Privacy protection and access control method and system based on unstructured metadata

Abstract

The invention provides a privacy protection and access control method and system based on unstructured metadata, and relates to the technical field of data processing, and the method comprises the steps: obtaining to-be-processed time sequence metadata of a plurality of data source nodes, calculating sensitivity characteristics and scores, and dividing sensitivity levels; a differential privacy budget is allocated according to the sensitivity level for processing; setting hierarchical access permissions and desensitizing visitor information; and analyzing access behavior characteristics and setting a differential privacy threshold to perform abnormal access judgment. According to the method, refined grading protection on the time sequence sensitive data is realized, the privacy protection efficiency is improved, and meanwhile, the data availability is ensured.

Description

Technical Field

[0001] The present invention relates to data processing technology, and in particular to a privacy protection and access control method and system based on unstructured metadata. Background Art

[0002] With the advent of the big data era, the collection, storage, and analysis of massive amounts of unstructured metadata have become critical assets across various industries. This time-series metadata often contains both sensitive and non-sensitive information. While providing value, it also poses serious privacy risks. This is particularly true in fields like healthcare, finance, and intelligent transportation, where time-series metadata contains personal privacy information. Direct use without proper protection can lead to privacy breaches and even legal risks.

[0003] Currently, privacy protection for unstructured time-series metadata primarily relies on traditional methods such as data desensitization and encrypted storage, but these methods have significant flaws. On the one hand, traditional privacy protection technologies often apply a uniform standard to all data, ignoring the differences in data sensitivity. This results in insufficient protection of highly sensitive data or overprotection of less sensitive data, making it impossible to achieve refined privacy protection. On the other hand, existing technologies often separate privacy protection from access control, lacking a linkage mechanism between the two. This makes it difficult for the system to dynamically adjust access policies based on data sensitivity, increasing system management complexity and security risks. Furthermore, existing privacy protection solutions lack effective access behavior monitoring and tracing mechanisms, making it impossible to promptly detect and prevent abnormal access behavior, making it difficult to address internal threats and the misuse of private data, and thus reducing overall data security.

[0004] Therefore, there is an urgent need for a technical solution that can provide refined privacy protection for unstructured time series metadata and organically combine privacy protection with access control to balance the relationship between data privacy protection and data availability, ensuring data security while maximizing data value. Summary of the Invention

[0005] The embodiments of the present invention provide a privacy protection and access control method and system based on unstructured metadata, which can solve the problems in the prior art.

[0006] A first aspect of an embodiment of the present invention provides a privacy protection and access control method based on unstructured metadata, comprising: Obtaining time series metadata to be processed from multiple data source nodes, where the time series metadata to be processed includes time series sensitive data and non-sensitive data; Calculating the sensitivity characteristics of the time series metadata to be processed at each data source node, calculating a sensitivity score based on the sensitivity characteristics, and classifying the time series sensitive data into time series sensitivity levels according to the sensitivity score; Allocating differential privacy budgets for time series sensitive data of different levels according to the time series sensitivity levels, performing differential privacy processing on the time series sensitive data using the differential privacy budgets, maintaining data availability while protecting data privacy, and generating time series data after differential privacy protection; Setting hierarchical access rights for the differentially private protected time series data according to the time series sensitivity level, performing permission verification on the access request, desensitizing the verified visitor information using a differential privacy algorithm corresponding to the differential privacy budget, and generating a desensitized access record; The access behavior characteristics are analyzed based on the desensitized access records, and different differential privacy thresholds are set in combination with the temporal sensitivity level. When the access behavior characteristics exceed the corresponding differential privacy threshold, it is determined to be an abnormal access behavior, and an access tracing report is generated.

[0007] Calculating the sensitivity characteristics of the time series metadata to be processed at each data source node, calculating a sensitivity score based on the sensitivity characteristics, and classifying the time series sensitive data into time series sensitivity levels according to the sensitivity score includes: Calculating, at each data source node, sensitivity features of the time series metadata to be processed, where the sensitivity features include time series fluctuation features and data association features; Constructing a sensitivity evaluation adversarial network, the sensitivity evaluation adversarial network including a generator and a discriminator, wherein the generator adaptively samples according to the distribution characteristics of the time series fluctuation characteristics and the data association characteristics to generate multi-scale perturbation samples, and the discriminator uses a dynamic weighted attention mechanism to evaluate the sensitivity stability of the multi-scale perturbation samples under different perturbation levels, and feeds the evaluation results back to the generator to guide the generation process of the perturbation samples; An adversarial loss function is constructed based on the multi-scale perturbation samples output by the generator and the sensitivity stability evaluation results of the discriminator. The sampling strategy of the generator and the evaluation weight of the discriminator are updated by iteratively optimizing the adversarial loss function, so that the sensitivity evaluation adversarial network has the ability to defend against attacks; The optimized sensitivity evaluation adversarial network is used to perform robustness evaluation on the sensitivity feature to obtain a sensitivity evaluation result, a sensitivity score is calculated based on the sensitivity evaluation result, and the time series metadata to be processed is divided into time series sensitivity levels according to the sensitivity score.

[0008] Based on the generator adaptively sampling according to the distribution characteristics of the time series fluctuation characteristics and the data association characteristics to generate multi-scale perturbation samples, the discriminator adopts a dynamic weighted attention mechanism to evaluate the sensitivity stability of the multi-scale perturbation samples under different perturbation degrees, including: Constructing a conditional variational autoencoder based on the time series fluctuation feature and the data association feature, wherein the conditional variational autoencoder includes a posterior distribution network and a prior distribution network, and generating a mean parameter and a variance parameter based on the posterior distribution network and the prior distribution network respectively; Inputting the mean parameter and the variance parameter into a generator, generating a multi-scale perturbation vector based on the generator through a reparameterization technique, mapping the mean parameter and the variance parameter to a latent space based on the reparameterization technique, and determining a perturbation sample based on the multi-scale perturbation vector and a random sampling vector of a standard normal distribution; A hierarchical attention network of the discriminator is constructed, the perturbation sample is input into the hierarchical attention network, the hierarchical attention network is used to perform multi-layer feature transformation on the perturbation sample to generate a multi-layer feature representation, attention weights are calculated based on the multi-layer feature representation, a feature reconstruction vector is determined based on the attention weights and the multi-layer feature representation, and the sensitivity stability of the perturbation sample under different perturbation degrees is evaluated based on the feature reconstruction vector.

[0009] Allocating differential privacy budgets to time series sensitive data of different levels according to the time series sensitivity level, performing differential privacy processing on the time series sensitive data using the differential privacy budget, maintaining data availability while protecting data privacy, and generating time series data after differential privacy protection includes: Calculating an initial allocation coefficient of the differential privacy budget according to the time series sensitivity level, inputting the initial allocation coefficient into a dynamic budget allocation function, and calculating the differential privacy budget of each time series sensitive data based on the initial allocation coefficient and the total privacy budget; Determining a scale parameter of the Laplace noise according to the differential privacy budget, generating Laplace noise based on the scale parameter, and adding the Laplace noise to the time series sensitive data to generate noisy time series data; calculating a data availability index between the noisy time series data and the original time series sensitive data, and calculating an adjustment direction and adjustment amplitude of the budget allocation based on the data availability index and the privacy protection level; The initial allocation coefficient is updated according to the adjustment direction and the adjustment amplitude, and the updated allocation coefficient is re-input into the dynamic budget allocation function to generate a new differential privacy budget; the process of noise addition and data availability calculation is repeatedly performed using the new differential privacy budget until the data availability indicator reaches a preset indicator threshold, and the time series data after differential privacy protection is output.

[0010] Setting hierarchical access rights for the differentially private protected time series data according to the time series sensitivity level, performing permission verification on the access request, and performing desensitization processing on the verified visitor information using a differential privacy algorithm corresponding to the differential privacy budget. Generating the desensitized access record includes: Setting a corresponding hierarchical access permission threshold based on the timing sensitivity level, the hierarchical access permission threshold being used to define the minimum permission requirement for the visitor; extracting visitor identity information, access time, and access operation type from the access request, and comparing the visitor identity information with the hierarchical access permission threshold; When the visitor identity information meets the hierarchical access permission threshold, calculating the visitor trust coefficient based on the permission level of the visitor identity information, the historical access behavior corresponding to the access time, and the access frequency of the access operation type; selecting a differential privacy algorithm that matches the differential privacy budget according to the visitor trust coefficient, and using the differential privacy algorithm to desensitize sensitive fields in the visitor identity information to generate desensitized visitor information; The desensitized visitor information, the access time, the timing sensitivity level, the differential privacy budget, and the access operation type are combined into an access record; noise of an intensity corresponding to the differential privacy budget is added to the sensitive fields in the access record to generate a desensitized access record.

[0011] Selecting a differential privacy algorithm that matches the differential privacy budget according to the visitor trust coefficient, desensitizing sensitive fields in the visitor identity information using the differential privacy algorithm, and generating desensitized visitor information includes: Constructing a differential privacy algorithm pool, wherein the differential privacy algorithm pool includes multiple differential privacy algorithms, and dividing the sensitive fields in the visitor identity information into an identity identification field, a location information field, a behavior feature field, and an attribute information field; Calculating the algorithm matching degree of each differential privacy algorithm for different types of sensitive fields, and allocating the differential privacy budget according to the sensitive field type based on the visitor trust coefficient to obtain a local budget; selecting an optimal differential privacy algorithm from the differential privacy algorithm pool according to the algorithm matching degree and the local budget, grouping the sensitive fields in the visitor identity information by type to obtain a sensitive field sequence, and inputting the sensitive field sequence into the optimal differential privacy algorithm; Based on the local budget, differential privacy processing is performed on the sensitive field sequence to generate initial desensitized data, and a data utility evaluation score of the initial desensitized data is calculated; the algorithm parameters of the optimal differential privacy algorithm are adjusted according to the data utility evaluation score, and the sensitive field sequence is reprocessed using the adjusted optimal differential privacy algorithm to generate desensitized visitor information.

[0012] Analyze access behavior characteristics based on the desensitized access records, set different differential privacy thresholds based on the temporal sensitivity level, and determine abnormal access behavior when the access behavior characteristics exceed the corresponding differential privacy threshold. Generate an access tracing report including: Extracting access time distribution, access frequency, access duration, and access resource type from the desensitized access records, and combining the access time distribution, access frequency, access duration, and access resource type to generate access behavior features; Analyzing an access behavior pattern based on the access behavior characteristics, determining a baseline threshold according to the access behavior pattern and the timing sensitivity level, and multiplying the baseline threshold by an adjustment coefficient of the timing sensitivity level to obtain a differential privacy threshold; Inputting the access behavior feature into a feature analysis module, calculating the access time distribution, the access frequency, the access duration, and the feature weight coefficient of the access resource type based on the feature analysis module; multiplying the differential privacy threshold by the feature weight coefficient to obtain the differential privacy threshold corresponding to each access behavior feature; Calculating the access time distribution, the access frequency, the access duration, and the deviation value of the access resource type from a preset normal resource access pattern; comparing the deviation values ​​with their corresponding differential privacy thresholds, and when any of the deviation values ​​exceeds the corresponding differential privacy threshold, determining the current access behavior as abnormal access behavior; The detection time of the abnormal access behavior is recorded, and the detection time, the access behavior characteristics, the deviation value, and the differential privacy threshold are combined into an access tracing report.

[0013] A second aspect of an embodiment of the present invention provides a privacy protection and access control system based on unstructured metadata, including: The first unit is configured to obtain time series metadata to be processed from multiple data source nodes, where the time series metadata to be processed includes time series sensitive data and non-sensitive data; The second unit is configured to calculate the sensitivity characteristics of the time series metadata to be processed at each data source node, calculate a sensitivity score based on the sensitivity characteristics, and classify the time series sensitive data into time series sensitivity levels according to the sensitivity score; A third unit is configured to allocate differential privacy budgets to time series sensitive data of different levels according to the time series sensitivity level, perform differential privacy processing on the time series sensitive data using the differential privacy budget, maintain data availability while protecting data privacy, and generate differentially private protected time series data; a fourth unit, configured to set hierarchical access rights for the differentially private protected time series data according to the time series sensitivity level, perform permission verification on the access request, perform desensitization processing on the verified visitor information using a differential privacy algorithm corresponding to the differential privacy budget, and generate a desensitized access record; The fifth unit is used to analyze the access behavior characteristics based on the desensitized access records, set different differential privacy thresholds in combination with the temporal sensitivity level, and determine it as abnormal access behavior when the access behavior characteristics exceed the corresponding differential privacy threshold, and generate an access tracing report.

[0014] According to a third aspect of an embodiment of the present invention, an electronic device is provided, including: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0015] According to a fourth aspect of an embodiment of the present invention, a computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the method described above is implemented.

[0016] The beneficial effects of this application are as follows: The method of the present invention achieves a precise match between privacy protection strength and data sensitivity by assigning differentiated privacy protection strategies to time series data of different sensitivity levels. While ensuring full protection of highly sensitive data, it avoids excessive protection of low-sensitivity data and improves the overall data availability.

[0017] The method of the present invention establishes a hierarchical access control mechanism based on sensitivity levels, and desensitizes visitor information in combination with differential privacy technology, which not only guarantees the security of data access, but also ensures the traceability of access behavior, and effectively balances the relationship between data openness and sharing and privacy protection.

[0018] By dynamically monitoring access behavior and setting differentiated privacy thresholds, the method of the present invention can promptly discover abnormal access patterns for data of different sensitivities, forming a complete access tracing chain, and significantly improving the privacy security protection capabilities and abnormal behavior identification capabilities of unstructured time series metadata in a multi-source environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 Schematic diagram of a process for privacy protection and access control based on unstructured metadata according to an embodiment of the present invention; Figure 2 This is a flow chart of a differential privacy budget allocation and processing method based on temporal sensitivity levels according to an embodiment of the present invention; Figure 3 This is a flow chart of a hierarchical access control and differential privacy processing method based on time sensitivity levels according to an embodiment of the present invention; Figure 4 This is a histogram analyzing abnormal access behavior characteristics based on timing sensitivity levels according to an embodiment of the present invention. DETAILED DESCRIPTION

[0020] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0021] The technical solution of the present invention is described in detail below with reference to specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0022] Figure 1 FIG. 1 is a flow chart of a privacy protection and access control method based on unstructured metadata according to an embodiment of the present invention. Figure 1 As shown, the method includes: Obtaining time series metadata to be processed from multiple data source nodes, where the time series metadata to be processed includes time series sensitive data and non-sensitive data; Calculating the sensitivity characteristics of the time series metadata to be processed at each data source node, calculating a sensitivity score based on the sensitivity characteristics, and classifying the time series sensitive data into time series sensitivity levels according to the sensitivity score; Allocating differential privacy budgets for time series sensitive data of different levels according to the time series sensitivity levels, performing differential privacy processing on the time series sensitive data using the differential privacy budgets, maintaining data availability while protecting data privacy, and generating time series data after differential privacy protection; Setting hierarchical access rights for the differentially private protected time series data according to the time series sensitivity level, performing permission verification on the access request, desensitizing the verified visitor information using a differential privacy algorithm corresponding to the differential privacy budget, and generating a desensitized access record; The access behavior characteristics are analyzed based on the desensitized access records, and different differential privacy thresholds are set in combination with the temporal sensitivity level. When the access behavior characteristics exceed the corresponding differential privacy threshold, it is determined to be an abnormal access behavior, and an access tracing report is generated.

[0023] In an optional implementation, calculating the sensitivity characteristics of the time series metadata to be processed at each data source node, calculating a sensitivity score based on the sensitivity characteristics, and classifying the time series sensitive data into time series sensitivity levels according to the sensitivity score includes: Calculating, at each data source node, sensitivity features of the time series metadata to be processed, where the sensitivity features include time series fluctuation features and data association features; Constructing a sensitivity evaluation adversarial network, the sensitivity evaluation adversarial network including a generator and a discriminator, wherein the generator adaptively samples according to the distribution characteristics of the time series fluctuation characteristics and the data association characteristics to generate multi-scale perturbation samples, and the discriminator uses a dynamic weighted attention mechanism to evaluate the sensitivity stability of the multi-scale perturbation samples under different perturbation levels, and feeds the evaluation results back to the generator to guide the generation process of the perturbation samples; An adversarial loss function is constructed based on the multi-scale perturbation samples output by the generator and the sensitivity stability evaluation results of the discriminator. The sampling strategy of the generator and the evaluation weight of the discriminator are updated by iteratively optimizing the adversarial loss function, so that the sensitivity evaluation adversarial network has the ability to defend against attacks; The optimized sensitivity evaluation adversarial network is used to perform robustness evaluation on the sensitivity feature to obtain a sensitivity evaluation result, a sensitivity score is calculated based on the sensitivity evaluation result, and the time series metadata to be processed is divided into time series sensitivity levels according to the sensitivity score.

[0024] The sensitivity features of the time series metadata to be processed are calculated at each data source node. The sensitivity features include time series fluctuation features and data association features. The time series fluctuation features can be extracted using the sliding window method. Statistical indicators such as volatility, kurtosis, and skewness are calculated for each time window.

[0025] For example, for electricity consumption data, a 24-hour sliding window can be set and the ratio of the standard deviation to the mean of the data within the window can be calculated as volatility. The peaks and asymmetry of the data distribution can also be analyzed. Data association features are obtained by calculating the correlation matrix between time series data and other related data sources. These include the Pearson correlation coefficient and mutual information value, which reflect the strength of linear and nonlinear relationships between the data.

[0026] The core of this method is to construct a sensitivity assessment adversarial network. This network consists of two main components: a generator and a discriminator. The generator uses a deep neural network architecture with multiple layers of fully connected layers and residual connections. Its input is time series fluctuation characteristics and data association characteristics, and its output is multi-scale perturbation samples. In practical applications, the generator adaptively adjusts the sampling strategy based on the distribution characteristics of different features, increasing the sampling density in high-volatility areas and reducing the sampling frequency in stable areas. For example, for financial transaction data, the generator will generate more diverse perturbation samples for data during peak trading periods, including small perturbations (±2% of the original value), medium perturbations (±5%), and large perturbations (±10%), forming a multi-scale perturbation sample set.

[0027] The discriminator also uses a deep neural network structure, but introduces a dynamically weighted attention mechanism that assigns different weights to perturbation samples of different scales through a soft attention layer. The discriminator evaluates the sensitivity stability of each perturbation sample under different perturbation levels. Stability indicators include the difference in data distribution before and after the perturbation and the magnitude of changes in key statistical features. In the health monitoring data scenario, the discriminator focuses on the impact of fluctuations in physiological indicators on the risk of sensitive information leakage, and gives a higher weight to the risk of activity pattern recognition caused by small perturbations in heart rate data. The discriminator's evaluation results are fed back to the generator through a backpropagation mechanism to guide the adjustment of the sampling strategy during the subsequent perturbation sample generation process.

[0028] Based on the interaction between the generator and the discriminator, an adversarial loss function is constructed for network optimization. The adversarial loss function consists of three parts: generator loss, discriminator loss, and stability loss. The generator loss encourages the generation of more challenging perturbation samples; the discriminator loss forces the discriminator to accurately identify sensitivity changes; and the stability loss ensures that the model maintains consistent evaluation under different perturbation levels.

[0029] During the actual optimization process, an alternating training strategy was employed. In each round, the generator parameters were first fixed to update the discriminator parameters, and then the discriminator parameters were fixed to update the generator parameters. The number of iterations was set to 100. After optimization, the sensitivity assessment adversarial network was able to identify subtle changes in data patterns and maintain its defense against adversarial attacks.

[0030] For smart home energy consumption data, the optimized sensitivity assessment adversarial network can identify the risk of leakage of user lifestyle information even when adding 5% random noise. By comparing the sensitivity assessment results of the original data and data with varying degrees of perturbation, a comprehensive sensitivity score is calculated. The sensitivity score is calculated using a weighted average method, with a weight of 0.6 for time series fluctuation features and a weight of 0.4 for data association features. The score ranges from 0 to 100, with higher values ​​indicating greater sensitivity.

[0031] Based on the sensitivity score, the time series metadata to be processed is divided into four sensitivity levels: low sensitivity (0-25 points), medium sensitivity (26-50 points), high sensitivity (51-75 points), and extremely high sensitivity (76-100 points). In the industrial production monitoring data example, equipment operating status data scored 35 points, which is classified as medium sensitivity; while production recipe parameter data scored 82 points, which is classified as extremely high sensitivity. Data of different sensitivity levels adopts differentiated strategies for subsequent storage, transmission, and access control. Highly sensitive data adopts stricter encryption and access restrictions to ensure data security while balancing system efficiency.

[0032] Practical applications of this method demonstrate that the sensitivity assessment adversarial network can accurately identify sensitive patterns in time series data and maintain assessment accuracy even in the presence of intentional interference. Compared with traditional rule-based sensitivity assessment methods, this method exhibits greater adaptability and robustness in dynamically changing data environments, improving sensitivity classification accuracy by approximately 15%. This advantage is particularly evident in scenarios with multi-source, heterogeneous time series data.

[0033] In an optional embodiment, the generator adaptively samples the distribution characteristics of the time series fluctuation features and the data association features to generate multi-scale perturbation samples, and the discriminator uses a dynamic weighted attention mechanism to evaluate the sensitivity stability of the multi-scale perturbation samples under different perturbation degrees, including: Constructing a conditional variational autoencoder based on the time series fluctuation feature and the data association feature, wherein the conditional variational autoencoder includes a posterior distribution network and a prior distribution network, and generating a mean parameter and a variance parameter based on the posterior distribution network and the prior distribution network respectively; Inputting the mean parameter and the variance parameter into a generator, generating a multi-scale perturbation vector based on the generator through a reparameterization technique, mapping the mean parameter and the variance parameter to a latent space based on the reparameterization technique, and determining a perturbation sample based on the multi-scale perturbation vector and a random sampling vector of a standard normal distribution; A hierarchical attention network of the discriminator is constructed, the perturbation sample is input into the hierarchical attention network, the hierarchical attention network is used to perform multi-layer feature transformation on the perturbation sample to generate a multi-layer feature representation, attention weights are calculated based on the multi-layer feature representation, a feature reconstruction vector is determined based on the attention weights and the multi-layer feature representation, and the sensitivity stability of the perturbation sample under different perturbation degrees is evaluated based on the feature reconstruction vector.

[0034] When building a conditional variational autoencoder, it's important to fully utilize time series fluctuation features and data association features. Time series fluctuation features include amplitude change, periodicity, trend, and mutation, and are extracted using a sliding window method. For the time series data of a temperature sensor [23.5, 24.1, 24.3, 23.8, 23.2, 22.9, 23.4, 23.7], a sliding window of length 5 is used to extract the amplitude change features [0.9, 1.4, 1.1, 0.9, 0.8]. The periodicity features are calculated using the autocorrelation function to obtain [0.85, 0.62, 0.31, -0.12]. Data association features include spatiotemporal correlation, attribute correlation, and semantic correlation, and are represented by a correlation matrix. For example, the attribute correlation between temperature and humidity is -0.75, indicating a strong negative correlation.

[0035] The conditional variational autoencoder consists of a posterior distribution network and a prior distribution network. The posterior distribution network uses a three-layer neural network structure. The number of input layer nodes is the sum of the original data dimension and the conditional feature dimension. For example, for 10-dimensional original data and 5-dimensional conditional features, the number of input layer nodes is 15. The number of hidden layer nodes is 128, and the ReLU activation function is used. The output layer is divided into two parts, outputting the mean parameter and the variance parameter respectively. The number of nodes in each part is equal to the latent space dimension. For example, if the latent space dimension is set to 32, the output layer has a total of 64 nodes. The prior distribution network takes only the conditional features as input. Its structure is similar to the posterior distribution network, but the number of input layer nodes is only equal to the conditional feature dimension.

[0036] In the specific implementation, for temperature time series data, the extracted time series fluctuation feature dimension is 12, the data association feature dimension is 8, the original data dimension is 24, the input dimension of the posterior distribution network is 44, and the input dimension of the prior distribution network is 20. Through forward propagation calculation, the posterior distribution network outputs the mean parameter μ posterior =[0.12,-0.35,0.42...-0.18] and variance parameter σ 2 posterior =[0.08,0.12,0.05...0.09], the prior distribution network output mean parameter μ prior =[0.08,-0.22,0.31...-0.15] and the variance parameter σ 2 prior =[0.10,0.15,0.08...0.11].

[0037] The mean parameter and variance parameter are input into the generator, and the multi-scale perturbation vector is generated by reparameterization technology. The reparameterization technology maps the mean parameter and variance parameter to the latent space through linear transformation. The specific method is to take the random sampling vector ε of the standard normal distribution and calculate z=μ+σ×ε, where μ is the mean parameter and σ is the square root of the variance parameter. For different perturbation scales, the perturbation factor α is set. By adjusting the value of α, different degrees of perturbation are generated and z is calculated. disturbed =μ+α×σ×ε.

[0038] In practical applications, the perturbation factor α is set to [0.5, 1.0, 1.5, 2.0], representing slight perturbation, moderate perturbation, strong perturbation, and severe perturbation, respectively. For the random sampling vector ε=[-0.62, 0.84, -0.15...0.37] of the standard normal distribution, the generated multi-scale perturbation vectors are z 0.5 =[0.08,-0.30,0.40...-0.12],z 1.0 =[0.05,-0.26,0.38...-0.07],z 1.5 =[0.01,-0.22,0.36...-0.01] and z 2.0 =[-0.03,-0.17,0.34...0.04].

[0039] Perturbation samples are generated based on multi-scale perturbation vectors and a decoder network. The decoder network uses a three-layer neural network structure. The number of input layer nodes is the sum of the latent space dimension and the conditional feature dimension. For example, if the latent space dimension is 32 and the conditional feature dimension is 20, the number of input layer nodes is 52. The number of hidden layer nodes is 128, and the ReLU activation function is used. The number of output layer nodes is the original data dimension. For perturbation vectors of four different perturbation scales, four sets of perturbation samples are generated through the decoder network.

[0040] For example, for temperature time series data, the original data is [23.5, 24.1, 24.3, 23.8, 23.2, 22.9, 23.4, 23.7], and the four sets of perturbation samples generated are [23.6, 24.0, 24.2, 23.7, 23.3, 23.0, 23.3, 23.6], [23.8, 23.9, 24.0, 23.6, 23.4, 23.1, 23.2, 23.5], [24.0, 23.7, 23.8, 23.4, 23.6, 23.3, 23.0, 23.3] and [24.3, 23.5, 23.5, 23.2, 23.8, 23.5, 22.8, 23.0].

[0041] When constructing the discriminator's hierarchical attention network, a multi-layer convolutional architecture is used to extract features at different scales. The hierarchical attention network consists of three convolutional layers, with kernel sizes of 3, 5, and 7, respectively, to extract local, mid-range, and global features. Each convolutional layer is followed by a max pooling layer and a batch normalization layer. For example, for temperature time series data of length 24, after three convolutional layers, the feature maps F1, F2, and F3 are obtained, with dimensions of [16, 8], [16, 4], and [16, 2], respectively, where 16 is the number of kernels.

[0042] When calculating attention weights based on multi-layer feature representations, a self-attention mechanism is introduced. For each layer of feature representation Fi, an attention score si is calculated by performing a dot product operation on the feature vector and a learnable attention vector a, and then normalizing it using a softmax function to obtain the attention weight wi. For example, for a three-layer feature representation, the calculated attention weights are w1=0.45, w2=0.35, and w3=0.20, indicating that local features are most important and global features are least important.

[0043] The feature reconstruction vector is obtained by weighted fusion of multiple layers of feature representation. The calculation method is to multiply the feature representation of each layer by the corresponding attention weight and then sum it, that is, R = w1 × F1 + w2 × F2 + w3 × F3. For four groups of samples with different degrees of perturbation, their feature reconstruction vectors R1, R2, R3, and R4 are calculated respectively.

[0044] When evaluating the sensitivity stability of perturbed samples, we calculated the similarity between the reconstructed feature vector and the original data feature vector. This similarity was calculated using cosine similarity, which ranges from -1 to 1. Similarity values ​​closer to 1 indicate higher similarity. For the four sets of perturbed samples, the calculated similarities were sim1 = 0.95, sim2 = 0.87, sim3 = 0.73, and sim4 = 0.58, respectively.

[0045] The sensitivity stability score is calculated based on the similarity change rate. The similarity change rate represents the ratio of the change in similarity between adjacent perturbation scales and is calculated as (simi - simi + 1) / simi. In this example, the three similarity change rates are rate1 = (0.95 - 0.87) / 0.95 = 0.084, rate2 = (0.87 - 0.73) / 0.87 = 0.161, and rate3 = (0.73 - 0.58) / 0.73 = 0.205. The sensitivity stability score is the average of the similarity change rates, i.e., stability = (0.084 + 0.161 + 0.205) / 3 = 0.15. Lower scores indicate more stable data sensitivity under different perturbation levels.

[0046] Through the above method, multi-scale perturbation sample generation and sensitivity stability evaluation based on the generator and discriminator are realized, providing an effective technical solution for the privacy protection and stability analysis of time-series sensitive data.

[0047] In an optional implementation, differential privacy budgets are allocated to time series sensitive data of different levels according to the time series sensitivity level, and differential privacy processing is performed on the time series sensitive data using the differential privacy budget to protect data privacy while maintaining data availability. Generating differentially private protected time series data includes: Calculating an initial allocation coefficient of the differential privacy budget according to the time series sensitivity level, inputting the initial allocation coefficient into a dynamic budget allocation function, and calculating the differential privacy budget of each time series sensitive data based on the initial allocation coefficient and the total privacy budget; Determining a scale parameter of the Laplace noise according to the differential privacy budget, generating Laplace noise based on the scale parameter, and adding the Laplace noise to the time series sensitive data to generate noisy time series data; calculating a data availability index between the noisy time series data and the original time series sensitive data, and calculating an adjustment direction and adjustment amplitude of the budget allocation based on the data availability index and the privacy protection level; The initial allocation coefficient is updated according to the adjustment direction and the adjustment amplitude, and the updated allocation coefficient is re-input into the dynamic budget allocation function to generate a new differential privacy budget; the process of noise addition and data availability calculation is repeatedly performed using the new differential privacy budget until the data availability indicator reaches a preset indicator threshold, and the time series data after differential privacy protection is output.

[0048] like Figure 2 As shown, the method includes: The sensitivity level of time-series sensitive data is determined using a multi-dimensional feature assessment method that considers four dimensions: data disclosure risk, data value, timeliness, and impact. Each dimension is scored on a scale of 0-10. Disclosure risk assessment considers the degree of privacy damage caused by data leakage; data value assessment considers the commercial and application value of the data; timeliness assessment considers the time sensitivity of the data; and impact assessment considers the sensitivity increase caused by combining the data with other data.

[0049] For a time series dataset, the scores for the four dimensions are 9, 7, 8, and 6, respectively. The weighted average score is 8, corresponding to an extremely high sensitivity level. Based on the total score, sensitivity is divided into four levels: extremely sensitive (8-10 points), highly sensitive (6-8 points), moderately sensitive (4-6 points), and low sensitive (0-4 points).

[0050] Initial allocation coefficients are determined using a sensitivity-budget mapping method. Extremely sensitive data, due to the strongest privacy protection needs, receives the largest coefficient, set at 0.4. Highly sensitive data is next, set at 0.3. Medium-sensitive and low-sensitive data are assigned 0.2 and 0.1, respectively. These coefficients represent the proportion of each sensitivity level within the total budget. Initial coefficient setting also takes into account data size and distribution, and fine-tuning is performed using a weighting formula.

[0051] For example, if extremely sensitive data accounts for 50% of a given application scenario, the weight is adjusted to 0.4 × 1.1 = 0.44; if low-sensitivity data accounts for only 5%, the weight is adjusted to 0.1 × 0.9 = 0.09. The adjusted initial distribution coefficients are [0.44, 0.27, 0.2, 0.09], ensuring that the sum remains 1.

[0052] The dynamic budget allocation function uses a hierarchical incremental allocation method. This function takes an initial allocation coefficient and a total privacy budget as input and calculates the differential privacy budget for each sensitivity level. For an initial allocation coefficient of [0.44, 0.27, 0.2, 0.09] and a total budget of ε = 5.0, the differential privacy budget for extremely sensitive data is 5.0 × 0.44 = 2.2; for highly sensitive data, it is 5.0 × 0.27 = 1.35; for moderately sensitive data, it is 5.0 × 0.2 = 1.0; and for lowly sensitive data, it is 5.0 × 0.09 = 0.45.

[0053] After budget allocation, the data item budget needs to be further refined, with the budget for each sensitivity level further allocated to each data item within that level. For example, the extremely sensitive level includes 10 data items, each receiving a budget of 2.2 / 10 = 0.22; the low sensitivity level includes 5 data items, each receiving a budget of 0.45 / 5 = 0.09.

[0054] Laplace noise generation uses the inverse function transformation method, which first generates uniformly distributed random numbers and then uses the inverse function transformation to obtain Laplace distributed random numbers. The specific steps are: generate a uniformly distributed random number u in the interval (0,1); calculate v = u - 0.5; determine the sign of v s = sign(v); and calculate the noise value noise = -s × b × ln(1 - 2 × |v|), where b is the scale parameter. For example, for a scale parameter b = 5.0, generate a random number u = 0.2, calculate v = 0.2 - 0.5 = -0.3, determine s = -1, and the noise value is -(-1) × 5.0 × ln(1 - 2 × |-0.3|) = 5.0 × ln(1 - 0.6) = 5.0 × ln(0.4) = -4.6. This method generates multiple noise values ​​[-4.6, 2.3, -7.9, 3.5] for addition to time series data.

[0055] The scale parameter is calculated using the sensitivity ratio method, where the scale parameter b is equal to the global sensitivity ΔF divided by the differential privacy budget ε. Global sensitivity represents the maximum difference between any two adjacent datasets. For time series data, it can be determined by analyzing the historical change amplitude or range.

[0056] For example, if the global sensitivity of heart rate time series data is 15 beats per minute and the differential privacy budget is 2.2, then the scale parameter b = 15 / 2.2 = 6.82. If the global sensitivity of temperature time series data is 5 degrees and the differential privacy budget is 1.35, then the scale parameter b = 5 / 1.35 = 3.70. For time series data with different characteristics, the global sensitivity and scale parameter must be calculated separately.

[0057] The noise addition process uses a direct superposition method to add the generated Laplace noise directly to the original time-sensitive data, resulting in noisy time series data. For example, if the original heart rate time series data is [75, 78, 82, 80, 76], after adding noise with a scale parameter of 6.82 [-4.6, 2.3, -7.9, 3.5, 1.2], the noisy data is [70.4, 80.3, 74.1, 83.5, 77.2]. If the original temperature time series data is [36.5, 36.8, 37.2, 37.0, 36.7], after adding noise with a scale parameter of 3.70 [-2.5, 1.3, -4.2, 1.8, 0.6], the noisy data is [34.0, 38.1, 33.0, 38.8, 37.3].

[0058] The data availability index is calculated using a multi-index comprehensive evaluation method. This method combines the mean square error (MSE), signal-to-noise ratio (SNR), and temporal correlation (TCP) to comprehensively evaluate data availability. The MSE calculation formula is the sum of the squares of the difference between the original data and the noisy data divided by the data volume. For heart rate data, MSE = ((75-70.4) 2 +(78-80.3) 2 +(82-74.1) 2 +(80-83.5) 2 +(76-77.2) 2 ) / 5 = 23.41. SNR is calculated as the ratio of the original data variance to the noise variance: SNR = 6.7 / 16.89 = 0.40. TCP is calculated by comparing the autocorrelation function similarity between the original time series data and the noise data: TCP = 0.65. The weighted average of each indicator yields a comprehensive usability score. For heart rate data, the score is 0.4 × (1 - 23.41 / 100) + 0.3 × 0.40 + 0.3 × 0.65 = 0.4 × 0.7659 + 0.3 × 0.40 + 0.3 × 0.65 = 0.306 + 0.12 + 0.195 = 0.621.

[0059] The direction and magnitude of budget allocation adjustments are calculated using a goal-oriented feedback method. This method dynamically adjusts the allocation coefficient based on the gap between the current availability score and the target threshold. If the availability score falls below the target threshold, the budget allocated to high-sensitivity data is reduced, while the budget allocated to low-sensitivity data is increased, and vice versa. The magnitude of the adjustment is proportional to the gap.

[0060] For example, if the heart rate data availability score is 0.621, the target threshold is 0.7, and the gap is 0.079, the adjustment factor is 0.079 / 0.7 = 0.113. Applied to the initial distribution coefficients [0.44, 0.27, 0.2, 0.09], the adjusted value is [0.44 × (1 - 0.113), 0.27 × (1 - 0.056), 0.2 × (1 + 0.056), 0.09 × (1 + 0.113)] = [0.39, 0.255, 0.211, 0.1]. The adjustment amplitudes for different sensitivity levels decrease, ensuring that the adjusted sum still equals 1.

[0061] After budget reallocation, using the updated allocation coefficients [0.39, 0.255, 0.211, 0.1] and a total budget of ε = 5.0, the budgets for each level were recalculated to [1.95, 1.275, 1.055, 0.5]. The scale parameter for the heart rate data was changed from 15 / 2.2 = 6.82 to 15 / 1.95 = 7.69, resulting in increased noise. The scale parameter for the temperature data was changed from 5 / 1.35 = 3.70 to 5 / 1.275 = 3.92, resulting in a slight increase in noise. A new Laplace noise is generated, which is [-5.2, 2.6, -8.9, 4.0, 1.4] for the heart rate data. After adding it to the original data, [69.8, 80.6, 73.1, 84.0, 77.4] is obtained. The new MSE is 28.02, the SNR is reduced to 0.34, the TCP is reduced to 0.62, and the comprehensive availability score is reduced to 0.584.

[0062] As the usability score decreases, moving further away from the target threshold, the adjustment direction needs to be reversed. The second adjustment distribution coefficients are [0.44 × (1 + 0.05), 0.27 × (1 + 0.025), 0.2 × (1 - 0.025), 0.09 × (1 - 0.05)] = [0.462, 0.277, 0.195, 0.0855]. The budgets for each level are recalculated to [2.31, 1.385, 0.975, 0.4275]. The scale parameter of the heart rate data is changed to 15 / 2.31 = 6.49, reducing the noise. A new Laplace noise is generated and added to the original data to calculate the overall usability score of 0.673, close to the target threshold of 0.7.

[0063] Continuing iterative optimization, the third adjustment of the distribution coefficients was [0.462×(1+0.02), 0.277×(1+0.01), 0.195×(1-0.01), 0.0855×(1-0.02)] = [0.471, 0.28, 0.193, 0.0838]. The budget and scale parameters for each level were recalculated, and noise-processed data was generated. The calculated overall availability score was 0.705, exceeding the target threshold of 0.7, and the iteration was terminated.

[0064] Output the final differentially private time series data, which protects privacy and maintains usability. For heart rate data, the final differentially private data output is [71.3, 79.8, 75.6, 82.1, 76.5], and for temperature data, the final differentially private data output is [35.2, 37.5, 34.8, 37.9, 36.9].

[0065] Through the above method, dynamic allocation of differential privacy budget based on time series sensitivity level is realized, which effectively solves the problems of inflexible budget allocation and difficult balance between data availability and privacy protection in traditional differential privacy methods, and provides a practical technical solution for the privacy protection of time series sensitive data.

[0066] In an optional embodiment, hierarchical access rights are set for the differentially private protected time series data according to the time series sensitivity level, access requests are verified, and the verified visitor information is desensitized using a differential privacy algorithm corresponding to the differential privacy budget. Generating desensitized access records includes: Setting a corresponding hierarchical access permission threshold based on the timing sensitivity level, the hierarchical access permission threshold being used to define the minimum permission requirement for the visitor; extracting visitor identity information, access time, and access operation type from the access request, and comparing the visitor identity information with the hierarchical access permission threshold; When the visitor identity information meets the hierarchical access permission threshold, calculating the visitor trust coefficient based on the permission level of the visitor identity information, the historical access behavior corresponding to the access time, and the access frequency of the access operation type; selecting a differential privacy algorithm that matches the differential privacy budget according to the visitor trust coefficient, and using the differential privacy algorithm to desensitize sensitive fields in the visitor identity information to generate desensitized visitor information; The desensitized visitor information, the access time, the timing sensitivity level, the differential privacy budget, and the access operation type are combined into an access record; noise of an intensity corresponding to the differential privacy budget is added to the sensitive fields in the access record to generate a desensitized access record.

[0067] like Figure 3 As shown, the method includes: Based on the time series sensitivity level, the corresponding hierarchical access permission threshold is set. For example, the system can classify time series sensitivity into three levels: high, medium, and low, corresponding to permission threshold values ​​of 9, 6, and 3, respectively. These thresholds are used to limit the minimum permission requirements for visitors, ensuring that only users with sufficient permissions can access data of corresponding sensitivity. When the system receives an access request, it extracts the visitor's identity information (such as user ID, department number, position level), access time (timestamp accurate to the second), and access operation type (query, modification, download, etc.) from the request. The system compares the permission value in the visitor's identity information with the set hierarchical access permission threshold to determine whether the access conditions are met.

[0068] When a visitor's permission value is greater than or equal to the permission threshold for the corresponding time-series sensitivity level, the system considers the visitor to meet the preliminary access conditions. For example, a user with a permission value of 7 can access data with low sensitivity (threshold 3) and medium sensitivity (threshold 6), but cannot access data with high sensitivity (threshold 9). After meeting the preliminary conditions, the system further calculates the visitor's trust factor based on the visitor's permission level, historical access behavior, and the frequency of access operation types.

[0069] The specific method of calculating the visitor's trust coefficient is as follows: the system retrieves the visitor's access records in the past 30 days, counts the access frequency in different time periods (such as working hours and non-working hours), and compares whether the current access time is consistent with the historical access pattern. At the same time, the system analyzes the historical frequency of the access operation type to determine whether the current operation is consistent with the user's normal behavior pattern. Based on these factors, the system generates a trust coefficient between 0 and 1. For example, if a user with permission level 8 performs a query operation during working hours, and the operation is consistent with its historical access pattern, the system will assign it a trust coefficient of 0.85; however, the same user performs a large number of download operations at unconventional times and only obtains a trust coefficient of 0.4.

[0070] Based on the visitor's calculated trust factor, the system selects a differential privacy algorithm that matches the differential privacy budget. The system maintains an algorithm library that includes various differential privacy algorithms, such as the Laplace mechanism and the exponential mechanism, each with a different level of privacy protection. For example, when a visitor's trust factor is 0.85, the system selects the Laplace mechanism with a privacy budget of ε=0.5; when the trust factor drops to 0.4, the system selects the more stringent algorithm with a privacy budget of ε=0.1. The system then uses the selected differential privacy algorithm to desensitize sensitive fields in the visitor's identity information (such as real name, contact information, and precise location), generating desensitized visitor information.

[0071] In this specific example, the original visitor information includes "Technician A, Technology Department, Office Area, Equipment ID-12345." After desensitization, it becomes "Technician, Technology Department, Office Area, Equipment ID-****," retaining necessary information while concealing sensitive personal information. The system combines the desensitized visitor information, the access time (e.g., "2023-10-15 14:30:25"), the time sensitivity level (e.g., "Medium Sensitive"), the differential privacy budget (e.g., "ε=0.5"), and the access operation type (e.g., "Data Query") to form a complete access record.

[0072] To further enhance privacy protection, the system adds noise to sensitive fields in access records at a level corresponding to the differential privacy budget. For example, for access time, the system adds random noise that conforms to a Laplace distribution to the original timestamp, changing the time record to "2023-10-15 14:32:10." For access location information, noise is added to fuzzy the precise location. The degree of noise added is determined by the differential privacy budget. A smaller budget value results in greater noise addition and higher privacy protection.

[0073] Through the above processing, the system ultimately generates desensitized access records, which not only protect the visitor's privacy but also retain sufficient information for data access management and auditing. This hierarchical access control mechanism based on differential privacy effectively balances the needs of data availability and privacy protection, and is suitable for sensitive data scenarios containing time-series information, such as medical and health data, financial transaction records, and location trajectories. In actual applications, the system will adjust the classification criteria for time-series sensitivity levels, the setting of access permission thresholds, and the parameter configuration of differential privacy algorithms based on the compliance requirements and specific business needs of different industries to ensure the effectiveness and pertinence of data protection.

[0074] In an optional embodiment, selecting a differential privacy algorithm that matches the differential privacy budget based on the visitor trust coefficient, and using the differential privacy algorithm to desensitize sensitive fields in the visitor identity information, generating desensitized visitor information includes: Constructing a differential privacy algorithm pool, wherein the differential privacy algorithm pool includes multiple differential privacy algorithms, and dividing the sensitive fields in the visitor identity information into an identity identification field, a location information field, a behavior feature field, and an attribute information field; Calculating the algorithm matching degree of each differential privacy algorithm for different types of sensitive fields, and allocating the differential privacy budget according to the sensitive field type based on the visitor trust coefficient to obtain a local budget; selecting an optimal differential privacy algorithm from the differential privacy algorithm pool according to the algorithm matching degree and the local budget, grouping the sensitive fields in the visitor identity information by type to obtain a sensitive field sequence, and inputting the sensitive field sequence into the optimal differential privacy algorithm; Based on the local budget, differential privacy processing is performed on the sensitive field sequence to generate initial desensitized data, and a data utility evaluation score of the initial desensitized data is calculated; the algorithm parameters of the optimal differential privacy algorithm are adjusted according to the data utility evaluation score, and the sensitive field sequence is reprocessed using the adjusted optimal differential privacy algorithm to generate desensitized visitor information.

[0075] We have built an algorithm pool that includes various differential privacy algorithms, including the Laplace mechanism, exponential mechanism, Gaussian mechanism, random response mechanism, and K-anonymity mechanism. Each algorithm has different characteristics and is suitable for different data processing requirements. The Laplace mechanism is suitable for numeric data and protects data privacy by adding random noise that follows a Laplace distribution. The exponential mechanism is suitable for non-numeric queries and selects output results based on a utility function. The Gaussian mechanism is suitable for continuous data and protects privacy by adding random noise that follows a Gaussian distribution. The random response mechanism is suitable for Boolean data and protects privacy by probabilistically flipping data values. The K-anonymity mechanism is suitable for categorical data and protects privacy by ensuring that each record is indistinguishable from at least K-1 other records.

[0076] The sensitive fields in the visitor's identity information are divided into four categories: identity identification field, location information field, behavior characteristic field and attribute information field. The identity identification field includes information that directly identifies the individual, such as name, user ID, and device number; the location information field includes spatial location related information such as home address, workplace, and common activity areas; the behavior characteristic field includes behavior pattern information such as consumption habits, browsing history, and social activities; and the attribute information field includes personal attribute information such as age, gender, occupation, and education level.

[0077] For each differential privacy algorithm, we calculate its algorithmic match for various sensitive fields. This match reflects the algorithm's suitability for processing specific types of data and is derived through analysis of historical application results and data characteristics. This is calculated by scoring the algorithm's historical performance in processing various sensitive fields, combining the correlation between the field data type characteristics and the algorithm's characteristics to generate a match score between 0 and 1.

[0078] For example, for highly structured data like user IDs, the K-anonymization mechanism has a matching degree of 0.85, while the Laplace mechanism has a matching degree of 0.45. However, for location coordinate data, the Gaussian mechanism has a matching degree of 0.92, while the random response mechanism has a matching degree of only 0.25. For browsing history data in the behavioral feature field, the exponential mechanism has a matching degree of 0.78, while the K-anonymization mechanism has a matching degree of 0.65. For age data in the attribute information field, the Laplace mechanism has a matching degree of 0.81, while the Gaussian mechanism has a matching degree of 0.79.

[0079] Based on the visitor's trust factor, the differential privacy budget is allocated to each sensitive field type to create a local budget. The visitor's trust factor is a value between 0 and 1, which is determined based on the visitor's historical behavior, authentication strength, and security level. A higher trust factor results in a smaller differential privacy budget and lower data protection. Conversely, a lower trust factor results in a larger budget and higher protection.

[0080] For example, when the visitor's trust level is 0.8, the total budget of 1.5 can be allocated according to the ratio of 30% for the identity field, 25% for the location information field, 25% for the behavior feature field, and 20% for the attribute information field, resulting in local budgets of 0.45, 0.375, 0.375, and 0.3 respectively; when the trust level is 0.3, the allocation ratio can be adjusted to 40%, 30%, 20%, and 10%, and the total budget increases to 3.0, resulting in local budgets of 1.2, 0.9, 0.6, and 0.3 respectively.

[0081] The optimal differentially private algorithm is selected from the pool of differentially private algorithms based on algorithm fit and local budget. This selection process uses a weighted scoring mechanism, combining algorithm fit with local budget to calculate a composite score. The algorithm with the highest score is selected as the optimal algorithm. This score is calculated by multiplying the algorithm fit by a weight of 0.7 and the local budget fitness by a weight of 0.3. The sum of the two is used to obtain the composite score. Local budget fitness refers to the performance of an algorithm under a given budget and is determined by the degree to which the algorithm's characteristics match the budget size.

[0082] For example, for the identity field, when the local budget is 0.45, the algorithm matching degree of the K-anonymity mechanism is 0.85, the local budget fitness is 0.75, and the comprehensive score is 0.85×0.7+0.75×0.3=0.82, which is higher than other algorithms. Therefore, the K-anonymity mechanism is selected; for the location information field, when the local budget is 0.375, the algorithm matching degree of the Gaussian mechanism is 0.92, the local budget fitness is 0.80, and the comprehensive score is 0.92×0.7+0.80×0.3=0.884, making it the optimal choice.

[0083] Sensitive fields in visitor identity information are grouped by type to create a sensitive field sequence. For example, "User A," "USER20240815000001," and "DEV87654321" are grouped as the identity field group; "province, city, district," and "longitude xx.xx, latitude yy.yy" are grouped as the location field group; "spending every Friday night" and "preferring sports apps" are grouped as the behavior field group; and "35 years old," "male," and "engineer" are grouped as the attribute field group. Each field group is further structured to form a sequence. For example, the identity field group can be represented as ["User A," "USER20240815000001," "DEV87654321"], and the location field group can be represented as ["province, city, district," {"longitude": xx.xx, "latitude": yy.yy}].

[0084] For each set of sensitive field sequences, differential privacy processing is performed based on the corresponding local budget to generate initial desensitized data. For example, after using the K-anonymity mechanism and a local budget of 0.45 for the identity field set, "User A" becomes "User*", "USER20240815000001" becomes "USER20240001", and "DEV87654321" becomes "DEV8321". After using the Gaussian mechanism and a local budget of 0.375 for the location field set, the precise location "longitude xx.xx, latitude yy.yy" is fuzzified to the range representation of "longitude xx.x ± 0.1, latitude yy.y ± 0.1".

[0085] After applying the exponential mechanism and a local budget of 0.375 to the behavioral feature field group, "Friday night consumption" becomes "weekend consumption" and "prefer sports apps" becomes "prefer health apps." After applying the Laplace mechanism and a local budget of 0.3 to the attribute information field group, "35 years old" becomes "30-40 years old," "male" remains unchanged, and "engineer" becomes "technician."

[0086] A data utility assessment is performed on the initial desensitized data, and a data utility score is calculated. Data utility assessment is based on three aspects: information retention, data availability, and query accuracy. Information retention refers to the degree of effective information retained in the original data after desensitization, calculated by comparing the information entropy of the data before and after desensitization. Data availability refers to the ability of the desensitized data to support data analysis and processing, determined by evaluating data integrity and consistency. Query accuracy refers to the accuracy of query operations using the desensitized data, determined by testing the error rate of the query results. Each aspect is scored on a scale of 0 to 10, and the weighted average of the three aspects is used to determine the final data utility assessment score.

[0087] For example, for the initial desensitized data in the identity field, the information retention rate score was 7 (weight 0.3), the data availability score was 8 (weight 0.4), and the query precision score was 6 (weight 0.3), resulting in a weighted average utility evaluation score of 7.1. For the initial desensitized data in the location field, the information retention rate was 6, the data availability was 7, and the query precision was 5, resulting in a weighted average score of 6.1.

[0088] Adjust the algorithm parameters of the optimal differential privacy algorithm based on the data utility evaluation score. When the utility evaluation score falls below a preset threshold, adjust the algorithm parameters to improve data utility. For the K-anonymity mechanism, adjust the K value; for the Laplace and Gaussian mechanisms, adjust the noise parameter; for the exponential mechanism, adjust the utility function parameters; and for the random response mechanism, adjust the flip probability.

[0089] For example, if the K anonymity mechanism's utility evaluation score is 5, which is lower than the preset threshold of 7, the K value can be adjusted from 5 to 3 to reduce the anonymization strength. If the Gaussian mechanism's utility evaluation score is 6.1, which is lower than the preset threshold of 7, the noise parameter can be adjusted from 0.5 to 0.3 to reduce the amount of added noise. The specific adjustment range is determined by the gap between the utility evaluation score and the threshold; the larger the gap, the larger the adjustment range.

[0090] The sensitive field sequence is reprocessed using the adjusted optimal differential privacy algorithm to generate the final desensitized visitor information. For example, after adjusting the parameters of the K-anonymity mechanism, the identity field "User A" becomes "User A*," retaining more information; "USER20240815000001" becomes "USER20241501," retaining the beginning and end of the information; and "DEV87654321" becomes "DEV87**321," remaining unchanged.

[0091] After adjusting parameters, the Gaussian mechanism processes location information, narrowing the range to "longitude xx.xx ± 0.05, latitude yy.yy ± 0.05," improving location accuracy. For the exponential mechanism processing behavioral feature fields, after adjusting parameters, "Friday night consumption" becomes "Friday consumption," retaining more precise time information. After adjusting parameters, the Laplace mechanism processes attribute information fields, changing "35 years old" to "33-37 years old," narrowing the age range and improving accuracy.

[0092] Through the above steps, the selection of differential privacy algorithms based on visitor trust and the desensitization of sensitive fields are realized, which protects data privacy while maintaining data availability, providing an effective method for access control and data protection.

[0093] In an optional embodiment, the access behavior characteristics are analyzed based on the desensitized access records, and different differential privacy thresholds are set in combination with the temporal sensitivity level. When the access behavior characteristics exceed the corresponding differential privacy threshold, it is determined to be an abnormal access behavior. Generating an access tracing report includes: Extracting access time distribution, access frequency, access duration, and access resource type from the desensitized access records, and combining the access time distribution, access frequency, access duration, and access resource type to generate access behavior features; Analyzing an access behavior pattern based on the access behavior characteristics, determining a baseline threshold according to the access behavior pattern and the timing sensitivity level, and multiplying the baseline threshold by an adjustment coefficient of the timing sensitivity level to obtain a differential privacy threshold; Inputting the access behavior feature into a feature analysis module, calculating the access time distribution, the access frequency, the access duration, and the feature weight coefficient of the access resource type based on the feature analysis module; multiplying the differential privacy threshold by the feature weight coefficient to obtain the differential privacy threshold corresponding to each access behavior feature; Calculating the access time distribution, the access frequency, the access duration, and the deviation value of the access resource type from a preset normal resource access pattern; comparing the deviation values ​​with their corresponding differential privacy thresholds, and when any of the deviation values ​​exceeds the corresponding differential privacy threshold, determining the current access behavior as abnormal access behavior; The detection time of the abnormal access behavior is recorded, and the detection time, the access behavior characteristics, the deviation value, and the differential privacy threshold are combined into an access tracing report.

[0094] Multi-dimensional access behavior features are extracted from desensitized access records. These features include access time distribution, access frequency, access duration, and accessed resource type. For example, for user A's access records in a data center, the system extracts access time distribution, showing that the user primarily accesses the system between 9:00 AM and 6:00 PM on weekdays, with an average frequency of five visits per day. Each visit typically lasts between 15 and 30 minutes, and the primary resource accessed is the customer management database. The system combines these features to form a feature vector for user A's access behavior.

[0095] Based on the extracted access behavior features, the system further analyzes the user's access behavior patterns. For User A, the system identifies their typical access behavior pattern as "frequent, short-duration access to the customer management database during work hours." Taking into account the resource's temporal sensitivity level (assuming it's level 3, meaning medium sensitivity), the system determines a baseline threshold of 0.6. The temporal sensitivity level and adjustment coefficient correspond to the following relationship: Level 1 (low sensitivity) corresponds to 1.5, Level 2 corresponds to 1.2, Level 3 corresponds to 1.0, Level 4 corresponds to 0.8, and Level 5 (high sensitivity) corresponds to 0.5. Therefore, for the Level 3 sensitive resource accessed by User A, the system multiplies the baseline threshold of 0.6 by the adjustment coefficient of 1.0, resulting in a differential privacy threshold of 0.6.

[0096] To more precisely measure the importance of different features, the system calculates weight coefficients for each feature through the feature analysis module. In this example, the feature analysis module, trained based on historical data, determines the following weight coefficients for each feature: access time distribution 0.35, access frequency 0.25, access duration 0.20, and access resource type 0.20. The system multiplies the differential privacy threshold of 0.6 by each feature weight coefficient to obtain the corresponding differential privacy thresholds for each feature: access time distribution 0.21, access frequency 0.15, access duration 0.12, and access resource type 0.12.

[0097] The system continuously monitors users' actual access behavior and calculates deviations from pre-defined normal resource access patterns. On one particular day, the system detected that user A accessed the customer management database during off-hours (11:30 PM) for 120 minutes, significantly deviating from their normal access pattern. The system calculated the following deviations: access time distribution 0.45 (exceeding the corresponding threshold of 0.21), access frequency 0.10 (within the corresponding threshold of 0.15), access duration 0.40 (exceeding the corresponding threshold of 0.12), and access resource type 0.05 (within the corresponding threshold of 0.12). Because the deviations for both access time distribution and access duration exceeded the corresponding differential privacy thresholds, the system classified this access behavior as anomalous.

[0098] Upon detecting abnormal access behavior, the system immediately records the detection time (e.g., 2023-06-15 23:35:12) and generates an access tracing report, including the detection time, the abnormal access behavior characteristics (long access during non-working hours), the deviation values ​​for each dimension (0.45, 0.10, 0.40, 0.05), and the corresponding differential privacy thresholds (0.21, 0.15, 0.12, 0.12). This report can be used by security managers for further investigation and processing.

[0099] Through this approach, the system dynamically adjusts detection thresholds based on the temporal sensitivity of resources, applying stricter detection standards to highly sensitive resources. It also considers the combined impact of multi-dimensional access characteristics to effectively identify potentially anomalous access behavior. This approach not only improves the accuracy of anomaly detection but also protects the privacy of users' legitimate access through differential privacy mechanisms, reducing false positives. Practice has demonstrated that this approach is particularly effective in sensitive data-intensive scenarios such as finance and healthcare, enabling timely detection and prevention of unauthorized access and data leakage risks.

[0100] Figure 4 This is a bar chart analyzing abnormal access behavior characteristics based on the time-series sensitivity level of an embodiment of the present invention. This chart shows the core analytical data of an access behavior anomaly detection system. The white bars represent the degree of deviation of actual access behavior from the normal baseline, the diagonal filled bars represent the security threshold boundaries set by the differential privacy mechanism, and the dot filled bars represent the importance weight coefficients of different access feature dimensions. From the data performance, in the access time distribution dimension, the actual deviation value reaches 0.33, significantly higher than the differential privacy threshold of 0.15, and has a feature weight coefficient of 0.25, indicating that this dimension is most sensitive to anomaly detection. The actual deviation value of the access frequency dimension is 0.07, lower than the differential privacy threshold of 0.11, and with a feature weight coefficient of 0.18, indicating that the current access frequency is within the normal range. The actual deviation value of 0.29 in the access duration dimension significantly exceeds the threshold of 0.09, and combined with the feature weight of 0.15, it indicates the presence of potential anomalies. The actual deviation value of the access resource type dimension is only 0.04, far lower than the threshold of 0.09, and has a feature weight of 0.15, indicating that the resource access pattern is relatively stable. Through comprehensive analysis of these four dimensions, the system can effectively identify abnormal patterns in access behavior, especially abnormalities in time distribution and duration, which provides an important basis for subsequent access control policy adjustments.

[0101] A second aspect of an embodiment of the present invention provides a privacy protection and access control system based on unstructured metadata, including: The first unit is configured to obtain time series metadata to be processed from multiple data source nodes, where the time series metadata to be processed includes time series sensitive data and non-sensitive data; The second unit is configured to calculate the sensitivity characteristics of the time series metadata to be processed at each data source node, calculate a sensitivity score based on the sensitivity characteristics, and classify the time series sensitive data into sensitivity levels according to the sensitivity score; A third unit is configured to allocate differential privacy budgets to time series sensitive data of different levels according to the time series sensitivity level, perform differential privacy processing on the time series sensitive data using the differential privacy budget, maintain data availability while protecting data privacy, and generate differentially private protected time series data; a fourth unit, configured to set hierarchical access rights for the differentially private protected time series data according to the time series sensitivity level, perform permission verification on the access request, perform desensitization processing on the verified visitor information using a differential privacy algorithm corresponding to the differential privacy budget, and generate a desensitized access record; The fifth unit is used to analyze the access behavior characteristics based on the desensitized access records, set different differential privacy thresholds in combination with the temporal sensitivity level, and determine it as abnormal access behavior when the access behavior characteristics exceed the corresponding differential privacy threshold, and generate an access tracing report.

[0102] According to a third aspect of an embodiment of the present invention, an electronic device is provided, including: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0103] According to a fourth aspect of an embodiment of the present invention, a computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the method described above is implemented.

[0104] The present invention may be a method, an apparatus, a system and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for executing various aspects of the present invention.

[0105] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A privacy protection and access control method based on unstructured metadata, characterized in that: include: Obtaining time series metadata to be processed from multiple data source nodes, where the time series metadata to be processed includes time series sensitive data and non-sensitive data; Calculating the sensitivity characteristics of the time series metadata to be processed at each data source node, calculating a sensitivity score based on the sensitivity characteristics, and classifying the time series sensitive data into time series sensitivity levels according to the sensitivity score; Allocating differential privacy budgets for time series sensitive data of different levels according to the time series sensitivity levels, performing differential privacy processing on the time series sensitive data using the differential privacy budgets, maintaining data availability while protecting data privacy, and generating time series data after differential privacy protection; Setting hierarchical access rights for the differentially private protected time series data according to the time series sensitivity level, performing permission verification on the access request, desensitizing the verified visitor information using a differential privacy algorithm corresponding to the differential privacy budget, and generating a desensitized access record; The access behavior characteristics are analyzed based on the desensitized access records, and different differential privacy thresholds are set in combination with the temporal sensitivity level. When the access behavior characteristics exceed the corresponding differential privacy threshold, it is determined to be an abnormal access behavior, and an access tracing report is generated.

2. The method according to claim 1, characterized in that Calculating the sensitivity characteristics of the time series metadata to be processed at each data source node, calculating a sensitivity score based on the sensitivity characteristics, and classifying the time series sensitive data into time series sensitivity levels according to the sensitivity score includes: Calculating, at each data source node, sensitivity features of the time series metadata to be processed, where the sensitivity features include time series fluctuation features and data association features; Constructing a sensitivity evaluation adversarial network, the sensitivity evaluation adversarial network including a generator and a discriminator, wherein the generator adaptively samples according to the distribution characteristics of the time series fluctuation characteristics and the data association characteristics to generate multi-scale perturbation samples, and the discriminator uses a dynamic weighted attention mechanism to evaluate the sensitivity stability of the multi-scale perturbation samples under different perturbation levels, and feeds the evaluation results back to the generator to guide the generation process of the perturbation samples; An adversarial loss function is constructed based on the multi-scale perturbation samples output by the generator and the sensitivity stability evaluation results of the discriminator. The sampling strategy of the generator and the evaluation weight of the discriminator are updated by iteratively optimizing the adversarial loss function, so that the sensitivity evaluation adversarial network has the ability to defend against attacks; The optimized sensitivity evaluation adversarial network is used to perform robustness evaluation on the sensitivity feature to obtain a sensitivity evaluation result, a sensitivity score is calculated based on the sensitivity evaluation result, and the time series metadata to be processed is divided into time series sensitivity levels according to the sensitivity score.

3. The method according to claim 2, characterized in that Based on the generator adaptively sampling according to the distribution characteristics of the time series fluctuation characteristics and the data association characteristics to generate multi-scale perturbation samples, the discriminator adopts a dynamic weighted attention mechanism to evaluate the sensitivity stability of the multi-scale perturbation samples under different perturbation degrees, including: Constructing a conditional variational autoencoder based on the time series fluctuation feature and the data association feature, wherein the conditional variational autoencoder includes a posterior distribution network and a prior distribution network, and generating a mean parameter and a variance parameter based on the posterior distribution network and the prior distribution network respectively; Inputting the mean parameter and the variance parameter into a generator, generating a multi-scale perturbation vector based on the generator through a reparameterization technique, mapping the mean parameter and the variance parameter to a latent space based on the reparameterization technique, and determining a perturbation sample based on the multi-scale perturbation vector and a random sampling vector of a standard normal distribution; A hierarchical attention network of the discriminator is constructed, the perturbation sample is input into the hierarchical attention network, the hierarchical attention network is used to perform multi-layer feature transformation on the perturbation sample to generate a multi-layer feature representation, attention weights are calculated based on the multi-layer feature representation, a feature reconstruction vector is determined based on the attention weights and the multi-layer feature representation, and the sensitivity stability of the perturbation sample under different perturbation degrees is evaluated based on the feature reconstruction vector.

4. The method according to claim 1, wherein Allocating differential privacy budgets to time series sensitive data of different levels according to the time series sensitivity level, performing differential privacy processing on the time series sensitive data using the differential privacy budget, maintaining data availability while protecting data privacy, and generating time series data after differential privacy protection includes: Calculating an initial allocation coefficient of the differential privacy budget according to the time series sensitivity level, inputting the initial allocation coefficient into a dynamic budget allocation function, and calculating the differential privacy budget of each time series sensitive data based on the initial allocation coefficient and the total privacy budget; Determining a scale parameter of the Laplace noise according to the differential privacy budget, generating Laplace noise based on the scale parameter, and adding the Laplace noise to the time series sensitive data to generate noisy time series data; calculating a data availability index between the noisy time series data and the original time series sensitive data, and calculating an adjustment direction and adjustment amplitude of the budget allocation based on the data availability index and the privacy protection level; The initial allocation coefficient is updated according to the adjustment direction and the adjustment amplitude, and the updated allocation coefficient is re-input into the dynamic budget allocation function to generate a new differential privacy budget; the process of noise addition and data availability calculation is repeatedly performed using the new differential privacy budget until the data availability indicator reaches a preset indicator threshold, and the time series data after differential privacy protection is output.

5. The method according to claim 1, wherein Setting hierarchical access rights for the differentially private protected time series data according to the time series sensitivity level, performing permission verification on the access request, and performing desensitization processing on the verified visitor information using a differential privacy algorithm corresponding to the differential privacy budget. Generating the desensitized access record includes: Setting a corresponding hierarchical access permission threshold based on the timing sensitivity level, the hierarchical access permission threshold being used to define the minimum permission requirement for the visitor; extracting visitor identity information, access time, and access operation type from the access request, and comparing the visitor identity information with the hierarchical access permission threshold; When the visitor identity information meets the hierarchical access permission threshold, calculating the visitor trust coefficient based on the permission level of the visitor identity information, the historical access behavior corresponding to the access time, and the access frequency of the access operation type; selecting a differential privacy algorithm that matches the differential privacy budget according to the visitor trust coefficient, and using the differential privacy algorithm to desensitize sensitive fields in the visitor identity information to generate desensitized visitor information; The desensitized visitor information, the access time, the timing sensitivity level, the differential privacy budget, and the access operation type are combined into an access record; noise of an intensity corresponding to the differential privacy budget is added to the sensitive fields in the access record to generate a desensitized access record.

6. The method according to claim 5, characterized in that Selecting a differential privacy algorithm that matches the differential privacy budget according to the visitor trust coefficient, desensitizing sensitive fields in the visitor identity information using the differential privacy algorithm, and generating desensitized visitor information includes: Constructing a differential privacy algorithm pool, wherein the differential privacy algorithm pool includes multiple differential privacy algorithms, and dividing the sensitive fields in the visitor identity information into an identity identification field, a location information field, a behavior feature field, and an attribute information field; Calculating the algorithm matching degree of each differential privacy algorithm for different types of sensitive fields, and allocating the differential privacy budget according to the sensitive field type based on the visitor trust coefficient to obtain a local budget; selecting an optimal differential privacy algorithm from the differential privacy algorithm pool according to the algorithm matching degree and the local budget, grouping the sensitive fields in the visitor identity information by type to obtain a sensitive field sequence, and inputting the sensitive field sequence into the optimal differential privacy algorithm; Based on the local budget, differential privacy processing is performed on the sensitive field sequence to generate initial desensitized data, and a data utility evaluation score of the initial desensitized data is calculated; the algorithm parameters of the optimal differential privacy algorithm are adjusted according to the data utility evaluation score, and the sensitive field sequence is reprocessed using the adjusted optimal differential privacy algorithm to generate desensitized visitor information.

7. The method according to claim 1, characterized in that Analyze access behavior characteristics based on the desensitized access records, set different differential privacy thresholds based on the temporal sensitivity level, and determine abnormal access behavior when the access behavior characteristics exceed the corresponding differential privacy threshold. Generate an access tracing report including: Extracting access time distribution, access frequency, access duration, and access resource type from the desensitized access records, and combining the access time distribution, access frequency, access duration, and access resource type to generate access behavior features; Analyzing an access behavior pattern based on the access behavior characteristics, determining a baseline threshold according to the access behavior pattern and the timing sensitivity level, and multiplying the baseline threshold by an adjustment coefficient of the timing sensitivity level to obtain a differential privacy threshold; Inputting the access behavior feature into a feature analysis module, calculating the access time distribution, the access frequency, the access duration, and the feature weight coefficient of the access resource type based on the feature analysis module; multiplying the differential privacy threshold by the feature weight coefficient to obtain the differential privacy threshold corresponding to each access behavior feature; Calculating the access time distribution, the access frequency, the access duration, and the deviation value of the access resource type from a preset normal resource access pattern; comparing the deviation values ​​with their corresponding differential privacy thresholds, and when any of the deviation values ​​exceeds the corresponding differential privacy threshold, determining the current access behavior as abnormal access behavior; The detection time of the abnormal access behavior is recorded, and the detection time, the access behavior characteristics, the deviation value, and the differential privacy threshold are combined into an access tracing report.

8. A privacy protection and access control system based on unstructured metadata, used to implement the method according to any one of claims 1 to 7, characterized in that: include: The first unit is configured to obtain time series metadata to be processed from multiple data source nodes, where the time series metadata to be processed includes time series sensitive data and non-sensitive data; The second unit is configured to calculate the sensitivity characteristics of the time series metadata to be processed at each data source node, calculate a sensitivity score based on the sensitivity characteristics, and classify the time series sensitive data into time series sensitivity levels according to the sensitivity score; A third unit is configured to allocate differential privacy budgets to time series sensitive data of different levels according to the time series sensitivity level, perform differential privacy processing on the time series sensitive data using the differential privacy budget, maintain data availability while protecting data privacy, and generate differentially private protected time series data; a fourth unit, configured to set hierarchical access rights for the differentially private protected time series data according to the time series sensitivity level, perform permission verification on the access request, perform desensitization processing on the verified visitor information using a differential privacy algorithm corresponding to the differential privacy budget, and generate a desensitized access record; The fifth unit is used to analyze the access behavior characteristics based on the desensitized access records, set different differential privacy thresholds in combination with the temporal sensitivity level, and determine it as abnormal access behavior when the access behavior characteristics exceed the corresponding differential privacy threshold, and generate an access tracing report.

9. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images