A method for risk assessment and management of enterprise data assets

Abstract

This invention discloses a method for risk assessment and management of enterprise data assets, relating to the field of data security technology. The method includes: collecting configuration information and real-time status information of the enterprise data asset environment, constructing a digital twin synchronized with the real environment; training an adversarial generative network model to generate simulated attack behavior sequences, and injecting these sequences into the digital twin for automated simulation; recording changes in the confidentiality, integrity, and availability indicators of data assets, as well as recovery times, during the simulation, and calculating a quantitative resilience score accordingly; identifying defense weaknesses, attack paths, and affected assets based on simulated attack behaviors that lead to a decline in key indicators, and generating recommendations for adjusting protection strategies. This invention achieves dynamic quantitative assessment of data asset resilience and forms a closed-loop management system from risk discovery to strategy hardening, enhancing the enterprise's initiative in resisting unknown threats.

Description

Technical Field

[0001] This invention relates to the field of data security technology, and in particular to a method for risk assessment and management of enterprise data assets. Background Technology

[0002] With the deepening of digital transformation, data assets have become a core competitive advantage for enterprises, making their security risk assessment crucial. Among existing technologies, some solutions are beginning to utilize digital twin technology for risk management. For example, constructing a virtual mirror of the real environment and simulating and rehearsing pre-defined risk scenarios to verify processes and optimize resource allocation. However, these methods have significant technical shortcomings: First, their simulations rely on known, predefined risk scenarios, failing to simulate and assess potential threats caused by unknown vulnerabilities or new attack methods, resulting in a lagging and limited risk view. Second, the assessment focuses primarily on the effectiveness of emergency response procedures, lacking an intrinsic quantitative measure of the data assets' resistance, adaptation, and recovery capabilities under attack—in other words, failing to measure the "resilience" of data assets. Finally, the risk assessment results are usually qualitative or based on general risk coefficients, making it difficult to directly link them to specific security attributes such as the confidentiality, integrity, and availability of data assets, and failing to provide direct data support for precise adjustments to defense strategies. Summary of the Invention

[0003] The technical problem that this invention aims to solve is that existing risk assessment methods based on digital twins rely on preset scenarios, cannot simulate unknown attacks, and cannot dynamically and repeatably quantify the inherent resilience of data assets (i.e., the ability to resist attacks and recover), resulting in incomplete risk identification and difficulty in accurately locating defense weaknesses to deal with emerging threats.

[0004] To address the aforementioned technical problems, this invention provides a risk assessment and management method for enterprise data assets, comprising: collecting configuration information and real-time status information of the enterprise data asset environment, wherein the configuration information includes network device topology connections, storage node distribution, firewall and access control policy rules, and data asset transfer dependencies, and the real-time status information includes data access logs, data change records, and system performance indicators; Based on the configuration information and real-time status information, a digital twin of the data asset environment is constructed, and the digital twin maintains state synchronization with the real environment; Construct and train an adversarial generative network model, and use the adversarial generative network model to generate simulated attack behavior sequences; The simulated attack behavior sequence is injected into the digital twin for automated simulation, and the changes in confidentiality, integrity, availability, and recovery time from the occurrence of the attack to the recovery of the business are recorded for each attack simulation. Based on the changes in confidentiality, integrity, availability, and recovery time indicators, a quantitative resilience score is calculated using a preset weighted summation function. Based on the simulated attack behavior sequence that causes the confidentiality, integrity, or availability indicators to drop beyond a preset threshold during the automated simulation process, the defense vulnerabilities in the digital twin are identified, and the attack paths and affected assets corresponding to the simulated attack behavior sequence are determined; and based on the defense vulnerabilities, the attack paths, and the affected assets, protection strategy adjustment suggestions are generated to block the attack paths or strengthen the affected assets.

[0005] Optionally, the method further includes: before or in parallel with the construction of the digital twin, extracting data asset entities, business system entities, security event entities, and relationships between entities from the configuration information to construct a dynamic knowledge graph; after the automated inference is completed, extracting newly added attack paths and unexpected dependencies exposed during the inference process, and updating the dynamic knowledge graph using the newly added attack paths and unexpected dependencies; and performing risk propagation simulation on the updated dynamic knowledge graph using graph reasoning algorithms to predict multi-level risk transmission paths.

[0006] Optionally, it also includes: when a security incident occurs in a real environment, based on the asset identifier contained in the alarm information of the security incident, retrieving and locating a node with the same asset identifier in the dynamic knowledge graph as a starting point for reverse tracing to locate the root cause node.

[0007] Optionally, it also includes: based on the prediction results of the multi-level risk transmission path, identifying key nodes or edges for blocking risk propagation, and generating an adaptive blocking strategy.

[0008] Optionally, it also includes: establishing a risk-value linkage model to map the changes in confidentiality indicators, integrity indicators, and availability indicators recorded in the automated simulation to the damage ratio of data assets; obtaining the market value of data assets, and calculating the expected economic loss by combining the market value with the damage ratio; The expected economic loss is used as a weighting factor to dynamically adjust the weighting coefficients of confidentiality, integrity, availability, and recovery time indicators in the resilience score, so that changes in indicators of high-value assets have a higher weight in the resilience score, thereby guiding the direction of subsequent automated simulation of attack behavior sequences and the priority ranking of protection strategies.

[0009] Optionally, it also includes: acquiring real-time data lineage information of data assets and constructing a value transmission chain based on the data lineage information; when an upstream node in the lineage experiences a risk, identifying all affected downstream data assets along the value transmission chain and calculating the cumulative economic impact of the risk on the downstream data assets to correct the expected economic loss. Based on the revised expected economic losses, key nodes on the risk transmission path are automatically marked in the digital twin, and adaptive isolation strategies or redundant deployment strategies are generated for these nodes to prevent the risk from spreading downstream.

[0010] Optionally, it also includes: based on the calculated expected economic loss and the recovery time indicator, calling an actuarial model to dynamically generate backup frequency parameters, network bandwidth reservation parameters, or computing resource elastic scaling thresholds for specific data assets, and automatically sending these parameters to the resource scheduling system of the digital twin and the real environment to adjust the risk mitigation resource configuration of the data assets.

[0011] Compared with existing technologies, the technical solution provided by this invention has the following beneficial effects: 1. By conducting attack simulations in a completely isolated digital twin, high-fidelity stress testing of data asset risks is achieved, avoiding impact on real business operations. 2. By utilizing adversarial generative network models to generate simulated attack behavior sequences containing unknown patterns, novel attack paths and system vulnerabilities that traditional methods cannot discover can be proactively and forward-lookingly exposed, providing a forward-looking risk discovery capability. 3. By recording confidentiality, integrity, availability, and recovery time indicators, and using a weighted summation function to calculate a quantified resilience score, dynamic quantitative assessment of data asset resilience is achieved, providing an intuitive and quantifiable decision-making basis for risk management. 4. By identifying defense weaknesses based on automated simulation results and generating protection strategy adjustment suggestions, a complete closed loop is formed from risk simulation, quantitative assessment to generating executable hardening strategies, changing the traditional disconnect between assessment and hardening, and improving the initiative and management efficiency of enterprises in resisting unknown threats to data assets. Attached Figure Description

[0012] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0013] Figure 1 This is a flowchart of a risk assessment and management method for enterprise data assets according to an embodiment of the present invention; Figure 2This is a schematic diagram of the system architecture corresponding to a risk assessment and management method for enterprise data assets according to an embodiment of the present invention; Figure 3 This is a schematic diagram of knowledge graph interaction according to an embodiment of the present invention; Figure 4 This is a flowchart illustrating the risk-to-value transformation process according to an embodiment of the present invention.

[0014] Explanation of reference numerals in the attached figures: 10. Realistic environment; 20. Data acquisition module; 30. Digital twin environment; 40. Generative Adversarial Network (GAN) module; 50. Toughness Analysis Engine; 60. Knowledge Graph Module; 70. Risk-Value Linkage Module; 80. Strategy generation and output module. Detailed Implementation

[0015] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. The described embodiments should not be considered as limitations on this application. All other embodiments obtained by those skilled in the art without inventive effort are within the scope of protection of this application. Unless otherwise defined, all technical and scientific terms used in the embodiments of this application have the same meaning as commonly understood by those skilled in the art. The terminology used in the embodiments of this application is for the purpose of describing the embodiments of this application only and is not intended to limit this application. Before further detailed description of the embodiments of this application, the nouns and terms involved in the embodiments of this application are explained, and the nouns and terms involved in the embodiments of this application are subject to the following interpretations.

[0016] (1) Digital twin: refers to a virtual environment that is constructed using container virtualization and lightweight virtual machine technology based on the configuration information and real-time status information of an enterprise's data asset environment, and is synchronized with the real environment. It may contain simulated networks, simulated storage nodes, simulated access control components, and simulated data flow engines, etc., to reproduce the behavior and status of the real environment with high fidelity in an isolated state.

[0017] (2) Adversarial Generative Network Model: This refers to a deep learning model consisting of a generator and a discriminator. In this invention, the generator is used to learn the features of real attack samples and generate new simulated attack behavior sequences containing unknown patterns; the discriminator is used to distinguish between real attacks and generated attacks. Through adversarial training between the two, the generator's ability to create new types of attacks is improved.

[0018] (3) Resilience score: This refers to a quantitative indicator used to assess the ability of data assets to resist damage, adapt to the environment, and recover from attacks. Its calculation integrates multiple dimensions of indicators such as confidentiality, integrity, availability loss, and recovery time under attack simulation, and is usually obtained through a preset weighting function.

[0019] (4) Dynamic knowledge graph: refers to a knowledge base that stores data assets, business systems, security events and their interrelationships in a graph structure. Its "dynamic" nature is reflected in its ability to self-update and improve based on new attack paths or unexpected dependencies discovered in digital twin simulations, thereby more accurately reflecting the overall risk situation.

[0020] (5) Risk-Value Linkage Model: This refers to an analytical model that links technical risk indicators (such as loss of confidentiality, integrity, and availability) with corporate financial indicators (such as economic losses). The model aims to transform abstract security risks into economic costs that managers can intuitively understand, providing a basis for investment decisions.

[0021] (6) Data lineage information: refers to information that records the flow, processing, and transformation path of data throughout its entire lifecycle (from its source to its final consumption). In this invention, it is used to construct a value transmission chain and analyze the cumulative economic impact of risks at upstream nodes on downstream data assets.

[0022] Please see Figure 1 This application provides a method for risk assessment and management of enterprise data assets, aiming to solve the technical problems in existing technologies where risk assessment relies on known scenarios, cannot quantify asset resilience, and the assessment results are disconnected from business impact. This method constructs a digital twin environment isolated from the real environment, in which unknown attacks generated by artificial intelligence are used for automated simulation, thereby achieving dynamic and quantitative assessment of data asset risks and ultimately forming a closed-loop management system from technical hardening to financial decision-making.

[0023] The method provided in this application first performs an information collection step. This step aims to comprehensively and accurately capture the static configuration and dynamic behavior of the enterprise's data asset environment, providing foundational data for the subsequent construction of a high-fidelity digital twin. Specifically, it collects configuration information, such as network device topology connections, storage node distribution, firewall and access control policy rules, and the flow dependencies between data assets; simultaneously, it collects real-time status information, such as data access logs, data change records, and system performance indicators. This step is designed to overcome the limitations of traditional assessments that rely on static asset ledgers. By integrating dynamic and static data, it ensures that the environmental snapshot on which the assessment is based is complete and timely. Through comprehensive collection, it solves the problem of blind spots in risk assessment caused by incomplete information, laying a solid foundation for subsequent accurate simulation.

[0024] After acquiring comprehensive environmental information, the next step is to build a digital twin. This step involves constructing a digital twin of the data asset environment based on the collected configuration and real-time status information, ensuring that it remains synchronized with the real environment. Its design aims to create a secure, isolated "sandbox" where all risk simulations are conducted within this virtual environment, thus completely avoiding any impact on the real business systems. By building a mirror image that is highly consistent with the real environment in behavior and state, the technical challenge of traditional penetration testing or risk drills having to be conducted in a production environment, posing a significant risk of business interruption, is solved. This achieves high-fidelity stress testing and avoids impact on the real business systems.

[0025] Subsequently, to simulate the ever-evolving and unpredictable attacks in the real world, this method constructs and trains an adversarial generative network (GDN) model. This model utilizes its unique generator-discriminator architecture to learn from historical attack data and current environmental characteristics to generate simulated attack behavior sequences. This step is designed to break free from reliance on known attack signatures or rules, proactively creating novel attack paths and techniques that may be exploited by hackers but have yet to be discovered. Through adversarial training, the generator can produce attack samples containing unknown patterns, solving the problem that traditional risk assessments cannot address zero-day attacks or advanced persistent threats (APTs), thus improving the foresight and coverage of risk assessments.

[0026] After generating simulated attacks, the method injects these attack behavior sequences into the digital twin for automated simulation. During the simulation, the system closely monitors and records the changes in the three major security attributes of data assets—confidentiality, integrity, and availability—under each simulated attack, as well as the recovery time required from the attack's occurrence to business recovery. This step aims to observe the real performance of data assets under stress through actual "attack and defense drills." The principle is that the digital twin can faithfully reflect the response of the real system when subjected to the same attack; by recording changes in various indicators, abstract attack behaviors can be transformed into measurable impacts. This process solves the problem of traditional assessments struggling to quantify the actual destructive effects of attacks, providing objective and accurate data input for subsequent resilience assessments.

[0027] Next, based on the changes in various indicators recorded during the simulation, this method uses a pre-defined weighted summation function to calculate a quantitative resilience score. This function integrates the degree of loss of confidentiality, integrity, and availability, as well as the speed of recovery time, to arrive at a comprehensive score. The purpose of this step is to converge multi-dimensional, discrete performance indicators into a single, easily understood, and comparable measure of "resilience." By scoring the risk resistance capability of data assets, this method solves the problem that traditional risk assessment results are mostly qualitative descriptions (such as high, medium, and low risk), making it difficult for managers to make intuitive comparisons and decisions, thus achieving the quantification and visualization of the risk resistance capability of data assets.

[0028] After calculating the resilience score, the method further identifies defensive vulnerabilities in the digital twin based on simulated attack sequences that cause key indicators (such as confidentiality, integrity, or availability) to drop above preset thresholds, and determines the specific attack paths and affected asset ranges corresponding to these severe attacks. The principle behind this step is that successful, highly destructive simulated attacks inevitably exploit certain vulnerabilities in the system. By reverse-analyzing these attack sequences, it is possible to pinpoint which configuration is mishandled, which strategy is missing, or which dependency is abused. This solves the problem that traditional vulnerability scanning can only discover vulnerabilities at "points" and cannot reveal complex "attack chains" composed of multiple factors, making the focus of defense much more precise.

[0029] Finally, based on the identified defense vulnerabilities, attack paths, and affected assets, the method automatically generates recommendations for adjusting protection strategies to block the attack path or harden the affected assets. These recommendations are specific and actionable, such as adjusting firewall rules, increasing data backup frequency, or isolating critical data assets. This step forms a closed loop from risk assessment to risk mitigation. Its design aims to directly translate assessment findings into action guidelines, preventing assessment reports from becoming obsolete. By automatically generating targeted hardening recommendations, it solves the problem of security teams not knowing where to start when faced with massive amounts of alerts and assessment results, improving the efficiency and effectiveness of risk management.

[0030] Furthermore, in a preferred embodiment, to deepen the dimensions of risk analysis, this method also introduces dynamic knowledge graph technology. Specifically, before or in parallel with the construction of the digital twin, the system extracts data asset entities, business system entities, security event entities, and the relationships between them from the configuration information to construct a dynamic knowledge graph. This graph is not only a static asset list, but also a "relationship network" describing the complex dependencies and interaction logic between assets. This step is designed to go beyond the isolated evaluation of individual assets and understand risk from a global, interconnected perspective. By constructing the knowledge graph, the necessary topological structure and semantic information are provided for subsequent risk transmission analysis.

[0031] After the automated simulation is complete, this implementation also updates the dynamic knowledge graph using newly discovered attack paths and unexpected dependencies revealed during the simulation. For example, if a simulated attack reveals an unrecorded access path from the development server to the production database, this newly discovered "edge" is added to the knowledge graph. The ingenuity of this design lies in its use of the exploratory capabilities of digital twin simulation to feed back into and improve the knowledge graph, enabling it to "learn" and "grow." Through this dynamic update mechanism, the knowledge graph can increasingly accurately reflect risk relationships in the real environment, solving the problem of outdated information in static configuration libraries that cannot reflect real attack paths.

[0032] The updated knowledge graph was then used for deeper risk analysis. The system uses graph reasoning algorithms to perform risk propagation simulations on the knowledge graph to predict multi-level risk transmission paths. For example, it simulates how, after an upstream data interface is compromised, the risk will gradually affect downstream reporting systems, decision support systems, and so on, along data flow and business dependencies. The principle behind this step is to simulate "fire spread" on the graph structure, quantifying the probability and impact of risk propagating from one node to another. In this way, it overcomes the limitation of traditional assessments that can only see the "ignition point" but not the "fire spread path," enabling managers to anticipate chain reactions and cascading failures, thereby identifying core assets on the critical path of risk propagation.

[0033] In another preferred embodiment, the dynamic knowledge graph is also applied to post-incident emergency response. When a security incident occurs in a real-world environment, the system can quickly retrieve and locate the node representing the asset in the dynamic knowledge graph based on the asset identifier contained in the incident alarm information. Then, starting from this node, it traces backward along the relational edges in the graph, and combines the temporal and causal relationships recorded on the edges to ultimately locate the root cause node that led to the incident. This function is designed to shorten the investigation and tracing time of security incidents. By utilizing the existing structured relational information of the knowledge graph for automated reasoning, it replaces the tedious process of manually querying logs and piecing together evidence across multiple systems in traditional emergency response, achieving automated reconstruction of the attack chain.

[0034] In an alternative implementation, based on the multi-level risk propagation paths predicted by the aforementioned risk propagation simulation, the system can also automatically identify key nodes or edges in the network used to block risk propagation and generate adaptive blocking strategies accordingly. For example, graph algorithms might discover that isolating a middleware server can simultaneously cut off potential attack paths to three core databases, thereby achieving high defense efficiency at a relatively low cost. The principle behind this step is to quantify and evaluate the importance of each node or edge in the risk propagation network using methods such as centrality algorithms in graph theory. By identifying and blocking these key "barriers," a better risk containment effect can be achieved with less business impact, solving the problems of traditional blocking strategies often being oversimplified, having an excessively large impact range, or being incomplete in blocking.

[0035] Furthermore, in a preferred embodiment, to directly link technological risks with the company's economic interests, this method also establishes a risk-value linkage model. This model first transforms changes in confidentiality, integrity, and availability indicators recorded during automated simulations into a "damage ratio" of data assets through preset mapping rules. Then, the system obtains the market value of the data asset and, combining the market value with the damage ratio, calculates the expected economic loss caused by each simulated attack. The purpose of this step is to convert abstract technological risk indicators (such as "30% decrease in integrity") into financial language that managers can intuitively understand (such as "expected economic loss of 500,000 yuan"). In this way, it solves the problems of security risk assessment results being difficult for business and finance departments to understand and the commercial value of security investments being difficult to measure.

[0036] In another preferred embodiment, to make the calculation of economic losses more accurate, this risk-value linkage model also introduces real-time data lineage information of enterprise data assets. Based on this lineage information, the system can construct a series of "value transmission chains." When a data node upstream in the lineage experiences a risk (e.g., a source data table is contaminated), the system will follow the value transmission chain to identify all downstream data assets affected (e.g., various reports and analytical models generated based on that table), and calculate the cumulative economic impact of the risk on these downstream assets, thereby correcting the initially calculated expected economic loss. The principle behind this design is that the value and risk of data assets are not isolated, but are transmitted along the data processing and flow chain. By introducing data lineage analysis, the problem of traditional assessments neglecting indirect economic losses and leading to a serious underestimation of risk costs is solved.

[0037] Subsequently, based on the revised expected economic losses, key nodes on the risk transmission path are automatically marked in the digital twin, and adaptive isolation strategies or redundant deployment strategies are generated for these nodes to prevent the risk from spreading downstream.

[0038] Take a financial institution's data processing chain as an example. Upstream is a database table storing raw transaction records (denoted as node A). Downstream, it generates a customer behavior feature table (node ​​B) through an ETL task. Node B is further used for training datasets for anti-fraud models (node ​​C) and risk exposure reports (node ​​D). In a twin simulation, the system discovered that node A is at risk of being contaminated by SQL injection and calculated the corrected expected economic loss (considering the cascading effects of nodes B, C, and D) to be 12 million yuan.

[0039] The system then automatically performs the following steps in the digital twin: Marking critical nodes: Using graph reasoning algorithms (such as betweenness centrality) to analyze the risk transmission path, the ETL task interface of node B is identified as a critical node—because all flows from A to C and D must pass through this interface, and it has no redundant backup. The system highlights the virtual entity corresponding to this interface as a "high-risk propagation point" in the dynamic knowledge graph.

[0040] Generate an adaptive isolation strategy: For this critical node, the system automatically generates a network isolation strategy: "When the data write volume of node A in the real environment suddenly increases by more than 3 times the normal baseline within 1 minute, automatically cut off the data synchronization channel from node A to node B, and enable read-only snapshots as a replacement." This strategy is first simulated and verified in a digital twin: simulating a sudden increase in attack traffic, it is confirmed that the isolation strategy can be triggered within 5 seconds and control the amount of corrupted data on downstream nodes to within 0.1%.

[0041] Redundant deployment strategy: Simultaneously, the system creates an independent read-only replica (node ​​B_replica) for node B and configures automatic failover rules—when the data integrity verification of the primary node B fails, query requests from downstream nodes C and D are automatically redirected to B_replica, ensuring that downstream services can still use the most recent clean backup data during risk propagation. The number of redundant replicas is dynamically determined based on the revised expected economic loss: for every additional 5 million yuan in loss, one additional replica is added (in this example, 12 million yuan corresponds to 3 replicas).

[0042] The aforementioned strategy is automatically pushed to the firewall management platform and container orchestration system in the real environment via API, achieving risk blocking without manual intervention. In this way, the revised expected economic loss is no longer merely a financial figure, but directly drives the automated generation and deployment of risk blocking strategies within the digital twin.

[0043] In one alternative implementation, this method extends the endpoint of risk assessment to the financial decision-making level. Based on the calculated expected economic losses and recovery time indicators, the system invokes an actuarial model to dynamically generate backup frequency parameters, network bandwidth reservation parameters, or computing resource elastic scaling thresholds for specific data assets. These parameters are then automatically distributed to the resource scheduling systems of the digital twin and the real environment to adjust the risk mitigation resource allocation for the data assets. The following specific example illustrates this: The twin simulation results of a financial institution's core transaction database indicate an expected economic loss of 12 million yuan and a recovery time of 45 minutes. The system invokes a resource allocation actuarial model to dynamically generate three types of technical parameters and automatically distributes them: Backup frequency: Full backups increased from once daily to once every 6 hours, incremental backups increased from once every 4 hours to once every 30 minutes, and retention period extended from 7 days to 30 days. Parameters are sent to the backup scheduling system.

[0044] Network bandwidth reservation: 200Mbps of dedicated bandwidth is reserved for the data replication link, with the highest priority (DSCP46), and the QoS policy is dynamically adjusted through the SDN controller.

[0045] Elastic scaling thresholds: CPU expansion threshold is lowered from 70% to 50%, memory reservation is increased from 2GB to 3GB, maximum number of replicas is increased from 3 to 5, and these parameters are sent to the container orchestration platform's elastic scaling strategy.

[0046] Before deployment, the system quickly validated the new configuration in a digital twin: the resilience score improved from 0.65 to 0.85, and it was automatically deployed to the real environment after meeting the target. Thus, the risk assessment results directly drove the dynamic configuration of backup, network, and computing resources, realizing a substantial shift from "financial advice" to "technical control".

[0047] Please see Figure 2 This application also provides a risk assessment and management system for enterprise data assets, which serves as the physical carrier of the aforementioned methods. This system can be one or more servers, a cloud computing platform instance, or any device with computing and storage capabilities. At the hardware level, the system typically includes at least one processor and memory connected to the processor. The processor can be a central processing unit (CPU), a graphics processing unit (GPU), or a dedicated AI acceleration chip, responsible for performing computing tasks. The memory can be RAM, a solid-state drive (SSD), or a hard disk drive (HDD), used to store computer programs and data.

[0048] In this system, computer programs are stored in the memory. When the processor executes these programs, it implements methods for risk assessment and management of enterprise data assets. Specifically, these programs are divided into multiple functional modules that work together to complete the entire process. For example, as... Figure 2 As shown, the system may include a data acquisition module 20, responsible for collecting configuration and status information from the real environment 10; a digital twin environment 30, used to build and run a virtual image (i.e., for running a digital twin); an adversarial generative network module 40, used to generate simulated attack sequences; a resilience analysis engine 50, used to perform inferences, calculate scores and identify vulnerabilities; and a policy generation and output module 80, used to produce final hardening recommendations.

[0049] In a preferred embodiment, when the computer program in the system is executed by a processor, it is used to perform functions related to the knowledge graph, in addition to implementing the basic risk assessment process. This means that the system includes a knowledge graph module 60. This module is responsible for performing advanced analytical tasks such as constructing a dynamic knowledge graph, updating the graph using twin inference results, and performing risk propagation simulations on the graph. Therefore, such a system can not only assess the resilience of individual assets but also reveal global risk transmission paths, providing users with deeper insights.

[0050] In another preferred embodiment, when the computer program in the system is executed by the processor, it is also used to perform functions related to risk-value linkage. This means that the system includes a risk-value linkage module 70. This module is responsible for establishing a risk-value linkage model, converting the technical loss indicators output by the resilience analysis engine 50 into expected economic losses, and ultimately outputting financial decision-making recommendations. Such a system can directly translate the results of technical risk assessment into business language, providing intuitive decision support for corporate management.

[0051] To more clearly illustrate the technical solution of the present invention, the embodiments of the present invention will be described in more detail below with reference to the accompanying drawings and specific scenarios.

[0052] In one specific embodiment, the present invention provides a system corresponding to a method for risk assessment and management of enterprise data assets. Please refer to [link / reference]. Figure 1 and Figure 2 This system aims to provide enterprises with the ability to proactively identify and quantify data asset risks without impacting real business operations. First, the system retrieves information from the enterprise's real-world environment 10 via the data acquisition module 20. For example, it obtains the topological connections of servers and network devices from the Configuration Management Database (CMDB) through API interfaces, acquires storage node distribution information from the storage management platform, exports access control policy rules from the firewall management interface, and parses the flow dependencies between data assets from the data governance platform. Simultaneously, through lightweight agents deployed on each server, it collects database access logs, file change records, and system performance metrics such as CPU and memory usage of the operating system in real time.

[0053] After acquiring this information, the system uses it to model the digital twin environment 30. Specifically, Infrastructure as Code (IaC) tools such as Terraform can be used to automatically orchestrate and create a set of containers or lightweight virtual machines based on the collected topology and configuration. For example, Open vSwitch can be used to build a simulated network with a topology consistent with the real environment, Kubernetes persistent volumes can be used to simulate storage nodes, and anonymized sample data can be loaded. Firewall rules are then translated into Kubernetes network policies. In this way, a digital twin that is highly similar to the real environment 10 in structure and behavior is constructed. This process corresponds to... Figure 1 Steps S101 and S102 in the process.

[0054] Next, the adversarial generative network module 40 begins operation. This module uses historical security incident records, publicly available threat intelligence databases, and penetration test reports as training data. The generator within the module (e.g., a Transformer-based sequence model) learns patterns from these real attacks and combines this with features extracted from the digital twin environment 30 (such as open ports, running service versions, etc.) to generate entirely new, potentially effective sequences of simulated attack behaviors. For example, it generates a ransomware encryption sequence combining the latest vulnerability exploits and specific environment configurations. The discriminator continuously evaluates the sequences generated by the generator to determine their authenticity. Through this adversarial game, the generator is forced to create increasingly realistic and unpredictable attack samples. This process corresponds to... Figure 1Step S103 in the process.

[0055] Subsequently, these simulated attack behavior sequences generated by the adversarial generative network module 40 are injected into the digital twin environment 30 to initiate automated simulations. This process corresponds to... Figure 1 Step S104. An attack executor parses instructions in the sequence, for example, simulating an unauthorized access operation by an insider, attempting to read core customer data tables that they do not have permission to access. During the simulation, monitoring probes deployed within the digital twin environment 30 record various metrics in real time: confidentiality metrics (such as detecting sensitive data being read by an unauthorized account), integrity metrics (such as changes in hash values ​​after malicious tampering of data tables), availability metrics (such as database service CPU exhaustion and service response time spikes due to the attack), and recovery time metrics (the total time from the end of the attack to the restoration of data through backup and verification of business availability).

[0056] After the simulation, all recorded indicator data are sent to the resilience analysis engine 50 for resilience score calculation. This process corresponds to... Figure 1 Step S105 in the process. The resilience analysis engine 50 will use a preset weighted summation function to calculate. For example, this function can be specified as: R=1-(α*C_loss+β*I_loss+γ*A_loss+δ*T_norm) Where R represents a single resilience score; C_loss, I_loss, and A_loss represent the percentage loss of confidentiality, integrity, and availability caused in this attack simulation, respectively; T_norm is the normalized recovery time, for example, the actual recovery time divided by the asset's preset maximum tolerable downtime (RTO); α, β, γ, and δ are weighting coefficients, which can be set to 0.4, 0.3, 0.2, and 0.1 respectively, depending on the enterprise's emphasis on different security attributes, and the sum is 1. Using this formula, each attack simulation will yield a resilience score between 0 and 1. The closer the score is to 1, the stronger the asset's resilience.

[0057] Finally, the resilience analysis engine 50 analyzes the attack scenarios that cause resilience scores to fall below a certain threshold (e.g., 0.5), identifies simulated attack sequences that lead to severe consequences, and traces back to the vulnerabilities in defenses they exploited. For example, it might discover that a successful attack was due to a developer's test account having excessive privileges that were not promptly revoked. Based on this finding, the policy generation and output module 80 generates specific recommendations for adjusting protection policies, such as "It is recommended to immediately review and revoke the production database access permissions for account 'dev_test'." These recommendations can be directly pushed to the security operations team for execution, thus completing the closed loop from risk assessment to response and handling. This process corresponds to... Figure 1Step S106 in the process.

[0058] Optionally, it also includes step S107: automatic offline backup protection triggered based on defense vulnerability and resilience score. When the resilience score is lower than a preset threshold (e.g., 0.5) or the automated simulation results show a high-risk defensive vulnerability, the strategy generation and output module 80 automatically activates the backup protection device and performs the following steps: (1) Store the primary backup copy of the data asset in the first backup database, and automatically disconnect its physical or logical connection with the business network after the backup is completed; (2) Introduce a ransomware detection engine based on AI feature analysis and real-time behavior scanning. If malicious behaviors such as ransomware encryption and batch changes of file extensions are detected at the backup source, the power supply or network link of the target network will be automatically cut off. (3) When the first backup database is offline, start the security verification process (such as integrity hash verification and immutable storage locking) and after confirming that the data has not been contaminated, copy the clean backup data to the second backup database. (4) A network mutual exclusion control mechanism is adopted to ensure that the data link between the first backup database and the second backup database remains physically or logically powered off during non-transmission periods, and only one backup database is allowed to connect to the business network at any given time; (5) Record the trigger time, detection results and network switching logs of the above offline backup operations as the basis for resilience score correction and compliance audit.

[0059] The above-mentioned automatic offline backup protection enables proactive isolation and secure copy retention of low-resilience or high-risk assets, preventing backup data from being encrypted by ransomware and ensuring a clean and recoverable data source in the event of a real attack.

[0060] In a preferred embodiment, to obtain a more comprehensive view of risk, the present invention introduces knowledge graph capabilities based on the above embodiments. Please refer to... Figure 3 During system operation, the knowledge graph module 60 works in parallel. It not only acquires information from the data acquisition module 20 to construct the initial dynamic knowledge graph, but more importantly, it continuously receives inference results from the digital twin environment 30. For example, in one inference, the system discovers that an attacker can use a forgotten network device connecting the non-production and production areas for lateral movement. This "unexpected dependency" is extracted as a new relation edge and updated into the dynamic knowledge graph, making it more complete and accurate.

[0061] The updated dynamic knowledge graph can be used for proactive risk propagation simulation. For example, a security analyst can select a key identity authentication server node on the graph and simulate its "failure" or "commitment." The graph reasoning algorithm will then calculate and visualize the risk propagation path along dependencies and access relationships, highlighting all potentially affected downstream business systems and displaying their risk levels in the form of a heatmap. Based on this prediction, the system can identify key nodes or edges that block risk propagation and generate adaptive blocking strategies. For example, the algorithm might discover that adding a network access control policy between the authentication server and the core business system is the most effective measure to block risk propagation.

[0062] Furthermore, this knowledge graph enhances post-incident response capabilities. When a security incident occurs in a real-world environment 10, such as a SIEM system alert indicating abnormal data export from a database, the security team no longer needs to manually investigate. The system automatically associates the asset identifier (database IP or name) in the alert information with the corresponding node in the dynamic knowledge graph and initiates the root cause tracing process. The system traverses backward along the relationship edges in the graph, combining timestamps and causal logic to quickly locate the initial entry point, such as an employee PC compromised by a phishing email, and presents the complete attack chain. This automated root cause tracing capability significantly reduces the time required for incident response.

[0063] In another preferred embodiment, to make the risk assessment results more commercially valuable, the present invention introduces a risk-value linkage module 70. Please refer to... Figure 4 The workflow of this module begins with acquiring the technical loss metric (S401) output by the resilience analysis engine 50. For example, a simulation might result in a 20% loss of integrity in a core transaction database (I_loss=0.2). The risk-value linkage module 70 then maps this loss to a comprehensive damage ratio based on preset Business Impact Analysis (BIA) rules. For example, the rule might be defined as: Overall damage ratio = w1*C_loss + w2*I_loss + w3*A_loss Where C_loss, I_loss, and A_loss represent the losses due to confidentiality, integrity, and availability, respectively. w1, w2, and w3 are the weights. Assuming the overall loss ratio is 15% in this scenario, the system will then obtain the market value index of the traded data asset from an external data exchange or an internal valuation model, assumed to be 10 million yuan. Next, the system will calculate the expected economic loss (S402), which is calculated as follows: Expected economic loss = Market value index * Overall damage ratio * Data asset volume coefficient The market value index is 10 million yuan, the overall damage rate is 15%, and the data asset volume coefficient is set according to the actual situation. Through this calculation, the "20% integrity loss" at the technical level is transformed into the "expected economic loss of 1.5 million yuan" at the financial level.

[0064] Subsequently, the expected economic loss is used as a weighting factor to dynamically adjust the weighting coefficients of confidentiality, integrity, availability, and recovery time indicators in the resilience score. This ensures that changes in indicators of high-value assets have a higher weight in the resilience score, guiding the direction of subsequent automated attack behavior sequence generation and the prioritization of protection strategies. A specific example is as follows: Suppose the current resilience scoring function of this database is: R=1-(0.4×C_loss+0.3×I_loss+0.2×A_loss+0.1×T_norm) The basic weights are α=0.4 (confidentiality), β=0.3 (integrity), γ=0.2 (availability), and δ=0.1 (recovery time).

[0065] When the risk-value linkage module 70 calculates the expected economic loss to be 1.5 million yuan, the system dynamically updates the resilience score weights of the database according to the preset value-weight mapping rules (e.g., for every 500,000 yuan increase in expected economic loss, α increases by 0.05, while δ decreases by 0.02). 1.5 million yuan corresponds to an increase of 0.15 in α (i.e., α changes from 0.4 to 0.55) and a decrease of 0.06 in δ (i.e., δ changes from 0.1 to 0.04), while β and γ are proportionally normalized to 0.27 and 0.14, respectively. The updated scoring function becomes: R'=1-(0.55×C_loss+0.27×I_loss+0.14×A_loss+0.04×T_norm) This new set of weights is fed into the reward function of the adversarial generative network module 40. The generator's goal is to maximize attack sequences that the discriminator cannot distinguish, while the reward function additionally rewards attack behaviors that cause a significant drop in the high-weight metric (in this case, confidentiality C_loss). Thus, in subsequent automated inferences, the generator tends to explore attack paths such as stealing sensitive data and unauthorized access, rather than simple ransomware or denial-of-service attacks.

[0066] Meanwhile, when identifying defensive vulnerabilities, the resilience analysis engine 50 prioritizes candidate vulnerabilities based on updated weights. For example, a simulation might expose two vulnerabilities: vulnerability A (which could reduce C_loss by 30%) and vulnerability B (which could reduce A_loss by 40%). Under the original weights, vulnerability B's overall impact score (0.2 × 40% = 8%) is higher than vulnerability A's (0.4 × 30% = 12%). However, under the new weights, vulnerability A's score becomes 0.55 × 30% = 16.5%, higher than vulnerability B's 0.14 × 40% = 5.6%. Therefore, the strategy generation and output module 80 will prioritize generating reinforcement suggestions for vulnerability A (such as tightening data access control), while postponing the handling of vulnerability B. In this way, the quantified result of expected economic losses directly drives the direction of attack simulation and the allocation of defense resources, achieving a value-oriented risk assessment closed loop.

[0067] Furthermore, this module performs value transmission analysis (S403). By accessing the enterprise's data lineage platform, the module understands that this core transaction database is the upstream data source for the downstream "quarterly financial reports" and "risk exposure monitoring dashboards." When a risk occurs in the upstream database, the risk will be transmitted downstream. The model will calculate the cumulative economic impact of upstream risk on downstream assets based on a preset transmission coefficient, and adjust the expected economic loss of 1.5 million yuan to obtain a more comprehensive total economic loss assessment.

[0068] Finally, this revised expected economic loss amount, along with the recovery time indicator derived from the simulation, is fed into an actuarial model (S404). Based on these inputs, the model dynamically calculates a suggested insurance premium rate for the asset in question, or recommends the amount of risk reserve the company should set aside in its financial statements. These financial decision recommendations (S405) can ultimately be automatically pushed to the company's financial management system or ERP system via API for the CFO and management to make decisions. This completes the entire closed loop from discovering a technical vulnerability to assessing its potential economic impact and formulating corresponding financial hedging strategies.

[0069] Now, envision a "panoramic" embodiment that integrates all these functions. The system's data acquisition module 20 and knowledge graph module 60 continuously synchronize information from the real environment 10 to maintain the real-time nature and accuracy of the digital twin environment 30 and the dynamic knowledge graph. One day, the adversarial generative network module 40 generates an attack sequence that has never been seen before, exploiting a vulnerability in a certain middleware combination for data penetration. After this attack sequence is injected into the digital twin environment 30, the resilience analysis engine 50 monitors a database storing a large amount of customer personal information, and its resilience score drops sharply to 0.2, and the confidentiality index (C_loss) is almost 100%. The system immediately triggers a linkage response. On the one hand, the resilience analysis engine 50 outputs the high-risk attack path and weak point information to the policy generation and output module 80, which immediately generates a work order with the highest priority, suggesting that the security team upgrade the relevant middleware and tighten access control. On the other hand, this attack path is automatically updated to the dynamic knowledge graph. The knowledge graph module 60 immediately runs a risk propagation simulation on it and discovers that this path may also threaten two other associated business systems. At the same time, the risk-value linkage module 70 is activated. It obtains the technical loss with C_loss of 100%, queries the market valuation of this customer data asset to be 50 million yuan, and its data lineage is downstream associated with the company's core marketing system. After calculation and value conduction correction, the expected economic loss of this risk event is obtained as 60 million yuan. Finally, the system calls the actuarial model (S404), and based on this potential loss, pushes a financial decision-making recommendation of "suggesting an emergency provision for data security risk reserve" to the financial system (S405), and at the same time provides an adaptive blocking strategy based on knowledge graph analysis to the security operation center, which can cut off all potential propagation paths at the lowest cost. Through the collaborative work of these modules, the present invention realizes a data asset risk management system.

[0070] In the financial industry, banks can use this invention to assess the resilience of their core banking systems to new types of cyberattacks, quantify potential transaction disruption losses, and optimize their disaster recovery strategies and cybersecurity insurance configurations accordingly. In the healthcare industry, hospitals can use this invention to simulate ransomware attacks on their electronic health record (EHR) systems, assess the risk of patient data breaches and their impact on healthcare activities, and generate targeted hardening recommendations to ensure patient information security and continuity of healthcare services. In critical information infrastructure sectors such as energy and transportation, operators can securely test and validate new control policies or software updates in digital twins, assessing their potential impact on cybersecurity without affecting the operation of actual physical systems, and preventing large-scale physical disruptions caused by cyberattacks. This system can be integrated with existing enterprise platforms such as Security Information and Event Management (SIEM) and Security Orchestration Automation and Response (SOAR), providing the risks and policy recommendations discovered in this invention as input to the SOAR platform for automatic execution, thereby improving the overall security operation efficiency and proactive defense capabilities of the enterprise.

[0071] The above description is merely an embodiment of the present invention and does not limit the patent scope of the present invention. Any equivalent modifications made based on the content of the present invention specification and drawings, or direct or indirect applications in related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. A method for risk assessment and management of enterprise data assets, characterized in that, Includes the following steps: Collect configuration information and real-time status information of the enterprise's data asset environment. The configuration information includes network device topology connection relationships, storage node distribution, firewall and access control policy rules, and data asset flow dependencies. The real-time status information includes data access logs, data change records, and system performance indicators. Based on the configuration information and real-time status information, a digital twin of the data asset environment is constructed, and the digital twin maintains state synchronization with the real environment; Construct and train an adversarial generative network model, and use the adversarial generative network model to generate simulated attack behavior sequences; The simulated attack behavior sequence is injected into the digital twin for automated simulation, and the changes in confidentiality, integrity, availability, and recovery time from the occurrence of the attack to the recovery of the business are recorded for each attack simulation. Based on the changes in confidentiality, integrity, availability, and recovery time indicators, a quantitative resilience score is calculated using a preset weighted summation function. Based on the simulated attack behavior sequence that causes the confidentiality, integrity or availability indicators to drop beyond a preset threshold during the automated simulation process, the defense vulnerabilities in the digital twin are identified, and the attack paths and affected assets corresponding to the simulated attack behavior sequence are determined. Based on the defense vulnerabilities, the attack paths, and the affected assets, suggestions for adjusting protection strategies to block the attack paths or harden the affected assets are generated.

2. The method for risk assessment and management of enterprise data assets according to claim 1, characterized in that, Also includes: Before or in parallel with the construction of the digital twin, extract the data asset entities, business system entities, security event entities, and relationships between entities from the configuration information to construct a dynamic knowledge graph; After the automated inference is completed, the newly added attack paths and unexpected dependencies exposed during the inference process are extracted, and the dynamic knowledge graph is updated using the newly added attack paths and unexpected dependencies. We use graph reasoning algorithms to perform risk propagation simulations on an updated dynamic knowledge graph to predict multi-level risk transmission paths.

3. The method for risk assessment and management of enterprise data assets according to claim 2, characterized in that, Also includes: When a security incident occurs in a real environment, based on the asset identifier contained in the alarm information of the security incident, the system retrieves and locates a node with the same asset identifier in the dynamic knowledge graph as a starting point for reverse tracing to locate the root cause node.

4. The method for risk assessment and management of enterprise data assets according to claim 2, characterized in that, Also includes: Based on the prediction results of the multi-level risk transmission path, key nodes or edges for blocking risk propagation are identified, and adaptive blocking strategies are generated.

5. The method for risk assessment and management of enterprise data assets according to claim 1, characterized in that, Also includes: Establish a risk-value linkage model to map the changes in confidentiality, integrity, and availability indicators recorded in the automated simulation to the proportion of data asset damage. Obtain the market value of the data assets, and calculate the expected economic loss by combining the market value with the damage ratio; The expected economic loss is used as a weighting factor to dynamically adjust the weighting coefficients of confidentiality, integrity, availability, and recovery time indicators in the resilience score, so that changes in indicators of high-value assets have a higher weight in the resilience score, thereby guiding the direction of subsequent automated simulation of attack behavior sequences and the priority ranking of protection strategies.

6. The method for risk assessment and management of enterprise data assets according to claim 5, characterized in that, Also includes: Acquire real-time data lineage information of data assets and construct a value transmission chain based on the data lineage information; When a risk occurs at an upstream node in the bloodline, all affected downstream data assets are identified along the value transmission chain, and the cumulative economic impact of the risk on the downstream data assets is calculated to correct the expected economic loss. Based on the revised expected economic losses, key nodes on the risk transmission path are automatically marked in the digital twin, and adaptive isolation strategies or redundant deployment strategies are generated for these nodes to prevent the risk from spreading downstream.

7. The method for risk assessment and management of enterprise data assets according to claim 6, characterized in that, Also includes: Based on the calculated expected economic loss and recovery time indicators, the actuarial model is invoked to dynamically generate backup frequency parameters, network bandwidth reservation parameters, or computing resource elastic scaling thresholds for specific data assets. These parameters are then automatically distributed to the resource scheduling system of the digital twin and the real environment to adjust the risk mitigation resource allocation for the data assets.

Images