Method and system for detecting classified information based on public information

Abstract

The present application belongs to the technical field of information security, and particularly relates to a method and system for detecting confidential information based on public information. The method comprises the following steps: S1, constructing a public information knowledge base; S2, constructing a personnel public knowledge base; S3, obtaining and preprocessing the information to be detected; S4, constructing an information category classifier; S5, classifying the information categories; S6, constructing an information confidential judgment device; and S7, judging the information confidentiality. The present application has the characteristics of being able to judge the domain confidential information and effectively judging whether the confidential information has been disclosed.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, specifically relating to a method and system for detecting classified information based on publicly available information. Background Technology

[0002] Supervisory and oversight agencies generate a large amount of classified information during case investigations and other work. The leakage of this classified information onto the internet could pose a serious threat to the nation. Therefore, it is necessary to monitor the information transmitted by these agencies to the internet to prevent the leakage of classified information.

[0003] Current methods for detecting sensitive information mainly include: 1. Regular expression matching, which relies on constructed regular expressions to complete the detection of sensitive information; 2. Corpus-based machine learning, which uses training data containing sensitive information to train a model. The trained machine learning model then completes the detection of sensitive information.

[0004] Although classified information is sensitive, the methods described above cannot be directly applied to its detection for the following reasons: 1. Classified information is time-sensitive, a characteristic particularly evident in this field. Judging solely by the content of the information cannot determine whether it has been published, thus making it impossible to determine if the information is classified. Based on this characteristic, regular expression matching methods and machine learning methods cannot determine whether classified information has been made public, and therefore cannot be directly used for its detection; 2. According to Chinese law, the scope of access to state secrets should be limited to a minimum based on work needs. Therefore, under existing legal provisions, it is difficult to obtain sufficient classified information for model training.

[0005] Currently, determining whether information is classified mainly involves two issues: 1. How to determine which field and category the information to be judged belongs to; 2. After determining the relevant scope clauses, how to use those clauses to determine whether the information is classified.

[0006] For example, Chinese patent document CN201610446539.9 describes an information management system for Party conduct and integrity building based on big data. This system includes an external network data collection platform and an internal network processing platform. External network data collection includes mobile terminals and / or fixed terminals, the internet, and an internet server. The person providing the clue or the person collecting it logs into the internet server on the mobile terminal and / or fixed terminal, inputs the original problem clue data, and transmits it via the internet. The data transmitted via the internet enters the internet server and then passes through an internal and external network data isolation and filtering system before entering the internal network database. The database exchanges progress data about the problem clues with various process nodes in the disciplinary inspection internal network and records the information on the processing of collected problem clues. Internal network process nodes carry out their work according to their respective business permissions. The data flow between the various process nodes in the internal network is automatic under the control of software programs. Although the application of the above system achieves the effects of more convenient supervision, more effective oversight, more specific responsibilities, more appropriate punishments, and more accurate statistics, its disadvantage lies in its limitation in information confidentiality, as it cannot determine information involving classified information in the field. Summary of the Invention

[0007] The present invention aims to overcome the problem that existing sensitive information detection methods cannot be directly applied to the detection of classified information. It provides a method and system for detecting classified information based on publicly available information, which can determine whether classified information has been made public.

[0008] To achieve the above-mentioned objectives, the present invention adopts the following technical solution:

[0009] The method for detecting classified information based on publicly available information includes the following steps:

[0010] S1, Building a public information knowledge base:

[0011] The data collected includes publicly available information on case categories and information provided by organizations on report categories. After data cleaning, a public information knowledge base was constructed.

[0012] S2, Building a public knowledge base for personnel:

[0013] Collect personnel organizational structure information and abnormal personnel information published on the official website of the department, and after entity alignment and disambiguation, construct a public knowledge base for personnel and a public knowledge base for abnormal personnel.

[0014] S3, Acquisition and preprocessing of information to be detected:

[0015] At the network entrance and exit points of the organization, network probe technology is used to obtain information to be detected and to perform preprocessing operations on the information to be detected.

[0016] S4, Construct an information category classifier:

[0017] Construct an information category classifier based on a publicly available information knowledge base;

[0018] S5, classify information categories:

[0019] The pre-processed information to be detected is classified using an information category classifier, and the category of the information to be detected is output.

[0020] S6, Construct an information confidentiality determination tool:

[0021] Based on the data provided by the public information knowledge base, the public personnel knowledge base, and the public abnormal personnel knowledge base, an information confidentiality determination tool is constructed.

[0022] S7, Information Classification Determination:

[0023] The information confidentiality determination device judges the information to be detected according to known categories and outputs the judgment result; if it is confidential, the proposed confidentiality level is marked and submitted to experts for review.

[0024] Preferably, step S1 includes the following steps:

[0025] S11, using web crawlers to collect information on cases, statistics, and important deployments publicly released on official websites in the field; and collecting reports and foreign-related information provided by relevant departments of the organization regarding the removal of relevant personnel.

[0026] S12, Use data cleaning tools to clean the collected public information, the data cleaning includes removing noisy words and filling in missing data;

[0027] S13, construct a public information knowledge base from the data cleaned information in step S12.

[0028] Preferably, step S2 includes the following steps:

[0029] S21. Use web crawlers to collect personnel information from the official websites of various departments over the years; through entity alignment and disambiguation operations, summarize the job information of the same person and build a resume; build a public personnel knowledge base from the relevant information of each person.

[0030] S22: Collect information on abnormal personnel published on the official website of the unit; through entity alignment and disambiguation operations, summarize the employment information and abnormal information of the same abnormal personnel to build a resume; and build a public knowledge base of abnormal personnel from the relevant information of each abnormal personnel.

[0031] Preferably, step S3 includes the following steps:

[0032] S31. After the network probe captures data packets, it obtains the packet sequence number and message encoding method by parsing the application layer protocol; it converts the data transmitted in the data packets into text by using the message encoding method, and combines the text in each data packet into the information to be detected by combining the packet sequence numbers.

[0033] S32, the acquired information to be detected is subjected to noise reduction processing, which includes removing stop words and punctuation marks.

[0034] Preferably, step S4 includes the following steps:

[0035] S41, for statistical data categories and important deployment category information with fixed content formats, a rule template matching method is used for detection;

[0036] S42. For case categories, report categories, and foreign-related categories with inconsistent content formats, a pre-trained model is used for classification.

[0037] S43, combine the different detection and classification methods in steps S41 and S42 to construct an information category classifier; test the classifier using data provided by the public information knowledge base, and set the classification threshold D based on the accuracy results.

[0038] Preferably, step S5 includes the following steps:

[0039] S51, the information category classifier classifies the pre-processed information to be detected, calculates the probability value of each information category, and selects the largest category probability value P to compare with the classification threshold D:

[0040] If the probability value P is greater than or equal to the classification threshold D, the classifier will output the information category corresponding to the probability value P; if the probability value P is less than the classification threshold D, it means that the information category to be detected is not among the set information categories and belongs to non-domain confidential information.

[0041] Preferably, step S6 includes the following steps:

[0042] S61, To determine whether the information contains personnel information, a named entity recognition tool is used to search for it;

[0043] S62, To determine whether information has been publicly released, a component consisting of a similarity comparison algorithm is used for matching;

[0044] S63, To determine whether the information contains fixed feature information, template matching is used;

[0045] S64. Combine the different search and matching methods in steps S61, S62 and S63 to construct an information confidentiality determination device.

[0046] Preferably, step S7 includes the following steps:

[0047] S71, if the report category is output in step S5, then the named entity recognition tool is used to detect whether there is personnel information in the information; if not, it is non-confidential information; if it exists, the personnel appearing in the public knowledge base are searched; if not found, it is non-confidential information; if found, the relevant attribute information and job information of the personnel are obtained; and then, according to the existing classification regulations, the specific settings for the corresponding category are used to output the proposed classification level of the information to be detected.

[0048] S72, if step S5 outputs the foreign-related category, then the named entity recognition tool is used to further detect whether there is personnel information in the information; if it does not exist, it is non-confidential information; if it exists, the data provided by the public knowledge base of abnormal personnel is used to query personnel information; if it cannot be found, it is non-confidential information; if it is found, the proposed classification level of the information to be detected is output according to the relevant attribute information and original position information of the corresponding personnel, and according to the specific settings of the corresponding category in the existing classification regulations.

[0049] S73, if step S5 outputs a case category, then the named entity recognition tool is used to further detect whether there is personnel information in the information; if not, it is non-confidential information; if it exists, the personnel appearing in the public knowledge base are searched; if not found, it is non-confidential information; if found, the relevant attribute information and employment information of the personnel are obtained; then, according to the existing classification regulations, the specific settings for the corresponding category are used to make a preliminary classification judgment on the information; then, the information to be detected is compared with the data in the public information knowledge base, and a similarity threshold M is set; if the similarity value is greater than M, the information has been published and belongs to non-confidential information; if the similarity value is less than M, the proposed classification level of the information to be detected is output.

[0050] S74, if step S5 outputs statistical data categories, then design a rule template matching method according to the existing security classification regulations; if no feature information is matched in the information to be detected, it belongs to non-confidential information; if feature information is matched in the information to be detected, then make a preliminary security classification judgment based on the matching result; then compare the similarity between the information to be detected and the data in the public information knowledge base, and set a similarity threshold M; if the similarity value is greater than M, the information has been published and belongs to non-confidential information; if the similarity value is less than M, then output the proposed security classification of the information to be detected.

[0051] S75, if step S5 outputs an important deployment category, then the information to be detected is compared with the data in the public information knowledge base, and a similarity threshold M is set; if the similarity value is greater than M, then the information has been disclosed and belongs to non-confidential information; if the similarity value is less than M, then according to the existing classification regulations, the specific settings for the corresponding category are used to output the proposed classification level of the information to be detected.

[0052] This invention also provides a classified information detection system based on publicly available information, comprising:

[0053] The public information knowledge base construction module is used to collect publicly available information related to case categories and information provided by units related to report categories. After data cleaning, a public text information knowledge base is constructed.

[0054] The personnel public knowledge base construction module is used to collect personnel organizational structure information and abnormal personnel information published on the department's official website. After entity alignment and disambiguation, it constructs the personnel public knowledge base and the abnormal personnel public knowledge base.

[0055] The information category classification module is used to design an information category classifier based on a public information knowledge base, and to use the classifier to classify the pre-processed information to be detected, and output the category of the information to be detected.

[0056] The information confidentiality determination module is used to design an information confidentiality determination device based on data provided by the public information knowledge base, the public personnel knowledge base, and the public abnormal personnel knowledge base. The device is used to determine the information to be detected of known categories and output the determination result. If it is confidential, the proposed confidentiality level is marked and submitted to experts for review.

[0057] Compared with the prior art, the beneficial effects of this invention are: (1) This invention proposes for the first time a method for detecting classified information in the field using publicly available information. Instead of relying on the classified information itself, it relies entirely on publicly available documents to construct a dedicated classifier and judge, thereby solving the previous dilemma that classified sample data could not be obtained or could only be obtained in small quantities; (2) This invention uses the scope of classified matters to determine classified information in the field, making the application of the method of this invention widely applicable; (3) This invention solves the previous dilemma that classified information detection based on custom rules was only applicable to a few specific units, and this invention uses the method of querying public information databases, which can effectively determine whether classified information has been made public. Attached Figure Description

[0058] Figure 1 This is a flowchart of a classified information detection method based on publicly available information provided in an embodiment of the present invention;

[0059] Figure 2This is a partial implementation logic diagram of the information confidentiality determination device provided in an embodiment of the present invention;

[0060] Figure 3 This is another part of the implementation logic diagram of the information confidentiality determination device provided in the embodiments of the present invention.

[0061] Figure 4 This is a partial architecture diagram of a classified information detection system based on publicly available information provided in an embodiment of the present invention;

[0062] Figure 5 This is a schematic diagram of another part of the architecture of the classified information detection system based on publicly available information provided in an embodiment of the present invention.

[0063] Figure 6 This is a schematic diagram of the architecture of the public information knowledge base construction module provided in an embodiment of the present invention;

[0064] Figure 7 This is a schematic diagram of the architecture of the personnel public knowledge base construction module provided in an embodiment of the present invention;

[0065] Figure 8 This is a schematic diagram of a hardware device for a classified information detection system based on publicly available information, as provided in an embodiment of the present invention. Detailed Implementation

[0066] To more clearly illustrate the embodiments of the present invention, specific implementation methods will be described below with reference to the accompanying drawings. Obviously, the drawings described below are merely some embodiments of the present invention. For those skilled in the art, other drawings and other implementation methods can be obtained based on these drawings without any creative effort.

[0067] Example:

[0068] The classification categories of classified information in this invention are specifically divided into 5 categories: (1) Reports; (2) Cases; (3) Statistics; (4) Foreign-related; and (5) Important Deployments.

[0069] The publicly available information involved in this invention includes a public information knowledge base, a personnel public knowledge base, and a public knowledge base for abnormal personnel. The public information knowledge base consists of two parts: one part contains publicly available information related to cases, statistics, and important deployments; the other part contains reports and foreign-related information provided by the organization, with relevant personnel information removed. The personnel public knowledge base includes not only personnel information such as name, position, and rank, but also a resume of their employment history, including dates of employment and current positions. The public knowledge base for abnormal personnel comprises officially released information on abnormal staff members, individuals involved in cases, and other abnormal individuals. It includes not only information about these individuals such as name, position, and rank, but also their employment history prior to their abnormal status, including dates of employment and current positions.

[0070] like Figure 1 As shown, the present invention provides a method for detecting classified information based on publicly available information, comprising the following steps:

[0071] Step S1, construct a public information knowledge base:

[0072] The data is collected from publicly available information related to case categories and from information provided by organizations related to report categories. After data cleaning, a public information knowledge base is constructed.

[0073] The specific method for step S1 is as follows:

[0074] Step S11: Use web scraping tools to collect information publicly released on official websites in the field, including case-related, statistical, and important deployment information. Also, collect reports from relevant departments within the organization regarding the removal of relevant personnel and information related to foreign affairs.

[0075] Step S12 involves using data cleaning tools to clean the collected public information, mainly including removing noise words (stop words, punctuation marks, etc.) and filling in missing data.

[0076] Step S13: Construct a public information knowledge base from the information that has been cleaned by the data.

[0077] Step S2, Build a public knowledge base for personnel:

[0078] Collect personnel organizational structure information and abnormal personnel information published on the official website of the department. After entity alignment and disambiguation, construct a public knowledge base for personnel and a public knowledge base for abnormal personnel.

[0079] The specific method for step S2 is as follows:

[0080] Step S21: Use web crawlers to retrieve personnel information from the official websites of various departments over the years. Further, through entity alignment, fusion, and disambiguation operations, aggregate the employment information of the same person to construct a resume. Then, build a public personnel knowledge base based on the aforementioned personnel information.

[0081] Step S22 involves collecting information on abnormal personnel published on the organization's official website. Further operations such as entity alignment and disambiguation are used to aggregate the employment information and abnormal information of the same abnormal personnel, constructing a resume. Then, a public knowledge base for abnormal personnel is built based on the aforementioned information.

[0082] Step S3, Acquisition and Preprocessing of Information to be Detected:

[0083] At the network entry and exit points of the organization, network probe technology is used to obtain information to be detected. Preprocessing operations are then performed on this information.

[0084] The specific method for step S3 is as follows:

[0085] Step S31: After the network probe captures data packets, it obtains the packet sequence number and message encoding method by parsing the application layer protocol. Then, it converts the data transmitted in the data packets into text using the message encoding method, and combines the text in each data packet with the packet sequence number to form the information text to be detected.

[0086] Step S32: The obtained information to be detected is subjected to noise reduction processing, including the removal of stop words and punctuation marks.

[0087] Step S4, construct the information category classifier:

[0088] An information category classifier is constructed based on a publicly available information knowledge base.

[0089] The specific method for step S4 is as follows:

[0090] Step S41: For statistical data categories and important deployment category information with fixed content formats, detection can be performed using a method similar to rule template matching, but it is not limited to this.

[0091] Step S42: For case categories, report categories, and foreign-related categories with inconsistent content formats, classification can be performed using a method similar to a pre-trained model, but is not limited to this.

[0092] Step S43: Combine the different methods described above to construct an information category classifier. Test the classifier using data provided by a public information knowledge base, and set a classification threshold D based on the accuracy results.

[0093] Step S5, Information Category Classification:

[0094] The pre-processed information to be detected is classified using an information category classifier, and the category of the information to be detected is output.

[0095] The specific method for step S5 is as follows:

[0096] The information category classifier classifies the pre-processed information to be detected, calculates the probability value of each information category, and selects the largest category probability value P to compare with the classification threshold D. If the probability value P is greater than or equal to the classification threshold D, the classifier outputs the information category corresponding to the probability value P; if the probability value P is less than the classification threshold D, it means that the information to be detected is not among the five pre-set information categories and belongs to non-domain-sensitive information.

[0097] Step S6, construct an information confidentiality determination device:

[0098] Based on the data provided by the public information knowledge base, the public personnel knowledge base, and the public abnormal personnel knowledge base, an information confidentiality determination tool is constructed.

[0099] The specific method for step S6 is as follows:

[0100] Step S61: To determine whether the information contains personnel information, a named entity recognition tool can be used for searching, but it is not limited to this.

[0101] Step S62: To determine whether the information has been publicly released, a component consisting of a similarity comparison algorithm can be used for matching, but it is not limited to this.

[0102] Step S63: To determine whether the information contains fixed feature information, template matching can be used, but it is not limited to this.

[0103] Step S64: Combine the different methods mentioned above to construct an information confidentiality determination device.

[0104] Step S7, as follows Figure 2 and Figure 3 As shown, the information is classified as confidential:

[0105] The information security classification tester assesses the known categories of information to be detected and outputs the assessment result. If the information is classified, a proposed security classification level is marked, and the information is submitted to experts for review.

[0106] The specific method for step S7 is as follows:

[0107] Step S71: If the report category is output in step S5, then the named entity recognition tool is used to further detect whether there is personnel information in the information. If not, it is considered non-confidential information. If it exists, the personnel appearing in the public personnel knowledge base are searched. If no personnel are found, it is considered non-confidential information; if personnel are found, the relevant attribute information and employment information of the personnel are obtained. Then, based on the specific settings for this category, the proposed security classification level of the information to be detected is output.

[0108] Step S72: If step S5 outputs an "international" category, then the named entity recognition tool is used to further detect whether there is personnel information in the information. If not, it is considered non-confidential information. If it exists, the personnel information is further queried using data provided by the public knowledge base of abnormal personnel. If no information is found, it is considered non-confidential information. If information is found, the proposed security classification level of the information to be detected is output according to the relevant attribute information and original employment information of the personnel, and in accordance with the specific settings for this category.

[0109] Step S73: If step S5 outputs a case category, then the named entity recognition tool is used to further detect whether there is personnel information in the information. If not, it is considered non-confidential information. If it exists, the personnel are searched in the public personnel knowledge base. If no personnel are found, it is considered non-confidential information. If personnel are found, the relevant attribute information and employment information of the personnel are obtained. Then, based on the specific settings for this category, a preliminary classification determination is made for the information. Next, the information to be detected is compared with the data in the public information knowledge base, and a similarity threshold M is set. If the similarity value is greater than M, the information has been publicly disclosed and is considered non-confidential information. If the similarity value is less than M, the proposed classification level of the information to be detected is output.

[0110] Step S74: If step S5 outputs a statistical data category, then according to a method similar to rule template matching (but not limited to), if no feature information is matched in the information to be detected, it belongs to non-confidential information. If feature information is matched in the information to be detected, a preliminary classification is made based on the matching result. Then, the information to be detected is compared with the data in the public information knowledge base, and a similarity threshold M is set. If the similarity value is greater than M, the information has been published and belongs to non-confidential information. If the similarity value is less than M, the proposed classification level of the information to be detected is output. For example: if the information to be detected is matched with "nationwide" using a rule template, and the information to be detected has not yet been published, then the proposed classification level of the information to be detected is confidential.

[0111] Step S75: If step S5 outputs an important deployment category, then the information to be detected is compared with the data in the publicly available information knowledge base, and a similarity threshold M is set. If the similarity value is greater than M, the information has been publicly disclosed and is considered non-confidential. If the similarity value is less than M, then the proposed classification level of the information to be detected is output according to the specific settings for this category. For example, if the information to be detected has not yet been publicly disclosed, then this type of information to be detected is proposed to be classified as confidential.

[0112] like Figure 4 and Figure 5 As shown, the present invention also provides a classified information detection system based on publicly available information, comprising:

[0113] The public information knowledge base construction module is used to collect publicly available information related to case categories and information provided by units related to report categories. After data cleaning, a public text information knowledge base is constructed.

[0114] The personnel public knowledge base construction module is used to collect personnel organizational structure information and abnormal personnel information published on the department's official website. After entity alignment and disambiguation, it constructs the personnel public knowledge base and the abnormal personnel public knowledge base.

[0115] The information category classification module is used to design an information category classifier based on a public information knowledge base, and to use the classifier to classify the pre-processed information to be detected, and output the category of the information to be detected.

[0116] The information confidentiality determination module is used to design an information confidentiality determination device based on data provided by the public information knowledge base, the public personnel knowledge base, and the public abnormal personnel knowledge base. The device is used to determine the information to be detected of known categories and output the determination result. If it is confidential, the proposed confidentiality level is marked and submitted to experts for review.

[0117] Among them, the public information knowledge base construction module, such as Figure 6 As shown:

[0118] 1. Collect information publicly released on the official website related to cases, statistics, and important deployments. Also, collect reports and foreign-related information regarding the removal of relevant personnel from relevant departments within the organization.

[0119] 2. Use data cleaning tools to clean the collected public information, mainly including removing noise words (stop words, punctuation marks, etc.) and filling in missing data.

[0120] 3. Construct a public information knowledge base based on the cleaned information described above.

[0121] Among them, the personnel open knowledge base construction module, such as Figure 7 As shown:

[0122] 1. Use web crawlers to collect personnel information from the official websites of various departments over the years. Further, through entity alignment, fusion, and disambiguation operations, aggregate the employment information of the same person to construct a resume. Then, build a public personnel knowledge base based on the aforementioned personnel information.

[0123] 2. Collect information on individuals with unusual activity from the organization's official website. Further, through entity alignment and disambiguation operations, aggregate the employment information and unusual activity details of the same individual to construct a resume. Then, build a public knowledge base for individuals with unusual activity based on the aforementioned information.

[0124] like Figure 8 The diagram shows a hardware device of the present invention. Device 11 includes one or more processors 111 and memory 112.

[0125] The processor can be a central processing unit (CPU) or other form of processing unit with data processing and instruction execution capabilities, and can control other components in the electronic device to perform the desired functions.

[0126] The memory may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory or non-volatile memory. Volatile memory may include, for example, random access memory (RAM) or cache memory. Non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and a processor may execute the program instructions to implement the test methods of the embodiments of this application described above, as well as other desired functions.

[0127] The hardware device of the present invention may further include an input device 113 and an output device 114, which are interconnected through a main system or other forms of connection mechanism.

[0128] Input devices may include network probes, etc.

[0129] The output device can output information to the outside.

[0130] The hardware device of this invention can be installed at the internet access point of an organization to prevent the leakage of classified information.

[0131] This invention is the first to propose a method for detecting classified information in a field using publicly available information. It does not rely on the classified information itself, but instead constructs a dedicated classifier and determiner entirely from publicly available documents, thus solving the previous predicament of not being able to obtain classified sample data or only being able to obtain a small number of samples. This invention uses the scope of classified matters to determine classified information in the field, making the method widely applicable. This invention also solves the predicament of previous methods that relied on custom rules for detecting classified information, thus limiting its applicability to only a few specific units. Furthermore, this invention uses a public information database query method, which can effectively determine whether classified information has been made public.

[0132] The above description is merely a detailed explanation of preferred embodiments and principles of the present invention. For those skilled in the art, there may be changes in specific implementation methods based on the ideas provided by the present invention, and these changes should also be considered within the scope of protection of the present invention.

Claims

1. A method for detecting classified information based on public information, characterized in that, It comprises the following steps: S1, constructing a public information knowledge base: Collecting information related to case categories and information related to report categories provided by the unit, and after data cleaning, constructing a public information knowledge base; S2, constructing a personnel public knowledge base: Collecting personnel organization structure information and published abnormal personnel from the official website of the department, and after entity alignment, fusion and disambiguation, constructing a personnel public knowledge base and an abnormal personnel public knowledge base; S3, obtaining and preprocessing the information to be detected: Using network probe technology to obtain the information to be detected at the entrance of the unit network, and preprocessing the information to be detected; S4, constructing an information category classifier: According to the public information knowledge base, an information category classifier is constructed; S5, classifying the information category: Classify the preprocessed information to be detected by the information category classifier, and output the category of the information to be detected; S6, constructing an information secrecy determination device: According to the data provided by the public information knowledge base, the personnel public knowledge base and the abnormal personnel public knowledge base, an information secrecy determination device is constructed; S7, information secrecy determination: Determine the information to be detected with known categories by the information secrecy determination device, and output the determination result; if it is secret, mark the proposed secret level, and hand it over to experts for review; Step S6 comprises the following steps: S61, whether the judgment information contains personnel information, using named entity recognition tool to find out; S62, whether the judgment information has been published, using a similarity comparison algorithm component to match; S63, whether the judgment information contains fixed feature information, using a template to match; S64, combining the different search and matching methods in steps S61, S62 and S63 to construct an information secrecy determination device.

2. The method according to claim 1, wherein Step S1 comprises the following steps: S11, using a crawler tool to collect information related to case categories, statistical categories and important deployment categories published on the official website of the field; through contact with the relevant departments of the unit, collect report information and foreign-related information provided by the unit without relevant personnel; S12, using a data cleaning tool to clean the collected public information, which includes removing noise words and filling in missing data; S13, constructing a public information knowledge base from the information cleaned in step S12.

3. The method according to claim 2, wherein Step S2 comprises the following steps: S21, using a crawler tool to crawl personnel information from the official website of each department over the years; through entity alignment, fusion and disambiguation operations, the service information of the same personnel is summarized to construct a resume table; and the personnel public knowledge base is constructed from the relevant information of each personnel; S22, collecting published abnormal personnel information from the official website of the unit; through entity alignment, fusion and disambiguation operations, the service information and abnormal information of the same abnormal personnel are summarized to construct a resume table; and the abnormal personnel public knowledge base is constructed from the relevant information of each abnormal personnel.

4. The method according to claim 3, wherein Step S3 comprises the following steps: S31, after the network probe captures the data packet, the packet sequence number value and the message encoding mode are obtained by analyzing the application layer protocol; the data transmitted in the data packet is converted into text by using the message encoding mode, and the text in each data packet is combined into the to-be-detected information text by combining the packet sequence number; S32, the to-be-detected information obtained is subjected to de-noising processing, and the de-noising processing includes removing stop words and punctuation marks.

5. The method according to claim 4, wherein, Step S4 includes the following steps: S41, for the statistical number category and the important deployment category information with fixed content format, a rule template matching method is used for detection; S42, for the case category, the report category and the foreign-related category information with unfixed content format, a pre-trained model is used for classification; S43, different detection and classification methods in step S41 and step S42 are combined to construct an information category classifier; the data provided by the public information knowledge base is used to test the classifier, and the classification threshold D is set according to the accuracy result.

6. The method according to claim 5, wherein, Step S5 includes the following steps: S51, the information category classifier classifies the pre-processed to-be-detected information, calculates the probability value of each information category, and selects the maximum category probability value P to compare with the classification threshold D: If the probability value P is greater than or equal to the classification threshold D, the information category corresponding to the probability value P is output by the classifier; if the probability value P is less than the classification threshold D, it indicates that the to-be-detected information category is not in the set information category, and belongs to non-domain confidential information.

7. The method according to claim 6, wherein the method further comprises: Step S7 includes the following steps: S71, if the report category is output in step S5, whether there is personnel information in the information is further detected by using a named entity recognition tool; if not, it belongs to non-confidential information, if yes, the personnel appearing in the information is queried in the personnel public knowledge base; if not found, it belongs to non-confidential information, if found, the related attribute information and the position information of the personnel are obtained; then, according to the existing secret level regulations and the specific settings of the corresponding category, the tentative judgment secret level of the to-be-detected information is output; S72, if the foreign-related category is output in step S5, whether there is personnel information in the information is further detected by using a named entity recognition tool; if not, it belongs to non-confidential information, if yes, the personnel information is further queried by using the data provided by the abnormal personnel public knowledge base; if not found, it belongs to non-confidential information, if found, according to the related attribute information and the original position information of the corresponding personnel, the tentative judgment secret level of the to-be-detected information is output according to the existing secret level regulations and the specific settings of the corresponding category; S73, if the case category is output in step S5, whether there is personnel information in the information is further detected by using a named entity recognition tool; if not, it belongs to non-confidential information, if yes, the personnel appearing in the information is queried in the personnel public knowledge base; if not found, it belongs to non-confidential information, if found, the related attribute information and the position information of the personnel are obtained; then, according to the existing secret level regulations and the specific settings of the corresponding category, the information is preliminarily judged to be confidential; then, the to-be-detected information is compared with the data of the public information knowledge base in similarity, and a similarity threshold M is set. If the similarity value is greater than M, the information has been disclosed and belongs to non-classified information, and if the similarity value is less than M, the tentative classified level of the to-be-detected information is outputted; S74, if the statistical number category is outputted in step S5, the design rule template matching mode is designed according to the existing classified level regulations; If the feature information cannot be matched in the to-be-detected information, it belongs to non-classified information, and if the feature information is matched in the to-be-detected information, the preliminary classified judgment is carried out according to the matched result; then the similarity comparison is carried out between the to-be-detected information and the data of the public information knowledge base, and the similarity threshold M is set; If the similarity value is greater than M, the information has been disclosed and belongs to non-classified information, and if the similarity value is less than M, the tentative classified level of the to-be-detected information is outputted; S75, if the important deployment category is outputted in step S5, the similarity comparison is carried out between the to-be-detected information and the data of the public information knowledge base, and the similarity threshold M is set; If the similarity value is greater than M, the information has been disclosed and belongs to non-classified information, and if the similarity value is less than M, the tentative classified level of the to-be-detected information is outputted according to the specific setting of the corresponding category in the existing classified level regulations.

8. A system for detecting classified information based on public information, for implementing the method for detecting classified information based on public information according to any one of claims 1-7, characterized in that, It comprises: A public information knowledge base construction module, which is used to collect information related to case categories in field disclosure and information related to report categories provided by units, and construct a public text information knowledge base after data cleaning; A personnel public knowledge base construction module, which is used to collect personnel organization structure information and published abnormal personnel disclosed by department official websites, and construct a personnel public knowledge base and an abnormal personnel public knowledge base after entity alignment, fusion and disambiguation; An information category classification module, which is used to design an information category classifier according to the public information knowledge base, and classify the preprocessed to-be-detected information by using the classifier to output the to-be-detected information category; An information classified judgment module, which is used to design an information classified judgment device according to the data provided by the public information knowledge base, the personnel public knowledge base and the abnormal personnel public knowledge base, and judge the to-be-detected information of the known category by using the judgment device to output the judgment result; If it is classified, the tentative classified level is marked and submitted to experts for review.

Images