indicate a more prominent dominant role and higher threat level for that node in the attack and risk propagation. Based on the strength of these dependencies, each node in the set of potential attackers is rated. Nodes that dominate the attack and have no other dependencies are rated highest and designated as key attack nodes; nodes that depend on other nodes to launch attacks and propagate risks are rated lower and designated as auxiliary attack nodes. Ultimately, the node with the highest rating is identified as the target attacker.

[0054] By combining the time information of security incidents, including the occurrence time, duration, and interval of historical security incidents, as well as the time patterns and time nodes of the target attacker's historical attacks, a trained neural network model can accurately predict the key time nodes when the target attacker launches the next attack. The model first mines the potential patterns in the time information of historical security incidents. For example, the target attacker's historical attacks often occur during peak business data interaction periods (such as 9-10 am every day, or the project settlement period at the end of each month) and attack intervals (such as launching an attack every 7 days or every 15 days). Combining the risk propagation speed, risk propagation pattern, and the target attacker's corresponding access records (access time, access frequency, access duration), a time series prediction algorithm is used to calculate the specific time node when the target attacker is most likely to launch the next attack. For example, it is predicted that the target attacker will launch an attack on a key project node between 9:30 am and 10:00 am within the next 3 days. Simultaneously, all access records corresponding to the target attacker are obtained, including access time, access node, access data type, access permissions, access operations, etc. These access records are then integrated with the predicted key time nodes, target attacker information, risk level, risk propagation mode, etc., according to a preset template to finally generate complete and standardized security assessment information, providing accurate and detailed basis for subsequent information security risk management operations.

[0055] Furthermore, during the training of the neural network model, historical security event information corresponding to historical projects is collected, covering original records of various security events such as data breaches, data tampering, and unauthorized access. Structured feature extraction is performed on these events, extracting quantifiable features such as timestamps, event types, involved nodes, interaction frequency, permission levels, and risk impact. Each type of security event is transformed into a multi-dimensional feature vector, and these are aggregated to form a security event feature information set. Next, the correlation between the security event features in this set is calculated. For example, the Pearson correlation coefficient is used to measure the linear correlation between different features, filtering out features strongly correlated with attack behavior, risk propagation, and attack time prediction, while eliminating weakly correlated redundant features to reduce model computational complexity. Subsequently, corresponding weights are assigned according to the importance of each feature, and the filtered features are linearly combined to form more representative composite features, which are then aggregated to obtain the target security event feature information set. The target security event feature information set is mapped to a multi-dimensional vector space to construct a target feature space. The features in each dimension of the space are normalized to eliminate the dimensional differences between different features, ensuring that the model can fairly learn the role of each feature. Finally, the constructed target feature space is divided into training and test sets. The training set is input into the neural network model for training. The prediction results are output through forward propagation. The error between the prediction results and the actual results is calculated. The model parameters are adjusted using the backpropagation algorithm. The training is repeated until the model converges. The stability of the model is then verified through the test set. Finally, a trained model that can accurately uncover the hidden complex patterns and rules of security events is obtained, providing support for subsequent risk propagation prediction, target attacker identification, and attack time prediction.

[0056] In this embodiment of the invention, key projects are first precisely selected from project parameters to focus on key risk points, avoiding an overly broad assessment scope and a lack of focus. Then, a business topology diagram is constructed based on the fourth historical data of the key projects, clearly presenting the business relationship logic and providing intuitive and systematic data support for subsequent analysis. Finally, a neural network model is used to perform in-depth analysis of the topology diagram to accurately predict the next attack time of the target attacker and generate comprehensive security assessment information. This not only improves the accuracy of attack time prediction but also effectively avoids security risks to the business system and ensures the stable operation of the business system.

[0057] Furthermore, after obtaining the security assessment information by performing step S4, the method further includes: performing information security risk management operations on the business system based on the security assessment information.

[0058] For example, the information security risk management operation refers to the related operations of risk warning, risk handling, access control, and security strategy optimization for business systems based on security assessment information. This is used to promptly block security threats, eliminate security risks, and ensure the secure and stable operation of data and nodes within the business system. For instance, the security assessment information can be publicized, and relevant professionals can be invited to further analyze and verify the information to generate corresponding risk management information. This risk management information is then distributed to the relevant departments responsible for the business system, who can then implement corresponding risk handling measures based on the risk management information to complete the information security risk management operation for the supply chain. The risk management operation includes, but is not limited to: revoking the target attacker's access rights to target node data; prohibiting the target attacker from logging into and accessing data in the business system; adding the target attacker to the business system's blacklist; restricting the data interaction permissions of abnormal nodes; encrypting and protecting data for key projects and target nodes; monitoring abnormal operational behaviors in real time; and updating the security protection strategies of the business system.

[0059] In this embodiment of the invention, the above-described risk management operations can promptly block identified attack behaviors, prevent target attackers from launching the next attack, effectively reduce the probability of security incidents such as data leakage, data tampering, and unauthorized operations, improve the accuracy and timeliness of supply chain information security management, and provide a solid security guarantee for the stable operation of business systems and supply chains.

[0060] Compared to existing technologies, the business system security assessment method disclosed in this invention performs cluster analysis on the first historical data of the target node based on confirmed anomaly reference historical data. This accurately distinguishes between data with and without anomalies, effectively avoiding data omissions and insufficient clustering in massive data processing and ensuring the accuracy of data segmentation. By relying on the third historical data without anomalies to locate the target project and obtain project parameters, the authenticity and reliability of the target project location can be ensured, avoiding misleading project location due to anomaly data. At the same time, security assessment based on project parameters can specifically uncover security vulnerabilities in the business system, improve the accuracy and comprehensiveness of security assessment, reduce the risk of data leakage and tampering in the business system, reduce security management costs, and provide reliable protection for the safe and stable operation of the business system.

[0061] See Figure 6 , Figure 6 This is a structural block diagram of a business system security assessment device 100 provided in an embodiment of the present invention. The business system security assessment device 100 includes: The historical data acquisition module 11 is used to acquire the first historical data of the target node in the business system, and to acquire reference historical data; wherein, the reference historical data is historical data in the business system that has been confirmed to have anomalies. Clustering module 12 is used to perform clustering analysis on the first historical data based on the reference historical data to obtain second historical data with anomalies and third historical data without anomalies; The project parameter acquisition module 13 is used to acquire the target project to which the target node corresponding to the third historical data belongs, and to acquire the project parameters of the target project; The security assessment module 14 is used to perform a security assessment on the business system based on the project parameters.

[0062] It is worth noting that the working process of each module in the business system security assessment device 100 described in the embodiments of the present invention can refer to the working process of the business system security assessment method described in the above embodiments, and will not be repeated here.

[0063] See Figure 7 , Figure 7 This is a structural block diagram of a business system security assessment device 200 provided in an embodiment of the present invention. The business system security assessment device 200 includes a processor 21, a memory 22, and a computer program stored in the memory 22 and executable on the processor 21. When the processor 21 executes the computer program, it implements the steps in the above-described embodiments of the various business system security assessment methods.

[0064] For example, the computer program may be divided into one or more modules / units, which are stored in the memory 22 and executed by the processor 21 to complete the present invention. The one or more modules / units may be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of the computer program in the business system security assessment device 200.

[0065] The business system security assessment device 200 may include, but is not limited to, a processor 21 and a memory 22. Those skilled in the art will understand that the schematic diagram is merely an example of the business system security assessment device 200 and does not constitute a limitation on the device. It may include more or fewer components than illustrated, or combine certain components, or use different components. For example, the business system security assessment device 200 may also include input / output devices, network access devices, buses, etc.

[0066] The processor 21 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor. The processor 21 is the control center of the business system security assessment device 200, connecting various parts of the device via various interfaces and lines.

[0067] The memory 22 can be used to store the computer programs and / or modules. The processor 21 implements various functions of the business system security assessment device 200 by running or executing the computer programs and / or modules stored in the memory 22 and calling the data stored in the memory 22. The memory 22 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, phonebook, etc.). In addition, the memory 22 may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0068] If the modules / units integrated in the business system security assessment device 200 are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by the processor 21, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.

[0069] Furthermore, the present invention also provides a computer program product, including a computer program / instructions, which, when executed by a processor, implement the business system security assessment method as described in any of the above embodiments.

[0070] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A method for security assessment of a business system, characterized in that, include: Obtain the first historical data of the target node in the business system, and obtain reference historical data; wherein, the reference historical data is historical data in the business system that has been confirmed to contain anomalies; Based on the reference historical data, cluster analysis is performed on the first historical data to obtain second historical data with anomalies and third historical data without anomalies. Obtain the target project to which the target node corresponding to the third historical data belongs, and obtain the project parameters of the target project; A security assessment of the business system is conducted based on the project parameters.

2. The business system security assessment method as described in claim 1, characterized in that, The step of performing cluster analysis on the first historical data based on the reference historical data to obtain second historical data with anomalies and third historical data without anomalies includes: Using the reference historical data as the first cluster center, calculate the similarity between each piece of first historical data and the first cluster center; Obtain the minimum similarity among the similarities, and use the first historical data corresponding to the minimum similarity as the second cluster center; Calculate the relative distance from each first historical data point to the first cluster center and the second cluster center, respectively; The first historical data is divided according to the relative distance to obtain second historical data with anomalies and third historical data without anomalies.

3. The business system security assessment method as described in claim 2, characterized in that, The relative distance includes a first distance between the first historical data and the first cluster center, and a second distance between the first historical data and the second cluster center; the step of dividing the first historical data according to the relative distance to obtain second historical data with anomalies and third historical data without anomalies includes: If the first distance of the first historical data is less than or equal to the second distance, then the first historical data is classified as second historical data with anomalies. If the first distance of the first historical data is greater than the second distance, then the first historical data is classified as the third historical data without anomalies.

4. The business system security assessment method as described in claim 1, characterized in that, The project parameters include the data access records and data modification records corresponding to the target project.

5. The business system security assessment method as described in claim 1 or 4, characterized in that, The security assessment of the business system based on the project parameters includes: Based on the project parameters, key projects are obtained from the reference projects; Construct a business topology diagram based on the fourth historical data corresponding to the key projects; The business topology map is analyzed using a neural network model to predict the timing of the next attack and generate security assessment information.

6. The business system security assessment method as described in claim 5, characterized in that, The step of using a neural network model to analyze the business topology map to predict the timing of the next attack includes: Based on the structural characteristics and node connection strength of the business topology graph, the neural network model is used to predict risk propagation patterns and speeds. Based on the risk propagation pattern and the risk propagation speed, identify the target attacker and determine the key time point when the target attacker launches the next attack.

7. A business system security assessment device, characterized in that, include: The historical data acquisition module is used to acquire the first historical data of the target node in the business system, and to acquire reference historical data; wherein, the reference historical data is historical data in the business system that has been confirmed to contain anomalies; The clustering module is used to perform clustering analysis on the first historical data based on the reference historical data to obtain second historical data with anomalies and third historical data without anomalies. The project parameter acquisition module is used to acquire the target project to which the target node corresponding to the third historical data belongs, and to acquire the project parameters of the target project; The security assessment module is used to perform a security assessment on the business system based on the project parameters.

8. A business system security assessment device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor executes the computer program to implement the business system security assessment method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the business system security assessment method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, It includes computer instructions that, when executed by a processor, implement the business system security assessment method as described in any one of claims 1 to 6.

Images