Data asset classification and dynamic authority management system

Abstract

The invention relates to the technical field of data security, in particular to a data asset classification and grading and authority dynamic management system, which comprises an asset parameter acquisition module, a classification feature judgment module, a grading weight calculation module and an authority dynamic adaptation module. According to the method, metadata and path parameters are automatically collected through a distributed crawler in combination with a regular expression, naming parameters and content feature parameters are separated to generate a structured parameter set, field naming similarity is quantized through a Levenshtein distance, content character distribution features are verified through chi-square verification, and a naming similarity and distribution feature dual verification mechanism is constructed. According to the method, sensitivity, access frequency and data volume weight are dynamically distributed through an entropy weight method, grading parameters are generated through linear superposition, an RBAC model is combined with a Dijkstra algorithm to verify access path topology legality, unauthorized access is blocked, and the heterogeneous data classification grading and authority control dynamic adaptive capacity is improved.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a data asset classification and grading and authority dynamic management system. Background Art

[0002] The field of data security technology encompasses security protection and risk prevention measures for all types of data in information systems. Its core content includes security management throughout the entire data lifecycle, including collection, storage, transmission, use, and destruction, ensuring that data is protected from tampering, leakage, or unauthorized use at every stage. This technical field focuses on data compliance and privacy protection, encompassing data encryption, access control, audit tracking, anomaly detection, identity authentication, and other aspects. With the development of information technologies such as cloud computing, big data, and the Internet of Things, data security technology has gradually evolved towards intelligence and automation, strengthening the security management and dynamic risk prevention capabilities of multi-source, heterogeneous data and forming a systematic protection architecture.

[0003] Among them, the data asset classification and grading and dynamic authority management system refers to a management system that dynamically adjusts data access rights based on the automatic identification, classification and security level division of various data assets within the organization, combined with user identity, access behavior and environmental factors. The data matters mainly targeted by this patent subject include classification and identification rules for data assets, data security level definition standards, user identity authentication mechanisms, access behavior analysis models and authority adjustment strategies. Specifically, by setting fixed data classification attribute labels, various types of data assets are automatically classified and graded based on a predefined data classification rule library; based on the authority matrix of user roles, combined with the real-time monitoring results of user operation behaviors, a policy engine based on threshold judgment is used to dynamically adjust the user's access rights to specific data, thereby achieving refined management of data assets and dynamic authority control.

[0004] Existing technologies rely on manually predefined classification rule bases. When faced with cross-domain terminology or naming heterogeneity, the rules are not extensible enough. For example, different business systems have different names for the same field, resulting in missing classification labels. The traditional grading model uses fixed weight superposition, which cannot distinguish the actual risk differences between high-frequency, low-sensitivity and low-frequency, high-sensitivity data, resulting in a mismatch of security resources. Permission management is based on static mapping of roles and resources, and lacks topological verification of cross-system access paths. For example, when a user jumps through an intermediate node to access high-level data, the permission policy cannot identify the legitimacy of the path. Content feature detection relies on keyword matching, which makes it difficult to identify data features of encoding obfuscation or distributed storage. For example, Base64-encoded text may be mistakenly judged as low-risk data, resulting in grading deviations that affect subsequent control strategies. Summary of the Invention

[0005] The purpose of the present invention is to solve the shortcomings of the existing technology and propose a data asset classification and grading and authority dynamic management system.

[0006] To achieve the above objectives, the present invention adopts the following technical solutions: A data asset classification and grading and authority dynamic management system includes:

[0007] The asset parameter collection module is used to obtain metadata field parameters and file path parameters through a distributed crawler. It uses a regular expression matching algorithm and the load balancing mechanism of the distributed crawler node cluster to generate a structured parameter set and transmit it to the classification feature discrimination module.

[0008] A classification feature discrimination module is configured to receive the structured parameter set, perform the field naming parameter comparison by calling the Levenshtein distance algorithm, detect the character distribution of the content feature parameter by using the improved chi-square test method, generate classification label parameters, and transmit the parameters to the classification weight calculation module;

[0009] A hierarchical weight calculation module is used to receive the classification label parameters, calculate the weight coefficients of the sensitivity index parameters, access frequency parameters and data volume parameters through an improved entropy weight method, perform linear superposition to generate hierarchical level parameters, and transmit them synchronously with the access event parameters to the permission dynamic adaptation module;

[0010] The permission dynamic adaptation module is used to match the hierarchical level parameters with the user role parameters in a permission matrix by improving the RBAC model, and combine the Dijkstra shortest path algorithm with the resource topology verification mechanism to generate dynamic permission policy parameters and write them into the access control list.

[0011] As a further solution of the present invention, the structured parameter set specifically refers to the field naming structure, content feature matrix, and metadata index map; the classification label parameters include semantic similarity index, character distribution characteristics, and field type identification; the grading level parameters specifically include sensitivity weight coefficient, access frequency weight, data volume weight, and comprehensive level value; the dynamic permission policy parameters include role permission matrix, resource topology verification results, access path whitelist, and policy effective timestamp.

[0012] As a further solution of the present invention, the regular expression matching algorithm achieves throughput matching with the distributed crawler by dynamically adjusting the thread pool size;

[0013] The improved entropy weight method includes a range standardization processing step, and its calculation formula is:

[0014]

[0015] Where x′ ijrepresents the normalized value of the jth parameter of the i-th sample, min(x j ) and max(x j ) represent the minimum and maximum values ​​of the j-th parameter respectively;

[0016] The linear superposition process includes an outlier truncation processing mechanism, and a normalization operation is performed when the weighted cumulative value exceeds a preset threshold;

[0017] The improved RBAC model reduces the time and space complexity of the role-authority mapping relationship by 42% by introducing hierarchical level threshold constraints;

[0018] The edge weight in the Dijkstra algorithm is defined as the weighted value of network delay and security level.

[0019] As a further solution of the present invention, the asset parameter collection module includes:

[0020] The data acquisition submodule deploys a distributed crawler node cluster, establishes a multi-threaded task allocation mechanism, sends concurrent requests to the target data source, captures metadata field text and file path strings in the response data, identifies multiple character encoding formats through an adaptive encoding detection interface, uses regular expressions to match special symbols or garbled characters, performs null value record filtering operations, and generates metadata feature streams;

[0021] The feature extraction submodule loads a regular expression matching algorithm based on the metadata feature stream, uses named capture groups to extract the alphanumeric sequence in the field naming rules, calculates the continuity index of the field naming structure, which is defined as the percentage of the length of consecutive letters and numbers in the total field length, separates the frequency of occurrence of special symbols in the content feature rules and the span of the numerical interval, and generates a field identifier and a content feature value;

[0022] The structure encoding submodule calls the field identifier to construct a hash index mapping table, uses the CRC32 check algorithm to generate a hash key value, generates a feature weight matrix based on the content feature value, converts the hash table key-value pairs and matrix row and column data into a nested hierarchical structure through the JSON encoder, performs data serialization verification, and outputs a structured parameter set.

[0023] As a further solution of the present invention, the classification feature discrimination module includes:

[0024] The field similarity calculation submodule obtains the field naming parameters of the structured parameter set, compares the number of insertion, deletion, and replacement operations character by character, calculates the average number of characters in the field based on the sliding time window, and calculates the quotient of the number of operations and the average number of characters in the field to generate a similarity value;

[0025] The character distribution deviation test submodule counts the frequency of occurrence of letter categories in the content feature parameters, divides the basic character categories according to the ISO / IEC10646 standard, and calculates the square difference between the actual frequency of each category and the expected value of the uniform distribution using the formula:

[0026]

[0027] Calculating and obtaining a comprehensive deviation of character distribution, comparing the deviation with a preset reference value, and generating a character deviation index;

[0028] Where D represents the character deviation index, o i Represents the actual count of the i-th type of character, e i represents the theoretical expected value of the i-th type of character, c j represents the special symbol weight factor, k is the number of 26 letter categories, m is the 10 predefined special symbol types, n represents the number of basic character categories, which is the same as k, i represents the character category index, and j represents the special character type index;

[0029] The classification label synthesis submodule establishes a Cartesian coordinate system with the horizontal axis mapping the similarity value and the vertical axis mapping the character deviation index, and uses a two-stage threshold setting method to divide the quadrant boundaries. When the data point is lower than the dual-axis threshold at the same time, the classification label parameter is output.

[0030] As a further solution of the present invention, the sliding time window is set to the field sample data set of the latest 30 days;

[0031] The two-stage threshold setting method first calculates the 75th percentile value as the initial threshold based on historical data, and then dynamically adjusts the ±5% floating range according to the real-time data stream.

[0032] As a further solution of the present invention, the hierarchical weight calculation module includes:

[0033] The indicator weight analysis submodule receives the sensitivity indicator parameter, access frequency parameter and data volume parameter in the classification label parameter, performs sliding window normalization processing on the three types of parameters, calculates the discrete degree and information entropy value of multiple parameter sample values, reversely derives the weight distribution ratio based on the entropy value, and generates a weight coefficient set;

[0034] The parameter synthesis submodule calls the sensitivity weight coefficient, access frequency weight coefficient and data volume weight coefficient in the weight coefficient set, establishes a three-level weighted accumulation mechanism, performs a scalar product of the original value of the sensitivity index and the corresponding weight, superimposes the access frequency weight value and the data volume weight value, performs an arithmetic accumulation operation of the three weighted results, and generates a grading level parameter;

[0035] The data synchronization submodule constructs a hierarchical coding sequence based on the hierarchical level parameters, extracts the timestamp field and operation type code in the access event parameters, aligns the timestamp using the NTP protocol, aligns the coding sequence with the event field and performs data format conversion, executes the data encapsulation protocol call, and outputs a synchronized data stream.

[0036] As a further solution of the present invention, the dynamic permission adaptation module includes:

[0037] The role-authority matching submodule loads the role identifier and authority entry in the user role parameter, calls the level threshold in the hierarchical level parameter, constructs a role-level two-dimensional matrix with constraints, calculates the intersection coverage of the role authority entry and the level requirement threshold, performs matrix unit Boolean operations to mark the valid authority area, and generates a permission matching matrix;

[0038] The path verification submodule is based on the node connection relationship of the resource topology graph, inputs the path node sequence in the access event parameter, uses the improved Dijkstra algorithm to traverse the adjacent nodes, calculates the shortest hop count and cumulative weight value from the start node to the target node, compares the actual path hop count with the theoretical optimal path difference, and generates a path verification coefficient;

[0039] The policy generation submodule integrates the effective permission mark in the permission matching matrix and the difference parameter in the path verification coefficient, constructs a policy decision tree based on the C4.5 algorithm, maps the conditional nodes to permission policy entries, performs ACL entry encoding and writing operations, and generates dynamic permission policy parameters.

[0040] As a further solution of the present invention, the improved Dijkstra algorithm sets the maximum hop count threshold to a 7-layer network topology;

[0041] The branch condition settings of the policy decision tree include authority matching degree ≥ 80% and path verification difference ≤ 2 hops.

[0042] Compared with the prior art, the advantages and positive effects of the present invention are:

[0043] In the present invention, the automatic collection of metadata fields and path parameters is achieved through the combination of distributed crawlers and regular expressions, and a structured parameter set is generated by separating the naming parameters from the content feature parameters, thereby reducing the cost of manual intervention. The Levenshtein distance algorithm quantifies the field naming similarity, the chi-square test verifies the content character distribution characteristics, and a dual verification mechanism for field naming similarity and content distribution is established to enhance the adaptability of classification rules to heterogeneous data. The entropy weight method dynamically assigns weight coefficients for sensitivity, access frequency and data volume, and generates grading parameters through linear superposition, so that the security level division can be adjusted in real time as the business scenario changes. The RBAC model is combined with the Dijkstra algorithm to verify the topological legitimacy of the access path in the authority matrix matching, blocking unauthorized access to non-preset paths. The technical integration enables data classification and grading to have the ability to dynamically allocate weights, and the authority control shifts from static mapping to path topology constraints to form a closed-loop protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 It is a system flow chart of the present invention. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0046] In the description of the present invention, it should be understood that the terms "length," "width," "up," "down," "front," "back," "left," "right," "vertical," "horizontal," "top," "bottom," "inside," "outside," and the like, indicating positions or relationships, are based on the positions or relationships shown in the accompanying drawings and are intended only to facilitate the description of the present invention and simplify the description. They do not indicate or imply that the devices or elements referred to must have a specific orientation, be constructed, or operate in a specific orientation. Therefore, they should not be construed as limiting the present invention. Furthermore, in the description of the present invention, "plurality" means two or more, unless otherwise expressly and specifically defined.

[0047] Example 1

[0048] See also Figure 1 A data asset classification and grading and authority dynamic management system includes:

[0049] The asset parameter collection module is used to obtain metadata field parameters and file path parameters through a distributed crawler. It uses a regular expression matching algorithm and the load balancing mechanism of the distributed crawler node cluster to generate a structured parameter set and transmit it to the classification feature discrimination module.

[0050] The classification feature discrimination module is used to receive the structured parameter set, call the Levenshtein distance algorithm to perform field naming parameter comparison, use the improved chi-square test method to detect the character distribution of content feature parameters, generate classification label parameters and transmit them to the classification weight calculation module;

[0051] The hierarchical weight calculation module is used to receive classification label parameters, calculate the weight coefficients of sensitivity index parameters, access frequency parameters and data volume parameters through the improved entropy weight method, perform linear superposition to generate hierarchical level parameters, and transmit them to the permission dynamic adaptation module synchronously with the access event parameters;

[0052] The permission dynamic adaptation module is used to match the hierarchical level parameters with the user role parameters in the permission matrix by improving the RBAC model, and combine the Dijkstra shortest path algorithm with the resource topology verification mechanism to generate dynamic permission policy parameters and write them into the access control list.

[0053] The structured parameter set specifically refers to the field naming structure, content feature matrix, and metadata index map. The classification label parameters include semantic similarity index, character distribution characteristics, and field type identification. The grading level parameters specifically include sensitivity weight coefficient, access frequency weight, data volume weight, and comprehensive level value. The dynamic permission policy parameters include role permission matrix, resource topology verification results, access path whitelist, and policy effective timestamp.

[0054] The regular expression matching algorithm dynamically adjusts the thread pool size to match the throughput of the distributed crawler;

[0055] The improved entropy weight method includes the range standardization processing step, and its calculation formula is:

[0056]

[0057] Where x′ ij represents the normalized value of the jth parameter of the i-th sample, min(x j ) and max(x j ) represent the minimum and maximum values ​​of the j-th parameter respectively;

[0058] The linear superposition process includes an outlier truncation processing mechanism, and a normalization operation is performed when the weighted cumulative value exceeds a preset threshold;

[0059] The improved RBAC model reduces the time and space complexity of the role-authority mapping relationship by 42% by introducing hierarchical level threshold constraints;

[0060] The edge weight in the Dijkstra algorithm is defined as the weighted value of network delay and security level.

[0061] The asset parameter collection module includes:

[0062] The data acquisition submodule deploys a distributed crawler node cluster, establishes a multi-threaded task allocation mechanism, sends concurrent requests to the target data source, captures metadata field text and file path strings in the response data, identifies multiple character encoding formats through an adaptive encoding detection interface, uses regular expressions to match special symbols or garbled characters, performs null value record filtering operations, and generates metadata feature streams;

[0063] The asset parameter collection module includes a data collection submodule. The data collection submodule refers to the configured distributed crawler node cluster address, for example, the IP address of node A is 192.168.1.101, the IP address of node B is 192.168.1.102, and the IP address of node C is 192.168.1.103. At the same time, according to the preset multi-threaded task allocation mechanism, for example, each crawler node is set to start 5 concurrent threads, a total of 15 concurrent threads to jointly execute the collection task. These threads send data to the target data source, such as the address of the enterprise internal document server "\\fileserv er\shared\documents\", the database server address "HR_DB_SERVER", and the API interface "https: / / api.partner.com / data / v1 / assets" provided by the external partner, send concurrent HTTP GET requests or database query instructions, and capture the metadata field text contained in the response data of each data source. For example, the metadata "Title: 2024 First Quarter Financial Report, Author: Zhang San, Creation Date: 2024-04-15" of the file "Financial Report_2024_Q1.docx" is captured from the document server, and the text "EMP001" of the field "EmployeeID" and the text "Wang" of the field "LastName" are captured from the "Employees" table of the database server HR_DB_SERVER, as well as the file path string, such as "\\fileserver\shared\documents\Financial Report_2024_Q1.docx". Then, an adaptive encoding detection interface is called, which analyzes byte stream features, such as checking the BOM (ByteOrder) at the beginning of the text. derMark) or count the frequency of occurrence of specific byte sequences to identify the character encoding format of the captured text, such as UTF-8, GBK, and ISO-8859-1. For example, it is detected that the metadata of "Financial Statement_2024_Q1.docx" is encoded in UTF-8, while the employee data "EMP001, Wang" migrated from the old system is encoded in GBK. Subsequently, a predefined regular expression rule set is used for the identified encoding format. For example, the rule set contains "[-1F]" for matching control characters, "[^\\u4e00-\\u9fa5\\w\\s.,;:? ! ()-]" is used to match garbled characters other than Chinese and English, numbers, spaces, and common punctuation. Matching operations are performed on metadata field text, identifying and marking special symbols or garbled characters in the text. For example, in the metadata "log_entry: Operation successful" captured in an unstructured log, "" is marked as garbled characters. Null value record filtering is then performed on all captured metadata records. Specifically, the value of each metadata field is checked. If the field value is an empty string "", a "NULL" string, or contains only whitespace characters, the record or field is removed from subsequent processing. For example, if a record is "File name:, Size: 1024KB", the "File name" field is of interest due to its empty value. After the aforementioned data collection, encoding recognition, regular expression matching, and null value filtering, the cleaned metadata fields and their corresponding values ​​are combined into a structured data stream to generate a metadata feature stream.

[0064] The feature extraction submodule loads a regular expression matching algorithm based on the metadata feature stream, uses named capture groups to extract the alphanumeric sequence in the field naming rules, calculates the continuity index of the field naming structure, defined as the percentage of the length of consecutive letters and numbers in the total field length, separates the frequency of occurrence of special symbols in the content feature rules and the span of the numerical range, and generates field identifiers and content feature values;

[0065] The asset parameter collection module also includes a feature extraction submodule. This submodule is based on the metadata feature stream generated by the aforementioned data collection submodule. For example, if a metadata record is received as {“field name”:

[0066] "UserID_Active_Status", "Field Value": "USR1001_A", "Source":

[0067] "DatabaseA.TableX.ColumnY"}, load the preset regular expression matching process, this process does not directly call a specific algorithm name, but specifically performs: define a set of regular expressions containing named capture groups, for example, for field naming rules, define the expression as

[0068] "(?[A-Za-z_]+)(?[0-9A-Za-z])(?[_A-Za-z])", use this expression to match the field name "UserID_Active_Status" in the metadata feature stream, extract the alphanumeric combination sequence, capture "UserID_" through the named capture group "prefix", capture "Active" through "identifier", and capture "Status" through "suffix". Then, calculate the continuity index of the field naming structure. The calculation process is: first obtain the total length of the field name "UserID_Active_Status", which is 20 characters, and then count the length of the consecutive letter sequence, such as "UserID" is 6, "Active" is 6, "Status" is 6, and the length of consecutive numeric characters. There are no consecutive numbers here, so the total length of consecutive letters and numeric characters is 6+6+6=18, so the continuity index is calculated as (18 / 20)*100%=90%. This index It is defined as the percentage of the length of consecutive letters and numbers in the total field length. At the same time, the frequency of occurrence of special symbols in the content feature rules and the span of the numerical range are separated. For example, for the field value "USR1001_A", according to the predefined special symbol list such as "['_','-','.',':']", the "" appears once, and other special symbols appear 0 times. If the field value is numeric, for example, the value of another field "Age" is "35", then its value "35" is recorded. If it is a numeric interval text such as "SalaryRange", nge:3000-5000", the lower limit 3000 and the upper limit 5000 are extracted, and the numerical interval span is calculated as 5000-3000=2000. Through the above extraction and calculation of field naming and content features, a field identifier is generated, such as "UserID_Active_Status_ID" composed of the capture group content, and the corresponding content feature value, such as {"continuity index":90,"special symbol_frequency":1,"value":null,"value span":null}.

[0069] The structure encoding submodule calls the field identifier to build a hash index mapping table, uses the CRC32 checksum algorithm to generate hash key values, generates a feature weight matrix based on the content feature values, converts the hash table key-value pairs and matrix row and column data into a nested hierarchical structure through the JSON encoder, performs data serialization verification, and outputs a structured parameter set.

[0070] The asset parameter collection module further includes a structure encoding submodule, which calls the field identifier generated by the aforementioned feature extraction submodule, such as "UserID_Active_Status_ID".

[0071] "CreationDate_Timestamp_ID", build a hash index mapping table, the specific construction process is: assign an integer index to each unique field identifier, for example, "UserID_Active_Status_ID" is mapped to 1, "CreationDate_Timestamp_ID" is mapped to 2, and a cyclic redundancy check process is used to generate a hash key value. The specific process is: convert the field identifier string, such as "UserID_Active_Status_ID", into a byte sequence, and then use a preset generator polynomial (such as 0xEDB88320 commonly used in CRC32) to perform a series of bit operations (mainly XOR and shift) on the byte sequence, and finally obtain a 32-bit integer as the hash key value. For example, "UserID_Active_Status_ID" is calculated through this process to obtain the hash key value 0x87654321. According to the content feature value, for example, the content feature value corresponding to the field "UserID_Active_Status_ID" is {"continuity index": 90, "special symbol_frequency": 1}, and the field "CreationDate_Timestamp_ID" is 0x87654321. The content feature value corresponding to "tionDate_Timestamp_ID" is {"continuity index": 75, "special symbol_frequency": 0}, and a feature weight matrix is ​​generated. The generation process of this matrix is: first determine the dimension of the matrix, the row corresponds to the field identifier, and the column corresponds to each dimension of the content feature (such as continuity index, special symbol frequency, etc.). Each element value in the matrix represents the quantitative value or weight of the corresponding field on the feature dimension. For example, if the continuity index weight is 0.6 and the special symbol frequency weight is 0.4 (this weight setting is based on prior knowledge that naming continuity is more important), the matrix is ​​generated as follows: ), then for "UserID_Active_Status_ID", its corresponding row in the matrix may be [900.6,10.4]=[54,0.4]. Subsequently, a JSON data processing program is called to convert the key-value pairs of the constructed hash index mapping table, such as {"0x87654321":1,...}, and the row and column data of the feature weight matrix, such as [[54,0.4],[45,0],...], into a nested JSON structure, such as {"hash_map":{"0x87654321":1,...},

[0072] "feature_matrix":[[54,0.4],[45,0],...]}. After the conversion is completed, the data serialization verification is performed. The verification process is as follows: the generated JSON string is re-parsed back into the internal data structure, and then the original hash table key-value pairs, matrix row and column data are compared item by item with the parsed data to see if they are completely consistent. For example, check whether the value corresponding to the key "0x87654321" in the parsed hash map is still 1, and whether the first element of the matrix is ​​still 54. If all data items are consistent, the verification passes, and finally the verified JSON format structured parameter set is output.

[0073] The classification feature discrimination module includes:

[0074] The field similarity calculation submodule obtains the field naming parameters of the structured parameter set, compares the number of insertion, deletion, and replacement operations character by character, calculates the average number of characters in the field based on the sliding time window, and calculates the quotient of the number of operations and the average number of characters in the field to generate a similarity value;

[0075] The classification feature discrimination module includes a field similarity calculation submodule, which first obtains the field naming parameters in the structured parameter set output by the aforementioned structure encoding submodule, such as a list of field names.

[0076] ["User_ID","UserID","UserName","Creation_Timestamp","CreatedTS"], then for any two field naming parameters, such as "User_ID" and "UserID", compare them character by character, and record the minimum number of single-character editing operations (insert, delete, replace) required to convert one string to another. For "User_ID" to "UserID", the operations are: delete "", insert "I", replace "D" with "d" (assuming case sensitivity, if not sensitive, no replacement is required). If the comparison is case-insensitive, the operation is to delete "", and the number of operations is 1. Based on a preset sliding time window, this window is set to collect field sample data sets within the last 30 days. For example, in the past 30 days, all field name samples collected are ["fieldA","fieldB",…,"fieldZ"], totaling N fields. Count the average number of characters of these field names in the window. The calculation process is: accumulate these N fields The total number of all characters in the name is then divided by N. For example, if there are 100 field name samples within 30 days and the total number of characters is 850, then the average number of characters in the field is 850 / 100=8.5 characters. Subsequently, the number of edit operations between the two field names calculated above, for example 1, is divided by the average number of characters in the field counted in the current sliding window, for example 8.5, and the similarity correction value is obtained = number of operations / average number of characters in the field = 1 / 8.5≈0.1176. Since the higher the similarity value, the more similar it is, and the smaller the edit distance, the closer it is. The more similar they are, the similarity they show. Therefore, the similarity value can be defined as 1-similarity correction value (if the correction value is limited to between 0 and 1), or more directly use the edit distance itself as the dissimilarity measure, or adopt other normalized similarity calculations based on the edit distance, such as Levenshtein similarity = 1-(edit distance / MAX(string 1 length, string 2 length)). If the length of "User_ID" is 7, the length of "UserID" is 6, and the edit distance is 1, then the similarity value is 1-(1 / 7)≈0.857, which generates this similarity value.

[0077] The character distribution deviation test submodule counts the frequency of occurrence of letter categories in the content feature parameters, divides the basic character categories according to the ISO / IEC10646 standard, and calculates the square difference between the actual frequency of each category and the expected value of the uniform distribution using the formula:

[0078]

[0079] Calculate and obtain the comprehensive deviation of character distribution, compare the deviation with the preset reference value, and generate a character deviation index;

[0080] Where D represents the character deviation index, oi Represents the actual count of the i-th type of character, e i represents the theoretical expected value of the i-th type of character, c j represents the special symbol weight factor, k is the number of 26 letter categories, m is the 10 predefined special symbol types, n represents the number of basic character categories, which is the same as k, i represents the character category index, and j represents the special character type index;

[0081] The classification feature discrimination module also includes a character distribution deviation test submodule, which first counts the frequency of occurrence of letter categories in the content feature parameters corresponding to each field in the structured parameter set. Taking the field value "ClientName_New_Version_2024" as an example, its content feature parameters contain the text. Based on the ISO / IEC10646 standard (Unicode) as a reference, the characters are divided into basic character categories, specifically the 26 English letters (case-insensitive), and the actual frequency of each letter category in the text is calculated (o i ), for example, for the text "ClientName_New_Version_2024", the letter 'c' appears once, 'l' appears once, 'i' appears twice, 'e' appears three times, 'n' appears three times, 't' appears once, 'a' appears once, 'm' appears once, 'w' appears once, 'v' appears once, 'r' appears once, 's' appears once, 'o' appears once, and other letters appear 0 times. The total number of letters in the text is 19. Then the uniform distribution expected value (e i ) is the total number of letters divided by the number of letter categories, that is, e i =19 / 26≈0.7308 times, then use the formula Calculation is performed, where D represents the final calculated character deviation index, o i Represents the frequency of the i-th type of letters (such as 'a', 'b', ..., 'z') actually appearing in the current field content, such as o c =1,o l =1,o i =2,e i represents the theoretical expected frequency of the i-th type of letter under the assumption of uniform distribution, for all i, e i =(∑o i ) / n, in this example, the total number of letters is 19, n = 26, so e i =19 / 26≈0.7308, n represents the number of basic character categories, here specifically refers to the case-insensitive category of English letters, so n=26, It is the sum of the squares of the difference between the actual frequency of each letter and the expected frequency, which reflects the unevenness of the letter distribution. For example, for the letter 'c', (1-0.7308)2 ≈(0.2692) 2 ≈0.07247, calculated for all 26 letters and summed, The square root of the above sum of squares is taken to obtain a measure in the form of standard deviation of the frequency distribution, c k Represents the weight factor of the jth predefined special symbol. These 10 predefined special symbol types (m=10) and their weight factors are set based on the experience of indicating the degree of data structure or sensitivity in specific business scenarios. For example, the underscore "_" is often used to connect words, and its weight factor can be set to 0.1. The hyphen "-" has a weight of 0.05. The appearance of numbers (considered as a special symbol type) has a weight of 0.2. Others include "@", "#", "", "' (0.1), "%" (0.05), and "number" (0.2). The weight factors of m=10 special symbols are summed, for example, 0.1+0.05+0.08+0.03+0.02+0.15+0.12+0.1+0.05+0.2=0.9, The absolute value of the sum of the weight factors is taken. Since the weight factors are usually set to positive values, this absolute value operation ensures that the result is positive, that is, |0.9|=0.9. k is an adjustment coefficient, and its value is the number of 26 letter categories, that is, k=26. It is a weighted adjustment term, which uses the total weight of special symbols divided by the number of letter categories as a correction for the previous letter distribution difference. The logical idea of ​​this formula is to first quantify the degree of deviation of the distribution of the main characters (here, letters) in the field value from the uniform distribution, and then combine the preset weights of special symbols appearing in the field to comprehensively evaluate the structural characteristics of the field content or the deviation from the specific pattern. The weight factor c of special symbols is k The introduction of allows the contribution of different special symbols to the deviation index to be adjusted based on prior knowledge. The benefit of the formula is that by comprehensively considering the discrete degree of letter distribution and the weighted influence of specific special symbols, it can more finely characterize the statistical characteristics of the field content, rather than just a single character uniformity measure. Let's demonstrate this with an example: Assume that in the text "ClientName_New_Version_2024", the letter frequency distribution o i As mentioned above, e i ≈0.7308,

[0082]

[0083] but Special symbol weight factor and ∑c j =0.9, k=26, so Obtain the comprehensive deviation of the character distribution D≈0.15857, and compare this deviation with a preset benchmark value. The benchmark value is set based on the average deviation value of historical similar asset data under this formula and adjusted based on expert experience. For example, by calculating the mean D value of 1000 classified "name" fields, the mean D value is 0.25 and the standard deviation is 0.05. The benchmark value can be set to the mean 0.25, or set to, for example, mean + 0.5 × standard deviation = 0.25 + 0.5 × 0.05 = 0.275 as required. If the currently calculated D = 0.15857 is lower than the benchmark value of 0.275, it is considered that the degree of deviation is low. If it is higher, the deviation is high. After comparison, a character deviation index is generated. This index can be the D value itself, or it can be normalized, or graded according to the comparison results with the benchmark value (for example, below 0.1 is low deviation, 0.1 to 0.3 is medium deviation, and above 0.3 is high deviation). Here, the character deviation index is 0.15857. The result 0.15857 indicates that the character distribution of the current field "ClientName_New_Version_2024" deviates by 0.15857 relative to the uniform distribution and special symbols. This value will be used for subsequent classification decisions, and the value itself is the generated character deviation index.

[0084] The classification label synthesis submodule establishes a Cartesian coordinate system with the horizontal axis mapping the similarity value and the vertical axis mapping the character deviation index. A two-stage threshold setting method is used to divide the quadrant boundaries. When a data point is lower than the dual-axis threshold at the same time, the classification label parameter is output.

[0085] The classification feature discrimination module further includes a classification label synthesis submodule, which first refers to a preset two-dimensional Cartesian coordinate system and sets its horizontal axis to map the similarity value generated by the aforementioned field similarity calculation submodule. For example, if the similarity value calculated for the field pair ("User_ID", "UserID") is 0.857, then the horizontal axis is located at 0.857, and the vertical axis is set to map the character deviation index generated by the aforementioned character distribution deviation test submodule. For example, the character deviation index calculated for the content of the field "User_ID" (assuming it is "UID123") is 0.15857 (the calculation results of the previous paragraph are reused here for association, for example). The deviation index of the content of "User_ID" itself should be located at 0.15857 on the vertical axis, thus obtaining a data point (0.857, 0.15857). Then, a two-stage threshold setting process is used to divide the quadrant boundaries. In the first stage, based on the historical classified asset field data (for example, containing 10,000 manually labeled classified field data), the 75th percentile value of the similarity value set and the character deviation index set is calculated. For example, the 75th percentile value of the historical similarity value is 0.80, and the 75th percentile value of the historical character deviation index is 0.20. These two values ​​(0.80 and 0.20) are used as the initial horizontal axis thresholds (Th x _initial=0.80) and vertical axis threshold (Th y _initial=0.20). In the second stage, the two initial thresholds are dynamically adjusted based on the new field data flowing in in real time. The adjustment method is to allow them to have a floating range of ±5% based on the initial threshold. For example, if the average similarity value calculated in the current real-time data stream has a downward trend, and the system monitors that the average similarity value of the latest batch of 100 new fields is 6% lower than the historical average, then the horizontal axis threshold can be adjusted downward, but not more than 5%, that is, adjusted to 0.80×

[0086] (1-0.05)=0.76. If the character deviation index has an upward trend, and the system detects that the deviation index average of the latest batch of new fields is 4% higher than the historical average, the vertical axis threshold can be adjusted upward to 0.20×(1+0.04)=0.208. Assume that the dynamically adjusted dual-axis thresholds of the current application are Th x =0.76 and Th y=0.208, when the horizontal axis value 0.857 of a data point (for example (0.857,0.15857)) is higher than the horizontal axis threshold 0.76, and its vertical axis value 0.15857 is lower than the vertical axis threshold 0.208 (the original text of the condition here is "lower than the dual-axis threshold at the same time". If this is understood, high field similarity is considered "good" and low deviation index is considered "good". Then the similarity should be higher than the threshold and the deviation index is lower than the threshold, or, if both are lower, the better, then both are lower than the threshold. Now follow the original text "lower than the dual-axis threshold at the same time". Assume that the lower the similarity, the better, that is, the less similar, the better. This is contrary to the common understanding. Here it is executed literally. If the similarity 0.857 is not lower than 0.76, it is not satisfied. If the logic needs to be adjusted to high similarity and low deviation, then it is judged that 0.857>0.76 and 0.15 857<0.208, the condition is met and a predefined classification label is output, such as "normal data"; if the original text "is lower than the dual-axis threshold at the same time", that is, 0.857<0.76 and 0.15857<0.208, in this example, 0.857 is not less than 0.76, so it is not satisfied, and another label is output, such as "data to be reviewed"). Here we assume that "lower than the dual-axis threshold at the same time" means that the similarity value is lower than the horizontal axis threshold and the character deviation index is lower than the vertical axis threshold. For the data point (0.857, 0.15857), since 0.857 is not less than 0.76, the condition is not met, so a specific classification label indicating that the data point is lower than the dual-axis threshold at the same time will not be output. Instead, the corresponding classification label parameters are output according to the quadrant it falls in (for example, high similarity, low deviation), such as "high similarity and low deviation sensitive data candidate".

[0087] The sliding time window is set to the field sample dataset of the last 30 days;

[0088] The two-stage threshold setting method first calculates the 75th percentile value as the initial threshold based on historical data, and then dynamically adjusts the ±5% floating range according to the real-time data stream.

[0089] The hierarchical weight calculation module includes:

[0090] The indicator weight analysis submodule receives the sensitivity indicator parameter, access frequency parameter and data volume parameter in the classification label parameter, performs sliding window normalization processing on the three types of parameters, calculates the discrete degree and information entropy value of multiple parameter sample values, reversely derives the weight distribution ratio based on the entropy value, and generates a weight coefficient set;

[0091] The hierarchical weight calculation module includes an indicator weight analysis submodule, which first receives the sensitivity indicator parameter, access frequency parameter and data volume parameter attached or associated with the classification label parameter output by the aforementioned classification label synthesis submodule. For example, for an asset "customer contact information table" marked as a "high similarity and low deviation sensitive data candidate", its sensitivity indicator parameter is calculated as 0.9 according to the preset rules (for example, if the content contains keywords such as "telephone" and "email", the sensitivity is assigned to 0.9, if it contains "ID card", it is assigned to 1.0, and if it contains other keywords, it is assigned to 0.1). Its access frequency parameter is calculated as 0.9 through The access log system is queried to obtain, for example, it was accessed 150 times in the past month, and its data volume parameter is obtained by querying the storage system metadata, for example, 15MB. For these three parameters (sensitivity 0.9, access frequency 150 times, data volume 15MB) and these three parameters of other assets in the historical sample, sliding window normalization is performed. The processing process is as follows: set a sliding window, for example, the samples of the last 100 processed assets, for each parameter in the window (such as access frequency), calculate its minimum and maximum values, and then use the formula X for the parameter value of the current asset std =(XX min ) / (X max -X min ) is scaled to between 0 and 1. For example, the minimum access frequency of the last 100 assets is 10 times and the maximum is 500 times. The normalized value of the current asset access frequency of 150 times is (150-10) / (500-10)=140 / 490≈0.2857. Similar processing is performed on sensitivity (assuming it is already in the range of 0-1, this step can be skipped or adjusted as needed) and data volume (for example, the minimum is 1MB and the maximum is 200MB, then 15MB is normalized to (15-1) / (200-1)=14 / 199≈0.0704) to obtain a set of standardized parameter sample values, for example {sensitivity_std: 0.9, access frequency_std: 0.2857, data volume_std: 0.0704}, and then calculate the degree of dispersion based on these standardized multiple parameter sample values, such as calculating the variance or standard deviation of each parameter, and at the same time calculate the information entropy value of these parameter sample values. The calculation process of information entropy is: for a certain parameter (such as access frequency_std), divide its value range in [0,1] into several intervals, such as 10 equal-width intervals [0,0.1), [0.1,0.2),…, [0.9,1.0], and statistically calculate the probability p of the sample falling in each interval k , then the information entropy of the parameter H=-∑ k p k log2p kThe smaller the information entropy value, the more concentrated the value of the parameter, the more certain the information it provides, and the lower the degree of discreteness. Conversely, the higher the value, the weight distribution ratio is reversely deduced based on the information entropy value of each parameter (sensitivity, access frequency, and data volume). The specific deduction process is as follows: the smaller the information entropy value, the lower the uncertainty, indicating that the discrimination may not be high or the data is relatively consistent. In the weight distribution, a relatively low weight can be assigned. Conversely, the larger the information entropy value, the higher the uncertainty, the more information it contains, the higher the discrimination may be, and the relatively high weight can be assigned. A commonly used method is to let the weight w j =(1-H j ) / ∑ i (1-H i ), where H k is the information entropy of the jth parameter. If the information entropy of sensitivity, access frequency, and data volume are calculated to be H1 = 0.5, H2 = 0.8, and H3 = 0.2, then the corresponding 1-H j They are 0.5, 0.2, and 0.8 respectively, and their sum is 1.5, so the weights are w1=0.5 / 1.5≈

[0092] 0.333, w2 = 0.2 / 1.5 ≈ 0.133, w3 = 0.8 / 1.5 ≈ 0.533. These weights constitute the weight coefficient set {sensitivity weight: 0.333, access frequency weight: 0.133, data volume weight: 0.533}, which generates this weight coefficient set.

[0093] The parameter synthesis submodule calls the sensitivity weight coefficient, access frequency weight coefficient and data volume weight coefficient in the weight coefficient set, establishes a three-level weighted accumulation mechanism, performs a scalar product of the original value of the sensitivity index and the corresponding weight, superimposes the access frequency weight value and the data volume weight value, performs arithmetic accumulation operation on the three weighted results, and generates a grading level parameter;

[0094] The hierarchical weight calculation module also includes a parameter synthesis submodule, which calls the weight coefficient set generated by the aforementioned indicator weight analysis submodule, such as {sensitivity weight: 0.333, access frequency weight: 0.133, data volume weight: 0.533}, and the corresponding original unstandardized but possibly preliminarily quantified parameter values. For example, the original value of the sensitivity index of asset A is 0.9 (assuming this is a score from 0 to 1), the original value of the access frequency index is 150 (the actual number of visits), and the original value of the data volume index is 15 (in MB, which may need to be preliminarily quantified). Convert it into a numerical value or rating comparable to other assets. For example, less than 1MB is 1, 1-10MB is 2, 10-50MB is 3, and 15MB corresponds to level 3). For simplification, we assume that access frequency and data volume have also been converted to scores in the range of 0-1, such as access frequency score 0.6 and data volume score 0.4. A three-level weighted accumulation mechanism is established. The specific implementation process is as follows: First, the original value of the sensitivity index (0.9) is scalar-multiplied by the corresponding sensitivity weight coefficient (0.333) to obtain the sensitivity weighted value.

[0095] = 0.9 × 0.333 = 0.2997. Secondly, perform a scalar product operation on the original value of the access frequency index (assuming it has been converted to a score of 0.6) and the corresponding access frequency weight coefficient (0.133), and obtain the access frequency weighted value = 0.6 × 0.133 = 0.0798. Thirdly, perform a scalar product operation on the original value of the data volume index (assuming it has been converted to a score of 0.4) and the corresponding data volume weight coefficient (0.533), and obtain the data volume weighted value = 0.4 × 0.533 = 0.2132. Finally, perform these three weighted calculations. The arithmetic accumulation operation of the results, that is, the original cumulative value of the final grading level parameter = sensitivity weighted value + access frequency weighted value + data volume weighted value = 0.2997 + 0.0798 + 0.2132 = 0.5927. This original cumulative value is subjected to subsequent possible threshold judgment or binning operations to generate the final grading level parameter. For example, if the level threshold is set to: [0-0.3) is level 1, [0.3-0.6) is level 2, and [0.6-1.0] is level 3, then 0.5927 belongs to level 2, and the grading level parameter "level 2" is generated.

[0096] The data synchronization submodule constructs a hierarchical coding sequence based on the hierarchical level parameters, extracts the timestamp field and operation type code in the access event parameters, aligns the timestamp using the NTP protocol, aligns the coding sequence with the event field and performs data format conversion, executes the data encapsulation protocol call, and outputs the synchronized data stream.

[0097] The hierarchical weight calculation module further includes a data synchronization submodule, which constructs a level coding sequence for the asset based on the hierarchical level parameters generated by the aforementioned parameter synthesis submodule, such as the "level 2" obtained by asset A, for example, directly using the level number "2" or converting it into a more complex code such as "L2_Normal". Then, it extracts the timestamp field and operation type code from the real-time access event parameters. For example, an access event record is {"user":"user01","asset_id":"AssetA","oper ation":"READ","timestamp":"2025-05-27T10:30:05.123Z","ip_address":"192.168.1.50"}, extract the timestamp "2025-05-27T10:30:05.123Z" and the operation type code "READ" (which may be internally mapped to the number 1), and then use the Network Time Protocol (NTP) client to communicate with the preset NTP server (such as time.nist.gov) to obtain the standard Time, calibrate the local clock of this system to ensure the accuracy of the extracted access event timestamps, or uniformly align timestamps from different sources at the data aggregation end. Associate and combine the aforementioned level coding sequence ("L2_Normal" or "2") with the relevant fields in the access event (such as asset ID "AssetA", operation type "READ", and the calibrated timestamp "2025-05-27T10:30:05.123Z"), and perform necessary data format conversion. For example, this information is uniformly converted into the specific format required by the target data warehouse or downstream policy execution system, such as Protocol Buffers or Avro serialization format. Finally, execute a predefined data encapsulation protocol call. This call process is to package the converted data into a data packet that conforms to a specific communication protocol (such as an HTTPS POST request body or a Kafka message body) and send it to the specified receiving endpoint (for example, a central audit log service or an API interface of a dynamic permission decision engine), outputting this encapsulated, synchronized data stream containing the level coding and alignment event information.

[0098] The dynamic permission adaptation module includes:

[0099] The role-authority matching submodule loads the role identifier and authority entries in the user role parameter, calls the level threshold in the hierarchical level parameter, constructs a role-level two-dimensional matrix with constraints, calculates the intersection coverage of the role authority entries and the level requirement threshold, performs Boolean operations on matrix cells to mark the valid authority area, and generates a permission matching matrix;

[0100] The permission dynamic adaptation module includes a role permission matching submodule. This submodule first loads the user role parameters, which are usually stored in the user management system. For example, the role identifier of the role "financial manager" is "FIN_MGR", and its associated permission item list is ["view financial statements", "approve expenditures less than 10,000 yuan", "generate monthly summary"]. At the same time, the level thresholds in the hierarchical level parameters generated by the aforementioned hierarchical weight calculation module are called. For example, the system defines the correspondence between asset levels and operation permissions. Level 1 assets allow "reading", level 2 assets allow "reading" and "modifying summary", and level 3 assets allow "reading", "modifying summary" and "deleting". These constitute the level requirement thresholds. Then, a role-level two-dimensional matrix with constraints is constructed. The rows of the matrix represent user roles (such as "FIN_MGR"), and the columns represent the asset sensitivity levels that assets or operations can reach (such as level 1, level 2, level 3). The constraints come from the highest asset level or specific operation type that the role itself is allowed to operate in the role definition. For example, the "FIN_MGR" role is set to operate assets of the highest level 2. For a specific asset X, its level calculated by the above module is level 2. Now it is necessary to determine the authority of "FIN_MGR" to perform the "approval of expenditures less than 10,000 yuan" operation on asset X. First, calculate the role permission item ("approval of expenditures less than 10,000 yuan") and the asset The intersection coverage between the requirement thresholds (allowing "reading" and "modifying summary") corresponding to level 2 of X is calculated as follows: check whether the specific permission entry of the role is included in the set of operations allowed by the asset level, or whether it meets the requirements of the asset level for a specific operation. For example, the operation "approve expenditures less than 10,000 yuan" itself may be preset to require at least level 2 assets to be executed. If asset X is level 2, and the permission entry list of role "FIN_MGR" contains "approve expenditures less than 10,000 yuan", and the minimum asset level required for this operation is not higher than 2, then the permission entry is considered to match the level requirement threshold, and the intersection coverage is 100% (or Boolean true). If it does not match, it is 0% (or Boolean false). Then, a Boolean operation is performed on the corresponding cell of the role-level two-dimensional matrix ("FIN_MGR", level 2 of asset X). If all constraints (role's own permissions, operation level requirements, actual asset level) are met, it is marked as a valid permission (for example, True or 1), otherwise it is marked as invalid (False or 0). For example, for the role "FIN_MGR" and asset X (level 2), if the "approve expenditures less than 10,000 yuan" operation is defined as requiring asset level 2, and the role has this permission, the corresponding cell in the matrix is ​​marked as True. By performing this process for all roles and all possible asset levels (or specific assets), a complete permission matching matrix is ​​generated.

[0101] Table 1 Example permission matching matrix fragment

[0102]

[0103] As shown in Table 1, the table lists the permission matching results of some roles for specific operations at different asset levels, where True means having permission and False means not having permission.

[0104] The path verification submodule is based on the node connection relationship of the resource topology graph, inputs the path node sequence in the access event parameter, uses the improved Dijkstra algorithm to traverse the adjacent nodes, calculates the shortest hop count and cumulative weight value from the start node to the target node, compares the actual path hop count with the theoretical optimal path difference, and generates a path verification coefficient;

[0105] The permission dynamic adaptation module also includes a path verification submodule, which is based on the node connection relationship of a pre-built or dynamically perceived resource topology map. The topology map describes the logical or physical connection path between data resources, services, users, and devices. For example, node A (user terminal) is connected to node B (application server), and node B is connected to node C (database server). A path node sequence contained in an access event parameter is input. For example, a user attempts to access the path " / a from a device (node ​​U) with an IP address of 192.168.1.10. pp / service1 / data / resourceZ" (this path can be mapped to a series of logical nodes P1->P2->P3), and the path sequence is U->P1->P2->P3. Then, an improved graph traversal process is adopted, which starts from the starting node (U) of the path sequence, traverses its adjacent nodes, and expands layer by layer to the target node (P3). At the same time, the weight of each edge (for example, network delay, security level jump cost, etc.) is recorded, and the maximum traversal hop threshold is set to 7-layer network topology, that is, if the starting node is If the shortest path from a point to a target node has more than 7 intermediate nodes (number of hops), the path is considered too long or unreachable. During the traversal process, the shortest cumulative weight value path from the start node (U) to the target node (P3) and the number of hops of the path are calculated. For example, the shortest path from U to P3 obtained by traversal calculation is U->N1->N2->P3, with a cumulative weight value of 15 (for example, a total delay of 15ms) and a hop count of 3. Subsequently, the actual path hop count in the access event (for example, the physical or logical hop count of the gateway, proxy, etc. that the actual request passes through) is calculated. Assume that there are 4 hops, U->G1->P1->P2->P3) is compared with the calculated theoretical optimal path hop count (3 hops), and the difference between the two is calculated, that is, path hop count difference = actual hop count - theoretical optimal hop count = 4-3 = 1 hop. This difference is used as part of the path verification coefficient, or the path verification coefficient can be directly this difference, or a comprehensive score based on the difference and the accumulated weight value. For example, the path verification coefficient can also be (1+difference / theoretical hop count). The closer the value is to 1, the better. This path verification coefficient is generated, for example, 1(hop count difference).

[0106] The policy generation submodule integrates the effective permission tags in the permission matching matrix and the difference parameters in the path verification coefficient, constructs a policy decision tree based on the C4.5 algorithm, maps conditional nodes to permission policy entries, performs ACL entry encoding and writing operations, and generates dynamic permission policy parameters.

[0107] The permission dynamic adaptation module further includes a policy generation submodule, which integrates the effective permission mark in the permission matching matrix generated by the aforementioned role permission matching submodule (for example, for user role R and target resource O, the permission matching matrix is ​​displayed as True) and the difference parameter in the path verification coefficient generated by the aforementioned path verification submodule (for example, the difference in the number of path hops is 1), and constructs a policy decision tree based on a decision tree construction process (its core idea is similar to C4.5, but it does not directly call its name, but describes its steps: select the attribute with the highest information gain or gain rate as the split node, and recursively construct a subtree). The construction process is: take the permission matching result (True / False) and the path verification difference (for example, ≤2 hops, >2 hops) as candidate split attributes, and calculate the value of each attribute for the decision goal of "whether to authorize". Information gain, select the optimal attribute to split the tree node. For example, the root node is first split based on "whether the effective permission mark in the permission matching matrix is ​​True". If it is True, then continue to use "whether the path verification difference is ≤ 2 hops" as the next splitting condition. If the permission matching degree (which can be understood as the confidence of the relevant entry in the permission matching matrix or a direct Boolean value) is ≥ 80% (for Boolean True, it is 100%, which meets the condition) and the path verification difference is ≤ 2 hops (for example, the calculated difference is 1 hop, which meets the condition), then the decision path leads to the "authorize" leaf node, otherwise it leads to "reject" or other refined processing nodes. These conditional nodes in the decision tree (such as "permission matching result = True", "path verification difference ≤ 2") and their branch logic are mapped to specific permission policy entries. For example, a policy rule is generated:

[0108] "IF (RolePermissionMatch == True AND PathValidationDifference <= 2) THE NEXT Access", then, perform access control list (ACL) entry encoding on these generated policy entries, that is, convert the abstract policy rules into a specific ACL format that can be recognized by the target system (such as a firewall, operating system, database), for example, convert it into an ACL rule containing the source IP, destination IP, destination port, protocol, user identity, and operation permission / denial, and perform the write operation of the ACL entry, that is, apply the encoded ACL rule to the corresponding policy enforcement point (PEP), for example, update the access control policy library of the network device through API calls, or modify the permission settings of the file system, and finally generate dynamic permission policy parameters containing these specific ACL rules or abstract policy definitions for real-time access control decision-making.

[0109] Improved Dijkstra algorithm sets the maximum hop count threshold to 7-layer network topology;

[0110] The branch condition settings of the policy decision tree include permission matching degree ≥ 80% and path verification difference ≤ 2 hops.

[0111] The above are merely preferred embodiments of the present invention and do not limit the present invention in any other form. Any technician familiar with the profession may use the technical content disclosed above to change or modify it into an equivalent embodiment with equivalent changes and apply it to other fields. However, any simple modification, equivalent change and modification made to the above embodiment based on the technical essence of the present invention without departing from the content of the technical solution of the present invention shall still fall within the scope of protection of the technical solution of the present invention.

Claims

1. A data asset classification and grading and authority dynamic management system, characterized by: The system comprises: The asset parameter collection module is used to obtain metadata field parameters and file path parameters through a distributed crawler. It uses a regular expression matching algorithm and the load balancing mechanism of the distributed crawler node cluster to generate a structured parameter set and transmit it to the classification feature discrimination module. A classification feature discrimination module is configured to receive the structured parameter set, perform the field naming parameter comparison by calling the Levenshtein distance algorithm, detect the character distribution of the content feature parameter by using the improved chi-square test method, generate classification label parameters, and transmit the parameters to the classification weight calculation module; A hierarchical weight calculation module is used to receive the classification label parameters, calculate the weight coefficients of the sensitivity index parameters, access frequency parameters and data volume parameters through an improved entropy weight method, perform linear superposition to generate hierarchical level parameters, and transmit them synchronously with the access event parameters to the permission dynamic adaptation module; The permission dynamic adaptation module is used to match the hierarchical level parameters with the user role parameters in a permission matrix by improving the RBAC model, and combine the Dijkstra shortest path algorithm with the resource topology verification mechanism to generate dynamic permission policy parameters and write them into the access control list.

2. The data asset classification and grading and authority dynamic management system according to claim 1 is characterized in that: The structured parameter set specifically refers to the field naming structure, content feature matrix, and metadata index map; the classification label parameters include semantic similarity index, character distribution characteristics, and field type identification; the grading level parameters specifically include sensitivity weight coefficient, access frequency weight, data volume weight, and comprehensive level value; the dynamic permission policy parameters include role permission matrix, resource topology verification results, access path whitelist, and policy effective timestamp.

3. The data asset classification and grading and authority dynamic management system according to claim 2 is characterized in that: The regular expression matching algorithm achieves throughput matching with the distributed crawler by dynamically adjusting the thread pool size; The improved entropy weight method includes a range standardization processing step, and its calculation formula is: Where x′ ij represents the normalized value of the jth parameter of the i-th sample, min(x j ) and max(x j ) represent the minimum and maximum values ​​of the j-th parameter respectively; The linear superposition process includes an outlier truncation processing mechanism, and a normalization operation is performed when the weighted cumulative value exceeds a preset threshold; The improved RBAC model reduces the time and space complexity of the role-authority mapping relationship by 42% by introducing hierarchical level threshold constraints; The edge weight in the Dijkstra algorithm is defined as the weighted value of network delay and security level.

4. The data asset classification and grading and authority dynamic management system according to claim 3 is characterized in that: The asset parameter collection module includes: The data acquisition submodule deploys a distributed crawler node cluster, establishes a multi-threaded task allocation mechanism, sends concurrent requests to the target data source, captures metadata field text and file path strings in the response data, identifies multiple character encoding formats through an adaptive encoding detection interface, uses regular expressions to match special symbols or garbled characters, performs null value record filtering operations, and generates metadata feature streams; The feature extraction submodule loads a regular expression matching algorithm based on the metadata feature stream, uses named capture groups to extract the alphanumeric sequence in the field naming rules, calculates the continuity index of the field naming structure, which is defined as the percentage of the length of consecutive letters and numbers in the total field length, separates the frequency of occurrence of special symbols in the content feature rules and the span of the numerical interval, and generates a field identifier and a content feature value; The structure encoding submodule calls the field identifier to construct a hash index mapping table, uses the CRC32 check algorithm to generate a hash key value, generates a feature weight matrix based on the content feature value, converts the hash table key-value pairs and matrix row and column data into a nested hierarchical structure through the JSON encoder, performs data serialization verification, and outputs a structured parameter set.

5. The data asset classification and grading and authority dynamic management system according to claim 4 is characterized in that: The classification feature discrimination module includes: The field similarity calculation submodule obtains the field naming parameters of the structured parameter set, compares the number of insertion, deletion, and replacement operations character by character, calculates the average number of characters in the field based on the sliding time window, and calculates the quotient of the number of operations and the average number of characters in the field to generate a similarity value; The character distribution deviation test submodule counts the frequency of occurrence of letter categories in the content feature parameters, divides the basic character categories according to the ISO / IEC10646 standard, and calculates the square difference between the actual frequency of each category and the expected value of the uniform distribution using the formula: Calculating and obtaining a comprehensive deviation of character distribution, comparing the deviation with a preset reference value, and generating a character deviation index; Where D represents the character deviation index, o i Represents the actual count of the i-th type of character, e i represents the theoretical expected value of the i-th type of character, c j represents the special symbol weight factor, k is the number of 26 letter categories, m is the 10 predefined special symbol types, n represents the number of basic character categories, which is the same as k, i represents the character category index, and j represents the special character type index; The classification label synthesis submodule establishes a Cartesian coordinate system with the horizontal axis mapping the similarity value and the vertical axis mapping the character deviation index, and uses a two-stage threshold setting method to divide the quadrant boundaries. When the data point is lower than the dual-axis threshold at the same time, the classification label parameter is output.

6. The data asset classification and grading and authority dynamic management system according to claim 5 is characterized in that: The sliding time window is set to the field sample data set of the last 30 days; The two-stage threshold setting method first calculates the 75th percentile value as the initial threshold based on historical data, and then dynamically adjusts the ±5% floating range according to the real-time data stream.

7. The data asset classification and grading and authority dynamic management system according to claim 6 is characterized in that: The hierarchical weight calculation module includes: The indicator weight analysis submodule receives the sensitivity indicator parameter, access frequency parameter and data volume parameter in the classification label parameter, performs sliding window normalization processing on the three types of parameters, calculates the discrete degree and information entropy value of multiple parameter sample values, reversely derives the weight distribution ratio based on the entropy value, and generates a weight coefficient set; The parameter synthesis submodule calls the sensitivity weight coefficient, access frequency weight coefficient and data volume weight coefficient in the weight coefficient set, establishes a three-level weighted accumulation mechanism, performs a scalar product of the original value of the sensitivity index and the corresponding weight, superimposes the access frequency weight value and the data volume weight value, performs an arithmetic accumulation operation of the three weighted results, and generates a grading level parameter; The data synchronization submodule constructs a hierarchical coding sequence based on the hierarchical level parameters, extracts the timestamp field and operation type code in the access event parameters, aligns the timestamp using the NTP protocol, aligns the coding sequence with the event field and performs data format conversion, executes the data encapsulation protocol call, and outputs a synchronized data stream.

8. The data asset classification and grading and authority dynamic management system according to claim 7 is characterized in that: The dynamic permission adaptation module includes: The role-authority matching submodule loads the role identifier and authority entry in the user role parameter, calls the level threshold in the hierarchical level parameter, constructs a role-level two-dimensional matrix with constraints, calculates the intersection coverage of the role authority entry and the level requirement threshold, performs matrix unit Boolean operations to mark the valid authority area, and generates a permission matching matrix; The path verification submodule is based on the node connection relationship of the resource topology graph, inputs the path node sequence in the access event parameter, uses the improved Dijkstra algorithm to traverse the adjacent nodes, calculates the shortest hop count and cumulative weight value from the start node to the target node, compares the actual path hop count with the theoretical optimal path difference, and generates a path verification coefficient; The policy generation submodule integrates the effective permission mark in the permission matching matrix and the difference parameter in the path verification coefficient, constructs a policy decision tree based on the C4.5 algorithm, maps the conditional nodes to permission policy entries, performs ACL entry encoding and writing operations, and generates dynamic permission policy parameters.

9. The data asset classification and grading and authority dynamic management system according to claim 8 is characterized in that: The improved Dijkstra algorithm sets the maximum hop count threshold to a 7-layer network topology; The branch condition settings of the policy decision tree include authority matching degree ≥ 80% and path verification difference ≤ 2 hops.

Images