Data classification management and control method based on artificial intelligence

Abstract

The invention discloses a data classification management and control method based on artificial intelligence, and relates to the technical field of data classification management and control, and the method comprises the following steps: capturing all data streams transmitted from a sensitive information storage device in real time through a network flow monitoring tool, employing a deep packet detection technology, analyzing a network packet, and obtaining specific transmission data; the method comprises the following steps: preprocessing captured transmission data, and dividing the preprocessed transmission data according to predefined fields; according to the method, a deep packet detection technology is utilized to obtain transmission content and pre-process and divide data, a field collection database is established in combination with an enterprise security policy, similarity analysis is performed through a machine learning model, and the data is divided into high-sensitivity data and low-sensitivity data. Face recognition authentication is carried out before high-sensitivity data transmission, and data which does not pass authentication are encrypted and transmitted by adopting TLS / SSL, so that the security in the transmission process is ensured, financial information leakage is effectively prevented, the financial security of enterprises is ensured, and economic loss and financial crisis are avoided.

Description

Technical Field

[0001] The present invention relates to the technical field of data classification management and control, and in particular to a data classification management and control method based on artificial intelligence. Background Art

[0002] Data classification control based on artificial intelligence refers to the use of artificial intelligence technology to classify and manage data to ensure data security and compliance. This control method uses technologies such as machine learning and natural language processing to automatically classify data, identify and mark sensitive information such as personal privacy data and financial information, and take different security measures for different categories of data according to preset security policies to prevent data leakage and unauthorized access.

[0003] In terms of agile applications, AI-based data classification and control can improve the efficiency and accuracy of enterprise data management. Through automated data classification and risk assessment, enterprises can respond to data security incidents and compliance requirements more quickly, reducing the time and errors of manual intervention. At the same time, AI technology can also dynamically adjust data classification strategies to adapt to rapidly changing business needs and data environments, thereby supporting agile development and operations of enterprises while maintaining data security.

[0004] The prior art has the following deficiencies:

[0005] When managing and controlling the company's sensitive data, if the company's financial information is leaked and the existing technology cannot perceive it intelligently, the leakage of financial information may cause the company's bank account information, credit card information, etc. to be used by criminals to commit theft and fraud, causing direct economic losses to the company. Illegal transactions, account theft and other behaviors will quickly consume the company's funds and lead to a financial crisis.

[0006] The above information disclosed in this Background section is only for enhancement of understanding of the background of the present disclosure and therefore it may contain information that does not constitute the prior art that is already known to one of ordinary skill in the art. Summary of the invention

[0007] The purpose of the present invention is to provide a data classification management and control method based on artificial intelligence, which captures and analyzes the transmission data in the network traffic in real time, uses deep packet inspection technology to obtain the specific transmission content, and pre-processes and divides it. In combination with the enterprise's security policy, a field collection database is established and matched, and then the data is analyzed and evaluated for similarity through a machine learning model, and the transmission data is divided into high-sensitivity and low-sensitivity data. Before the transmission of high-sensitivity data, face recognition authentication is performed, and the data that has not been authenticated is encrypted and transmitted using the TLS / SSL protocol to ensure the security of the data during the transmission process, thereby effectively preventing the leakage of financial information, ensuring the financial security of the enterprise, and avoiding economic losses and financial crises caused by data leakage, so as to solve the problems in the above-mentioned background technology.

[0008] In order to achieve the above object, the present invention provides the following technical solution: a data classification management method based on artificial intelligence, comprising the following steps:

[0009] Capture all data streams transmitted from sensitive information storage devices in real time through network traffic monitoring tools, and use deep packet inspection technology to parse network packets and obtain specific transmission data;

[0010] Preprocess the captured transmission data, divide the preprocessed transmission data according to predefined fields, determine the sensitive fields that need to be monitored according to the enterprise's security policy, summarize the sensitive fields, and establish a field collection database;

[0011] Collect several field data during data transmission, match the collected field data with the database storing sensitive data of the enterprise, and use machine learning models to perform similarity analysis on the transmission data and the field collection database. Based on the analysis results, the transmission data is divided into highly sensitive transmission data and low-sensitivity transmission data;

[0012] Perform facial recognition authentication on highly sensitive transmission data. After the authentication is passed, the information is transmitted to ensure that only personnel who meet the transmission conditions can transmit the information.

[0013] For highly sensitive data transmission that has not been authenticated, the TLS / SSL protocol is used to encrypt the data at the source and decrypt it at the target end to ensure that the data remains encrypted during transmission.

[0014] Preferably, deep packet inspection technology is used to parse network packets and obtain specific transmission data. The specific steps are as follows:

[0015] Install traffic monitoring tools in the network to monitor all data flows transmitted from sensitive information storage devices in real time;

[0016] Use filters to preliminarily classify and filter captured data packets, identify and eliminate irrelevant data flows;

[0017] Reassemble the segmented data packets through TCP stream reassembly and restore them into complete messages or files, ensuring deep packet inspection and analysis of complete application layer data;

[0018] The reassembled data packets are analyzed by the protocol analyzer, parsing the network protocol stack layer by layer, from the link layer, network layer to the transport layer, and finally reaching the application layer;

[0019] After the data is extracted at the application layer, it is deeply analyzed by the DPI engine to extract the specific transmission data.

[0020] Preferably, the specific steps of preprocessing the captured transmission data and dividing the preprocessed transmission data according to predefined fields are as follows:

[0021] Clean the captured transmission data to remove noise and irrelevant information;

[0022] Based on the cleaned data, data analysis is performed to convert the original data into structured data;

[0023] According to the predefined fields, the parsed data is subjected to field extraction;

[0024] The extracted fields are mapped and classified with the predefined fields, and the field data of different categories are classified into the corresponding database or storage system according to the enterprise's security policy.

[0025] Preferably, when the collected field data is matched with the database storing the enterprise's sensitive data, the coverage information and matching density information are obtained during the matching, and after analyzing and processing the coverage information and matching density information, a coverage index and a matching density index are generated, and the coverage index and the matching density index are input into a pre-trained machine learning model to generate a similarity evaluation coefficient, and the similarity between the transmission data and the field collection database is intelligently evaluated through the similarity evaluation coefficient.

[0026] Preferably, the similarity evaluation coefficient generated when the collected field data is matched with the database storing the enterprise's sensitive data is compared and analyzed with a preset similarity evaluation coefficient reference threshold, and the transmission data is divided. The specific division steps are as follows:

[0027] If the similarity evaluation coefficient is greater than or equal to the similarity evaluation coefficient reference threshold, the transmission data is classified as high-sensitivity transmission data;

[0028] If the similarity evaluation coefficient is less than the similarity evaluation coefficient reference threshold, the transmission data is classified as low-sensitivity transmission data.

[0029] Preferably, for the data transmission of highly sensitive data that has not been authenticated, the TLS / SSL protocol is used to encrypt the data transmission source and decrypt it at the target end. The specific steps are as follows:

[0030] Generate a public key and a private key pair at the source and target end of the data transmission, and the source server distributes the public key to the target server;

[0031] Establish a TLS / SSL connection between the source server and the target server;

[0032] At the source server, the transmitted data is encrypted using the target server’s public key before transmission;

[0033] The encrypted data is transmitted via an established TLS / SSL secure connection;

[0034] On the target server, after receiving the encrypted data, it uses the private key to decrypt it.

[0035] Preferably, the collected field data is matched with the database storing the enterprise's sensitive data, and after analyzing and processing the coverage information during the matching, the steps of generating the coverage index are as follows:

[0036] Perform preliminary matching using hash matching or similarity algorithms to identify potential matching pairs;

[0037] Calculate the matching pairs, the expression for calculation is: M i，j =match(F i , D j ), where M i，j Represents the element in the i-th row and j-th column of the matching pair matrix, representing the field data F i With database data D j Whether it matches, F i represents the field data collected for the ith time, D j represents the jth database data item, match represents the matching function, if F i With D j Returns 1 if a match is found, otherwise returns 0;

[0038] Calculate the coverage, the expression is: In the formula, C i represents the coverage of the i-th field data, j represents the number of matches of the i-th field data in all database data items, and n represents the total number of database data items;

[0039] The coverage of the field data is normalized, and the calculation expression for the normalization is: N i represents the coverage of the normalized i-th field data, min(C) represents the minimum value of all field data coverage, and max(C) represents the maximum value of all field data coverage;

[0040] Calculate the coverage index. The expression is: In the formula, CI μ represents the coverage index, α and β represent weight parameters, α is used to adjust the influence of the normalized coverage, β is used to adjust the influence of the entropy value, w i represents the weight of the i-th field data, reflecting the importance of the field data, m represents the total number of field data collected, H(N) represents the entropy value of the normalized coverage, and measures the distribution uniformity of data matching. The calculation formula is:

[0041] Preferably, a hash matching or similarity algorithm is used for preliminary matching, and the specific steps for identifying potential matching pairs are:

[0042] S1. Select a data hash function, convert each field data into a hash value of fixed length, apply the selected hash function, hash encode each field data and database data, generate a corresponding hash value list, and store the hash value of the database data in the hash table;

[0043] S2. For each field data to be matched, calculate its similarity with the database data. If the hash match is unsuccessful, further use the similarity algorithm to perform fine-grained comparison. The specific steps include:

[0044] Look up the hash value of the field data in the hash table. If a completely matching hash value is found, it is considered a potential match. For hash values ​​that are not completely matched, a similarity algorithm is used to calculate the similarity between the field data and the database data.

[0045] S3. Based on the similarity calculation results, identify and record potential matching pairs. The specific steps include:

[0046] The Levenshtein distance is compared with the preset distance reference threshold for analysis. If the Levenshtein distance is less than the distance reference threshold, the matching pair is marked as a match; if the Levenshtein distance is greater than or equal to the distance reference threshold, the matching pair is marked as a mismatch.

[0047] Preferably, the collected field data is matched with the database storing the enterprise's sensitive data, and after the matching density information during matching is analyzed and processed, the steps of generating the matching density index are as follows:

[0048] Collect all matching records of field data and enterprise sensitive data storage database, including successful and failed matching records, and calculate the matching success rate as a preliminary matching density measure. The calculation expression of the matching success rate is: In the formula, P represents the matching success rate, S represents the number of successful matches, and M represents the total number of matches;

[0049] Calculate the total matching weight. The calculation expression is: Where W represents the total matching weight, ω k Indicates the weight coefficient of the kth match, m k Indicates whether the kth match is successful, and N indicates the total number of matches;

[0050] Calculate the weighted matching success rate. The calculation expression is: Where P ω Represents the weighted matching success rate, taking into account the importance of different matches and giving higher weights to high-quality matches. Represents the sum of all matching weight coefficients;

[0051] The matching success rate and weighted matching success rate are combined to generate the matching density index. The calculation expression of the matching density index is: Where DMI μ represents the matching density index, r1 and r2 are the matching success rate P and weighted matching success rate P respectively. ω The weight coefficients of the matching success rate P and the weighted matching success rate P ω The importance of.

[0052] In the above technical solution, the technical effects and advantages provided by the present invention are:

[0053] The present invention captures and parses the transmission data in the network traffic in real time, obtains the specific transmission content by deep packet inspection technology, pre-processes and divides it, establishes a field collection database and matches it in combination with the enterprise's security policy, and then uses a machine learning model to perform similarity analysis and evaluation on the data, and divides the transmission data into high-sensitivity and low-sensitivity data. Before the transmission of high-sensitivity data, face recognition authentication is performed, and the data that has not passed the authentication is encrypted and transmitted using the TLS / SSL protocol to ensure the security of the data during the transmission process, thereby effectively preventing the leakage of financial information, ensuring the financial security of the enterprise, and avoiding economic losses and financial crises caused by data leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0055] Figure 1 The present invention is a method flow chart of a data classification control method based on artificial intelligence. DETAILED DESCRIPTION

[0056] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these example embodiments are provided so that the description of the present disclosure will be more comprehensive and complete, and the concept of the example embodiments will be fully conveyed to those skilled in the art.

[0057] The present invention provides Figure 1 The data classification management method based on artificial intelligence shown in the figure includes the following steps:

[0058] Use network traffic monitoring tools to capture all data streams transmitted from sensitive information storage devices (such as database servers and file servers) in real time, and use deep packet inspection (DPI) technology to parse network packets and obtain specific transmission data;

[0059] Use deep packet inspection (DPI) technology to parse network packets and obtain specific transmission data. The specific steps are as follows:

[0060] Install traffic monitoring tools in the network to monitor all data flows transmitted from sensitive information storage devices in real time;

[0061] Traffic monitoring tools such as network probes or traffic capture devices capture every packet passing through the network node where they are located, including all transport layer and application layer data.

[0062] Use filters to preliminarily classify and filter captured data packets, identify and eliminate irrelevant data flows;

[0063] Irrelevant data flows such as traffic from non-sensitive devices or known safe traffic. Filters can be set based on characteristics such as IP address, port number, protocol type, etc. to reduce the amount of data processed and improve efficiency;

[0064] Reassemble the segmented data packets through TCP stream reassembly and restore them into complete messages or files, ensuring deep packet inspection and analysis of complete application layer data;

[0065] Since data packets transmitted over the network are often fragmented, these fragmented data packets need to be reassembled to restore them into complete messages or files. TCP stream reassembly is a common technology that ensures that deep packet inspection can analyze complete application layer data.

[0066] The reassembled data packets are analyzed by the protocol analyzer, parsing the network protocol stack layer by layer, from the link layer, network layer to the transport layer, and finally reaching the application layer;

[0067] For example, from Ethernet frames to IP packets, to TCP / UDP segments, and finally to data of specific application protocols such as HTTP and FTP.

[0068] After the data is extracted at the application layer, it is deeply analyzed by the DPI engine to extract the specific transmission data;

[0069] The DPI engine (Deep Packet Inspection Engine) is an advanced network analysis tool that can deeply analyze the content of network data packets, not only checking the packet header information, but also the data content of the application layer. Through the DPI engine, the specific application protocols, user behaviors, sensitive information and other details contained in the data packet can be parsed and identified, so as to effectively monitor and manage network traffic and ensure the security and compliance of data transmission. The DPI engine plays an important role in network security, data leakage protection, traffic management and other aspects.

[0070] Specific transmission data includes, but is not limited to: user login credentials (such as user name and password), personal identification information (such as name, ID number, social security number), financial information (such as bank account information, credit card number, transaction amount), communication content (such as email, instant messaging), business operation data (such as order information, transaction records), and other sensitive information (such as medical records, legal documents). The identification and extraction of this data helps to conduct further security analysis and risk management.

[0071] Pre-process the captured transmission data, divide the pre-processed transmission data into pre-defined fields (such as bank account information, credit card number, transaction amount, date, etc.), and then determine the sensitive fields that need to be monitored according to the company's security policy, summarize the sensitive fields, and establish a field collection database;

[0072] The specific steps of preprocessing the captured transmission data and dividing the preprocessed transmission data according to predefined fields are as follows:

[0073] Clean the captured transmission data to remove noise and irrelevant information;

[0074] This step includes removing duplicate data, correcting erroneous data, processing missing data, etc. Data cleaning ensures the integrity and consistency of transmitted data and improves the accuracy of subsequent analysis.

[0075] Based on the cleaned data, data analysis is performed to convert the original data into structured data;

[0076] This process involves converting data from its original format (such as binary or text) into a format that is easy to process and analyze. This step usually requires identifying and parsing various protocols and data structures in data packets, such as HTTP requests, JSON data, XML data, etc.

[0077] According to the predefined fields, the parsed data is subjected to field extraction;

[0078] For example, extract specific fields such as bank account information, credit card number, transaction amount, date, etc. from the transmission data. Use regular expressions, string matching, or machine learning algorithms to automatically identify and extract target fields. This step ensures that complex transmission data is broken down into clear fields for subsequent processing and analysis.

[0079] Map and classify the extracted fields with predefined fields, and classify different types of field data into corresponding databases or storage systems according to the enterprise's security policies;

[0080] For example, financial information is classified into the financial database, and personal information is classified into the user information database. This step ensures that data is stored and managed by category, providing a basis for monitoring and protecting sensitive data.

[0081] Determining the sensitive fields that need to be monitored according to the company's security policy means that the company must first clarify which types of data need to be monitored based on its own security needs and regulatory requirements, such as personal identity information, financial data, etc. Aggregating these sensitive fields means centrally organizing all identified important data categories to form a complete list. Establishing a field collection database means creating a dedicated database to store and manage data records of these sensitive fields for systematic monitoring and analysis. This process ensures that the company can effectively identify, classify and protect sensitive information, prevent data leakage, and meet compliance requirements. Through such measures, companies can improve the refinement and effectiveness of data security management and provide reliable basic data support for subsequent security monitoring and emergency response.

[0082] Collect several field data during data transmission, match the collected field data with the database storing sensitive data of the enterprise, and use machine learning models to perform similarity analysis on the transmission data and the field collection database. Based on the analysis results, the transmission data is divided into highly sensitive transmission data and low-sensitivity transmission data;

[0083] When matching the collected field data with the database storing the enterprise's sensitive data, obtain the coverage information and matching density information during matching. After analyzing and processing the coverage information and matching density information, generate a coverage index and a matching density index. Input the coverage index and the matching density index into a pre-trained machine learning model to generate a similarity evaluation coefficient. The similarity evaluation coefficient is used to perform an intelligent evaluation of the similarity between the transmitted data and the field collection database.

[0084] When matching the collected field data with the database where the enterprise's sensitive data is stored, if the matching coverage is high, it means that the field data is highly similar to the database where the enterprise's sensitive data is stored. A high coverage rate means that a large proportion of records in the database can find matching field data, which usually reflects that the content, format and structure between the two are highly consistent. A high coverage rate means that a large proportion of the matched data in different records and fields indicates that the field data and the data in the database are highly overlapped in many aspects (such as format, field name, data type, etc.). This high overlap is usually because the field data and database data have similar sources or follow the same standards and rules, so more identical or similar items can be identified during matching. Matches with higher similarity can ensure the accuracy and consistency of data, thereby improving the effectiveness of data analysis and management. In data protection and security management, high coverage also means that sensitive data can be monitored and protected more effectively to prevent data leakage and illegal access. Therefore, a high coverage rate is an important indicator for evaluating the similarity between field data and database data.

[0085] The collected field data is matched with the database storing the enterprise's sensitive data. After analyzing and processing the coverage information during matching, the steps to generate the coverage index are as follows:

[0086] Perform preliminary matching using hash matching or similarity algorithms (such as Levenshtein distance) to identify potential matching pairs;

[0087] Use hash matching or similarity algorithms (such as Levenshtein distance) for preliminary matching. The specific steps to identify potential matching pairs are:

[0088] S1. Select a data hash function (such as SHA-256, MD5, etc.), convert each field data into a hash value of fixed length, apply the selected hash function, hash encode each field data and database data, generate a corresponding hash value list, and store the hash value of the database data in a hash table for fast matching;

[0089] S2. For each field data to be matched, calculate its similarity with the database data. If the hash match is unsuccessful, further use a similarity algorithm (such as Levenshtein distance) to perform a fine-grained comparison. The specific steps include: searching the hash value of the field data in the hash table. If a completely matching hash value is found, it is regarded as a potential matching pair. For hash values ​​that are not completely matched, use a similarity algorithm to calculate the similarity between the field data and the database data.

[0090] The Levenshtein distance measures similarity by calculating the minimum number of edit operations (insertions, deletions, substitutions) between two strings.

[0091] S3. According to the similarity calculation results, potential matching pairs are identified and recorded. The specific steps include: comparing and analyzing the Levenshtein distance with a preset distance reference threshold. If the Levenshtein distance is less than the distance reference threshold, the matching pair is marked as a match. If the Levenshtein distance is greater than or equal to the distance reference threshold, the matching pair is marked as a mismatch.

[0092] Calculate the matching pairs, the expression for calculation is: M i，j =match(F i , D j ), where M i，j Represents the element in the i-th row and j-th column of the matching pair matrix, representing the field data F i With database data D j Whether it matches, F i represents the field data collected for the ith time, D j represents the jth database data item, match represents the matching function, if F i With D j Returns 1 if a match is found, otherwise returns 0;

[0093] Calculate the coverage, the expression is: In the formula, C i represents the coverage of the i-th field data, j represents the number of matches of the i-th field data in all database data items, and n represents the total number of database data items;

[0094] The coverage of the field data is normalized, and the calculation expression for the normalization is: N i represents the coverage of the normalized i-th field data, min(C) represents the minimum value of all field data coverage, and max(C) represents the maximum value of all field data coverage;

[0095] The role of normalization is to convert data of different scales and ranges to a unified scale, so that they are comparable in subsequent analysis and processing. Through normalization, the impact of different dimensions in the original data can be eliminated, making the differences between data easier to compare and understand, and ensuring the accuracy and consistency of the analysis results.

[0096] Calculate the coverage index. The expression is: In the formula, CI μ represents the coverage index, α and β represent weight parameters, α is used to adjust the influence of the normalized coverage, and β is used to adjust the influence of the entropy value. The values ​​of α and β are not specifically limited here and can be adjusted intelligently according to actual scenarios and needs. i represents the weight of the i-th field data, reflecting the importance of the field data, m represents the total number of field data collected, H(N) represents the entropy value of the normalized coverage, and measures the distribution uniformity of data matching. The calculation formula is:

[0097] It can be seen from the coverage index that when matching the collected field data with the database storing the enterprise's sensitive data, the larger the coverage index performance value, the higher the matching degree and similarity between the collected field data and the database storing the enterprise's sensitive data; this means that more field data are successfully matched to the records in the database, showing a high degree of consistency and overlap between the two. On the contrary, the smaller the coverage index performance value, the lower the matching degree and similarity between the field data and the database, which means that fewer field data find matching records, showing that there are large differences and inconsistencies between the two.

[0098] When the collected field data is matched with the database where the enterprise's sensitive data is stored, if the matching density is high, it indicates that the field data has a high degree of similarity with the database where the enterprise's sensitive data is stored. Matching density refers to the frequency of matching field data with database records within a certain time range. When the matching density is high, it means that in multiple data transmission records, the field data frequently matches the sensitive data in the database. This frequent matching indicates that the field data has a high degree of consistency and similarity with the records in the database in terms of content, structure, format, etc. For example, if in each data transmission, field data such as bank account information, credit card number, etc. can often match the corresponding records in the database, it means that these transmission data and the data stored in the database have a high degree of overlap. Therefore, a high matching density reflects the high similarity between field data and database records. Through a high matching density, the accuracy of data monitoring and protection can be improved, and the security of sensitive data during transmission can be ensured.

[0099] The collected field data is matched with the database storing the enterprise's sensitive data. After analyzing and processing the matching density information during matching, the steps to generate the matching density index are as follows:

[0100] Collect all matching records of field data and enterprise sensitive data storage database, including successful and failed matching records, and calculate the matching success rate as a preliminary matching density measure. The calculation expression of the matching success rate is: In the formula, P represents the matching success rate, S represents the number of successful matches, and M represents the total number of matches;

[0101] Considering the different importance and quality of matching, the total matching weight is calculated. The expression for calculation is: Where W represents the total matching weight, ω k Indicates the weight coefficient of the kth match, m k Indicates whether the kth match is successful (1 for success and 0 for failure), and N represents the total number of matches;

[0102] Calculate the weighted matching success rate (to more accurately reflect the matching quality), the calculation expression is: Where P ω Represents the weighted matching success rate, taking into account the importance of different matches and giving higher weights to high-quality matches. Represents the sum of all matching weight coefficients;

[0103] The matching success rate and weighted matching success rate are combined to generate the matching density index. The calculation expression of the matching density index is: Where DMI μ represents the matching density index, r1 and r2 are the matching success rate P and weighted matching success rate P respectively. ω The weight coefficients of the matching success rate P and the weighted matching success rate P ω The values ​​of r1 and r2 are not specifically limited here, and can also be intelligently adjusted according to actual scenarios and needs.

[0104] The larger the performance value of the matching density index, the higher the similarity between the field data and the database where the enterprise sensitive data is stored; conversely, the smaller the performance value of the matching density index, the lower the similarity between the field data and the database where the enterprise sensitive data is stored. The matching density index quantifies the matching degree between the field data and the sensitive database records by comprehensively considering the matching success rate, the weighted matching success rate and the stability of the matching quantity. A high matching density index indicates that in multiple data transmission records, the field data frequently and accurately matches the sensitive data in the database, reflecting a high consistency and similarity; a low matching density index indicates a low matching frequency or poor matching quality, indicating that the similarity between the field data and the database records is low.

[0105] The machine learning model is not specifically limited here, and can achieve the coverage index CI μ and matching density index DMI μ Perform comprehensive analysis to generate similarity evaluation coefficient ψ Similarity In order to realize the technical solution of the present invention, the present invention provides a specific implementation method;

[0106] Similarity evaluation coefficient ψ Similarity The resulting calculation formula is:

[0107]

[0108] , where m a 、m b Coverage index CI μ and matching density index DMI μ The preset proportionality factor, and m a 、m b Both are greater than 0.

[0109] It can be seen from the similarity evaluation coefficient that the larger the performance value of the coverage index generated when matching the collected field data with the database storing the enterprise's sensitive data, the larger the performance value of the generated matching density index, that is, the larger the performance value of the generated similarity evaluation coefficient, the higher the matching degree between the collected field data and the database storing the enterprise's sensitive data, and vice versa.

[0110] The similarity evaluation coefficient generated when matching the collected field data with the database storing the enterprise's sensitive data is compared and analyzed with the pre-set similarity evaluation coefficient reference threshold to divide the transmitted data. The specific division steps are as follows:

[0111] If the similarity evaluation coefficient is greater than or equal to the similarity evaluation coefficient reference threshold, the transmission data is classified as high-sensitivity transmission data;

[0112] If the similarity evaluation coefficient is less than the similarity evaluation coefficient reference threshold, the transmission data is classified as low-sensitivity transmission data.

[0113] Perform facial recognition authentication on highly sensitive transmission data. After the authentication is passed, the information is transmitted to ensure that only personnel who meet the transmission conditions can transmit the information.

[0114] When processing transmission data classified as highly sensitive, the system will first perform facial recognition to verify the identity of the person operating the data transmission. Only when the facial recognition authentication is successful, that is, it is confirmed that the person is authorized to perform such sensitive data transmission, will the data transmission operation be allowed. This measure is intended to improve the security of data transmission through double verification, ensuring that sensitive data is only transmitted by authenticated legitimate personnel, thereby preventing unauthorized personnel from accessing or transmitting sensitive data and reducing data leakage and security risks.

[0115] For highly sensitive data that has not been authenticated, the TLS / SSL protocol is used to encrypt the data at the source and decrypt it at the target end to ensure that the data remains encrypted during transmission.

[0116] For highly sensitive data transmission that has not been authenticated, use the TLS / SSL protocol to encrypt it at the source of the data transmission and decrypt it at the target end. The specific steps are as follows:

[0117] Generate a public key and a private key pair at the source and target end of the data transmission, and the source server distributes the public key to the target server;

[0118] This step ensures that both parties have a unique encryption key pair, a public key for encryption and a private key for decryption.

[0119] Establish a TLS / SSL connection between the source server and the target server;

[0120] This process includes the handshake protocol, the exchange of public keys, negotiation of encryption algorithms and session keys, and the verification of certificates to ensure the legitimacy and security of the identities of both parties.

[0121] At the source server, the transmitted data is encrypted using the target server’s public key before transmission;

[0122] Public key encryption ensures that data cannot be decrypted and read even if it is intercepted during transmission. The encryption algorithm is usually an asymmetric encryption algorithm (such as RSA).

[0123] The encrypted data is transmitted via an established TLS / SSL secure connection;

[0124] During the transmission process, the data is always encrypted, which protects the data from man-in-the-middle attacks and data tampering.

[0125] On the target server, after receiving the encrypted data, it uses the private key to decrypt it;

[0126] Private key decryption ensures that only the target server can read the transmitted data and restore the original highly sensitive data content. The decryption algorithm is usually paired with the encryption algorithm (such as RSA).

[0127] The present invention captures and analyzes the transmission data in the network traffic in real time, uses deep packet inspection (DPI) technology to obtain the specific transmission content, and pre-processes and divides it. In combination with the enterprise's security policy, a field collection database is established and matched, and the data is analyzed and evaluated for similarity through a machine learning model to divide the transmission data into high-sensitivity and low-sensitivity data. Before the transmission of highly sensitive data, face recognition authentication is performed, and the data that has not been authenticated is encrypted and transmitted using the TLS / SSL protocol to ensure the security of the data during transmission, thereby effectively preventing the leakage of financial information, ensuring the financial security of the enterprise, and avoiding economic losses and financial crises caused by data leakage.

[0128] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters in the formula are set by technicians in this field according to actual conditions.

[0129] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0130] The above description is only by way of illustration of certain exemplary embodiments of the present invention. It is undoubted that those skilled in the art can modify the described embodiments in various ways without departing from the spirit and scope of the present invention. Therefore, the above drawings and descriptions are illustrative in nature and should not be construed as limiting the scope of protection of the claims of the present invention.

Claims

1. A data classification management and control method based on artificial intelligence, characterized in that: The following steps are involved: Capture all data streams transmitted from sensitive information storage devices in real time through network traffic monitoring tools, and use deep packet inspection technology to parse network packets and obtain specific transmission data; Preprocess the captured transmission data, divide the preprocessed transmission data according to predefined fields, determine the sensitive fields that need to be monitored according to the enterprise's security policy, summarize the sensitive fields, and establish a field collection database; Collect several field data during data transmission, match the collected field data with the database storing sensitive data of the enterprise, and use machine learning models to perform similarity analysis on the transmission data and the field collection database. Based on the analysis results, the transmission data is divided into highly sensitive transmission data and low-sensitivity transmission data; Perform facial recognition authentication on highly sensitive transmission data. After the authentication is passed, the information is transmitted to ensure that only personnel who meet the transmission conditions can transmit the information. For highly sensitive data transmission that has not been authenticated, the TLS / SSL protocol is used to encrypt the data at the source and decrypt it at the target end to ensure that the data remains encrypted during transmission.

2. According to the artificial intelligence-based data classification management method of claim 1, it is characterized in that: Use deep packet inspection technology to parse network packets and obtain specific transmission data. The specific steps are as follows: Install traffic monitoring tools in the network to monitor all data flows transmitted from sensitive information storage devices in real time; Use filters to preliminarily classify and filter captured data packets, identify and eliminate irrelevant data flows; Reassemble the segmented data packets through TCP stream reassembly and restore them into complete messages or files, ensuring deep packet inspection and analysis of complete application layer data; The reassembled data packets are analyzed by the protocol analyzer, parsing the network protocol stack layer by layer, from the link layer, network layer to the transport layer, and finally reaching the application layer; After the data is extracted at the application layer, it is deeply analyzed by the DPI engine to extract the specific transmission data.

3. According to the data classification management method based on artificial intelligence in claim 1, it is characterized in that: The specific steps of preprocessing the captured transmission data and dividing the preprocessed transmission data according to predefined fields are as follows: Clean the captured transmission data to remove noise and irrelevant information; Based on the cleaned data, data analysis is performed to convert the original data into structured data; According to the predefined fields, the parsed data is subjected to field extraction; The extracted fields are mapped and classified with the predefined fields, and the field data of different categories are classified into the corresponding database or storage system according to the enterprise's security policy.

4. According to the data classification management method based on artificial intelligence in claim 1, it is characterized in that: When matching the collected field data with the database storing the enterprise's sensitive data, obtain the coverage information and matching density information during matching. After analyzing and processing the coverage information and matching density information, generate a coverage index and a matching density index. Input the coverage index and the matching density index into a pre-trained machine learning model to generate a similarity evaluation coefficient. The similarity between the transmitted data and the field collection database is intelligently evaluated through the similarity evaluation coefficient.

5. The data classification management and control method based on artificial intelligence according to claim 4 is characterized in that: The similarity evaluation coefficient generated when matching the collected field data with the database storing the enterprise's sensitive data is compared and analyzed with the pre-set similarity evaluation coefficient reference threshold to divide the transmitted data. The specific division steps are as follows: If the similarity evaluation coefficient is greater than or equal to the similarity evaluation coefficient reference threshold, the transmission data is classified as high-sensitivity transmission data; If the similarity evaluation coefficient is less than the similarity evaluation coefficient reference threshold, the transmission data is classified as low-sensitivity transmission data.

6. The data classification management and control method based on artificial intelligence according to claim 1 is characterized in that: For highly sensitive data transmission that has not been authenticated, use the TLS / SSL protocol to encrypt it at the source of the data transmission and decrypt it at the target end. The specific steps are as follows: Generate a public key and a private key pair at the source and target end of the data transmission, and the source server distributes the public key to the target server; Establish a TLS / SSL connection between the source server and the target server; At the source server, the transmitted data is encrypted using the target server’s public key before transmission; The encrypted data is transmitted via an established TLS / SSL secure connection; On the target server, after receiving the encrypted data, it uses the private key to decrypt it.

7. The data classification management method based on artificial intelligence according to claim 4 is characterized in that: The collected field data is matched with the database storing the enterprise's sensitive data. After analyzing and processing the coverage information during matching, the steps to generate the coverage index are as follows: Perform preliminary matching using hash matching or similarity algorithms to identify potential matching pairs; Calculate the matching pairs, the expression for calculation is: M i，j =match(F i , D j ), where M i，j Represents the element in the i-th row and j-th column of the matching pair matrix, representing the field data F i With database data D j Whether it matches, F i represents the field data collected for the ith time, D j represents the jth database data item, match represents the matching function, if F i With D j Returns 1 if a match is found, otherwise returns 0; Calculate the coverage, the expression is: In the formula, C i represents the coverage of the i-th field data, represents the number of matches of the i-th field data in all database data items, and n represents the total number of database data items; The coverage of the field data is normalized, and the calculation expression for the normalization is: N i represents the coverage of the normalized i-th field data, min(C) represents the minimum value of all field data coverage, and max(C) represents the maximum value of all field data coverage; Calculate the coverage index. The expression is: In the formula, CI μ represents the coverage index, α and β represent weight parameters, α is used to adjust the influence of the normalized coverage, β is used to adjust the influence of the entropy value, w i represents the weight of the i-th field data, reflecting the importance of the field data, m represents the total number of field data collected, H(N) represents the entropy value of the normalized coverage, and measures the distribution uniformity of data matching. The calculation formula is:

8. The data classification management and control method based on artificial intelligence according to claim 7 is characterized in that: Use hash matching or similarity algorithms to perform preliminary matching and identify potential matching pairs as follows: S1. Select a data hash function, convert each field data into a hash value of fixed length, apply the selected hash function, hash encode each field data and database data, generate a corresponding hash value list, and store the hash value of the database data in the hash table; S2. For each field data to be matched, calculate its similarity with the database data. If the hash match is unsuccessful, further use the similarity algorithm to perform fine-grained comparison. The specific steps include: Look up the hash value of the field data in the hash table. If a completely matching hash value is found, it is considered a potential match. For hash values ​​that are not completely matched, a similarity algorithm is used to calculate the similarity between the field data and the database data. S3. Based on the similarity calculation results, identify and record potential matching pairs. The specific steps include: The Levenshtein distance is compared with the preset distance reference threshold for analysis. If the Levenshtein distance is less than the distance reference threshold, the matching pair is marked as a match; if the Levenshtein distance is greater than or equal to the distance reference threshold, the matching pair is marked as a mismatch.

9. The data classification management method based on artificial intelligence according to claim 4 is characterized in that: The collected field data is matched with the database storing the enterprise's sensitive data. After analyzing and processing the matching density information during matching, the steps to generate the matching density index are as follows: Collect all matching records of field data and enterprise sensitive data storage database, including successful and failed matching records, and calculate the matching success rate as a preliminary matching density measure. The calculation expression of the matching success rate is: In the formula, P represents the matching success rate, S represents the number of successful matches, and M represents the total number of matches; Calculate the total matching weight. The calculation expression is: Where W represents the total matching weight, ω k Indicates the weight coefficient of the kth match, m k Indicates whether the kth match is successful, and N indicates the total number of matches; Calculate the weighted matching success rate. The calculation expression is: Where P ω Represents the weighted matching success rate, taking into account the importance of different matches and giving higher weights to high-quality matches. Represents the sum of all matching weight coefficients; The matching success rate and weighted matching success rate are combined to generate the matching density index. The calculation expression of the matching density index is: Where DMI μ represents the matching density index, r1 and r2 are the matching success rate P and weighted matching success rate P respectively. ω The weight coefficients of the matching success rate P and the weighted matching success rate P ω The importance of.

Images