Data security management method, system and device, storage medium and program product

Abstract

The embodiment of the invention provides a data security management method, system and device, a storage medium and a program product, and relates to the field of data security, and the method comprises the steps: collecting operation behavior data in an application system through a security parallel section technology; constructing an interaction graph between the user and the data entity based on the operation behavior data; analyzing historical operation behavior characteristics in the interaction graph by using a graph neural network model to obtain an anomaly quantized value of each operation behavior data; for any operation behavior data, determining a comprehensive risk value of the operation behavior according to the anomaly quantized value, the data sensitivity weight and the environment risk coefficient; based on the regulation knowledge graph and the comprehensive risk value, generating a corresponding security detection rule; and based on the security detection rule and the comprehensive risk value, executing a corresponding data management and control operation on the data entity in the operation behavior. According to the method, all links of data compliance management can be unified, computing resources are saved, and the management efficiency is improved.

Description

Technical Field

[0001] This application relates to the field of data security technology, and in particular to a data security management method, system, device, storage medium, and program product. Background Technology

[0002] In the digital economy era, data is gradually becoming a core resource for economic development. Data compliance governance helps prevent legal risks and ensure stable business operations; therefore, a comprehensive data compliance management system is necessary.

[0003] In related technologies, data quality inspection tools, privacy risk scanning tools, and log auditing tools often operate and are managed independently. This results in fragmented data, where the same data may need to be checked repeatedly in different tools, leading to a waste of computing resources. Furthermore, a single tool can only cover a partial aspect of compliance, resulting in fragmented compliance status and an inability to achieve unified management. Summary of the Invention

[0004] This application provides a data security management method, system, device, storage medium, and program product.

[0005] In a first aspect, embodiments of this application provide a data security management method, comprising: collecting operational behavior data in an application system using security parallel sectioning technology; constructing an interaction graph between users and data entities based on the operational behavior data, wherein the interaction graph is used to characterize: the historical operational behavior features of any user on the accessed data entity; analyzing the historical operational behavior features in the interaction graph using a graph neural network model to obtain anomaly quantification values ​​for each operational behavior data; for any operational behavior data, determining a comprehensive risk value for the operational behavior based on the anomaly quantification value, the data sensitivity weight of the corresponding data entity, and the environmental risk coefficient at the time of the operation; generating corresponding security detection rules based on a regulatory knowledge graph and the comprehensive risk value; and performing corresponding data control operations on the data entities in the operational behavior based on the security detection rules and the comprehensive risk value.

[0006] Secondly, embodiments of this application provide a data security management system, including: a secure parallel section layer, used to collect operational behavior data in an application system through secure parallel section technology; The intelligent analysis layer is used to construct an interaction graph between users and data entities based on the operational behavior data. This interaction graph represents: the historical operational behavior characteristics of any user towards the accessed data entities; it analyzes the historical operational behavior characteristics in the interaction graph using a graph neural network model to obtain anomaly quantification values ​​for each operational behavior data; for any operational behavior data, it determines the comprehensive risk value of the operational behavior based on the anomaly quantification value, the data sensitivity weight of the corresponding data entity, and the environmental risk coefficient at the time of the operation; it generates corresponding security detection rules based on the regulatory knowledge graph and the comprehensive risk value; the decision execution layer is used to perform corresponding data control operations on the data entities in the operational behavior based on the security detection rules and the comprehensive risk value.

[0007] Thirdly, embodiments of this application provide an electronic device, including a memory, a processor, and a computer program stored in the memory, wherein the processor implements any of the methods of embodiments of this application when executing the computer program.

[0008] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the method of any one of the embodiments of this application.

[0009] Fifthly, embodiments of this application provide a computer program product, including a computer program, which, when executed by a processor, implements any of the methods described in the embodiments of this application.

[0010] According to the method of this application embodiment, the operational behavior data of the application system can be uniformly collected through the security parallel section technology. Compared with the data sources in various management tools that run independently in related technologies, data can be integrated from the data source. On this basis, an interaction graph is constructed based on the operational behavior data. A graph neural network model is used to analyze the historical operational behavior characteristics in the interaction graph to obtain the anomaly quantification value of each operational behavior data. The comprehensive risk value of each operational behavior is determined by combining the anomaly quantification value, data sensitivity weight, and environmental risk coefficient. This accurate identification based on intelligent analysis can reduce the false alarm rate and improve the accuracy of risk identification results compared with the static and broad rule matching in related technologies. Furthermore, based on the regulatory knowledge graph and the comprehensive risk value, corresponding security detection rules are generated, and corresponding data control operations are executed in combination with the security detection rules and the comprehensive risk value, realizing automated processing from risk identification to handling response. According to this method, data collection, behavioral feature analysis, risk assessment, and execution of data control operations are integrated into an automated process. This unifies the fragmented aspects of data compliance management in related technologies, thereby avoiding the problem of isolated tools, saving computing resources, and improving the response efficiency of data security compliance management.

[0011] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application, it can be implemented according to the contents of the specification. In order to make the above and other objects, features and advantages of this application more obvious and understandable, specific embodiments of this application are given below. Attached Figure Description

[0012] In the accompanying drawings, unless otherwise specified, the same reference numerals throughout the various drawings denote the same or similar parts or elements. These drawings are not necessarily drawn to scale. It should be understood that these drawings depict only some embodiments according to this application and should not be construed as limiting the scope of this application.

[0013] Figure 1 A flowchart illustrating a data security management method according to an embodiment of this application is shown; Figure 2 A schematic diagram illustrating the working principle of the section probe of an exemplary embodiment of this application is shown. Figure 3 A schematic diagram showing the structure of a safety parallel cross-section of an exemplary embodiment of this application; Figure 4 A flowchart illustrating a data analysis process based on a graph neural network model, as shown in an exemplary embodiment of this application, is provided. Figure 5 This diagram illustrates the internal structure of an exemplary embodiment of the present application for intelligent analysis of collected operational behavior data. Figure 6A flowchart illustrating an exemplary embodiment of this application demonstrating the execution of a graded response strategy based on risk level; Figure 7 This diagram illustrates a module structure based on decision execution processing, as shown in an exemplary embodiment of this application. Figure 8 This application illustrates a schematic diagram of the system architecture of a data security management system as an exemplary embodiment. Figure 9 This illustration shows a structural diagram of a data security management system according to an embodiment of this application; Figure 10 A block diagram of an electronic device provided in an embodiment of this application is shown. Detailed Implementation

[0014] In the following description, only certain exemplary embodiments are briefly described. As those skilled in the art will recognize, the described embodiments can be modified in various ways without departing from the concept or scope of this application. Therefore, the drawings and description are considered to be exemplary in nature and not restrictive.

[0015] To facilitate understanding of the technical solutions of the embodiments of this application, the relevant technologies of the embodiments of this application are described below. The following relevant technologies are optional solutions and can be combined with the technical solutions of the embodiments of this application in any way, and all of them fall within the protection scope of the embodiments of this application.

[0016] In related technologies, enterprise data compliance governance faces the following technical bottlenecks. For example, there's the problem of siloed tools. Specifically, enterprises typically use independently operating data quality inspection tools, privacy risk scanning tools, and log auditing tools, resulting in fragmented data. The same data may need to be checked repeatedly in different tools, leading to a waste of computing resources. Furthermore, a single tool can only cover a partial aspect of compliance, resulting in fragmented compliance status and hindering unified management. Another example is the increasingly prominent defect of static rules. Specifically, traditional systems rely on manually maintained rule bases with update cycles as long as several weeks (e.g., 2-3 weeks), failing to adapt to dynamic revisions of data security regulations and creating significant protection gaps. Yet another example is insufficient credibility of audit traceability. Specifically, auditing systems based on application-layer logs have the following defects: first, logs are easily tampered with, resulting in insufficient credibility; second, cross-system operations cannot be correlated, making it difficult to reconstruct a complete attack chain.

[0017] It should be noted that the application scenarios or examples provided in the embodiments of this application are for ease of understanding, and the embodiments of this application do not specifically limit the application of the technical solutions. In addition, the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0018] The technical solution of this application and how it solves the aforementioned technical problems are described in detail below with specific embodiments. The listed specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0019] Figure 1 A flowchart illustrating a data security management method according to an embodiment of this application is shown, such as... Figure 1 As shown, the method may include steps S101 to S106.

[0020] S101 collects operational behavior data from the application system using safe parallel slicing technology.

[0021] S102, Based on operational behavior data, construct an interaction graph between users and data entities. The interaction graph is used to characterize the historical interaction behavior features of any user with the accessed data entities.

[0022] S103, using a graph neural network model to analyze the characteristics of historical operational behaviors in the interaction graph, and obtaining the abnormal measurement values ​​of each operational behavior data.

[0023] S104. For any operational behavior data, determine the comprehensive risk value of the operational behavior based on the abnormality quantification value, the data sensitivity weight of the corresponding data entity, and the environmental risk coefficient when the operation occurs.

[0024] S105 generates corresponding safety detection rules based on regulatory knowledge graphs and comprehensive risk values.

[0025] S106, based on security detection rules and comprehensive risk values, performs corresponding data control operations on data entities in operational activities.

[0026] According to the method of this application embodiment, the operational behavior data of the application system can be uniformly collected through the security parallel section technology. Compared with the data sources in various management tools that run independently in related technologies, data can be integrated from the data source. On this basis, an interaction graph is constructed based on the operational behavior data. A graph neural network model is used to analyze the historical operational behavior characteristics in the interaction graph to obtain the anomaly quantification value of each operational behavior data. The comprehensive risk value of each operational behavior is determined by combining the anomaly quantification value, data sensitivity weight, and environmental risk coefficient. This accurate identification based on intelligent analysis can reduce the false alarm rate and improve the accuracy of risk identification results compared with the static and broad rule matching in related technologies. Furthermore, based on the regulatory knowledge graph and the comprehensive risk value, corresponding security detection rules are generated, and corresponding data control operations are executed in combination with the security detection rules and the comprehensive risk value, realizing automated processing from risk identification to handling response. According to this method, data collection, behavioral feature analysis, risk assessment, and execution of data control operations are integrated into an automated process. This unifies the fragmented aspects of data compliance management in related technologies, thereby avoiding the problem of isolated tools, saving computing resources, and improving the response efficiency of data security compliance management.

[0027] In some embodiments, step S101 may specifically include: deploying the probe installer as a background daemon through the system package manager and starting the probe installer; using the probe installer to load a configuration file to establish a target process feature library based on the feature information of each target process contained in the configuration file; identifying the target processes in the application system based on the process feature library; deploying aspect probes to the target processes through dynamic injection technology; and collecting data operation behavior data in the application system through aspect probes running inside the target processes.

[0028] As an example, the system package manager is a tool used by the operating system to automate the installation, upgrade, configuration, and removal of software packages. A background daemon is a special process that runs in the background of the operating system for a long time, typically starting automatically at system startup without requiring user terminal interaction.

[0029] As an example, the feature information in the process feature library can include: process name pattern matching rules, environment variable identifiers, and runtime feature identifiers. Process name pattern matching rules can support at least one matching method, such as wildcard matching and regular expression matching, for example, performing fuzzy or exact matching on process names (e.g., java.exe, nginx.*) to adapt to different versions and variants of naming conventions. Environment variable identifiers are used to identify the runtime environment to which the process belongs. Runtime feature identifiers are used to indicate at least one of the following features: listening port, loaded dynamic libraries, Java Virtual Machine (JNM) startup parameters, etc.

[0030] As an example, the steps for identifying and matching target processes based on a process feature library may include: obtaining all processes in the current application system. For any process, using at least one of regular expression matching and wildcard matching, the process name is compared with a process name pattern matching rule. If the process name matches the process name pattern matching rule, subsequent processing continues; otherwise, the process name is skipped. Next, for process names that match the process name pattern matching rule, the process's environment variable table is checked. If the environment variable table contains preset environment variable identifiers, subsequent processing continues; otherwise, the process name is skipped. Finally, at least one runtime feature of the process is obtained, such as the listening port and loaded dynamic libraries. If the preset runtime feature identifiers contain the feature identifier of the obtained runtime feature, the process can be determined to be the target process; otherwise, the process name is skipped.

[0031] As an example, specific injection strategies involved in dynamic injection technology include, but are not limited to, the Java Agent scheme, the extended Berkeley Packet Filter (eBPF) scheme, and the .NET Profiler scheme.

[0032] Specifically, regarding the proxy solution: For virtual machine applications, the `-javaagent:` parameter is used to mount the application system during runtime. The probe interface (Instrumentation API) is used to enhance bytecode during class loading, injecting data collection logic. Injection points are primarily key classes such as `javax.sql.DataSource` and `HttpServlet`. This is equivalent to installing an invisible monitor in the Java program of the application system. When the program starts, this monitor is attached using the `-javaagent` parameter, and it monitors and records database operations, page requests, method substitutions, and other operations.

[0033] Regarding the eBPF scheme: The Linux kernel contains two system call trace points: trace points for tracing write system calls and trace points for tracing read system calls. For all processes on the Linux host machine, eBPF programs mount system call points such as `sys_enter_write` and `sys_enter_read` in kernel mode, capturing file and network input / output (I / O) behavior and associating it with the user-mode process identifier (PID) to trace file operations, network requests, and other behaviors performed on a specific process. For example, eBPF technology can record the file paths and contents read by a process.

[0034] Regarding the profiler solution: For applications based on the .NET development platform framework, a profiler is registered through the Component Object Model interface (COM interface). Intermediate Language (IL) code is injected into callback functions such as JIT CompilationStarted, enabling performance monitoring and behavior tracing of the application without modifying the source code. For example, this profiler can insert timing code at the beginning and end of application methods to track execution time (i.e., performance monitoring); and record information such as the number of method calls and parameter values ​​(behavior tracing).

[0035] In this embodiment, the probe installer can continuously scan the application system's process list, identify and match target processes based on a process feature library, and automatically trigger a dynamic injection process when a target process is detected to be running. Depending on the characteristics of different runtime environments, the probe installer employs differentiated injection strategies to ensure seamless integration across various technology stacks. The probe installer can also track probe status in real time and automatically recover in case of anomalies, thereby achieving self-monitoring and automatic recovery functions and ensuring continuous monitoring reliability.

[0036] As an example, the section probe, as a data acquisition execution unit, can adopt a modular architecture to achieve multi-dimensional data capture. Figure 2 A schematic diagram illustrating the working principle of the section probe of an exemplary embodiment of this application is shown. Figure 2 As shown, the aspect probe includes three collectors: a database access monitor 201, an interface call monitor 202, and a file operation monitor 203. These three collectors are connected to a cache manager 204, which in turn is connected to a context association engine 205.

[0037] Among them, the database access monitor 201 is used to hook the data operation interface and extract the operation semantic information by deeply parsing the structured query language (SQL) syntax tree; the interface call monitor 202 is used to intercept the service request entry and capture the complete call context; the file operation monitor 203 is used to encapsulate the system input / output (I / O) interface and track the access trajectory of sensitive files.

[0038] exist Figure 2 In the middle, the cache manager 204 equips the three collectors with a cache management mechanism, adopts a circular buffer structure to temporarily store the collected data, and can optimize input and output efficiency through batch processing. The context association engine 205 can be used to perform context association on the collected data, thereby realizing data fusion.

[0039] The context association engine 205 can provide more supplementary information to the collected data by calling internal or external data sources, thereby adding rich contextual information to the collected data and transforming it into event objects containing contextual information. For example, the collected data provided by the cache manager 204 includes a database query log: User U1 executed a query statement (SELECT * FROM customers) on the customer data table (table name: customers) at time T1. The context association engine 205 can call the human resources management system (HR system) to obtain the user's department and user role (user context); it can also call the customer data table in the database to determine information such as the sensitive data types contained in the data table (data context); and it can also call the network management system to determine the network address where the user initiated the data query request, whether the time of initiating the data query request was during working hours, and whether the user's device was a personal device or a company device (environmental context). As an example, an event object containing rich contextual information could be: A development engineer (username U1) in the R&D department used his personal computer during non-working hours to perform a batch query on the customer table containing Personally Identifiable Information (PII).

[0040] In this embodiment, the system package manager enables automated deployment of the probe installer. Combined with dynamic injection technology, aspect probes deployed non-intrusively collect data operation behavior data of the application system. For example, as soon as the target process starts, the aspect probe can be loaded into the target process. Inside the process, the probe can hook into public data access interfaces, and all data operation behavior data issued through these interfaces can be automatically captured, thereby significantly improving data collection coverage.

[0041] In some embodiments, the security parallel aspect can adopt any of the following alternatives. For example, the sidecar pattern, and the database auditing plugin pattern. The sidecar pattern decouples auxiliary functions (such as log collection, monitoring, security, etc.) from the main application and hosts these functions in a separate process (container). This separate process / container shares the same lifecycle as the main application container and runs on the same host. In a Kubernetes container orchestration engine environment, the probe functionality can be encapsulated as a sidecar container, sharing the process namespace with the business container for monitoring. The database auditing plugin pattern directly uses the database's built-in advanced auditing plugins (such as Oracle AuditVault) or third-party plugins to collect the database's SQL logs. The sidecar pattern has the advantage of standardized deployment, while the database auditing plugin pattern has the advantage of high stability. It can be used in combination with the security parallel aspect or independently, depending on the specific circumstances.

[0042] In some embodiments, for the collected operational behavior data from the application system, the communication protocol type of the operational behavior data can be determined through protocol parsing, and it can be routed to the corresponding parsing pipeline (e.g., parser or decoder) to obtain operational behavior data with a unified format output by the parsing pipeline.

[0043] As an example, the communication protocol type includes, but is not limited to, at least one of the following: Hypertext Transfer Protocol (HTTP), open-source relational database (MySQL) protocols, and protocols used by open-source in-memory data structure storage systems (Redis), such as the Redis Serialization Protocol (RESP). As an example, the uniform format could be, for example, a lightweight data exchange format (JSON mode). It should be understood that the uniform format can be customized according to actual needs, and this application embodiment does not impose specific limitations.

[0044] As an example, the protocol parsing matrix can be used as a data standardization and transformation hub. Here, the "matrix" is not a square matrix in mathematics, but rather a many-to-many mapping table. The protocol parsing matrix processes the input operational behavior data as follows: first, it identifies the protocol; then, it parses the data through the corresponding parsing pipeline; finally, it outputs operational behavior data with a unified format.

[0045] In this embodiment, the protocol parsing matrix serves as the hub for data standardization and transformation, and a streaming processing architecture is used to realize real-time data protocol parsing and data standardization processing.

[0046] In some embodiments, operational behavior data with a uniform format can be encrypted to obtain encrypted operational behavior data with a uniform format.

[0047] As an example, a multi-layered encryption strategy can be employed, such as using the AES-256 algorithm (256-bit Advanced Encryption Standard) to encrypt operational behavior data with a unified format end-to-end. Furthermore, the collection of operational behavior data can be conducted in batches, with each batch of collected data appended with a digital signature based on an asymmetric encryption algorithm (RSA) to achieve a system integrity protection mechanism. Tamper-proof designs can also be implemented for the collected operational behavior data. For example, a continuous sequence number mechanism can be used to periodically (every minute) anchor the Merkle root hash value of the operation log to the blockchain network, establishing an unrepudiable audit evidence chain. The Merkle root hash value is a hash digest of the operational behavior data. Using a hash algorithm (such as SHA-256), the operational behavior data is compressed into a fixed-length unique identifier (data fingerprint). The Merkle root hash values ​​of the operational behavior data are periodically packaged into blocks and written to the blockchain through a consensus mechanism. The blockchain's chain structure and distributed storage help ensure that once the hash value is on the chain, it cannot be modified individually. Furthermore, by using a sequence number mechanism, the Merkle root hash values ​​at different points in time are linked in chronological order to form a complete operation history, thereby achieving the continuity and traceability of the audit evidence chain.

[0048] Figure 3 A schematic diagram illustrating the structure of a safety parallel cross-section, as shown in an exemplary embodiment of this application. Figure 3 As shown, the security parallel aspect layer includes: a probe installer 301, an aspect probe 302, a protocol parsing module 303, and a security assurance engine 304. For the probe installer 301, it can be deployed as a background daemon through the system package manager. The probe installer is started, and it loads a configuration file to build a process signature database, identifying and matching target processes based on the database.

[0049] Aspect probe 302 is used to deploy aspect probes into the target process via dynamic injection technology.

[0050] The protocol parsing module 303 is used to process the input operation behavior data through the protocol parsing matrix as follows: first, perform protocol identification, then perform data parsing of the corresponding parsing pipeline, and finally output operation behavior data with a unified format.

[0051] The security assurance engine 304 is used to encrypt operational behavior data with a uniform format, resulting in encrypted operational behavior data with a uniform format. The security assurance engine 304 can also be used for health monitoring of the probe installer.

[0052] In this embodiment, the probe installer serves as the control center for the data acquisition module and can be managed throughout its entire lifecycle using a service-oriented architecture. Specific details can be found in the descriptions of the above embodiments and will not be repeated here.

[0053] In step S102, an interaction graph between the user and data entities can be constructed based on the operation behavior data. This operation behavior data can be operation behavior data with a uniform format or encrypted operation behavior data with a uniform format. If it is encrypted operation behavior data with a uniform format, it is first decrypted to obtain decrypted operation behavior data with a uniform format, and then the interaction graph between the user and data entities is constructed based on this decrypted operation behavior data.

[0054] As an example, the nodes in this interaction graph include user entities and data entities, with edge weights representing operation frequency and access patterns. Taking a user entity as an example, the node attributes of a user entity include at least one of department and role. The node attributes of a data entity include: data type and sensitivity level. Data types include, but are not limited to, personally identifiable information (PII) or non-personally identifiable information (non-PII). Personally identifiable information includes, but is not limited to, names, contact addresses, etc. Non-personally identifiable information includes, but is not limited to, public information, descriptive information that does not directly point to a specific individual, statistical summary data, non-personal contact information, etc.

[0055] Figure 4 A flowchart illustrating a data analysis process based on a graph neural network model, as shown in an exemplary embodiment of this application, is presented. Figure 4 The process includes the following steps.

[0056] S401, Obtain operation behavior data.

[0057] S402, Construct a graph structure.

[0058] Specifically, the operational behavior data is constructed as a dynamic graph structure, with nodes including user entities and data entities, and edge weights representing operation frequency and access patterns.

[0059] S403, Feature Analysis.

[0060] Specifically, graph neural network models include graph convolutional networks and temporal convolutional networks. When using graph neural network models to analyze historical operational behavior features in an interaction graph, it includes spatial convolutional analysis and temporal convolutional analysis. Spatial convolutional analysis includes analyzing the topological structure and detecting abnormal connections in the spatial dimension using graph convolutional networks. Temporal convolutional analysis includes obtaining the fluctuation characteristics of the operation sequence in the temporal dimension using temporal convolutional networks.

[0061] S404, Feature Fusion.

[0062] Specifically, feature representations from spatial and temporal dimensions are fused. Various fusion methods can be used, such as concatenation or weighted fusion. In practical applications, the specific implementation of feature fusion may be adjusted according to actual needs. This application's embodiments do not impose specific limitations.

[0063] S405, anomaly detection output.

[0064] Specifically, a graph neural network model may include a classifier, which can map the fused feature vectors to the output space to generate anomaly metrics for each operational behavior data.

[0065] In some embodiments, the graph neural network model is a pre-trained network model. Model training employs a semi-supervised approach, using normal operation logs as positive samples and attack data generated from penetration testing as negative samples. Training data needs to include multi-dimensional features such as user roles, operation types, access targets, and timestamps, and can be used for model training after data anonymization and feature engineering. As an example, normal operation logs will be used as positive samples, and penetration test data such as SQL injection and unauthorized access will be used as negative samples. The ratio of positive to negative samples will be greater than or equal to a predetermined threshold, for example, controlling the ratio at 10:1. The following loss function is used to mitigate the sample imbalance problem. Where y represents the true label. For positive samples, the label value is equal to 1. For negative samples, the label value is equal to 0. This is the probability predicted by the model, i.e., the anomaly quantification value A_s. The original output is typically converted to a probability value in the range [0, 1] using the sigmoid function. This is a continuous value between 0 and 1. It is a weighting factor used to adjust the influence of positive and negative samples in loss calculation, in order to alleviate the problem of sample imbalance.

[0066] In some embodiments, step S104, which involves determining the comprehensive risk value of an operation based on the anomaly metric, the data sensitivity weight of the corresponding data entity, and the environmental risk coefficient at the time of the operation, may specifically include: determining the data sensitivity weight of the corresponding data entity based on a predetermined classification rule, wherein the predetermined classification rule is used to characterize different levels of data sensitivity; determining the environmental risk coefficient based on at least one of the operation time, geographical location, and device type of the operation, wherein the geographical location is used to characterize the network area of ​​the request source of the operation, and the device type is used to characterize the network environment type at the time the operation is initiated; and generating the comprehensive risk value of the operation based on the product of the anomaly metric, the data sensitivity weight, and the environmental risk coefficient.

[0067] As an example, operation time includes either working hours or non-working hours. Geographic location includes either intranet or internet. Device type includes either company equipment or personal equipment. Calculations are made dynamically based on factors such as operation time (working hours / non-working hours), geographic location (internet / public network), and device type (company equipment / personal equipment).

[0068] As an example, predefined classification rules can be used, such as personally identifiable information, protected health information (PHI), financial data, and other sensitive data. In practical applications, the various data types involved in the operation are identified. A corresponding weight is assigned to each data type. Based on the predefined classification rules, the weights corresponding to each data type are generated, and these weights are averaged or weighted averaged to obtain the data sensitivity weight. As an example, the data sensitivity weight ranges from [0.1, 1.0].

[0069] As a specific example, the environmental risk coefficient can be determined by looking up a table. Specifically, a mapping relationship between environmental risk impact factors and environmental risk coefficients is established in advance. Based on this mapping relationship, the environmental risk coefficient corresponding to the environmental risk impact factors of the operational behavior is determined. Environmental risk impact factors include at least one of operation time, geographical location, and equipment type. As a specific example, the environmental risk coefficient can also be calculated as follows: For example, a weight and risk value are pre-assigned to each factor in the environmental risk impact factors. The weight of each factor is multiplied by its corresponding risk value, and these products are then summed to obtain the corresponding environmental risk coefficient. For example, the environmental risk coefficient ranges from [0.5, 1.5]. The above method allows for the dynamic calculation of risk coefficients based on the current operating environment, thereby more accurately assessing the risk level of operational behaviors.

[0070] As an example, the risk calculation formula is: .in, Data sensitivity weights for operational behavior data. The environmental risk coefficient for operational behavior data. The three measures are used to measure the anomalies in the operational behavior data. Multiplying them together yields the comprehensive risk value of the operational behavior. For example, the comprehensive risk value ranges from 0 to 1, and is used to comprehensively assess multi-dimensional characteristics such as operation frequency, time series distribution, and path deviation.

[0071] In this embodiment, a comprehensive risk value for operational behavior is generated by combining anomaly metrics, data sensitivity weights, and environmental risk coefficients. Dynamic assessment of operational risk improves the accuracy and response speed of data security protection.

[0072] In some embodiments, step S105, the step of generating corresponding security detection rules based on the regulatory knowledge graph and the comprehensive risk value, includes: constructing a regulatory knowledge graph based on regulatory documents collected from the network, the regulatory knowledge graph being used to store structured regulatory clauses; and generating corresponding security detection rules based on the regulatory clauses and the comprehensive risk value through few-sample learning.

[0073] For example, a regulatory knowledge graph is used to construct a structured legal knowledge base. The construction process of the regulatory knowledge graph includes: automatically collecting regulatory documents from the official websites of designated regulatory agencies or other authoritative channels via web scraping; extracting key information using Natural Language Processing (NLP) technology to form triples of "boundary object - obligation clause - penalty standard," thereby transforming unstructured regulatory text into structured triples. The knowledge graph uses ontology to construct a hierarchical structure. Users can query using natural language, and the system can understand the semantics of the query and return relevant regulatory clauses. Furthermore, the system can perform logical reasoning based on the existing knowledge graph to find the relationships between related clauses. When the collected regulatory documents are newly released (referred to as new regulations), the system automatically parses the clause content, mapping the content of the new regulations with information in the existing regulatory knowledge base to identify the scope of impact of the regulatory changes, which helps ensure the consistency and coherence of the old and new regulations.

[0074] In the data compliance governance scenario of this application embodiment, the constrained object refers to the responsible entity explicitly stipulated in regulations, such as at least one of an organization, role, or system. The obligation clause refers to the specific compliance requirements imposed on the constrained object. The penalty standard refers to the legal consequences of violating the obligation clause.

[0075] For example, suppose a regulation states: "Companies must ensure that all employees authenticate their identity when accessing sensitive data. Unauthenticated access will be logged and subject to a fine." The entity bound by this regulation is the company. The obligation is to ensure that all employees authenticate their identity when accessing sensitive data. The penalty is that unauthenticated access will be logged and subject to a fine.

[0076] For example, a dynamic rule generator can be used to automatically generate executable safety rules based on regulatory provisions and the comprehensive risk value obtained from the above analysis. The algorithm for generating safety rules uses Prototypical Networks for few-shot learning, requiring only a few, for example, 3-5 labeled samples to generate new detection rules. The rule generation process includes three steps: condition extraction, action definition, and threshold setting.

[0077] Specifically, condition extraction refers to automatically extracting key fields appearing in N samples. For example, key fields such as network address not being an internal network, access time being early morning, access device being a personal device, and overall risk value exceeding a predetermined risk threshold are converted into IF conditions; N is an integer greater than or equal to 1. Action definition: Assuming the predetermined sample label is "block," the action can be defined as "THEN DENY." Threshold setting refers to using the average distance from the sample to the prototype center as the threshold. The prototype center refers to the mean of the feature vectors of the N samples. The generated rules are only deployed after being validated in a sandbox. The rule format uses an IF-THEN structure, supporting complex condition combinations and multi-level actions. As an example, newly generated rules are replayed and tested in an isolated sandbox against historical data streams. Only after confirming that the false positive rate (False Positive Rate) is lower than a predetermined false positive rate threshold (e.g., 5%) and the false negative rate (False Negative Rate) is lower than a predetermined false negative rate threshold of 10% can the rules be formally deployed.

[0078] It should be understood that the above thresholds are merely illustrative and can be customized according to actual needs. This application does not impose any specific limitations on the embodiments.

[0079] As an example, each rule can use the following rule template: <rule>:: = IF <condition>THEN <action> ； <condition> :: = <entity> . <attribute> <operator> <value> ； <action>::= ALLOW | DENY | LOG | MASK.

[0080] Here, `Rule` is the complete rule definition. `Condition` is the triggering condition, composed of an entity, attribute, operator, and value. An entity is the object on which the rule applies, such as a user, file, or request. An attribute is a characteristic of the entity, such as permission level or file type. An operator includes at least one of the following: equal to (=), greater than (>), less than (<). A value is the benchmark used for comparison. An action is the action to be performed, including any of the following: allow, deny, log, or mask.

[0081] Figure 5 This diagram illustrates the internal structure of an exemplary embodiment of this application for intelligent analysis of collected operational behavior data. Figure 5 It includes: a graph neural network model 501, a multimodal risk quantifier 502, a regulatory knowledge graph generator 503, and a dynamic rule generator 504. Among them, the graph neural network model 501 can be, for example, a spatiotemporal graph convolutional network (ST-GCN).

[0082] Graph Neural Network Model 501 is used to construct a user-data entity interaction graph using spatiotemporal graph convolutional network technology, which is then used to detect abnormal behaviors in operational behavior data based on the interaction graph.

[0083] The multimodal risk quantifier 502 is used to comprehensively assess the operational risk level. Specifically, for any operational behavior data, the comprehensive risk value of the operational behavior is determined based on the anomaly quantification value, the data sensitivity weight of the corresponding data entity, and the environmental risk coefficient at the time of the operation; the risk level is determined based on the comprehensive risk value.

[0084] Legal knowledge graph generator 503 is used to build structured legal knowledge bases.

[0085] The dynamic rule generator 504 is used to generate corresponding security detection rules based on regulatory provisions and comprehensive risk values ​​through few-sample learning.

[0086] Risk decision module 505 is used to determine the risk level based on the comprehensive risk assessment value and execute the graded response strategy corresponding to the risk level.

[0087] Rule output module 506 is used to output security detection rules.

[0088] In some embodiments, if computational resources are limited, temporal anomaly detection algorithms (such as LSTM-Autoencoder) or Isolation Forest models can be used to calculate the behavioral anomaly degree of each operational behavior data, obtaining an anomaly metric value for each operational behavior data. The processing principle of temporal anomaly detection algorithms is as follows: a compression-reconstruction network is pre-trained using normal sequences of each operational behavior data. If the reconstruction error of newly collected sequences of operational behavior data is large, it is determined to be a behavioral anomaly, and an anomaly metric value is output. The processing principle of the Isolation Forest model is as follows: the feature space is randomly segmented, and after several segments, the feature point farthest from the central feature (the mean of the feature vectors of each operational behavior data) can be determined, and the outlier degree of this farthest feature point is output as an anomaly metric value.

[0089] The implementation of the above module functions can be found in the specific implementation of the corresponding methods in the above embodiments, and will not be repeated here.

[0090] In this embodiment, a regulatory knowledge graph is constructed to achieve structured storage of regulatory clauses. Combined with few-sample learning and comprehensive risk values, accurate security detection rules are automatically generated, improving the efficiency and accuracy of compliance detection and reducing labor costs.

[0091] In some embodiments, step S106 may specifically include: acquiring log data from the application system; identifying non-compliant behaviors in the log data based on security detection rules; executing handling strategies corresponding to the non-compliant behaviors; determining the risk level based on the comprehensive risk value; and executing a graded response strategy corresponding to the risk level, wherein the graded response strategy includes at least one of the following strategies: data desensitization, data generalization processing and generating alarm information, and blocking data operations and generating alarm information.

[0092] Figure 6 A flowchart illustrating an exemplary embodiment of this application demonstrates the execution of a graded response strategy based on risk level. Figure 6 In this process, implementing a graded response strategy corresponding to the risk level includes the following steps.

[0093] S601, Input data.

[0094] Specifically, the input data includes at least one of the following: data entities in any operation, data content output from the application system, such as query results returned by the database, downloaded files, etc.

[0095] S602, Determine the risk level.

[0096] Specifically, if the overall risk value is less than the first value, the corresponding operational behavior data is determined to be low-risk. If the overall risk value is greater than or equal to the first value and less than the second value, the corresponding operational behavior data is determined to be medium-risk. If the overall risk value is greater than or equal to the second value, the corresponding operational behavior data is determined to be high-risk.

[0097] As an example, the first value is less than the second value. For example, the first value is 0.3 and the second value is 0.7. Specific settings can be customized as needed, and this application does not impose specific limitations on the embodiments.

[0098] S603, basic desensitization.

[0099] Specifically, if the operational data is considered low-risk, basic anonymization is performed. Basic anonymization involves simply masking or replacing sensitive data to make it impossible to directly identify the original information. For example, replacing some information in personal information with the symbol "*". Replacing some numbers in contact phone numbers with fixed values ​​(such as the number 0).

[0100] S604, semantic generalization.

[0101] Specifically, if the operational behavior data is classified as medium risk, semantic generalization processing is performed. After basic anonymization processing, alarm information can also be generated. Semantic generalization refers to reducing the precision or scope of data while retaining its meaning but obscuring specific details. For example, numerical generalization simplifies a detailed address from "city, district, road" to "city," obscuring the specific district and road.

[0102] S605, Field Blocking.

[0103] Specifically, if the operational behavior data is high-risk, it will be blocked directly and an alert will be issued immediately. Field blocking refers to directly truncating or deleting sensitive fields, making them completely invisible. Truncating means retaining only the content of non-sensitive fields.

[0104] S606, output data.

[0105] Specifically, the data after performing basic desensitization, semantic generalization, or field blocking on the input data will be returned to the user or downstream system.

[0106] Through the above steps S601-S606, a graded response strategy is implemented based on the risk level.

[0107] In some embodiments, after step S106, the method further includes: after performing corresponding data control operations on the data entities in the operation, the method further includes: performing hash calculations on the data entities and corresponding data control operations in each operation within a predetermined time interval to obtain hash values; uploading the hash values ​​to the blockchain network; and confirming the validity of the evidence storage when the blockchain network confirms that a predetermined number of blocks have been reached.

[0108] For example, at predetermined intervals, such as every minute, a batch of data, namely the data entities in each operation and the corresponding data control operation, is hashed, the resulting hash value is uploaded to the blockchain, and the evidence is confirmed to be effective only after the number of blocks on the chain reaches a predetermined number (e.g., greater than or equal to 12), thereby preventing the evidence from becoming invalid due to blockchain forks and rollbacks.

[0109] Specifically, the resulting hash value can be the Merkle root hash value. The Merkle root hash value is the root node of the Merkle tree (hash tree), which is generated by calculating the hash values ​​of child nodes layer by layer, and is used to efficiently verify data integrity.

[0110] As an example, this system uses the FISCO-BCOS consortium blockchain, with a block generation time of 1 second and a confirmation time of approximately 12 seconds for 12 blocks, meeting the technical requirement of "immutability" for electronic evidence in relevant regulations. The blockchain network is deployed in a compliant cloud environment to ensure data security and the validity of judicial evidence. Automatic verification is implemented through smart contracts, allowing auditors to verify the completeness and authenticity of the stored records at any time.

[0111] In some scenarios, if a connection to a blockchain network is not possible, a trusted evidence report can be generated based on a Trusted Execution Environment (TEE). The vendor of the TEE can be selected according to actual needs; this application does not impose specific limitations on this option.

[0112] Figure 7 This diagram illustrates a module structure based on decision execution processing, as shown in an exemplary embodiment of this application. Figure 7 The system includes a strategy central module 710, a dynamic desensitization gateway 720, and a blockchain evidence storage module 730.

[0113] The strategy central module 710 is used to perform corresponding data control operations on data entities in operational behaviors based on security detection rules and comprehensive risk values. The dynamic de-identification gateway 720 is used to perform dynamic de-identification on the output data of the application system. The blockchain evidence storage module 730 is used to perform hash calculations on the data entities and corresponding data control operations in each operational behavior within a predetermined time interval to obtain hash values; upload the hash values ​​to the blockchain network; and confirm the evidence storage is effective when the blockchain network confirms that a predetermined number of blocks have been reached.

[0114] In this embodiment, basic data masking, semantic generalization, or field blocking processing is performed through a dynamic data masking gateway 720. The dynamic data masking gateway serves as the data security exit point for the application system, implementing precise data rewriting according to policy instructions. This module supports multi-level data masking strategies. Basic masking uses partial hiding to simply cover or replace sensitive data; semantic generalization transforms detailed information into category descriptions to reduce the precision or scope of the data; and field blocking completely blocks (truncates or deletes) sensitive content. The gateway can adopt a streaming processing architecture, intercepting and rewriting the data output by the response system in real time at the data exit point to ensure that sensitive information is not leaked.

[0115] In practical applications, in terms of performance optimization, when the gateway adopts a streaming processing architecture, under a stress test environment that processes billions of records per day, its latency can be controlled within 50 milliseconds and the CPU utilization rate is less than 20%, which can control the processing latency at the millisecond level.

[0116] The Blockchain Evidence Storage Module 730 provides tamper-proof audit trail capabilities through blockchain evidence storage processing, ensuring that all operations are traceable and verifiable. By uploading the Merkle root hash value generated from a batch of key security events and handling records to the blockchain, the immutability of distributed ledger technology guarantees the credibility of the evidence. As an example, the stored evidence includes a complete chain of information such as operation details, risk analysis process, and the basis for handling decisions.

[0117] Figure 8 This diagram illustrates the system architecture of a data security management system, as shown in an exemplary embodiment of this application. Figure 8 The system architecture includes: business system layer 810, security parallel aspect layer 820, intelligent analysis layer 830, and decision execution layer 840.

[0118] The business system layer 810 includes application processes and a database system. Application processes are the processes of various applications deployed and running within the application system, used to handle business logic and user interaction. The database is responsible for data storage, retrieval, and management.

[0119] like Figure 8 As shown, the secure parallel section layer 820 includes: a probe installer, section probes, a protocol parsing matrix, and a security assurance engine.

[0120] The probe installer is used to load configuration files to build a process feature library, identify and match target processes based on the feature library, and deploy aspect probes to target processes using dynamic injection technology. In some scenarios, the probe installer serves as the module's control hub, enabling full lifecycle management using a service-oriented architecture. This submodule is deployed as a background daemon process through the system package manager. Upon startup, it automatically loads configuration files and builds a target process feature library, including process name pattern matching rules, environment variable identifiers, and runtime feature identifiers. The aspect probes can act as data acquisition execution units, employing a modular architecture for multi-dimensional data capture. The protocol parsing matrix serves as a data standardization and transformation hub, using a streaming processing architecture for real-time data analysis. Specifically, it first identifies the protocol, then parses the data through the corresponding parsing pipeline, and finally outputs operational behavior data with a unified format. The security engine is used to build a comprehensive data protection system, ensuring the trustworthiness of the entire data acquisition and transmission process. Specifically, it employs multi-layered encryption strategies to encrypt operational behavior data with a unified format end-to-end.

[0121] like Figure 8 As shown, the intelligent analysis layer 830 includes: a spatiotemporal graph convolutional network (ST-GCN), a multi-module risk quantifier, a regulatory knowledge graph generator, and a dynamic rule generator.

[0122] Among them, the spatiotemporal graph convolutional network is used to construct a user-data entity interaction graph using spatiotemporal graph convolutional network technology, which is then used to detect abnormal behaviors in operational behavior data based on this interaction graph. The function of the multimodal risk quantifier can be found above. Figure 5 The functional description of the multimodal risk quantifier 502 is provided above. The functionality of the regulatory knowledge graph generator can be found in the above text. Figure 5 The description of the regulatory knowledge graph generator 503 is provided above. The functionality of the dynamic rule generator can be found in the previous text. Figure 5 Functional description of the dynamic rule generator 504.

[0123] like Figure 8 As shown, the decision execution layer 840 includes: a strategy central module, a dynamic de-identification gateway, and a blockchain evidence storage module. The decision execution layer 840 is used to translate analysis results into practical actions, achieving closed-loop management of risk disposal. This layer contains three execution modules, forming a complete chain from decision-making to execution and then to evidence storage. The functions of each execution module are referenced below. Figure 7 The functions of the corresponding modules will not be elaborated here.

[0124] In the data security management system of this application embodiment, an interaction graph between users and data entities is constructed based on the operational behavior data collected by the security parallel section. A graph neural network model is then used to analyze the historical operational behavior characteristics in the interaction graph to obtain anomaly quantification values ​​for each operational behavior data. Specifically, the security parallel section probe provides tamper-proof operation logs for the graph neural network, which identifies hidden violation patterns by analyzing the user-data entity interaction path. The fusion of the security parallel section and the graph neural network facilitates the detection of low-frequency, high-risk violations (such as access control crawling attacks) that are difficult to detect using traditional methods.

[0125] In a data security management system, a regulatory knowledge graph can be established and regulatory document updates can be automatically captured. New detection rules can be quickly generated through few-sample learning, and rule validity verification tests can be performed periodically (e.g., daily). Furthermore, for any operational behavior data, the comprehensive risk value of the operational behavior is determined by multiplying the corresponding anomaly metric, data sensitivity weight, and environmental risk coefficient. The anomaly metric is calculated by a graph neural network, such as a spatiotemporal graph convolutional network, which can comprehensively consider multi-dimensional features such as operation frequency, time distribution, and path deviation.

[0126] The data security management system according to embodiments of this application integrates unified data collection, behavioral feature analysis, risk assessment, and execution of data control operations into a single automated process. This breaks down data silos in related technologies, achieves cross-tool data barriers, and enables global awareness of compliance status. It automatically updates detection rules after relevant regulations change, avoiding delays caused by manual maintenance and enabling dynamic compliance adaptation. Furthermore, it can upload data entities and corresponding data control operations for each operational behavior within a predetermined timeframe to the blockchain, constructing a tamper-proof operation log system and establishing a causal relationship between data operations and compliance risks, enabling traceable and trustworthy behavior. Additionally, it utilizes a graph neural network model to analyze historical operational behavior characteristics in the interaction graph to obtain anomaly metrics for each operational behavior. Combining these anomaly metrics, data sensitivity weights, and environmental risk coefficients, it determines the comprehensive risk value for each operational behavior. This precise identification based on intelligent analysis, compared to static and broad rule matching in related technologies, can reduce the false alarm rate and effectively control it.

[0127] In the data security management system of this application embodiment, the training data used are all simulated attack data generated by internal penetration testing and do not contain any real personal information. The data collection and processing process complies with the requirements of data security regulations and personal information protection laws, and all data has been anonymized. Furthermore, this system crawls publicly available regulatory documents published on government websites, strictly adheres to the robots.txt protocol, and obtains data through the official website's data interface. The crawling frequency is controlled within a reasonable range to avoid burdening the target websites.

[0128] Corresponding to the application scenarios and methods provided in the embodiments of this application, the embodiments of this application also provide a data security management system. Figure 9 This diagram illustrates the structure of a data security management system according to an embodiment of this application. This system is used to execute the methods provided in any of the above embodiments, such as... Figure 9 As shown, the system includes the following modules.

[0129] The safety parallel section layer 910 is used to collect operational behavior data in the application system through safety parallel section technology; The intelligent analysis layer 920 is used to construct an interaction graph between users and data entities based on operational behavior data. The interaction graph is used to represent: the historical operational behavior characteristics of any user to the accessed data entities; the historical operational behavior characteristics in the interaction graph are analyzed using a graph neural network model to obtain the anomaly quantification value of each operational behavior data; for any operational behavior data, the comprehensive risk value of the operational behavior is determined according to the anomaly quantification value, the data sensitivity weight of the corresponding data entity, and the environmental risk coefficient when the operation occurred; and corresponding security detection rules are generated based on the regulatory knowledge graph and the comprehensive risk value. The decision execution layer 930 is used to perform corresponding data control operations on data entities in operational behaviors based on security detection rules and comprehensive risk values.

[0130] In some embodiments, when the secure parallel aspect layer 910 is used to collect operational behavior data in an application system through secure parallel aspect technology, it is specifically used to: deploy the probe installer as a background daemon process through the system package manager and start the probe installer; load the configuration file using the probe installer to establish a target process feature library based on the feature information of each target process contained in the configuration file; identify the target processes in the application system based on the process feature library; deploy aspect probes to the target processes through dynamic injection technology; and collect data operation behavior data in the application system through aspect probes running inside the target processes.

[0131] In some embodiments, the intelligent analysis layer 920, when determining the comprehensive risk value of an operation based on the anomaly quantification value, the data sensitivity weight of the corresponding data entity, and the environmental risk coefficient at the time of the operation, specifically performs the following: determining the data sensitivity weight of the corresponding data entity based on a predetermined classification rule, wherein the predetermined classification rule is used to characterize different levels of data sensitivity; determining the environmental risk coefficient based on at least one of the operation time, geographical location, and device type of the operation, wherein the geographical location is used to characterize the network area of ​​the request source of the operation, and the device type is used to characterize the network environment type at the time the operation is initiated; and generating the comprehensive risk value of the operation based on the product of the anomaly quantification value, the data sensitivity weight, and the environmental risk coefficient.

[0132] In some embodiments, the intelligent analysis layer 920, when used to generate corresponding security detection rules based on a regulatory knowledge graph and a comprehensive risk value, is specifically used to: construct a regulatory knowledge graph based on regulatory documents collected from the network, the regulatory knowledge graph being used to store structured regulatory clauses; and generate corresponding security detection rules based on the regulatory clauses and the comprehensive risk value through few-sample learning.

[0133] In some embodiments, the decision execution layer 930, when performing corresponding data control operations on data entities in operational behaviors based on security detection rules and comprehensive risk values, is specifically used for: acquiring log data from the application system; identifying non-compliant behaviors in the log data based on security detection rules; executing handling strategies corresponding to the non-compliant behaviors; determining risk levels based on comprehensive risk values; and executing graded response strategies corresponding to the risk levels, wherein the graded response strategies include at least one of the following strategies: data desensitization, data generalization processing and generating alarm information, and blocking data operations and generating alarm information.

[0134] In some embodiments, the system further includes: a decision execution layer, configured to perform corresponding data control operations on the data entities in the operation behavior, and then perform hash calculations on the data entities and corresponding data control operations in each operation behavior within a predetermined time interval to obtain hash values; upload the hash values ​​to the blockchain network; and confirm the validity of the evidence storage when the blockchain network confirms that a predetermined number of blocks have been reached.

[0135] The functions of each module in each device in the embodiments of this application can be found in the corresponding description in the above method, and they have corresponding beneficial effects, which will not be repeated here.

[0136] According to the data security management system of this application embodiment, the various modules of the system can achieve efficient collaboration through standardized interfaces, forming a complete closed loop of perception-analysis-decision-execution. The security parallel aspect layer provides high-quality data input to the intelligent analysis layer, the intelligent analysis layer provides accurate analysis results to the decision execution layer, and the decision execution layer feeds back the handling effect to the intelligent analysis layer for model optimization. The system also establishes a continuous learning mechanism, continuously optimizing the analysis model and security rules by collecting handling effect data and new attack patterns. When a new attack method is discovered, the system automatically generates training samples and triggers model retraining; when regulations and policies are updated, the system adjusts the detection rules and handling strategies in a timely manner. This self-evolution capability enables the system to adapt to constantly changing security threats and compliance requirements. Based on the above design, this application embodiment implements a complete data compliance governance solution, significantly improving the level of data security protection and compliance management efficiency.

[0137] Figure 10 This is a block diagram of an electronic device used to implement embodiments of this application. For example... Figure 10 As shown, the electronic device includes a memory 1001 and a processor 1002. The memory 1001 stores a computer program that can run on the processor 1002. When the processor 1002 executes the computer program, it implements the method described in the above embodiments. The number of memories 1001 and processors 1002 can be one or more. In a specific implementation, the electronic device may also include a communication interface 1003 for communicating with external devices and performing data exchange and transmission.

[0138] In practical implementation, if the memory 1001, processor 1002, and communication interface 1003 are implemented independently, they can be interconnected via a bus to communicate with each other. This bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. This bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 10 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0139] Optionally, in a specific implementation, if the memory 1001, processor 1002 and communication interface 1003 are integrated on a single chip, the memory 1001, processor 1002 and communication interface 1003 can communicate with each other through an internal interface.

[0140] This application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the method provided in this application.

[0141] This application provides a computer program product, including a computer program that, when executed by a processor, implements the method provided in this application.

[0142] This application also provides a chip including a processor for calling and executing instructions stored in a memory, causing a communication device with the chip installed to perform the method provided in this application.

[0143] This application also provides a chip, including: an input interface, an output interface, a processor, and a memory. The input interface, output interface, processor, and memory are connected through an internal connection path. The processor is used to execute code in the memory. When the code is executed, the processor is used to execute the method provided in the application embodiment.

[0144] It should be understood that the aforementioned processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. General-purpose processors can be microprocessors or any conventional processor. It is worth noting that the processor can be a processor supporting Advanced Reduced Instruction Set Machines (ARM) architecture.

[0145] Further, optionally, the aforementioned memory may include read-only memory and random access memory. The memory may be volatile memory or non-volatile memory, or may include both. Non-volatile memory may include read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory may include random access memory (RAM), which serves as an external cache. By way of example, but not limitation, many forms of RAM are available. Examples include Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDR SDRAM), Enhanced Synchronous DRAM (ESDRAM), Sync Link DRAM (SLDRAM), and Direct Rambus RAM (DR RAM).

[0146] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions according to this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another.

[0147] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of those different embodiments or examples.

[0148] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "a plurality of" means two or more, unless otherwise explicitly specified.

[0149] Any process or method described in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process. Furthermore, the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functionality involved.

[0150] The logic and / or steps described in the flowchart or otherwise herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus or device (such as a computer-based system, a processor-included system or other system that can fetch and execute instructions from, an instruction execution system, apparatus or device).

[0151] It should be understood that various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. All or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware, the program being stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiments.

[0152] Furthermore, the functional units in the various embodiments of this application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. This storage medium can be a read-only memory, a disk, or an optical disk, etc.

[0153] The above are merely exemplary embodiments of this application, but the scope of protection of this application is not limited thereto. Any person skilled in the art can easily conceive of various variations or substitutions within the technical scope described in this application, and these should all be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.< / action> < / value> < / operator> < / attribute> < / entity> < / condition> < / action> < / condition> < / rule>

Claims

1. A data security management method, characterized in that, The method includes: The system uses a safe parallel section technology to collect operational behavior data from the application system. Based on the operational behavior data, an interaction graph between users and data entities is constructed. The interaction graph is used to characterize the historical operational behavior features of any user on the accessed data entities. The graph neural network model is used to analyze the historical operation behavior characteristics in the interaction graph to obtain the abnormality quantification value of each operation behavior data; For any operational behavior data, the comprehensive risk value of the operational behavior is determined based on the anomaly quantification value, the data sensitivity weight of the corresponding data entity, and the environmental risk coefficient at the time of the operation. Based on the regulatory knowledge graph and the comprehensive risk value, corresponding security detection rules are generated; Based on the security detection rules and the comprehensive risk value, corresponding data control operations are performed on the data entities in the operation.

2. The method according to claim 1, characterized in that, The method of collecting operational behavior data in the application system through safe parallel slicing technology includes: Deploy the probe installer as a background daemon using the system package manager, and then start the probe installer. The probe installer is used to load a configuration file to establish a target process feature database based on the feature information of each target process contained in the configuration file. The target process in the application system is identified based on the process feature library; The facet probe is deployed to the target process using dynamic injection technology; By using a section probe running within the target process, data manipulation behavior data of the application system is collected.

3. The method according to claim 1, characterized in that, The step of determining the comprehensive risk value of the operation based on the anomaly quantification value, the data sensitivity weight of the corresponding data entity, and the environmental risk coefficient at the time of the operation includes: Based on predetermined classification rules, the data sensitivity weights of the corresponding data entities are determined, and the predetermined classification rules are used to characterize different levels of data sensitivity. The environmental risk coefficient is determined based on at least one of the operation time, geographical location, and device type of the operation behavior, wherein the geographical location is used to characterize the network area of ​​the request source of the operation behavior, and the device type is used to characterize the network environment type when the operation behavior is initiated. The comprehensive risk value of the operation is generated by multiplying the anomaly quantification value, the data sensitivity weight, and the environmental risk coefficient.

4. The method according to claim 1, characterized in that, The generation of corresponding security detection rules based on the regulatory knowledge graph and the comprehensive risk value includes: A legal knowledge graph is constructed based on legal documents collected from the internet, and the legal knowledge graph is used to store structured legal clauses; Based on the aforementioned regulatory provisions and the aforementioned comprehensive risk value, corresponding safety detection rules are generated through few-sample learning.

5. The method according to claim 1, characterized in that, The step of performing corresponding data control operations on data entities in the operational behavior based on the security detection rules and the comprehensive risk value includes: Obtain log data from the application system; Based on the security detection rules, non-compliant behaviors in the log data are identified; Implement the corresponding handling strategy for the aforementioned non-compliant behavior; The risk level is determined based on the comprehensive risk value; Implement a graded response strategy corresponding to the risk level, wherein the graded response strategy includes at least one of the following strategies: data anonymization, data generalization processing and generation of alarm information, and blocking data operations and generating alarm information.

6. The method according to claim 1, characterized in that, After performing the corresponding data control operations on the data entities in the operation, the method further includes: At predetermined intervals, hash calculations are performed on the data entities and corresponding data control operations in each operation within the predetermined interval to obtain hash values. Upload the hash value to the blockchain network; Once the blockchain network confirms that the predetermined number of blocks has been reached, the certificate of authenticity is confirmed to be valid.

7. A data security management system, characterized in that, The system includes: The secure parallel section layer is used to collect operational behavior data from the application system using secure parallel section technology. The intelligent analysis layer is used to construct an interaction graph between users and data entities based on the operational behavior data. This interaction graph represents: the historical operational behavior characteristics of any user towards the accessed data entities; it analyzes the historical operational behavior characteristics in the interaction graph using a graph neural network model to obtain anomaly metrics for each operational behavior data; for any operational behavior data, it determines the comprehensive risk value of the operational behavior based on the anomaly metrics, the data sensitivity weight of the corresponding data entity, and the environmental risk coefficient at the time of the operation; and it generates corresponding security detection rules based on the regulatory knowledge graph and the comprehensive risk value. The decision execution layer is used to perform corresponding data control operations on the data entities in the operation behavior based on the security detection rules and the comprehensive risk value.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory, wherein the processor, when executing the computer program, implements the method of any one of claims 1 to 6.

9. A computer-readable storage medium storing a computer program that, when executed by a processor, implements the method of any one of claims 1 to 6.

10. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1 to 6.

Images