Processing method and system for data governance

Abstract

The invention is suitable for the technical field of data governance, and particularly relates to a data governance processing method and system, and the method comprises the steps: receiving an access request uploaded to an intranet by a user, recognizing a risk level, accessing a buffer region into the intranet, and configuring a plurality of virtual containers in the buffer region, obtaining at least a first container, a second container and a root container; and when the risk level of the access request is greater than a threshold value, importing the access request into a first container, analyzing and positioning a target address corresponding to the access request, and carrying out random disturbance processing to obtain a plurality of pseudo addresses. According to the invention, by identifying the risk features, defense can be carried out in advance, potential attack behaviors can be found and blocked in time, the probability of occurrence of security events is reduced, the processing efficiency and security of data management are greatly improved, and safe, reliable and smooth connection of data exchange between the internal network and the external network is ensured.

Description

Technical Field

[0001] This invention relates to the field of data governance technology, and in particular to a data governance processing method and system. Background Technology

[0002] Data governance refers to the management rules established within an enterprise or organization to ensure data quality. It includes the standardized management of all aspects of data collection, storage, processing, sharing, and use.

[0003] Data governance is particularly important during data interaction between the intranet and the extranet. Data may face various risks when transmitted across networks, such as unauthorized data access, leakage of sensitive information, or virus intrusion. Strict control and detection of data flow between the intranet and the extranet can reduce potential security risks and ensure the security and reliability of enterprise data assets.

[0004] Therefore, "how to detect and induce access requests" is the technical problem that this invention needs to solve. Summary of the Invention

[0005] The purpose of this invention is to provide a data governance processing method and system to solve the problem of "how to detect and guide access requests" mentioned in the background art.

[0006] To achieve the above objectives, the present invention provides the following technical solution: A data governance processing method, the method comprising: Receive user access requests uploaded to the intranet, identify the risk level, access the buffer in the intranet, and configure several virtual containers in the buffer, obtaining at least a first container, a second container, and a root container; When the risk level of the access request is greater than the threshold, the access request is imported into the first container, the target address corresponding to the access request is parsed and located, and random perturbation is performed to obtain several pseudo addresses, wherein the pseudo addresses include at least: a first pseudo address and a second pseudo address. The pseudo addresses are written into the corresponding virtual container and an identification field is embedded. Select a hash function, hash the first pseudo address to generate a first hash value, and insert it into the second pseudo address. Hash the second pseudo address to obtain a second hash value, and write it into the third pseudo address. Continue in this manner until the nth pseudo address is obtained. Calculate the number of hashes and establish the correspondence between the number of hashes and the risk level. The access request is processed sequentially using all the virtual containers, and after obtaining the processing results, all the virtual containers are initialized. If the processing result contains risk characteristics, the access request is marked as a malicious request and a pre-built security alert rule is triggered. If not, the access request is traced back through the hash value and the identifier field. The access request and the target address are imported into the root container to determine the real result and identify the type of the real result. A handling rule corresponding to the type is created, the processing result is packaged, and sent back to the intranet.

[0007] Furthermore, the steps of receiving user access requests uploaded to the intranet, identifying risk levels, accessing a buffer in the intranet, and configuring several virtual containers in the buffer include: When the risk level is greater than the threshold, the corresponding access request is defined as a sensitive request; From the virtual containers, select high-risk containers and connect the sensitive requests to the high-risk containers.

[0008] Furthermore, the step of receiving access requests uploaded by users to the intranet and identifying the risk level includes: Construct a behavior detection mechanism for access requests to obtain behavior trajectories, wherein the behavior trajectories include at least: access frequency, instruction pattern, and data packet characteristics; A risk database is constructed, which consists of behavioral trajectory items and risk level items. The risk level is dynamically adjusted using the risk database.

[0009] Furthermore, the step of importing the access request into the first container when the risk level of the access request is greater than the threshold includes: Establish a one-to-one correspondence between hash counts and risk levels; Collect attribute data of access requests, wherein the attribute data includes at least: IP, type and risk level, and adjust the number of hashes based on the attribute data and behavioral patterns.

[0010] Furthermore, the step of sequentially processing the access request using all virtual containers and initializing all virtual containers after obtaining the processing result includes: Record all hash values ​​corresponding to each access request, establish a mapping between hash values ​​and virtual containers, and integrate them to generate a verification set; The verification set is sent to the root container, and the verification mechanism is embedded.

[0011] Furthermore, the steps of creating processing rules that correspond one-to-one with the type, packaging the processing results, and sending them back to the intranet include: Identify the target end of the processing results and set the priority for each target end; Once the data return is complete, a security log is generated and sent to the preset terminal.

[0012] Furthermore, the method also includes: The source terminal of each access request is determined based on the attribute data. Based on the security logs and processing results, risk profiles are drawn, with each source terminal corresponding to a risk profile.

[0013] Furthermore, the system includes: The receiving module is used to receive access requests uploaded by users to the intranet, identify the risk level, access the buffer in the intranet, and configure several virtual containers in the buffer, at least obtaining a first container, a second container and a root container; The embedding module is used to import the access request into a first container when the risk level of the access request is greater than a threshold, parse and locate the target address corresponding to the access request, and perform random perturbation processing to obtain several pseudo addresses, wherein the pseudo addresses include at least: a first pseudo address and a second pseudo address, write the pseudo addresses into the corresponding virtual container, and embed an identifier field. An initialization module is used to select a hash function, hash the first pseudo address to generate a first hash value, and insert it into the second pseudo address. The second pseudo address is then hashed to obtain a second hash value, which is written into the third pseudo address, and so on, until the nth pseudo address is obtained. The number of hashes is calculated, and a correspondence between the number of hashes and the risk level is established. All virtual containers are used sequentially to process the access request, and after obtaining the processing result, all virtual containers are initialized. The feedback module is used to determine whether there are risk characteristics in the processing result. If so, the access request is marked as a malicious request and a pre-built security alarm rule is triggered. If not, the access request is traced back through the hash value and the identifier field. The access request and the target address are imported into the root container to determine the real result, identify the type of the real result, create a one-to-one corresponding handling rule for the type, package the processing result, and send it back to the intranet.

[0014] Furthermore, the receiving module includes: A definition unit is used to define the corresponding access request as a sensitive request when the risk level is greater than the threshold. An access unit is used to select high-risk containers from the virtual containers and access the sensitive request to the high-risk containers; The acquisition unit is used to construct a behavior detection mechanism for access requests and acquire behavior trajectories, wherein the behavior trajectories include at least: access frequency, instruction pattern, and data packet characteristics. An adjustment unit is used to construct a risk database, wherein the risk database consists of behavioral trajectory items and risk level items, and the risk level is dynamically adjusted using the risk database.

[0015] Furthermore, the embedding module includes: Establish a unit to create a one-to-one correspondence between hash counts and risk levels; A hash unit is used to collect attribute data of access requests, wherein the attribute data includes at least: IP, type and risk level, and the number of hashes is adjusted based on the attribute data and behavioral patterns.

[0016] Compared with the prior art, the beneficial effects of the present invention are: This invention creates a buffer zone to isolate core areas, reducing the risk of direct attacks or lateral spread to the internal network. It also enables threat detection and analysis. Deploying virtual containers within the buffer zone further enhances isolation, allowing suspicious requests to be executed and their behavior monitored, facilitating the detection of unknown threats. Connecting access requests to different numbers of virtual containers enables cross-validation, further improving data processing security. Generating pseudo-addresses hides the real topology and reduces the attack surface, preventing sensitive information leakage. It also traps malicious requests, facilitating analysis, delaying attacks, and collecting threat intelligence. Hashting the pseudo-addresses ensures their evolution is irreversible and unforgeable, allowing for a complete reconstruction of the access request processing chain, meeting auditing and forensic requirements, and significantly improving data processing security. Initialization via virtual containers prevents sensitive information leakage and ensures the independence of each access request's verification environment. Identifying risk characteristics enables proactive defense, timely detection and blocking of potential attacks, reducing the probability of security incidents, and greatly improving the efficiency and security of data governance. It also ensures secure, reliable, and seamless data exchange between internal and external networks. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention.

[0018] Figure 1 A flowchart illustrating the data governance processing method provided in this embodiment of the invention.

[0019] Figure 2 This is a first sub-flowchart of the data governance processing method provided in an embodiment of the present invention.

[0020] Figure 3This is a second sub-flowchart of the data governance processing method provided in an embodiment of the present invention.

[0021] Figure 4 The third sub-flowchart of the data governance processing method provided in the embodiments of the present invention.

[0022] Figure 5 The fourth sub-flowchart of the data governance processing method provided in the embodiments of the present invention.

[0023] Figure 6 This is a block diagram of the data governance processing system provided in an embodiment of the present invention.

[0024] Figure 7 This is a block diagram of the receiving module in the data governance processing system provided in an embodiment of the present invention.

[0025] Figure 8 This is a block diagram of the components of the embedded module in the data governance processing system provided in the embodiments of the present invention.

[0026] Figure 9 This is a block diagram of the initialization module in the data governance processing system provided in this embodiment of the invention.

[0027] Figure 10 This is a block diagram of the initialization module in the data governance processing system provided in this embodiment of the invention. Detailed Implementation

[0028] In Example 1, Figure 1 The implementation flow of the data governance processing method provided in this embodiment of the invention is illustrated below, and will be described in detail below: S100: Receives access requests uploaded by users to the intranet, identifies the risk level, accesses a buffer in the intranet, and configures several virtual containers in the buffer, obtaining at least a first container, a second container, and a root container.

[0029] The system receives and identifies access requests uploaded to the intranet by users. Based on the source, frequency, and parameters of the access requests, it determines the corresponding risk level. The specific method for determining the risk level can be as follows: assign a risk value to the source, frequency, etc., sum the risk values ​​of each access request, and then divide the sum into several intervals, each interval corresponding to a risk level. A buffer is created between the intranet and the extranet, and access requests are imported into this buffer. The buffer is a security isolation layer, referring to a secure isolation and relay environment between the intranet and the extranet. Its main function is to temporarily store, process, and isolate external access requests. Several virtual containers are deployed within the buffer. Virtual containers are logically isolated processing units; they are neither physical servers nor traditional application containers, but rather virtualized environment units that make up the buffer. Each virtual container runs independently. The buffer consists of at least a first container, a second container, and a root container, with all virtual containers arranged in a chain, i.e., the first container is followed by the second container, and the root container is connected to the end of all virtual containers.

[0030] S200: When the risk level of the access request is greater than the threshold, the access request is imported into the first container, the target address corresponding to the access request is parsed and located, and random perturbation processing is performed to obtain several pseudo addresses, wherein the pseudo addresses include at least: a first pseudo address and a second pseudo address, the pseudo addresses are written into the corresponding virtual container, and an identification field is embedded.

[0031] If the risk level of an access request exceeds a threshold, the request is transferred to the first container and fully analyzed to determine the specific source information, access parameters, and target resources. Random perturbation is applied to the target address, generating several pseudo-addresses. This random perturbation refers to fine-tuning the access path, request parameters, and access time. A pseudo-address is assigned to each virtual container and inserted into it. The access request is processed sequentially using the pseudo-addresses in each virtual container (using the corresponding program or terminal to perform risk detection). Each virtual container performs specific operations based on the pseudo-address, such as simulated access, data verification, hash calculation, or security analysis. Throughout the process, virtual containers maintain logical isolation, and processing operations are tracked and correlated through embedded identifier fields to ensure accurate tracing of the access request's source and processing trajectory. This achieves secure isolation, effective verification, and dynamic protection for high-risk requests. Each pseudo-address corresponds to a point (program or terminal, etc.) for anomaly detection. Anomaly detection is performed on the access request through this point to determine if suspicious behavior exists.

[0032] S300: Select a hash function, hash the first pseudo address to generate a first hash value, and insert it into the second pseudo address. Hash the second pseudo address to obtain a second hash value, and write it into the third pseudo address. Continue in this manner until the nth pseudo address is obtained. Calculate the number of hashes, establish the correspondence between the number of hashes and the risk level, process the access request using all virtual containers in sequence, and initialize all virtual containers after obtaining the processing results.

[0033] In addition to using identifier fields to record and associate the verification process, hashing can be used to enhance the association. A hash function (SHA-256, SHA-1, etc.) is selected to hash the first pseudo-address, and the resulting hash value is defined as the first hash value. This first hash value is then written into the second pseudo-address. The hash function is then used to hash the new second pseudo-address to obtain the second hash value, which is then written into the third pseudo-address, and so on. A chained tagging method is used to adjust all pseudo-addresses. The advantage of this is that by verifying the authenticity of the nth pseudo-address, it can be determined whether the access request has passed the verification of all virtual containers. It also prevents pseudo-addresses from being tampered with, ensuring the verification process is genuine and reliable.

[0034] In this application, if the risk level of the access request is high, more hashing is performed, and more virtual containers are used to process and detect the access request; if the risk level is low, fewer processing and detection operations are performed.

[0035] Record the number of hashes and establish a correspondence between the number of hashes and the risk level of the access request. This ensures that high-risk requests are associated with more hashes. Each virtual container performs independent parsing, verification, perturbation, and security analysis operations on the access request through its internally configured pseudo-address to determine whether risk characteristics exist. After determining the judgment result, initialize each virtual container, clear temporary data, reset pseudo-address and identification fields, and restore the processing environment.

[0036] S400: Determine whether there are risk characteristics in the processing result. If so, mark the access request as a malicious request and trigger the pre-built security alarm rule. If not, trace back the access request through the hash value and the identifier field, import the access request and the target address into the root container, determine the real result, identify the type of the real result, create a one-to-one corresponding handling rule for the type, package the processing result, and send it back to the intranet.

[0037] The system determines whether the processing result contains risk characteristics. If so, the corresponding access request is marked as malicious and a security alert rule is triggered. This rule includes: real-time notification to the security management platform, recording detailed event logs, isolating related virtual containers, and blocking further propagation of suspicious requests. If the processing result does not contain risk characteristics, the access request is traced back using pre-embedded hash values ​​and identifier fields. The access request and its corresponding target address are imported into the root container within the buffer. In the root container, the access request is further parsed to determine the true result. The true result refers to "the result obtained by processing the access request using the real access address (target address)." Define the type of the actual result, such as different categories like data access, query operation, control command, or log recording. Access requests can also be categorized based on the type of data to be written to the intranet (video, image, text, etc.). Create a corresponding handling rule for each type, including data distribution, alarm triggering, log recording, and policy execution. The root container packages the processing results, ensuring the data format conforms to intranet reception specifications, embeds necessary security identifiers and tracking information, and sends the access request back to the intranet. For example, if an access request contains video data, the handling rule for the video type is: store the video data in a cloud drive, and only send the video's sharing link back to the intranet.

[0038] In Example 2, Figure 2 The implementation flow of the data governance processing method provided by an embodiment of the present invention is illustrated. The following details the steps of receiving access requests uploaded by users to the intranet, identifying the risk level, accessing a buffer in the intranet, and configuring several virtual containers in the buffer: S101: When the risk level is greater than the threshold, the corresponding access request is defined as a sensitive request.

[0039] If the risk level of an access request exceeds the threshold, the corresponding access request will be defined as a sensitive request.

[0040] S102: Select a high-risk container from the virtual containers and connect the sensitive request to the high-risk container.

[0041] High-risk containers are identified and selected from the virtual containers. These high-risk containers are specifically designed to handle sensitive requests and have strict security isolation mechanisms and independent processing logic within their internal environment.

[0042] In Example 3, Figure 2 The implementation flow of the data governance processing method provided by an embodiment of the present invention is illustrated. The following details the steps of receiving access requests uploaded by users to the intranet and identifying the risk level: S103: Construct a behavior detection mechanism for access requests and obtain behavior trajectories, wherein the behavior trajectories include at least: access frequency, instruction pattern, and data packet characteristics.

[0043] A behavior detection mechanism is constructed, which refers to a set of methods for real-time capture, analysis, and evaluation of access request behavior. This mechanism records access request behavior data and generates corresponding behavior trajectories. The behavior trajectories include three core dimensions: access frequency, command pattern, and data packet characteristics. Access frequency measures the number of access requests and the access rhythm within a unit of time to identify abnormally high-frequency or low-frequency access behaviors. Command pattern analyzes the operation type, call order, and command structure carried in the request to identify potential malicious operations or abnormal command combinations. Data packet characteristics include data packet size, header information, protocol type, payload characteristics, and encryption method, used to detect abnormal patterns in data transmission.

[0044] S104: Construct a risk database, wherein the risk database consists of behavioral trajectory items and risk level items, and use the risk database to dynamically adjust the risk level.

[0045] Create a risk database, which is specifically used to store and manage the risk characteristics of access requests. The risk database consists of behavioral trajectory items and risk level items. In other words, each access request corresponds to a behavioral trajectory, and each behavioral trajectory corresponds to a risk level.

[0046] In Example 4, Figure 3 The implementation flow of the data governance processing method provided by an embodiment of the present invention is illustrated. The following details the step of importing the access request into the first container when the risk level of the access request is greater than a threshold: S201: Establish a one-to-one correspondence between the number of hashes and the risk level.

[0047] The hash count refers to the number of times a pseudo address is hashed using a hash function; each risk level corresponds to one hash count.

[0048] S202: Collect attribute data of access requests, wherein the attribute data includes at least: IP, type and risk level, and adjust the number of hashes based on the attribute data and behavioral patterns.

[0049] In addition to adjusting the number of hashes based on the risk level, the attributes of the access request should also be considered. These attributes include IP information and access request type information. The IP is used to identify the source address of the access request, which can identify requests from suspicious sources or abnormal regions. The second is the type information, which is used to define the specific category of the access request, such as file transfer request, instruction execution request, and data read request.

[0050] In Example 5, Figure 4 The implementation flow of the data governance processing method provided by an embodiment of the present invention is illustrated. The following details the steps of sequentially processing the access request using all virtual containers and initializing all virtual containers after obtaining the processing results: S301: Record all hash values ​​corresponding to each access request, establish a mapping between hash values ​​and virtual containers, and integrate them to generate a verification set.

[0051] The hash value corresponding to each access request is stored, and the mapping corresponding to each hash value is determined. The hash value is then integrated to generate a verification set, which is mainly used to backtrack the data governance process.

[0052] For example, an access request is hashed three times. The first pseudo-address and its corresponding identifier field are integrated, and the new first pseudo-address is hashed to obtain the first hash value. The first hash value is inserted into the second pseudo-address and hashed to obtain the second hash value. The second hash value is inserted into the third pseudo-address and hashed. The first, second, and third pseudo-addresses are written into the first, second, and third containers, respectively. Using the program or terminal in each virtual container pseudo-address, anomaly detection is performed on the access request. All hash values ​​corresponding to the access request and the detection results of the virtual containers are integrated to obtain a verification set.

[0053] S302: Send the verification set to the root container and embed the verification mechanism.

[0054] The verification set is sent to the root container, and a verification mechanism is embedded. Specifically, the root container, as the final decision unit, verifies and analyzes the detection results of each virtual container after receiving the verification set to determine whether there is a defect. If not, the access request is routed to the target address.

[0055] In Example 5, Figure 5 The implementation flow of the data governance processing method provided by the embodiment of the present invention is illustrated. The following details the steps of creating processing rules that correspond one-to-one with the type, packaging the processing results, and sending them back to the intranet: S401: Identify the target end of the processing result and set the priority of each target end.

[0056] Identify the target end corresponding to the processing result, that is, determine the business node, application module or storage unit that the access request ultimately needs to be delivered to, and set a corresponding priority for each target end, which can be divided into high, medium and low priorities.

[0057] S402: After the return is completed, a security log is generated and sent to the preset terminal.

[0058] Once the data return is complete, a security log is generated. The security log is used to record the entire process information of this access request. The security log is then sent to a preset terminal, which refers to the terminal of the data governance administrator.

[0059] In Example 6, unlike Example 1, the method further includes: The source terminal of each access request is determined based on the attribute data. Based on the security logs and processing results, risk profiles are drawn, with each source terminal corresponding to a risk profile.

[0060] Based on the IP information in the attribute data of each access request, the source terminal of each access request is determined, and the behavioral characteristics, abnormal event records and risk levels exhibited by the access request during the intranet access process are extracted to create a risk profile, which can characterize the potential threat tendencies of each source terminal.

[0061] Figure 6 The diagram illustrates the structural block diagram of a data governance processing system provided in an embodiment of the present invention. The data governance processing system 1 includes: The receiving module 11 is used to receive access requests uploaded by users to the intranet, identify the risk level, access the buffer in the intranet, and configure several virtual containers in the buffer, at least obtaining a first container, a second container and a root container. The embedding module 12 is used to import the access request into the first container when the risk level of the access request is greater than the threshold, parse and locate the target address corresponding to the access request, and perform random perturbation processing to obtain several pseudo addresses, wherein the pseudo addresses include at least: a first pseudo address and a second pseudo address, write the pseudo addresses into the corresponding virtual container, and embed an identification field. Initialization module 13 is used to select a hash function, hash the first pseudo address to generate a first hash value, and insert it into the second pseudo address. Hash the second pseudo address to obtain a second hash value, and write it into the third pseudo address, and so on, until the nth pseudo address is obtained. The hash count is calculated, and a correspondence between the hash count and the risk level is established. All virtual containers are used in sequence to process the access request, and after obtaining the processing result, all virtual containers are initialized. The feedback module 14 is used to determine whether there are risk characteristics in the processing result. If so, the access request is marked as a malicious request and a pre-built security alarm rule is triggered. If not, the access request is traced back through the hash value and the identifier field. The access request and the target address are imported into the root container to determine the real result, identify the type of the real result, create a one-to-one corresponding handling rule for the type, package the processing result, and send it back to the intranet.

[0062] Figure 7 This diagram illustrates the structural block diagram of a data governance processing system provided in an embodiment of the present invention. The receiving module 11 includes: Definition unit 111 is used to define the corresponding access request as a sensitive request when the risk level is greater than the threshold. Access unit 112 is used to select high-risk containers from the virtual containers and access the sensitive request into the high-risk containers; The acquisition unit 113 is used to construct a behavior detection mechanism for access requests and acquire behavior trajectories, wherein the behavior trajectories include at least: access frequency, instruction pattern and data packet characteristics; The adjustment unit 114 is used to construct a risk database, wherein the risk database consists of behavioral trajectory items and risk level items, and the risk level is dynamically adjusted using the risk database.

[0063] Figure 8 This diagram illustrates the structural block diagram of a data governance processing system provided in an embodiment of the present invention. The embedded module 12 includes: Establishment unit 121 is used to establish a one-to-one correspondence between hash counts and risk levels; Hash unit 122 is used to collect attribute data of access requests, wherein the attribute data includes at least: IP, type and risk level, and the number of hashes is adjusted based on the attribute data and behavioral patterns.

[0064] Figure 9 This diagram illustrates the structural block diagram of a data governance processing system provided in an embodiment of the present invention. The initialization module 13 includes: Recording unit 131 is used to record all hash values ​​corresponding to each access request, establish a mapping between hash values ​​and virtual containers, and integrate them to generate a verification set; Sending unit 132 is used to send the verification set to the root container and embed the verification mechanism.

[0065] Figure 10 This diagram illustrates the structural block diagram of the data governance processing system provided in an embodiment of the present invention. The feedback module 14 includes: The identification unit 141 is used to identify the target end of the processing result and set the priority of each target end; The generation unit 142 is used to generate a security log after the return is completed and send it to a preset terminal.

[0066] The receiving module 11 is mainly used to complete step S100, the embedding module 12 is mainly used to complete step S200, the initialization module 13 is mainly used to complete step S300, and the return module 14 is mainly used to complete step S400. The definition unit 111 is mainly used to complete step S101, the access unit 112 is mainly used to complete step S102, the acquisition unit 113 is mainly used to complete step S103, and the adjustment unit 114 is mainly used to complete step S104. The establishment unit 121 is mainly used to complete step S201, and the hash unit 122 is mainly used to complete step S202; Recording unit 131 is mainly used to complete step S301, and sending unit 132 is mainly used to complete step S302; The identification unit 141 is mainly used to complete step S401, and the generation unit 142 is mainly used to complete step S402.

[0067] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. A data governance processing method, characterized in that, The method includes: Receive user access requests uploaded to the intranet, identify the risk level, access the buffer in the intranet, and configure several virtual containers in the buffer, obtaining at least a first container, a second container, and a root container; When the risk level of the access request is greater than the threshold, the access request is imported into the first container, the target address corresponding to the access request is parsed and located, and random perturbation is performed to obtain several pseudo addresses, wherein the pseudo addresses include at least: a first pseudo address and a second pseudo address. The pseudo addresses are written into the corresponding virtual container and an identification field is embedded. Select a hash function, hash the first pseudo address to generate a first hash value, and insert it into the second pseudo address. Hash the second pseudo address to obtain a second hash value, and write it into the third pseudo address. Continue in this manner until the nth pseudo address is obtained. Calculate the number of hashes and establish the correspondence between the number of hashes and the risk level. The access request is processed sequentially using all the virtual containers, and after obtaining the processing results, all the virtual containers are initialized. If the processing result contains risk characteristics, the access request is marked as a malicious request and a pre-built security alert rule is triggered. If not, the access request is traced back through the hash value and the identifier field. The access request and the target address are imported into the root container to determine the real result and identify the type of the real result. A handling rule corresponding to the type is created, the processing result is packaged, and sent back to the intranet.

2. The data governance processing method according to claim 1, characterized in that, The steps of receiving access requests uploaded by users to the intranet, identifying risk levels, accessing a buffer in the intranet, and configuring several virtual containers in the buffer include: When the risk level is greater than the threshold, the corresponding access request is defined as a sensitive request; From the virtual containers, select high-risk containers and connect the sensitive requests to the high-risk containers.

3. The data governance processing method according to claim 2, characterized in that, The step of receiving access requests uploaded by users to the intranet and identifying the risk level includes: Construct a behavior detection mechanism for access requests to obtain behavior trajectories, wherein the behavior trajectories include at least: access frequency, instruction pattern, and data packet characteristics; A risk database is constructed, which consists of behavioral trajectory items and risk level items. The risk level is dynamically adjusted using the risk database.

4. The data governance processing method according to claim 3, characterized in that, The step of importing the access request into the first container when the risk level of the access request is greater than the threshold includes: Establish a one-to-one correspondence between hash counts and risk levels; Collect attribute data of access requests, wherein the attribute data includes at least: IP, type and risk level, and adjust the number of hashes based on the attribute data and behavioral patterns.

5. The data governance processing method according to claim 1, characterized in that, The steps of processing the access request sequentially using all virtual containers and initializing all virtual containers after obtaining the processing results include: Record all hash values ​​corresponding to each access request, establish a mapping between hash values ​​and virtual containers, and integrate them to generate a verification set; The verification set is sent to the root container, and the verification mechanism is embedded.

6. The data governance processing method according to claim 4, characterized in that, The steps of creating a one-to-one correspondence between processing rules and types, packaging the processing results, and sending them back to the intranet include: Identify the target end of the processing results and set the priority for each target end; Once the data return is complete, a security log is generated and sent to the preset terminal.

7. The data governance processing method according to claim 6, characterized in that, The method further includes: The source terminal of each access request is determined based on the attribute data. Based on the security logs and processing results, risk profiles are drawn, with each source terminal corresponding to a risk profile.

8. A data governance processing system, characterized in that, The system includes: The receiving module is used to receive access requests uploaded by users to the intranet, identify the risk level, access the buffer in the intranet, and configure several virtual containers in the buffer, at least obtaining a first container, a second container and a root container; The embedding module is used to import the access request into a first container when the risk level of the access request is greater than a threshold, parse and locate the target address corresponding to the access request, and perform random perturbation processing to obtain several pseudo addresses, wherein the pseudo addresses include at least: a first pseudo address and a second pseudo address, write the pseudo addresses into the corresponding virtual container, and embed an identifier field. An initialization module is used to select a hash function, hash the first pseudo address to generate a first hash value, and insert it into the second pseudo address. The second pseudo address is then hashed to obtain a second hash value, which is written into the third pseudo address, and so on, until the nth pseudo address is obtained. The number of hashes is calculated, and a correspondence between the number of hashes and the risk level is established. All virtual containers are used sequentially to process the access request, and after obtaining the processing result, all virtual containers are initialized. The feedback module is used to determine whether there are risk characteristics in the processing result. If so, the access request is marked as a malicious request and a pre-built security alarm rule is triggered. If not, the access request is traced back through the hash value and the identifier field. The access request and the target address are imported into the root container to determine the real result, identify the type of the real result, create a one-to-one corresponding handling rule for the type, package the processing result, and send it back to the intranet.

9. The data governance processing system according to claim 8, characterized in that, The receiving module includes: A definition unit is used to define the corresponding access request as a sensitive request when the risk level is greater than the threshold. An access unit is used to select high-risk containers from the virtual containers and access the sensitive request to the high-risk containers; The acquisition unit is used to construct a behavior detection mechanism for access requests and acquire behavior trajectories, wherein the behavior trajectories include at least: access frequency, instruction pattern, and data packet characteristics. An adjustment unit is used to construct a risk database, wherein the risk database consists of behavioral trajectory items and risk level items, and the risk level is dynamically adjusted using the risk database.

10. The data governance processing system according to claim 9, characterized in that, The embedded module includes: Establish a unit to create a one-to-one correspondence between hash counts and risk levels; A hash unit is used to collect attribute data of access requests, wherein the attribute data includes at least: IP, type and risk level, and the number of hashes is adjusted based on the attribute data and behavioral patterns.

Images