A data security risk identification method based on data attribute classification grading

Abstract

The application discloses a data security risk identification method based on data attribute classification and grading. The method solves the problem that the existing security risk identification of data through automatic grading cannot accurately calculate the damage degree of data security time and cannot meet the data classification diversity requirement. The method comprises the following steps: collecting target information system data, pre-processing the collected data, judging the attributes of the data, classifying the data, setting data levels, establishing a support vector machine, training the support vector machine with the training data after the data level marking, obtaining a risk identification model, and identifying the security risk of the collected data with the risk identification model. The application utilizes data attribute classification and grading, adopts the support vector machine classification method to judge the data level, identifies the data security risk level, and accurately determines the security of the system. The method is simple in operation, strong in data interpretability, good in anti-interference effect, and can obtain relatively accurate data results.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a method for identifying data security risks based on data attribute classification and grading. Background Technology

[0002] In accordance with Article 21 of the Data Security Law, a data classification and grading protection system should be established. This system classifies and grades data based on its importance to economic and social development, and the degree of harm it would cause to national security, public interests, or the legitimate rights and interests of individuals or organizations should it be tampered with, damaged, leaked, or illegally obtained or used. The National Data Security Coordination Mechanism coordinates relevant departments to formulate an important data catalog and strengthen the protection of important data. Various industries are closely following legal requirements to formulate industry standards; the telecommunications and financial industries have already issued and implemented relevant standards.

[0003] Existing security systems typically identify security risks by automatically classifying data. This automatic data classification primarily relies on data content, categorizing data in the database into levels such as important data, core data, and general data. While this method aims to classify and classify data at the field, table, and database levels, it cannot accurately calculate the severity of data security incidents such as data leaks, and thus struggles to meet the diverse needs of data classification and grading. Summary of the Invention

[0004] This invention primarily addresses the shortcomings of existing technologies that rely on automatic grading for data security risk identification. These technologies struggle to accurately calculate the severity of data security risks over time and fail to meet the diverse needs of data classification. The invention provides a data security risk identification method based on data attribute classification and grading. This data classification and grading process involves judging data attributes to achieve differentiated management. Data classification and grading is a data-based application, typically using the content of the data as the basis.

[0005] The above-mentioned technical problems of the present invention are mainly solved by the following technical solution: a data security risk identification method based on data attribute classification and grading, comprising the following steps:

[0006] S1. Collect data from the target information system;

[0007] The collected data includes web server logs, database usage logs, network traffic, etc.

[0008] S2. Preprocess the collected data by formatting it;

[0009] S3. Perform attribute judgment to classify the data, and set data levels according to the classification;

[0010] S4. Build a support vector machine based on the data level, and train the support vector machine with the training data labeled by the data level to obtain a risk identification model;

[0011] S5. Use a risk identification model to identify security risks in the collected data. The risk identification model determines the data level, and based on this level, the degree of security risk is determined, enabling classified and graded management of the data. Simultaneously, it allows for monitoring of the usage of key data. The data mining results can be used as the final output of the support vector machine through data interfaces and data mining reports.

[0012] This invention utilizes data attribute classification and grading. By statistically analyzing total data volume, calculating data dimensions, and identifying data types, it extracts the required feature values ​​and employs support vector machine classification to determine data levels, thereby identifying data security risk levels and enabling the system to accurately assess security. This method is simple to operate, offers strong data interpretability, exhibits good anti-interference capabilities, and yields relatively accurate data results, achieving a balance between performance and effectiveness.

[0013] As a preferred embodiment, step S2 specifically includes the following process:

[0014] For structured data, preserve the structure;

[0015] For unstructured data, the data is segmented into words, and word groups are extracted to obtain a set of word groups.

[0016] As a preferred embodiment, the S3 process specifically includes:

[0017] S31. Identify and classify the attributes of the data content to obtain categorized data; methods for identifying content attributes include regular expressions and importing data dictionaries. The classification results include personal information, enterprise information, and unidentifiable information.

[0018] S32. Generate indicator data based on classification data;

[0019] S33. Consider the quantity and dimensions to set data levels through multi-dimensional combinations.

[0020] As a preferred embodiment, step S32 specifically includes the following process:

[0021] The total amount of data is used as a reference feature value and is denoted as D1;

[0022] The data dimension is used as a reference feature value and denoted as D2;

[0023] The quotient of the total data volume and the data dimension is used as a reference feature value, which is interpreted as the data density and denoted as D3;

[0024] The number of unidentifiable information classes in the data classification results is recorded as D4;

[0025] The number of data classification results belonging to the personal information category is counted as D5;

[0026] The number of data classification results belonging to the "Enterprise Information" category is counted as D6;

[0027] The quotient of the number of personal information items to the number of enterprise information items is calculated as a reference feature value, interpreted as the proportion of meaningful data, and recorded as D7.

[0028] The data sources, data volume, data dimensions, and data types are combined to form indicator data, such as total data volume, data dimensions, data density, number of personal information items, number of enterprise information items, number of unidentifiable information items, and proportion of meaningful data, which are used to determine the data level.

[0029] As a preferred embodiment, step S33 specifically includes the following process:

[0030] Based on two dimensions—the amount of personal or corporate information and the amount of unidentifiable information—the data is divided into four levels:

[0031] Category A data: This type of data contains little or no personal or corporate information, and the amount of data is small, with limited information that cannot be identified. This type of data is considered to have a low security risk and is not considered key data for concern.

[0032] Category B data: This type of data contains relatively little personal or corporate information, but also contains a large amount of data with a significant amount of unidentifiable information. It is considered to pose a moderate security risk and is classified as data of general concern.

[0033] C-level data: Contains a large amount of personal or corporate information, with limited unidentifiable data; this type of data is considered to have a high security risk and requires close attention.

[0034] Category D data: Contains a large amount of personal or corporate information, as well as a large amount of unidentifiable information; this type of data is considered to be potentially encrypted or obfuscated, or it may lead to the leakage of precise personal information by associating personal information with other information. It poses an extremely high security risk and requires close attention.

[0035] As a preferred embodiment, step S4 specifically includes the following process:

[0036] S41. Determine the number of support vector machines to be built based on the number of data levels, and build support vector machines accordingly. The number of support vector machines is n*(n-1) / 2, where n is the number of data levels.

[0037] S42. Use the preprocessed data as training samples, label the training samples according to the data level, and randomly divide the labeled samples into training set and test set, with the training set accounting for 70% and the test set accounting for 30%. Use the training set to train each support vector machine, and obtain the risk identification model after training.

[0038] As a preferred embodiment, in step S42, the training samples are labeled according to the data level, and each support vector machine is trained separately. The process includes:

[0039] The training samples were labeled with ABCD according to four levels of data, and six support vector machines were trained respectively. The allocation of training samples was based on the focus of each support vector machine, and the focus was divided according to the indicator data.

[0040] Train a support vector machine C(A, B), treating training samples A as samples of type A and samples B, C, and D as samples of type B. This support vector machine focuses on samples with a small total amount of data and treats samples of type B, C, and D as the same type of sample.

[0041] Train a support vector machine C(A, C), treating ABD training samples as samples of type A and C as samples of type C; this support vector machine focuses on identifiable data density and treats ABD as samples of the same type.

[0042] Train a support vector machine C(A,D), treating the training samples ABC as samples of type A and D as samples of type D; this support vector machine focuses on non-high-risk samples and treats ABC as samples of the same type.

[0043] Train a support vector machine C(B,C), treating the training samples AB as samples of type B and CD as samples of type C. This support vector machine focuses on the dimension and quantity of identifiable data, treating AB as samples of the same type and CD as samples of the same type.

[0044] Train a support vector machine C(B,D), treating the training samples BC as samples of type B and BAD as samples of type D. This support vector machine focuses on samples that cannot be identified due to large amounts of data, and treats ACD as samples of the same type.

[0045] Train a support vector machine C(C,D), treating training samples AC as samples of type C and samples BD as samples of type D. This support vector machine focuses on the amount of unidentifiable data, treating AC as samples of the same type and BD as samples of the same type.

[0046] As a preferred embodiment, the risk identification model obtained in step S42 includes the following identification process:

[0047] After formatting the data, input it into the risk identification model.

[0048] For a support vector machine C(A, B), if the judgment result is type A, then for data of type A, A = A + 1; if the judgment result is type B, then for data of type B, B = B + 1.

[0049] For a support vector machine C(A, C), if the judgment result is of type A, then for data of type A, A = A + 1; if the judgment result is of type C, then for data of type C, C = C + 1.

[0050] For a support vector machine C(A, D), if the judgment result is of type A, then for that type of data A = A + 1; if the judgment result is of type D, then for that type of data D = D + 1.

[0051] For a support vector machine C(B, C), if the judgment result is of type B, then for data of type B, B = B + 1; if the judgment result is of type C, then for data of type C, C = C + 1.

[0052] For a support vector machine C(B, D), if the judgment result is of type B, then for data of type B, B = B + 1; if the judgment result is of type D, then for data of type D, D = D + 1.

[0053] For a support vector machine C(C,D), if the judgment result is of type C, then C=C+1 for data of that type; if the judgment result is of type D, then D=D+1 for data of that type.

[0054] The data security risk assessment result is determined by statistically analyzing the results of the six support vector machines and identifying the type with the highest frequency.

[0055] As a preferred embodiment, after step S4, an evaluation step of the effectiveness of the risk identification model is also included, which includes:

[0056] The test set is input into the risk identification model. The level output by the risk identification model is compared with the level labeled in the data. If the comparison result meets the expected condition, the current risk identification model is adopted as the final risk identification model. If the expected condition is not met, return to step S1 and repeat the steps until the comparison result meets the expected condition. The expected condition is that the identification accuracy on the test set exceeds 95%.

[0057] As a preferred approach, the data cleaning step is included after the preprocessing of the collected data, specifically including the removal of duplicate and meaningless data.

[0058] Therefore, the advantages of this invention are: it utilizes data attribute classification and grading, extracts required feature values ​​by statistically analyzing total data volume, calculating data dimensions, and identifying data types, and uses support vector machine classification to determine data levels, thereby identifying data security risk levels and enabling the system to accurately determine security. The method of this invention is simple to operate, has strong data interpretability, good anti-interference effect, and can obtain relatively accurate data results, achieving a balance between performance and effectiveness. Attached Figure Description

[0059] Figure 1 This is a flowchart of the present invention. Detailed Implementation

[0060] The technical solution of the present invention will be further described in detail below through embodiments and in conjunction with the accompanying drawings.

[0061] Example 1:

[0062] This embodiment presents a data security risk identification method based on data attribute classification and grading, such as... Figure 1 As shown, it includes the following steps:

[0063] S1. Collect data from the target information system;

[0064] The collected data includes web server logs, database usage logs, network traffic, etc. In addition to the data itself, it is necessary to understand other relevant information about the data to be classified and categorized. The data attributes involved include information about the data owner and information about the data user.

[0065] S2. Preprocess the collected data by formatting it; the specific process includes:

[0066] For structured data, preserve the structure;

[0067] For unstructured data, the data is segmented into words, and word groups are extracted using the forward maximum matching algorithm and the backward maximum matching algorithm. The results of the two algorithms are used to obtain a set of word groups.

[0068] Data cleaning specifically includes removing duplicate and meaningless data. Meaningless data includes data that the tokenizer cannot process. A data example is shown below:

[0069] 880285BD557FFC3FB7C652E3B293C93D81E67E6A776A9F52108A287C465C4F306F41CD1B8601B8888919C6E0C44296BA352D99EBE24FFD9A8CF0.

[0070] S3. Perform attribute analysis to classify the data and set data levels based on the classification; the specific process includes:

[0071] S31. Identify and classify the attributes of the data content to obtain categorized data; methods for identifying content attributes include regular expressions and importing data dictionaries. The classification results include personal information, enterprise information, and unidentifiable information.

[0072] S32. Form indicator data based on categorized data; form indicator data by comprehensively considering the source, volume, dimension, and type of data, such as total data volume, data dimension, data density, number of personal information items, number of enterprise information items, number of unidentifiable information items, and proportion of meaningful data, for the purpose of determining the data level.

[0073] The specific process includes:

[0074] The total amount of data is used as a reference feature value and is denoted as D1;

[0075] The data dimension is used as a reference feature value and denoted as D2;

[0076] The quotient of the total amount of data and the data dimension is used as a reference feature value, which is interpreted as the data density and denoted as D3;

[0077] The number of unidentifiable information classes in the data classification results is recorded as D4;

[0078] The number of data classification results belonging to the personal information category is counted as D5;

[0079] The number of data classification results belonging to the "Enterprise Information" category is counted as D6;

[0080] The quotient of the number of personal information items to the number of enterprise information items is calculated as a reference feature value, interpreted as the proportion of meaningful data, and recorded as D7.

[0081] S33. Consider quantity and dimensions to set data levels through multi-dimensional combinations. The specific process includes:

[0082] Based on two dimensions—the amount of personal or corporate information and the amount of unidentifiable information—data is categorized into four levels to closely align with data security requirements. These levels are:

[0083] Category A data: This type of data contains little or no personal or corporate information, and the amount of data is small, with limited information that cannot be identified. This type of data is considered to have a low security risk and is not considered key data for concern.

[0084] Category B data: This type of data contains relatively little personal or corporate information, but also contains a large amount of data with a significant amount of unidentifiable information. It is considered to pose a moderate security risk and is classified as data of general concern.

[0085] C-level data: Contains a large amount of personal or corporate information, with limited unidentifiable data; this type of data is considered to have a high security risk and requires close attention.

[0086] Category D data: Contains a large amount of personal or corporate information, as well as a large amount of unidentifiable information; this type of data is considered to be potentially encrypted or obfuscated, or it may lead to the leakage of precise personal information by associating personal information with other information. It poses an extremely high security risk and requires close attention.

[0087] S4. Build a support vector machine based on data levels. Train the support vector machine with the labeled training data to obtain a risk identification model; the specific process includes:

[0088] S41. Determine the number of support vector machines to be built based on the number of data levels, and build support vector machines for each level. The number of support vector machines is n*(n-1) / 2, where n is the number of data levels. Six support vector machines need to be built based on the four types of data levels, namely C(A,B), C(A,C), C(A,D), C(B,C), C(B,D), and C(C,D).

[0089] S42. Using the preprocessed data as training samples, the training samples are labeled according to data level. Each labeled sample is then randomly divided into a training set and a test set, with the training set accounting for 70% and the test set accounting for 30%. Each support vector machine is then trained separately to obtain a risk identification model. The specific process includes:

[0090] The training samples were labeled with ABCD according to four levels of data, and six support vector machines were trained accordingly.

[0091] Train a support vector machine C(A, B), treating training samples A as samples of type A and samples B, C, and D as samples of type B; treat training samples A as samples of type A and samples B, C, and D as samples of type B; this support vector machine focuses on samples with a small total amount of data and treats samples of type B, C, and D as the same type of sample.

[0092] Train a support vector machine C(A, C), treating ABD training samples as samples of type A and C as samples of type C; this support vector machine focuses on identifiable data density and treats ABD as samples of the same type.

[0093] Train a support vector machine C(A,D), treating the training samples ABC as samples of type A and D as samples of type D; this support vector machine focuses on non-high-risk samples and treats ABC as samples of the same type.

[0094] Train a support vector machine C(B,C), treating the training samples AB as samples of type B and CD as samples of type C. This support vector machine focuses on the dimension and quantity of identifiable data, treating AB as samples of the same type and CD as samples of the same type.

[0095] Train a support vector machine C(B,D), treating the training samples BC as samples of type B and BAD as samples of type D. This support vector machine focuses on samples that cannot be identified due to large amounts of data, and treats ACD as samples of the same type.

[0096] Train a support vector machine C(C,D), treating AC training samples as C-type samples and BD as D-type samples. This support vector machine focuses on the number of unidentifiable data, treating AC as samples of the same class and BD as samples of the same class.

[0097] Once a risk identification model is obtained, the formatted and cleaned data is input into the risk identification model to assess security risks.

[0098] For a support vector machine C(A, B), if the judgment result is type A, then for data of type A, A = A + 1; if the judgment result is type B, then for data of type B, B = B + 1.

[0099] For a support vector machine C(A, C), if the judgment result is of type A, then for data of type A, A = A + 1; if the judgment result is of type C, then for data of type C, C = C + 1.

[0100] For a support vector machine C(A, D), if the judgment result is of type A, then for that type of data A = A + 1; if the judgment result is of type D, then for that type of data D = D + 1.

[0101] For a support vector machine C(B, C), if the judgment result is of type B, then for data of type B, B = B + 1; if the judgment result is of type C, then for data of type C, C = C + 1.

[0102] For a support vector machine C(B, D), if the judgment result is of type B, then for data of type B, B = B + 1; if the judgment result is of type D, then for data of type D, D = D + 1.

[0103] For a support vector machine C(C,D), if the judgment result is of type C, then C=C+1 for data of that type; if the judgment result is of type D, then D=D+1 for data of that type.

[0104] The data judgment type is determined by statistically analyzing the judgment results of the six support vector machines and selecting the type with the highest frequency.

[0105] After obtaining the risk identification model, the evaluation of its effectiveness is also included, specifically:

[0106] Set expected conditions;

[0107] Input the test set into the risk identification model and output the data level.

[0108] The risk identification model outputs a level that is compared with the level of the data label. The expected condition is set: the identification accuracy exceeds 95%. If the comparison result meets the expected condition, the current risk identification model is used as the final risk identification model. If the expected condition is not met, return to step S1 and repeat the steps until the comparison result meets the expected condition.

[0109] S5. Use the risk identification model to identify security risks from the collected data.

[0110] The four hierarchical data types are respectively mapped to security risk levels.

[0111] Data classified as Grade A indicates a low level of security risk and is not considered key data for monitoring.

[0112] Category B data indicates a moderate safety risk and falls under the category of data of general concern.

[0113] C-level data indicates a high level of security risk and is therefore subject to close monitoring.

[0114] Data classified as D-level indicates an extremely high security risk and is therefore subject to close monitoring.

[0115] The collected data is output as a graded data type using a risk identification model, and the security risk level of the data is determined based on the above correspondence.

[0116] By identifying the content and attribute characteristics of data, we can achieve data classification and hierarchical management, while also monitoring the usage of key data. The data mining results can be used as the final output of the support vector machine through data interfaces and data mining reports. Data output mainly takes the following forms:

[0117] Data level and sensitive field content. The data interface parameters directly return the level of the target data, allowing customers to directly use the results of this invention in their existing systems.

[0118] Visualized reports. The results of data classification and grading are transformed into a data asset list and reports, which intuitively display the type, type distribution, level, and level distribution of the verified data. This allows the data provider's data asset administrator to intuitively understand the distribution and usage of the company's sensitive data.

[0119] Alarms. By configuring alarm rules, alarms can be sent via email, SMS, or other means when the alarm rules are met.

[0120] Example 2:

[0121] This embodiment uses data from the education industry to illustrate the method.

[0122] S1. Collect data from the target information system;

[0123] The collected data includes web server logs, database usage logs, network traffic, etc. Educational institutions often store and use large amounts of student (adult and minor) information, which involves a significant amount of personal data. This data is highly sensitive to its owners and has numerous users, including educational institutions and banks. Therefore, assessments must be made based on the intended use of the data.

[0124] S2. Preprocess the collected data by formatting it;

[0125] For structured data, preserve the structure; the structured data is shown below.

[0126] {

[0127] "country":"China",

[0128] "type_name":"**Exam",

[0129] "xs_sfz":"410922********6230",

[0130] "city":"Chengdu"

[0131] "zk_type":0,

[0132] "xb_bm":"0",

[0133] "kaoc_bm":"221",

[0134] "rx_sj":"",

[0135] "xs_id":2***6,

[0136] "card_state":4,

[0137] "school_id":"0101",

[0138] "province":"Sichuan Province",

[0139] "branch_id":58,

[0140] "photo_state":1,

[0141] "branch_name":"****College",

[0142] "bz":"",

[0143] "audit_fail_reason":"",

[0144] "zy_type":1,

[0145] "tel":"177****1712",

[0146] "email":"***@163.com",

[0147] "xs_bm":"010****00971",

[0148] "by_sj":"2022-12",

[0149] "address":"**District**Community**Building**Unit******",

[0150] "zy_bm":"W****06",

[0151] "audit_state":2,

[0152] "xs_xm":"Zhang*",

[0153] "token":"d0674e3e6a2******b248b45f6e9d4ae",

[0154] "gzdw":"**** Co., Ltd."

[0155] "bmd_bm":"001",

[0156] "zy_mc":"Human Resources Management"

[0157] }

[0158] For unstructured data, the data is segmented into words, and word groups are extracted using both forward maximum matching and backward maximum matching algorithms. The results from both algorithms are then used to obtain a set of word groups. The following example uses unstructured data:

[0159] On Wednesday, November 9th, at 7:00 AM, I left my dormitory (Building *) and bought a roujiamo (Chinese hamburger) from downstairs. I paid Sister Ren at 7:46 AM (Shop name: **Old Brand Pancake Shop, Ren**, ID number 510722********5323, contact number 132****9456). I walked to **** and took the subway, which goes directly to ** subway station. Around 9:00 AM, I entered **** through the south gate. At 10:00 AM, I went to my classroom (Teacher Zhu*, Building A, Room A***) for class. After class at 12:00 PM, I walked to the second floor of *** cafeteria for beef noodles (about a 20-minute walk), which took about ten minutes (**area**). After eating, I took the subway directly from *** station to *** and walked to ****. I had a nucleic acid test done at **** (for people arriving at the same time and place, the school is screening). Then I stayed in the *** laboratory in Building 2. Around 6:00 PM, I walked to ** Building 3, ** area** for my *** class, which started at 7:30 PM. After class at around 21:10, I walked directly back to my dormitory and bought food from a street vendor. At 18:52, I paid Mr. Luo 8 yuan, and at 18:53, I paid the recipient 5 yuan (the school is investigating).

[0160] After segmenting the data into words, we get:

[0161] 'November 9th', 'Wednesday morning at 07:00', 'Starting from', '**', 'dormitory', 'Building *', '***', 'departed', 'to', 'downstairs', 'to', 'buy', 'a', 'Chinese hamburger', 'and', 'paid', 'to', 'Sister Ren', 'Payment', 'time:', '07:46', '(', 'Store name:', '**', 'Time-honored pancake', 'Ren**', 'License number', ' ', '510722********5323', ' ', 'Contact phone', ' ', '132****9456', ' ', ')', 'Walked', 'to', '**', '**', 'to', 'take', 'the', 'subway', 'The', 'subway', 'goes', 'directly', 'to', '**','subway station.', 'At', 'around', '09:00', 'entered', 'from', 'the', 'south', 'gate', 'of', '**', **', '**', 'At', '10:00', 'arrived', 'at', 'the', 'classroom', '(', '**** class', ' ', 'Teacher Zhu*', ' ', 'Building A', 'A608',')', 'to', 'have', 'class', 'After', 'class', 'at', '12:00', 'walked', 'to', 'the', 'second', 'floor', 'of', '****', 'restaurant', 'to', 'have', 'beef', 'noodles', '(', 'The', 'journey', 'is', 'about', '20 minutes', 'or', 'so', ')', 'Ate', 'for', 'about', 'ten', 'or', 'more', 'minutes', '(', '** district', ')', '.', 'After', 'finishing', 'eating', 'directly', 'took', 'the', 'subway', 'from', '**', 'subway station', 'to', '**', 'walked', 'to', '****', '.', 'Had', 'a', 'nucleic', 'acid', 'test', 'at', '****', '(', 'Personnel', 'in', 'the', 'same', 'time', 'and', 'same', 'space-time', 'are', 'checked', 'by', 'the', 'school', ')', '.', 'Then', 'stayed', 'in', 'the', 'laboratory', 'of', '***', 'in', 'the', 'second', 'teaching', 'building', 'of', '****', 'all', 'the', 'time.', 'At', 'around', '6 o'clock', 'in', 'the', 'evening', 'walked', 'to', 'the', 'third', 'district', 'of', '***', 'building', '**', 'to', 'have', '****', 'class', 'Class', 'started', 'at', '7:30', '.Around 21:10, after class, went directly on foot back to the dormitory. During this time, bought food from a street vendor at 18:52. Paid to Mr. Luo for 8 yuan. At 18:53, paid to the recipient for 5 yuan. (School investigation)

[0162] Data cleaning specifically includes removing duplicate and meaningless data.

[0163] S3. Perform attribute analysis to classify the data and set data levels based on the classification; the specific process includes:

[0164] S31. Identify and classify the attributes of the data content to obtain categorized data; methods for identifying content attributes include regular expressions and data dictionary import to identify personal information and enterprise information. The classification results include personal information, personal school information, enterprise internal data, and unidentifiable information.

[0165] S32. Generate indicator data based on categorized data; including:

[0166] The total amount of data is used as a reference feature value and is denoted as D1;

[0167] The data dimension is used as a reference feature value and denoted as D2;

[0168] The quotient of the total amount of data and the data dimension is used as a reference feature value, which is interpreted as the data density and denoted as D3;

[0169] The number of unidentifiable information classes in the data classification results is recorded as D4;

[0170] The number of data classification results belonging to the personal information category is counted as D5;

[0171] The number of data classification results belonging to the "Personal School Information" category is counted as D6;

[0172] The number of data belonging to the internal enterprise data category in the data classification results is counted as D7;

[0173] The quotient of the number of identifiable information categories to the total data volume is calculated as a reference feature value, which is interpreted as the proportion of meaningful data and denoted as D8.

[0174] S33. Consider quantity and dimensions to set data levels through multi-dimensional combinations. The specific process includes:

[0175] Based on two dimensions—the amount of personal or corporate information and the amount of unidentifiable information—data is categorized into four levels to closely align with data security requirements. These levels are:

[0176] Category A data: This type of data contains little or no personal or corporate information, and the amount of data is small, with limited information that cannot be identified. This type of data is considered to have a low security risk and is not considered key data for concern.

[0177] Category B data: This type of data contains relatively little personal or corporate information, but also contains a large amount of data with a significant amount of unidentifiable information. It is considered to pose a moderate security risk and is classified as data of general concern.

[0178] C-level data: Contains a large amount of personal or corporate information, with limited unidentifiable data; this type of data is considered to have a high security risk and requires close attention.

[0179] Category D data: Contains a large amount of personal or corporate information, as well as a large amount of unidentifiable information; this type of data is considered to be potentially encrypted or obfuscated, or it may lead to the leakage of precise personal information by associating personal information with other information. It poses an extremely high security risk and requires close attention.

[0180] S4. Build a support vector machine based on data levels. Train the support vector machine with the labeled training data to obtain a risk identification model; the specific process includes:

[0181] S41. Determine the number of support vector machines to be built based on the number of data levels, and build support vector machines for each level. The number of support vector machines is n*(n-1) / 2, where n is the number of data levels. Six support vector machines need to be built based on the four types of data levels, namely C(A,B), C(A,C), C(A,D), C(B,C), C(B,D), and C(C,D).

[0182] S42. Use the preprocessed data as training samples, label the training samples according to the data level, train each support vector machine separately, and obtain the risk identification model after training.

[0183] After obtaining the risk identification model, evaluate its effectiveness until the final risk identification model is obtained.

[0184] S5. Use the risk identification model to identify security risks from the collected data.

[0185] The specific embodiments described herein are merely illustrative of the spirit of the invention. Those skilled in the art to which this invention pertains may make various modifications or additions to the described specific embodiments or use similar methods to substitute them, without departing from the spirit of the invention or exceeding the scope defined by the appended claims.

Claims

1. A data security risk identification method based on data attribute classification and grading, characterized in that: Includes the following steps: S1. Collect data from the target information system; S2. Preprocess the collected data by formatting it; S3. Perform attribute analysis to classify the data and set data levels based on the classification; including: S31. Identify and classify the data content attributes to obtain classified data; S32. Generate indicator data based on the classification data; The indicator data is formed by combining the total amount of data, data dimensions, data density, number of personal information items, number of enterprise information items, number of unidentifiable information items, and the proportion of meaningful data. S33. Consider the quantity and dimensions to set data levels using multi-dimensional combinations; S4. Build a support vector machine based on the data level, and train the support vector machine with the training data labeled by the data level to obtain a risk identification model; S5. Use the risk identification model to identify security risks from the collected data.

2. The data security risk identification method based on data attribute classification and grading according to claim 1, characterized in that: The specific process of step S2 includes: For structured data, preserve the structure; For unstructured data, the data is segmented into words, and word groups are extracted to obtain a set of word groups.

3. The data security risk identification method based on data attribute classification and grading according to claim 1, characterized in that: The specific process of step S32 includes: The total amount of data is used as a reference feature value and is denoted as D1; The data dimension is used as a reference feature value and denoted as D2; The quotient of the total amount of data and the data dimension is used as a reference feature value, which is interpreted as the data density and denoted as D3; The number of unidentifiable information classes in the data classification results is recorded as D4; The number of data classification results belonging to the personal information category is counted as D5; The number of data classification results belonging to the "Enterprise Information" category is counted as D6; The quotient of the number of personal information items to the number of enterprise information items is calculated as a reference feature value, interpreted as the proportion of meaningful data, and recorded as D7.

4. The data security risk identification method based on data attribute classification and grading according to claim 1, characterized in that: The specific process of step S33 includes: Based on two dimensions—the amount of personal or corporate information and the amount of unidentifiable information—the data is divided into four levels: Grade A data: contains little or no personal or corporate information, contains a small amount of data, and contains little information that cannot be identified. Category B data: contains less personal or corporate information, contains a large amount of data, and contains a large amount of unidentifiable information. C-level data: Contains a large amount of personal or corporate information, but the amount of unidentifiable information is relatively small; Category D data contains a large amount of personal or corporate information, as well as a large amount of unidentifiable information.

5. A data security risk identification method based on data attribute classification and grading according to claim 4, characterized in that: The specific process of step S4 includes: S41. Determine the number of support vector machines to be built based on the number of data levels, and build support vector machines accordingly. The number of support vector machines is n*(n-1) / 2, where n is the number of data levels. S42. Use the preprocessed data as training samples, label the training samples according to the data level, and randomly divide the labeled samples into training set and test set. Use the training set to train each support vector machine to obtain the risk identification model.

6. A data security risk identification method based on data attribute classification and grading according to claim 5, characterized in that: In step S42, the training samples are labeled according to the data level, and each support vector machine is trained separately. The process includes: The training samples were labeled with ABCD according to four levels of data, and six support vector machines were trained accordingly. Train a support vector machine C(A, B), and use the training samples A as samples of type A, and BCD as samples of type B. Train a support vector machine C(A, C), and use the ABD training samples as samples of type A and C as samples of type C. Train a support vector machine C(A,D), and treat the training samples ABC as samples of type A and D as samples of type D. Train a support vector machine C(B, C), and use the training samples AB as samples of type B and CD as samples of type C. Train a support vector machine C(B,D), and use the training samples BC as samples of type B and BAD as samples of type D. Train a support vector machine C(C,D), using AC training samples as C-type samples and BD as D-type samples.

7. A data security risk identification method based on data attribute classification and grading according to claim 6, characterized in that: The risk identification model obtained in step S42 includes the following identification process: After formatting the data, input it into the risk identification model. For a support vector machine C(A, B), if the judgment result is type A, then for data of type A, A = A + 1; if the judgment result is type B, then for data of type B, B = B + 1. For a support vector machine C(A, C), if the judgment result is of type A, then for data of type A, A = A + 1; if the judgment result is of type C, then for data of type C, C = C + 1. For a support vector machine C(A, D), if the judgment result is of type A, then for that type of data A = A + 1; if the judgment result is of type D, then for that type of data D = D + 1. For a support vector machine C(B, C), if the judgment result is of type B, then for data of type B, B = B + 1; if the judgment result is of type C, then for data of type C, C = C + 1. For a support vector machine C(B, D), if the judgment result is of type B, then for data of type B, B = B + 1; if the judgment result is of type D, then for data of type D, D = D + 1. For a support vector machine C(C,D), if the judgment result is of type C, then C=C+1 for data of that type; if the judgment result is of type D, then D=D+1 for data of that type. The data security risk assessment result is determined by statistically analyzing the results of the six support vector machines and identifying the type with the highest frequency.

8. A data security risk identification method based on data attribute classification and grading according to claim 5, 6, or 7, characterized in that... Step S4 is followed by an evaluation step of the risk identification model's effectiveness, which includes: Input the test set into the risk identification model, compare the level output by the risk identification model with the level labeled in the data. If the comparison result meets the expected conditions, the current risk identification model is used as the final risk identification model. If the expected conditions are not met, return to step S1 and repeat the steps until the comparison result meets the expected conditions.

9. A data security risk identification method based on data attribute classification and grading according to any one of claims 1-7, characterized in that: After preprocessing the collected data, a data cleaning step is also included, which specifically includes deleting duplicate and meaningless data.

Images