A data recognition method and device

Abstract

The application provides a data identification method and device, and relates to the technical field of data processing. The method comprises the following steps: acquiring a data table; performing field identification on the data table; if the data table comprises a set field, determining that data corresponding to the set field in the data table is sensitive data; and for first to-be-identified data corresponding to a field other than the set field in the data table, performing identification processing on the first to-be-identified data by using an identification rule based on data content, so as to identify whether sensitive data exists in the first to-be-identified data. Thus, the speed and accuracy of sensitive data identification are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, and in particular to a data identification method and device. BACKGROUND

[0002] Data security is one of the important challenges of data application. With the increase of system users and the abuse of rights, the risk of data leakage is increasing. At present, many security products are mainly used to deal with threats from the outside, and lack effective identification and prevention of internal threats. Data, as the most core asset, contains a large amount of personal information such as mobile phone number, ID number, bank card number, address, and other important and sensitive information, so data security services are needed to better protect data.

[0003] In order to protect sensitive data, it is necessary to identify sensitive data first. Data identification is generally based on data identification rules to automatically discover sensitive fields in the existing tables in the system. The identification process is a matching process of the target table according to the set rules, which needs to match the content in the database by piece and record the identification results. That is, data identification is a particularly resource-consuming operation, so how to perform efficient identification is a common problem encountered by the current industry.

[0004] In the current sensitive data identification scheme, content-based identification rules are used to match all the contents in the database, that is, all the data, which will result in low identification efficiency and even large matching result errors.

[0005] Therefore, how to improve the identification efficiency and accuracy of sensitive data is one of the technical problems worth considering. SUMMARY

[0006] Therefore, the present application provides a data identification method and device to improve the identification efficiency and accuracy of sensitive data.

[0007] Specifically, the present application is implemented through the following technical solutions:

[0008] According to the first aspect of the present application, a data identification method is provided, comprising:

[0009] obtaining a data table;

[0010] performing field identification on the data table, and if the data table includes a set field, determining that the data corresponding to the set field in the data table is sensitive data;

[0011] for the first to be identified data corresponding to the fields other than the set field in the data table, using a data content-based identification rule to identify the first to be identified data to identify whether there is sensitive data in the first to be identified data.

[0012] According to a second aspect of the present application, a data identification apparatus is provided, comprising:

[0013] an acquisition module, configured to acquire a data table;

[0014] a first identification module, configured to perform field identification on the data table;

[0015] a first determination module, configured to determine that data corresponding to a set field in the data table is sensitive data if the first identification module identifies that the data table comprises the set field;

[0016] a second identification module, configured to, for first to-be-identified data corresponding to a field other than the set field in the data table, perform identification processing on the first to-be-identified data by using a data-content-based identification rule, to identify whether sensitive data exists in the first to-be-identified data.

[0017] According to a third aspect of the present application, an electronic device is provided, comprising a processor and a machine-readable storage medium, the machine-readable storage medium stores a computer program capable of being executed by the processor, and the processor is prompted by the computer program to execute the method provided in the first aspect of the present application.

[0018] According to a fourth aspect of the present application, a machine-readable storage medium is provided, the machine-readable storage medium stores a computer program, and when invoked and executed by a processor, the computer program prompts the processor to execute the method provided in the first aspect of the present application.

[0019] The beneficial effects of the embodiments of the present application are as follows:

[0020] The data identification method and apparatus provided in the embodiments of the present application. First, field identification is performed on a data table, and when it is identified that the data table comprises a set field, it can be directly determined that the data table comprises sensitive data, i.e., data corresponding to the set field included in the data table belongs to sensitive data. In this way, through field identification, data belonging to the set field does not need to be subjected to data content identification, and it can be identified that data corresponding to the set field belongs to sensitive data, thereby accelerating the sensitive data identification speed. Then, data corresponding to a field other than the set field in the data table is subjected to a data-content-based data identification process, to identify whether sensitive data exists in data corresponding to the field other than the set field in the data table, to avoid the occurrence of sensitive data missing identification, and at the same time, to realize the accuracy and integrity of sensitive data identification in the data table on the premise of improving the sensitive data identification speed. BRIEF DESCRIPTION OF DRAWINGS

[0021] Figure 1 is a flowchart of a data identification method provided in the embodiments of the present application;

[0022] Figure 2 is a structural schematic diagram of a data recognition device provided by an embodiment of the present application.

[0023] Figure 3 is a hardware structural schematic diagram of an electronic device for implementing a data recognition method provided by an embodiment of the present application. DETAILED DESCRIPTION

[0024] The exemplary embodiments will be described in detail herein with reference to the attached drawings. In the following description, the same numbers are used to indicate the same or similar elements, unless otherwise indicated. The embodiments described in the following exemplary embodiments are not meant to represent all embodiments consistent with the present application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the present application.

[0025] The terminology used in the present application is for the purpose of describing particular embodiments only and is not intended to be limiting of the present application. As used in the present application, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and / or "comprising," when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0026] It should be understood that, although the terms first, second, third, etc. can be used herein to describe various information, these terms are not intended to denote a particular order of the information. These terms are used only to distinguish one type of information from another. For example, a first information can be termed a second information, and similarly, a second information can be termed a first information, without departing from the scope of the present application. Depending on the context, the word "if' as used herein can be interpreted as meaning "when" or "in response to determining."

[0027] The data recognition method provided by the present application will be described in detail below.

[0028] Referring to Figure 1 , Figure 1 is a flowchart of a data recognition method provided by the present application, which can be applied to an electronic device in need of data recognition. The method can include the following steps:

[0029] S101, obtaining a data table.

[0030] In this step, the data table is a data table in a database in need of data recognition. In actual applications, it can be each data table in the database, or a data table having a set name in the database. The specific implementation can be determined according to actual conditions.

[0031] S102, field recognition is performed on the data table, and if the data table includes a set field, it is determined that the data corresponding to the set field in the data table is sensitive data.

[0032] In this step, the data table in the database is created by the user. When naming the fields of the data table, the user will name them according to the properties of the data to be written in the field. Specifically, in daily development, the table name and field name in the business library (which can be understood as the database in the present application, which can be any business library) are generally meaningful identifiers, such as sensitive data of the type name, ID number, home address (address), card number, etc. Therefore, the corresponding field of the data table can be directly named by type, for example, the name of the field 1 can be named as the name if the name needs to be written in the corresponding position of the field 1. Similarly, the field 2 can be named as the card number if the card number needs to be written in the corresponding position of the field 2. By analogy. In this way, the name field in the obtained data table indicates that the field can store the name subsequently, and the address field indicates that the field can store the home address subsequently. Since this type of naming has high recognition, the identification rule can be set based on the above naming with high recognition, that is, the above set field is set, and the data corresponding to the set field is sensitive data.

[0033] On this basis, after obtaining the data table, it can be judged whether the data table includes the set field. When it includes, it can be directly determined that the data table includes sensitive data, and the field including sensitive data can be directly identified. Specifically, after obtaining the data table, the fields in the data table and the above set field can be matched by using a regular expression to obtain the fields in the data table that match the set field. The matched field is the sensitive data, so as to achieve the purpose of quickly identifying the sensitive field. Moreover, the field identification method can avoid querying the real data in the data table, thereby reducing the database pressure and improving the sensitive data identification speed.

[0034] It is worth noting that the set fields corresponding to different data tables may be the same or different. Therefore, when configuring the set field, the set field can be set according to the sensitive field that may appear in the existing or pre-stored data table in the database, and then stored in a matching table. Then, when performing field recognition on the data table, each field in the data table is matched with the set field in the matching table. When the matching is successful, it indicates that the field is a sensitive field, that is, the data corresponding to the field belongs to sensitive data. Thus, the set field included in the data table, that is, the field including sensitive data, can be determined.

[0035] S103, for the first to be identified data corresponding to the field in the data table except the set field, the first to be identified data is identified by using the identification rule based on the data content, to identify whether there is sensitive data in the first to be identified data.

[0036] In this step, in order to avoid the sensitive data included in the data table being missed, the data corresponding to the field in the data table except the set field is further identified, that is, by setting some identification rules based on the data content in advance, when the first to be identified data needs to be identified, the first to be identified data can be identified by using the identification rule based on the data content, so as to identify whether there is sensitive data in the first to be identified data.

[0037] It should be noted that the above identification rule based on the data content is also preconfigured, which can be set according to the data characteristics of the data content, and then the identification rule with rich language and complex logic can be set by using regular expression, script language and the like. Then when the data identification based on the data content is needed, the identification rule can be called to identify whether the first to be identified data includes sensitive data.

[0038] By implementing the data identification method provided in the present application, the field identification is performed on the data table first, when the data table is identified to include the set field, it can be directly determined that the data table includes sensitive data, that is, the data corresponding to the set field included in the data table belongs to sensitive data. In this way, through the field identification, the data belonging to the set field does not need to be identified by the data content, and it can be identified that the data corresponding to the set field belongs to sensitive data, so as to speed up the sensitive data identification speed. Then the data identification based on the data content is performed on the data corresponding to the field in the data table except the set field, to identify whether there is sensitive data in the data corresponding to the field in the data table except the set field, so as to avoid the sensitive data missing identification, and at the same time, the accuracy and integrity of the sensitive data identification in the data table are ensured on the premise of improving the sensitive data identification speed.

[0039] Optionally, based on the above embodiment, the data identification method provided in the present embodiment further includes: if the data table does not include the set field, extracting second to be identified data of a first set data amount from the data table, the first set data amount being less than the total data amount of the data in the data table; identifying the second to be identified data by using the identification rule based on the data content; and when it is identified that the second to be identified data exists sensitive data, confirming whether the data table exists sensitive data.

[0040] Specifically, in order to quickly and accurately identify sensitive data based on the identification rule based on data content, the embodiment proposes that, when performing data identification, data not exceeding the total data amount of the data table is extracted from the data table, that is, the second to-be-identified data with the data amount being the first set data amount is extracted, and then the second to-be-identified data is identified by using the identification rule based on data content. When it is identified that the second to-be-identified data contains sensitive data, it is confirmed that the data table contains sensitive data. In this way, whether the data table contains sensitive data can be identified without traversing all the data in the data table, greatly improving the identification speed of sensitive data.

[0041] It should be noted that the specific value of the first set data amount can be configured according to actual conditions. In addition, when the second to-be-identified data with the first set data amount is extracted from the data table, it can be extracted on demand or randomly, and the embodiment does not limit this.

[0042] Optionally, based on any of the above embodiments, in the embodiment, step S103 can be performed according to the following process: extracting third to-be-identified data with a second set data amount from the first to-be-identified data, the second set data amount being less than the total data amount of the first to-be-identified data; identifying the third to-be-identified data by using the identification rule based on data content; when it is identified that the third to-be-identified data contains sensitive data, it is determined that the first to-be-identified data contains sensitive data; and when it is identified that the third to-be-identified data does not contain sensitive data, it is determined that the first to-be-identified data does not contain sensitive data.

[0043] Specifically, in order to quickly and accurately identify sensitive data based on the identification rule based on data content, the embodiment proposes that, when performing data identification, data not exceeding the total data amount of the data table is extracted from the data table, that is, the second to-be-identified data with the data amount being the first set data amount is extracted, and then the second to-be-identified data is identified by using the identification rule based on data content. When it is identified that the second to-be-identified data contains sensitive data, it is confirmed that the data table contains sensitive data. In this way, whether the data table contains sensitive data can be identified without traversing all the data in the data table, greatly improving the identification speed of sensitive data.

[0044] It should be noted that the specific value of the second set data amount can be configured according to actual conditions. In addition, when the third to-be-identified data of the second set data amount is extracted from the first to-be-identified data, it can be extracted as needed or randomly, and the embodiment does not limit this.

[0045] Further, in the embodiment, the first to-be-identified data is the data corresponding to each field of the data table except the set field, and the third to-be-identified data is extracted from the first to-be-identified data corresponding to the field. On this basis, the step of performing identification processing on the third to-be-identified data using the identification rule based on the data content can be performed according to the following process: matching each piece of third to-be-identified data using the identification rule based on the data content corresponding to the field; recording the first data amount of successful matching and the second data amount of failed matching respectively; when the first data amount of successful matching is not less than the first set data amount threshold, it is determined that the third to-be-identified data corresponding to the field contains sensitive data; when the second data amount of failed matching is greater than the second set data amount threshold, it is determined that the third to-be-identified data corresponding to the field does not contain sensitive data; wherein the sum of the first set data amount threshold and the second set data amount threshold is the second set data amount.

[0046] Specifically, when identifying the data of the fields except the set field, it is generally identified field by field. Specifically, the second set amount of third to-be-identified data is extracted from the first to-be-identified data corresponding to each field except the set field, and then each piece of third to-be-identified data is matched using the identification rule based on the data content corresponding to the field. Then, record the data amount of successful matching, denoted as the first data amount, and record the data amount of failed matching, denoted as the second data amount. Then, if it is determined that the first data amount is not less than the first set data amount threshold, it can be determined that the third to-be-identified data corresponding to the field contains sensitive data, and it is determined that the first to-be-identified data corresponding to the field contains sensitive data, and further it is determined that the field belongs to a sensitive field containing sensitive data, so that whether the field contains sensitive data is accurately identified, and at the same time, it is not necessary to match all the data of the field, which greatly improves the speed of sensitive data identification.

[0047] When the second data amount of failed matching is greater than the second set data amount threshold, it can be determined that the third to-be-identified data corresponding to the field does not contain sensitive data, and it is determined that the first to-be-identified data corresponding to the field does not contain sensitive data, i.e., the field does not belong to a sensitive field.

[0048] Specifically, when recording the first data quantity of successful matches and the second data quantity of failed matches based on the field matching, a first counter and a second counter can be set respectively, the first counter records the number of successful matches (the number of data of successful matches, i.e. the first data quantity described above), and the second counter records the number of failed matches (the number of data of failed matches, i.e. the second data quantity described above). On this basis, when a match is successful, the count of the first counter is incremented by 1, and when a match fails, the count of the second counter is incremented by 1. After each match, it is determined whether the value of the first counter is not less than the first set data quantity threshold, and it is also determined whether the value of the second counter is greater than the second set data quantity threshold. When it is determined that the value of the first counter is not less than the first set data quantity threshold, or the value of the second counter is greater than the second set data quantity threshold, the data recognition process of the field is ended regardless of whether the third identification data of the field in the history recognition is greater than the second set data quantity. In this way, it can not only be determined whether the first to-be-recognized data corresponding to the field contains sensitive data, but also the speed of sensitive data recognition is improved.

[0049] It should be noted that for each field other than the set field, when the data recognition process is performed, after the data recognition process of a field is performed, the first counter and the second counter are cleared, and then the cleared first counter and the second counter are used to participate in the data recognition process of other fields, which will not be described in detail here.

[0050] It should be noted that the first set data quantity threshold and the second set data quantity threshold are determined according to the total data quantity of the third to-be-recognized data and the set first matching threshold, and the specific value of the set first matching threshold can be configured according to actual conditions. By setting the first matching threshold, the present scheme can allow the data corresponding to the field including sensitive data to contain dirty data or non-standard data, thereby avoiding the situation that such a field is mistakenly considered not to include sensitive data, i.e. avoiding the false recognition of such a field, thereby improving the accuracy of the sensitive data recognition result.

[0051] In order to better understand the above-mentioned embodiment, the above-mentioned second set data amount, i.e. the total number of the third to-be-identified data is 1000, the above-mentioned first matching threshold is 90%, the above-mentioned first set data amount threshold is 1000*90% = 900, and the second set data amount threshold is 1000*(1-90%) = 100. On this basis, taking field 3 as an example in addition to the set field, 1000 third to-be-identified data can be extracted from the first to-be-identified data corresponding to field 3, and then the data content-based identification rule corresponding to the field 3 is obtained, and the 1000 third to-be-identified data is identified by using the obtained data content-based identification rule. Each matching third to-be-identified data updates the values of the first counter and the second counter, and judges whether the value of the first counter, i.e. the first data amount, is not less than 900 and whether the value of the second counter, i.e. the second data amount, is greater than 100. When the value of the first counter is not less than 900, it is confirmed that the first to-be-identified data corresponding to field 3 contains sensitive data, and it is further indicated that field 3 belongs to a sensitive field. When the value of the second counter is greater than 100, it is confirmed that the first to-be-identified data corresponding to field 3 does not contain sensitive data, and it is confirmed that field 3 does not belong to a sensitive field.

[0052] It should be noted that when the first 101 data is judged and the values of the first counter and the second counter are updated, it is found that the value of the second counter is greater than 100, and field 3 is directly confirmed to not belong to sensitive data, and it is confirmed that the first to-be-identified data corresponding to field 3 does not contain sensitive data, and then the 102 data does not need to be judged, and the data identification process of field 3 can be directly terminated. Similarly, when the first 900 data is judged and the values of the first counter and the second counter are updated, it is found that the value of the first counter is not less than 900, and it is directly confirmed that the first to-be-identified data corresponding to field 3 contains sensitive data, and it is confirmed that field 3 belongs to a sensitive field, and then the 901 data does not need to be judged, and the data identification process of field 3 can be directly terminated.

[0053] It should be noted that the number of data content-based identification rules corresponding to each field in addition to the set field can be determined according to actual conditions, which is not limited in the embodiment.

[0054] Optionally, based on any of the above embodiments, in this embodiment, the second to-be-identified data is the data corresponding to each field in the data table, that is, each field except the set field corresponds to the second to-be-identified data respectively. On this basis, the step of identifying the second to-be-identified data using the identification rule based on data content can be performed according to the following process: matching each piece of second to-be-identified data with the identification rule based on data content corresponding to the field; recording the third data amount of successful matching and the fourth data amount of failed matching respectively; when the third data amount is not less than a third set data amount threshold, it is determined that the second to-be-identified data corresponding to the field contains sensitive data; when the fourth data amount is greater than a fourth set data amount threshold, it is determined that the second to-be-identified data corresponding to the field does not contain sensitive data; wherein the sum of the third set data amount threshold and the fourth set data amount threshold is the first set data amount.

[0055] Specifically, when it is determined that the data table does not include the set field, in order to further improve the accuracy of the sensitive data identification result, it is necessary to further identify the data in the data table, and when identifying the data in the data table, it is generally identified field by field. Specifically, after extracting the second to-be-identified data from the data corresponding to each field, the identification rule based on data content corresponding to the field can be used to match each piece of second to-be-identified data one by one, and then record the data amount of successful matching, which is recorded as the third data amount; and record the data amount of failed matching, which is recorded as the fourth data amount. After each identification process is performed and the data amount of successful matching or failed matching is updated, it is determined whether the third data amount is not less than a third set data amount threshold, and it is also determined whether the fourth data amount is greater than a fourth set data amount threshold. When the third data amount is not less than the third set data amount threshold, it is determined that the data corresponding to the field contains sensitive data, and then it is determined that the field belongs to a sensitive field containing sensitive data, so that whether the field contains sensitive data is accurately identified, and at the same time, it is not necessary to match all the data of the field, which greatly improves the speed of sensitive data identification.

[0056] When the fourth data amount of failed matching is greater than the fourth set data amount threshold, it is determined that the data corresponding to the field does not contain sensitive data, and then it is determined that the field does not belong to a sensitive field, and at the same time, it is not necessary to continue to determine whether the other data of the field belongs to sensitive data, so that whether the field contains sensitive data can be quickly determined.

[0057] Further, when recording the third data amount of successful matching and the fourth data amount of failed matching based on the identification of the field, the first counter and the second counter can also be used for recording, and the specific recording process can refer to the above description, which will not be described in detail here.

[0058] It should be noted that the third set data amount threshold and the fourth set data amount threshold are determined according to the total data amount of the second to-be-identified data and a set second matching threshold, and a specific value of the set second matching threshold can be configured according to actual conditions. By setting the second matching threshold, it is allowed that there is dirty data or non-standard data in the data corresponding to the field including sensitive data, thereby avoiding the situation that such a field is mistakenly considered as not including sensitive data, that is, avoiding the false identification of such a field, thereby improving the accuracy of the sensitive data identification result. Further, by setting the first set data amount or the second set data amount and the matching threshold participating in matching according to requirements, querying the data amount satisfying the matching lower limit from the data table, executing the matching logic, and using the fast return algorithm in the matching process, the sensitive field is identified, and the identification speed and accuracy of the sensitive data and the sensitive field are greatly improved.

[0059] Further, when it is confirmed that the second to-be-identified data corresponding to each field does not include sensitive data, it is confirmed that the data table does not include sensitive data.

[0060] It should be noted that the values of the first set data amount and the second set data amount can be the same or different, and can be determined according to actual conditions; the values of the first matching threshold and the second matching threshold can be the same or different, and can be determined according to actual conditions; the values of the first set data amount threshold and the third set data amount threshold can be the same or different, and can be determined according to actual conditions; the values of the second set data amount threshold and the fourth set data amount threshold can be the same or different, and can be determined according to actual conditions.

[0061] It should be noted that the number of identification rules based on data content corresponding to each field in the data table excluding the set field can be determined according to actual conditions, and the present embodiment does not limit this.

[0062] It should be noted that each field in the data table can be understood as a column of the data table, and different fields correspond to different columns.

[0063] Based on the same inventive concept, the present application also provides a data identification device corresponding to the above-mentioned data identification method. The implementation of the data identification device can refer to the description of the data identification method above, which will not be discussed one by one here.

[0064] Referring to Figure 2 , Figure 2 The data identification device provided by an exemplary embodiment of the present application comprises:

[0065] The acquisition module 201 is configured to acquire a data table.

[0066] The first identification module 202 is configured to perform field identification on the data table.

[0067] The first determination module 203 is configured to determine that the data corresponding to the set field in the data table is sensitive data if the first identification module 202 identifies that the data table includes the set field.

[0068] The second identification module 204 is configured to, for first to-be-identified data corresponding to a field in the data table other than the set field, perform identification processing on the first to-be-identified data by using a data-content-based identification rule to identify whether sensitive data exists in the first to-be-identified data.

[0069] Optionally, based on the above-mentioned embodiments, the data identification apparatus provided in the embodiment further includes:

[0070] The extraction module (not shown in the figure) is configured to, if the data table does not include the set field, extract second to-be-identified data of a first set data amount from the data table, the first set data amount being less than a total data amount of data in the data table.

[0071] The third identification module (not shown in the figure) is configured to perform identification processing on the second to-be-identified data by using a data-content-based identification rule.

[0072] The second determination module (not shown in the figure) is configured to, when the third identification module identifies that the second to-be-identified data includes sensitive data, determine whether the data table includes sensitive data.

[0073] Optionally, based on any of the above-mentioned embodiments, in the embodiment, the second identification module 204 is specifically configured to extract third to-be-identified data of a second set data amount from the first to-be-identified data, the second set data amount being less than a total data amount of the first to-be-identified data; perform identification processing on the third to-be-identified data by using a data-content-based identification rule; when it is identified that the third to-be-identified data includes sensitive data, determine that the first to-be-identified data includes sensitive data; and when it is identified that the third to-be-identified data does not include sensitive data, determine that the first to-be-identified data does not include sensitive data.

[0074] Optionally, based on the above-mentioned embodiments, in the embodiment, the first to-be-identified data is data corresponding to each field in the data table other than the set field, and the third to-be-identified data is extracted from the first to-be-identified data corresponding to the field.

[0075] On this basis, the second identification module 204 is specifically configured to match each piece of third identification data by using the identification rule based on data content corresponding to the field; record a first data amount of successful matching and a second data amount of failed matching respectively; when the first data amount of successful matching is not less than a first set data amount threshold, it is confirmed that the third identification data corresponding to the field contains sensitive data; and when the second data amount of failed matching is greater than a second set data amount threshold, it is confirmed that the third identification data corresponding to the field does not contain sensitive data.

[0076] The sum of the first set data amount threshold and the second set data amount threshold is the second set data amount.

[0077] Optionally, based on the above embodiment, in the present embodiment, the second identification data is data corresponding to each field in the data table; on this basis, the third identification module (not shown in the figure) is specifically configured to match each piece of second identification data by using the identification rule based on data content corresponding to the field; record a third data amount of successful matching and a fourth data amount of failed matching respectively; when the third data amount is not less than a third set data amount threshold, it is confirmed that the second identification data corresponding to the field contains sensitive data; and when the fourth data amount is greater than a fourth set data amount threshold, it is confirmed that the second identification data corresponding to the field does not contain sensitive data.

[0078] The sum of the third set data amount threshold and the fourth set data amount threshold is the first set data amount.

[0079] Optionally, based on the above embodiment, the data identification device provided in the present embodiment further comprises:

[0080] The third determination module (not shown in the figure) is configured to, when the third identification module confirms that the second identification data corresponding to each field does not contain sensitive data, confirm that the data table does not contain sensitive data.

[0081] It should be noted that the implementation process of any of the above device embodiments can refer to the related description in the above data identification method embodiments, which will not be described in detail here.

[0082] Based on the same inventive concept, the present embodiment provides an electronic device, such as Figure 3As shown, the electronic device includes a processor 301 and a machine readable storage medium 302, the machine readable storage medium 302 stores a computer program which can be executed by the processor 301, and the processor 301 is caused to perform the data recognition method provided by any of the embodiments of the present application by the computer program. In addition, the electronic device further includes a communication interface 303 and a communication bus 304, wherein the processor 301, the communication interface 303, and the machine readable storage medium 302 complete communication with each other through the communication bus 304.

[0083] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For the convenience of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or only one type of bus.

[0084] The communication interface is used for communication between the above electronic device and other devices.

[0085] The memory can include a Random Access Memory (RAM), a DDR SRAM (Double Data Rate Synchronous Dynamic Random Access Memory), and can also include a Non-Volatile Memory (NVM), such as at least one disk memory. Optionally, the memory can also be at least one storage device located away from the aforementioned processor.

[0086] The processor mentioned above can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component.

[0087] In addition, the embodiment of the present application provides a machine readable storage medium, which stores a computer program. When the computer program is called and executed by a processor, the computer program causes the processor to execute the data recognition method provided by the embodiment of the present application.

[0088] For the electronic device and the machine readable storage medium embodiment, since the method content involved is basically similar to the foregoing method embodiment, the description is relatively simple, and the related parts refer to the part of the method embodiment.

[0089] It should be noted that, in this document, the relationship terms such as first and second are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between these entities or operations. In addition, the terms "include", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device. Without more limitations, the element defined by the statement "including a" does not exclude the presence of another identical element in the process, method, article or device including the element.

[0090] The implementation process of the functions and roles of each unit / module in the above device is specifically described in the implementation process of the corresponding steps in the above method, which will not be repeated here.

[0091] For the device embodiment, since it basically corresponds to the method embodiment, the related parts refer to the part of the method embodiment. The device embodiments described above are only illustrative, and the units / modules described as separate components can or can not be physically separated, and the components shown as units / modules can or can not be physical units / modules, that is, they can be located in one place or distributed on multiple network units / modules. According to actual needs, part or all of the units / modules can be selected to achieve the purpose of the present application. Those skilled in the art can understand and implement without creative labor.

[0092] The above only describes the preferred embodiments of the present application and does not limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A data recognition method, characterized in that, include: Retrieve the data table; The data table is subjected to field identification. If the data table includes a set field, the data corresponding to the set field in the data table is determined to be sensitive data. For the first data to be identified corresponding to the fields in the data table other than the set fields, the first data to be identified is processed by the identification rules based on the data content in order to identify whether there is sensitive data in the first data to be identified. If the data table does not include the set field, then a second set of data to be identified is extracted from the data table in the form of a first set data amount, where the first set data amount is less than the total data amount in the data table. The second data to be identified is processed using recognition rules based on data content; If sensitive data is identified in the second data to be identified, then it is confirmed whether sensitive data exists in the data table.

2. The method according to claim 1, characterized in that, The first data to be identified is processed using data content-based recognition rules to determine whether sensitive data exists in the first data to be identified, including: Extract a third set of data to be identified from the first data to be identified, where the second set data amount is less than the total data amount of the first data to be identified. The third data to be identified is processed using recognition rules based on data content; When the third data to be identified is found to contain sensitive data, then the first data to be identified is determined to contain sensitive data. When it is determined that the third data to be identified does not contain sensitive data, then it is determined that the first data to be identified does not contain sensitive data.

3. The method according to claim 2, characterized in that, If the first data to be identified is the data corresponding to each field in the data table except for the set field, then the third data to be identified is the data extracted from the first data to be identified corresponding to that field. The third data to be identified is processed using recognition rules based on data content, including: Each third piece of identification data is matched using the data content-based recognition rules corresponding to this field; Record the first number of successfully matched data and the second number of unmatched data respectively; When the first data volume that is successfully matched is not less than the first set data volume threshold, it is confirmed that the third data to be identified corresponding to the field contains sensitive data. If the amount of second data that fails to match exceeds the second set data amount threshold, it is confirmed that there is no sensitive data in the third identification data corresponding to that field. Wherein, the sum of the first set data volume threshold and the second set data volume threshold is the second set data volume.

4. The method according to claim 1, characterized in that, The second data to be identified is the data corresponding to each field in the data table; The second data to be identified is processed using recognition rules based on data content, including: The data content-based recognition rules corresponding to this field are used to match each second piece of data to be identified; Record the third set of data that were successfully matched and the fourth set of data that were not matched, respectively; When the third data volume is not less than the third set data volume threshold, it is confirmed that the second data to be identified corresponding to the field contains sensitive data. When the fourth data volume is greater than the fourth set data volume threshold, it is confirmed that the second data to be identified corresponding to this field does not contain sensitive data. The sum of the third set data volume threshold and the fourth set data volume threshold is the first set data volume.

5. The method according to claim 4, characterized in that, When it is confirmed that there is no sensitive data in the second data to be identified corresponding to each field, it is confirmed that there is no sensitive data in the data table.

6. A data identification device, characterized in that, include: The retrieval module is used to retrieve data tables; The first identification module is used to identify fields in the data table; The first determining module is used to determine that the data corresponding to the set field in the data table is sensitive data if the first identification module identifies that the data table includes a set field. The second identification module is used to identify the first data to be identified based on the data content using identification rules for the first data to be identified corresponding to the fields other than the set fields in the data table, so as to identify whether there is sensitive data in the first data to be identified. An extraction module is used to extract a first set amount of second data to be identified from the data table if the data table does not include the set field, wherein the first set amount of data is less than the total amount of data in the data table; The third identification module is used to identify the second data to be identified using identification rules based on data content; The second determining module is used to confirm whether the data table contains sensitive data when the third identification module identifies that the second data to be identified contains sensitive data.

7. The apparatus according to claim 6, characterized in that, The second identification module is specifically used to extract a third data to be identified from the first data to be identified, wherein the second set data amount is less than the total data amount of the first data to be identified; and to perform identification processing on the third data to be identified using identification rules based on data content. When the third data to be identified is found to contain sensitive data, then the first data to be identified is determined to contain sensitive data. When it is determined that the third data to be identified does not contain sensitive data, then it is determined that the first data to be identified does not contain sensitive data.

8. The apparatus according to claim 7, characterized in that, If the first data to be identified is the data corresponding to each field in the data table except for the set field, then the third data to be identified is the data extracted from the first data to be identified corresponding to that field. The second identification module is specifically used to match each third identification data using the data content-based identification rules corresponding to the field; record the first data volume of successful matching and the second data volume of unsuccessful matching respectively; when the first data volume of successful matching is not less than the first set data volume threshold, it is confirmed that the third identification data corresponding to the field contains sensitive data; when the second data volume of unsuccessful matching is greater than the second set data volume threshold, it is confirmed that the third identification data corresponding to the field does not contain sensitive data. The sum of the first set data volume threshold and the second set data volume threshold is the second set data volume.

9. The apparatus according to claim 6, characterized in that, The second data to be identified is the data corresponding to each field in the data table; The third identification module is specifically used to match each piece of second data to be identified with the data content-based identification rules corresponding to the field; record the third data volume of successful matching and the fourth data volume of unsuccessful matching respectively; when the third data volume is not less than the third set data volume threshold, it is confirmed that the second data to be identified corresponding to the field contains sensitive data; when the fourth data volume is greater than the fourth set data volume threshold, it is confirmed that the second data to be identified corresponding to the field does not contain sensitive data. The sum of the third set data volume threshold and the fourth set data volume threshold is the first set data volume.

10. The apparatus according to claim 9, characterized in that, Also includes: The third determining module is used to confirm that the data table does not contain sensitive data when the third identification module confirms that none of the second data to be identified corresponding to each field contains sensitive data.

Images