A data asset classification and dynamic management system of grading and permission

Abstract

The application relates to the technical field of data security, in particular to a data asset classification and grading and dynamic management system of authority, which comprises an asset parameter acquisition module, a classification feature discrimination module, a grading weight calculation module and a dynamic adaptation module of authority. In the application, distributed crawlers are combined with regular expressions to automatically collect metadata and path parameters, naming parameters and content feature parameters are separated to generate a structured parameter set, Levenshtein distance is used to quantify the naming similarity, chi-square test is used to verify the content character distribution feature, a double-checking mechanism of naming similarity and distribution feature is constructed, the entropy weight method is used to dynamically distribute the sensitivity, access frequency and data volume weight, the grading parameters are generated through linear superposition, the RBAC model is combined with the Dijkstra algorithm to verify the legality of the access path topology, the over-authorization access is blocked, and the dynamic adaptation capability of heterogeneous data classification and grading and authority control is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security, and particularly relates to a data asset classification and grading and dynamic permission management system. BACKGROUND

[0002] The technical field of data security includes security protection and risk prevention measures for various types of data in information systems. Its core content includes the security management of data collection, storage, transmission, use and destruction throughout the life cycle, to ensure that data is not tampered with, leaked or illegally used at each link. This technical field focuses on data compliance and privacy protection, covering data encryption, access control, audit tracking, anomaly detection, identity authentication and other aspects. With the development of information technologies such as cloud computing, big data and the Internet of Things, data security technology is gradually evolving towards intelligence and automation, strengthening the security management and dynamic risk prevention and control capabilities of multi-source heterogeneous data, and forming a systematic protection architecture.

[0003] Among them, the data asset classification and grading and dynamic permission management system refers to a management system that dynamically adjusts data access permissions based on the automatic identification, classification and security level division of various data assets within an organization, combined with user identity, access behavior and environmental factors. The patent subject mainly targets data matters including data asset classification identification rules, data security level definition standards, user identity authentication mechanisms, access behavior analysis models and permission adjustment strategies. Specifically, by setting fixed data classification attribute labels, based on a pre-defined data classification rule library, various data assets are automatically classified and graded; according to the permission matrix of user roles, combined with the real-time monitoring results of user operation behavior, using a threshold-based strategy engine, the access permissions of users to specific data are dynamically adjusted, thereby realizing fine-grained management and dynamic permission control of data assets.

[0004] The existing technology relies on manually pre-defined classification rule libraries, and when faced with cross-domain terminology or naming heterogeneity, the rule extension is insufficient, for example, different business systems name the same field differently, resulting in missing classification labels. The traditional grading model uses fixed weights to superimpose, which cannot distinguish the actual risk differences between high-frequency low-sensitivity and low-frequency high-sensitivity data, causing security resource mismatch. Permission management is based on the static mapping of roles and resources, lacking topological verification of cross-system access paths, for example, when a user accesses high-density level data by jumping through intermediate nodes, the permission strategy cannot identify the legality of the path. Content feature detection relies on keyword matching, which is difficult to identify data features of code obfuscation or distributed storage, for example, Base64 encoded text may be misjudged as low-risk data, causing grading deviation and affecting subsequent control strategies. SUMMARY

[0005] The invention aims at solving the problems existing in the prior art and proposes a data asset classification and grading and dynamic permission management system.

[0006] To achieve the above-mentioned purpose, the invention adopts the following technical scheme: a data asset classification and grading and dynamic permission management system comprises:

[0007] An asset parameter acquisition module is configured to obtain metadata field parameters and file path parameters through a distributed crawler, to cooperatively operate a regular expression matching algorithm and a load balancing mechanism of a distributed crawler node cluster, to generate a structured parameter set and transmit the structured parameter set to a classification feature discrimination module;

[0008] A classification feature discrimination module is configured to receive the structured parameter set, to call a Levenshtein distance algorithm to perform field naming parameter comparison, to detect content feature parameter character distribution by using an improved chi-square test method, to generate a classification label parameter and transmit the classification label parameter to a grading weight calculation module;

[0009] A grading weight calculation module is configured to receive the classification label parameter, to calculate weight coefficients of a sensitivity index parameter, an access frequency parameter and a data volume parameter by using an improved entropy weight method, to perform linear superposition to generate a grading level parameter, and to synchronously transmit the grading level parameter and an access event parameter to a dynamic permission adaptation module;

[0010] A dynamic permission adaptation module is configured to perform permission matrix matching of the grading level parameter and a user role parameter by using an improved RBAC model, to generate a dynamic permission strategy parameter by combining a Dijkstra shortest path algorithm and a resource topology verification mechanism, and to write the dynamic permission strategy parameter into an access control list.

[0011] As a further scheme of the invention, the structured parameter set specifically refers to a field naming structure, a content feature matrix and a metadata index atlas, the classification label parameter includes a semantic similarity index, a character distribution feature and a field type identifier, the grading level parameter specifically refers to a sensitivity weight coefficient, an access frequency weight, a data volume weight and a comprehensive level value, and the dynamic permission strategy parameter includes a role permission matrix, a resource topology verification result, an access path whitelist and a strategy effective timestamp.

[0012] As a further scheme of the invention, the regular expression matching algorithm matches the throughput of the distributed crawler by dynamically adjusting the size of a thread pool;

[0013] The improved entropy weight method includes a range standardization processing step, and the calculation formula is:

[0014] ;

[0015] wherein, represents the jth parameter standardization value of the ith sample. and respectively represent the minimum value and the maximum value of the jth parameter;

[0016] The linear superposition comprises an outlier truncation processing mechanism, and when the weighted cumulative value exceeds a preset threshold, a normalization operation is performed;

[0017] The improved RBAC model reduces the space-time complexity of the role-permission mapping relationship by 42% by introducing a hierarchical level threshold constraint.

[0018] The edge weight in the Dijkstra shortest path algorithm is defined as the weighted value of network delay and security level.

[0019] As a further scheme of the application, the asset parameter acquisition module comprises:

[0020] The data acquisition sub-module deploys a distributed crawler node cluster, establishes a multi-threaded task allocation mechanism, sends concurrent requests to the target data source, captures the metadata field text and file path string in the response data, identifies multiple character encoding formats through an adaptive encoding detection interface, matches special symbols or garbled characters using regular expressions, performs null record filtering operations, and generates a metadata feature stream.

[0021] The feature extraction sub-module loads a regular expression matching algorithm based on the metadata feature stream, uses named capture groups to extract alphanumeric combination sequences in field naming rules, calculates the continuity index of field naming structure, which is defined as the percentage of consecutive alphabetic and numeric character length to total field length, separates the frequency of special symbol occurrence and the numerical interval span in content feature rules, and generates field identifiers and content feature values.

[0022] The structure encoding sub-module calls the field identifiers to construct a hash index mapping table, generates hash key values using the CRC32 checksum algorithm, generates a feature weight matrix according to the content feature values, converts the hash table key-value pairs and matrix row-column data into nested hierarchical structures through a JSON encoder, performs data serialization verification, and outputs a structured parameter set.

[0023] As a further scheme of the application, the classification feature discrimination module comprises:

[0024] The field similarity calculation sub-module obtains the field naming parameters of the structured parameter set, compares the number of insertion, deletion and replacement operations character by character, calculates the average number of characters in the field based on a sliding time window, and generates a similarity value by dividing the number of operations by the average number of characters in the field.

[0025] The character distribution deviation detection submodule counts the frequency of occurrence of the letter category in the content feature parameter, divides the basic character category according to the ISO / IEC 10646 standard, calculates the square difference between the actual frequency of each category and the expected value of uniform distribution, and uses the formula:

[0026] ;

[0027] The operation obtains a comprehensive deviation degree of character distribution, compares the deviation degree with a preset reference value, and generates a character deviation index;

[0028] wherein, represents the character deviation index, represents the actual count of the i-th character, represents the theoretical expected value of the i-th character, represents a special symbol weight factor, is the number of 26 letter categories, is the number of 10 predefined special symbol types, represents the number of basic character categories, and is the same as value, represents a character category index, represents a special character type index;

[0029] The classification label synthesis submodule establishes a Cartesian coordinate system, with the horizontal axis mapping the similarity value and the vertical axis mapping the character deviation index. A two-stage threshold setting method is used to divide the quadrant boundary. When the data point is below the two-axis threshold at the same time, the classification label parameter is output.

[0030] As a further scheme of the present application, the sliding time window is set to a field sample data set of the last 30 days.

[0031] The two-stage threshold setting method first calculates the 75th percentile value as the initial threshold based on historical data, and then dynamically adjusts the ±5% floating range according to real-time data flow.

[0032] As a further scheme of the present application, the hierarchical weight calculation module includes:

[0033] The index weight analysis submodule receives the sensitivity index parameter, access frequency parameter and data volume parameter in the classification label parameter, performs sliding window standardization processing on the three types of parameters, calculates the dispersion degree and information entropy value of multiple parameter sample values, inversely deduces the weight distribution proportion according to the entropy value, and generates a weight coefficient set;

[0034] The parameter synthesis submodule calls sensitivity weight coefficients, access frequency weight coefficients and data volume weight coefficients in the set of weight coefficients, establishes a three-level weighted accumulation mechanism, performs scalar multiplication of the sensitivity index original value and the corresponding weight, superimposes the access frequency weighted value and the data volume weighted value, performs arithmetic accumulation operation on the three weighted results, and generates a hierarchical level parameter;

[0035] The data synchronization submodule constructs a level coding sequence based on the hierarchical level parameter, extracts a timestamp field and an operation type code in the access event parameter, aligns the timestamp using an NTP protocol, aligns the timestamp and converts the data format of the coding sequence and the event field, performs data encapsulation protocol calling, and outputs a synchronization data stream.

[0036] As a further scheme of the application, the permission dynamic adaptation module comprises:

[0037] The role permission matching submodule loads a role identifier in the user role parameter and a permission entry, calls a level threshold in the hierarchical level parameter, constructs a role-level two-dimensional matrix with constraint conditions, calculates the intersection coverage rate of the role permission entry and the level demand threshold, performs Boolean operation marking on the effective permission area of the matrix unit, and generates a permission matching matrix;

[0038] The path verification submodule inputs a path node sequence in the access event parameter based on the node connection relationship of the resource topology graph, traverses the adjacent nodes using an improved Dijkstra shortest path algorithm, calculates the shortest hop number and the cumulative weight value from the starting node to the target node, compares the actual path hop number and the difference value of the theoretical optimal path, and generates a path verification coefficient;

[0039] The strategy generation submodule fuses the effective permission marker in the permission matching matrix and the difference parameter in the path verification coefficient, constructs a strategy decision tree based on a C4.5 algorithm, maps the condition node to a permission strategy entry, performs ACL entry encoding and writing operation, and generates a dynamic permission strategy parameter.

[0040] As a further scheme of the application, the improved Dijkstra shortest path algorithm sets the maximum hop number threshold to 7-layer network topology.

[0041] The branch condition of the strategy decision tree comprises permission matching degree ≥ 80% and path verification difference ≤ 2 hop numbers.

[0042] Compared with the prior art, the application has the following advantages and positive effects:

[0043] In the present application, the metadata field and path parameter are automatically collected by combining the distributed crawler with the regular expression, the structured parameter set is generated by separating the naming parameter and the content feature parameter, and the manual intervention cost is reduced. The Levenshtein distance algorithm quantifies the field naming similarity, the chi-square test verifies the content character distribution feature, a double verification mechanism of field naming similarity and content distribution is established, and the adaptability of the classification rule to heterogeneous data is enhanced. The entropy weight method dynamically allocates the weight coefficients of sensitivity, access frequency and data volume, generates a hierarchical parameter through linear superposition, and makes the security level division adjust in real time with the change of business scenarios. The RBAC model is combined with the Dijkstra shortest path algorithm to verify the topological legality of the access path in the permission matrix matching, and to block the unauthorized access behavior of non-pre-set paths. The technical fusion makes the data classification and grading have the ability of dynamic weight allocation, and the permission control changes from static mapping to path topology constraint, forming a closed loop protection. BRIEF DESCRIPTION OF DRAWINGS

[0044] Figure 1 The system flowchart of the present application. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical scheme and advantages of the present application clearer, the present application will be further described in detail below in combination with the drawings and examples. It should be understood that the specific examples described herein are only used to explain the present application and do not limit the present application.

[0046] In the description of the present application, it should be understood that the terms "length", "width", "upper", "lower", "front", "rear", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer" and the like indicate the orientation or positional relationship based on the orientation or positional relationship shown in the drawings, and are only for the convenience of describing the present application and simplifying the description, and do not indicate or imply that the devices or elements referred to must have a particular orientation, be constructed and operated in a particular orientation, and therefore cannot be understood as limiting the present application. In addition, in the description of the present application, the meaning of "a plurality of" is two or more, unless otherwise specifically limited.

[0047] Example one

[0048] Please refer to Figure 1 A data asset classification and grading and dynamic permission management system comprises:

[0049] An asset parameter acquisition module is used to obtain metadata field parameters and file path parameters through a distributed crawler, and a regular expression matching algorithm is used to cooperate with the load balancing mechanism of the distributed crawler node cluster to generate a structured parameter set and transmit it to a classification feature discrimination module;

[0050] The classification feature discrimination module is configured to receive the structured parameter set, call a Levenshtein distance algorithm to perform field naming parameter comparison, detect content feature parameter character distribution by using an improved chi-square test method, generate a classification label parameter, and transmit the classification label parameter to the hierarchical weight calculation module.

[0051] The hierarchical weight calculation module is configured to receive the classification label parameter, calculate weight coefficients of the sensitivity index parameter, the access frequency parameter, and the data volume parameter by using an improved entropy weight method, perform linear superposition to generate a hierarchical level parameter, and transmit the hierarchical level parameter to the permission dynamic adaptation module in synchronization with the access event parameter.

[0052] The permission dynamic adaptation module is configured to perform permission matrix matching of the hierarchical level parameter and a user role parameter by using an improved RBAC model, generate a dynamic permission strategy parameter by combining a Dijkstra shortest path algorithm and a resource topology verification mechanism, and write the dynamic permission strategy parameter into an access control list.

[0053] The structured parameter set specifically refers to a field naming structure, a content feature matrix, and a metadata index graph. The classification label parameter includes a semantic similarity index, a character distribution feature, and a field type identifier. The hierarchical level parameter specifically refers to a sensitivity weight coefficient, an access frequency weight, a data volume weight, and a comprehensive level value. The dynamic permission strategy parameter includes a role permission matrix, a resource topology verification result, an access path whitelist, and a strategy effective timestamp.

[0054] The regular expression matching algorithm matches the throughput of the distributed crawler by dynamically adjusting the size of a thread pool.

[0055] The improved entropy weight method includes a range standardization processing step, and a calculation formula thereof is as follows:

[0056] ;

[0057] wherein, represents a standardized value of the jth parameter of the ith sample, and represent a minimum value and a maximum value of the jth parameter, respectively.

[0058] The linear superposition includes an abnormal value truncation processing mechanism. When a weighted cumulative value exceeds a preset threshold, a normalization operation is performed.

[0059] The improved RBAC model reduces the space-time complexity of the role-permission mapping relationship by 42% by introducing a hierarchical level threshold constraint.

[0060] The edge weight in the Dijkstra shortest path algorithm is defined as a weighted value of network delay and security level.

[0061] The asset parameter acquisition module includes:

[0062] The data collection sub-module deploys a distributed crawler node cluster, establishes a multi-thread task allocation mechanism, sends concurrent requests to the target data source, captures the metadata field text and file path string in the response data, identifies multiple character encoding formats through an adaptive encoding detection interface, matches special symbols or garbled characters using a regular expression, performs a null record filtering operation, and generates a metadata feature stream;

[0063] The asset parameter acquisition module includes a data acquisition submodule. This submodule references the configured distributed crawler node cluster addresses; for example, node A's IP address is 192.168.1.101, node B's is 192.168.1.102, and node C's is 192.168.1.103. It also follows a preset multi-threaded task allocation mechanism, for example, setting each crawler node to start 5 concurrent threads, for a total of 15 concurrent threads to jointly execute the acquisition task. These threads send data to the target data source, such as the enterprise's internal document server address "\\fileserv". The system retrieves the following data: `employee\shared\documents\`, the database server address `HR_DB_SERVER`, and the API interface provided by an external partner `https: / / api.partner.com / data / v1 / assets`. It sends concurrent HTTP GET requests or database query commands to capture the metadata field text contained in the response data from each data source. For example, it captures the metadata "Title: 2024 First Quarter Financial Statements, Author: Zhang San, Creation Date: 2024-04-15" from the file "Financial Statements_2024_Q1.docx" from the document server; it captures the text "EMP001" for the "EmployeeID" field and "Wang" for the "LastName" field from the "Employees" table of the HR_DB_SERVER database server; and it captures file path strings, such as "\\fileserver\shared\documents\Financial Statements_2024_Q1.docx". Then, it calls an adaptive encoding detection interface, which analyzes byte stream characteristics, such as checking the BOM (Byte Order Mark) at the beginning of the text. (derMark) or by counting the frequency of specific byte sequences, the character encoding format of the captured text can be identified, such as UTF-8, GBK, and ISO-8859-1. For example, if the metadata of "Financial Statements_2024_Q1.docx" is detected to be UTF-8 encoded, while the employee data "EMP001, Wang" migrated from the old system is GBK encoded, then a predefined set of regular expression rules is used for the identified encoding format. For example, the rule set contains "[-1F]" to match control characters, "[^\\u4e00-\\u9fa5\\w\\s".The regular expression matching algorithm is used to match non-Chinese and English, numbers, spaces and common punctuation, and the metadata field text is matched to identify and mark special symbols or garbled characters in the text, such as the metadata "log_entry: operation success" captured in a certain unstructured log, wherein " " is marked as a garbled character, and a null record filtering operation is performed on all captured metadata records, that is, the value of each metadata field is checked, if the field value is an empty string "", or a "NULL" string, or only contains white space, the record or the field is removed from subsequent processing, for example, a record is "filename:, size: 1024KB", and the "filename" field is concerned because it is null, after the above data collection, code recognition, regular matching and null value filtering, the cleaned metadata fields and their corresponding values are combined into a structured data stream to generate a metadata feature stream.

[0064] The feature extraction submodule loads a regular expression matching algorithm based on the metadata feature stream, uses named capture groups to extract alphanumeric sequences in the field naming rules, calculates the continuity index of the field naming structure, which is defined as the percentage of consecutive alphabetic and numeric character length to the total field length, separates the special symbol occurrence frequency and numerical interval span in the content feature rule, and generates field identifiers and content feature values.

[0065] The asset parameter collection module further comprises a feature extraction submodule, which extracts features from the metadata feature stream generated by the aforementioned data collection submodule. For example, when a metadata record {“field name”:“UserID_Active_Status”,“field value”:“USR1001_A”,“source”:“DatabaseA.TableX.ColumnY”} is received, the submodule loads a pre-defined regular expression matching process. Instead of directly invoking a specific algorithm name, the process specifically performs the following steps: define a set of regular expressions containing named capture groups, for example, for the field naming rule, define the expression as “(?[A-Za-z_]+)(?[0-9A-Za-z])(?[_A-Za-z])”, use this expression to match the field name“UserID_Active_Status” in the metadata feature stream, extract the alphanumeric combination sequence, capture“UserID_” through the named capture group“prefix”, capture“Active” through“identifier”, and capture“Status” through“suffix”. Then, calculate the continuity index of the field naming structure. The calculation process is as follows: first, obtain the total length of the field name“UserID_Active_Status”, which is 20 characters, then count the length of the continuous letter sequence, such as“UserID” for 6 characters, “Active” for 6 characters, and “Status” for 6 characters, and the length of the continuous numeric character, which is 0 in this case. The total length of the continuous letter and numeric character is 6+6+6=18, so the continuity index is calculated as (18 / 20)*100%=90%. This index is defined as the percentage of the length of the continuous letter and numeric character to the total field length. At the same time, separate the frequency of special symbol occurrence and the numerical interval span in the content feature rule, for example, for the field value“USR1001_A”, according to the pre-defined special symbol list such as“[’_’,‘-’,‘.’,‘:’]”, count the occurrence of“” as 1 and the occurrence of other special symbols as 0. If the field value is numeric, for example, the value of another field“Age” is“35”, record the numerical value“35”. If it is a numerical interval type text such as“SalaryRange:3000-5000”, extract the lower limit 3000 and the upper limit 5000, and calculate the numerical interval span as 5000-3000=2000. Through the above extraction and calculation of field naming and content features, the field identifier is generated, such as“UserID_Active_Status_ID” composed of the capture group content, and the corresponding content feature value, such as {“continuity index”:90,“special symbol_frequency”:1,“numerical value”:null,“numerical span”:null}.

[0066] The structural coding submodule calls the field identifier to build a hash index mapping table, generates a hash key value using a CRC32 check algorithm, generates a feature weight matrix according to a content feature value, converts the hash table key value pair and the matrix row and column data into a nested hierarchical structure through a JSON encoder, performs data serialization verification, and outputs a structured parameter set.

[0067] The asset parameter collection module further comprises a structure coding submodule, which calls the field identifiers generated by the aforementioned feature extraction submodule, such as "UserID_Active_Status_ID" and "CreationDate_Timestamp_ID", constructs a hash index mapping table, and the specific construction process is as follows: an integer index is assigned to each unique field identifier, for example, "UserID_Active_Status_ID" is mapped to 1 and "CreationDate_Timestamp_ID" is mapped to 2, and a cyclic redundancy check process is used to generate a hash key value, which specifically comprises the following steps: converting the field identifier string, such as "UserID_Active_Status_ID", into a byte sequence, then using a preset generating polynomial (for example, 0xEDB88320 commonly used in CRC32) to perform a series of bit operations (mainly XOR and shift) on the byte sequence, and finally obtaining a 32-bit integer as a hash key value, for example, "UserID_Active_Status_ID" is operated by this process to obtain a hash key value of 0x87654321, according to the content feature value, for example, the content feature value corresponding to the field "UserID_Active_Status_ID" is { "continuity index": 90, "special symbol_frequency": 1}, and the content feature value corresponding to the field "CreationDate_Timestamp_ID" is { "continuity index": 75, "special symbol_frequency": 0}, a feature weight matrix is generated, and the generation process of the matrix is as follows: first, determine the dimension of the matrix, the rows correspond to the field identifiers, and the columns correspond to the dimensions of the content features (such as continuity index and special symbol frequency), and each element value in the matrix represents the quantization value or weight of the corresponding field in the feature dimension, for example, if the continuity index weight is 0.6 and the special symbol frequency weight is 0.4 (this weight setting is based on prior knowledge, considering that the naming continuity is more important), then for "UserID_Active_Status_ID", its corresponding row in the matrix may be [900.6,10.4]=[54,0.4], then a JSON data processing program is called, which converts the key-value pairs of the constructed hash index mapping table, such as { "0x87654321": 1,...}, and the row and column data of the feature weight matrix, such as [[54,0.4],[45,0],...], into a nested level JSON structure, such as { "hash_map": { "0x87654321": 1,...}, "feature_matrix": [[54,0.4],[45,0],...After the conversion is completed, a data serialization check is performed, and the check process is: the generated JSON string is parsed back to the internal data structure, and then the original hash table key-value pairs, matrix row and column data, and the parsed data are compared item by item to determine whether they are completely consistent, for example, whether the value corresponding to the key "0x87654321" in the parsed hash mapping is still 1, and whether the first element of the matrix is still 54. If all data items are consistent, the check passes, and the finally output is the checked JSON format structured parameter set.

[0068] The classification feature discrimination module comprises:

[0069] The field similarity calculation submodule obtains the field naming parameter of the structured parameter set, compares the insertion, deletion, and replacement operation times character by character, counts the average number of characters in the field based on a sliding time window, and performs quotient operation on the operation times and the average number of characters in the field to generate a similarity value.

[0070] The classification feature discrimination module includes a field similarity calculation submodule. The submodule first acquires the field naming parameters in the structured parameter set output by the aforementioned structure encoding submodule, such as the field name list ["User_ID", "UserID", "UserName", "Creation_Timestamp", "CreatedTS"]. Then, for any two field naming parameters, such as "User_ID" and "UserID", character-by-character comparison is performed, and the minimum number of single-character editing operations (insertion, deletion, replacement) required to convert one string into another is recorded. For "User_ID" to "UserID", the operations are: delete "", insert "I", and replace "D" with "d" (assuming case sensitivity, if not, no replacement is needed). If compared in a case-insensitive manner, the operation is to delete "", and the operation number is 1. Based on a preset sliding time window, the window is set to collect field sample data sets in the last 30 days. For example, in the past 30 days, all field name samples collected are ["fieldA", "fieldB",..., "fieldZ"], a total of N fields. The average number of characters of these field names in the window is calculated by: adding the total number of all characters in the N field names, and then dividing by N. For example, if there are 100 field name samples in 30 days, the total number of characters is 850, and the average number of characters of the field is 850 / 100 = 8.5 characters. Then, the number of editing operations between the two field names calculated above, for example 1, is multiplied by the average number of characters of the field in the current sliding window, for example 8.5, to obtain the similarity correction value, i.e. similarity correction value = operation number / average number of characters of field = 1 / 8.5 ≈ 0.1176. Since a higher similarity value generally indicates greater similarity, and a smaller edit distance indicates greater similarity, the similarity value can be defined as 1-similarity correction value (if the correction value is limited to between 0 and 1) or more directly use the edit distance itself as a dissimilarity measure, or use other normalized similarity calculations based on edit distance, such as Levenshtein similarity = 1-(edit distance / MAX(string 1 length, string 2 length)), if "User_ID" is 7 characters long, "UserID" is 6 characters long, and the edit distance is 1, then the similarity value is 1-(1 / 7) ≈ 0.857. This similarity value is generated.

[0071] The character distribution deviation inspection submodule counts the frequency of occurrence of letter categories in the content feature parameters, divides the basic character categories according to the ISO / IEC 10646 standard, calculates the squared difference between the actual frequency of each category and the expected value of uniform distribution, using the formula:

[0072] ;

[0073] The calculation obtains the overall deviation of character distribution, compares the deviation with a preset benchmark value, and generates a character deviation index.

[0074] in, The index represents the deviation of the character. This represents the actual count of the i-th character class. Represents the theoretical expected value of the i-th character class. Represents special symbol weighting factors. There are 26 letter categories. For 10 predefined special symbol types, Represents the number of basic character categories, and The values ​​are the same. Represents the character category index. Represents a special character type index;

[0075] The classification feature discrimination module also includes a character distribution deviation detection submodule. This submodule first counts the frequency of letter categories in the content feature parameters corresponding to each field in the structured parameter set. Taking the field value "ClientName_New_Version_2024" as an example, its content feature parameters contain this text. Based on the ISO / IEC 10646 standard (Unicode) as a reference, the characters are divided into basic character categories, specifically referring to the 26 English letters (not case-sensitive). The frequency of each letter category in the text is then calculated. For example, in the text "ClientName_New_Version_2024", the letter 'c' appears once, 'l' once, 'i' twice, 'e' three times, 'n' three times, 't' once, 'a' once, 'm' once, 'w' once, 'v' once, 'r' once, 's' once, 'o' once, and other letters 0 times. The total number of letters in the text is 19. What is the expected value of the uniform distribution of each type of letter? The total number of letters is divided by the number of letter categories, i.e. Next, the formula is used. Perform the calculation, where, This represents the final calculated character deviation index. Representing the The actual frequency of each letter class (e.g., 'a', 'b', ..., 'z') in the current field content, for example... , , , Representing the The theoretical expected frequency of class letters under the assumption of uniform distribution, for all , In this example, the total number of letters is 19. ,so , This represents the number of basic character categories, specifically referring to the case-insensitive category for English letters. , It calculates the sum of squares of the differences between the actual frequency and the expected frequency of each letter, reflecting the degree of unevenness in the distribution of letters. For example, for the letter 'c', Calculate this value for all 26 letters and sum them. This is a measure of the frequency distribution in the form of the standard deviation, obtained by taking the square root of the sum of the squares mentioned above. Representing the Weighting factors for 10 predefined special symbol types ( The weights and their associated weights are set based on experience in indicating the degree of data structuring or sensitivity in specific business scenarios. For example, the underscore "_" is often used to connect words, and its weight factor can be set to 0.1; the hyphen "-" has a weight of 0.05; the appearance of numbers (considered as a special symbol type) has a weight of 0.2; and others such as "@", "#", etc. '(0.1),'%'(0.05),'number'(0.2), Is this Summing the weight factors of special symbols, for example , This involves taking the absolute value of the sum of the weighting factors. Since the weighting factors are usually set to positive values, this absolute value operation ensures that the result is positive. , This is an adjustment factor, whose value is the number of 26 letter categories, i.e. , This is a weighted adjustment term, calculated by dividing the total weight of special symbols by the number of letter categories, as a correction for the differences in letter distribution. The logic of this formula is to first quantify the deviation of the distribution of the main characters (letters in this case) in the field values ​​from a uniform distribution, and then combine this with the preset weights of the special symbols appearing in the field to comprehensively evaluate the deviation of the structured characteristics or specific patterns of the field content. The weighting factor for special symbols... The introduction of this formula allows for adjusting the contribution of different special symbols to the deviation index based on prior knowledge. The advantage of this formula lies in its ability to more precisely characterize the statistical properties of field content by comprehensively considering both the dispersion of letter distribution and the weighted influence of specific special symbols, rather than simply measuring character uniformity. We will demonstrate this with an example: Suppose that in the text “ClientName_New_Version_2024”, the letter frequency distribution… As mentioned above, , , then , special symbol weight factor and , therefore , Obtain the comprehensive deviation degree of this character distribution Compare this deviation degree with a preset reference value, which is set by referring to the average deviation degree value of historical similar asset data under this formula, and adjusted by expert experience, for example, by calculating 1000 classified "name" type fields, the average value of the value is 0.25, and the standard deviation is 0.05, the reference value can be set to the average value 0.25, or set to 0.25 according to the demand , if the current calculated is lower than the reference value 0.275, it is considered that the deviation degree is low, if it is higher, the deviation degree is high, after comparison, the character deviation index is generated, this index can be directly the value itself, or normalized, or graded according to the comparison result with the reference value (for example, lower than 0.1 is low deviation, 0.1 to 0.3 is medium deviation, higher than 0.3 is high deviation), here, the character deviation index is 0.15857, the result 0.15857 indicates that the character distribution of the current field "ClientName_New_Version_2024" deviates from the uniform distribution and the consideration of special symbols, and the deviation degree is 0.15857, this value will be used for subsequent classification decision, the numerical value itself is the generated character deviation index.

[0076] The classification label synthesis submodule establishes a Cartesian coordinate system, with the horizontal axis mapping the similarity value and the vertical axis mapping the character deviation index. A two-stage threshold setting method is used to divide the quadrant boundary. When the data point is below the threshold value of both axes, the classification label parameter is output.

[0077] The classification feature discrimination module further comprises a classification label synthesis submodule. The submodule first refers to a preset two-dimensional Cartesian coordinate system, sets the horizontal axis to map the similarity values generated by the field similarity calculation submodule, for example, the similarity value calculated for the field pair ("User ID", "User ID") is 0.857, and the horizontal axis is positioned at the position of 0.857. The vertical axis is set to map the character deviation index generated by the character distribution deviation inspection submodule, for example, the character deviation index calculated for the field "User ID" (assuming "UID123") is 0.15857 (here, the calculation result of the previous paragraph is reused for association, and the actual deviation index should be that of the content of "User ID" itself), and the vertical axis is positioned at the position of 0.15857, thereby obtaining a data point (0.857, 0.15857). Then, a two-stage threshold setting process is used to divide the quadrant boundary. In the first stage, based on the historical classified asset field data (for example, containing 10,000 field data manually labeled and classified), the 75th percentile value of the similarity value set and the character deviation index set is calculated, for example, the 75th percentile value of the historical similarity value is 0.80, and the 75th percentile value of the historical character deviation index is 0.20. These two values (0.80 and 0.20) are used as the initial horizontal axis threshold ( ) and vertical axis threshold ( ). In the second stage, according to the real-time inflow of new field data, the two initial thresholds are dynamically adjusted. The adjustment method allows a floating range of ±5% based on the initial threshold, for example, if the similarity value calculated in the current real-time data stream has a downward trend, the system monitors that the average similarity of the last batch of 100 new fields is 6% lower than the historical average, and the horizontal axis threshold can be adjusted downward, but not more than 5%, i.e., adjusted to , if the character deviation index has an average upward trend, the system monitors that the average deviation index of the last batch of new fields is 4% higher than the historical average, and the vertical axis threshold can be adjusted upward to , assuming that the dynamically adjusted two-axis thresholds currently applied are and When the abscissa value 0.857 of a data point (for example, (0.857, 0.15857)) is higher than the abscissa threshold 0.76, and the ordinate value 0.15857 is lower than the ordinate threshold 0.208 (here, the condition is "simultaneously lower than the double-axis threshold", if this is understood, then the high field similarity is considered "good", and the low deviation index is considered "good", so the similarity is higher than the threshold and the deviation is lower than the threshold, or if both are lower, they are both lower than the threshold, now according to the original "simultaneously lower than the double-axis threshold", it is assumed that the similarity is also lower, that is, the more dissimilar, the better, which is contrary to the usual understanding, here it is executed according to the literal meaning, if the similarity 0.857 is not lower than 0.76, it does not meet the condition, if the high similarity and low deviation are adjusted, then 0.857>0.76 and 0.15857<0.208 are judged to meet the condition, and a predefined classification label is output, for example "normal data"; if the original "simultaneously lower than the double-axis threshold" is 0.857<0.76 and 0.15857<0.208, in this example 0.857 is not less than 0.76, so it does not meet the condition, and another label is output, for example "data to be reviewed"), here we assume that "simultaneously lower than the double-axis threshold" means that the similarity value is lower than the abscissa threshold, and the character deviation index is lower than the ordinate threshold, so for the data point (0.857, 0.15857), since 0.857 is not less than 0.76, the condition is not met, and a specific classification label indicating that the data point is simultaneously lower than the double-axis threshold is not output, but a classification label corresponding to the quadrant (for example, high similarity, low deviation) is output according to the quadrant, such as "high similarity low deviation sensitive data candidate".

[0078] The sliding time window is set to the field sample data set of the last 30 days;

[0079] The two-stage threshold setting method first calculates the 75th percentile value as the initial threshold based on historical data, and then dynamically adjusts the ±5% floating range according to the real-time data flow.

[0080] The hierarchical weight calculation module includes:

[0081] The index weight analysis submodule receives the sensitivity index parameter, access frequency parameter and data volume parameter in the classification label parameter, performs sliding window standardization processing on the three types of parameters, calculates the dispersion degree and information entropy value of multiple parameter sample values, inversely deduces the weight distribution proportion according to the entropy value, and generates a weight coefficient set;

[0082] The hierarchical weight calculation module includes an index weight analysis submodule. The submodule first receives the sensitivity index parameter, the access frequency parameter, and the data volume parameter attached to or associated with the classification label parameter output by the aforementioned classification label synthesis submodule. For example, for an asset "customer contact information table" labeled as "high similarity low deviation sensitive data candidate", the sensitivity index parameter is calculated as 0.9 according to a preset rule (for example, if the content contains keywords such as "phone", "email", etc., the sensitivity is assigned as 0.9, if it contains "ID card", it is 1.0, and otherwise it is 0.1). The access frequency parameter is obtained by querying the access log system, for example, it has been accessed 150 times in the past month. The data volume parameter is obtained by querying the storage system metadata, for example, it is 15MB. For the three types of parameters (sensitivity 0.9, access frequency 150 times, data volume 15MB) and the three types of parameters of other assets in the historical sample, sliding window standardization processing is performed. The processing process is as follows: set a sliding window, for example, the last 100 processed asset samples. For each type of parameter (such as access frequency) in the window, calculate its minimum value and maximum value, and then use the formula to scale it to 0 to 1, for example, the minimum access frequency of the last 100 assets is 10 times, and the maximum is 500 times, so the standardized value of the current asset access frequency of 150 times is . Similarly, the sensitivity (assuming it is in the range of 0-1, it can be exempted from this step or adjusted as needed) and data volume (for example, the minimum is 1MB and the maximum is 200MB, so 15MB is standardized to ) are also processed to obtain a set of standardized parameter sample values, for example, {sensitivity_std: 0.9, access_frequency_std: 0.2857, dataVolume_std: 0.0704}. Then, based on these standardized multiple parameter sample values, the dispersion degree is calculated, for example, the variance or standard deviation of each parameter is calculated, and the information entropy value of these parameter sample values is calculated. The calculation process of information entropy is as follows: for a parameter (such as access_frequency_std), divide its value range in [0, 1] into several intervals, for example, 10 equal-width intervals [0, 0.1), [0.1, 0.2), …, [0.9, 1.0], and count the probability of the sample falling in each interval . Then the information entropy of the parameter is The smaller the information entropy value is, the more concentrated the parameter value is, the more certain the information provided is, and the lower the discrete degree is. Conversely, the higher the information entropy value is, the higher the uncertainty is. According to the information entropy values of the parameters (sensitivity, access frequency, and data volume) calculated, the weight distribution proportion is inversely deduced. The specific deduction process is as follows: the smaller the information entropy of a parameter is, the lower the uncertainty is, which indicates that the discrimination degree of the parameter is possibly not high or the data is relatively consistent. Therefore, the parameter can be assigned a relatively low weight in weight distribution. Conversely, the larger the information entropy of a parameter is, the higher the uncertainty is, which indicates that the parameter contains more information and the discrimination degree is possibly higher. Therefore, the parameter can be assigned a relatively high weight. A commonly used method is to let the weight wherein is the information entropy of the jth parameter. If the information entropy of the sensitivity, access frequency, and data volume calculated is respectively, the sum of the corresponding is 1.5, and thus the weights are These weights constitute the weight coefficient set {sensitivity weight: 0.333, access frequency weight: 0.133, data volume weight: 0.533}, and the weight coefficient set is generated.

[0083] The parameter synthesis submodule calls the sensitivity weight coefficient, access frequency weight coefficient, and data volume weight coefficient in the weight coefficient set, establishes a three-level weighted accumulation mechanism, performs scalar multiplication of the original value of the sensitivity index and the corresponding weight, superimposes the weighted value of the access frequency and the weighted value of the data volume, and performs arithmetic accumulation operation on the three weighted results to generate a hierarchical level parameter.

[0084] ​​​​The hierarchical weight calculation module further includes a parameter synthesis submodule, which calls the weight coefficient set generated by the aforementioned index weight analysis submodule, such as {sensitivity weight: 0.333, access frequency weight: 0.133, data volume weight: 0.533}, and the corresponding original non-standardized but possibly preliminary quantized parameter values, such as the sensitivity index original value of asset A being 0.9 (assuming this is a score of 0 to 1), the access frequency index original value being 150 (actual access frequency), and the data volume index original value being 15 (unit MB, which may need to be converted into a value comparable to other assets or hierarchical, such as less than 1 MB being 1, 1-10 MB being 2, 10-50 MB being 3, so 15 MB corresponds to level 3), for simplicity, we assume that the access frequency and data volume have also been converted into scores in the range of 0-1, such as access frequency score 0.6 and data volume score 0.4, a three-level weighted accumulation mechanism is established, the specific execution process is: first, the sensitivity index original value (0.9) is multiplied by the corresponding sensitivity weight coefficient (0.333) to obtain the sensitivity weighted value = Second, the access frequency index original value (assuming it has been converted to a score of 0.6) is multiplied by the corresponding access frequency weight coefficient (0.133) to obtain the access frequency weighted value = Third, the data volume index original value (assuming it has been converted to a score of 0.4) is multiplied by the corresponding data volume weight coefficient (0.533) to obtain the data volume weighted value = Finally, the arithmetic accumulation operation of the three weighted results is performed, that is, the original accumulation value of the final hierarchical level parameter = sensitivity weighted value + access frequency weighted value + data volume weighted value = After the original accumulation value is subjected to subsequent threshold judgment or binning operation, the final hierarchical level parameter is generated, for example, if the level threshold is set as: [0-0.3) is level 1, [0.3-0.6) is level 2, [0.6-1.0] is level 3, then 0.5927 belongs to level 2, generating the hierarchical level parameter "level 2".

[0085] The data synchronization submodule constructs a level encoding sequence based on the hierarchical level parameter, extracts the timestamp field and operation type encoding in the access event parameter, aligns the timestamp using the NTP protocol, aligns the timestamp and performs data format conversion on the encoding sequence and event field, calls the data encapsulation protocol, and outputs the synchronization data stream.

[0086] The hierarchical weight calculation module further includes a data synchronization submodule that, based on the hierarchical level parameters generated by the aforementioned parameter synthesis submodule, for example, "Level 2" obtained by asset A, constructs a level coding sequence for the asset, for example, directly using the level number "2" or converting it into a more complex coding such as "L2_Normal", then extracts the timestamp field and operation type coding from real-time access event parameters, for example, an access event record { "user": "user01", "asset_id": "AssetA", "operation": "READ", "timestamp": "2025-05-27T10:30:05.123Z", "ip_address": "192.168.1.50"}, extracts the timestamp "2025-05-27T10:30:05.123Z" and operation type coding "READ" (which may be internally mapped to the number 1) from it, then uses a Network Time Protocol (NTP) client to communicate with a preset NTP server (such as time.nist.gov) to obtain standard time, calibrate the local clock of the system to ensure the accuracy of the extracted access event timestamp, or align the timestamps from different sources at the data aggregation end, associate and combine the aforementioned constructed level coding sequence ("L2_Normal" or "2") with the relevant fields in the access event (such as asset ID "AssetA", operation type "READ", calibrated timestamp "2025-05-27T10:30:05.123Z"), and perform necessary data format conversion, for example, converting all this information into a specific format required by the target data warehouse or downstream policy execution system, such as ProtocolBuffers or Avro serialization format, finally, execute a predefined data encapsulation protocol call, which is to package the converted data into a data packet that conforms to a specific communication protocol (such as HTTPS POST request body or Kafka message body), and send it to the specified receiving endpoint (for example, a central audit log service or an API interface of a dynamic permission decision engine), outputting this encapsulated, level coding and aligned event information synchronization data stream.

[0087] The dynamic permission adaptation module includes:

[0088] The role permission matching submodule loads the role identifier in the user role parameter and the permission entry, calls the level threshold in the hierarchical level parameter, constructs a role-level two-dimensional matrix with constraints, calculates the intersection coverage of the role permission entry and the level demand threshold, performs Boolean operation on the matrix units to mark the effective permission area, and generates a permission matching matrix;

[0089] The permission dynamic adaptation module includes a role permission matching submodule. The submodule first loads user role parameters, which are usually stored in a user management system. For example, the role identifier of the role "financial manager" is "FIN MGR", and the associated permission entry list is ["view financial report", "approve expenditure less than 10000 yuan", "generate monthly summary"]. At the same time, the level threshold in the hierarchical level parameter generated by the aforementioned hierarchical weight calculation module is called. For example, the system defines the correspondence between asset levels and operation permissions. Level 1 assets allow "reading", level 2 assets allow "reading" and "modifying summary", and level 3 assets allow "reading", "modifying summary", and "deleting". These constitute the level requirement threshold. Then, a role-level two-dimensional matrix with constraints is constructed. The rows of the matrix represent user roles (such as "FIN MGR"), and the columns represent the asset or operation levels that can be reached by the asset (such as level 1, level 2, and level 3). The constraints come from the highest asset level or specific operation type that the role itself is allowed to operate in the role definition. For example, the "FIN MGR" role is set to operate on assets up to level 2. For a specific asset X, the level calculated by the aforementioned module is level 2. Now the permission of "FIN MGR" to execute the "approve expenditure less than 10000 yuan" operation on asset X needs to be determined. First, calculate the intersection coverage rate between the role permission entry ("approve expenditure less than 10000 yuan") and the requirement threshold (allow "reading" and "modifying summary") corresponding to the level 2 of asset X. The calculation process is as follows: check whether the specific permission entry of the role is included in the set of operations allowed by the asset level, or whether it meets the requirements of the specific operation on the asset level. For example, the "approve expenditure less than 10000 yuan" operation itself may be pre-set to at least require level 2 assets to be executed. If asset X is level 2 and the permission entry list of role "FIN MGR" includes "approve expenditure less than 10000 yuan", and the minimum asset level required by the operation is not higher than 2, it is considered that the permission entry and the level requirement threshold match, and the intersection coverage rate is 100% (or Boolean true). If they do not match, the intersection coverage rate is 0% (or Boolean false). Then, perform a Boolean operation on the corresponding cell ("FIN MGR", level 2 of asset X) in the role-level two-dimensional matrix. If all constraints (role itself permission, operation level requirement, and actual asset level) are met, mark it as valid permission (e.g., True or 1). Otherwise, mark it as invalid (False or 0). For example, for role "FIN MGR" and asset X (level 2), if the "approve expenditure less than 10000 yuan" operation is defined as requiring level 2 assets, and the role has this permission, the corresponding cell in the matrix is marked as True. By performing this process for all roles and all possible asset levels (or specific assets), a complete permission matching matrix is generated.

[0090] Table 1 shows an example of a permission matching matrix fragment

[0091]

[0092] As shown in Table 1, the table lists the permission matching results of some roles on specific operations under different asset levels, where True means having permission and False means no permission.

[0093] The path verification submodule inputs the path node sequence in the access event parameter based on the node connection relationship of the resource topology graph, traverses the adjacent nodes using the improved Dijkstra shortest path algorithm, calculates the shortest hop number and the cumulative weight value from the starting node to the target node, compares the actual path hop number with the difference value of the theoretical optimal path, and generates a path verification coefficient.

[0094] The permission dynamic adaptation module further comprises a path verification submodule. Based on a pre-constructed or dynamically perceived resource topology graph describing logical or physical connection paths among data resources, services, users, and devices, for example, node A (a user terminal) is connected to node B (an application server), and node B is connected to node C (a database server), the path verification submodule inputs a path node sequence contained in an access event parameter, for example, a user attempts to access a path of “ / app / service1 / data / resourceZ” (the path can be mapped to a series of logical nodes P1->P2->P3) from a device (node U) with an IP of 192.168.1.10 (node U), the path sequence is U->P1->P2->P3, and then an improved graph traversal process is adopted. The process starts from the starting node (U) of the path sequence, traverses its adjacent nodes, and expands to the target node (P3) layer by layer, while recording the weight of each edge (for example, network delay, security level jump cost, etc.), and setting a maximum traversal hop threshold of 7-layer network topology, that is, if the shortest path from the starting node to the target node exceeds 7 intermediate nodes (hops), the path is considered too long or unreachable. In the traversal process, the shortest cumulative weight value path from the starting node (U) to the target node (P3) and the hop count of the path are calculated, for example, the shortest path from U to P3 is U->N1->N2->P3, the cumulative weight value is 15 (for example, the total delay is 15 ms), and the hop count is 3 hops, and then the actual path hop count (for example, the physical or logical hop count of the gateway, proxy, etc. actually requested by the user, assuming 4 hops, U->G1->P1->P2->P3) in the access event is compared with the theoretically optimal path hop count (3 hops) calculated, and the difference between the two is calculated, that is, the path hop count difference = actual hop count - theoretical optimal hop count = 4-3 = 1 hop. The difference is part of the path verification coefficient, or the path verification coefficient can be directly the difference, or a comprehensive score based on the difference and the cumulative weight value, for example, the path verification coefficient can also be (1+difference / theoretical hop count), and the value closer to 1 is better. The path verification coefficient is generated, for example, 1 (hop difference).

[0095] The policy generation submodule fuses the valid permission marks in the permission matching matrix and the difference parameters in the path verification coefficient, constructs a policy decision tree based on the C4.5 algorithm, maps the condition nodes to permission policy items, performs ACL item encoding and writing operations, and generates dynamic permission policy parameters.

[0096] The permission dynamic adaptation module further comprises a policy generation submodule, which fuses the difference parameters in the valid permission marks (for example, for user role R and target resource O, the permission matching matrix shows True) in the permission matching matrix generated by the aforementioned role permission matching submodule and the path verification coefficients generated by the aforementioned path verification submodule (for example, the path hop difference is 1), constructs a policy decision tree based on a decision tree construction process (the core idea is similar to C4.5, but not directly calling its name, but describing its steps: selecting the attribute with the highest information gain or gain rate as the split node, recursively constructing the sub-tree), which is: taking the permission matching result (True / False) and the path verification difference (for example, ≤2 hops, >2 hops) as candidate split attributes, calculating the information gain of each attribute for the decision target “whether to authorize”, selecting the optimal attribute for tree node splitting, for example, the root node is first split based on “whether the valid permission mark in the permission matching matrix is True”, if True, then continue to use “whether the path verification difference is ≤2 hops” as the next split condition, if the permission matching degree (which can be understood as the confidence of the relevant entries in the permission matching matrix or a direct Boolean value) ≥80% (for Boolean True, it is 100%, which meets the condition) and the path verification difference ≤2 hops (for example, the calculated difference is 1 hop, which meets the condition), the decision path leads to the “authorization” leaf node, otherwise, it leads to the “refusal” or other refined processing nodes, mapping these condition nodes (such as “permission matching result=True”, “path verification difference≤2”) and their branch logic in the decision tree to specific permission policy entries, for example, generating a policy rule: “IF(RolePermissionMatch==True AND PathValidationDifference<=2) THEN GrantAccess”, then, performing access control list (ACL) entry coding on these generated policy entries, that is, converting abstract policy rules into specific ACL formats that can be recognized by target systems (such as firewalls, operating systems, databases), for example, converting into an ACL rule containing source IP, target IP, target port, protocol, user identity, operation permission / rejection, and performing write operation of the ACL entry, that is, applying the coded ACL rule to the corresponding policy enforcement point (PEP), for example, updating the access control policy library of the network device through API call or modifying the permission settings of the file system, finally generating dynamic permission policy parameters containing these specific ACL rules or abstract policy definitions for real-time access control decision.

[0097] The improved Dijkstra shortest path algorithm sets the maximum hop threshold to 7-layer network topology.

[0098] The branch condition setting of the policy decision tree includes that the permission matching degree is greater than or equal to 80% and the path verification difference is less than or equal to 2 hop numbers.

[0099] The above is only the preferred embodiment of the present application, and does not limit the present application in other forms. Any person skilled in the art can use the disclosed technical content to make changes or modifications into equivalent embodiments applied to other fields, but as long as it does not deviate from the technical solution content of the present application, any simple modification, equivalent change and modification made to the above embodiments according to the technical essence of the present application still belongs to the protection scope of the technical solution of the present application.

Claims

1. A data asset classification grading and dynamic management system, characterized in that, The system comprises: An asset parameter acquisition module is configured to acquire metadata field parameters and file path parameters through a distributed crawler, to cooperatively operate a regular expression matching algorithm and a load balancing mechanism of a distributed crawler node cluster, to generate a structured parameter set, and to transmit the structured parameter set to a classification feature discrimination module; The classification feature discrimination module is configured to receive the structured parameter set, to call a Levenshtein distance algorithm to perform field naming parameter comparison, to detect content feature parameter character distribution using an improved chi-square test method, to generate a classification label parameter, and to transmit the classification label parameter to a hierarchical weight calculation module; The hierarchical weight calculation module is configured to receive the classification label parameter, to calculate weight coefficients of a sensitivity index parameter, an access frequency parameter, and a data volume parameter through an improved entropy weight method, to perform linear superposition to generate a hierarchical level parameter, and to synchronously transmit the hierarchical level parameter to a permission dynamic adaptation module together with an access event parameter; The permission dynamic adaptation module is configured to perform permission matrix matching of the hierarchical level parameter and a user role parameter through an improved RBAC model, to combine a Dijkstra shortest path algorithm and a resource topology verification mechanism, to generate a dynamic permission strategy parameter, and to write the dynamic permission strategy parameter into an access control list; The structured parameter set specifically refers to a field naming structure, a content feature matrix, and a metadata index atlas, the classification label parameter includes a semantic similarity index, a character distribution feature, and a field type identifier, the hierarchical level parameter specifically refers to a sensitivity weight coefficient, an access frequency weight, a data volume weight, and a comprehensive level value, and the dynamic permission strategy parameter includes a role permission matrix, a resource topology verification result, an access path whitelist, and a strategy effective timestamp; The regular expression matching algorithm matches the throughput of the distributed crawler by dynamically adjusting the size of a thread pool; The improved entropy weight method includes a range standardization processing step, and a calculation formula thereof is: ； wherein, a standardized value of the jth parameter representing the ith sample, and respectively represent a minimum value and a maximum value of the jth parameter. The linear superposition includes an outlier truncation processing mechanism, and when a weighted cumulative value exceeds a preset threshold, a normalization operation is performed; The improved RBAC model reduces the space-time complexity of a role-permission mapping relationship by 42% by introducing a hierarchical level threshold constraint; An edge weight in the Dijkstra shortest path algorithm is defined as a weighted value of network delay and security level.

2. The data asset classification, grading and permission dynamic management system according to claim 1, characterized in that, The asset parameter acquisition module comprises: A data acquisition sub-module is configured to deploy a distributed crawler node cluster, to establish a multithreaded task allocation mechanism, to send concurrent requests to a target data source, to capture metadata field texts and file path strings in response data, to identify a plurality of character encoding formats through an adaptive encoding detection interface, to match special symbols or garbled characters using a regular expression, to perform a null record filtering operation, and to generate a metadata feature stream; A feature extraction sub-module is configured to load a regular expression matching algorithm based on the metadata feature stream, to extract an alphanumeric combination sequence in a field naming rule using a named capture group, to calculate a continuity index of a field naming structure, to define the continuity index as a percentage of continuous letter and number character length over total field length, to separate special symbol occurrence frequency and numerical interval span in a content feature rule, and to generate a field identifier and a content feature value; The structural coding submodule calls the field identifier to construct a hash index mapping table, generates a hash key value using a CRC32 check algorithm, generates a feature weight matrix according to the content feature value, converts the hash table key value pair and the matrix row and column data into a nested hierarchical structure through a JSON encoder, performs data serialization check, and outputs a structured parameter set. 3.The data asset classification, grading and permission dynamic management system according to claim 2, characterized in that, The classification feature discrimination module comprises: The field similarity calculation submodule obtains the field naming parameter of the structured parameter set, compares the number of insertion, deletion and replacement operations character by character, counts the average number of characters in the field based on a sliding time window, performs quotient operation on the number of operations and the average number of characters in the field, and generates a similarity value; The character distribution deviation inspection submodule counts the occurrence frequency of letter categories in the content feature parameter, divides the basic character categories according to the ISO / IEC10646 standard, calculates the squared difference between the actual frequency of each category and the expected value of uniform distribution, and obtains the comprehensive deviation degree of character distribution by using the formula: ； The operation compares the deviation degree with a preset reference value to generate a character deviation index; wherein, representing a character deviation index, representing an actual count of the i-th character class, representing a theoretical expected value of the i-th character class, representing a special symbol weight factor, is the number of 26 letter classes, is the number of 10 predefined special symbol types, representing the number of base character classes, and has the same value as representing a character class index, representing a special character type index; The classification label synthesis submodule maps the similarity value on the horizontal axis and the character deviation index on the vertical axis of the Cartesian coordinate system, divides the quadrant boundary by using a two-stage threshold setting method, and outputs a classification label parameter when the data point is below the threshold value of both axes.

4. The data asset classification, grading and permission dynamic management system according to claim 3, characterized in that, The sliding time window is set to the field sample data set of the latest 30 days; The two-stage threshold setting method first calculates the 75th percentile value as the initial threshold value based on historical data, and then dynamically adjusts the ±5% floating range according to real-time data flow.

5. The data asset classification, grading and permission dynamic management system according to claim 4, characterized in that, The hierarchical weight calculation module comprises: The index weight analysis submodule receives the sensitivity index parameter, access frequency parameter and data volume parameter in the classification label parameter, performs sliding window standardization processing on the three types of parameters, calculates the dispersion degree and information entropy value of a plurality of parameter sample values, inversely deduces the weight distribution ratio according to the entropy value, and generates a weight coefficient set; The parameter synthesis submodule calls the sensitivity weight coefficient, access frequency weight coefficient and data volume weight coefficient in the weight coefficient set, establishes a three-level weighted accumulation mechanism, performs scalar multiplication on the sensitivity index original value and the corresponding weight, superimposes the access frequency weighted value and the data volume weighted value, and performs arithmetic accumulation operation on the weighted results three times to generate a hierarchical level parameter; The data synchronization submodule constructs a level coding sequence based on the hierarchical level parameter, extracts the timestamp field and operation type code in the access event parameter, aligns the timestamp using the NTP protocol, performs timestamp alignment and data format conversion on the coding sequence and event field, calls a data encapsulation protocol, and outputs a synchronous data stream.

6. The data asset classification, grading and permission dynamic management system according to claim 5, characterized in that, The permission dynamic adaptation module comprises: The role permission matching submodule loads the role identifier and permission entry in the user role parameter, calls the level threshold in the hierarchical level parameter, constructs a role-level two-dimensional matrix with constraint conditions, calculates the intersection coverage rate of the role permission entry and the level demand threshold, performs Boolean operation marking on the effective permission area of the matrix unit, and generates a permission matching matrix; The path verification submodule inputs the path node sequence in the access event parameter based on the node connection relationship of the resource topology graph, adopts the improved Dijkstra shortest path algorithm to traverse the adjacent nodes, calculates the shortest hop count and the cumulative weight value from the starting node to the target node, compares the actual path hop count with the difference value of the theoretical optimal path, and generates a path verification coefficient; The policy generation submodule fuses the effective permission markers in the permission matching matrix and the difference parameters in the path verification coefficient, constructs a policy decision tree based on the C4.5 algorithm, maps the condition nodes to permission policy items, performs ACL item encoding and writing operations, and generates dynamic permission policy parameters.

7. The data asset classification hierarchy and permissions dynamic management system of claim 6, wherein, The improved Dijkstra shortest path algorithm sets the maximum hop count threshold to 7-layer network topology; The branch condition setting of the policy decision tree includes permission matching degree ≥ 80% and path verification difference ≤ 2 hop counts.

Images