Privacy-Preserving Data Mining and Behavior Recognition Methods Based on Machine Learning

Abstract

This invention relates to the field of data mining and behavior recognition technology, specifically to a privacy-preserving data mining and behavior recognition method based on machine learning. This invention assesses the gradient sensitivity of each network layer of a target machine learning model to obtain a privacy leakage risk score and determine the privacy protection level of each layer. Based on Rényi differential privacy, it dynamically allocates a privacy budget for each network layer according to the privacy protection level. A gradient masking mechanism is used to add noise matching the privacy budget to the gradients of each layer, preserving key gradients and completing model training. The behavior data to be recognized is then anonymized and input into the trained model to perform behavior recognition. This achieves differentiated privacy protection for each network layer and dynamic adaptation to the model training process, and is adaptable to various behavior recognition scenarios.

Description

Technical Field

[0001] This invention relates to the field of data mining and behavior recognition technology, specifically to a privacy-preserving data mining and behavior recognition method based on machine learning. Background Technology

[0002] Currently, machine learning technology has been widely applied in the fields of privacy-preserving data mining and behavior recognition. With the continuous improvement of privacy compliance requirements, the need to protect privacy information such as facial features, core device parameters, and user operation trajectories contained in behavioral data is becoming increasingly urgent.

[0003] However, most existing privacy protection methods adopt a uniform protection strategy, which does not fully consider the differences in privacy sensitivity of each network layer (input layer, feature extraction layer, feature fusion layer, classification layer) of the machine learning model, and cannot dynamically adapt to the dynamic changes in gradient distribution during model training. They also lack targeted and differentiated protection designs. This deficiency directly leads to existing methods either having insufficient privacy protection and a high risk of privacy leakage, failing to effectively avoid privacy leakage risks such as gradient inversion, or causing excessive loss of model accuracy due to over-protection, affecting the accuracy and reliability of behavior recognition. They are unable to balance privacy compliance requirements and behavior recognition performance, and cannot meet the core needs of practical applications.

[0004] To address the aforementioned shortcomings, a technical solution is provided. Summary of the Invention

[0005] To address the aforementioned shortcomings of existing technologies, this invention provides a privacy-preserving data mining and behavior recognition method based on machine learning. This method effectively solves the problems of insufficient privacy protection, high risk of privacy leakage, and difficulty in balancing privacy compliance requirements and behavior recognition performance caused by the lack of specificity and inability to dynamically adapt to the model training process in existing privacy protection methods.

[0006] To achieve the above objectives, the present invention can be implemented through the following technical solutions:

[0007] This invention provides a privacy-preserving data mining and behavior recognition method based on machine learning, comprising the following steps:

[0008] Gradient sensitivity assessment is performed on each network layer of the target machine learning model to obtain a privacy leakage risk score, thereby determining the privacy protection level of each network layer;

[0009] Based on the privacy protection level, the privacy budget is dynamically allocated to each network layer according to Rényi differential privacy.

[0010] A gradient masking mechanism is used to add noise to the gradients of each network layer that matches the dedicated privacy budget, while retaining key gradient information to complete the training of the target machine learning model;

[0011] The behavioral data to be identified is input into the trained target machine learning model to perform behavior recognition and result preprocessing.

[0012] Furthermore, in the gradient sensitivity evaluation process, a time series model or a spatiotemporal joint model is selected as the target machine learning model;

[0013] The target machine learning model is divided into different network layers according to functional modules, including the input layer, feature extraction layer, feature fusion layer and classification layer. The privacy sensitivity of each network layer is different. Among them, the input layer has the highest privacy sensitivity, the classification layer has the lowest privacy sensitivity, and the privacy sensitivity of the feature extraction layer and the feature fusion layer is between that of the input layer and the classification layer.

[0014] Furthermore, during the gradient sensitivity evaluation process, a typical dataset corresponding to the behavior recognition scenario is selected, and the typical dataset is divided into a training set and a validation set. The training set must contain a set amount of privacy-sensitive samples, which may include behavioral data containing personal identity information and operational data containing core device parameters.

[0015] The samples from the training set are input into the target machine learning model. The gradient matrix of each network layer is calculated through the backpropagation algorithm. Then, the L2 norm of the gradient matrix of each network layer is calculated to obtain the L2 norm of the gradient of each network layer.

[0016] A privacy leakage risk coefficient is introduced, and the privacy leakage risk score of each network layer is calculated by combining the L2 norm of the gradient of each network layer and the correlation between each network layer and the original privacy data.

[0017] Based on the comparison between the privacy leakage risk scores of each network layer and the set high-sensitivity and low-sensitivity thresholds, the privacy protection level of each network layer is determined. The privacy protection levels include high protection level, medium protection level and low protection level.

[0018] Furthermore, during the dynamic allocation of the privacy budget, the core parameters of Rényi differential privacy are set, including the overall privacy budget and the privacy budget allocation weights;

[0019] Based on the privacy protection level of each network layer and its corresponding privacy budget allocation weight range, the initial allocation weight of each network layer is determined.

[0020] By combining the overall privacy budget with the initial allocated weights of each network layer, the initial privacy budget of each network layer is calculated, where the sum of the initial privacy budgets of all network layers equals the overall privacy budget.

[0021] During each iteration of training of the target machine learning model, the privacy budget allocation weights of each network layer are dynamically adjusted by combining the privacy leakage risk score and privacy protection level of each network layer. If the privacy leakage risk score increases, the corresponding weight and dedicated privacy budget are increased; if the privacy leakage risk score decreases, the corresponding weight and dedicated privacy budget are decreased. The dedicated privacy budget of each network layer is recalculated based on the adjusted weights, and upper and lower limits of the dedicated privacy budget of each privacy protection level network layer are set.

[0022] Furthermore, in the implementation of the gradient masking mechanism, a binary gradient mask matrix with the same dimension as the gradient matrix of each network layer is constructed. The absolute value of each gradient value in the gradient matrix of each network layer is calculated and sorted according to the size of the absolute value. The top K% of gradients are selected as key gradients. In the gradient mask matrix, the position corresponding to the key gradient is set to 1, and the position corresponding to the non-key gradient is set to 0. This is used to filter and retain key information in the gradient and mask redundant gradients. The gradient mask matrix is ​​updated synchronously with each iteration of the model to adapt to the dynamic changes in the gradient distribution.

[0023] Furthermore, a gradient masking mechanism is used to add noise matching the dedicated privacy budget to the gradients of each network layer and complete the model training. The specific implementation process is as follows:

[0024] Based on the privacy budget of each network layer, an appropriate noise distribution is selected, and a random noise matrix negatively correlated with the privacy budget strength is generated. The random noise matrix is ​​added to the original gradient matrix of the corresponding network layer to obtain the gradient matrix with added noise. Then, the gradient mask matrix is ​​multiplied by the gradient matrix with added noise to obtain the mask gradient matrix. This mask gradient matrix retains only the key gradient information and masks redundant gradients. Based on the mask gradient matrix, the backpropagation algorithm is used to update the model parameters of each network layer. The process of gradient masking, noise addition, and parameter updating is repeated until the model converges. The trained target machine learning model is then saved.

[0025] Furthermore, the behavioral data to be identified is input into the trained target machine learning model to perform behavioral recognition and result preprocessing. The specific implementation process is as follows:

[0026] First, the original behavioral data to be identified is lightly anonymized to shield or obscure the privacy information to avoid leakage of the original privacy data. The anonymized data is then input into the trained target machine learning model. The output of each network layer is calculated through the forward propagation algorithm, and the probability value of each behavioral category is output by the classification layer.

[0027] The behavior classification result is determined according to the preset classification probability threshold. Specifically, if the probability value corresponding to a certain behavior is greater than or equal to the preset classification probability threshold, the behavior category is output. If the probability value of all behavior categories is less than the preset classification probability threshold, the unknown behavior is output.

[0028] The determined behavior classification results are subjected to secondary privacy desensitization processing to mask potential privacy-related information and output only behavior classification results with no risk of privacy leakage.

[0029] Furthermore, during the behavior recognition and result preprocessing process, the identified behavior classification results undergo secondary privacy desensitization processing to mask potential privacy-related information and output only classification results without privacy leakage risks. At the same time, the desensitized classification results are encrypted and stored, and an access control mechanism is established to allow only authorized users to access them.

[0030] The technical solution provided by this invention has the following advantages compared with the known prior art:

[0031] 1. This invention evaluates the gradient sensitivity of each network layer of the target machine learning model, clarifies the differences in privacy sensitivity of each network layer (input layer, feature extraction layer, feature fusion layer, classification layer), and classifies different privacy protection levels accordingly. Precise protection is then implemented for each level, avoiding the defects of over-protection of low-sensitivity network layers and insufficient protection of high-sensitivity network layers. This achieves differentiated and precise privacy protection for each network layer of the model, effectively reducing the risk of privacy leakage and balancing the targetedness and rationality of privacy protection.

[0032] 2. In each iteration of model training, this invention re-evaluates gradient sensitivity, dynamically adjusts privacy protection level and privacy budget allocation weights, and synchronously updates the gradient mask matrix. This ensures that the privacy protection strategy always matches the actual privacy leakage risk of each network layer, guaranteeing the protection strength of high privacy risk network layers while avoiding the waste of model accuracy caused by over-protection. This achieves a dynamic balance between privacy protection and model training accuracy, improving model practicality and the reliability of privacy protection.

[0033] 3. This invention combines Rényi differential privacy for dynamic allocation of the privacy budget with gradient masking and noise addition strategies. While preserving key gradient information and ensuring model training effectiveness, it also enhances privacy protection capabilities, thereby achieving a dual improvement in privacy protection and model performance. This effectively avoids the risk of privacy leakage and ensures that the model can converge stably and accurately complete behavior recognition and data mining tasks. Attached Figure Description

[0034] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0035] Figure 1 This is a flowchart illustrating the overall process of the present invention. Detailed Implementation

[0036] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0037] like Figure 1 As shown, this invention discloses a privacy-preserving data mining and behavior recognition method based on machine learning, comprising the following steps:

[0038] Step 1: Evaluate the gradient sensitivity of each network layer of the target machine learning model to obtain a privacy leakage risk score, thereby determining the privacy protection level of each network layer. The specific implementation steps are as follows:

[0039] To meet the application requirements of privacy-preserving data mining and behavior recognition, the target machine learning model selected in this solution must be suitable for feature extraction and classification of behavioral data, with time series models being the preferred choice.

[0040] The models can be either temporal or spatiotemporal joint models. Temporal models include, but are not limited to, LSTM (Long Short-Term Memory), GRU (Gated Recurrent Unit), and Transformer models; spatiotemporal joint models include, but are not limited to, 3D-CNN (3D Convolutional Neural Network) and Two-StreamCNN (Two-Stream Convolutional Neural Network). These models can effectively process various types of behavioral data, such as video, sensor time-series streams, and user operation logs, to achieve accurate extraction and classification of behavioral features.

[0041] To achieve differentiated privacy protection for each network layer, the target machine learning model needs to be divided into different network layers according to functional modules, including the input layer, feature extraction layer, feature fusion layer, and classification layer.

[0042] It should be noted that the input layer receives raw behavioral data, which includes, but is not limited to, video frames, sensor timing data, and user operation sequences. Since the gradient of the input layer is directly related to raw privacy information, this raw privacy information includes, but is not limited to, facial features, user operation trajectories, and device operating status. Therefore, the input layer is a high-risk point for privacy leakage.

[0043] The feature extraction layer comprises CNN convolutional layers and LSTM hidden layers. Its core function is to extract spatial and temporal features from behavioral data. Spatial features include, but are not limited to, human pose contours and device appearance features; temporal features include, but are not limited to, behavioral sequence variation patterns and device state fluctuation trends. The gradient of the feature extraction layer contains the core features of the behavioral pattern. Its privacy sensitivity is lower than that of the input layer but higher than that of the subsequent feature fusion and classification layers.

[0044] The feature fusion layer is used to fuse multimodal behavioral features, which include, but are not limited to, visual features, temporal features, sensor features, and operation log features. The gradient of the feature fusion layer contains the correlation information of different modal features, and its privacy sensitivity is at a moderate level.

[0045] The classification layer adopts a fully connected layer structure. Its core function is to output behavior classification results, which include, but are not limited to, normal behavior, abnormal behavior, and specific behavior categories. The gradient of the classification layer is mainly associated with the behavior classification logic and has the lowest correlation with the original privacy information, so its privacy sensitivity is the lowest.

[0046] Select typical datasets corresponding to behavior recognition scenarios. Typical datasets include, but are not limited to, the human behavior recognition dataset UCF101, the user operation log dataset, and the industrial equipment behavior dataset.

[0047] Typical datasets are divided into training and validation sets. The training set must contain a set number of privacy-sensitive samples, including but not limited to behavioral data containing personally identifiable information and operational data containing core device parameters, to ensure that the gradient sensitivity assessment can accurately reflect the risk of privacy leakage.

[0048] Input the samples from the training set into the target machine learning model, and calculate the gradient matrix of each network layer using the backpropagation algorithm. Let the gradient matrix of the i-th layer be... The gradient matrix of the network layer is ; Calculate the L2 norm of the gradient matrix of each network layer to obtain the L2 norm of the gradient of each network layer. The formula for calculating the L2 norm is: .in, For the first Layer The gradient values ​​of each parameter. For the first The larger the total number of parameters in a network layer and the larger the L2 norm of the gradient, the greater the influence of the network layer parameters on the model output, and the higher the corresponding risk of privacy leakage.

[0049] Introducing a privacy breach risk factor By combining the L2 norm of the gradients of each network layer and the correlation between each network layer and the original privacy data, a privacy leakage risk score for each network layer is calculated. The formula for calculating its privacy breach risk score is as follows: .in, For the first The correlation between the network layer and the raw privacy data is specifically defined as follows: Input layer Feature extraction layer The value range is 0.7~0.9, feature fusion layer The value range is 0.4~0.6, classification layer The value range is 0.1 to 0.3. The weighting coefficient ranges from 0.6 to 0.8, prioritizing the dominant role of the gradient norm in the privacy breach risk score to ensure that the assessment results accurately reflect the differences in privacy breach risk at each layer.

[0050] Two thresholds for gradient sensitivity are set: a high sensitivity threshold T1 and a low sensitivity threshold T2. The formula for calculating the high sensitivity threshold T1 is as follows: The formula for calculating the low sensitivity threshold T2 is: , This represents the maximum value of the privacy leakage risk score for all network layers. The threshold setting can be adaptively adjusted according to the needs of the application scenario to ensure that the privacy protection level of each network layer can be accurately classified.

[0051] Based on the privacy breach risk score of each network layer The privacy protection level of each network layer is determined by comparing the results with the previously set high-sensitivity threshold T1 and low-sensitivity threshold T2. The privacy protection levels include high protection level, medium protection level, and low protection level. The specific steps for this classification are as follows:

[0052] When the privacy breach risk score of a certain network layer meets the following: If the value is ≥T1, then the network layer is determined to be of a high protection level.

[0053] When the privacy leakage risk score of a certain network layer satisfies: T2 < If the value is less than T1, then the network layer is classified as medium protection level.

[0054] When the privacy breach risk score of a certain network layer meets the following: If the value is less than or equal to T2, then the network layer is classified as having a low protection level.

[0055] It should be noted that the gradient sensitivity assessment in this scheme is not completed in one go; it is performed at the target...

[0056] During each iteration of training a machine learning model, the gradient matrix, L2 norm of the gradient, and privacy risk score of each network layer are recalculated. The privacy protection level of each network layer is dynamically adjusted based on the recalculation results. This adapts to the dynamic changes in gradient distribution during model training, avoiding privacy protection failure or model accuracy waste caused by gradient drift, and ensuring that the privacy protection strategy always matches the actual privacy risk of each network layer.

[0057] Step 2: Based on the privacy protection level, dynamically allocate the privacy budget for each network layer using Rényi differential privacy. The specific implementation steps are as follows:

[0058] Set the core parameters for Rényi Differential Privacy (RDP). The core parameters mainly include the overall privacy budget. And the weighting of privacy budget allocation The specific settings for its core parameters are as follows:

[0059] Overall privacy budget This is the total privacy budget available during the entire behavior recognition model training process. Its value is set according to the privacy compliance requirements of the actual application scenario, and the range is 3.0 to 8.0. Reasonable values ​​within this range are preferred. This value can meet the requirements of strong privacy protection and comply with relevant privacy compliance standards, while effectively avoiding the loss of model accuracy due to excessively high overall privacy budget, thus achieving an initial balance between privacy protection and model accuracy.

[0060] Privacy budget allocation weight This weight is used to characterize the allocation ratio of each network layer in the overall privacy budget. It is set based on the privacy protection level of each network layer determined in step one. Different privacy protection levels correspond to different weight ranges, and the sum of the privacy budget allocation weights of all network layers is 1. Specifically, the weight range is set as follows: Privacy budget allocation weight for network layers with higher protection levels... The value ranges from 0.5 to 0.6, representing the privacy budget allocation weights for the intermediate protection level network layer. The value ranges from 0.3 to 0.4, representing the privacy budget allocation weight for low-protection-level network layers. With a value range of 0.1 to 0.2, this weight setting ensures that network layers with high privacy leakage risk receive more privacy budgets, achieving precise and differentiated privacy protection.

[0061] After completing the core parameter settings for Rényi Differential Privacy (RDP), based on the privacy budget splitting rules of Rényi Differential Privacy (RDP) and combined with the privacy budget allocation weights for each network layer determined above, Calculate the dedicated privacy budget for each network layer. This enables tiered and dynamic allocation of the privacy budget. The specific allocation process is as follows:

[0062] Based on the privacy protection level of each network layer and its corresponding privacy budget allocation weight range, the initial allocation weights for each network layer are determined. As a preferred embodiment, the initial weight allocation for the high-protection-level network layer can be set to 0.55, the initial weight allocation for the medium-protection-level network layer can be set to 0.35, and the initial weight allocation for the low-protection-level network layer can be set to 0.1, ensuring that the initial weight allocation conforms to the principle of "high risk, high weight; low risk, low weight", and that the sum of the initial weights of all network layers is 1.

[0063] Based on the overall privacy budget Initial weight allocation for each network layer Calculate the initial privacy budget for each network layer The calculation formula is as follows: .

[0064] The calculation process must strictly ensure that the sum of the initial privacy budgets of all network layers equals the overall privacy budget. This is to avoid problems such as wasted privacy budgets or unbalanced allocation.

[0065] Because the gradient sensitivity of each network layer changes after each iteration of model training, corresponding to

[0066] The privacy risk score will rise or fall accordingly, so it is necessary to dynamically adjust the privacy budget allocation weights at each layer, and then recalculate the dedicated privacy budget to ensure that the budget allocation always matches the actual privacy risk at each layer. The specific calculation steps are as follows:

[0067] During each iteration of training of the target machine learning model, the privacy budget allocation weights of each network layer are dynamically adjusted by combining the privacy leakage risk score and privacy protection level of each network layer. The specific adjustment rules are as follows:

[0068] If the privacy breach risk score of a certain network layer increases (i.e., the gradient sensitivity of that layer increases, and the risk of privacy breach increases), then the privacy budget allocation weight of that network layer is increased. Accordingly, increase their dedicated privacy budget .

[0069] If the privacy risk score of a certain network layer decreases (i.e., the gradient sensitivity of that layer decreases, and the risk of privacy leakage decreases), then the privacy budget allocation weight of that network layer should be reduced. Accordingly, reduce their dedicated privacy budget. .

[0070] After adjustment, it is necessary to ensure that the sum of the weights allocated to all network layers is still 1, and that the weights allocated to each network layer are still within the weight range of the corresponding protection level (high protection 0.5~0.6, medium protection 0.3~0.4, low protection 0.1~0.2).

[0071] Adjust the privacy budget allocation weights for each network layer Substitute in and recalculate the dedicated privacy budget for each layer. The calculation formula is: ;in, For the adjusted number A dedicated privacy budget for each layer, The overall privacy budget remains unchanged from the initial setting. Assign weights to the dynamically adjusted privacy budget.

[0072] It should be noted that, to avoid extreme situations in privacy budget allocation, such as insufficient privacy budget for high-protection-level network layers or excessive loss of accuracy for low-protection-level network layers, a dedicated privacy budget is set for each privacy protection level network layer. Upper and lower limits of constraints. Among these, the dedicated privacy budget for high-level protection network layers. The value range is [1.0, 2.0], ensuring that network layers with high privacy leakage risk have sufficient privacy protection strength; the dedicated privacy budget for network layers with medium protection level. The value range is [0.8, 1.0], balancing privacy protection and model accuracy; a dedicated privacy budget for low-protection network layers. The value range is [0.5, 0.8], prioritizing model training accuracy and avoiding wasted accuracy due to excessively low privacy budget.

[0073] Step 3: Employ a gradient masking mechanism to add noise matching the dedicated privacy budget to the gradients of each network layer, preserving key gradient information to complete the training of the target machine learning model. The specific implementation steps are as follows:

[0074] For the gradient matrix of each network layer Construct a binary gradient mask matrix with the same dimensions as the gradient matrix. This is used to filter and retain key information in the gradients and mask redundant gradients. The specific construction method is as follows: calculate the absolute value of each gradient value in the gradient matrix of each network layer, sort them according to the size of the absolute value, and select the top K% of gradients as key gradients (K is the gradient retention ratio, set according to the privacy protection level: high protection level k=30%~40%, medium protection level k=50%~60%, low protection level k=70%~80%). Gradient mask matrix... In the model, the position corresponding to the critical gradient is set to 1 (meaning that the gradient is retained), and the position corresponding to the non-critical gradient is set to 0 (meaning that the gradient is masked). The gradient mask matrix is ​​updated synchronously with each iteration of the model, the gradients are reordered and the mask positions are adjusted to ensure that it always adapts to the dynamic changes in the gradient distribution and accurately retains the key gradient information.

[0075] Based on the privacy budgets for each network layer determined in step two. Select an appropriate noise distribution to generate a random noise matrix that matches the strength of the privacy budget. Noise intensity and dedicated privacy budget It is negatively correlated, that is The smaller the value (the stronger the need for privacy protection), the greater the noise intensity. The larger the value (the weaker the need for privacy protection), the lower the noise intensity. Specific noise distribution selection and parameter settings are as follows:

[0076] High-protection-level network layers use a Laplace distribution (stronger noise perturbation, better privacy protection), scale parameters (in For the first The global sensitivity of layer gradients, i.e. D and D * For datasets differing by only one sample; Gaussian distribution is used for medium and low protection levels of network layers (more uniform noise, reducing model accuracy loss), variance Where c is a preset safety factor, ranging from 1.0 to 1.5, with 1.2 being preferred; noise matrix. The dimension and the gradient matrix of the corresponding network layer Complete consistency ensures the effectiveness of noise addition.

[0077] The generated random noise matrix With the original gradient matrix of the corresponding network layer Perform addition to obtain the gradient matrix after adding noise. Subsequently, the gradient mask matrix is... Gradient matrix after adding noise To perform a dot product, follow the formula: The mask gradient matrix is ​​obtained. At this point, the mask gradient matrix retains only the key gradient information, while redundant gradients are masked and noise matching the privacy budget is added, thus achieving both privacy protection and avoiding distortion of key gradients.

[0078] Based on the mask gradient matrix The backpropagation algorithm is used to update the model parameters of each network layer. The above gradient masking, noise addition, and parameter update process is repeated until the model converges (the convergence condition is that the loss value of the validation set does not decrease for 10 consecutive rounds). The trained target machine learning model is then saved.

[0079] Step 4: Input the behavior data to be identified into the trained target machine learning model, and perform behavior recognition and result preprocessing. The specific implementation steps are as follows:

[0080] Lightweight anonymization processing is performed on the raw input data of the behavior to be identified, including but not limited to blurring faces in video frames, normalizing sensor data, and masking privacy fields in user operation logs, to prevent the raw privacy data from being directly input into the model and thus causing leakage.

[0081] The preprocessed data to be identified is input into the model, and the output of each network layer is calculated through the forward propagation algorithm. Finally, the probability value of each behavior category is output through the classification layer.

[0082] The behavior classification result is determined based on the preset classification probability threshold (preferably set to 0.8).

[0083] If the probability of a certain type of behavior is ≥0.8, then output the behavior category;

[0084] If the probability value of all behavior categories is less than 0.8, then output "Unknown behavior";

[0085] The determined behavior classification results undergo secondary privacy desensitization. If the classification results contain potential privacy information (such as behavior descriptions associated with personal identity or core device parameters), all privacy-related fields are masked, and only behavior classification results without privacy leakage risk are output (such as "normal behavior", "abnormal operation", "device operating normally", etc.). The desensitized behavior classification results are output to the corresponding terminals (such as monitoring platforms, device control terminals, and data management terminals). At the same time, the classification results are encrypted and stored using the AES-256 encryption algorithm, and an access control mechanism for the classification results is established, allowing only authorized users to access them, further eliminating the risk of privacy leakage and ensuring that the entire behavior recognition process complies with privacy compliance requirements.

[0086] A computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement any of the methods described above.

[0087] A computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements any of the methods described above.

[0088] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions will not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for privacy preserving data mining and behavior recognition based on machine learning, characterized in that, Includes the following steps: Gradient sensitivity assessment is performed on each network layer of the target machine learning model to obtain a privacy leakage risk score, thereby determining the privacy protection level of each network layer; Based on the privacy protection level, the privacy budget is dynamically allocated to each network layer according to Rényi differential privacy. A gradient masking mechanism is used to add noise to the gradients of each network layer that matches the dedicated privacy budget, while retaining key gradient information to complete the training of the target machine learning model; The behavioral data to be identified is input into the trained target machine learning model to perform behavior recognition and result preprocessing.

2. The privacy-preserving data mining and behavior recognition method based on machine learning according to claim 1, characterized in that, In the gradient sensitivity evaluation process, a time series model or a spatiotemporal joint model is selected as the target machine learning model. The target machine learning model is divided into different network layers according to functional modules, including the input layer, feature extraction layer, feature fusion layer and classification layer. The privacy sensitivity of each network layer is different. Among them, the input layer has the highest privacy sensitivity, the classification layer has the lowest privacy sensitivity, and the privacy sensitivity of the feature extraction layer and the feature fusion layer is between that of the input layer and the classification layer.

3. The privacy-preserving data mining and behavior recognition method based on machine learning according to claim 1, characterized in that, In the gradient sensitivity evaluation process, a typical dataset corresponding to the behavior recognition scenario is selected, and the typical dataset is divided into a training set and a validation set. The training set must contain a set amount of privacy-sensitive samples, which may include behavioral data containing personal identity information and operational data containing core device parameters. The samples from the training set are input into the target machine learning model. The gradient matrix of each network layer is calculated through the backpropagation algorithm. Then, the L2 norm of the gradient matrix of each network layer is calculated to obtain the L2 norm of the gradient of each network layer. A privacy leakage risk coefficient is introduced, and the privacy leakage risk score of each network layer is calculated by combining the L2 norm of the gradient of each network layer and the correlation between each network layer and the original privacy data. Based on the comparison between the privacy leakage risk scores of each network layer and the set high-sensitivity and low-sensitivity thresholds, the privacy protection level of each network layer is determined. The privacy protection levels include high protection level, medium protection level and low protection level.

4. The privacy-preserving data mining and behavior recognition method based on machine learning according to claim 1, characterized in that, During the dynamic allocation of the privacy budget, the core parameters of Rényi differential privacy are set, including the overall privacy budget and the privacy budget allocation weights. Based on the privacy protection level of each network layer and its corresponding privacy budget allocation weight range, the initial allocation weight of each network layer is determined. By combining the overall privacy budget with the initial weights allocated to each network layer, the initial privacy budget for each network layer is calculated, where the sum of the initial privacy budgets of all network layers equals the overall privacy budget. During each iteration of training of the target machine learning model, the privacy budget allocation weights of each network layer are dynamically adjusted by combining the privacy leakage risk score and privacy protection level of each network layer. If the privacy leakage risk score increases, the corresponding weight and dedicated privacy budget are increased; if the privacy leakage risk score decreases, the corresponding weight and dedicated privacy budget are decreased. The dedicated privacy budget of each network layer is recalculated based on the adjusted weights, and upper and lower limits of the dedicated privacy budget of each privacy protection level network layer are set.

5. The privacy-preserving data mining and behavior recognition method based on machine learning according to claim 1, characterized in that, In the implementation of the gradient masking mechanism, a binary gradient mask matrix with the same dimension as the gradient matrix of each network layer is constructed. The absolute value of each gradient value in the gradient matrix of each network layer is calculated and sorted according to the size of the absolute value. The top K% of gradients are selected as key gradients. In the gradient mask matrix, the position corresponding to the key gradient is set to 1, and the position corresponding to the non-key gradient is set to 0. This is used to filter and retain key information in the gradient and mask redundant gradients. The gradient mask matrix is ​​updated synchronously with each iteration of the model to adapt to the dynamic changes in gradient distribution.

6. The privacy-preserving data mining and behavior recognition method based on machine learning according to claim 1, characterized in that, A gradient masking mechanism is used to add noise matching the dedicated privacy budget to the gradients of each network layer and then train the model. The specific implementation process is as follows: Based on the privacy budget of each network layer, an appropriate noise distribution is selected, and a random noise matrix negatively correlated with the privacy budget strength is generated. The random noise matrix is ​​added to the original gradient matrix of the corresponding network layer to obtain the gradient matrix with added noise. Then, the gradient mask matrix is ​​multiplied by the gradient matrix with added noise to obtain the mask gradient matrix. This mask gradient matrix retains only the key gradient information and masks redundant gradients. Based on the mask gradient matrix, the backpropagation algorithm is used to update the model parameters of each network layer. The process of gradient masking, noise addition, and parameter updating is repeated until the model converges. The trained target machine learning model is then saved.

7. The privacy-preserving data mining and behavior recognition method based on machine learning according to claim 1, characterized in that, The behavior data to be identified is input into the trained target machine learning model to perform behavior recognition and result preprocessing. The specific implementation process is as follows: First, the original behavioral data to be identified is lightly anonymized to shield or obscure the privacy information to avoid leakage of the original privacy data. The anonymized data is then input into the trained target machine learning model. The output of each network layer is calculated through the forward propagation algorithm, and the probability value of each behavioral category is output by the classification layer. The behavior classification result is determined according to the preset classification probability threshold. Specifically, if the probability value corresponding to a certain behavior is greater than or equal to the preset classification probability threshold, the behavior category is output. If the probability value of all behavior categories is less than the preset classification probability threshold, the unknown behavior is output. The determined behavior classification results are subjected to secondary privacy desensitization processing to mask potential privacy-related information and output only behavior classification results with no risk of privacy leakage.

8. The privacy-preserving data mining and behavior recognition method based on machine learning according to claim 1, characterized in that, During the behavior recognition and result preprocessing process, the behavior classification results are subjected to secondary privacy desensitization to mask potential privacy-related information and output only classification results without privacy leakage risks. At the same time, the desensitized classification results are encrypted and stored, and an access control mechanism is established to allow only authorized users to access them.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the method steps of any one of claims 1 to 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method steps of any one of claims 1 to 8.

Images