AI-based data security protection test evaluation and risk control platform

Abstract

The application provides an AI-based data security equal protection test evaluation and risk control platform, relates to the technical field of equal protection evaluation, and comprises the following steps: constructing an equal protection control item three-level semantic deconstruction system to generate standard evidence vectors of each control item; collecting multi-source test data and extracting measured evidence vectors, calculating the matching degree of the two, and screening an illegal item set according to the matching degree; collecting the kernel micro-jitter time sequence of the measured asset by the bypass non-inductive method, aligning the illegal item observation window with the jitter time sequence in space and time, and calculating the disturbance sensitivity; calculating the disturbance correction coefficient based on the disturbance sensitivity; superimposing the asset basic vulnerability risk to obtain the asset real risk value; collecting the same dimension kernel jitter data after rectification based on the jitter baseline, the disturbance sensitivity and the asset real risk value, and calculating the rectification convergence degree; calculating the risk value after rectification in combination with the equal protection clause weight, dividing the rectification effectiveness level according to the preset threshold, and generating the treatment strategy.

Description

Technical Field

[0001] This invention relates to the field of information security compliance assessment technology, specifically an AI-based data security compliance testing, assessment, and risk management platform. Background Technology

[0002] Cybersecurity classification protection is a core system for network and data security governance in my country. Precise and dynamic classification protection assessment and risk management are key means to ensure the safe and compliant operation of business assets. Currently, traditional classification protection assessment and risk management methods in the industry have significant technical deficiencies, and their overall level of intelligence and refinement is insufficient.

[0003] Existing technologies largely rely on manual rule matching and static vulnerability checks, failing to provide a systematic and standardized analysis of compliance control items. When faced with multi-source assessment data, compliance matching accuracy is low, prone to omissions and misjudgments, and it's difficult to fully retain information on the timing of violations, severity levels, and asset ownership, making tracing and review challenging. Furthermore, traditional risk assessments, based solely on static vulnerability scoring, cannot capture hidden risks such as dynamic operational disturbances to assets caused by compliance deficiencies, resulting in significant discrepancies between assessment results and the actual security status. In addition, existing rectification and verification methods are crude, lacking quantitative convergence assessment standards, making the determination of rectification effectiveness vague, and lacking dynamic iteration capabilities for baseline and risk data. The handling strategies are highly generalized but poorly adaptable, failing to meet the current closed-loop and precise data security compliance management requirements. Summary of the Invention

[0004] (a) Technical problems to be solved To address the aforementioned technical issues, the present invention aims to provide an AI-based data security compliance testing and assessment and risk management platform, which can improve the accuracy of compliance testing and assessment and achieve precise risk management.

[0005] (II) Technical Solution To achieve the above objectives, the present invention provides the following technical solution: an AI-based data security compliance testing, assessment, and risk management platform, the platform comprising: The semantic parsing module constructs a three-level semantic deconstruction system for the information security level protection control items, generates standard evidence vectors for each control item, collects multi-source assessment data and extracts measured evidence vectors, calculates the matching degree between the two, classifies compliance status based on the matching degree, and filters out the set of non-compliant items and their corresponding detection timestamps, severity levels and related assets. The disturbance analysis module, based on the set of non-compliant items and the detection timestamp, bypasses and imperceptibly collects the kernel micro-jitter time series of the tested asset, constructs a normalized jitter feature vector, aligns the observation window of non-compliant items with the spatiotemporal jitter time series, and calculates the disturbance sensitivity; calculates the disturbance correction coefficient based on the disturbance sensitivity to correct the inherent risk component of non-compliant items; and superimposes the asset's basic vulnerability risk to obtain the asset's true risk value and stores the jitter baseline. The rectification verification module uses the jitter baseline, disturbance sensitivity, and actual asset risk value as benchmarks to collect kernel jitter data in the same dimension after rectification and calculate the rectification convergence. It also calculates the risk value after rectification by combining the weight of the information security clauses, classifies the rectification effectiveness level according to the preset threshold, generates disposal strategies, and iteratively updates the jitter baseline and asset risk data.

[0006] Preferably, the specific process for determining compliance status is as follows: Based on the hierarchical semantic decomposition of the information security standard clauses, a three-level semantic deconstruction system of parent clauses, sub-verification items, and evidence constraint dimensions is constructed to obtain the structured standard evidence vectors corresponding to each control item. Based on the collected multi-source evaluation raw data, the measured evidence vectors corresponding one-to-one with the evidence dimensions of each control item are extracted. Based on the cosine similarity calculation between the measured evidence vector and the standard evidence vector, the evidence source matching fit is obtained; Based on preset multi-level compliance thresholds, each control item is divided into four compliance states: fully compliant, highly compliant, lowly compliant, and non-compliant. A set of non-compliant control items is obtained by filtering, and the detection timestamp, inherent severity level, and asset identifier of each non-compliant item are obtained simultaneously.

[0007] Preferably, constructing a normalized jitter feature vector and aligning the observation window of non-compliant items with the spatiotemporal sequence of jitter includes: Runtime sequence data of the operating system kernel layer of the tested asset is collected in a bypass-free manner. Three types of raw micro-jitter sampling sequences are obtained by sampling at fixed sampling intervals: CPU instantaneous volatility, memory page replacement thrashing rate, and file handle short-term jitter frequency. Based on the linear normalization processing of the preset interval, amplitude mapping is performed on the three types of original micro-jitter sampling sequences to obtain the three-dimensional kernel jitter feature vector; Based on the detection timestamps of each non-compliant control item, a preset time window width is expanded forward and backward with the timestamp as the center to generate a sliding observation time window, thereby obtaining the event tag sequence of the corresponding non-compliant item; Based on window matching processing with a unified time axis, the event tag sequence is spatiotemporally aligned with the kernel jitter feature vector to obtain the time-series correlation analysis samples corresponding to each non-compliant item.

[0008] Preferably, the specific process for generating the true risk value of an asset is as follows: Based on the kernel jitter feature vector and the event tag sequence of the corresponding non-compliant items within the sliding observation time window, the covariance and variance of the two sets of sequences are calculated respectively. The compliance defect perturbation sensitivity of the corresponding non-compliance item is obtained by calculating the ratio of the covariance to the product of the square roots of the variances of the two sets of sequences. Based on the positive and negative values ​​of the sensitivity to compliance defect disturbances, the disturbance correction coefficients corresponding to each non-compliance item are obtained through piecewise calculation. The risk component of a single non-compliance control item is obtained by multiplying the disturbance correction factor with the inherent severity level of the corresponding non-compliance item. Based on the aggregation result of all non-compliant control risk components under the same asset, the basic vulnerability risk value of the corresponding asset is superimposed to obtain the true business risk value of the asset, and the kernel jitter feature vector of the current period is stored simultaneously as the historical jitter baseline.

[0009] The preferred method for calculating the convergence of the rectification is as follows: Based on the historical jitter baseline stored in history and the historical disturbance sensitivity of corresponding non-compliant items, a rectification judgment benchmark is constructed; Based on the kernel jitter data collected after rectification with the same sampling frequency and the same index dimension, the kernel jitter feature vector after rectification is obtained. Based on the deviation calculation and normalization of the kernel jitter feature vectors before and after rectification, the kernel jitter feature deviation degree is obtained; The rectification convergence degree of the corresponding non-compliant item is obtained by coupling the kernel jitter feature deviation degree and the historical disturbance sensitivity.

[0010] Preferably, the specific process for classifying the effectiveness level of rectification and the closed-loop iteration is as follows: Based on the comparison between the preset two-level convergence threshold and the numerical value of the rectification convergence, the rectification effectiveness level of the corresponding non-compliant item is obtained, including rectification qualified, rectification partially effective, and rectification invalid. Based on the coupled calculation of the constraint weight of the information security clause, the degree of rectification convergence and the true risk value of historical assets, the risk value of the assets after rectification is obtained. Based on different levels of rectification effectiveness, corresponding handling strategies are generated. For non-compliant items that have passed rectification, the kernel jitter feature vector after rectification is updated to a new jitter baseline, and the risk data of the corresponding assets is updated simultaneously.

[0011] The preferred disposal strategy involves the following specific process: Based on the comparison of the severity level of each non-compliance item with the corresponding disturbance sensitivity, mismatch scenarios where the paper risk does not match the actual disturbance capability are identified. Based on the judgment result that the severity level is higher than the preset high level threshold and the disturbance sensitivity is lower than the preset low sensitivity threshold, a high inherent low disturbance label is obtained, and the processing priority of the corresponding non-compliant item is downgraded. Based on the judgment result that the severity level is lower than the preset low level threshold and the disturbance sensitivity is higher than the preset high sensitivity threshold, a low inherent high disturbance label is obtained, and the processing priority of the corresponding non-compliant item is increased. Based on the preset grading threshold of the true risk value of the assets, the remaining non-compliant items are classified into risk levels, and differentiated disposal strategies are generated by combining the priority adjustment results.

[0012] This invention also provides an AI-based data security compliance testing and assessment and risk management method, which applies the aforementioned AI-based data security compliance testing and assessment and risk management platform.

[0013] The present invention also provides a computer-readable storage medium storing a computer program, which is executed by a processor to implement the above-mentioned AI-based data security compliance testing and risk management platform.

[0014] (III) Beneficial Effects Compared with the prior art, the beneficial effects of the present invention are: This invention constructs an intermediate parameter for evidence tracing and matching fit, thereby overcoming the coarse-grained and black-box deficiencies of traditional compliance assessments from the perspective of the judgment mechanism. Addressing the technical problems of existing information security compliance assessments that rely solely on shallow keyword semantic matching, cannot distinguish ambiguous compliance scenarios, and lack traceability of judgment criteria, this invention constructs a standardized evidence vector system by performing a three-level semantic deconstruction of information security compliance clauses—parent clauses, sub-verification items, and evidence constraint dimensions. Evidence tracing and matching fit is introduced as the core intermediate parameter for compliance judgment. This parameter is quantitatively calculated using the cosine similarity metric between measured evidence vectors and standard evidence vectors, transforming traditional qualitative compliance judgment into multi-dimensional quantitative matching. Based on this, a four-level refined compliance status classification is achieved, while simultaneously establishing a one-to-one mapping relationship between the judgment result and the original evidence dimensions. This fundamentally solves the problems of coarse-grained judgment in traditional assessments, inability to accurately distinguish some compliance scenarios, and the black-box nature of AI judgments, significantly improving the accuracy and interpretability of compliance judgments and strengthening the evidentiary force of assessment conclusions.

[0015] This invention establishes a core intermediate parameter for compliance defect disturbance sensitivity, thereby correcting the inherent distortion of static risk assessment from a quantitative perspective. Addressing the core pain point of existing risk assessments that rely solely on the direct summation of inherent severity levels and vulnerability scores for compliance items, failing to reflect the actual operational exploitability of defects, this invention introduces the implicit, underlying observation source of micro-jitter in system kernel resources, creating compliance defect disturbance sensitivity as a core intermediate parameter for risk quantification. This parameter is indirectly derived through spatiotemporal alignment of the non-compliance event time window with the kernel jitter sequence, based on the correlation calculation of covariance and variance. Serving as a technical bridge connecting surface-level compliance events and underlying operational characteristics, it achieves a mapping from paper-based compliance labels to actual operational disturbance capabilities. Based on this parameter, a segmented disturbance correction coefficient is constructed to dynamically correct the static inherent risk components before fusing the underlying vulnerability risk. This technically solves the risk mismatch problem of high-risk on paper but difficult to trigger in reality, and low-risk on paper but with exploitable pathways, ensuring that the risk quantification results deeply reflect the actual operating state of the system and significantly improving the objectivity and accuracy of risk assessment.

[0016] This invention proposes an intermediate parameter for the convergence degree of rectification deviation, constructing a dynamic closed loop for the entire risk lifecycle from a management and control perspective. Addressing the shortcomings of traditional information security compliance (ISC) management, which only outputs static rectification suggestions, relies on manual surface-level review, cannot identify false rectifications, and lacks a continuous iteration mechanism, this invention reuses the previously generated kernel jitter baseline and historical disturbance sensitivity to propose rectification deviation convergence degree as the core intermediate parameter for rectification verification. This parameter is calculated by coupling the relative deviation of kernel jitter characteristics before and after rectification with historical disturbance sensitivity. The convergence degree of the underlying system runtime is used to inversely determine the authenticity and effectiveness of rectification, breaking through the traditional surface-level judgment logic that only verifies configuration fields. Using this parameter as the core and combining it with the weights of ISC clauses to deduce risk regression results, differentiated handling strategies are generated at different levels, and security baselines and risk data are dynamically updated iteratively. Technically, this achieves implicit automated verification of rectification effects and continuous iteration of risk status, constructing a complete end-to-end risk control closed loop of assessment, evaluation, rectification, and review, enabling continuous optimization of risk management. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0018] Figure 1 This is a schematic diagram of an AI-based data security compliance testing, evaluation, and risk management platform.

[0019] Figure 2 This is a flowchart for determining compliance status. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be described in detail below. Obviously, the described embodiments are merely some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other implementation methods obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0021] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0022] Example 1

[0023] like Figure 1 As shown in the figure, this embodiment discloses an AI-based data security compliance testing, assessment, and risk management platform, the platform comprising: The semantic parsing module constructs a three-level semantic deconstruction system for the information security level protection control items, generates standard evidence vectors for each control item, collects multi-source assessment data and extracts measured evidence vectors, calculates the matching degree between the two, classifies compliance status based on the matching degree, and filters out the set of non-compliant items and their corresponding detection timestamps, severity levels and related assets. like Figure 2 As shown, in this embodiment, the specific process for determining compliance status is as follows: Based on the hierarchical semantic decomposition of the information security standard clauses, a three-level semantic deconstruction system of parent clauses, sub-verification items, and evidence constraint dimensions is constructed to obtain the structured standard evidence vectors corresponding to each control item. In this standard, the parent clause corresponds to a single control category item in the Cybersecurity Classified Protection 2.0 standard, the sub-verification items are the implementable inspection nodes after decomposing the parent clause, and the evidence constraint dimensions are the quantifiable evidence fields corresponding to each sub-verification item, including three dimensions: configuration item values, log retention duration, and permission configuration rules. Each dimension element in the standard evidence vector takes a value of 0 or 1, where 1 represents a mandatory constraint for compliance, and 0 represents a non-mandatory constraint. Taking the "Identity Authentication" control item of the Cybersecurity Classified Protection standard as an example, the decomposed standard evidence vector can be represented as follows: ,in Corresponding to password complexity requirements, Corresponding login failure handling mechanism Corresponding to two-factor authentication requirements, The corresponding account must be uniquely identified.

[0024] Based on the collected multi-source evaluation raw data, the measured evidence vectors corresponding one-to-one with the evidence dimensions of each control item are extracted. The multi-source assessment raw data covers four types of data sources: configuration snapshot files, vulnerability scan reports, system security logs, and permission audit records. During the extraction of experimental evidence vectors, a predefined mapping table between evidence constraint dimensions and data source fields is used to determine whether the experimental data meets the constraint requirements dimension by dimension. If it does, the corresponding dimension is assigned a value of 1; otherwise, it is assigned a value of 0, generating a vector with the same dimensions as the standard evidence vector. Type-based measured evidence vector .

[0025] Based on the cosine similarity calculation between the measured evidence vector and the standard evidence vector, the evidence source matching fit is obtained; The formula for calculating the fit of evidence tracing is as follows:

[0026] In the formula, For the dot product operation of two vectors, , These are the L2 norms of the measured evidence vector and the standard evidence vector, respectively. The range of values ​​is The closer the value is to 1, the higher the actual compliance level.

[0027] Based on preset multi-level compliance thresholds, each control item is divided into four compliance states: fully compliant, highly compliant, lowly compliant, and non-compliant. A set of non-compliant control items is obtained by filtering, and the detection timestamp, inherent severity level, and asset identifier of each non-compliant item are obtained simultaneously.

[0028] The preset multi-level fit threshold is specifically set as follows: Fully conform to the threshold. The high portion meets the threshold. The lower portion meets the threshold ;when It is determined to be completely consistent. The high portion is deemed to be in compliance. The lower part is deemed to be in compliance. It was determined to be non-compliant.

[0029] The disturbance assessment module, based on the set of non-compliant items and the detection timestamp, bypasses and imperceptibly collects the kernel micro-jitter time series of the tested asset, constructs a normalized jitter feature vector, aligns the observation window of non-compliant items with the spatiotemporal jitter time series, and calculates the disturbance sensitivity; based on the disturbance sensitivity, it calculates the disturbance correction coefficient to correct the inherent risk component of non-compliant items; and superimposes the asset's basic vulnerability risk to obtain the asset's true risk value and stores the jitter baseline. In this embodiment, constructing a normalized jitter feature vector and aligning the non-compliance observation window with the jitter temporal and spatial sequence includes: Runtime sequence data of the operating system kernel layer of the tested asset is collected in a bypass-free manner. Three types of raw micro-jitter sampling sequences are obtained by sampling at fixed sampling intervals: CPU instantaneous volatility, memory page replacement thrashing rate, and file handle short-term jitter frequency. Fixed sampling interval Set to 1 second, with a minimum baseline sampling duration of 300 seconds per group; the specific calculation rules for the three types of indicators are as follows: CPU instantaneous fluctuation rate: ,in Let t be the instantaneous CPU utilization rate. The CPU utilization rate is the arithmetic average of the CPU utilization rate during the stable operation period. The stable period is the operating interval in which the load fluctuation is less than 5% within 10 consecutive minutes. Memory page replacement turbulence The ratio of the total number of memory page swaps in and out within a 10-second window before and after time t to the window duration represents the severity of frequent memory page swapping. File handle short-term jitter frequency : The total number of file handle allocation and release operations within a 5-second window before and after time t, representing the degree of fluctuation in short-term allocation and release of system resources.

[0030] Based on the linear normalization processing of the preset interval, amplitude mapping is performed on the three types of original micro-jitter sampling sequences to obtain the three-dimensional kernel jitter feature vector; Linear normalization employs an extreme value normalization method to map each type of original jitter feature to... The formula for normalizing an interval in a single dimension is:

[0031] In the formula, The value of the original jitter feature of type k at time t is taken. These are the minimum and maximum values ​​of this type of feature over the entire sampling period, respectively. These are the normalized eigenvalues; the final 3D kernel jitter feature vector is represented as... Each element in the vector is a normalized value.

[0032] Based on the detection timestamps of each non-compliant control item, a preset time window width is expanded forward and backward with the timestamp as the center to generate a sliding observation time window, thereby obtaining the event tag sequence of the corresponding non-compliant item; Preset time window width The value is 30 seconds, meaning the sliding observation time window is... ,in The timestamp for the detection of the i-th non-compliance item; event tag sequence. Given a binary sequence, when the sampling time t falls within the sliding observation window, At other times The sequence sampling points correspond one-to-one with the sampling times of the kernel jitter feature vector.

[0033] Based on window matching processing with a unified time axis, the event tag sequence is spatiotemporally aligned with the kernel jitter feature vector to obtain the time-series correlation analysis samples corresponding to each non-compliant item.

[0034] During spatiotemporal alignment, the system's unified clock is used as a reference. Discrete sampling points with timestamp deviations greater than 0.5 seconds are removed to ensure that the number of sampling points in the event marker sequence and the kernel jitter feature vector are equal and that the time axis corresponds completely, forming a sequence with a length of [missing information]. Equal-length association analysis of sample sequences.

[0035] In this embodiment, the specific process for generating the true risk value of an asset is as follows: Based on the kernel jitter feature vector and the event tag sequence of the corresponding non-compliant items within the sliding observation time window, the covariance and variance of the two sets of sequences are calculated respectively. Covariance and variance are calculated using the statistical formula for discrete sequences: The equivalent scalar sequence of the window kernel jitter vector takes the magnitude of the three-dimensional features. The formula for calculating covariance is:

[0036] In the formula, N is the total number of sampling points within the window. The arithmetic mean of the dithering modulus values ​​within the window. The arithmetic mean of the event tag sequence within the window; Variance of kernel jitter modulus sequence Variance of event-marked sequences These represent the sample variances of the corresponding sequences.

[0037] The compliance defect perturbation sensitivity of the corresponding non-compliance item is obtained by calculating the ratio of the covariance to the product of the square roots of the variances of the two sets of sequences. The formula for calculating the sensitivity to compliance defect disturbances is as follows:

[0038] The range of values ​​is The closer the value is to +1, the stronger the positive correlation between non-compliant events and kernel jitter, and the higher the actual disturbance capability of the defect; a value close to 0 indicates no statistical correlation and low exploitability of the defect; a value less than 0 indicates a negative correlation and the defect triggering conditions are difficult to meet.

[0039] Based on the positive and negative values ​​of the sensitivity to compliance defect disturbances, the disturbance correction coefficients corresponding to each non-compliance item are obtained through piecewise calculation. Disturbance correction coefficient Calculation using piecewise functions:

[0040] Among them, the suppression small constant The value is set to 0.1, which is used to suppress the risk of negatively correlated non-compliance items on paper, and to avoid the invalid risk components from excessively interfering with the final evaluation results.

[0041] The risk component of a single non-compliance control item is obtained by multiplying the disturbance correction factor with the inherent severity level of the corresponding non-compliance item. The formula for calculating the risk component of a single non-compliant control item is as follows: ;in The inherent severity level of the control item is an integer ranging from 1 to 5, where 5 represents the highest severity level; j is the asset number to which the non-compliance item belongs.

[0042] Based on the aggregation result of all non-compliant control risk components under the same asset, the basic vulnerability risk value of the corresponding asset is superimposed to obtain the true business risk value of the asset, and the kernel jitter feature vector of the current period is stored simultaneously as the historical jitter baseline.

[0043] Ultimate Real Business Risk Value of Assets The calculation formula is:

[0044] In the formula, This is the set of all non-compliant control items belonging to asset j. The basic vulnerability risk value for this asset is obtained by aggregating CVSS vulnerability scores. The weighting coefficient for non-compliance risks under the information security compliance system is aggregated, with an empirically calibrated value of 0.8, used to balance the contribution ratio of vulnerability risk and compliance risk; the historical jitter baseline is the arithmetic mean sequence of kernel jitter feature vectors during stable operation periods, and the storage duration covers the entire business cycle.

[0045] The rectification verification module uses the jitter baseline, disturbance sensitivity, and actual asset risk value as benchmarks to collect kernel jitter data in the same dimension after rectification and calculate the rectification convergence. It also calculates the risk value after rectification by combining the weight of the information security clauses, classifies the rectification effectiveness level according to the preset threshold, generates disposal strategies, and iteratively updates the jitter baseline and asset risk data.

[0046] In this embodiment, the specific process of calculating the convergence of the rectification is as follows: Based on the historical jitter baseline stored in history and the historical disturbance sensitivity of corresponding non-compliant items, a rectification judgment benchmark is constructed; The rectification judgment criteria include the historical kernel jitter vector baseline. Sensitivity to historical non-compliance disturbances Historical asset true risk value All three types of benchmark data were taken from the output results of the most recent complete evaluation cycle before rectification.

[0047] Based on the kernel jitter data collected after rectification with the same sampling frequency and the same index dimension, the kernel jitter feature vector after rectification is obtained. After rectification, data collection must be conducted under stable system operation conditions, with the business load deviating from the baseline collection period by less than 10%. The collection duration should be consistent with the baseline sampling duration, using the exact same indicator calculation rules and normalization methods to obtain the rectified kernel jitter feature vector. .

[0048] Based on the deviation calculation and normalization of the kernel jitter feature vectors before and after rectification, the kernel jitter feature deviation degree is obtained; The kernel jitter characteristic deviation is calculated using the L2 norm relative deviation:

[0049] In the formula, For vector 2 norm operations, The range of values ​​is The larger the value, the greater the difference in kernel operation status before and after the rectification.

[0050] The rectification convergence degree of the corresponding non-compliant item is obtained by coupling the kernel jitter feature deviation degree and the historical disturbance sensitivity.

[0051] The formula for calculating the convergence of rectification deviation is:

[0052] The smaller the value, the closer the kernel jitter is to the safety baseline after rectification, and the higher the actual effectiveness of the rectification. This parameter takes into account both the difference in operating status before and after rectification and the historical disturbance capability of the original defect, avoiding over-judgment of the effectiveness of defects with extremely weak original disturbance capability.

[0053] In this embodiment, the specific process of classifying the effectiveness level of rectification and the closed-loop iteration is as follows: Based on the comparison between the preset two-level convergence threshold and the numerical value of the rectification convergence, the rectification effectiveness level of the corresponding non-compliant item is obtained, including rectification qualified, rectification partially effective, and rectification invalid. For example, the two-level convergence thresholds are set as follows: , The judgment rule is: The rectification was deemed satisfactory. The rectification measures have been deemed effective. The rectification was deemed invalid (a sham rectification).

[0054] Based on the coupled calculation of the constraint weight of the information security clause, the degree of rectification convergence and the true risk value of historical assets, the risk value of the assets after rectification is obtained. The formula for calculating the risk reduction of a single non-compliant item after rectification is as follows:

[0055] In the formula, The mandatory constraint weight for the information security protection clause has a value range of [value range missing]. Core control clauses are given higher weights, while general control clauses are given lower weights; the overall risk value after asset rectification is obtained by aggregating the risk values ​​of all rectification items.

[0056] Based on different levels of rectification effectiveness, corresponding handling strategies are generated. For non-compliant items that have passed rectification, the kernel jitter feature vector after rectification is updated to a new jitter baseline, and the risk data of the corresponding assets is updated simultaneously.

[0057] The baseline update adopts a sliding replacement mechanism, replacing the historical sequence of the corresponding duration in the original baseline with the stable operating jitter sequence after rectification. After the update, the baseline average value and fluctuation range are recalculated as the benchmark for the next cycle of assessment and rectification verification. The asset risk data is updated synchronously to the latest calculated value after rectification, realizing the dynamic iteration of risk status.

[0058] In this embodiment, the specific process of the handling strategy is as follows: Based on the comparison of the severity level of each non-compliance item with the corresponding disturbance sensitivity value, mismatch scenarios where the paper risk does not match the actual disturbance capability are identified. Based on the judgment result that the severity level is higher than the preset high-level threshold and the disturbance sensitivity is lower than the preset low-sensitivity threshold, a high inherent low-disturbance label is obtained, and the processing priority of the corresponding non-compliant item is downgraded; the preset high-level threshold is level 4 (inherent severity level ≥ 4), and the preset low-sensitivity threshold is... For non-compliant items that meet this condition, the priority of handling will be downgraded by 1 level from the original level.

[0059] Based on the judgment result that the severity level is lower than the preset low level threshold and the disturbance sensitivity is higher than the preset high sensitivity threshold, a low inherent high disturbance label is obtained, and the processing priority of the corresponding non-compliant item is increased. The preset low-level threshold is level 2 (inherent severity level ≤ 2), and the preset high-sensitivity threshold is... For non-compliant items that meet this condition, the priority of handling will be increased by 1 level from the original level.

[0060] Based on the preset grading threshold of the true risk value of the assets, the remaining non-compliant items are classified into risk levels, and differentiated disposal strategies are generated by combining the priority adjustment results.

[0061] The threshold for classifying the true risk value of assets is set as follows: High Risk Medium risk Low risk The differentiated handling strategy includes three categories: rectification time limit, rectification resource allocation, and review frequency: high-risk items are required to be rectified within 7 days, medium-risk items within 30 days, and low-risk items within 90 days; at the same time, special alarm work orders are generated for items marked as false rectification and included in the key review list.

[0062] This embodiment also discloses an AI-based data security compliance testing, evaluation, and risk management method, which applies the aforementioned AI-based data security compliance testing, evaluation, and risk management platform.

[0063] This embodiment also discloses a computer-readable storage medium storing a computer program, which is executed by a processor to implement the above-mentioned AI-based data security compliance testing, assessment, and risk management platform.

[0064] Optionally, in this embodiment, those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0065] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0066] If the integrated units in the above embodiments are implemented as software functional units and sold or used as independent products, they can be stored in the aforementioned computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause one or more electronic devices to execute all or part of the steps of the methods described in the various embodiments of this application.

[0067] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0068] In the several embodiments provided in this application, it should be understood that the disclosed application can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection of units or modules may be electrical or other forms.

[0069] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0070] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0071] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. An AI-based data security compliance testing, assessment, and risk management platform, characterized in that: The platform includes: The semantic parsing module constructs a three-level semantic deconstruction system for the information security level protection control items, generates standard evidence vectors for each control item, collects multi-source assessment data and extracts measured evidence vectors, calculates the matching degree between the two, classifies compliance status based on the matching degree, and filters out the set of non-compliant items and their corresponding detection timestamps, severity levels and related assets. The disturbance assessment module, based on the set of non-compliant items and the detection timestamp, bypasses and imperceptibly collects the kernel micro-jitter time series of the tested asset, constructs a normalized jitter feature vector, aligns the observation window of non-compliant items with the spatiotemporal jitter time series, and calculates the disturbance sensitivity; based on the disturbance sensitivity, it calculates the disturbance correction coefficient to correct the inherent risk component of non-compliant items; and superimposes the asset's basic vulnerability risk to obtain the asset's true risk value and stores the jitter baseline. The rectification verification module uses the jitter baseline, disturbance sensitivity, and actual asset risk value as benchmarks to collect kernel jitter data in the same dimension after rectification and calculate the rectification convergence. It also calculates the risk value after rectification by combining the weight of the information security clauses, classifies the rectification effectiveness level according to the preset threshold, generates disposal strategies, and iteratively updates the jitter baseline and asset risk data.

2. The AI-based data security compliance testing, evaluation, and risk management platform according to claim 1, characterized in that, The specific process for determining compliance status is as follows: Based on the hierarchical semantic decomposition of the information security standard clauses, a three-level semantic deconstruction system of parent clauses, sub-verification items, and evidence constraint dimensions is constructed to obtain the structured standard evidence vectors corresponding to each control item. Based on the collected multi-source evaluation raw data, the measured evidence vectors corresponding one-to-one with the evidence dimensions of each control item are extracted. Based on the cosine similarity calculation between the measured evidence vector and the standard evidence vector, the evidence source matching fit is obtained; Based on preset multi-level compliance thresholds, each control item is divided into four compliance states: fully compliant, highly compliant, lowly compliant, and non-compliant. A set of non-compliant control items is obtained by filtering, and the detection timestamp, inherent severity level, and asset identifier of each non-compliant item are obtained simultaneously.

3. The AI-based data security compliance testing, evaluation, and risk management platform according to claim 2, characterized in that, Constructing a normalized jitter feature vector and aligning the observation window of non-compliant items with the spatiotemporal sequence of jitter includes: Runtime sequence data of the operating system kernel layer of the tested asset is collected in a bypass-free manner. Three types of raw micro-jitter sampling sequences are obtained by sampling at fixed sampling intervals: CPU instantaneous volatility, memory page replacement thrashing rate, and file handle short-term jitter frequency. Based on the linear normalization processing of the preset interval, amplitude mapping is performed on the three types of original micro-jitter sampling sequences to obtain the three-dimensional kernel jitter feature vector; Based on the detection timestamps of each non-compliant control item, a preset time window width is expanded forward and backward with the timestamp as the center to generate a sliding observation time window, thereby obtaining the event tag sequence of the corresponding non-compliant item; Based on window matching processing with a unified time axis, the event tag sequence is spatiotemporally aligned with the kernel jitter feature vector to obtain the time-series correlation analysis samples corresponding to each non-compliant item.

4. The AI-based data security compliance testing, evaluation, and risk management platform according to claim 3, characterized in that, The specific process for generating the true risk value of an asset is as follows: Based on the kernel jitter feature vector and the event tag sequence of the corresponding non-compliant items within the sliding observation time window, the covariance and variance of the two sets of sequences are calculated respectively. The compliance defect perturbation sensitivity of the corresponding non-compliance item is obtained by calculating the ratio of the covariance to the product of the square roots of the variances of the two sets of sequences. Based on the positive and negative values ​​of the sensitivity to compliance defect disturbances, the disturbance correction coefficients corresponding to each non-compliance item are obtained through piecewise calculation. The risk component of a single non-compliance control item is obtained by multiplying the disturbance correction factor with the inherent severity level of the corresponding non-compliance item. Based on the aggregation result of all non-compliant control risk components under the same asset, the basic vulnerability risk value of the corresponding asset is superimposed to obtain the true business risk value of the asset, and the kernel jitter feature vector of the current period is stored simultaneously as the historical jitter baseline.

5. The AI-based data security compliance testing, evaluation, and risk management platform according to claim 4, characterized in that, The specific process for calculating the convergence of the rectification is as follows: Based on the historical jitter baseline stored in history and the historical disturbance sensitivity of corresponding non-compliant items, a rectification judgment benchmark is constructed; Based on the kernel jitter data collected after rectification with the same sampling frequency and the same index dimension, the kernel jitter feature vector after rectification is obtained. Based on the deviation calculation and normalization of the kernel jitter feature vectors before and after rectification, the kernel jitter feature deviation degree is obtained; The rectification convergence degree of the corresponding non-compliant item is obtained by coupling the kernel jitter feature deviation degree and the historical disturbance sensitivity.

6. The AI-based data security compliance testing, evaluation, and risk management platform according to claim 5, characterized in that, The specific process of classifying the effectiveness of rectification and the closed-loop iteration is as follows: Based on the comparison between the preset two-level convergence threshold and the numerical value of the rectification convergence, the rectification effectiveness level of the corresponding non-compliant item is obtained, including rectification qualified, rectification partially effective, and rectification invalid. Based on the coupled calculation of the constraint weight of the information security clause, the degree of rectification convergence and the true risk value of historical assets, the risk value of the assets after rectification is obtained. Based on different levels of rectification effectiveness, corresponding handling strategies are generated. For non-compliant items that have passed rectification, the kernel jitter feature vector after rectification is updated to a new jitter baseline, and the risk data of the corresponding assets is updated simultaneously.

7. The AI-based data security compliance testing, evaluation, and risk management platform according to claim 6, characterized in that, The specific process of the handling strategy is as follows: Based on the comparison of the severity level of each non-compliance item with the corresponding disturbance sensitivity value, mismatch scenarios where the paper risk does not match the actual disturbance capability are identified. Based on the judgment result that the severity level is higher than the preset high level threshold and the disturbance sensitivity is lower than the preset low sensitivity threshold, a high inherent low disturbance label is obtained, and the processing priority of the corresponding non-compliant item is downgraded. Based on the judgment result that the severity level is lower than the preset low level threshold and the disturbance sensitivity is higher than the preset high sensitivity threshold, a low inherent high disturbance label is obtained, and the processing priority of the corresponding non-compliant item is increased. Based on the preset grading threshold of the true risk value of the assets, the remaining non-compliant items are classified into risk levels, and differentiated disposal strategies are generated by combining the priority adjustment results.

8. A data security compliance testing, assessment, and risk management method based on AI, characterized in that... The AI-based data security compliance testing, evaluation, and risk management platform according to any one of claims 1 to 7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which is executed by a processor to implement the AI-based data security compliance testing, evaluation, and risk management platform as described in any one of claims 1-7.

Images