Sensitive information marking method, device, equipment and computer-readable storage medium

Abstract

The present application provides a sensitive information labeling method, apparatus, device, and computer-readable storage medium. The method comprises: extracting high-frequency words from multiple operation logs in a log file to obtain an ordered set of high-frequency words, wherein the high-frequency words are words that appear in the multiple operation logs with a frequency greater than a preset frequency threshold; pre-classifying the multiple operation logs based on the high-frequency words in each operation log and the ordered set of high-frequency words to obtain pre-classification results; filtering out some operation logs from each pre-classification result and obtaining labeling results for the some operation logs, wherein the labeling results are used to characterize the sensitivity level of the sensitive information included in the operation logs; and determining the labeling results for the remaining operation logs in the multiple operation logs, excluding the some operation logs, based on the labeling results for the some operation logs. In this way, sensitive information can be accurately and efficiently labeled.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and is related to, but not limited to, a sensitive information marking method, apparatus, device, and computer-readable storage medium. Background Art

[0002] Sensitive information generally refers to information that involves privacy rights and may cause serious harm to society or individuals if leaked. It includes personal sensitive information such as name, ID number, address, telephone number, bank account number, email address, password, medical information, educational background, etc.; it also includes information that is not suitable for enterprises or social organizations to disclose, such as the company's operating conditions, the company's network structure, IP address list, etc.

[0003] In the era of big data, user data across all industries is becoming increasingly digitized, and large-scale leaks of sensitive information have become increasingly common in recent years. To monitor employee operations involving sensitive information, such as viewing, downloading, or exporting, many companies are adopting information technology to record employee operations and achieve unified storage of operation logs. Based on this stored data, technologies such as big data and artificial intelligence are used to conduct targeted audits of operations involving sensitive information. Accurate and efficient labeling of sensitive information is the foundation and prerequisite for effective audit oversight. However, existing sensitive information labeling methods suffer from issues such as high workload, low efficiency, low accuracy, and limited applicability. Summary of the Invention

[0004] In view of this, the present application provides a sensitive information marking method, device, equipment and computer-readable storage medium, which at least solve the problems of large workload, low efficiency and low accuracy in sensitive information marking.

[0005] The technical solution of the embodiment of the present application is implemented as follows:

[0006] At least one embodiment of the present application provides a sensitive information marking method, the method comprising:

[0007] Extracting high-frequency words from a plurality of operation logs in a log file to obtain an ordered set of high-frequency words, wherein the high-frequency words are words that appear in the plurality of operation logs at a frequency greater than a preset frequency threshold;

[0008] Pre-classifying the plurality of operation logs based on the high-frequency words in each operation log and the ordered set of high-frequency words to obtain a pre-classification result;

[0009] Filtering out some operation logs from each pre-classification result, and obtaining marking results of the some operation logs, wherein the marking results are used to characterize the sensitivity level of sensitive information included in the operation logs;

[0010] Based on the marking results of the partial operation logs, marking results of the remaining operation logs in the plurality of operation logs except the partial operation logs are determined.

[0011] In addition, according to at least one embodiment of the present application, extracting high-frequency words from a plurality of operation logs in a log file to obtain an ordered set of high-frequency words includes:

[0012] Obtaining log files of sensitive business systems and obtaining multiple operation logs from the log files;

[0013] Performing word segmentation processing on the current operation log to obtain multiple word segments of the current operation log;

[0014] Calculate the frequency of each word appearing in the multiple operation logs;

[0015] Determine the segmented words whose frequency is greater than the preset frequency threshold as high-frequency words in the current operation log;

[0016] The high-frequency words of the plurality of operation logs are arranged in order to form an ordered set of high-frequency words.

[0017] In addition, according to at least one embodiment of the present application, after obtaining multiple operation logs from the log file, the method further includes:

[0018] Obtaining identification information of the plurality of operation logs;

[0019] Deduplication processing is performed on the multiple operation logs according to the identification information to obtain multiple processed operation logs, and the identification information of the multiple processed operation logs is different.

[0020] In addition, according to at least one embodiment of the present application, the pre-classification of the plurality of operation logs based on the high-frequency words and the ordered set of high-frequency words in each operation log to obtain a pre-classification result includes:

[0021] Determine a high-frequency vocabulary array corresponding to each operation log based on the high-frequency vocabulary of each operation log and the high-frequency vocabulary ordered set;

[0022] Calculating a first similarity between any two operation logs in the plurality of operation logs based on a plurality of high-frequency word arrays corresponding to the plurality of operation logs to obtain a calculation result;

[0023] Obtaining a pre-classification number M, and clustering the plurality of operation logs into M categories according to the pre-classification number M and the calculation result;

[0024] The M classifications are determined as pre-classification results.

[0025] In addition, according to at least one embodiment of the present application, determining the high-frequency vocabulary array corresponding to each operation log based on the high-frequency vocabulary in each operation log and the high-frequency vocabulary ordered set includes:

[0026] Initialize an initial array including N elements, where N is the number of high-frequency words in the ordered set of high-frequency words;

[0027] Searching the current operation log for N high-frequency words corresponding to N ordinal numbers in the high-frequency word ordered set in a preset order to obtain N search results;

[0028] Determine, among the N search results, the target ordinal number corresponding to the high-frequency word for which the search result is successfully found;

[0029] The initial value corresponding to the target ordinal number in the initial array is adjusted to the target value to obtain the high-frequency vocabulary array of the current operation log.

[0030] In addition, according to at least one embodiment of the present application, calculating the first similarity between any two operation logs in the plurality of operation logs based on the plurality of high-frequency vocabulary arrays corresponding to the plurality of operation logs to obtain the calculation result includes:

[0031] Acquire a first high-frequency vocabulary array and a second high-frequency vocabulary array from the plurality of high-frequency vocabulary arrays;

[0032] Determine a first operation log corresponding to the first high-frequency vocabulary array and a second operation log corresponding to the second high-frequency vocabulary array;

[0033] Calculating a first similarity between the first operation log and the second operation log;

[0034] A plurality of first similarities calculated between any two operation logs in the plurality of operation logs are determined as calculation results.

[0035] Furthermore, according to at least one embodiment of the present application, calculating the first similarity between the first operation log and the second operation log includes:

[0036] Calculate a first frequency of a high-frequency word of a current ordinal number in the first operation log and a second frequency of the high-frequency word in the second operation log;

[0037] determining an adjustment item of a current ordinal number according to the first frequency and the second frequency;

[0038] determining a weight of a current ordinal number according to the first frequency, the second frequency, and the adjustment item;

[0039] Adjusting the distance between the first high-frequency vocabulary array and the second high-frequency vocabulary array according to the weight of the current ordinal number to obtain an adjusted distance;

[0040] A first similarity between the first operation log and the second operation log is determined according to the adjusted distance.

[0041] In addition, according to at least one embodiment of the present application, determining the marking results of the remaining operation logs in the plurality of operation logs other than the partial operation logs based on the marking results of the partial operation logs includes:

[0042] Selecting an operation log from each category in the partial operation logs as a third operation log, and selecting an operation log from the remaining operation logs as a fourth operation log;

[0043] Calculating the second similarities between the third operation log selected in each category and the fourth operation log respectively to obtain M second similarities;

[0044] Determining a maximum second similarity among the M second similarities;

[0045] The marking result of the third operation log corresponding to the maximum second similarity is determined as the marking result of the fourth operation log.

[0046] Furthermore, according to at least one embodiment of the present application, calculating a second similarity between a third operation log selected in a category and the fourth operation log includes:

[0047] Calculate a third frequency of the high-frequency word of the current ordinal number in the third operation log and a fourth frequency in the fourth operation log;

[0048] determining a weight of a current ordinal number according to the third frequency and the fourth frequency;

[0049] adjusting the distance between the third high-frequency vocabulary array of the third operation log and the fourth high-frequency vocabulary array of the fourth operation log according to the weight of the current ordinal number to obtain an adjusted distance;

[0050] A second similarity between the third operation log and the fourth operation log is determined according to the adjusted distance.

[0051] At least one embodiment of the present application provides a sensitive information marking device, the device comprising:

[0052] An extraction module is used to extract high-frequency words from a plurality of operation logs in a log file to obtain an ordered set of high-frequency words, wherein the high-frequency words are words that appear in the plurality of operation logs at a frequency greater than a preset frequency threshold;

[0053] A pre-classification module, configured to pre-classify the plurality of operation logs based on the high-frequency words in each operation log and the ordered set of high-frequency words to obtain a pre-classification result;

[0054] a first acquisition module, configured to filter out some operation logs from the pre-classification results and obtain marking results for the some operation logs, wherein the marking results are used to characterize the sensitivity level of sensitive information included in the operation logs;

[0055] The marking module is configured to determine, based on the marking results of the partial operation logs, marking results of the remaining operation logs in the plurality of operation logs except the partial operation logs.

[0056] At least one embodiment of the present application provides a sensitive information marking device, including:

[0057] processor; and

[0058] a memory for storing a computer program executable on the processor;

[0059] Among them, when the computer program is executed by the processor, the steps of the above-mentioned sensitive information marking method are implemented.

[0060] At least one embodiment of the present application provides a computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions are configured to execute the steps of the above-mentioned sensitive information marking method.

[0061] The embodiments of the present application provide a sensitive information labeling method, apparatus, device, and computer-readable storage medium. The method includes: extracting high-frequency words from multiple operation logs in a log file to obtain an ordered set of high-frequency words, wherein the high-frequency words are words that appear in the multiple operation logs with a frequency greater than a preset frequency threshold; pre-classifying the multiple operation logs based on the high-frequency words in each operation log and the ordered set of high-frequency words to obtain pre-classification results; filtering out some operation logs from each pre-classification result and obtaining labeling results for the some operation logs, wherein the labeling results are used to characterize the sensitivity level of sensitive information included in the operation logs; and determining the labeling results for the remaining operation logs in the multiple operation logs, excluding the some operation logs, based on the labeling results for the some operation logs. In this way, sensitive information can be accurately and efficiently labeled. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] In the drawings, which are not necessarily drawn to scale, like reference numerals may describe similar components throughout the different views.The drawings illustrate generally, by way of example and not limitation, various embodiments discussed herein.

[0063] Figure 1A schematic diagram of an implementation flow of the sensitive information marking method provided in an embodiment of the present application;

[0064] Figure 2 A schematic diagram of an implementation flow of the step of obtaining an ordered set of high-frequency words provided in an embodiment of the present application;

[0065] Figure 3 A schematic diagram of another implementation flow of the sensitive information marking method provided in an embodiment of the present application;

[0066] Figure 4 A schematic diagram of the implementation modules of the method for marking the risk level of sensitive data provided in an embodiment of the present application;

[0067] Figure 5 A schematic diagram of the structure of a sensitive information marking device provided in an embodiment of the present application;

[0068] Figure 6 A schematic diagram of the structure of the sensitive information marking device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0069] In order to make the purpose, technical solutions and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. The described embodiments should not be regarded as limiting this application. All other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0070] In the following description, reference is made to “some embodiments”, which describes a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0071] In the following description, the terms "first\second\third" involved are merely used to distinguish similar objects and do not represent a specific ordering of the objects. It can be understood that "first\second\third" can be interchanged with a specific order or sequence where permitted, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein.

[0072] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application pertains. The terms used herein are for the purpose of describing the embodiments of this application only and are not intended to limit this application.

[0073] In order to better understand the embodiments of the present application, the sensitive information marking method in the related art and its shortcomings are first explained.

[0074] In related technologies, Strapi can be used to build customizable application programming interfaces (APIs). Strapi is a free, open-source, headless content management system (CMS) for Node.js that makes it easy to build customizable APIs. When customizing and publishing data, the published data is made available through the Node interface. Furthermore, data configuration is only available to users with configuration permissions; users without configuration permissions cannot configure or access the data.

[0075] In related technologies, one sensitive information labeling method involves first cleaning the data to generate training data. This training data is then used to train a classifier and identifier capable of classifying sensitive information, and the sensitive information is then labeled based on the classifier and identifier. In this method, the classifier and identifier for labeling sensitive information rely on a training sample set. The quality of the training sample set directly affects the accuracy of the classifier and identifier, making accurate labeling impossible.

[0076] Another related approach to labeling sensitive information involves categorizing sensitive information that requires protection within big data platforms, defining the specific content and attributes of each category, and then determining the sensitivity level of the information based on its importance or sensitivity. This labeling method utilizes sensitive information contained within big data platforms and is not widely applicable to sensitive information outside of these platforms.

[0077] Another sensitive information labeling method in related art pre-assigns identical and similar sensitive words to each sensitive information mining algorithm. The segmented word is then matched one-to-one with each identical and similar sensitive word. If a match is successful, the segmented word is determined to be sensitive information. If all matches fail, the segmented word is determined to be non-sensitive data. This labeling method requires pre-assigning identical and similar sensitive words to each sensitive information mining algorithm, and relies too much on a reliable original sensitive word library.

[0078] To address the problems in the related art, embodiments of the present application provide a sensitive information labeling method, which is applied to a sensitive information labeling device. The method provided in embodiments of the present application can be implemented via a computer program. When executed, the computer program completes each step of the sensitive information labeling method provided in embodiments of the present application. In some embodiments, the computer program can be executed by a processor in the sensitive information labeling device. Figure 1 A schematic diagram of an implementation flow of the sensitive information marking method provided in an embodiment of the present application is shown as follows: Figure 1 As shown, the sensitive information marking method includes the following steps:

[0079] Step S101 : extracting high-frequency words from a plurality of operation logs in a log file to obtain an ordered set of high-frequency words.

[0080] Here, the high-frequency words are words that appear in the plurality of operation logs at a frequency greater than a preset frequency threshold.

[0081] In an embodiment of the present application, the sensitive information marking device may be a user equipment (UE), a mobile device, a terminal, a laptop computer, a tablet computer, a desktop computer, or other device capable of marking sensitive information.

[0082] During the operation of sensitive business systems, the operation instructions executed by operators are stored and obtained as log files. Each operation instruction corresponds to an operation log in the log file. In the database, the structure of the operation log storage table is shown in Table 1:

[0083] Table 1 Structure of the operation log storage table

[0084] Serial number Field Name Notes 1 operation_id Operation ID 2 system_id System Number 3 operation_type Operation Type 4 operation_content Operation content

[0085] As shown in Table 1, an operation log mainly includes the operation unique code (ID, Identity Document), system number, operation type and operation content. Among them, the "operation ID" is the unique identifier of the operation log; the "system number" is the unique identifier to distinguish different sensitive business systems; the "operation type" includes operations such as adding, deleting, modifying, querying, importing (including uploading), and exporting (including downloading); and the "operation content" is a detailed description of the operation process.

[0086] After obtaining multiple operation logs, the operation logs are segmented and the frequency of each segmented word in the multiple operation logs is calculated. Segments with a frequency greater than a preset frequency threshold are identified as high-frequency words. The high-frequency words extracted from each operation log are combined into an ordered set of high-frequency words for the multiple operation logs. All high-frequency words in the ordered set are in an ordered relationship.

[0087] In some embodiments, the high-frequency words in the ordered set of high-frequency words can be sorted in lexicographical order, or in order of frequency, or in the order in which the high-frequency words appear in the log file, or in other possible sorting methods, which are not limited in the embodiments of the present application.

[0088] Step S102 : pre-classifying the plurality of operation logs based on the high-frequency words of each operation log and the ordered set of high-frequency words to obtain a pre-classification result.

[0089] For example, the high-frequency vocabulary ordered set obtained based on the high-frequency vocabulary of multiple operation logs is {high-frequency vocabulary 1, high-frequency vocabulary 2, ..., high-frequency vocabulary N}, where N is the number of high-frequency vocabulary in the high-frequency vocabulary ordered set.

[0090] When determining the high-frequency vocabulary array of the i-th operation log (here, i is a positive integer greater than or equal to 1 and less than or equal to the total number of operation logs) among multiple operation logs, first initialize an array i with a length of N, and then judge whether high-frequency vocabulary 1 to high-frequency vocabulary N exist in the operation log: if high-frequency vocabulary j (here, j is a positive integer greater than or equal to 1 and less than or equal to N) exists in the operation log, set the j-th position in array i to 1; if high-frequency vocabulary j does not exist in the operation log, set the j-th position in array i to 0; in this way, the high-frequency vocabulary array i of the i-th operation log is obtained. For example, using the above judgment, it is obtained that high-frequency vocabulary 1, 3, 5 to 100 do not exist in the current operation log, and high-frequency vocabulary 2 and 4 exist in the current operation log, then the high-frequency vocabulary array of the current operation log is obtained as

[0091] Then, unsupervised learning is performed on the multiple high-frequency word arrays corresponding to the multiple operation logs, and they are classified. The operation logs corresponding to the high-frequency word arrays in the same classification are classified into the same category, thereby achieving pre-classification of the multiple operation logs. Here, when performing unsupervised learning, a clustering algorithm can be used to classify the multiple high-frequency word arrays.

[0092] In the embodiment of the present application, an unsupervised algorithm is combined to divide multiple operation logs once to achieve pre-classification, which can effectively reduce classification errors caused by inconsistent understanding during the manual labeling process.

[0093] Step S103 , filtering out some operation logs from the pre-classification results, and obtaining marking results of the some operation logs.

[0094] Here, the marking result is used to characterize the sensitivity level of the sensitive information included in the operation log.

[0095] Based on the pre-classification results, a small number of operation logs are randomly screened from multiple operation logs in each category, and the small number of operation logs screened in each category are determined as the screened partial operation logs, and then the marking results of the partial operation logs are obtained. The marking result is the marking information for the sensitive information included in the operation log, and the sensitivity level of the sensitive information can be determined based on the marking information. In an embodiment of the present application, the input and output devices of the sensitive information marking device can obtain the marking results of the partial operation log based on the input operation of the operator, that is, the sensitivity level of the sensitive information included in the partial operation log is manually judged and marked. After the manual marking is completed, the partial operation log is the operation log with marked sensitive information.

[0096] Step S104: Based on the marking results of the partial operation logs, determining the marking results of the remaining operation logs in the plurality of operation logs except the partial operation logs.

[0097] Based on the operation logs marked with sensitive information, the remaining operation logs except the partial operation logs in the multiple operation logs, that is, the operation logs not marked with sensitive information in the multiple operation logs, are automatically marked.

[0098] In this embodiment of the present application, when automatically tagging an operation log that is not marked with sensitive information, the similarity between the operation log and an operation log in each category that is already marked with sensitive information is calculated, and the tagging result of the operation log corresponding to the category with the greatest similarity is determined as the tagging result for the current operation log. All operation logs that are not marked with sensitive information are automatically tagged, achieving accurate and efficient tagging of the sensitivity level of the operation logs.

[0099] The sensitive information labeling method provided by the embodiment of the present application includes: extracting high-frequency words from multiple operation logs in a log file to obtain an ordered set of high-frequency words, wherein the high-frequency words are words that appear in the multiple operation logs with a frequency greater than a preset frequency threshold; pre-classifying the multiple operation logs based on the high-frequency words in each operation log and the ordered set of high-frequency words to obtain pre-classification results; filtering out some operation logs from each pre-classification result and obtaining labeling results for the some operation logs, wherein the labeling results are used to characterize the sensitivity level of sensitive information included in the operation logs; and determining the labeling results for the remaining operation logs in the multiple operation logs, excluding the some operation logs, based on the labeling results for the some operation logs. In this way, sensitive information can be accurately and efficiently labeled.

[0100] In some embodiments, the above step S101 of “extracting high-frequency words from a plurality of operation logs in a log file to obtain an ordered set of high-frequency words” can be implemented by the following steps.

[0101] Step S1011: Obtain log files of sensitive business systems.

[0102] Here, since the operation logs of non-sensitive business systems are all non-sensitive data, there is no need to identify the sensitivity level of sensitive information. In sensitive business systems, there are not only operation logs involving sensitive information, but also operation logs that do not involve sensitive information. In addition, the sensitivity level of sensitive information is also divided into high and low levels. For example, the sensitivity level can be divided into five categories from high to low: "extremely sensitive level", "relatively sensitive level", "generally sensitive level", "low sensitivity level" and "non-sensitive level". In order to distinguish between sensitive information and non-sensitive information, and mark the different sensitivity levels of sensitive information, first obtain the log file of the sensitive business system, which stores the operations performed by the operator in the sensitive business system.

[0103] Step S1012: Acquire multiple operation logs from the log file.

[0104] The log file stores multiple operation logs. The multiple operation logs are obtained from the log file according to the recording mode of the operation logs.

[0105] Step S1013: extract high-frequency words from the plurality of operation logs to obtain an ordered set of high-frequency words.

[0106] After obtaining multiple operation logs, the operation logs are segmented and the frequency of each segmented word in the multiple operation logs is calculated. Segments with a frequency greater than a preset frequency threshold are identified as high-frequency words. The high-frequency words extracted from each operation log are combined into an ordered set of high-frequency words for the multiple operation logs. All high-frequency words in the ordered set are in an ordered relationship.

[0107] Figure 2 A schematic diagram of an implementation flow of the step of obtaining an ordered set of high-frequency words provided in an embodiment of the present application is shown as follows: Figure 2 As shown, the above step S101 "extracting high-frequency words from multiple operation logs in the log file to obtain an ordered set of high-frequency words" can be implemented by the following steps:

[0108] Step S201: Obtain log files of sensitive business systems.

[0109] In sensitive business systems, not only operation logs involving sensitive information are included, but also operation logs not involving sensitive information. In order to distinguish sensitive from non-sensitive information and mark the different sensitivity levels of sensitive information, we first obtain the log files of sensitive business systems. These log files store the operations performed by operators in sensitive business systems.

[0110] Step S202: Acquire multiple operation logs from the log file.

[0111] The log file stores multiple operation logs. The multiple operation logs are obtained from the log file according to the recording mode of the operation logs.

[0112] Step S203: Obtain identification information of the multiple operation logs.

[0113] The identification information here may be an operation ID of the operation log. Different operations correspond to different operation logs and have different operation IDs, so the operation logs can be distinguished according to the operation ID.

[0114] Step S204: Deduplication processing is performed on the multiple operation logs according to the identification information to obtain multiple processed operation logs.

[0115] Here, the identification information of the multiple processed operation logs is different.

[0116] Deduplication is performed on multiple operation logs, removing duplicate operation logs. For batch operation logs, if there are multiple operation logs corresponding to the same operation ID, only one operation log is retained and the remaining duplicate operation logs are deleted. This prevents duplicate operation logs from affecting classification results and helps improve the accuracy of sensitive information labeling.

[0117] The following steps S205 to S208 are a possible implementation of the above step S1013.

[0118] Step S205 : performing word segmentation processing on the current operation log to obtain multiple word segments of the current operation log.

[0119] In an embodiment of the present application, algorithms such as a hidden Markov model (HMM), a conditional random field (CRF), or a neural network may be used to perform word segmentation on multiple operation logs to obtain multiple word segments for each operation log.

[0120] It should be noted here that when the operation log is segmented, punctuation marks, function words, etc. do not have complete meanings, cannot form sentences on their own, and cannot serve as grammatical components on their own. During the segmentation process, such segmentations are deleted so that the multiple segmentations of each operation log are segmented into complete meanings.

[0121] Step S206 : Calculate the frequency of each word appearing in the plurality of operation logs.

[0122] Calculate the frequency of the remaining words in each operation log. The calculation method is: Among them, count iis the frequency of occurrence of the i-th (where i is a positive integer greater than or equal to 1 and less than or equal to the number of remaining participles) participle, count total is the total number of operation logs.

[0123] Step S207: Determine the segmented words whose frequencies are greater than a preset frequency threshold as high-frequency words in the current operation log.

[0124] The preset frequency threshold α can be any value between 0.05 and 0.1. i When it is greater than the threshold α, the word is considered a high-frequency word and is added to the high-frequency word ordered set C. high_freq middle.

[0125] Step S208 , arranging the high-frequency words in the plurality of operation logs in order to form an ordered set of high-frequency words.

[0126] Arrange the high-frequency words of multiple operation logs in order to obtain the ordered set C of high-frequency words high_freq In the high frequency vocabulary ordered set C high_freq In the example, the high-frequency words of each operation log are stored in the form of an ordered array of equal length, that is, the high-frequency word array x∈C of the operation log high_freq And x=[x1,x2,…,x N ].

[0127] The embodiment of the present application provides a step for obtaining an ordered set of high-frequency words, which deduplicates multiple operation logs and then performs word segmentation. By removing duplicate operation logs, it is possible to avoid duplicate operation logs affecting the classification results, thereby helping to improve the accuracy of sensitive information marking.

[0128] In some embodiments, Figure 1 In the illustrated embodiment, "pre-classifying the plurality of operation logs based on the high-frequency words in each operation log and the ordered set of high-frequency words to obtain a pre-classification result" in step S102 can be implemented by the following steps.

[0129] Step S1021 : determining a high-frequency vocabulary array corresponding to each operation log based on the high-frequency vocabulary of each operation log and the high-frequency vocabulary ordered set.

[0130] For example, the high-frequency vocabulary ordered set obtained based on the high-frequency vocabulary of multiple operation logs is {high-frequency vocabulary 1, high-frequency vocabulary 2, ..., high-frequency vocabulary N}, where N is the number of high-frequency vocabulary in the high-frequency vocabulary ordered set.

[0131] When determining the high-frequency vocabulary array of the i-th operation log (here, i is a positive integer greater than or equal to 1 and less than or equal to the total number of operation logs) among multiple operation logs, first initialize an array i with a length of N, and then judge whether high-frequency vocabulary 1 to high-frequency vocabulary N exist in the operation log: if high-frequency vocabulary j (here, j is a positive integer greater than or equal to 1 and less than or equal to N) exists in the operation log, set the j-th position in array i to 1; if high-frequency vocabulary j does not exist in the operation log, set the j-th position in array i to 0; in this way, the high-frequency vocabulary array i of the i-th operation log is obtained. For example, using the above judgment, it is obtained that high-frequency vocabulary 1, 3, 5 to 100 do not exist in the current operation log, and high-frequency vocabulary 2 and 4 exist in the current operation log, then the high-frequency vocabulary array of the current operation log is obtained as

[0132] The above steps are performed on the high-frequency words of each operation log in the log file to obtain a high-frequency word array corresponding to each operation log.

[0133] Step S1022 : Pre-classifying the plurality of operation logs based on the plurality of high-frequency word arrays corresponding to the plurality of operation logs to obtain a pre-classification result.

[0134] Unsupervised learning is performed on multiple high-frequency word arrays corresponding to multiple operation logs, and they are classified. Operation logs corresponding to high-frequency word arrays in the same classification are classified into the same category, thereby pre-classifying the multiple operation logs. Here, when performing unsupervised learning, a clustering algorithm can be used to classify the multiple high-frequency word arrays.

[0135] In the embodiment of the present application, an unsupervised algorithm is combined to divide multiple operation logs once to achieve pre-classification, which can effectively reduce classification errors caused by inconsistent understanding during the manual labeling process.

[0136] In some embodiments, the above step S1021 "determining the high-frequency vocabulary array corresponding to each operation log based on the high-frequency vocabulary of each operation log and the high-frequency vocabulary ordered set" can be implemented through the following steps.

[0137] Step S0211, initialize an initial array including N elements.

[0138] Where N is the number of high-frequency words in the ordered set of high-frequency words. For example, if the ordered set of high-frequency words includes 100 high-frequency words, the initial array is

[0139] Step S0212: searching the current operation log for N high-frequency words corresponding to N ordinal numbers in the ordered set of high-frequency words in a preset order to obtain N search results.

[0140] Here, the preset order can be searched from the first high-frequency word in the ordered set of high-frequency words to the last high-frequency word in the ordered set of high-frequency words, that is, searched in positive order. Alternatively, the preset order can also be searched in reverse order from the last high-frequency word in the ordered set of high-frequency words to the first high-frequency word in the ordered set of high-frequency words, that is, searched in reverse order. Alternatively, the preset order can also be a search method in a specific order. For example, the ordered set of high-frequency words includes 5 high-frequency words. It is preset to search the 3rd one first, then the 5th one, then the 1st one, then the 4th one, and finally the 2nd one, that is, search in the order of [3, 5, 1, 2, 4].

[0141] Step S0213: Determine the target ordinal number corresponding to the high-frequency word for which the search result is successfully found among the N search results.

[0142] When the search result is successful, it indicates that the high-frequency word being searched exists in the current operation log, that is, the high-frequency word corresponding to the current ordinal number exists. At this time, the initial value corresponding to the current ordinal number in the initial array needs to be adjusted to the target value. For example, the initial value 0 corresponding to the current ordinal number in the initial array needs to be adjusted to the target value 1.

[0143] When the search result is search failure, it indicates that the high-frequency word being searched does not exist in the current operation log. At this time, there is no need to adjust the initial value corresponding to the current ordinal in the initial array, and continue to search the next ordinal of the current ordinal.

[0144] N high-frequency words corresponding to N ordinal numbers in the high-frequency word ordered set are searched in the current operation log to obtain N search results, and the ordinal numbers corresponding to the high-frequency words whose search results are successful are determined as target ordinal numbers.

[0145] Step S0214: Adjust the initial value corresponding to the target ordinal number in the initial array to the target value, and obtain the high-frequency vocabulary array of the current operation log.

[0146] Still using the above example to illustrate, the initial array is The target ordinal numbers are 2 and 4, and the target value is 1. The high-frequency word array of the current operation log is

[0147] In some embodiments, the above-mentioned step S1022 of "pre-classifying the multiple operation logs based on the multiple high-frequency word arrays corresponding to the respective operation logs to obtain pre-classification results" can be implemented through the following steps.

[0148] Step S0221 : Based on a plurality of high-frequency word arrays corresponding to the plurality of operation logs, a first similarity between any two operation logs in the plurality of operation logs is calculated to obtain a calculation result.

[0149] In some embodiments, step S0221 may be implemented as the following steps:

[0150] Step S2211: Obtain a first high-frequency vocabulary array and a second high-frequency vocabulary array from the multiple high-frequency vocabulary arrays.

[0151] The first high-frequency word array and the second high-frequency word array are any two high-frequency word data in the plurality of high-frequency word arrays. For the sake of distinction, in the embodiment of the present application, the first high-frequency word data x is represented as x=[x1, x2, ..., x n ], the second high-frequency vocabulary data y is expressed as y=[y1,y2,…,y n ], where x∈C high_freq , y∈C high_freq .

[0152] Step S2212: Determine a first operation log corresponding to the first high-frequency vocabulary array and a second operation log corresponding to the second high-frequency vocabulary array.

[0153] Step S2213: Calculate a first similarity between the first operation log and the second operation log.

[0154] In actual implementation, 1) first Calculate the first frequency of the high-frequency word of the current ordinal number in the first operation log And according to Calculate the second frequency corresponding to the high-frequency word of the current ordinal number in the second operation log

[0155] Since the high-frequency words of the current ordinal number are high-frequency words, and

[0156] 2) Determine an adjustment item for a current ordinal number according to the first frequency and the second frequency.

[0157] Adjustment item φ i Used to adjust the importance of high-frequency word similarity measurement, which satisfies 0<φ i ≤1, according to weight The value of can further divide φ i For example, when When the value of is between (0, a], φ i The value of is a value between (q, 1]; When the value of is between (a,b], φ i The value of is a value between (p, q]; and so on, When the value of is between (c,α], φ i The value of is a value between (0, t]. Generally speaking, The smaller the value of i The value of jump increases, according to this method, the adjustment term φ i Flexibly adjust the importance of high-frequency words for similarity measurement.

[0158] 3) Determine the weight of the current ordinal number based on the first frequency, the second frequency, and the adjustment item.

[0159] In the embodiment of the present application, the weight of the current ordinal number It can be calculated based on the frequency of the i-th high-frequency word in arrays x and y. The calculation formula is shown in the following formula (1):

[0160]

[0161] Among them, φ i Indicates adjustment items. As the basis for adjusting the weight, both high-frequency words x i The influence of y on the similarity measurement is also considered. i The degree of influence on the similarity measurement.

[0162] 4) According to the weight of the current ordinal number, the distance between the first high-frequency vocabulary array and the second high-frequency vocabulary array is adjusted to obtain an adjusted distance.

[0163] In the embodiment of the present application, the distance between x and y is recorded as d(x, y), and the calculation formula of the distance d(x, y) is shown in the following formula (2):

[0164]

[0165] in, is the adjusted weight. In practice, it is found that high-frequency words that appear infrequently have a greater impact on classification; on the contrary, words that appear too frequently are not very useful for classification. Therefore, when calculating similarity, the adjusted weight can increase the influence of high-frequency words that do not appear frequently in operation logs on classification. The smaller the value, the smaller the distance d(x,y) between x and y, and the larger the value of the similarity S(x,y).

[0166] 5) Determine a first similarity between the first operation log and the second operation log according to the adjusted distance.

[0167] In the embodiment of the present application, the reciprocal of the distance between the high-frequency vocabulary arrays x and y is determined as the first similarity between the first operation log and the second operation log, that is,

[0168] Step S2214: Determine multiple first similarities calculated between any two operation logs in the multiple operation logs as calculation results.

[0169] Step S0222: clustering the plurality of operation logs according to the calculation result to obtain a pre-classification result.

[0170] In some embodiments, before executing step S0222, a pre-classification number M may be obtained to classify the multiple operation logs into M categories. In this case, when implementing step S1032, the multiple operation logs are first clustered into M categories based on the pre-classification number M and the calculation result, and then the M categories are determined as the pre-classification results.

[0171] In some embodiments, step S104 of "determining the marking results of the remaining operation logs in the plurality of operation logs except the partial operation logs based on the marking results of the partial operation logs" can be implemented by the following steps.

[0172] Step S1041 : Select one operation log from each category in the partial operation logs as a third operation log, and select one operation log from the remaining operation logs as a fourth operation log.

[0173] In the embodiment of the present application, the third operation log is an operation log that has been marked with a sensitivity level, and the fourth operation log is an operation log that is to be marked with a sensitivity level.

[0174] Step S1042 : Calculate the second similarities between the third operation log selected in each category and the fourth operation log respectively to obtain M second similarities.

[0175] In some embodiments, calculating the second similarity between the third operation log selected in a category and the fourth operation log may be implemented as follows:

[0176] Step S0421 : Calculate the third frequency of the high-frequency word of the current ordinal number in the third operation log and the fourth frequency in the fourth operation log.

[0177] according to Calculate the third frequency of the high-frequency word of the current ordinal number in the third operation log And according to Calculate the fourth frequency of the high-frequency word of the current ordinal number in the fourth operation log

[0178] Step S0422: Determine the weight of the current ordinal number according to the third frequency and the fourth frequency.

[0179] In the embodiment of the present application, the weight of the current ordinal number f sign , we can calculate the frequency of high-frequency words in the operation logs with marked sensitivity levels and the operation logs without marked sensitivity levels. and To calculate, the calculation formula is shown in the following formula (3):

[0180]

[0181] During the pre-classification process, the adjustment term φ i Corrected the importance of high-frequency words for similarity measurement, so no adjustment is added during secondary classification. The calculated weight f sign ,The importance of high-frequency words in the marked risk level operation logs and unmarked risk level operation logs to similarity measurement is comprehensively considered.

[0182] Step S0423 : adjusting the distance between the third high-frequency vocabulary array of the third operation log and the fourth high-frequency vocabulary array of the fourth operation log according to the weight of the current ordinal number to obtain an adjusted distance.

[0183] In the embodiment of the present application, the third high-frequency word array x of the risk-level operation log is marked signed and the fourth high-frequency word array y of the unlabeled risk level operation log no_signed The distance between them is denoted as d(x signed ,y no_signed ), and its calculation formula is shown in formula (4):

[0184]

[0185] Among them, f sign It is used to adjust the weight of importance. The lower the frequency of high-frequency words, the higher the calculated weight f sign The smaller the distance d(x signed ,y no_signed ) is smaller, and the similarity S(x signed ,y no_signed ) is larger. It can be seen that by adjusting the importance weight f sign , which can effectively increase the influence of high-frequency words with lower frequency of occurrence on the mark.

[0186] Step S0424: Determine a second similarity between the third operation log and the fourth operation log according to the adjusted distance.

[0187] In the embodiment of the present application, the third high-frequency vocabulary array x signed and the fourth high frequency vocabulary array y no_signed The reciprocal of the distance between them is determined as the second similarity between the marked risk level operation log and the unmarked risk level operation log, that is,

[0188] Step S1043: Determine the maximum second similarity among the M second similarities.

[0189] Step S1044: Determine the marking result of the third operation log corresponding to the maximum second similarity as the marking result of the fourth operation log.

[0190] Based on the pre-classification, the similarity S(x signed ,y no_signed ). When the largest of the M second similarities, max(S(x signed ,y no_signed )) is used as the marking basis for the unmarked sensitive level operation logs, that is, the maximum similarity max(S(x signed ,y no_signed ))The marking result of the corresponding third operation log is determined as the marking result of the fourth operation log, thereby achieving accurate and efficient marking of sensitive information.

[0191] After marking is completed, the structure of the operation log storage table in the database is shown in Table 2:

[0192] Table 2 Structure of the operation log storage table after marking is completed

[0193]

[0194]

[0195] Figure 3 Another implementation flow diagram of the sensitive information marking method provided in the embodiment of the present application is as follows: Figure 3 As shown, the sensitive information marking method described in the embodiment of the present application includes the following steps:

[0196] Step S301, obtaining log files of sensitive business systems;

[0197] Step S302, obtaining multiple operation logs from the log file;

[0198] Step S303: Obtain identification information of the plurality of operation logs;

[0199] Step S304: Deduplication processing is performed on the multiple operation logs according to the identification information to obtain multiple processed operation logs.

[0200] Here, the identification information of the multiple processed operation logs is different.

[0201] Step S305: performing word segmentation processing on the current operation log to obtain multiple word segments of the current operation log;

[0202] Step S306, respectively calculating the frequency of each word in the plurality of operation logs;

[0203] Step S307, determining the segmented words whose frequency is greater than the preset frequency threshold as high-frequency words in the current operation log;

[0204] Step S308 : Arrange the high-frequency words in the plurality of operation logs in order to form an ordered set of high-frequency words.

[0205] Step S309: Initialize an initial array including N elements.

[0206] Where N is the number of high-frequency words in the ordered set of high-frequency words.

[0207] Step S310, searching the current operation log for N high-frequency words corresponding to N ordinal numbers in the high-frequency word ordered set in a preset order, to obtain N search results;

[0208] Step S311, determining the target ordinal number corresponding to the high-frequency word for which the search result is successfully found among the N search results;

[0209] Step S312: adjusting the initial value corresponding to the target ordinal number in the initial array to the target value to obtain the high-frequency vocabulary array of the current operation log;

[0210] Step S313, obtaining a first high-frequency vocabulary array and a second high-frequency vocabulary array from the plurality of high-frequency vocabulary arrays;

[0211] Step S314: determining a first operation log corresponding to the first high-frequency vocabulary array and a second operation log corresponding to the second high-frequency vocabulary array;

[0212] Step S315: calculating a first similarity between the first operation log and the second operation log;

[0213] In actual implementation, step S315 can be implemented as follows: calculating the first frequency corresponding to the high-frequency vocabulary of the current ordinal number in the first operation log and the second frequency corresponding to the high-frequency vocabulary in the second operation log; determining the adjustment item of the current ordinal number based on the first frequency and the second frequency; determining the weight of the current ordinal number based on the first frequency, the second frequency and the adjustment item; adjusting the distance between the first high-frequency vocabulary array and the second high-frequency vocabulary array based on the weight of the current ordinal number to obtain the adjusted distance; determining the first similarity between the first operation log and the second operation log based on the adjusted distance.

[0214] Step S316: Determine multiple first similarities calculated between any two operation logs in the multiple operation logs as calculation results.

[0215] Step S317, obtaining the number M of pre-classified items;

[0216] Step S318: clustering the plurality of operation logs into M categories according to the pre-classification number M and the calculation result;

[0217] Step S319: Determine that the M classifications are pre-classification results.

[0218] Step S320: Selecting an operation log from each category in the partial operation logs as a third operation log, and selecting an operation log from the remaining operation logs as a fourth operation log;

[0219] Step S321, respectively calculating the second similarities between the third operation log selected in each category and the fourth operation log, to obtain M second similarities;

[0220] Among them, calculating the second similarity between a third operation log of a category selection and the fourth operation log can be implemented as follows: calculating the third frequency corresponding to the high-frequency vocabulary of the current ordinal number in the third operation log and the fourth frequency corresponding to the current ordinal number in the fourth operation log; determining the weight of the current ordinal number based on the third frequency and the fourth frequency; adjusting the distance between the third high-frequency vocabulary array of the third operation log and the fourth high-frequency vocabulary array of the fourth operation log based on the weight of the current ordinal number to obtain the adjusted distance; and determining the second similarity between the third operation log and the fourth operation log based on the adjusted distance.

[0221] Step S322, determining the maximum second similarity among the M second similarities;

[0222] Step S323: Determine the marking result of the third operation log corresponding to the maximum second similarity as the marking result of the fourth operation log.

[0223] The sensitive information labeling method provided in the embodiment of the present application performs word segmentation processing on multiple operation logs in the log file; then extracts high-frequency words, calculates the similarity between the multiple operation logs based on the extracted high-frequency words, and divides the multiple operation logs once in combination with a clustering algorithm to achieve pre-classification. Pre-classification can effectively reduce classification errors caused by inconsistent understanding in the manual labeling process. Then, based on the pre-classification of multiple operation logs, a small number of operation logs are extracted to let experts mark the sensitivity level of sensitive information. The weight is adjusted based on the importance of high-frequency words, and the similarity between the operation logs with marked sensitivity levels and the operation logs with unmarked sensitivity levels is calculated. The sensitive information is then divided twice to achieve accurate classification of the sensitive information in the operation logs according to the sensitivity level.

[0224] The following describes an exemplary application of the embodiments of the present application in a practical application scenario.

[0225] In the era of big data, user data across all industries is becoming increasingly digitized. In recent years, large-scale leaks of sensitive personal information have become increasingly common. In particular, corporate employees exploiting their positions to steal sensitive user information has caused significant distress and financial losses.

[0226] In order to monitor employees' viewing, downloading, and exporting of user-sensitive data (corresponding to the "sensitive information" mentioned above), many companies have adopted information technology to record employee operations and achieve unified storage of operation logs. Based on the stored data, big data, artificial intelligence and other technologies are used to conduct targeted audits of operations involving user-sensitive data, promptly identify employee violations and illegal behaviors, and hold them accountable. Given limited time, manpower, and resources, the demand for supervision of non-sensitive data is often less than that of sensitive data. When supervising sensitive data, the intensity of supervision for sensitive data of different risk levels will also vary. In order to conduct effective audit supervision, accurate and efficient labeling of the sensitivity level of sensitive data is the basis and prerequisite. However, faced with diversified operational businesses and huge volumes of log records, manually labeling sensitive data has problems such as large workload, high cost, and low timeliness.

[0227] The solutions for automatically marking the sensitivity level of sensitive data in related technologies and their shortcomings are summarized as follows:

[0228] 1) An AI-based automatic labeling method for sensitive data involves first cleaning the data and generating training data. This training data is then used to train a classifier and identifier capable of classifying sensitive data. In this approach, the classifier and identifier for labeling sensitive data rely on a training sample set. The quality of the training sample set directly affects the accuracy of the classifier and identifier, so this approach cannot guarantee the accuracy of sensitive data labeling results.

[0229] 2) A method for labeling sensitive data based on its importance or sensitivity: This method first categorizes the sensitive data that needs to be protected within the big data platform, defines the specific content and attributes of each sensitive data category, and then labels the sensitive data with a sensitivity level based on the data's importance or sensitivity. This method utilizes sensitive data contained within the big data platform and is not widely applicable to sensitive data labeling outside of big data platforms. It is not suitable for automatically labeling sensitive data outside of big data platforms.

[0230] 3) A method for automatically labeling sensitive data based on mining algorithms: Each sensitive data mining algorithm is pre-assigned with identical and similar sensitive words. A segmented word is then matched against each identical and similar sensitive word. If a match is successful, the segmented word is identified as sensitive data. If all matches fail, the segmented word is identified as non-sensitive data. This approach requires pre-assigning identical and similar sensitive words to each sensitive data mining algorithm, and the reliability of the original sensitive word library directly affects the accuracy of labeling.

[0231] In response to the shortcomings of related technical solutions in terms of sensitive data labeling, the method proposed in the embodiment of the present application is to perform traditional word segmentation processing on the log content related to employee operation user sensitive data; calculate the similarity of the neighboring based on the extracted high-frequency words, and divide the operation log once in combination with the unsupervised algorithm. The pre-classification can effectively reduce the classification errors caused by inconsistent understanding in the manual labeling process; on the basis of the pre-classification of the operation log, extract a small number of operation logs and ask experts to mark the risk level of sensitive data, combine the weighted importance of high-frequency words, calculate the similarity of the marked risk level operation log and the unmarked risk level operation log, and perform a secondary division of the sensitive data, and finally accurately classify the risk level of the sensitive data. The embodiment of the present application uses the operation log as input data, and through a method that combines unsupervised learning and expert labeling, considers the influence of the importance weight of high-frequency words on the similarity calculation, and then divides the sensitive data twice according to the similarity, and finally marks the sensitive data as one of the five risk levels of "extremely sensitive level", "relatively sensitive level", "generally sensitive level", "low sensitive level" and "non-sensitive level" (corresponding to the "sensitive level" above).

[0232] Figure 4 A schematic diagram of an implementation module of the method for marking the risk level of sensitive data provided in an embodiment of the present application is shown in FIG. Figure 4 As shown, the method is processed by three modules, namely, operation log pre-processing module 401, operation log pre-classification module 402, and sensitive data level marking module 403. The functions of each module are as follows:

[0233] 1) Operation log preprocessing module 401 mainly extracts operation logs of sensitive business systems as input data for the next step; removes duplicate operation logs; performs word segmentation on the input sensitive business system operation logs, and extracts a high-frequency word set (corresponding to the "high-frequency word ordered set" mentioned above) for use by the subsequent operation log pre-classification algorithm.

[0234] 2) Operation log pre-classification module 402 calculates similarity based on the influence weights of the high-frequency word array and classifies operation logs with similarity above a threshold into the same category. This pre-classification effectively reduces labeling issues caused by inconsistent understanding when manually labeling sensitive data risk levels.

[0235] 3) Sensitive data level labeling module 403 extracts a small amount of operation logs from each category, asks experts to label the risk level of sensitive data, and then trains the sensitive data automatic labeling device based on the expert labeling results combined with the similarity algorithm and weight adjustment method.

[0236] Table 3 shows the sensitive data of the operation log, which mainly includes the operation ID, system number, operation type, and operation content. See the table below for details:

[0237] Table 3: Table structure of sensitive data in operation logs

[0238] Serial number Field Name Notes 1 operation_id Operation ID 2 system_id System Number 3 operation_type Operation Type 4 operation_content Operation content

[0239] Among them, "Operation ID" is the unique identifier of the operation log; "System Number" is the unique identifier to distinguish different business systems; "Operation Type" includes addition, deletion, modification, query, import (including upload), and export (including download); "Operation Content" is a detailed description of the operation process.

[0240] 1) Operation log preprocessing module

[0241] Operation log preprocessing primarily involves extracting operation logs from sensitive business systems, removing duplicate operation logs, and performing word segmentation on the operation logs. Extracting high-frequency word sets provides the data foundation for subsequent operation log pre-classification algorithms.

[0242] Business systems include sensitive business systems and non-sensitive business systems. Since the operation logs of non-sensitive business systems are all non-sensitive data, their risk levels are already clear, and there is no need to further identify the risk level of sensitive data according to this solution. Sensitive business systems include not only operation logs involving sensitive data, but also operation logs not involving sensitive data. In addition, the risk level of sensitive data is also divided into high and low. In order to mark non-sensitive data and sensitive data in sensitive business systems, and at the same time mark the different risk levels of sensitive data, the operation logs of sensitive business systems need to be used as input data for this solution.

[0243] Duplicate operation logs are removed to prevent duplicate logs from biasing the classifier's results. For batch operation logs, if the same operation ID corresponds to multiple records, only the first operation log is retained, and duplicate operations are removed.

[0244] For the operation logs of sensitive business systems, widely used algorithms such as Hidden Markov Model (HMM), Conditional Random Fields (CRF), and neural networks are used for word segmentation to extract keywords and remove punctuation and stop words. Based on the word library segmentation, the frequency of word occurrence is calculated using the following method: Among them, count i is the frequency of occurrence of the i-th word, count total is the total number of operation logs. i When it is greater than the threshold α, the word is considered to be a high-frequency word, that is, the high-frequency word set C high_freq Elements of high-frequency vocabulary set C high_freq In the example, the high-frequency words of each operation log are stored in the form of an ordered array of equal length, that is, x∈C high_freq And x=[x1,x2,…,x n ].

[0245] 2) Operation log pre-classification module

[0246] Based on the high-frequency word set obtained through preprocessing, in order to accurately measure the similarity of the operation logs, we added the weighted distance adjustment and performed a pre-classification of the operation logs using an unsupervised algorithm. The similarity of the operation logs can be calculated based on the corresponding high-frequency word arrays x and y, and is defined as S(x,y). Where x∈C high_freq , y∈C high_freq ,x=[x1,x2,…,x n ],y=[y1,y2,…,y n ].

[0247] When the similarity S(x,y)>β, the operation logs are classified into the same category. The details are as follows:

[0248]

[0249] It should be noted that formula (5) indicates that the similarity between high-frequency word arrays x and y is the inverse of the distance between the two, that is, Where d(x,y) is the distance between x and y.

[0250] Formula (6) represents the distance d(x,y) between x and y, that is in, is the adjusted weight. In practice, it is found that high-frequency words that appear infrequently have a greater impact on classification; on the contrary, words that appear too frequently are not very useful for classification. Therefore, when calculating similarity, the adjusted weight can increase the influence of high-frequency words that do not appear frequently in operation logs on classification. The smaller the value, the smaller the distance d(x,y) between x and y, and the larger the value of the similarity S(x,y).

[0251] Formula (7) represents the adjusted weight It is calculated based on the frequency of occurrence of the i-th high-frequency word in arrays x and y. i Indicates adjustment items. As the basis for adjusting the weight, both high-frequency words x i The influence of y on the similarity measurement is also considered. i The degree of influence on the similarity measurement.

[0252] Formula (8) represents the adjustment term φ i The value is between (0, 1], according to the weight The value of can further divide φ i For example, when When the value of is between (0, a], φ i The value of is a value between (q, 1]; When the value of is between (a,b], φ i The value of is a value between (p, q]; and so on, When the value of is between (c,α], φ i The value of is a value between (0, t]. Generally speaking, The smaller the value of i The value of jump increases, according to this method, the adjustment term φ i Flexibly adjust the importance of high-frequency words for similarity measurement.

[0253] In formula (9), the words in arrays x and y are all high-frequency words, so and

[0254] 3) Sensitive data level marking module

[0255] The main function of the sensitive data level labeling module is to extract several operation contents from each of the N categories divided by the operation log pre-classification module, and ask experts to label the risk level of the sensitive data. When the number of labels for the five risk levels of "extremely sensitive", "relatively sensitive", "normally sensitive", "lowly sensitive" and "non-sensitive" is greater than n, the labeling work is completed. According to the expert labeling results, the weights are adjusted in combination with high-frequency words, and the similarity S (x signed ,y no_signed ). When the similarity S(x signed ,y no_signed )>γ, select max(S(x signed ,y no_signed )) serves as the basis for marking unmarked risk level operation logs.

[0256]

[0257] It should be noted that formula (10) indicates that the similarity between the risk-level operation log x and the unmarked risk-level operation log y is the inverse of the distance between the two, that is, where d(x signed ,y no_signed ) is the distance between the risk-level marked operation log x and the unmarked risk-level operation log y.

[0258] Formula (11) represents the distance between the risk-level operation log x and the unmarked risk-level operation log y. Among them, f sign It is used to adjust the weight of importance. The lower the frequency of high-frequency words, the higher the calculated weight f sign The smaller the distance d(x signed ,y no_signed ) is smaller, and the similarity S(x signed ,y no_signed ) is larger. It can be seen that by adjusting the importance weight f sign , which can effectively increase the influence of high-frequency words with lower frequency of occurrence on the mark.

[0259] Formula (12) represents the weight The weight is calculated based on the frequency of high-frequency words in the operation logs with marked risk levels and the operation logs with unmarked risk levels. i Corrected the importance of high-frequency words for similarity measurement, so no adjustment is added during secondary classification. The calculated weight f sign,The importance of high-frequency words in the marked risk level operation logs and unmarked risk level operation logs to similarity measurement is comprehensively considered.

[0260] The final output results are presented in the form of a table. The table structure is as follows:

[0261] Table 4 Table structure of the final output results

[0262] Serial number Field Name Notes 1 operation_id Operation ID 2 system_id System Number 3 operation_type Operation Type 4 operation_content Operation content 5 risk_level Risk Level 6 similarity Similarity

[0263] The embodiment of the present application provides a method for automatic labeling of sensitive data based on operation logs and big data mining technology. It defines a classification model by considering the similarity of high-frequency words and importance weights, and then performs secondary classification on the sensitive data according to the defined classification model to achieve classification of the sensitive data.

[0264] The technical advantages of this proposal are mainly reflected in the following aspects:

[0265] 1) When calculating the similarity of sensitive data in operation logs, we introduce custom importance weights for medium- and low-frequency high-frequency words that have a greater impact on classification. We assign higher weights to low-frequency high-frequency words and lower weights to high-frequency high-frequency words, which can effectively improve classification accuracy.

[0266] 2) In related technologies, classifiers and identifiers for labeling sensitive data rely on the quality of the training sample set. This solution uses an unsupervised learning method based on the full data set for preliminary classification of operation logs. This method does not rely on the training sample set, thus reducing the impact of the training sample set data quality on the model.

[0267] 3) Related technologies utilize sensitive data contained within big data platforms, making their tagging methods less applicable to sensitive data outside of these platforms. This solution directly segmentes operation logs and categorizes them based on high-frequency words, eliminating the need for a pre-defined vocabulary and effectively improving the scalability of classification applications.

[0268] 4) Related technologies pre-assign identical and similar sensitive terms to each sensitive data mining algorithm, requiring a reliable database of original sensitive terms. This solution first performs unsupervised automatic classification of operation logs, avoiding unreliable classification results caused by differences in understanding during the manual labeling process. Based on this pre-classification, experts label a small amount of sensitive data according to its risk level, and then introduce a secondary classification mechanism for sensitive data operation logs, ultimately training a reliable sensitive data database and automatic labeling model.

[0269] Based on the foregoing embodiments, an embodiment of the present application provides a sensitive information marking device, wherein the modules included in the device and the units included in each module can be implemented by a processor in a computer device; of course, they can also be implemented by a specific logic circuit; in the implementation process, the processor can be a central processing unit (CPU, Central Processing Unit), a microprocessor (MPU, Microprocessor Unit), a digital signal processor (DSP, Digital Signal Processing) or a field programmable gate array (FPGA, Field Programmable Gate Array), etc.

[0270] The present application further provides a sensitive information marking device. Figure 5 This is a schematic diagram of the structure of the sensitive information marking device provided in the embodiment of the present application, as shown in FIG. Figure 5 As shown, the sensitive information marking device 500 includes:

[0271] An extraction module 501 is configured to extract high-frequency words from a plurality of operation logs in a log file to obtain an ordered set of high-frequency words, wherein the high-frequency words are words that appear in the plurality of operation logs at a frequency greater than a preset frequency threshold;

[0272] A pre-classification module 502 is configured to pre-classify the plurality of operation logs based on the high-frequency words in each operation log and the ordered set of high-frequency words to obtain a pre-classification result;

[0273] A first acquisition module 503 is configured to filter out some operation logs from the pre-classification results and obtain marking results for the some operation logs, where the marking results are used to characterize the sensitivity level of sensitive information included in the operation logs;

[0274] The marking module 504 is configured to determine, based on the marking results of the partial operation logs, marking results of the remaining operation logs in the plurality of operation logs except the partial operation logs.

[0275] In some embodiments, the extraction module 501 may also be used to:

[0276] Obtain log files from sensitive business systems;

[0277] Obtain multiple operation logs from the log file;

[0278] Performing word segmentation processing on the current operation log to obtain multiple word segments of the current operation log;

[0279] Calculate the frequency of each word appearing in the multiple operation logs;

[0280] Determine the segmented words whose frequency is greater than the preset frequency threshold as high-frequency words in the current operation log;

[0281] The high-frequency words of the plurality of operation logs are arranged in order to form an ordered set of high-frequency words.

[0282] In some embodiments, the sensitive information marking device 500 may further include:

[0283] A second acquisition module is used to obtain identification information of the multiple operation logs;

[0284] The deduplication processing module is used to perform deduplication processing on the multiple operation logs according to the identification information to obtain multiple processed operation logs, and the identification information of the multiple processed operation logs is different.

[0285] In some embodiments, the pre-classification module 502 may also be used to:

[0286] Determine a high-frequency vocabulary array corresponding to each operation log based on the high-frequency vocabulary of each operation log and the high-frequency vocabulary ordered set;

[0287] Calculating a first similarity between any two operation logs in the plurality of operation logs based on a plurality of high-frequency word arrays corresponding to the plurality of operation logs to obtain a calculation result;

[0288] Obtaining a pre-classification number M, and clustering the plurality of operation logs into M categories according to the pre-classification number M and the calculation result;

[0289] The M classifications are determined as pre-classification results.

[0290] In some embodiments, the pre-classification module 502 may also be used to:

[0291] Initialize an initial array including N elements, where N is the number of high-frequency words in the ordered set of high-frequency words;

[0292] Searching the current operation log for N high-frequency words corresponding to N ordinal numbers in the high-frequency word ordered set in a preset order to obtain N search results;

[0293] Determine, among the N search results, the target ordinal number corresponding to the high-frequency word for which the search result is successfully found;

[0294] The initial value corresponding to the target ordinal number in the initial array is adjusted to the target value to obtain the high-frequency vocabulary array of the current operation log.

[0295] In some embodiments, the pre-classification module 502 may also be used to:

[0296] Acquire a first high-frequency vocabulary array and a second high-frequency vocabulary array from the plurality of high-frequency vocabulary arrays;

[0297] Determine a first operation log corresponding to the first high-frequency vocabulary array and a second operation log corresponding to the second high-frequency vocabulary array;

[0298] Calculating a first similarity between the first operation log and the second operation log;

[0299] A plurality of first similarities calculated between any two operation logs in the plurality of operation logs are determined as calculation results.

[0300] In some embodiments, the pre-classification module 502 may also be used to:

[0301] Calculate a first frequency of a high-frequency word of a current ordinal number in the first operation log and a second frequency of the high-frequency word in the second operation log;

[0302] determining an adjustment item of a current ordinal number according to the first frequency and the second frequency;

[0303] determining a weight of a current ordinal number according to the first frequency, the second frequency, and the adjustment item;

[0304] Adjusting the distance between the first high-frequency vocabulary array and the second high-frequency vocabulary array according to the weight of the current ordinal number to obtain an adjusted distance;

[0305] A first similarity between the first operation log and the second operation log is determined according to the adjusted distance.

[0306] In some embodiments, the marking module 504 may also be used to:

[0307] Selecting an operation log from each category in the partial operation logs as a third operation log, and selecting an operation log from the remaining operation logs as a fourth operation log;

[0308] Calculating the second similarities between the third operation log selected in each category and the fourth operation log respectively to obtain M second similarities;

[0309] Determining a maximum second similarity among the M second similarities;

[0310] The marking result of the third operation log corresponding to the maximum second similarity is determined as the marking result of the fourth operation log.

[0311] In some embodiments, the marking module 504 may also be used to:

[0312] Calculate a third frequency of the high-frequency word of the current ordinal number in the third operation log and a fourth frequency in the fourth operation log;

[0313] determining a weight of a current ordinal number according to the third frequency and the fourth frequency;

[0314] adjusting the distance between the third high-frequency vocabulary array of the third operation log and the fourth high-frequency vocabulary array of the fourth operation log according to the weight of the current ordinal number to obtain an adjusted distance;

[0315] A second similarity between the third operation log and the fourth operation log is determined according to the adjusted distance.

[0316] It should be noted that the description of the above sensitive information marking device embodiment is similar to the description of the above method embodiment and has the same beneficial effects as the method embodiment. For any technical details not disclosed in the sensitive information marking device embodiment of this application, those skilled in the art should refer to the description of the method embodiment of this application for understanding.

[0317] It should be noted that in the embodiments of the present application, if the above-mentioned sensitive information marking method is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a U disk, a mobile hard disk, a read-only memory (ROM, Read Only Memory), a magnetic disk or an optical disk. In this way, the embodiments of the present application are not limited to any specific combination of hardware and software.

[0318] Accordingly, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps in the sensitive information marking method provided in the above embodiment are implemented.

[0319] The present invention provides a sensitive information marking device. Figure 6 This is a schematic diagram of the structure of the sensitive information marking device provided in the embodiment of the present application, according to Figure 6The exemplary structure of the sensitive information marking device 600 shown can foresee other exemplary structures of the sensitive information marking device 600, so the structure described here should not be regarded as limiting. For example, some components described below can be omitted, or components not described below can be added to meet the special needs of certain applications.

[0320] Figure 6 The sensitive information labeling device 600 shown includes: a processor 601, at least one communication bus 602, a user interface 603, at least one external communication interface 604, and a memory 605. The communication bus 602 is configured to enable communication between these components. The user interface 603 may include a display screen, and the external communication interface 604 may include standard wired and wireless interfaces. The processor 601 is configured to execute a program for the sensitive information labeling method stored in the memory to implement the steps of the sensitive information labeling method provided in the above embodiment.

[0321] The description of the above embodiments of the sensitive information marking device and storage medium is similar to the description of the above method embodiments, and has similar beneficial effects as the method embodiments. For technical details not disclosed in the embodiments of the sensitive information marking device and storage medium of this application, please refer to the description of the method embodiments of this application for understanding.

[0322] It should be understood that "one embodiment" or "an embodiment" mentioned throughout the specification means that the specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, "in one embodiment" or "in an embodiment" appearing throughout the specification does not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application. The above-mentioned serial numbers of the embodiments of the present application are for description only and do not represent the advantages and disadvantages of the embodiments.

[0323] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or apparatus comprising the element.

[0324] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0325] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units; they may be located in one place or distributed across multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the scheme of this embodiment.

[0326] In addition, all functional units in the embodiments of the present application can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the above-mentioned integrated units can be implemented in the form of hardware or in the form of hardware plus software functional units.

[0327] Those skilled in the art will understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above-mentioned method embodiments; and the aforementioned storage medium includes: mobile storage devices, ROM, disks or optical disks, and other media that can store program codes.

[0328] Alternatively, if the above-mentioned integrated unit of the present application is implemented in the form of a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling an AC to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROMs, magnetic disks or optical disks.

[0329] The above is merely an embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A sensitive information marking method, characterized in that: The method comprises: Obtain log files from sensitive business systems; Obtain multiple operation logs from the log file; Extracting high-frequency words from the plurality of operation logs to obtain an ordered set of high-frequency words, wherein the high-frequency words are words that appear in the plurality of operation logs with a frequency greater than a preset frequency threshold; sorting the ordered set of high-frequency words in lexicographic order, in frequency, or in the order in which the high-frequency words appear in the log file; Pre-classifying the plurality of operation logs based on the high-frequency words in each operation log and the ordered set of high-frequency words to obtain a pre-classification result; Filtering out some operation logs from each pre-classification result, and obtaining marking results of the some operation logs, wherein the marking results are used to characterize the sensitivity level of sensitive information included in the operation logs; Based on the marking results of the partial operation logs, marking results of the remaining operation logs in the plurality of operation logs except the partial operation logs are determined.

2. The method according to claim 1, characterized in that The extracting high-frequency words from the plurality of operation logs to obtain an ordered set of high-frequency words includes: Performing word segmentation processing on the current operation log to obtain multiple word segments of the current operation log; Calculate the frequency of each word appearing in the multiple operation logs; Determine the segmented words whose frequency is greater than the preset frequency threshold as high-frequency words in the current operation log; The high-frequency words of the plurality of operation logs are arranged in order to form an ordered set of high-frequency words.

3. The method according to claim 2, characterized in that After obtaining the plurality of operation logs from the log file, the method further includes: Obtaining identification information of the plurality of operation logs; Deduplication processing is performed on the multiple operation logs according to the identification information to obtain multiple processed operation logs, and the identification information of the multiple processed operation logs is different.

4. The method according to claim 1, wherein The pre-classification of the plurality of operation logs based on the high-frequency words and the ordered set of high-frequency words in each operation log to obtain a pre-classification result includes: Determine a high-frequency vocabulary array corresponding to each operation log based on the high-frequency vocabulary of each operation log and the high-frequency vocabulary ordered set; Calculating a first similarity between any two operation logs in the plurality of operation logs based on a plurality of high-frequency word arrays corresponding to the plurality of operation logs to obtain a calculation result; Obtaining a pre-classification number M, and clustering the plurality of operation logs into M categories according to the pre-classification number M and the calculation result; The M classifications are determined as pre-classification results.

5. The method according to claim 4, characterized in that The determining of the high-frequency vocabulary array corresponding to each operation log based on the high-frequency vocabulary and the high-frequency vocabulary ordered set of each operation log includes: Initialize an initial array including N elements, where N is the number of high-frequency words in the ordered set of high-frequency words; Searching the current operation log for N high-frequency words corresponding to N ordinal numbers in the high-frequency word ordered set in a preset order to obtain N search results; Determine, among the N search results, the target ordinal number corresponding to the high-frequency word for which the search result is successfully found; The initial value corresponding to the target ordinal number in the initial array is adjusted to the target value to obtain the high-frequency vocabulary array of the current operation log.

6. The method according to claim 4, characterized in that The calculating, based on the plurality of high-frequency word arrays corresponding to the plurality of operation logs, a first similarity between any two operation logs in the plurality of operation logs to obtain a calculation result, includes: Acquire a first high-frequency vocabulary array and a second high-frequency vocabulary array from the plurality of high-frequency vocabulary arrays; Determine a first operation log corresponding to the first high-frequency vocabulary array and a second operation log corresponding to the second high-frequency vocabulary array; Calculating a first similarity between the first operation log and the second operation log; A plurality of first similarities calculated between any two operation logs in the plurality of operation logs are determined as calculation results.

7. The method according to claim 6, characterized in that The calculating a first similarity between the first operation log and the second operation log includes: Calculate a first frequency of a high-frequency word of a current ordinal number in the first operation log and a second frequency of the high-frequency word in the second operation log; determining an adjustment item of a current ordinal number according to the first frequency and the second frequency; determining a weight of a current ordinal number according to the first frequency, the second frequency, and the adjustment item; Adjusting the distance between the first high-frequency vocabulary array and the second high-frequency vocabulary array according to the weight of the current ordinal number to obtain an adjusted distance; A first similarity between the first operation log and the second operation log is determined according to the adjusted distance.

8. The method according to claim 4, characterized in that The determining, based on the marking results of the partial operation logs, marking results of the remaining operation logs in the plurality of operation logs except the partial operation logs, includes: Selecting an operation log from each category in the partial operation logs as a third operation log, and selecting an operation log from the remaining operation logs as a fourth operation log; Calculating the second similarities between the third operation log selected in each category and the fourth operation log respectively to obtain M second similarities; Determining a maximum second similarity among the M second similarities; The marking result of the third operation log corresponding to the maximum second similarity is determined as the marking result of the fourth operation log.

9. The method according to claim 8, characterized in that Calculating a second similarity between a third operation log selected in a category and the fourth operation log includes: Calculate a third frequency of the high-frequency word of the current ordinal number in the third operation log and a fourth frequency in the fourth operation log; determining a weight of a current ordinal number according to the third frequency and the fourth frequency; adjusting the distance between the third high-frequency vocabulary array of the third operation log and the fourth high-frequency vocabulary array of the fourth operation log according to the weight of the current ordinal number to obtain an adjusted distance; A second similarity between the third operation log and the fourth operation log is determined according to the adjusted distance.

10. A sensitive information marking device, characterized in that: The device comprises: An extraction module is configured to obtain log files of sensitive business systems; obtain multiple operation logs from the log files; extract high-frequency words from the multiple operation logs to obtain an ordered set of high-frequency words, wherein the high-frequency words are words that appear in the multiple operation logs at a frequency greater than a preset frequency threshold; a pre-classification module for pre-classifying the plurality of operation logs based on the high-frequency words in each operation log and the ordered set of high-frequency words to obtain a pre-classification result; the ordered set of high-frequency words is sorted in lexicographic order, in frequency order, or in the order in which the high-frequency words appear in the log file; a first acquisition module, configured to filter out some operation logs from the pre-classification results and obtain marking results for the some operation logs, wherein the marking results are used to characterize the sensitivity level of sensitive information included in the operation logs; The marking module is configured to determine, based on the marking results of the partial operation logs, marking results of the remaining operation logs in the plurality of operation logs except the partial operation logs.

11. A sensitive information marking device, characterized in that: The device comprises: processor; and a memory for storing a computer program executable on the processor; Wherein, when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 9 are implemented.

12. A computer-readable storage medium, characterized in that Computer-executable instructions are stored, and the computer-executable instructions are configured to execute the steps of the method according to any one of claims 1 to 9.

Images