Database sensitive data desensitization and backtracking control method and system

Abstract

The invention belongs to the technical field of data desensitization, and provides a database sensitive data desensitization and backtracking control method and system.According to the technical scheme, text samples are constructed according to obtained database field content, sensitive entities in the text samples are recognized, and the sensitive entities are classified and marked; determining a field position and a sensitivity level of the sensitive entity; determining a desensitization strategy by combining three-dimensional information of a field type, use scene information and user role information on the basis of the determined field position and sensitive level of the sensitive entity; and responding to an operation request of a user, matching a corresponding desensitization strategy and an execution strategy based on the operation request of the user, writing a strategy execution record into an audit log, performing data use track backtracking and anomaly detection according to the audit log, and obtaining a corresponding disposal strategy according to an anomaly detection result. The data security governance capability can be remarkably improved, and the requirement of supervision on data compliance use is met.

Description

Technical Field

[0001] This invention belongs to the field of data desensitization technology, and in particular relates to a method and system for desensitizing and backtracking sensitive data in a database. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] In industries such as finance, healthcare, government affairs, and e-commerce, corporate databases often store large amounts of structured data containing sensitive information, such as ID card numbers, mobile phone numbers, bank card numbers, addresses, email addresses, and health records. This data frequently involves exporting, sharing, or development / testing requirements in business scenarios. To ensure data security and meet compliance requirements, sensitive information must be effectively anonymized.

[0004] However, most enterprises still face the following problems in data masking and export control: Sensitive field identification is often based on simple field name matching or manual configuration, lacking the ability to recognize semantic content, and easily overlooking non-standard fields (such as "recipient's phone number" and "alternate mobile phone number"); Masking strategies are inconsistent and lack flexibility, with masking rules hard-coded into scripts or tools, making it difficult to dynamically adjust according to business type, export object, and field importance level, resulting in maintenance difficulties and poor reusability. The export process lacks approval and logging loops. Data export is often carried out through SQL scripts or BI tools, with weak approval processes, incomplete logging, and a lack of control and traceability over the entire data export process, which can easily lead to data leakage. Summary of the Invention

[0005] To address at least one of the technical problems mentioned above, this invention provides a method and system for sensitive data desensitization and backtracking control in databases, which can significantly improve data security governance capabilities and meet regulatory requirements for compliant data use.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: The first aspect of the present invention provides a method for desensitizing and backtracking sensitive data in a database, comprising the following steps: Based on the obtained database field content, construct text samples, identify sensitive entities in the text samples, classify and label sensitive entities, and determine the field location and sensitivity level of sensitive entities; Based on the determined field location and sensitivity level of sensitive entities, and combined with three-dimensional information such as field type, usage scenario information and user role information, a desensitization strategy is determined. In response to user operation requests, the system matches the corresponding de-identification strategy based on the user's operation request, executes the strategy, and writes the strategy execution record to the audit log. Based on the audit log, the system performs data usage trajectory backtracking and anomaly detection, and obtains the corresponding handling strategy based on the anomaly detection results.

[0007] Furthermore, the step of constructing text samples based on the acquired database field content includes: determining the target field, sampling based on the set sampling rules, and constructing text samples.

[0008] Furthermore, when identifying sensitive entities in text samples, the BERT+CRF named entity recognition model is used to identify sensitive entities in the text samples.

[0009] Furthermore, the method for determining the desensitization strategy based on the determined field location and sensitivity level of sensitive entities, combined with three-dimensional information including field type, usage scenario information, and user role information, includes: Identify the field's inherent attributes, the usage scenario of the current operation context, and the role of the current operator; Set appropriate desensitization strategies based on a combination of the field's inherent attributes, the usage scenario of the current operation context, and the role information of the current operator; Set a corresponding desensitization strategy and assign a weight score to each leaf node, calculate the score of all matching paths, and take the path with the highest score as the final strategy.

[0010] Furthermore, the corresponding desensitization strategy is set based on a combination of the field's inherent attributes, the usage scenario of the current operation context, and the role information of the current operator, including: Define node dimensions, including the root node first determining the field type, the first-level child nodes determining the current usage scenario, and the second-level child nodes determining the current user role; Set a corresponding de-identification strategy for each leaf node. The de-identification rule template library includes mask de-identification, interval fuzzing, hash / irreversible encryption, reversible encryption, and de-identification retention mapping.

[0011] Furthermore, the process of tracing data usage patterns and detecting anomalies based on audit logs, and obtaining corresponding handling strategies based on the anomaly detection results, includes: Build historical user profiles based on collected user operation logs; A sliding time window model is introduced to statistically analyze changes in user behavior within a given time period; After scoring changes in user behavior, risk levels are determined in tiers, and corresponding response strategies are set based on the risk levels.

[0012] Furthermore, the process of scoring user behavior changes and then stratifying them to determine risk levels, followed by setting corresponding response strategies based on those risk levels, includes: If the score deviates from the first threshold, the risk level is low risk, and the response method is to mark it as archived. If the deviation score is less than or equal to the first threshold and the deviation score is less than the second threshold, and the accessed field is a sensitive field, the risk level is medium risk and the response method is to send an alarm. If the deviation score is greater than or equal to the second threshold of 0 or if sensitive fields are exported multiple times within a short period of time, the risk level is high risk, and the response method is to block operations and link up with the SIEM system.

[0013] A second aspect of the present invention provides a database sensitive data desensitization and backtracking control system, comprising: The sensitive entity identification module is used to construct text samples based on the acquired database field content, identify sensitive entities in the text samples, classify and label sensitive entities, and determine the field location and sensitivity level of sensitive entities. The desensitization strategy determination module is used to determine the desensitization strategy based on the field location and sensitivity level of the identified sensitive entity, combined with three-dimensional information including field type, usage scenario information, and user role information. The backtracking control module is used to respond to user operation requests, match the corresponding de-identification policy based on the user's operation request, execute the policy, and write the policy execution record to the audit log. Based on the audit log, it performs data usage trajectory backtracking and anomaly detection, and obtains the corresponding handling policy based on the anomaly detection results.

[0014] A third aspect of the present invention provides a computer-readable storage medium.

[0015] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the database sensitive data desensitization and backtracking control method described above.

[0016] A fourth aspect of the present invention provides a computer device.

[0017] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the steps of the database sensitive data desensitization and backtracking control method described above.

[0018] Compared with the prior art, the beneficial effects of the present invention are: 1. This invention, by improving the accuracy and automation of sensitive field identification, formulates a template-based desensitization strategy. At the same time, all desensitization and export operations generate unique hash identifiers and write them into an immutable log to ensure accountability. It also integrates an abnormal behavior detection model to achieve real-time early warning of high-risk export behavior, which can significantly improve data security governance capabilities and meet regulatory requirements for compliant data use.

[0019] 2. This invention proposes an intelligent sensitive field identification mechanism. Compared to traditional solutions that rely on field name rules, this mechanism, based on a BERT+CRF-based Chinese NER model with fine-tuning training, can identify various entity types such as user information, financial data, and geographic information. This significantly improves the system's coverage of "unstructured fields" or "non-standard named fields," avoiding false positives and false negatives.

[0020] 3. After identifying sensitive fields, the system will dynamically apply the corresponding de-identification method according to the preset strategy template. The strategy engine supports differentiated configuration based on field type, usage scenario (such as development, testing, and integration), and user role to ensure that the de-identification results meet compliance requirements while retaining the necessary data availability.

[0021] 4. This invention's system records each export operation, including metadata such as the operator, export scope, field information, and target of use, and marks it in the exported data as a digital watermark. This watermark can be embedded in the file structure or data row content, without affecting data usage, while enabling reverse tracing of responsibility in leakage scenarios. The watermark employs an tamper-proof design and supports automatic inclusion in exported formats such as Excel and CSV, enhancing post-leakage tracking capabilities.

[0022] Advantages of additional aspects of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0023] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0024] Figure 1 This is a flowchart of a database sensitive data desensitization and backtracking control method provided by an embodiment of the present invention. Detailed Implementation

[0025] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0026] It should be noted that the following detailed description is illustrative and intended to provide further explanation of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0027] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0028] It should be noted that this application may display prompt interfaces, pop-ups, or output voice prompts before and during the collection of user data. These prompt interfaces, pop-ups, or voice prompts are used to inform users that their data is being collected. This ensures that the application only begins the steps for collecting user data after receiving confirmation from the user regarding the prompt interface or pop-up; otherwise (i.e., without user confirmation), the steps for collecting user data end, meaning no user data is collected. In other words, all user data collected by this application is processed strictly in accordance with the requirements of relevant national laws and regulations. The informed consent or separate consent of the data subject is obtained only with the user's consent and authorization. Subsequent data use and processing are conducted within the scope of laws, regulations, and the data subject's authorization, and the collection, use, and processing of relevant user data must comply with the relevant laws, regulations, and standards of the relevant countries and regions.

[0029] Example 1 like Figure 1 As shown, this embodiment provides a method for sensitive data desensitization and backtracking control in a database, including the following steps: Step 1: Based on the obtained database field content, construct a text sample, identify sensitive entities in the text sample, classify and label the sensitive entities, and determine the field location and sensitivity level of the sensitive entities; Specifically, the steps include the following: Step 101: Determine the target field, and perform sampling based on the set sampling rules to construct text samples; In this embodiment, the target fields are filtered according to the actual scenario requirements, with priority given to fields containing sensitive entities; In this embodiment, the sampling rule is stratified sampling, for example, stratifying according to the type of table, and randomly sampling within each stratum to ensure that fields in different business scenarios are covered.

[0030] Furthermore, after sampling, deduplication and outlier processing are performed to remove duplicate records (such as multiple redundant records from the same user), filter out null values ​​or fields with abnormal formats (such as mobile phone numbers that are only 8 digits), and avoid invalid samples.

[0031] Furthermore, when constructing text samples, considering that database fields are mostly isolated values, directly inputting them into the model can easily lead to a decrease in recognition accuracy. Therefore, it is necessary to embed field values ​​into the natural language context to construct samples that closely resemble actual text. The specific construction principles are as follows: Preserve logical relationships: Organize text based on the business scenario to which the field belongs (such as user registration information, order details) to ensure semantic coherence between fields.

[0032] Diverse templates: Design multiple sentence templates to avoid the model being limited to fixed expressions (such as using different sentence combinations for a batch of fields).

[0033] Step 102: Identify sensitive entities in the text sample, classify and label the sensitive entities, and determine the field location and sensitivity level of the sensitive entities; In this embodiment, a BERT+CRF named entity recognition model is used to identify sensitive entities in text samples. The BERT layer converts the input text into context-sensitive word vectors (solving the problem of polysemy) to capture the semantic features of entities such as "name" and "ID number". The CRF layer handles label dependencies (e.g., B-Name (starting with a name) can only be followed by I-Name (middle of the name) or O (non-entity)) to optimize entity boundary recognition.

[0034] Furthermore, a contextual semantic enhancement mechanism was introduced when identifying sensitive entities in text samples. Specifically, token embeddings were extracted through the BERT intermediate layer, and the correlation between field context information and inter-line cross-fields (such as the linked appearance of name-ID card-address) was fused, significantly improving the recognition accuracy of unstructured fields. This was particularly effective for fields containing mixed text (such as "Zhang San lives in a certain area, and his ID card number is..."). It has a higher generalization ability.

[0035] This invention supports the identification of cross-field entities, such as sensitive information that requires the concatenation of multiple fields within a single record (e.g., name and phone number stored in different fields). This capability is achieved through sequence concatenation modeling, unlike existing single-field granular NER methods.

[0036] Step 2: Based on the determined field location and sensitivity level of the sensitive entity, and combined with the three-dimensional information of field type, usage scenario information and user role information, determine the de-identification strategy; In this embodiment, "field type," "use case," and "user role" do not determine the de-identification method independently, but rather participate in the decision-making process as multiple conditions within the de-identification strategy engine. The system adopts a rule-based optimization mechanism based on three-dimensional combined conditions, rather than simply "triggering the strategy directly based on whichever is identified." Instead, these three types of information jointly determine which specific de-identification method to use.

[0037] Specifically, the steps include the following: Step 201: Identify the attributes of the field itself, the usage scenario of the current operation context, and the role of the current operator; In this embodiment, the attributes of the field itself are identified, such as whether it is text, whether it belongs to the ID card number type, whether it is an amount field, etc. Identify the usage scenario of the current operation context, such as development environment / testing environment / production environment, etc. Identify the role of the current operator, such as DBA, developer, data analyst, outsourcing vendor, etc. Step 202: Set the corresponding desensitization strategy based on the combination of the field's own attributes, the usage scenario of the current operation context, and the role information of the current operator; In this embodiment, a multi-dimensional rule-based decision tree is used, with three types of conditions (field attributes, usage scenarios, and user roles) as decision branches, and each leaf node corresponds to a combination of de-identification strategies; The specific construction process includes: Step 2021: Set the node dimensions, including: the root node first determines the field type (e.g., text / numeric / identifier); the first-level child nodes determine the current use case (e.g., testing / production / integration testing); the second-level child nodes determine the current user role (e.g., DBA / R&D / supplier). Step 2022: Set the corresponding desensitization strategy for each leaf node; Then, the corresponding desensitization strategy is set for each leaf node as shown in Table 1: Table 1 shows the corresponding desensitization strategies for each leaf node.

[0038] Table 1 only lists a portion of the desensitization rules; those skilled in the art can set their own rules based on the actual situation.

[0039] The set de-identification rule template library includes masking, interval fuzzing, hash / irreversible encryption, reversible encryption, and de-identification retention mapping; Specifically, masking is suitable for text fields such as ID cards, mobile phone numbers, and email addresses. Typical scenarios include testing / integration debugging where some formatting needs to be retained for front-end debugging. Users include developers and external personnel.

[0040] Execution method: The system replaces the middle part of the field value with " according to the configured rules (e.g., keeping the first 3 and last 4 digits). For example, mobile number 13812345678 → The mask is executed using regular expressions and field template matching.

[0041] Range generalization is suitable for numeric fields (such as amounts, ages, and salaries). Typical scenarios include analytical queries that avoid exposing precise values. Users include data analysts and BI system users.

[0042] Execution method: Based on the data distribution, preset intervals are set, such as "1000-2000" and ">10000". The desensitization process maps the original value to the corresponding interval; for example, 1578 yuan is displayed as "1000-2000".

[0043] Hash / irreversible encryption is suitable for fields such as unique identifiers, including ID cards, email addresses, and account IDs. Typical scenarios include situations where no backfilling is required, only uniqueness needs to be guaranteed; and user roles include third-party interfaces and external data sharing.

[0044] Execution method: Encryption is performed using a method such as SHA-256, and the key is not saved; ensuring that the original data cannot be restored from the de-identified value; for example: Zhang San → 9b74c9897bac770ffc029102a200c5de.

[0045] Reversible encryption (such as AES) is suitable for fields that need to be filled back in the business, such as ID card numbers and mobile phone numbers. Typical scenarios: online environment / production troubleshooting; user roles: DBA, authorized security personnel; Execution method: AES algorithm is used for encryption, and the key is stored in the Key Management Service (KMS); The field values ​​are stored in encrypted form during the query and decrypted by authorized users when viewed; for example: 13812345678 →XhUj98HdnaB3z1Lp== (stored after encryption).

[0046] Data masking and mapping is applicable to fields that require statistical analysis and summarization; typical scenarios include data warehouses and modeling sample sets; and the target user is the data science team. Execution method: Before anonymization, establish a mapping table from the original value to the anonymous ID; for example, Zhang San → user_001; retain the mapping table for authorized users only, for later training / statistical regression.

[0047] The final rule example is shown below: [Field type = ID card number] ├── [Scene=Test] │└── [Role = External Supplier] → Mask (Keep the first 2 and last 2) │└── [Role = R&D]→ Reversible Encryption ├── [Scene = Production] │└── [Role=DBA]→ Reversible Encryption │└── [Role=Analyst]→ Mapped ID Step 2023: Set a corresponding desensitization strategy for each leaf node and assign a weight score. Calculate the score of all matching paths and take the path with the highest score as the final strategy.

[0048] In this embodiment, when assigning weight scores to each leaf node according to the corresponding desensitization strategy, the settings can be made according to the actual scenario and role. For example, the scenario is "production" with a weight of +3, and the role is "external supplier" with a weight of +2. Step 2024: Set the corresponding policy ID for different policies.

[0049] Step 3: In response to the user's query request, match the corresponding de-identification strategy based on the user's query request, execute the strategy, and write the strategy execution record to the audit log. Perform data usage trajectory backtracking and anomaly detection based on the audit log; Specifically, the steps include the following: Step 301: In response to the user's query request, match the corresponding de-identification strategy based on the user's query request, execute the strategy, and write the strategy execution record to the audit log; In this embodiment, each export operation is recorded, including metadata such as the operator, export scope, field information, and target of use, and is marked in the export audit log data as a digital watermark. This watermark can be embedded in the file structure or data row content, without affecting data usage, and can be used to trace the responsible party in a leakage scenario. The watermark adopts an anti-tampering design and supports automatic attachment in exported formats such as Excel and CSV, improving the ability to trace leaks after they occur.

[0050] Specifically, watermark embedding includes: inserting invisible marker fields at the row level (such as attaching a _trace_token field); embedding invisible character-encoded tracking information in Excel / CSV files; and adding hidden columns and encrypted identifiers if exported as a structured table. Watermarks are resistant to deletion and modification; once data is leaked, the source can be traced through surviving watermark fragments.

[0051] Step 302: Perform data usage trajectory backtracking and anomaly detection based on the audit logs; A data usage log chain is constructed, combined with user behavior profiles, to continuously monitor the access, de-identification, export, and transfer paths of sensitive fields. Once an abnormal pattern is detected (such as a single account continuously exporting multiple sensitive tables within a short period of time, or multiple failed export retries), an alert or blocking operation can be automatically triggered. In addition, by introducing clustering models (such as K-Means and Isolation Forest) to model user operation habits, it helps to identify "unauthorized use" or "atypical behavior," achieving a closed loop throughout the entire process from pre-emptive prevention to in-process control and post-event tracking.

[0052] Specifically, it includes: Step 3021: Establish a user historical profile based on the collected user operation logs; Specifically, the collected user operation logs include querying, exporting, and viewing; when building user historical profiles, this includes extracting user access frequency, access fields, and export time periods. Step 3022: Introduce a sliding time window model to statistically analyze changes in user behavior within that time period; In this embodiment, dynamic windows such as 30 minutes / 2 hours are set to statistically analyze changes in user behavior within the time period. If the behavior deviates sharply in a short period of time (such as a surge in access frequency or a significant increase in the span of data tables), it is marked as high risk. Anomaly detection algorithms such as Isolation Forest are used, combined with the rarity of access fields (such as a table that can only be accessed by core personnel), to determine whether there is any "unauthorized behavior".

[0053] Step 3023: After scoring changes in user behavior, determine the risk level in different tiers, and set corresponding handling strategies based on the corresponding risk level.

[0054] This embodiment specifically includes; If the deviation score is less than the first threshold, such as 0.3, the risk level is low risk, and the response method is to mark it as archived. If the deviation score is less than or equal to the first threshold and the deviation score is less than the second threshold (e.g., 0.7), and the accessed field is a sensitive field, the risk level is medium risk, and the response method is to send an alarm. If the deviation score is greater than or equal to the second threshold or if sensitive fields are exported multiple times within a short period of time, the risk level is high risk, and the response method is to block operations and link up with the SIEM system.

[0055] By introducing a sliding time window and abnormal behavior modeling, a mechanism of "dynamic behavior profiling + risk level determination + joint prevention and control" is constructed to achieve a closed loop of the entire chain from identification to handling.

[0056] Example 2 This embodiment provides a database sensitive data desensitization and backtracking control system, including: The sensitive entity identification module is used to construct text samples based on the acquired database field content, identify sensitive entities in the text samples, classify and label sensitive entities, and determine the field location and sensitivity level of sensitive entities. The desensitization strategy determination module is used to determine the desensitization strategy based on the field location and sensitivity level of the identified sensitive entity, combined with three-dimensional information including field type, usage scenario information, and user role information. The backtracking control module is used to respond to user operation requests, match the corresponding de-identification policy based on the user's operation request, execute the policy, and write the policy execution record to the audit log. Based on the audit log, it performs data usage trajectory backtracking and anomaly detection, and obtains the corresponding handling policy based on the anomaly detection results.

[0057] It should be noted that the specific implementation of the database sensitive data desensitization and backtracking control system of this invention is similar to the specific implementation of the database sensitive data desensitization and backtracking control method of this invention. Please refer to the description in the method section for details. In order to reduce redundancy, it will not be repeated here.

[0058] Example 3 This embodiment provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the database sensitive data desensitization and backtracking control method described above.

[0059] Example 4 This embodiment provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the steps in the database sensitive data desensitization and backtracking control method described above.

[0060] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of hardware embodiments, software embodiments, or embodiments combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage) containing computer-usable program code.

[0061] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0062] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0063] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0064] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0065] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for sensitive data desensitization and backtracking control in a database, characterized in that, Includes the following steps: Based on the obtained database field content, construct text samples, identify sensitive entities in the text samples, classify and label sensitive entities, and determine the field location and sensitivity level of sensitive entities; Based on the determined field location and sensitivity level of sensitive entities, and combined with three-dimensional information including field type, usage scenario information, and user role information, a desensitization strategy is determined. In response to user operation requests, the system matches the corresponding de-identification strategy based on the user's operation request, executes the strategy, and writes the strategy execution record to the audit log. Based on the audit log, the system performs data usage trajectory backtracking and anomaly detection, and obtains the corresponding handling strategy based on the anomaly detection results.

2. The database sensitive data desensitization and backtracking control method as described in claim 1, characterized in that, The step of constructing text samples based on the acquired database field content includes: determining the target field, sampling based on the set sampling rules, and constructing text samples.

3. The database sensitive data desensitization and backtracking control method as described in claim 1, characterized in that, When identifying sensitive entities in text samples, the BERT+CRF named entity recognition model is used to identify sensitive entities in the text samples.

4. The database sensitive data desensitization and backtracking control method as described in claim 1, characterized in that, The desensitization strategy is determined based on the identified field location and sensitivity level of sensitive entities, combined with three-dimensional information including field type, usage scenario information, and user role information. Identify the field's inherent attributes, the usage scenario of the current operation context, and the role of the current operator; Set appropriate desensitization strategies based on a combination of the field's inherent attributes, the usage scenario of the current operation context, and the role information of the current operator; Set a corresponding desensitization strategy and assign a weight score to each leaf node, calculate the score of all matching paths, and take the path with the highest score as the final strategy.

5. The database sensitive data desensitization and backtracking control method as described in claim 1, characterized in that, The desensitization strategy is set based on a combination of the field's inherent attributes, the usage scenario of the current operation context, and the role information of the current operator, including: Define node dimensions, including the root node first determining the field type, the first-level child nodes determining the current usage scenario, and the second-level child nodes determining the current user role; Set a corresponding de-identification strategy for each leaf node. The de-identification rule template library includes mask de-identification, interval fuzzing, hash / irreversible encryption, reversible encryption, and de-identification retention mapping.

6. The database sensitive data desensitization and backtracking control method as described in claim 1, characterized in that, The process of tracing data usage patterns and detecting anomalies based on audit logs, and obtaining corresponding handling strategies based on the anomaly detection results, includes: Build historical user profiles based on collected user operation logs; A sliding time window model is introduced to statistically analyze changes in user behavior within a given time period; After scoring changes in user behavior, risk levels are determined in tiers, and corresponding response strategies are set based on the risk levels.

7. The database sensitive data desensitization and backtracking control method as described in claim 6, characterized in that, The process of scoring user behavior changes and then stratifying them to determine risk levels, followed by setting corresponding response strategies based on those risk levels, includes: If the score deviates from the first threshold, the risk level is low risk, and the response method is to mark it as archived. If the deviation score is less than or equal to the first threshold and the deviation score is less than the second threshold, and the accessed field is a sensitive field, the risk level is medium risk, and the response method is to send an alarm. If the deviation score is greater than or equal to the second threshold of 0 or if sensitive fields are exported multiple times within a short period of time, the risk level is high risk, and the response method is to block operations and link up with the SIEM system.

8. A database sensitive data desensitization and backtracking control system, characterized in that, include: The sensitive entity identification module is used to construct text samples based on the acquired database field content, identify sensitive entities in the text samples, classify and label sensitive entities, and determine the field location and sensitivity level of sensitive entities. The desensitization strategy determination module is used to determine the desensitization strategy based on the field location and sensitivity level of the identified sensitive entity, combined with three-dimensional information including field type, usage scenario information, and user role information. The backtracking control module is used to respond to user operation requests, match the corresponding de-identification policy based on the user's operation request, execute the policy, and write the policy execution record to the audit log. Based on the audit log, it performs data usage trajectory backtracking and anomaly detection, and obtains the corresponding handling policy based on the anomaly detection results.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps in the database sensitive data desensitization and backtracking control method as described in any one of claims 1-7.

10. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps in the database sensitive data desensitization and backtracking control method as described in any one of claims 1-7.

Images