A marketing data security risk assessment system based on big data analysis

Abstract

The application discloses a marketing data security risk assessment system based on big data analysis, comprising: a data fusion processing module for collecting marketing data and security correlation data and preprocessing to generate standardized marketing security data set; a risk element coding module for extracting data sensitivity, access behavior state, permission adaptation state and flow path state to generate marketing risk element vector; a behavior benchmark modeling module for constructing marketing access behavior benchmark; a risk heterogeneous graph construction module for constructing marketing data security risk heterogeneous graph; a meta-path risk assessment module for generating marketing data security risk representation through permission constraint MAGNN network; a risk transmission correction module for generating corrected risk representation; a traceability result output module for outputting marketing data security risk assessment result. The application has the advantages of accurate risk assessment, strong dynamic analysis capability and clear risk traceability.

Description

Technical Field

[0001] This invention relates to the field of data security risk assessment technology, and in particular to a marketing data security risk assessment system based on big data analysis. Background Technology

[0002] In recent years, with the development of enterprise digital marketing, customer data management, advertising platforms, channel operation systems, and data security auditing technologies, marketing data is frequently accessed and shared in business processes such as customer outreach, transaction analysis, tag management, campaign placement, and channel conversion. Existing technologies typically collect basic customer data, customer transaction data, customer tag data, marketing campaign data, advertising placement data, and channel conversion data through marketing management systems. This data is then cleaned, classified, and statistically analyzed for customer profiling, precision marketing, campaign effectiveness evaluation, and business decision-making. Simultaneously, some data security management solutions combine access audit data, permission configuration data, API call data, and anomaly alert data to monitor abnormal logins, unauthorized queries, batch exports, or unauthorized sharing during marketing data access, and generate security alerts through rule matching or risk scoring.

[0003] However, existing technologies still suffer from insufficient dynamic correlation analysis and weak risk tracing capabilities in marketing data security risk assessment scenarios. On the one hand, existing solutions rely heavily on sensitive field identification, permission rule verification, or single-event anomaly alerts, making it difficult to uniformly encode data sensitivity, access behavior status, permission adaptation status, and flow path status. They also struggle to build a marketing access behavior benchmark based on the access subject and marketing business cycle, resulting in inaccurate distinctions between normal and abnormal marketing access. On the other hand, existing solutions typically fail to construct a heterogeneous marketing data security risk graph comprising the access subject, marketing data, API calls, and flow nodes. They lack joint assessment based on data access meta-paths, API call meta-paths, and flow transmission meta-paths, making it difficult to identify risk transmission paths in cross-interface and cross-node data flow. Furthermore, they struggle to correct isolated risk responses arising from single abnormal accesses, thus affecting the accurate output of risk scores, risk levels, risk types, and risk tracing paths. Summary of the Invention

[0004] One objective of this invention is to propose a marketing data security risk assessment system based on big data analysis. The method of this invention makes full use of big data fusion analysis, risk heterogeneous graph construction and permission constraint MAGNN network technology, and has the advantages of accurate risk identification, strong dynamic assessment capability, low false judgment rate and traceable risk source.

[0005] A marketing data security risk assessment system based on big data analysis according to an embodiment of the present invention includes: The data fusion and processing module is used to collect marketing data and security-related data, preprocess the collected data, and generate a standardized marketing security dataset. The risk element coding module is used to extract data sensitivity, access behavior status, permission adaptation status and flow path status based on a standardized marketing security dataset, and then perform vectorized coding to generate a marketing risk element vector. The behavioral benchmark modeling module is used to aggregate marketing risk factor vectors based on the access subject and marketing business cycle to construct marketing access behavior benchmarks; The risk heterogeneity graph construction module is used to construct a marketing data security risk heterogeneity graph based on marketing risk element vectors and marketing access behavior benchmarks. The meta-path risk assessment module is used to input the heterogeneous graph of marketing data security risks into the permission constraint MAGNN network to generate a representation of marketing data security risks. The risk transmission correction module is used to identify risk transmission paths based on the marketing data security risk representation, correct isolated risk responses caused by a single abnormal access, and generate a corrected risk representation. The traceability result output module is used to generate marketing data security risk scores, risk levels, risk types, and risk traceability paths based on the corrected risk representation, and output marketing data security risk assessment results.

[0006] Optionally, the marketing data includes customer basic data, customer transaction data, customer tag data, marketing activity data, advertising placement data, channel conversion data, and a marketing data catalog. The security-related data includes access audit data, permission configuration data, interface call data, data sharing and export data, data flow data, and abnormal alarm data. The preprocessing includes field standardization, duplicate data removal, missing field completion, abnormal record filtering, timestamp unification, data type labeling, business cycle division, and unit normalization processing.

[0007] Optionally, the risk element coding module includes: Based on a standardized marketing security dataset, data type labels and field content tags corresponding to marketing data are extracted from the marketing data catalog to generate data sensitivity levels. Based on access audit data and API call data, extract the number of accesses, API calls, actions, and access time distribution of the access subject within the same marketing business cycle, and organize the number of accesses, API calls, actions, and access time distribution to generate access behavior status; Based on the permission configuration data, the access subject's access scope, interface call scope, and shared export scope for marketing data are extracted and matched with the actual access records to generate a permission adaptation status. Based on data sharing, export data and extract data flow data, extract the flow order of marketing data between different calling interfaces and flow nodes, and generate the flow path status; Data sensitivity, access behavior status, permission adaptation status, and flow path status are vectorized and encoded to generate marketing risk element vectors.

[0008] Optionally, the behavioral benchmark modeling module includes: The marketing risk element vectors are grouped according to the access subject and marketing business cycle, and the access frequency, API calls, operation actions, access time distribution, permission adaptation status and flow path status of the same access subject in the same marketing business cycle are extracted. Statistical aggregation of access counts within the same group generates an access count baseline; Count the number of times each API call occurs and organize the API range within the same group to generate a API call baseline. The operations within the same group are organized in chronological order of occurrence to generate an operation baseline; Perform time segment statistics on the access time distribution within the same group to generate an access time distribution benchmark; The benchmarks for access frequency, API call, operation actions, and access time distribution are combined according to the access subject and marketing business cycle to construct a marketing access behavior benchmark.

[0009] Optionally, the risk heterogeneity graph construction module includes: Read the encoded content associated with the access subject, marketing data, calling interface, flow node and marketing business cycle in the marketing risk element vector, and map the access subject, marketing data, calling interface and flow node into different types of graph nodes respectively; Access connection edges are established based on the access records of the access subjects to marketing data within the same marketing business cycle; interface call edges are established based on the call records of the access subjects to the calling interfaces; and path flow edges are established based on the flow order of marketing data between different flow nodes. Write the data sensitivity level into the graph node corresponding to the marketing data, write the permission adaptation status into the access connection edge and the interface call edge, and write the flow path status into the path flow edge. The marketing access behavior benchmark is matched with the access behavior status of the same access subject in the marketing risk element vector, and the matching results are written into the graph node and access connection edge corresponding to the access subject to construct a heterogeneous graph of marketing data security risks.

[0010] Optionally, the meta-path risk assessment module includes: The heterogeneous graph of marketing data security risks is input into the permission-constrained MAGNN network. The permission-constrained MAGNN network includes a graph input construction layer, a risk meta-path construction layer, a meta-path aggregation layer, an inter-path attention fusion layer, a permission constraint gating layer, and a risk representation output layer. In the graph input construction layer, the graph nodes, access connection edges, interface call edges, path flow edges, data sensitivity, permission adaptation status and flow path status in the heterogeneous graph of marketing data security risk are read, and the graph nodes and graph edges are feature-encoded to generate heterogeneous graph input features. In the risk meta-path construction layer, data access meta-paths, interface call meta-paths, and flow transmission meta-paths are constructed based on access connection edges, interface call edges, and path flow edges. Meta-path input features are extracted from the heterogeneous graph input features according to the graph nodes and graph edges traversed by each meta-path. In the meta-path aggregation layer, node feature aggregation and edge feature aggregation are performed on the meta-path input features in the data access meta-path, interface call meta-path, and flow transmission meta-path to generate meta-path risk representation. In the inter-path attention fusion layer, the risk representations of each meta-path are weighted and fused to generate a fused risk representation. In the permission constraint gating layer, permission constraint gating coefficients are generated based on the permission adaptation state. The permission constraint gating coefficients are then used to modulate the fusion risk representation to generate a permission constraint risk representation. In the risk representation output layer, the risk representation of permission constraints is mapped to generate a marketing data security risk representation.

[0011] Optionally, the risk transmission correction module includes: The marketing data security risk representation is split into node-dimensional and edge-dimensional components to obtain the risk representation components of each graph node and each graph edge. Based on the connection order of access connection edge, interface call edge and path flow edge, the risk representation components that are continuously distributed within the same marketing business cycle are connected by path to generate candidate risk transmission paths. Continuity detection is performed on the risk representation components in the candidate risk transmission path to determine the risk transmission path; Risk representation components that are only distributed on a single access connection edge and do not continue along the interface call edge and path flow edge are isolated and marked to generate isolated risk responses; The isolated risk response is separated from the marketing data security risk representation, and the marketing data security risk representation is updated based on the continuous risk representation components in the risk transmission path to generate a corrected risk representation.

[0012] Optionally, the traceability result output module includes: Read the corrected risk representation and extract the data sensitivity, permission adaptation status, flow path status, risk transmission path, access behavior status, and isolated risk response from the corrected risk representation; Data risk components are determined based on data sensitivity, permission risk components are determined based on permission adaptation status, flow risk components are determined based on flow path status and risk transmission path, and behavior risk components are determined based on access behavior status and isolated risk response. The data risk component, access risk component, flow risk component, and behavior risk component are weighted and sorted to generate a marketing data security risk score; The marketing data security risk score is matched with the risk level classification criteria to generate a risk level; Risk types are determined based on permission adaptation status, workflow status, access behavior status, and the triggering of risk transmission paths. A risk tracing path is generated based on the access subjects, marketing data, API calls, and transfer nodes along the risk transmission path; The marketing data security risk score, risk level, risk type, and risk tracing path are associated and encapsulated to output the marketing data security risk assessment results.

[0013] The beneficial effects of this invention are: This invention utilizes a data fusion processing module to uniformly collect and preprocess marketing data and security-related data, forming a standardized marketing security dataset. This allows customer basic data, customer transaction data, customer tag data, marketing activity data, advertising placement data, channel conversion data, marketing data catalog, as well as access audit data, permission configuration data, interface call data, data sharing and export data, data flow data, and anomaly alarm data to participate in risk assessment on the same data basis. A risk element coding module extracts data sensitivity, access behavior status, permission adaptation status, and flow path status, generating a marketing risk element vector. This ensures that marketing data security risks are no longer judged solely based on a single sensitive field or a single access record, but rather simultaneously reflect data content, access behavior, permission scope, and flow process, improving the completeness of risk characteristic expression.

[0014] This invention constructs marketing access behavior benchmarks based on the access subject and marketing business cycle through a behavior benchmark modeling module. This distinguishes actual access behavior from normal behavior within the marketing business cycle, reducing the possibility of normal marketing activities being misjudged as risky. A risk heterogeneity graph construction module organizes the access subject, marketing data, API calls, and flow nodes into a marketing data security risk heterogeneity graph. Using a permission-constrained MAGNN network, it performs meta-path risk assessment on data access meta-paths, API call meta-paths, and flow transmission meta-paths, identifying risk transmission during marketing data access, API calls, shared exports, and cross-node flow. A risk transmission correction module corrects isolated risk responses from single abnormal accesses and, combined with a traceability result output module, generates a marketing data security risk score, risk level, risk type, and risk traceability path. This allows the risk assessment results to correlate the risk source, involved data, occurrence stage, and flow destination, improving the accuracy, dynamism, and traceability of marketing data security risk assessment. Attached Figure Description

[0015] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is an overall flowchart of a marketing data security risk assessment system based on big data analysis proposed in this invention; Figure 2 This is a schematic diagram illustrating the construction of a heterogeneous marketing data security risk graph for a marketing data security risk assessment system based on big data analysis proposed in this invention. Figure 3 This is a schematic diagram illustrating the generation of marketing data security risk representation in a marketing data security risk assessment system based on big data analysis proposed in this invention. Detailed Implementation

[0016] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0017] refer to Figures 1-3 A marketing data security risk assessment system based on big data analytics includes: The data fusion and processing module is used to collect marketing data and security-related data, preprocess the collected data, and generate a standardized marketing security dataset. The risk element coding module is used to extract data sensitivity, access behavior status, permission adaptation status and flow path status based on a standardized marketing security dataset, and then perform vectorized coding to generate a marketing risk element vector. The behavioral benchmark modeling module is used to aggregate marketing risk factor vectors based on the access subject and marketing business cycle to construct marketing access behavior benchmarks; The risk heterogeneity graph construction module is used to construct a marketing data security risk heterogeneity graph based on marketing risk element vectors and marketing access behavior benchmarks. The meta-path risk assessment module is used to input the heterogeneous graph of marketing data security risks into the permission constraint MAGNN network to generate a representation of marketing data security risks. The risk transmission correction module is used to identify risk transmission paths based on the marketing data security risk representation, correct isolated risk responses caused by a single abnormal access, and generate a corrected risk representation. The traceability result output module is used to generate marketing data security risk scores, risk levels, risk types, and risk traceability paths based on the corrected risk representation, and output marketing data security risk assessment results.

[0018] In this implementation, marketing data includes customer basic data, customer transaction data, customer tag data, marketing activity data, advertising placement data, channel conversion data, and a marketing data catalog. Security-related data includes access audit data, permission configuration data, interface call data, data sharing and export data, data flow data, and abnormal alarm data. Preprocessing includes field standardization, duplicate data removal, missing field completion, abnormal record filtering, timestamp unification, data type labeling, business cycle division, and unit normalization.

[0019] In this embodiment, the risk element coding module includes: Based on a standardized marketing security dataset, data type labels and field content tags corresponding to marketing data are extracted from the marketing data catalog to generate data sensitivity levels. The generation of data sensitivity specifically includes: reading data type labels and field content tags from the marketing data catalog in the standardized marketing security dataset; dividing the marketing data into customer basic data records, customer transaction data records, customer tag data records, marketing activity data records, advertising placement data records, and channel conversion data records according to the data type labels; identifying customer identity fields, transaction detail fields, customer profile fields, activity configuration fields, advertising placement fields, and channel conversion fields in each type of marketing data record according to the field content tags; marking fields involving customer identity, transaction details, and customer profiles in customer basic data records, customer transaction data records, and customer tag data records as highly sensitive fields; marking fields involving activity rules, target audience, and conversion results in marketing activity data records, advertising placement data records, and channel conversion data records as business sensitive fields; statistically analyzing the distribution of highly sensitive fields and business sensitive fields in the same marketing data record; and generating the data sensitivity of the marketing data record based on the combination of highly sensitive fields, business sensitive fields, and non-sensitive fields. Based on access audit data and API call data, the number of accesses, API calls, actions, and access time distribution of the access subject within the same marketing business cycle are extracted. The number of accesses, API calls, actions, and access time distribution are then organized to generate access behavior status. Here, the access subject refers to the account, system, interface, or channel object that performs access, call, export, share, or transfer operations on marketing data. The marketing business cycle refers to the fixed business time range formed by the marketing activity from planning and placement, conversion tracking, to effect statistics. The generation of access behavior status specifically includes: collecting access audit data based on the access subject and marketing business cycle, counting the number of access records generated by the same access subject within the same marketing business cycle, and obtaining the access count; collecting interface call data based on the access subject and marketing business cycle, extracting the interface names and the number of interface calls made by the same access subject within the same marketing business cycle, and obtaining the called interfaces; extracting query, modification, export, sharing, and interface call actions from the access audit data and interface call data, sorting them according to the time of operation, and obtaining the operation action sequence; dividing the same marketing business cycle into multiple time segments, counting the number of access records and the number of interface calls in each time segment, and obtaining the access time distribution; and normalizing and organizing the access count, called interfaces, operation action sequence, and access time distribution to generate the access behavior status. Based on the permission configuration data, the access subject's access scope, interface call scope, and shared export scope for marketing data are extracted and matched with the actual access records to generate a permission adaptation status. The generation of permission adaptation status specifically includes: reading the authorized data type, authorized call interface, and authorized sharing export method of the access subject based on permission configuration data to form the data type access scope, interface call scope, and sharing export scope of the access subject; extracting the actual marketing data type and access time accessed by the access subject from access audit data, extracting the actual interface name and call time called by the access subject from interface call data, and extracting the actual sharing operation, export operation, and related data type executed by the access subject from data sharing export data; matching the actual accessed marketing data type with the data type access scope item by item, matching the actual called interface name with the interface call scope item by item, and matching the actual executed sharing operation and export operation with the sharing export scope item by item; marking records that do not exceed the permission scope as permission adapted, and marking records that exceed the data type access scope, interface call scope, or sharing export scope as permission incompatible; generating permission adaptation status according to the distribution of permission adapted and incompatible records of the same access subject within the same marketing business cycle; Based on data sharing, export data and extract data flow data, extract the flow order of marketing data between different calling interfaces and flow nodes, and generate the flow path status; The generation of the flow path status specifically includes: reading the data identifier, shared export time, shared export initiator, shared export recipient, shared export method, and calling interface of marketing data based on data sharing and export data; reading the entry time, exit time, node name, flow direction, and next flow node of the same data identifier in each flow node based on data flow data; aggregating the shared export data and data flow data according to the same data identifier, sorting the shared export time, calling interface, flow node, entry time, and exit time in chronological order to generate the flow sequence of a single piece of marketing data; connecting and organizing adjacent calling interfaces and adjacent flow nodes in the flow sequence to obtain the path segments of marketing data from the shared export initiation position to the receiving position; counting the number of path segments, flow nodes, cross-node flow times, and shared export times of the same data identifier within the same marketing business cycle, marking records of flow direction interruption, node repetition and return, and continued diffusion after shared export; and generating the flow path status based on the number of path segments, the number of flow nodes, the number of cross-node flow times, the number of shared export times, and the marking results. Data sensitivity, access behavior status, permission adaptation status, and flow path status are vectorized and encoded to generate marketing risk element vectors.

[0020] In this embodiment, the behavioral baseline modeling module includes: The marketing risk element vectors are grouped according to the access subject and marketing business cycle, and the access frequency, API calls, operation actions, access time distribution, permission adaptation status and flow path status of the same access subject in the same marketing business cycle are extracted. Statistical aggregation of access counts within the same group generates an access count baseline; Count the number of times each API call occurs and organize the API range within the same group to generate a API call baseline. The operations within the same group are organized in chronological order of occurrence to generate an operation baseline; Perform time segment statistics on the access time distribution within the same group to generate an access time distribution benchmark; The benchmarks for access frequency, API call, operation actions, and access time distribution are combined according to the access subject and marketing business cycle to construct a marketing access behavior benchmark.

[0021] In this embodiment, the risk heterogeneity graph construction module includes: Read the encoded content associated with the access subject, marketing data, calling interface, flow node and marketing business cycle in the marketing risk element vector, and map the access subject, marketing data, calling interface and flow node into different types of graph nodes respectively; Access connection edges are established based on the access records of the same user subject to marketing data within the same marketing business cycle; interface call edges are established based on the access records of the user subject to API calls; and path flow edges are established based on the flow order of marketing data between different flow nodes. Specifically, taking the marketing business cycle as the group unit, access records of the same user subject to the same marketing data are read from the access audit data. The graph node corresponding to the user subject is used as the edge starting point, and the graph node corresponding to the marketing data is used as the edge ending point. Access connection edges are generated according to the access time, access frequency, and operation actions. The API call records of the same user subject to API calls are read from the API call data. The graph node corresponding to the access subject is used as the starting point of the edge, and the graph node corresponding to the calling interface is used as the ending point of the edge. Interface call edges are generated according to the interface call time, number of interface calls, and interface call actions. The flow order of the same marketing data through different flow nodes is read from the data flow data. The graph node corresponding to the previous flow node is used as the starting point of the edge, and the graph node corresponding to the next flow node is used as the ending point of the edge. Path flow edges are generated sequentially according to the flow occurrence time and flow direction. Edges with the same starting point, the same ending point, and the same edge type within the same marketing business cycle are merged. The merged access connection edges, interface call edges, and path flow edges are written into the marketing data security risk heterogeneous graph. The process involves writing data sensitivity to the graph nodes corresponding to the marketing data, writing permission adaptation status to access connection edges and interface call edges, and writing flow path status to path flow edges. Specifically, it reads data sensitivity, permission adaptation status, and flow path status from the marketing risk element vector; searches for marketing data graph nodes based on the data identifier of the marketing data, converts data sensitivity into node attribute values, and writes them into the risk attribute field of the marketing data graph node; searches for access connection edges based on the access subject, marketing data, and marketing business cycle, converts permission adaptation status into access permission attribute values, and writes them into the permission attribute field of the access connection edge; searches for interface call edges based on the access subject, calling interface, and marketing business cycle, converts permission adaptation status into interface permission attribute values, and writes them into the permission attribute field of the interface call edge; searches for path flow edges based on marketing data, flow nodes, and marketing business cycle, converts flow path status into path attribute values, and writes them into the flow attribute field of the path flow edge; marks graph nodes and edges that do not match data sensitivity, permission adaptation status, or flow path status with null values, and performs attribute consistency checks on graph nodes and edges that have completed attribute writing. This process involves matching marketing access behavior benchmarks with the access behavior status of the same accessing entity in the marketing risk element vector, and writing the matching results into the graph nodes and access connection edges corresponding to the accessing entity to construct a heterogeneous graph of marketing data security risks. Specifically, it extracts the access frequency benchmark, API call benchmark, operation action benchmark, and access time distribution benchmark from the marketing access behavior benchmark; reads the access behavior status of the same accessing entity within the same marketing business cycle from the marketing risk element vector, and extracts the access frequency, API call, operation action, and access time distribution; calculates the difference between the access frequency and the access frequency benchmark, matches the API call with the API call benchmark within a range, matches the operation action with the operation action benchmark in sequence, and matches the access time distribution with the access time distribution benchmark in segments to generate matching results; finds the accessing entity graph node according to the accessing entity, and writes the matching results into the behavior attribute field of the accessing entity graph node; finds the access connection edge according to the accessing entity, marketing data, and marketing business cycle, and writes the matching results into the behavior deviation attribute field of the access connection edge; and organizes the graph nodes and edges that have been written with data sensitivity, permission adaptation status, flow path status, and matching results to construct a heterogeneous graph of marketing data security risks.

[0022] In this embodiment, the meta-path risk assessment module includes: The heterogeneous graph of marketing data security risks is input into the permission-constrained MAGNN network. The permission-constrained MAGNN network includes a graph input construction layer, a risk meta-path construction layer, a meta-path aggregation layer, an inter-path attention fusion layer, a permission constraint gating layer, and a risk representation output layer. The improvements to the permission-constrained MAGNN network are specifically reflected in the following aspects: The original MAGNN network's general heterogeneous graph input is replaced with a marketing data security risk heterogeneous graph input, introducing data sensitivity, permission adaptation status, and flow path status into the graph input construction layer; the original MAGNN network's general meta-path construction method is replaced with a data access meta-path, interface call meta-path, and flow transmission meta-path construction method oriented towards marketing data security risk assessment; the original MAGNN network's meta-path intra-node aggregation is replaced with meta-path intra-aggregation involving graph nodes, access connection edges, interface call edges, and path flow edges; in the inter-path attention fusion layer, weighted fusion is performed according to the contribution of different risk meta-paths to marketing data security risks; and a permission constraint gating layer is added before the original MAGNN network output, performing gating modulation on the fused risk representation based on the permission adaptation status to generate a permission constraint risk representation. This study uses standardized marketing security datasets and anomaly alert data from multiple marketing business cycles as training data sources. A risk element encoding module processes the standardized marketing security datasets to generate training marketing risk element vectors. A behavioral baseline modeling module constructs training marketing access behavior baselines based on these vectors. A risk heterogeneous graph construction module builds a training marketing data security risk heterogeneous graph based on the training marketing risk element vectors and the training marketing access behavior baselines. Anomaly alert data is used to annotate graph nodes, access connection edges, interface call edges, and path flow edges in the training marketing data security risk heterogeneous graph, generating training and validation graph samples. The training graph samples are input into a permission-constrained MAGNN network, sequentially passing through a graph input construction layer, a risk meta-path construction layer, a meta-path aggregation layer, an inter-path attention fusion layer, a permission constraint gating layer, and a risk representation output layer to generate a marketing data security risk representation for the training phase. Based on the marketing data security risk representation for the training phase, a training risk score and training risk type are output, and the network parameters are updated in reverse according to the risk score annotation, risk type annotation, and permission adaptation status. The training parameters were set as follows: node embedding dimension of 128, meta-path embedding dimension of 128, number of attention heads between paths of 4, permission constraint gating coefficient of 0.6, learning rate of 0.001, batch size of 32, training epochs of 100, and weight decay coefficient of 0.0005. The updated network parameters were validated using validation graph samples. When the output results of training risk scores and training risk types reached a stable state, the trained permission constraint MAGNN network was obtained. In the graph input construction layer, the graph nodes, access connection edges, interface call edges, path flow edges, data sensitivity, permission adaptation status and flow path status in the heterogeneous graph of marketing data security risk are read, and the graph nodes and graph edges are feature-encoded to generate heterogeneous graph input features. In the risk meta-path construction layer, data access meta-paths, interface call meta-paths, and flow transmission meta-paths are constructed based on access connection edges, interface call edges, and path flow edges. Meta-path input features are extracted from the heterogeneous graph input features according to the graph nodes and graph edges traversed by each meta-path. The specific processing of the risk meta-path construction layer is as follows: Based on the start and end points of the access connection edges, the connection order between access subject graph nodes and marketing data graph nodes is determined from the marketing data security risk heterogeneous graph. Access subject graph nodes, access connection edges, and marketing data graph nodes are combined to form data access path segments. These data access path segments are then merged according to the same access subject or the same marketing data within the same marketing business cycle to construct the data access meta-path. Similarly, based on the start and end points of the interface call edges, the connection order between access subject graph nodes and call interface graph nodes is determined. Access subject graph nodes, interface call edges, and call interface graph nodes are combined to form interface call path segments. These segments are then merged according to the same access subject or the same marketing data within the same marketing business cycle to construct the data access meta-path. During the period, interface call path segments with the same access subject or the same calling interface are merged to construct interface call meta-paths; according to the starting point, ending point, and occurrence time of the path flow edges, the sequential connection order between flow nodes is determined, and continuous path flow edges are connected to form flow path segments. These flow path segments are then merged according to the flow order of the same marketing data within the same marketing business cycle to construct flow transmission meta-paths; based on the graph nodes and edges traversed by the data access meta-path, interface call meta-path, and flow transmission meta-path, the feature content of the same graph nodes and edges is extracted from the heterogeneous graph input features. These features are then organized according to the node arrangement order and edge connection order in the meta-path to generate meta-path input features; In the meta-path aggregation layer, node feature aggregation and edge feature aggregation are performed on the meta-path input features in the data access meta-path, interface call meta-path, and flow transmission meta-path to generate meta-path risk representation. The specific processing of the meta-path aggregation layer is as follows: Meta-path input features are read according to the path types of data access meta-paths, interface call meta-paths, and flow transmission meta-paths. The feature content of graph nodes is extracted based on the node arrangement order in each meta-path. The feature content of graph nodes is aggregated according to the connection order of adjacent graph nodes within the same meta-path to generate node aggregation results. The feature content of access connection edges, interface call edges, and path flow edges is extracted according to the edge connection order in each meta-path. The feature content of graph edges is aggregated according to edge occurrence time, edge connection direction, and the path type to which the edge belongs to generate edge aggregation results. The node aggregation results and edge aggregation results within the same meta-path are concatenated and normalized according to the path types of data access meta-paths, interface call meta-paths, and flow transmission meta-paths to generate risk representations for data access meta-paths, interface call meta-paths, and flow transmission meta-paths, respectively. Finally, the risk representations for data access meta-paths, interface call meta-paths, and flow transmission meta-paths are organized into a meta-path risk representation. In the inter-path attention fusion layer, the risk representations of each meta-path are weighted and fused to generate a fused risk representation. The specific processing of the inter-path attention fusion layer is as follows: Data access meta-path risk representation, interface call meta-path risk representation, and flow transmission meta-path risk representation are mapped to the same feature dimension; feature components related to data sensitivity, permission adaptation status, and flow path status are extracted from the three types of meta-path risk representations; linear transformation and non-linear activation are performed on the feature components of each type of meta-path risk representation to generate data access meta-path attention scores, interface call meta-path attention scores, and flow transmission meta-path attention scores; the three types of meta-path attention scores are normalized to generate data access meta-path weights, interface call meta-path weights, and flow transmission meta-path weights; the data access meta-path risk representation is weighted using the data access meta-path weights, the interface call meta-path risk representation is weighted using the interface call meta-path weights, and the flow transmission meta-path risk representation is weighted using the flow transmission meta-path weights; the weighted three types of meta-path risk representations are then concatenated and compressed to generate a fused risk representation. In the permission constraint gating layer, permission constraint gating coefficients are generated based on the permission adaptation state. The permission constraint gating coefficients are then used to modulate the fusion risk representation to generate a permission constraint risk representation. The specific processing of the permission constraint gating layer is as follows: Read the fusion risk representation and the permission adaptation status associated with the access connection edge and interface call edge; convert the permission adaptation status into permission constraint values ​​according to three results: permission adaptation, permission mismatch, and permission missing; aggregate the permission constraint values ​​under the same access subject, the same marketing data, and the same marketing business cycle to obtain a permission constraint sequence; map the permission constraint sequence to the same feature dimension as the fusion risk representation to generate permission constraint gating coefficients; multiply the permission constraint gating coefficients bit by bit with each feature component in the fusion risk representation, maintaining the original response for feature components with a permission adaptation status of permission adaptation, and enhancing the risk response for feature components with a permission mismatch or permission missing status; normalize the modulated fusion risk representation to generate a permission constraint risk representation. In the risk representation output layer, the risk representation of permission constraints is mapped to generate a marketing data security risk representation.

[0023] In this embodiment, the risk transmission correction module includes: The marketing data security risk representation is split into node-dimensional and edge-dimensional components to obtain the risk representation components of each graph node and each graph edge. Based on the connection order of access connection edge, interface call edge and path flow edge, the risk representation components that are continuously distributed within the same marketing business cycle are connected by path to generate candidate risk transmission paths. The generation of candidate risk transmission paths is as follows: Read the starting point graph node, ending point graph node, and occurrence time of each graph edge within the same marketing business cycle; using the access connection edge as the starting edge, determine the access order between the access subject graph node and the marketing data graph node; when the ending point graph node of the access connection edge matches the starting point graph node of the interface call edge or path flow edge, connect the access connection edge to the subsequent interface call edge or path flow edge; when the ending point graph node of the path flow edge matches the starting point graph node of the next path flow edge, continue connecting according to the occurrence time to form a continuous edge sequence; extract the risk representation components of the graph nodes and edges traversed by the continuous edge sequence from the marketing data security risk representation, arrange them according to the connection order of the continuous edge sequence, and bind the arranged risk representation components to the continuous edge sequence to generate candidate risk transmission paths; Continuity detection is performed on the risk representation components in the candidate risk transmission path to determine the risk transmission path; The generation of risk transmission paths specifically includes: reading the connection order, occurrence time, path type, and graph nodes traversed in the continuous edge sequence of each candidate risk transmission path; checking whether there are common endpoint and starting graph nodes among adjacent access connection edges, interface call edges, and path flow edges; retaining path segments where graph nodes can be continuously connected; performing time sequence checks on the retained path segments according to the occurrence time, and eliminating path segments with reversed time sequence or time intervals exceeding the same marketing business cycle; extracting the risk representation components of graph nodes and graph edges in each path segment, and checking whether the risk representation components maintain a continuous distribution among adjacent graph nodes and adjacent graph edges; and determining the candidate risk transmission path that simultaneously satisfies the requirements of graph node connectivity, consistent time sequence, and continuous distribution of risk representation components as the risk transmission path. Risk representation components that are only distributed on a single access connection edge and do not continue along the interface call edge and path flow edge are isolated and marked to generate isolated risk responses; The generation of isolated risk responses specifically includes: reading risk representation components that are not identified as risk transmission paths; extracting the graph edge type, access subject graph node, marketing data graph node, and marketing business cycle of the risk representation component; retaining risk representation components whose graph edge type is an access connection edge, and using the access subject graph node, marketing data graph node, and marketing business cycle as matching conditions, finding interface call edges and path flow edges connected to the access connection edge within the same marketing business cycle; when the access connection edge is not connected to an interface call edge, or there are no continuous risk representation components of the same marketing data in the connected interface call edges and path flow edges, marking the risk representation component as a risk representation component generated by a single access; comparing the risk representation components generated by a single access with the identified risk transmission paths using graph node indexing and graph edge indexing, and removing risk representation components already included in the risk transmission paths; writing the remaining risk representation components into the isolated marker, aggregating them according to the access subject, marketing data, and marketing business cycle to generate isolated risk responses; The isolated risk response is separated from the marketing data security risk representation, and the marketing data security risk representation is updated based on the continuous risk representation components in the risk transmission path to generate a corrected risk representation.

[0024] In this embodiment, the traceability result output module includes: Read the corrected risk representation and extract the data sensitivity, permission adaptation status, flow path status, risk transmission path, access behavior status, and isolated risk response from the corrected risk representation; Data risk components are determined based on data sensitivity, permission risk components based on permission adaptation status, flow risk components based on flow path status and risk transmission path, and behavioral risk components based on access behavior status and isolated risk responses. Specifically, based on the distribution of highly sensitive, business-sensitive, and non-sensitive fields in data sensitivity, the data exposure level of marketing data is organized into data risk components. Based on the marking of permission adaptation, permission mismatch, and permission missing in permission adaptation status, records exceeding the data type access range, interface call range, or shared export range in access connection edges and interface call edges are extracted, and permission exceedance situations are organized into permission risk components. Based on the number of path segments, the number of flow nodes, and the number of cross-node flow times in flow path status, combined with the access connection edges, interface call edges, and path flow edges traversed by the risk transmission path, flow risk components are organized into components. Based on the distribution of access times, interface calls, operation actions, and access time in access behavior status, combined with the marking of isolated risk responses, behavioral risk components are organized into components. The data risk component, access risk component, flow risk component, and behavior risk component are weighted and sorted to generate a marketing data security risk score; The generation of the marketing data security risk score is as follows: The data risk component, access control risk component, data transfer risk component, and behavioral risk component are normalized to a numerical range of 0 to 1, resulting in normalized values ​​for data risk, access control risk, data transfer risk, and behavioral risk; the weights for data risk, access control risk, data transfer risk, and behavioral risk are set to 0.25, 0.30, 0.30, and 0.15, respectively; the normalized data risk value is then multiplied by its corresponding data risk weight to obtain the data risk score. Weighting: Multiply the normalized value of permission risk by the permission risk weight to obtain the permission risk weighted value; multiply the normalized value of circulation risk by the circulation risk weight to obtain the circulation risk weighted value; multiply the normalized value of behavior risk by the behavior risk weight to obtain the behavior risk weighted value; sum the data risk weighted value, permission risk weighted value, circulation risk weighted value, and behavior risk weighted value to obtain the comprehensive risk normalized value; multiply the comprehensive risk normalized value by 100 to generate a marketing data security risk score ranging from 0 to 100. The marketing data security risk score is matched with risk level classification criteria to generate a risk level. The risk level classification criteria are as follows: when the marketing data security risk score is between 0 and 30, a low risk level is generated; when the marketing data security risk score is between 30 and 60, a medium risk level is generated; when the marketing data security risk score is between 60 and 80, a high risk level is generated; and when the marketing data security risk score is between 80 and 100, a severe risk level is generated. Risk types are determined based on permission adaptation status, workflow status, access behavior status, and the triggering of risk transmission paths. The risk type is determined as follows: When there is permission mismatch or missing permissions in the permission adaptation state, and it involves access connection edge or interface call edge, the risk type is determined as permission overstepping risk; when there is abnormal cross-node flow count or flow direction interruption in the flow path state, and this state is located in the risk transmission path, the risk type is determined as flow diffusion risk; when there is a concentrated increase in the number of accesses, abnormal changes in the call interface, abnormal operation sequence, or abnormal distribution of access time in the access behavior state, and no continuous risk transmission path is formed, the risk type is determined as abnormal access risk; when the data sensitivity characterization marketing data contains highly sensitive fields, and there is simultaneously permission mismatch, abnormal flow path state, or continued risk transmission path, the risk type is determined as sensitive data exposure risk. A risk tracing path is generated based on the access subjects, marketing data, API calls, and transfer nodes along the risk transmission path; The risk tracing path is generated as follows: Following the connection order of the risk transmission path, the access subject graph nodes, marketing data graph nodes, API call graph nodes, and flow nodes traversed by the risk transmission path are read sequentially. The node identifier, node type, occurrence time, and corresponding marketing business cycle of each graph node are extracted. The access subject graph nodes are recorded as the risk initiation location, the marketing data graph nodes as the risk-related data, the API call graph nodes as the risk invocation stage, and the flow nodes as the risk flow stage. The risk initiation location, risk-related data, risk invocation stage, and risk flow stage are connected in sequence according to the access connection edge, API call edge, and path flow edge to generate a risk tracing chain. Data sensitivity, permission adaptation status, flow path status, and risk type are written into the risk tracing chain to form a risk tracing path containing the risk source, risk-related data, risk occurrence stage, and risk flow destination. The marketing data security risk score, risk level, risk type, and risk tracing path are associated and encapsulated to output the marketing data security risk assessment results.

[0025] Example 1: To verify the feasibility of this invention in practice, it was applied to the marketing data security management scenario of a large retail enterprise's marketing operations center. This enterprise simultaneously runs a membership management system, an online store, an advertising platform, a channel conversion platform, and a data analysis platform. Marketing personnel, data analysts, channel operations personnel, and system interfaces frequently access customer basic data, customer transaction data, customer tag data, marketing activity data, advertising data, and channel conversion data in their daily operations. Due to the obvious cyclical nature of marketing activities, data access volume, interface call frequency, and sharing / export behavior all change during the pre-launch, official launch, customer outreach, conversion tracking, and performance statistics phases. Existing security management methods primarily rely on manual review of permission configuration checks and abnormal alarm records. While this can detect some unauthorized accesses and abnormal exports, it is difficult to determine whether a particular access aligns with the current marketing cycle, or whether data continues to spread to other flow nodes after entering the channel system from the interface call. This results in security personnel needing to repeatedly review access audit data, interface call data, data sharing and export data, and data flow data when handling risk events, making risk source identification insufficiently direct.

[0026] In this scenario, the standardized marketing security dataset consists of customer basic data, customer transaction data, customer tag data, marketing activity data, advertising placement data, channel conversion data, marketing data catalog, access audit data, permission configuration data, interface call data, data sharing and export data, data flow data, and anomaly alarm data. Data generated by the marketing operations center within a complete marketing campaign cycle is integrated into the system of this invention. The data fusion processing module performs field standardization, duplicate data removal, missing field completion, anomaly record filtering, timestamp unification, data type labeling, business cycle division, and dimensional normalization on the collected data to generate the standardized marketing security dataset. The risk element encoding module extracts data sensitivity, access behavior status, permission adaptation status, and flow path status from the standardized marketing security dataset and generates a marketing risk element vector. The behavior benchmark modeling module aggregates the marketing risk element vector according to the access subject and marketing business cycle to form a marketing access behavior benchmark. The risk heterogeneity graph construction module maps the access subject, marketing data, interface call, and flow nodes as graph nodes and writes access connection edges, interface call edges, and path flow edges into the marketing data security risk heterogeneity graph. The meta-path risk assessment module inputs a heterogeneous graph of marketing data security risks into the permission-constrained MAGNN network, generating a marketing data security risk representation around the data access meta-path, interface call meta-path, and flow transmission meta-path. The risk transmission correction module identifies risk transmission paths, distinguishing between risks that continuously spread along interface calls and path flows and isolated risk responses caused by a single abnormal access, generating a corrected risk representation. The traceability result output module outputs a marketing data security risk score, risk level, risk type, and risk traceability path based on the corrected risk representation.

[0027] In practical applications, marketing operations personnel often query customer tag data and channel conversion data during campaign launches. Such access is easily flagged as high-frequency anomalies in traditional security audits. This invention does not directly judge risk based on the number of accesses, but rather combines the access behavior benchmark of the accessing entity within the same marketing business cycle to make a holistic judgment on the number of accesses, API calls, actions, and access time distribution. For access behaviors consistent with the business patterns of the campaign launch phase, even with high access frequency, the system can reduce false positives by matching the access behavior status with the marketing access behavior benchmark. For cases where an accessing entity calls customer basic data outside of peak business processing periods, and the API call is not within the authorized scope of the permission configuration data, the system can write the permission adaptation status into the access connection edge and API call edge, and enhance the response of such risks in the marketing data security risk representation through the permission constraint MAGNN network, allowing security personnel to directly see the risk involving the accessing entity, marketing data, and API call.

[0028] Table 1. Performance Comparison of the Invention Method and Traditional Marketing Data Security Risk Assessment Method

[0029] As shown in Table 1, the method of this invention achieves a risk identification accuracy of 89.2%, while the traditional method achieves 84.7%. Traditional methods, in the stages of concentrated marketing campaign deployment, batch retrieval of customer tags, and channel conversion statistics, tend to confuse normal high-frequency business visits with abnormal visits. This invention models the normal access behavior of the accessing entity within the marketing business cycle using a marketing access behavior benchmark, thus enabling a more accurate distinction between normal marketing visits and abnormal risk visits.

[0030] Regarding the false positive rate, the traditional method has a false positive rate of 15.6%, while the method of this invention reduces it to 11.8%. This change mainly stems from the coordination between the behavioral baseline modeling module and the risk transmission correction module. For concentrated queries, batch API calls, or phased export behaviors occurring during marketing campaigns, if the distribution of access frequency, API calls, actions, and access times matches the marketing access behavior baseline of the accessing subject within the corresponding marketing business cycle, this invention will not directly treat them as high-risk events. For risk representation components generated solely by a single abnormal access that do not extend further along the API call edge and path flow edge, this invention will also correct them through isolated risk responses, thereby reducing false positives caused by normal business fluctuations.

[0031] Regarding the false negative rate, the traditional method has a false negative rate of 12.4%, while the method of this invention reduces it to 9.1%. Traditional methods typically focus more on whether a single access is unauthorized or whether a single log entry is abnormal, easily overlooking the continuous risks formed by marketing data continuing to circulate after being shared and exported, cross-interface calls, or cross-node diffusion. This invention organizes the access subject, marketing data, calling interfaces, and flow nodes into a graph structure through a risk heterogeneous graph construction module, and expresses the access, calling, and flow process of marketing data through access connection edges, interface call edges, and path flow edges. This allows risk information that was originally scattered across multiple types of logs to be continuously correlated, thus reducing false negatives.

[0032] Regarding the consistency rate of risk levels, the method of this invention achieves 86.3%, higher than the 80.9% of the traditional method. The improved consistency rate is due to the fact that the risk score of this invention is not directly determined by a single anomaly, but rather by a weighted average of data risk components, permission risk components, flow risk components, and behavioral risk components. This avoids a single log anomaly directly causing an excessively high risk level, and also prevents sensitive data from being underestimated in cases of incompatible permissions or continuous flow, thus making the risk level closer to the actual security risk.

[0033] Regarding the risk identification rate across nodes, the traditional method achieves 74.8%, while the method of this invention achieves 82.6%. This metric reflects the adaptability of this invention to marketing data sharing and export scenarios and cross-channel flow scenarios. Traditional methods can typically record data sharing and export behavior, but they are insufficient in expressing the continuous relationship between subsequent flow nodes, flow direction, and calling interfaces after sharing and export. This invention generates flow path states based on data sharing and export data and data flow data, and constructs flow transmission meta-paths in the permission-constrained MAGNN network, enabling the risk changes of marketing data from sharing and export to subsequent flow nodes to be included in the assessment.

[0034] Regarding the completeness of the risk tracing path, the method of this invention achieves 84.1%, while the traditional method achieves 73.5%. This improvement mainly stems from the risk transmission path and tracing result output modules. Traditional methods often only output abnormal alarms or risk levels, requiring manual searching for correlations between access audit data, interface call data, data sharing exported data, and data flow data. This invention can generate a risk tracing path based on the access subjects, marketing data, call interfaces, and flow nodes traversed in the risk transmission path, enabling the risk source, involved data, call links, and flow destination to be reflected in the same result.

[0035] Regarding the average risk location time, the traditional method takes 16.8 minutes per log entry, while the method of this invention reduces it to 11.2 minutes per log entry. This is because the system has already completed risk element coding, heterogeneous graph association, meta-path assessment, and risk tracing path generation during the risk assessment phase. Security personnel do not need to rely entirely on manual methods to reassemble the log chain; instead, they can directly verify the output risk tracing path.

[0036] The above are merely preferred embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A marketing data security risk assessment system based on big data analytics, characterized in that, include: The data fusion and processing module is used to collect marketing data and security-related data, preprocess the collected data, and generate a standardized marketing security dataset. The risk element coding module is used to extract data sensitivity, access behavior status, permission adaptation status and flow path status based on a standardized marketing security dataset, and then perform vectorized coding to generate a marketing risk element vector. The behavioral benchmark modeling module is used to aggregate marketing risk factor vectors based on the access subject and marketing business cycle to construct marketing access behavior benchmarks; The risk heterogeneity graph construction module is used to construct a marketing data security risk heterogeneity graph based on marketing risk element vectors and marketing access behavior benchmarks. The meta-path risk assessment module is used to input the heterogeneous graph of marketing data security risks into the permission constraint MAGNN network to generate a representation of marketing data security risks. The risk transmission correction module is used to identify risk transmission paths based on the marketing data security risk representation, correct isolated risk responses caused by a single abnormal access, and generate a corrected risk representation. The traceability result output module is used to generate marketing data security risk scores, risk levels, risk types, and risk traceability paths based on the corrected risk representation, and output marketing data security risk assessment results.

2. The marketing data security risk assessment system based on big data analysis according to claim 1, characterized in that, The marketing data includes customer basic data, customer transaction data, customer tag data, marketing activity data, advertising placement data, channel conversion data, and marketing data catalog. The security-related data includes access audit data, permission configuration data, interface call data, data sharing and export data, data flow data, and abnormal alarm data. The preprocessing includes field standardization, duplicate data removal, missing field completion, abnormal record filtering, timestamp unification, data type labeling, business cycle division, and unit normalization processing.

3. The marketing data security risk assessment system based on big data analysis according to claim 1, characterized in that, The risk factor coding module includes: Based on a standardized marketing security dataset, data type labels and field content tags corresponding to marketing data are extracted from the marketing data catalog to generate data sensitivity levels. Based on access audit data and API call data, extract the number of accesses, API calls, actions, and access time distribution of the access subject within the same marketing business cycle, and organize the number of accesses, API calls, actions, and access time distribution to generate access behavior status; Based on the permission configuration data, the access subject's access scope, interface call scope, and shared export scope for marketing data are extracted and matched with the actual access records to generate a permission adaptation status. Based on data sharing, export data and extract data flow data, extract the flow order of marketing data between different calling interfaces and flow nodes, and generate the flow path status; Data sensitivity, access behavior status, permission adaptation status, and flow path status are vectorized and encoded to generate marketing risk element vectors.

4. The marketing data security risk assessment system based on big data analysis according to claim 1, characterized in that, The behavioral benchmark modeling module includes: The marketing risk element vectors are grouped according to the access subject and marketing business cycle, and the access frequency, API calls, operation actions, access time distribution, permission adaptation status and flow path status of the same access subject in the same marketing business cycle are extracted. Statistical aggregation of access counts within the same group generates an access count baseline; Count the number of times each API call occurs and organize the API range within the same group to generate a API call baseline. The operations within the same group are organized in chronological order of occurrence to generate an operation baseline; Perform time segment statistics on the access time distribution within the same group to generate an access time distribution benchmark; The benchmarks for access frequency, API call, operation actions, and access time distribution are combined according to the access subject and marketing business cycle to construct a marketing access behavior benchmark.

5. A marketing data security risk assessment system based on big data analysis according to claim 1, characterized in that, The risk heterogeneity graph construction module includes: Read the encoded content associated with the access subject, marketing data, calling interface, flow node and marketing business cycle in the marketing risk element vector, and map the access subject, marketing data, calling interface and flow node into different types of graph nodes respectively; Access connection edges are established based on the access records of the access subjects to marketing data within the same marketing business cycle; interface call edges are established based on the call records of the access subjects to the calling interfaces; and path flow edges are established based on the flow order of marketing data between different flow nodes. Write the data sensitivity level into the graph node corresponding to the marketing data, write the permission adaptation status into the access connection edge and the interface call edge, and write the flow path status into the path flow edge. The marketing access behavior benchmark is matched with the access behavior status of the same access subject in the marketing risk element vector, and the matching results are written into the graph node and access connection edge corresponding to the access subject to construct a heterogeneous graph of marketing data security risks.

6. The marketing data security risk assessment system based on big data analysis according to claim 1, characterized in that, The meta-path risk assessment module includes: The heterogeneous graph of marketing data security risks is input into the permission-constrained MAGNN network. The permission-constrained MAGNN network includes a graph input construction layer, a risk meta-path construction layer, a meta-path aggregation layer, an inter-path attention fusion layer, a permission constraint gating layer, and a risk representation output layer. In the graph input construction layer, the graph nodes, access connection edges, interface call edges, path flow edges, data sensitivity, permission adaptation status and flow path status in the heterogeneous graph of marketing data security risk are read, and the graph nodes and graph edges are feature-encoded to generate heterogeneous graph input features. In the risk meta-path construction layer, data access meta-paths, interface call meta-paths, and flow transmission meta-paths are constructed based on access connection edges, interface call edges, and path flow edges. Meta-path input features are extracted from the heterogeneous graph input features according to the graph nodes and graph edges traversed by each meta-path. In the meta-path aggregation layer, node feature aggregation and edge feature aggregation are performed on the meta-path input features in the data access meta-path, interface call meta-path, and flow transmission meta-path to generate meta-path risk representation. In the inter-path attention fusion layer, the risk representations of each meta-path are weighted and fused to generate a fused risk representation. In the permission constraint gating layer, permission constraint gating coefficients are generated based on the permission adaptation state. The permission constraint gating coefficients are then used to modulate the fusion risk representation to generate a permission constraint risk representation. In the risk representation output layer, the risk representation of permission constraints is mapped to generate a marketing data security risk representation.

7. A marketing data security risk assessment system based on big data analysis according to claim 1, characterized in that, The risk transmission correction module includes: The marketing data security risk representation is split into node-dimensional and edge-dimensional components to obtain the risk representation components of each graph node and each graph edge. Based on the connection order of access connection edge, interface call edge and path flow edge, the risk representation components that are continuously distributed within the same marketing business cycle are connected by path to generate candidate risk transmission paths. Continuity detection is performed on the risk representation components in the candidate risk transmission path to determine the risk transmission path; Risk representation components that are only distributed on a single access connection edge and do not continue along the interface call edge and path flow edge are isolated and marked to generate isolated risk responses; The isolated risk response is separated from the marketing data security risk representation, and the marketing data security risk representation is updated based on the continuous risk representation components in the risk transmission path to generate a corrected risk representation.

8. A marketing data security risk assessment system based on big data analysis according to claim 1, characterized in that, The traceability result output module includes: Read the corrected risk representation and extract the data sensitivity, permission adaptation status, flow path status, risk transmission path, access behavior status, and isolated risk response from the corrected risk representation; Data risk components are determined based on data sensitivity, permission risk components are determined based on permission adaptation status, flow risk components are determined based on flow path status and risk transmission path, and behavior risk components are determined based on access behavior status and isolated risk response. The data risk component, access risk component, flow risk component, and behavior risk component are weighted and sorted to generate a marketing data security risk score; The marketing data security risk score is matched with the risk level classification criteria to generate a risk level; Risk types are determined based on permission adaptation status, workflow status, access behavior status, and the triggering of risk transmission paths. A risk tracing path is generated based on the access subjects, marketing data, API calls, and transfer nodes along the risk transmission path; The marketing data security risk score, risk level, risk type, and risk tracing path are associated and encapsulated to output the marketing data security risk assessment results.

Images