A compliance checking method for privacy data usage based on a knowledge graph

Abstract

The application belongs to the technical field of privacy data use compliance checking, and provides a compliance checking method for privacy data use based on a knowledge graph.The main purpose is to automatically detect whether there is non-compliance in the use process of data, and the main scheme comprises extracting rules for compliance detection from acquired privacy policy data, in order to use a formalized method to express sentences in unstructured text, first, entities are recognized;according to the recognized entities, relationships between different entities are mined from the privacy policy, a rule library composed of triples is constructed, and a knowledge graph is constructed;the processing process of privacy data is obtained from the audit log of a data processing engine, metadata in the privacy data is found out, and a directed acyclic graph representing the data processing process, namely a data processing graph, is established;the graph representing the data processing process is matched with the knowledge graph, whether the data processing process conforms to the rules defined by the privacy policy is judged, and the cause leading to non-compliance is found out.

Description

Technical Field

[0001] This invention belongs to the field of privacy data usage compliance inspection technology, and provides a privacy data usage compliance inspection method based on knowledge graph. Background Technology

[0002] In recent years, emerging internet technologies such as big data and artificial intelligence have continuously revolutionized our lives. While efficient information processing has facilitated our lives, the leakage of sensitive personal information has also brought numerous problems. In the information technology era, the continuous occurrence of privacy data leaks, misuse, and misappropriation has demonstrated the serious impact of non-compliant data use on society. Countries around the world are increasingly emphasizing data security, and data compliance is gradually coming to the forefront of public attention. Data compliance refers to companies and industry organizations adhering to data usage regulations and legally and compliantly collecting, using, storing, and managing data.

[0003] As personal privacy data receives increasing attention from all sectors of society, numerous laws have been enacted both domestically and internationally. These include the EU's General Data Protection Regulation (GDPR), and China's Data Security Law and Personal Information Protection Law, which provide support for my country's digital economy and form the basis for compliance testing. Compliance testing typically involves two aspects. First, identifying privacy policies. This primarily involves extracting security rules from relevant privacy policies, identifying access control policies, and conducting compliance testing based on these rules. Privacy policies are crucial for both businesses and users. Users can understand how their data is used through these policies, and businesses can conduct self-checks by developing their own privacy policies. Second, ensuring consistency in data usage. As data processing rules become increasingly stringent and standardized, inconsistencies between information processing and privacy rules can arise. These issues have attracted considerable attention from scholars, who are working to determine whether the processing of privacy data is compliant.

[0004] The first aspect of privacy data compliance testing is the extraction of security rules. These rules can simplify the reading burden for users, allowing them to quickly understand how privacy data is processed, and also help companies verify in practice whether data use is consistent with predefined policies. The technical challenge lies in how to extract rules for compliance testing from complex and ever-changing unstructured text data. While manual methods are highly accurate, they are too inefficient to keep up with the ever-increasing volume of privacy policies and the rapid pace of data development in today's era. Automated methods are gaining increasing attention. In automatic rule extraction, existing methods typically combine machine learning with predefined templates. First, machine learning algorithms are used to classify syntactic structures; then, rules are generated from the privacy policy based on templates and keywords. However, this approach has significant drawbacks. Rules extracted from manually defined templates are incomplete and cannot cover all statements, resulting in incomplete rule extraction. Furthermore, identifying rules from statements using machine learning requires a large amount of training data, which typically needs to be manually labeled and often lacks scalability, making it difficult to apply to other types of privacy policies. Regarding data processing compliance, which involves checking whether the use of data is within the scope of the rules, existing methods are usually based on purpose-aware approaches to determine whether the processing of data falls within that purpose. There are also methods that use data flows and business processes, but these methods describe abstractions of behavior that are not related to privacy policies and cannot be combined with privacy processing rules.

[0005] To address the aforementioned issues, we propose a knowledge graph-based compliance check method for privacy data use. This method aims to automate the representation of rules implicit in privacy policies within a knowledge graph, thus resolving the complexity and variability of privacy policies. Simultaneously, metadata from data processing is extracted and represented as a directed acyclic graph (DAG), which is then matched against the rules in the knowledge graph to determine compliance. Summary of the Invention

[0006] This invention is proposed in view of the problems existing in existing methods for detecting compliance with the use of privacy data.

[0007] This invention provides a compliance check method for the use of privacy data based on knowledge graphs. It constructs the security rules in the enterprise's privacy policy into a knowledge graph, models the data processing process into a directed graph and matches it with the rules in the knowledge graph, and uses it to automatically detect whether there are any non-compliance issues in the use of data.

[0008] The objective of this invention is achieved through the following technical solution:

[0009] A compliance check method for the use of privacy data based on knowledge graphs includes the following steps:

[0010] Step 1: Obtain privacy policy data;

[0011] Step 2: Extract the rules for compliance testing from the obtained privacy policy data. In order to express the statements in the unstructured text using formal methods, first identify the entities and obtain the entity type Ek.

[0012] Step 3: Based on the identified entities, mine the relationships between different entities from the privacy policy, build a rule base composed of triples, and construct a knowledge graph through entity alignment;

[0013] Step 4: Obtain the processing procedure of privacy data from the audit logs of the data processing engine, find the metadata in the privacy data, and build a directed acyclic graph representing the data processing procedure, referred to as the data processing graph;

[0014] Step 5: Match the graph representing the data processing process with the knowledge graph to determine whether the data processing process complies with the rules defined in the privacy policy, and identify the reasons for non-compliance.

[0015] In the above technical solution, step 2 includes the following sub-steps:

[0016] Step 2.1: Segment the privacy policy into multiple complete sentences {S1, S2, ..., S...} n}。 ;

[0017] Step 2.2: Take a complete sentence S k Using existing word segmentation techniques, we obtain multiple phrases {T1, T2, ..., T...}. m};

[0018] Step 2.3: Use all phrases belonging to a sentence as input to the pre-trained model to obtain the vector representation of each phrase.

[0019] Step 2.4: For each sentence S k Phrase vector representation The aggregation operation is performed, and the data is input into a linear neural network F1, treated as a binary classification problem. This determines whether the sentence contains a data processing rule. If the sentence does not contain a rule, no further processing is performed on that sentence; if the sentence S... k If processing rules are present, proceed to step 2.5;

[0020] Step 2.5: Vectorize each phrase The input is fed into a model for entity recognition, and normalization is used to obtain the label probabilities {P1, P2, ..., P} for different entity types. m}

[0021] Step 2.6: Transform sentence Sk The entity type label probability of all phrases in {P1, P2, ..., P} m The input is fed into the CRF layer. Since the label probabilities do not consider the order of entity types between phrases, the CRF layer learns the order of entity types in the sentences in the training set and adjusts the label probabilities of entity types to make the order of entity types in the phrases in the sentence reasonable and grammatically correct, thus obtaining the final entity type E for each phrase. k .

[0022] In the above technical solution, step 3 includes the following sub-steps:

[0023] Step 3.1: For each sentence S k Different entities in the data, each entity type E k By combining with other different entity types, we obtain all possible entity pairs {E}. k E m}

[0024] Step 3.2: For each entity pair {E} k E m To perform relation identification, first, the dependency relationships between entities are obtained. If a dependency relationship exists, a triple {E} is constructed. k [belong to],E m} represents entity type E k It is E m Subtypes;

[0025] Step 3.3: If two entities {E} k E m If there is no subordinate relationship, then extract the metadata of the processing relationship between the two entities. This relation metadata includes two relation types, represented as [R approach ,R purpose ], representing the method and purpose of compliant data processing, respectively, constructing {E k ,[R approach ,R purpose ],E m In the triple of}, the first entity represents the role that performs data processing, and the second entity represents the data object being processed;

[0026] Step 3.4: Form a rule base based on triples, and perform entity alignment on the rule base. In order to find entities with different expressions but the same reference, entity alignment is performed by judging the similarity of entity vector representations, and then fused into a complete knowledge graph.

[0027] In the above technical solution, step 4 includes the following sub-steps:

[0028] Step 4.1: When enterprise-related data platforms and systems use data, the relevant information on these data processing begins to be generated during the task submission stage. The data processing engine mainly includes the relevant programs that perform data operations on the platform or system. The processing process of privacy data is obtained from the audit logs of the data processing engine. The processing process of a single data object is divided into units based on the operations performed on the individual data object, including the role using the data, the data object being operated on, the method of operating the data, and the purpose of using the data.

[0029] Step 4.2: Perform text replacement on the obtained data processing process, such as replacing specific place names and specific phone numbers with more abstract words such as "location" and "telephone" as entities.

[0030] Step 4.3: Perform word segmentation and vector representation on the replaced data, then extract the metadata and represent it as a directed acyclic graph, treating it as a multi-task, multi-label classification problem. The first node represents the role N of using the data. role The second node represents data object N. data The side indicates the method of manipulating the data and the purpose of using the data [E] approach E purpose ].

[0031] In the above technical solution, step 5 includes the following sub-steps:

[0032] Step 5.1: Extract the directed acyclic graph representing the data processing process, i.e., the data usage method E in the data processing graph. approach Traverse the relations E in the rules of the knowledge graph approach If the data uses method E approach No relation R approach If they are the same, then the operation method is not compliant.

[0033] Step 5.2: If E exists approach With R approach Same, retrieve R approach Head node E in the knowledge graph head Tail node E tail 。;

[0034] Step 5.3: Based on the type attribution relationships in the knowledge graph, find entity E respectively. head and E tail All parent type entities, with entity E head and E tail They respectively form set S head and S tail Two sets of entities;

[0035] Step 5.4: Extract the relevant data operation method E from the data processing diagram. approach The role N that uses the connected data role and data object N data Traverse set S head and S tail Does it include the role N that uses the data? role and data object N data If it is present, it indicates that the role N using the data is... role and data object N data Compliance; if not included, then find the next element in the knowledge graph that corresponds to E. approach Same relation R approach If step 5.3 is executed and the traversal is complete, it will return that the role and data object using the data are not compliant.

[0036] Step 5.5: In set S head and S tail N were found respectively role and N data Then extract the relevant information from the knowledge graph that corresponds to R. approach Adjacent R purpose Compare whether it matches E in the data processing diagram. purpose If they are the same, return "Data processing compliant"; otherwise, continue iterating through R. approach If step 5.3 is executed and the traversal is complete, it will return an error indicating that the intended use is non-compliant.

[0037] Because the present invention employs the above-mentioned technical means, it has the following beneficial effects:

[0038] (1) A novel method for checking whether the use of privacy data complies with the privacy policy statement is proposed. It utilizes the structure of knowledge graphs, has a wide range of applications, can greatly reduce the workload, and realize the compliance check of the privacy data use process.

[0039] (2) A novel knowledge graph structure was constructed, in which the relationships are composed of the processing methods and purposes of privacy data, effectively formalizing the data usage rules in the privacy policy.

[0040] (3) A new form of modeling the processing of privacy data is presented, which effectively represents the data processing process as a graph structure.

[0041] (4) A method for matching data processing process graphs with knowledge graphs is given, which effectively realizes automatic compliance detection. Attached Figure Description

[0042] Figure 1 This is an overall structural diagram of the present invention.

[0043] Figure 2 This is a model diagram of how the entity is identified in the privacy policy of this invention.

[0044] Figure 3 This is a model diagram for implementing multi-task relationship extraction in this invention.

[0045] Figure 4 This is a structural diagram of the data processing process modeled as a directed graph in this invention. Detailed Implementation

[0046] The embodiments of the present invention will be described in detail below. Although the present invention will be described and illustrated in conjunction with some specific embodiments, it should be noted that the present invention is not limited to these embodiments. On the contrary, any modifications or equivalent substitutions made to the present invention should be covered within the scope of the claims of the present invention.

[0047] Furthermore, to better illustrate the present invention, numerous specific details are set forth in the following detailed embodiments. Those skilled in the art will understand that the present invention can be practiced without these specific details.

[0048] This invention provides a knowledge graph-based method for compliance checks on the use of privacy data, the specific structure of which is as follows: Figure 1 As shown, the process includes the following steps: obtaining privacy policy data; extracting rules for compliance checks from the obtained privacy policy data; firstly, identifying entities to formalize statements in unstructured text; secondly, mining relationships between different entities based on the identified entities, constructing a rule base composed of triples, and building a knowledge graph through entity alignment; thirdly, obtaining the processing procedure of privacy data from the audit logs of the data processing engine, identifying metadata in the privacy data, and establishing a directed acyclic graph (DAG) representing the data processing procedure; and fourthly, matching the DAG representing the data processing procedure with the knowledge graph to determine whether the data processing procedure conforms to the rules defined in the privacy policy and identifying the reasons for non-compliance.

[0049] In step 2, rules for compliance checks are extracted from the acquired privacy policy data. First, entity identification is performed, and the model structure is as follows: Figure 2 As shown.

[0050] S1: Divide the complete privacy policy into multiple independent sentences. Entity identification and subsequent relation extraction can be performed within each independent sentence, using {S1, S2, ..., S...}. n} represents all n sentences.

[0051] S2: For a certain sentence S kFirst, word segmentation is performed. Word segmentation can utilize existing natural language processing (NLP) model interface APIs to automatically segment sentences. k Word segmentation yields the phrases {T1, T2, ..., T} in the sentence. m}

[0052] S3: Using a pre-trained model, the phrases {T1,T2,…,T...} in the sentence are... m Transform into vector representation in The vector representing the start symbol of a sentence can leverage the rich language knowledge learned by pre-trained models, reducing reliance on the training set. In the privacy policy domain, where labeled datasets are scarce, pre-trained models can greatly simplify the workload of manual labeling.

[0053] S4: For a given sentence S k First, we need to determine whether the sentence contains rules for processing private data. Therefore, we need to obtain the vector representation of the entire sentence. We then obtain the sentence vector by taking a weighted average of the vector representations of all phrases. Where a i The weights of the vector representing the phrase are learned through a network, allowing us to treat this problem as a binary classification problem. The final probability P is obtained through a multilayer perceptron network whose output is two neurons.

[0054]

[0055]

[0056] S5: If sentence S k It contains data processing rules, according to Figure 2 The structure shown inputs the vectors of phrases into a linear layer to obtain the probabilities of entity types. Entity types are divided into three main categories: the first category is non-entity entities; the second category represents entities that act on the data, such as employees, administrators, and third-party organizations; and the third category represents entities that operate on the data objects, such as specific data types like identity information, travel information, and purchase information. This task can be viewed as a classification task, with phrases as input and each phrase T as output. k The label probabilities {P1, P2, ..., P} m}

[0057] S6: After initially obtaining the probability type of each entity through the linear layer, the label probabilities of all phrases in a sentence are assigned to the CRF layer. Previous label predictions were based on individual phrases and did not fully consider the dependencies between phrases. That is, the order of consecutive phrases according to their corresponding entity types must conform to grammar. The sentence S... kAll phrases T in k The label probabilities are input into the CRF layer to obtain the adjusted label probabilities, and finally, for each phrase T... k The final entity type is E. k =argmax{P1,P2,…,P m}

[0058] Step 3: Based on the entity types obtained from the sentences, mine the relationships between different entities from the privacy policy. The structure of the relationship extraction model is as follows: Figure 3 As shown, it can be viewed as a multi-task model. The first task extracts the subordinate relationships between entities, the second task extracts the specific methods of operation data, and the third task extracts the purpose of operation data. A rule base composed of triples is constructed, and a knowledge graph is constructed through entity alignment.

[0059] S1: A sentence S k Given multiple entities {E1, E2, ...}, list all possible combinations of two entities {E1, E2, ...}. k E m Extract the relationship between two entities.

[0060] S2: For entities belonging to the same major category, there may be hierarchical relationships between them. For example, in the role entity, administrator is a subclass of employee, and in the data object type, name is a subclass of identity information. The model structure is as follows: Figure 2 Task 1 in the text, for entity pair {E k E m}, Determination of Subordination Relationships R belong The discrimination can be viewed as a binary classification problem, namely, determining the entity type E. k Is it E? m The subclass of [class] will have its word vector H0, representing the sentence start symbol [CLS], and its entity E. k E m phrase vectors The inputs are fed into three linear layers respectively, and the results are concatenated to obtain a one-dimensional vector, namely [MLP1(H0)||MLP2(H0)]. k )||MLP3(H m Using this vector as the input to the last linear layer, we obtain the discriminant R of the dependency relationship between the two entities. belong If there is a subordinate relationship, construct it as {E k [belong to],E m Triples in the form of}

[0061] S4: Add the obtained triples to the rule base to represent the security rules for data processing in the privacy policy, and build a knowledge graph based on these triples. Linking different triples requires entity alignment, merging entities with the same meaning into a single node, and determining the relationship between two entities E. k E m Whether the referents have the same meaning can be determined by the Euclidean distance between the two entity vector representations, i.e., |H|. k -H m If the distance between two vectors is less than a predetermined threshold ε, then the two entities are considered to have the same meaning. ε can be obtained through verification. Triples in the rule base are merged into a complete knowledge graph through entity alignment.

[0062] Step four: When enterprise-related data platforms and systems use data, relevant data processing information begins to be generated during the task submission stage. The data processing engine mainly includes programs that perform data operations within the platform or system. The processing procedure for privacy data is obtained from the audit logs of the data processing engine. Metadata within the privacy data is identified, and a directed acyclic graph representing the data processing procedure is established. The specific structure is as follows: Figure 4 As shown, this is represented from the process of processing privacy data. Figure 4 The data processing diagram shown contains four metadata elements, namely the roles N that use the data. role The data object N being operated on data Methods for manipulating data (E) approach Purpose of data use E purpose Let N represent nodes and edges, respectively, where the first node represents the role N that uses the data. role The second node represents data object N. data The side indicates the method of manipulating the data and the purpose of using the data [E] approach E purpose ].

[0063] S1: Obtain the privacy data processing procedures from the audit logs of the data processing engine. Divide the data processing procedures into units based on the operations performed on individual data objects. Use these processing procedures as input to obtain four types of metadata, namely, the roles N that use the data. role The data object N being operated on data Methods for manipulating data (E) approach Purpose of data use E purpose ;

[0064] S2: The data processing process is usually quite specific, targeting specific people and numbers. First, these specific words need to be replaced with abstract types, such as replacing specific names and numbers with entity types like names and phone numbers. Specific numbers, place names, etc. have certain formats. These specific entities are found through template matching and the types are replaced.

[0065] S3: After type replacement, the data is segmented and vectorized using the process. The entity recognition and relation extraction models used in the knowledge graph construction process are treated as a multi-task, multi-label classification problem. The metadata is then extracted, representing the roles N using the data. role The data object N being operated on data Methods for manipulating data (E) approach Purpose of data use E purpose N role As the head node, N data As the tail node, use E approach and E purpose The edges are represented to construct a data processing graph.

[0066] Step five involves matching the graph representing the data processing procedure with the knowledge graph to determine whether the data processing procedure complies with the rules defined in the privacy policy and to identify the reasons for non-compliance. The knowledge graph is used to represent the security rules in the privacy policy, automating compliance checks on data usage. In the rules defined in the knowledge graph, there are instances where only operations on data by the parent type are defined. This indicates that operations on the data by its subtypes are also compliant, and the same applies to operations on the parent type of the data object. Therefore, the graph matching process should consider the role nodes E in the knowledge graph that use the data. r and data object node E d The parent type node.

[0067] S1: Represent the data processing graph as a directed acyclic graph to obtain the data usage methods E. approach It begins matching with the knowledge graph, traversing the relations R in the rules of the knowledge graph. approach Judgment and Usage Method E approach Relation R approach If there are identical records, then the data processing method is non-compliant.

[0068] S2: If the first match with E is found approach The same R approach Then begin to target the role N that uses the data. role and data object N data To conduct compliance testing, it is necessary to obtain information related to R from the knowledge graph. approach Connected head node entity E head Tail node entity Etail , respectively representing the roles N that use the data role and the data object N used data .

[0069] S3: As described earlier, if the rules of the knowledge graph define that operations of the parent type are compliant, then operations of the child type are also compliant. This applies to knowledge graphs related to R... approach Connected E head and E tail According to R in the knowledge graph belong Relationship, find all its parent types, and add them to itself to form S. head and S tail A collection of two entity types, S head N represents the role that uses the data. role The type and its parent type, S tail Indicates the data object N used. data and its parent type.

[0070] S4: Extract data from the data processing diagram and data operation method E approach Connected N role and N data This indicates the role and data object performing this operation. To determine if it matches the knowledge graph, you can use the element (N) role N data Does it belong to S? head and S tail The Cartesian product {S} head ×S tail If it belongs to the knowledge graph, it means that operations on that type or its parent type are allowed; otherwise, it is necessary to return to the knowledge graph and find the next one related to R. approach The same E approach Then, S3 is executed again, and the traversal of the introduction indicates that the roles and data objects using the data are non-compliant.

[0071] S5: If using the role N of the data role For data object N data Operation E approach If it can be matched with entities and usage relationships in a knowledge graph, then examine the purpose E of the data processing graph. purpose Is it related to R in knowledge graphs? approach Adjacent R purpose If they are the same, it indicates that the data operation represented by the data processing graph is compliant, and the data operation compliance is returned; if the purpose does not match, it is necessary to return to the knowledge graph to find the next one that matches R. approach The same E approach The purpose of returning the processed data after the traversal ends is non-compliant, and S3 is executed again.

Claims

1. A compliance check method for the use of privacy data based on knowledge graphs, characterized in that, Includes the following steps: Step 1: Obtain privacy policy data; Step 2: Extract the rules for compliance checks from the obtained privacy policy data. In order to express the statements in the unstructured text using formal methods, first identify the entities and obtain the entity types. ; Step 3: Based on the identified entities, mine the relationships between different entities from the privacy policy, build a rule base composed of triples, and construct a knowledge graph through entity alignment; Step 4: Obtain the processing procedure of privacy data from the audit logs of the data processing engine, find the metadata in the privacy data, and build a directed acyclic graph representing the data processing procedure, referred to as the data processing graph; Step 5: Match the graph representing the data processing process with the knowledge graph to determine whether the data processing process complies with the rules defined in the privacy policy, and identify the reasons for non-compliance; Step 5 includes the following sub-steps: Step 5.1: Extract the directed acyclic graph representing the data processing process, i.e., the data usage method in the data processing graph. Traverse the relationships in the rules of the knowledge graph If the data is used in a certain way No relationship If they are the same, then the operation method is considered non-compliant; Step 5.2: If it exists and Same, take out Head nodes in a knowledge graph Tail node ; Step 5.3: Based on the type attribution relationships in the knowledge graph, find the entities respectively. and All parent type entities, and entities and Each constitutes a set and Two sets of entities; Step 5.4: Extract the data manipulation method from the data processing diagram. Connected roles using data and data objects traverse the set and Does it include roles that use data? and data objects If it contains, it indicates the role of the data user. and data objects Compliance; if not included, then search for the next related entry in the knowledge graph. Same relationship If step 5.3 is executed and the traversal is complete, it will return that the role and data object using the data are not compliant. Step 5.5: In the set and They were found and Then retrieve the relevant entries from the knowledge graph. Adjacent Compare whether the data in the data processing diagram is used for its intended purpose. If they are the same, return that the data processing is compliant; otherwise, continue iterating. If step 5.3 is executed and the traversal is complete, it will return an error indicating that the intended use is non-compliant.

2. The compliance check method for the use of privacy data based on knowledge graphs according to claim 1, characterized in that, Step 2 includes the following sub-steps: Step 2.1: Segment the privacy policy into n complete sentences. ; Step 2.2: Transform a complete sentence Using existing word segmentation techniques, multiple phrases are obtained. ; Step 2.3: Use all phrases belonging to a sentence as input to the pre-trained model to obtain the vector representation of each phrase. ,in This represents the vector corresponding to the sentence beginning symbol. Step 2.4: For each sentence Phrase vector representation Perform aggregation operations and input the data into a linear neural network. In this context, the problem is treated as a binary classification problem, used to determine whether a sentence contains a data processing rule. If the sentence does not contain a rule, no further processing is performed on that sentence; otherwise, the sentence is classified as a binary classification problem. If processing rules are present, proceed to step 2.5; Step 2.5: Input the vector of each phrase into the model for entity recognition, and obtain the label probability of different entity types through normalization. Step 2.6: Translate the sentence Label probability of entity type for all phrases When input into the CRF layer, since the label probabilities do not consider the order of entity types between phrases, the CRF layer learns the order of entity types in the sentences in the training set and adjusts the label probabilities of entity types to make the order of entity types in the phrases in the sentence reasonable and grammatically correct, thus obtaining the final entity type of each phrase. .

3. The compliance check method for the use of privacy data based on knowledge graphs according to claim 1, characterized in that, Step 3 includes the following sub-steps: Step 3.1: For each sentence Different entities in the data, each entity type By combining with other different entity types, we can obtain all possible entity pairs. Step 3.2: For each entity pair To identify relationships, the first step is to determine the hierarchical relationships between entities. If a hierarchical relationship exists, a triplet is constructed. , indicating entity type yes Subtypes; Step 3.3: If two entities If there is no subordinate relationship, then extract the metadata of the processing relationship between the two entities. This relation metadata includes two relationship types, represented as follows: These represent the methods and purposes of compliant data processing, respectively, and are used to construct... The triple consists of two entities: the first entity represents the role that performs the data processing, and the second entity represents the data object being processed. Step 3.4: Form a rule base based on triples, and perform entity alignment on the rule base. In order to find entities with different expressions but the same reference, entity alignment is performed by judging the similarity of entity vector representations, and then fused into a complete knowledge graph.

4. The compliance check method for the use of privacy data based on knowledge graphs according to claim 1, characterized in that, Step 4 includes the following sub-steps: Step 4.1: When enterprise-related data platforms and systems use data, the relevant information on data processing begins to be generated during the task submission stage. The data processing engine includes the relevant programs that perform data operations on the platform or system. The processing process of privacy data is obtained from the audit logs of the data processing engine. The processing process of a single data object is divided into units based on the operations performed on the single data object, including the role using the data, the data object being operated on, the method of operating the data, and the purpose of using the data. Step 4.2: Replace the text in the obtained data processing procedure; Step 4.3: Perform word segmentation and vector representation on the replaced data, then extract the metadata and represent it as a directed acyclic graph, treating it as a multi-task, multi-label classification problem. The first node represents the role of the data user. The second node represents a data object. The side represents the method of manipulating the data and the purpose of using the data. .

Images