A method and system for preventing enterprise data assets from leaking

Abstract

The present invention relates to the field of data encryption, and in particular to a method and system for preventing enterprise data assets from being leaked. The method comprises the following steps: obtaining an enterprise multimodal data set; performing outlier filtering optimization on the enterprise multimodal data set, and performing time series clustering serialization processing to obtain an enterprise multimodal data sequence; performing adaptive dimensional compression encoding on the enterprise multimodal data sequence to generate multiple low-dimensional feature tensors; performing end-to-end loss optimization on multiple low-dimensional feature tensors to generate optimized multimodal low-dimensional tensors; performing mirror space mapping on the optimized multimodal low-dimensional tensors to obtain a mirror encryption space; performing nonlinear transformation confusion on the mirror encryption space to obtain a nonlinear confused mirror space; obtaining user access behavior data; performing dynamic behavior feature mining on the user access behavior data to construct a user behavior portrait. The present invention achieves good data asset leakage prevention and real-time data risk response.

Description

Technical Field

[0001] The present invention relates to the field of data encryption, and in particular to a method and system for preventing enterprise data assets from being leaked. Background Art

[0002] In today's digital age, enterprise data assets have become one of the most important assets of enterprises and play a vital role in the operation and development of enterprises. However, with the continuous growth of data scale and the frequent occurrence of data leakage incidents, enterprises are facing increasingly severe data security challenges. Data leakage may lead to serious consequences such as legal proceedings, business losses, and reputation damage. Therefore, it is particularly important to protect the security and privacy of enterprise data assets.

[0003] Traditional methods of preventing data leakage in enterprises mainly rely on access control, encryption technology, and security training. However, these methods often have poor data leakage prevention capabilities and cannot achieve real-time monitoring of data leakage. In terms of preventing data leakage in enterprises, the limitations of traditional methods have gradually emerged.

[0004] In order to meet the needs of modern enterprises for data asset security, an intelligent and comprehensive method for preventing enterprise data asset leakage is needed. Summary of the invention

[0005] In order to solve the above technical problems, the present invention proposes a method and system for preventing enterprise data asset leakage to solve at least one of the above technical problems.

[0006] To achieve the above object, the present invention provides a method for preventing leakage of enterprise data assets, comprising the following steps:

[0007] Step S1: obtaining an enterprise multimodal data set; performing outlier filtering optimization on the enterprise multimodal data set, and performing time series clustering and serialization processing, thereby obtaining an enterprise multimodal data sequence;

[0008] Step S2: Adaptively compress and encode the enterprise multimodal data sequence to generate multiple low-dimensional feature tensors; perform end-to-end loss optimization on the multiple low-dimensional feature tensors to generate optimized multimodal low-dimensional tensors;

[0009] Step S3: performing mirror space mapping on the optimized multimodal low-dimensional tensor to obtain a mirror encrypted space; performing nonlinear transformation confusion on the mirror encrypted space to obtain a nonlinear confused mirror space;

[0010] Step S4: Obtain user access behavior data; perform dynamic behavior feature mining on the user access behavior data to construct a user behavior profile;

[0011] Step S5: Analyze the illegal attack behavior of the user behavior profile, make adaptive risk diagnosis decisions, and build an access behavior risk strategy;

[0012] Step S6: Perform dynamic access control on the nonlinear obfuscated mirror space based on the access behavior risk strategy and build an enterprise data protection model.

[0013] The present invention cleans and processes data through outlier filtering optimization and time series clustering serialization processing, improves data quality, provides a reliable data basis for subsequent analysis, and obtains enterprise multimodal data sequences to better understand the characteristics and changing laws of enterprise data, providing a basis for subsequent processing and analysis, generates multiple low-dimensional feature tensors to reduce data dimensions, improves computing efficiency, and retains important information at the same time. It improves model performance and data expression capabilities through end-to-end loss optimization, provides better data support for subsequent tasks, and maps data to a new space through mirror space mapping, improves data security and privacy protection. Nonlinear transformation confusion increases data complexity, improves data security, and effectively prevents information leakage and attacks. Dynamic behavior feature mining deeply understands user behavior patterns and builds user behavior portraits to provide a basis for subsequent analysis and risk diagnosis. The establishment of user behavior portraits helps companies better understand user needs and behavioral habits, and provides data support for corporate decision-making. Adaptive risk diagnosis decisions promptly identify and respond to illegal attacks to protect corporate data security and build access behavior risk strategies. According to user behavior portraits and risk diagnosis results, formulate corresponding protection strategies to improve data security. Dynamic access control realizes real-time monitoring and protection of data based on access behavior risk strategies, improves data security and protection capabilities, and builds an enterprise data protection model to comprehensively manage and protect enterprise data and improve data security and defense capabilities.

[0014] Preferably, step S1 comprises the following steps:

[0015] Step S11: Obtain enterprise multimodal dataset;

[0016] Step S12: performing feature type recognition and classification processing on the enterprise multimodal data set to obtain structured data and unstructured data;

[0017] Step S13: monitoring the missing time points of structured data and identifying abnormal missing feature points;

[0018] Step S14: performing time series prediction interpolation filling on the structured data according to the abnormal missing feature points, thereby obtaining filled structured data;

[0019] Step S15: performing outlier filtering optimization on the unstructured data to generate optimized unstructured data;

[0020] Step S16: Perform time series clustering and serialization processing on the filled structured data and optimized unstructured data to obtain a multimodal data sequence of the enterprise.

[0021] The present invention provides comprehensive data assets for enterprises by acquiring multimodal data sets of enterprises, laying the foundation for subsequent data processing and analysis. Identify and divide structured data and unstructured data to classify and process the data more finely for subsequent data analysis and protection measures. Monitor the missing time points in structured data to detect abnormalities in a timely manner, thereby improving the integrity and reliability of the data. Fill in abnormal missing feature points through time series prediction interpolation, restore the continuity and integrity of the data, and reduce the uncertainty and fragmentation of the data. Optimize unstructured data through outlier filtering, eliminate outliers and noise, improve the quality and credibility of data, and reduce the risk of data leakage. Through time series clustering serialization processing, the filled structured data and optimized unstructured data are integrated and organized into serialized data, providing more convenient operations for subsequent data processing and analysis.

[0022] Preferably, the specific steps of step S15 are:

[0023] Analyze the semantic features of unstructured data to obtain the semantic features of enterprise data;

[0024] Extract characteristic keywords based on the semantic features of enterprise data to obtain keywords of enterprise unstructured data;

[0025] Perform text distribution analysis on keywords in enterprise unstructured data to generate keyword distribution data;

[0026] Perform parameterized keyword frequency average statistics on unstructured data based on keyword distribution data to generate parameterized data frequency range;

[0027] Identify abnormal outliers in unstructured data based on parameterized data frequency range and mark abnormal outlier data points;

[0028] Outlier filtering is optimized for abnormal outlier data points to generate optimized unstructured data.

[0029] The present invention deeply understands the meaning and content of unstructured data through semantic feature analysis, so as to better grasp the key features of enterprise data. Obtaining the semantic features of enterprise data provides a more accurate and meaningful basis for subsequent keyword extraction and data analysis. By extracting feature keywords, important information and key concepts in unstructured data can be quickly captured to help further understand the data content. Obtaining the subsequent text distribution analysis and data frequency statistics of enterprise unstructured data keywords provides key guidance for the protection of data assets. Generate keyword distribution data to show the frequency and distribution of keywords in the text, and find the key points and concerns of the data. Perform text distribution analysis to identify hot information and topics in the data, and provide guidance for subsequent data processing and analysis. Through parameterized keyword frequency average statistics, the frequency of occurrence of keywords is converted into quantifiable data, which is convenient for subsequent analysis and comparison. Generate parameterized data frequency range to establish a baseline range of data, providing a basis for identifying abnormal outlier data. Identifying abnormal outlier data and marking it helps enterprises to promptly discover potential data leakage or abnormal behavior and protect the security of data assets. Optimize abnormal data points through outlier filtering, reduce false alarms and interference, and ensure the integrity and confidentiality of key enterprise data. Optimizing unstructured data improves data quality and credibility, reduces potential leakage risks, and protects enterprise data assets from external threats. Generating and optimizing unstructured data enables enterprises to establish more robust and reliable data security mechanisms, improve data management efficiency and risk prevention capabilities.

[0030] Preferably, step S2 specifically comprises the following steps:

[0031] Step S21: Decomposing the enterprise multimodal data sequence into multiple dimensions, thereby generating data sequences of different dimensions;

[0032] Step S22: Dimension feature analysis is performed on data sequences of different dimensions, thereby obtaining dimensional features of multiple data series;

[0033] Step S23: performing adaptive dimensional compression encoding based on the dimensional features of multiple data series to generate multiple low-dimensional feature tensors;

[0034] Step S24: Calculating compression loss on multiple low-dimensional feature tensors to obtain compression tensor loss data;

[0035] Step S25: normalizing the magnitude differences between the data of the multiple low-dimensional feature tensors to generate multiple standardized low-dimensional feature tensors;

[0036] Step S26: performing end-to-end loss optimization on multiple standardized low-dimensional feature tensors based on the compressed tensor loss data, thereby generating an optimized multimodal low-dimensional tensor.

[0037] The present invention can decompose complex multimodal data sequences into data sequences of different dimensions through multi-dimensional decomposition, and understand and analyze data from different perspectives. Generating data sequences of different dimensions extracts the potential features of the data, providing more options and perspectives for subsequent analysis and processing. Dimension feature analysis deeply understands the characteristics and laws of data sequences of different dimensions, and provides important clues for subsequent processing. Obtaining multiple data series dimensional features helps to reveal the correlation and important features between data, and provides guidance for data processing and optimization. Adaptive dimensional compression coding better retains important information of data and reduces the dimension of data, improves data processing efficiency and reduces storage costs. Generate multiple low-dimensional feature tensors to simplify data structure and speed up subsequent data processing and analysis. Magnitude difference standardization eliminates the magnitude effect between data, makes data of different dimensions comparable, and better performs comprehensive analysis and processing. Generate standardized low-dimensional feature tensors to improve the consistency and interpretability of data, and provide a more stable foundation for subsequent analysis and optimization. The compression effect of data is further improved through end-to-end loss optimization, minimizing information loss and improving data representation capabilities. Improving the representation quality of data and reducing data redundancy provide more effective means for the protection and utilization of enterprise data assets.

[0038] Preferably, step S3 specifically comprises the following steps:

[0039] Step S31: symmetrically encrypting the optimized multimodal low-dimensional tensor to obtain an encrypted low-dimensional tensor;

[0040] Step S32: performing mirror space mapping on the encrypted low-dimensional tensor to obtain a mirror encrypted space;

[0041] Step S33: Perform encrypted tensor full connection processing on the mirror encrypted space to obtain an encrypted tensor deep feature network;

[0042] Step S34: Perform nonlinear transformation confusion on the encrypted tensor deep feature network to obtain a nonlinear confusion mirror space.

[0043] The present invention converts data into ciphertext form through symmetric encryption, improves the confidentiality of data, prevents unauthorized access, obtains an encrypted low-dimensional tensor to ensure that data is not stolen or tampered with during transmission and storage, and enhances data security. Mirror space mapping increases the obfuscation of data, making data more difficult to crack and decrypt, and obtains a mirrored encrypted space to increase the complexity of data, improve data security and anti-attack, and the encrypted tensor fully connected processing further confuses data and increases the difficulty of cracking the encrypted data. The encrypted tensor deep feature network constructs a more complex encryption structure, improves data security and difficulty of cracking, and nonlinear transformation obfuscation further increases the complexity and randomness of data, making encrypted data more difficult to restore and decrypt, and obtains a nonlinear obfuscated mirror space to strengthen the obfuscation and protection level of data, and improve data security and confidentiality.

[0044] Preferably, the specific steps of step S4 are:

[0045] Step S41: monitoring the entire process of users accessing internal data to obtain user access behavior data;

[0046] Step S42: performing time series analysis on the user access behavior data to generate access behavior time series data;

[0047] Step S43: mining the dynamic behavior characteristics of the access behavior time series data to generate dynamic access behavior characteristics;

[0048] Step S44: Perform global profile fitting on dynamic access behavior features to construct a user behavior profile.

[0049] The present invention monitors the entire process of users accessing internal data to fully understand the users' operational behaviors, including access frequency, access path and other information, obtains user access behavior data to establish a benchmark for user behavior, discovers abnormal behaviors or potential data leakage risks, and time series analysis reveals the changing trends and laws of user access behaviors, helps identify user behavior patterns and periodic changes, generates access behavior time series data to better understand the dynamic characteristics of user behavior, and provides a reference for the time dimension for subsequent analysis. Dynamic behavior feature mining can discover changes and trends in user behavior, help identify abnormal or unusual behavior patterns, and generate dynamic access behavior features to more finely describe the user's behavior characteristics, providing more dimensional information for subsequent modeling and analysis. Global portrait fitting integrates various types of user access behavior features into a comprehensive user behavior portrait, more comprehensively describes the user's behavioral habits and characteristics, and constructs a user behavior portrait for enterprises to classify and identify users, discover abnormal behaviors in a timely manner, and take corresponding measures to prevent risks such as data leakage.

[0050] Preferably, the specific steps of step S43 are:

[0051] Extract multiple access behavior timestamps based on access behavior time series data;

[0052] Calculate the access frequency of the user access behavior data according to multiple access behavior timestamps to obtain the access behavior frequency;

[0053] Perform page dwell time statistics on access behavior time series data to obtain the dwell time of each page;

[0054] According to the access behavior frequency, the visit interval timeliness analysis is performed on the residence time of each page, so as to obtain the access behavior timeliness characteristic data;

[0055] Identify user access objects based on access behavior time series data;

[0056] Performing a user access resource type distribution analysis based on the user access object to obtain access resource type distribution data;

[0057] Dynamic behavior feature analysis is performed on the access resource type distribution data and access behavior time characteristic data to generate dynamic access behavior features.

[0058] The present invention captures the user's access behavior time pattern by extracting multiple access behavior timestamps, helping to analyze the time distribution and regularity of user behavior. Timestamp extraction provides a time reference for subsequent access frequency calculation and timeliness analysis. Calculating the access behavior frequency reveals the user's active access to different resources, helping to discover abnormal high-frequency access behavior. The access behavior frequency is obtained to establish a benchmark for user behavior, providing important indicators for subsequent analysis. Page residence time statistics can understand the length of time the user stays on each page. The access interval timeliness analysis reveals the timeliness characteristics of the user's access behavior, helping to identify the regularity and periodicity of user access, and obtaining the access behavior timeliness characteristic data to better understand the dynamics of user behavior. The dynamic behavior feature analysis can combine the access behavior frequency, timeliness features and resource type distribution to reveal the multi-dimensional features of user behavior, generate dynamic access behavior features to more comprehensively describe user behavior patterns and trends, and provide a deeper analysis basis for data leakage risk identification and prevention.

[0059] Preferably, the specific steps of step S5 are:

[0060] Step S51: Detect abnormal access behavior of the user behavior profile and extract potential abnormal access behavior data;

[0061] Step S52: Tracing the entire access path of the user's access behavior data to obtain the entire access behavior link;

[0062] Step S53: performing illegal attack behavior analysis on potential abnormal access behavior data based on the access behavior full link to obtain illegal attack access behavior data;

[0063] Step S54: quantify the risk assessment of the illegal attack access behavior data and generate a risk assessment value of the risk access behavior;

[0064] Step S55: Make an adaptive risk diagnosis decision based on the risk assessment value of the risky access behavior and construct an access behavior risk strategy.

[0065] The present invention detects abnormal access behavior on user behavior profiles, timely identifies potential abnormal behaviors, including unauthorized access, abnormally frequent access, etc., extracts potential abnormal access behavior data to quickly respond to and handle abnormal situations, thereby reducing the risk of data leakage. By tracing the user access behavior data throughout the entire process, restoring the user's complete access path, helping to understand the user's behavior trajectory and operation process, and obtaining the full link of access behavior, it can help to deeply analyze the motivation and logic behind the user behavior, and provide more clues for abnormal behavior analysis and prevention. Based on the full link of access behavior, illegal attack behavior analysis of potential abnormal access behavior data can identify potential security risks and attack behaviors, and illegal attack access behavior data can be obtained to timely discover malicious attack behaviors, protect data assets from malicious intrusions and attacks, and conduct risk assessment and quantification of illegal attack access behavior data to quantify risk levels, help enterprises understand and evaluate the severity of potential risks, generate risk assessment values, give priority to high-risk access behaviors, strengthen control over data leakage risks, make adaptive risk diagnosis decisions based on risk access behavior assessment values, take corresponding preventive measures and response strategies according to risk situations, build access behavior risk strategies to establish risk perception mechanisms, improve enterprises' ability to identify and respond to abnormal access behaviors, and further strengthen the security protection of data assets.

[0066] Preferably, the specific steps of step S6 are:

[0067] Step S61: constructing a data protection architecture for the nonlinear obfuscated mirror space to generate a data protection framework;

[0068] Step S62: mapping risk decision rules to the enterprise encryption data protection framework based on the access behavior risk strategy to build the enterprise encryption protection framework;

[0069] Step S63: Perform dynamic access control on the enterprise encryption protection framework and build an enterprise data protection model;

[0070] The dynamic access control specifically includes: identifying the access risk level of the current user based on the access behavior risk strategy;

[0071] The access risk levels include: high-risk users, medium-risk users, and low-risk users;

[0072] When the user's access risk level is high-risk, the enterprise encryption protection framework restricts the user's access behavior;

[0073] When the user's access risk level is medium risk, the enterprise encryption protection framework performs user access data obfuscation processing;

[0074] When the user's access risk level is low risk, the enterprise encryption protection framework allows the user to access data.

[0075] The present invention protects data from unauthorized access and theft by constructing a data protection framework for nonlinear confusion mirror space using advanced encryption technology and security algorithms. The data protection framework establishes a secure data protection infrastructure to ensure that data is effectively protected during transmission and storage. Risk decision rules are mapped to the enterprise encryption data protection framework based on the access behavior risk strategy, and the encryption strategy is adjusted and optimized according to the risk assessment results. An enterprise encryption protection framework is constructed to protect the confidentiality and integrity of important data, improve data security, prevent leakage and tampering, and dynamically control access to the enterprise encryption protection framework. Data access rights are dynamically adjusted according to real-time access conditions and risk assessment results. An enterprise data protection model is constructed to establish a flexible data access control mechanism to protect data from unauthorized access and improve data security and controllability.

[0076] In this specification, a system for preventing leakage of enterprise data assets is provided, which is used to execute the above-mentioned method for preventing leakage of enterprise data assets, including:

[0077] The data optimization module is used to obtain enterprise multimodal data sets; perform outlier filtering optimization on enterprise multimodal data sets, and perform time series clustering and serialization processing to obtain enterprise multimodal data sequences;

[0078] The compression coding module is used to perform adaptive dimensional compression coding on enterprise multimodal data sequences to generate multiple low-dimensional feature tensors; perform end-to-end loss optimization on multiple low-dimensional feature tensors to generate optimized multimodal low-dimensional tensors;

[0079] The mirror encryption module is used to perform mirror space mapping on the optimized multi-modal low-dimensional tensor to obtain a mirror encryption space; perform nonlinear transformation confusion on the mirror encryption space to obtain a nonlinear confused mirror space;

[0080] The behavior feature module is used to obtain user access behavior data; perform dynamic behavior feature mining on user access behavior data and build user behavior portraits;

[0081] Adaptive risk decision module, which is used to analyze illegal attack behaviors of user behavior profiles, make adaptive risk diagnosis decisions, and build access behavior risk strategies;

[0082] The data protection module is used to dynamically control access to the nonlinear obfuscated mirror space based on the access behavior risk strategy and build an enterprise data protection model.

[0083] The present invention organizes and optimizes enterprise multimodal data sets through outlier filtering optimization and time series clustering serialization processing, improves data quality and availability, obtains enterprise multimodal data sequences to better analyze and understand data, and provides a high-quality data foundation for subsequent processing. Adaptive dimensional compression coding reduces data storage and transmission costs, generates low-dimensional feature tensors, improves data processing efficiency, generates optimized multimodal low-dimensional tensors through end-to-end loss optimization, better retains important information and features of data, and provides more effective data representation for subsequent processing. Mirror space mapping and nonlinear transformation obfuscation enhance data security and privacy protection, ensure that data is not easily stolen or tampered with during transmission and storage, and obtains nonlinear obfuscated mirror space to effectively protect data privacy, reduce the risk of data leakage, and enhance data According to data security, dynamic behavior feature mining and user behavior portrait construction can deeply understand user behavior patterns and characteristics, provide more comprehensive information for subsequent risk analysis and decision-making, and build user behavior portraits to help enterprises more accurately identify illegal attack behaviors and take corresponding measures to protect data assets in a timely manner. Illegal attack behavior analysis and adaptive risk diagnosis decisions are conducted based on user behavior portraits to quickly respond to and prevent potential security threats. Building access behavior risk strategies can effectively reduce the risk of data leakage and improve the security and reliability of enterprise data assets. Dynamic access control of non-linear obfuscated mirror space can effectively prevent unauthorized access and data leakage, strengthen data protection, and build an enterprise data protection model to ensure that data is fully protected during transmission and storage, minimizing the risk of data leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0084] Figure 1 A schematic diagram of the steps of a method for preventing leakage of enterprise data assets according to the present invention;

[0085] Figure 2 Detailed implementation flow chart of step S1;

[0086] Figure 3 Detailed implementation flow chart of step S2;

[0087] Figure 4Detailed implementation flow chart of step S3. DETAILED DESCRIPTION

[0088] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0089] The example of this application provides a method and system. The execution subjects of the method and system include but are not limited to: mechanical equipment, data processing platform, cloud server node, network upload device, etc. equipped with the system can be regarded as the general computing node of this application, and the data processing platform includes but is not limited to: at least one of an audio and image management system, an information management system, and a cloud data management system.

[0090] See also Figures 1 to 4 The present invention provides a method for preventing leakage of enterprise data assets, and the method for preventing leakage of enterprise data assets comprises the following steps:

[0091] Step S1: obtaining an enterprise multimodal data set; performing outlier filtering optimization on the enterprise multimodal data set, and performing time series clustering and serialization processing, thereby obtaining an enterprise multimodal data sequence;

[0092] Step S2: Adaptively compress and encode the enterprise multimodal data sequence to generate multiple low-dimensional feature tensors; perform end-to-end loss optimization on the multiple low-dimensional feature tensors to generate optimized multimodal low-dimensional tensors;

[0093] Step S3: performing mirror space mapping on the optimized multimodal low-dimensional tensor to obtain a mirror encrypted space; performing nonlinear transformation confusion on the mirror encrypted space to obtain a nonlinear confused mirror space;

[0094] Step S4: Obtain user access behavior data; perform dynamic behavior feature mining on the user access behavior data to construct a user behavior profile;

[0095] Step S5: Analyze the illegal attack behavior of the user behavior profile, make adaptive risk diagnosis decisions, and build an access behavior risk strategy;

[0096] Step S6: Perform dynamic access control on the nonlinear obfuscated mirror space based on the access behavior risk strategy and build an enterprise data protection model.

[0097] The present invention cleans and processes data through outlier filtering optimization and time series clustering serialization processing, improves data quality, provides a reliable data basis for subsequent analysis, and obtains enterprise multimodal data sequences to better understand the characteristics and changing laws of enterprise data, providing a basis for subsequent processing and analysis, generates multiple low-dimensional feature tensors to reduce data dimensions, improves computing efficiency, and retains important information at the same time. It improves model performance and data expression capabilities through end-to-end loss optimization, provides better data support for subsequent tasks, and maps data to a new space through mirror space mapping, improves data security and privacy protection. Nonlinear transformation confusion increases data complexity, improves data security, and effectively prevents information leakage and attacks. Dynamic behavior feature mining deeply understands user behavior patterns and builds user behavior portraits to provide a basis for subsequent analysis and risk diagnosis. The establishment of user behavior portraits helps companies better understand user needs and behavioral habits, and provides data support for corporate decision-making. Adaptive risk diagnosis decisions promptly identify and respond to illegal attacks to protect corporate data security and build access behavior risk strategies. According to user behavior portraits and risk diagnosis results, formulate corresponding protection strategies to improve data security. Dynamic access control realizes real-time monitoring and protection of data based on access behavior risk strategies, improves data security and protection capabilities, and builds an enterprise data protection model to comprehensively manage and protect enterprise data and improve data security and defense capabilities.

[0098] In the embodiment of the present invention, refer to Figure 1 , is a schematic diagram of the steps of a method for preventing leakage of enterprise data assets of the present invention. In this example, the steps of the method for preventing leakage of enterprise data assets include:

[0099] Step S1: obtaining an enterprise multimodal data set; performing outlier filtering optimization on the enterprise multimodal data set, and performing time series clustering and serialization processing, thereby obtaining an enterprise multimodal data sequence;

[0100] In this embodiment, various types of enterprise data are collected and integrated from various business systems and data sources within the enterprise. These data include: text data (such as emails, reports, etc.), structured data (such as transaction records, user information, etc.), image data (such as monitoring screens, product images, etc.), video data (such as meeting records, equipment operation status, etc.), etc. These heterogeneous multimodal data are integrated into a comprehensive enterprise multimodal data set. Outlier detection and filtering are performed for abnormal data points or noise data in the enterprise multimodal data set. An anomaly detection method based on statistical distribution or an anomaly detection model based on machine learning is used to clean and optimize the data. The filtered clean data is retained as basic data for subsequent processing. The cleaned multimodal data is time-series sorted and clustered according to timestamp information. The time-series clustering method uses a clustering algorithm based on time correlation, such as dynamic time warping clustering, etc. Through clustering, these multimodal data are divided into several time-series data sequences. These data sequences reflect the evolution and change rules of enterprise data in the time dimension.

[0101] Step S2: Adaptively compress and encode the enterprise multimodal data sequence to generate multiple low-dimensional feature tensors; perform end-to-end loss optimization on the multiple low-dimensional feature tensors to generate optimized multimodal low-dimensional tensors;

[0102] In this embodiment, an adaptive dimensionality compression method is used to encode the enterprise multimodal data sequence obtained above, and an autoencoder model based on deep learning is used. Different encoder structures are designed according to the characteristics of each modal data. By training the autoencoder model, the original high-dimensional multimodal data is compressed and encoded into a low-dimensional feature tensor, and the data of different modalities are adaptively encoded respectively to generate multiple low-dimensional feature tensors. The multiple low-dimensional feature tensors generated above are input into an end-to-end optimization framework. This framework adopts the structure of a multimodal fusion network to learn the association and interaction between multiple low-dimensional features. During the optimization process, a variety of loss functions are designed, such as reconstruction loss, contrast loss, regularization loss, etc., to perform end-to-end optimization training. Finally, a set of optimized multimodal low-dimensional feature tensors, i.e., optimized multimodal low-dimensional tensors, are obtained.

[0103] Step S3: performing mirror space mapping on the optimized multimodal low-dimensional tensor to obtain a mirror encrypted space; performing nonlinear transformation confusion on the mirror encrypted space to obtain a nonlinear confused mirror space;

[0104] In this embodiment, the optimized multimodal low-dimensional tensor is used as input and processed by a mirror mapping module. This mirror mapping module is based on the duality theory and maps the original low-dimensional feature tensor to a dual mirror space. Each point in the mirror space corresponds to a point in the original low-dimensional feature tensor, but there is a complex mapping relationship between the two. Through this mirror mapping, a mirror encryption space is obtained, which contains an encrypted representation of the original multimodal features. The data in the mirror encryption space is further subjected to a series of nonlinear transformations and obfuscation processing. Through these complex nonlinear transformations, the mirror encryption space is further obfuscated and distorted to generate a nonlinear obfuscated mirror space.

[0105] Step S4: Obtain user access behavior data; perform dynamic behavior feature mining on the user access behavior data to construct a user behavior profile;

[0106] In this embodiment, the user's access behavior data is collected and integrated from various business systems and applications within the enterprise. The user's dynamic behavior characteristics are extracted using machine learning and data mining methods for the collected user access behavior data. The characteristics include the user's access mode, such as access frequency, access time distribution, access path, etc., the user's operation behavior, such as common functions, preference settings, abnormal operations, etc., and the user's social interaction, such as participation, influence, relationship network, etc. These dynamic behavior characteristics are integrated into a user behavior portrait model, which can comprehensively describe the behavioral characteristics of each user.

[0107] Step S5: Analyze the illegal attack behavior of the user behavior profile, make adaptive risk diagnosis decisions, and build an access behavior risk strategy;

[0108] In this embodiment, the user behavior portrait model constructed above is input into an illegal attack behavior analysis module based on machine learning. This analysis module will refer to the known illegal attack behavior characteristics and conduct a comparative analysis of the behavior portrait of each user. The results of the illegal attack behavior analysis are input into an adaptive risk assessment model. This risk assessment model will comprehensively consider factors such as user behavior portraits, illegal attack characteristics, and enterprise security policies to dynamically assess the user's access risk. Based on the risk assessment results, a targeted access behavior risk management and control strategy is formulated.

[0109] Step S6: Perform dynamic access control on the nonlinear obfuscated mirror space based on the access behavior risk strategy and build an enterprise data protection model.

[0110] In this embodiment, based on the nonlinear confusion mirror space, an overall architecture of data protection is designed. This architecture includes: an encryption storage module, an access control module, a risk monitoring module, etc. Through the collaborative work of these functional modules, a complete data protection framework is constructed. This framework provides basic support for subsequent enterprise data protection. The obtained access behavior risk management strategy is connected to the data protection framework. According to different risk assessment values, corresponding access control, risk response and other decision rules are formulated. These rules are mapped to the functional modules of the data protection framework to construct an enterprise-level encryption protection framework. This encryption protection framework realizes refined data access control and risk warning. The constructed encryption protection framework is deployed in the enterprise's data management system. For each user's data access request, the framework will perform real-time access control based on the dynamic risk assessment results. The means of access control include: dynamic encryption, permission management, risk warning, etc. Through this dynamic access control mechanism, a comprehensive enterprise data protection model is constructed.

[0111] In this embodiment, refer to Figure 2 , is a flowchart of detailed implementation steps of step S1. In this embodiment, the detailed implementation steps of step S1 include:

[0112] Step S11: Obtain enterprise multimodal dataset;

[0113] Step S12: performing feature type recognition and classification processing on the enterprise multimodal data set to obtain structured data and unstructured data;

[0114] Step S13: monitoring the missing time points of structured data and identifying abnormal missing feature points;

[0115] Step S14: performing time series prediction interpolation filling on the structured data according to the abnormal missing feature points, thereby obtaining filled structured data;

[0116] Step S15: performing outlier filtering optimization on the unstructured data to generate optimized unstructured data;

[0117] Step S16: Perform time series clustering and serialization processing on the filled structured data and optimized unstructured data to obtain a multimodal data sequence of the enterprise.

[0118] In this embodiment, various types of enterprise-related data are collected from various channels inside and outside the enterprise (such as financial systems, production systems, marketing systems, etc.), including structured data (such as digital data, text data) and unstructured data (such as images, audio, video, etc.). The collected raw data is reasonably classified and archived to establish a multimodal data set for the enterprise. The feature type of the data set is identified by machine learning methods, and the data is divided into structured data and unstructured data. For structured data, it is further divided into digital features and text features by means of statistical analysis, rule recognition, etc. For unstructured data, the corresponding features are extracted using computer vision, natural language processing and other technologies. The time series features in the structured data are analyzed to detect whether there are missing time points. A method based on time series prediction, such as ARIMA model, time series anomaly detection, etc., is used to identify abnormal missing feature points in the data. For the identified abnormal missing feature points, a time series prediction model (such as ARIMA, Prophet, RNN, etc.) is used to predict the missing values. Fill the predicted values ​​into the original structured data to repair the abnormal missing feature points and obtain the filled structured data. For unstructured data (such as images, audio, video, etc.), use anomaly detection algorithms (such as a class of support vector machines, local anomaly factors, etc.) to identify outlier samples. For the identified outlier samples, use data augmentation, sample filtering and other methods to optimize and generate optimized unstructured data. Perform time series feature engineering on the filled structured data and the optimized unstructured data to extract time series features.

[0119] Use time series clustering algorithms (such as distance-based clustering, state-space model-based clustering, etc.) to cluster time series data to obtain enterprise multimodal data sequences. Perform visual analysis on clustering results to understand the time series characteristics and potential patterns of enterprise multimodal data.

[0120] In this embodiment, the specific steps of step S15 are:

[0121] Analyze the semantic features of unstructured data to obtain the semantic features of enterprise data;

[0122] Extract characteristic keywords based on the semantic features of enterprise data to obtain keywords of enterprise unstructured data;

[0123] Perform text distribution analysis on keywords in enterprise unstructured data to generate keyword distribution data;

[0124] Perform parameterized keyword frequency average statistics on unstructured data based on keyword distribution data to generate parameterized data frequency range;

[0125] Identify abnormal outliers in unstructured data based on parameterized data frequency range and mark abnormal outlier data points;

[0126] Outlier filtering is optimized for abnormal outlier data points to generate optimized unstructured data.

[0127] In this embodiment, for the unstructured data of the enterprise (such as text, image, audio, etc.), natural language processing (NLP), computer vision and other technologies are used to perform semantic analysis on the data. For text data, semantic features such as themes, emotional tendencies, keywords, etc. are extracted using methods such as word embedding, named entity recognition, and sentiment analysis. For image data, deep learning models such as convolutional neural networks are used to extract visual features such as object detection and scene understanding. For audio data, semantic features such as speech recognition and audio feature analysis are used to obtain semantic features such as speech content and emotional state. After semantic feature analysis, a semantic feature set of the enterprise's unstructured data is obtained. For text-type semantic features, such as topic keywords, named entities, etc., keywords as the enterprise's unstructured data are directly extracted. For non-text features such as images and audio, word embedding technology is used to map visual and audio features to semantic space, thereby extracting relevant keywords. After keyword extraction, a keyword set of the enterprise's unstructured data is obtained. For the extracted keyword set, the occurrence of each keyword in the unstructured data is counted. The frequency of occurrence is calculated, and the distribution map of keywords is drawn. The distribution characteristics of keywords are analyzed, such as the proportion of high-frequency keywords, low-frequency keywords, and the co-occurrence relationship between keywords. The keyword distribution characteristics are encoded into structured data as keyword distribution data. The keyword distribution data is used to calculate the average occurrence frequency of each keyword in each unstructured data sample. These average frequency values ​​are normalized to obtain a parameterized keyword frequency range. This parameterized frequency range describes the "normal" keyword distribution characteristics of unstructured data. The actual keyword frequency of each unstructured data sample is compared with the parameterized frequency range. For those samples whose keyword frequencies obviously deviate from the parameterized range, they are marked as abnormal outlier data points. Anomaly detection algorithms based on distance metrics or probability models are used to identify outlier samples. For unstructured data samples identified as abnormal outliers, for text data, text correction operations such as keyword replacement and semantic correction are performed. For image data, image enhancement processing such as data augmentation and noise filtering is performed. For audio data, pre-processing such as denoising and speech enhancement is performed.

[0128] In this embodiment, refer to Figure 3 , is a flowchart of detailed implementation steps of step S2. In this embodiment, the detailed implementation steps of step S2 include:

[0129] Step S21: Decomposing the enterprise multimodal data sequence into multiple dimensions, thereby generating data sequences of different dimensions;

[0130] Step S22: Dimension feature analysis is performed on data sequences of different dimensions, thereby obtaining dimensional features of multiple data series;

[0131] Step S23: performing adaptive dimensional compression encoding based on the dimensional features of multiple data series to generate multiple low-dimensional feature tensors;

[0132] Step S24: Calculating compression loss on multiple low-dimensional feature tensors to obtain compression tensor loss data;

[0133] Step S25: normalizing the magnitude differences between the data of the multiple low-dimensional feature tensors to generate multiple standardized low-dimensional feature tensors;

[0134] Step S26: performing end-to-end loss optimization on multiple standardized low-dimensional feature tensors based on the compressed tensor loss data, thereby generating an optimized multimodal low-dimensional tensor.

[0135] In this embodiment, for the enterprise multimodal data sequence (including structured data and optimized unstructured data), different dimensional features contained therein, such as time dimension, space dimension, attribute dimension, etc., are identified, and a multidimensional slicing operation is performed on the data sequence to decompose it into data subsequences of different dimensions. For each data subsequence, its time series, spatial distribution, attribute correlation and other characteristics are analyzed. The typical features of the data sequence of each dimension are extracted using methods such as statistical analysis, spectrum analysis, and association analysis. After dimensional feature analysis, a set of data describing the different dimensional features of the enterprise multimodal data is obtained. The multiple data series dimensional features obtained in the previous step are input into a deep learning model based on an autoencoder. The model will adaptively learn the potential low-dimensional representation of the data and generate a corresponding low-dimensional feature tensor. The relationship between each low-dimensional feature tensor and the original high-dimensional feature tensor is calculated. The reconstruction loss between data is the loss value in the compression process. These loss values ​​reflect the degree of information lost in the compression process. These compressed tensor loss data are used as a new data set for subsequent optimization processing. Due to the large differences in the magnitude of data of different dimensions, the low-dimensional feature tensors need to be standardized. Z-score standardization, Min-Max standardization and other methods are used to map the data of each dimension to the same magnitude range. After standardization, a set of comparable low-dimensional feature tensors are obtained. The above-mentioned compressed tensor loss data and the standardized low-dimensional feature tensor are input into an end-to-end optimization model. The model will learn how to minimize the information loss in the compression process and generate a more optimized low-dimensional feature tensor, which greatly reduces the dimension and storage overhead of the data while maintaining the original data information.

[0136] In this embodiment, refer to Figure 4, is a flowchart of detailed implementation steps of step S3. In this embodiment, the detailed implementation steps of step S3 include:

[0137] Step S31: symmetrically encrypting the optimized multimodal low-dimensional tensor to obtain an encrypted low-dimensional tensor;

[0138] Step S32: performing mirror space mapping on the encrypted low-dimensional tensor to obtain a mirror encrypted space;

[0139] Step S33: Perform encrypted tensor full connection processing on the mirror encrypted space to obtain an encrypted tensor deep feature network;

[0140] Step S34: Perform nonlinear transformation confusion on the encrypted tensor deep feature network to obtain a nonlinear confusion mirror space.

[0141] In this embodiment, multimodal data (such as text, image, video, etc.) are feature fused to generate a low-dimensional tensor representation, and a symmetric encryption algorithm (such as AES, Blowfish, etc.) is used to encrypt the low-dimensional tensor to protect the confidentiality of the data. The encrypted low-dimensional tensor is output as the input for the next step, and a mathematical mapping function is designed to map the encrypted low-dimensional tensor to a mirror space. Based on the mapping function, a mirror encryption space related to but different from the original space is constructed, and the constructed mirror encryption space is output for subsequent feature network processing. A multi-layer fully connected neural network is designed for feature extraction of the mirror encryption space, and the weights and bias parameters of the neural network are encrypted to ensure the security of the network structure. The encrypted neural network is applied to the mirror encryption space, and the encrypted deep feature network is output. A series of nonlinear activation functions (such as Sigmoid, Tanh, ReLU, etc.) are designed to perform nonlinear transformation on the encrypted deep feature network. The feature network is confused by the superposition of multiple nonlinear transformations to enhance the security of the data, and the feature network confused by the nonlinear transformation is output as the final nonlinear confused mirror space.

[0142] In this embodiment, step S4 includes the following steps:

[0143] Step S41: monitoring the entire process of users accessing internal data to obtain user access behavior data;

[0144] Step S42: performing time series analysis on the user access behavior data to generate access behavior time series data;

[0145] Step S43: mining the dynamic behavior characteristics of the access behavior time series data to generate dynamic access behavior characteristics;

[0146] Step S44: Perform global profile fitting on dynamic access behavior features to construct a user behavior profile.

[0147] In this embodiment, a user behavior monitoring system is deployed within the enterprise to track and record the entire process of user access to enterprise data in real time. The monitoring content includes: user identity information, access time, access object (file, database, etc.), access operation (read, modify, etc.), etc. The collected user access behavior data is structured and stored to form a user access behavior data set. The timestamp information in the user access behavior data is analyzed and converted into time series data. The time series data is processed by statistical analysis, time window aggregation, etc. to generate access behavior time series data with more time dimension features. These time series data reflect the time change trend of user access behavior. For the time series user access behavior data, time series analysis, anomaly detection and other methods are used to mine the dynamic features contained therein. Features such as user access frequency, access time distribution, and access object association are extracted. These dynamic features describe the time change pattern and abnormal pattern of user access behavior. The dynamic access behavior features mined above are integrated into a user portrait model. This model is a model based on statistical analysis or machine learning, which is used to fit and describe the user's behavior characteristics in a global range. Through the user portrait model, a comprehensive user behavior portrait is generated, reflecting the user's behavior patterns in multiple dimensions such as time, space, and objects. This user behavior portrait provides a valuable basis for subsequent user behavior analysis, risk warning, and other work.

[0148] In this embodiment, the specific steps of step S43 are:

[0149] Extract multiple access behavior timestamps based on access behavior time series data;

[0150] Calculate the access frequency of the user access behavior data according to multiple access behavior timestamps to obtain the access behavior frequency;

[0151] Perform page dwell time statistics on access behavior time series data to obtain the dwell time of each page;

[0152] According to the access behavior frequency, the visit interval timeliness analysis is performed on the residence time of each page, so as to obtain the access behavior timeliness characteristic data;

[0153] Identify user access objects based on access behavior time series data;

[0154] Performing a user access resource type distribution analysis based on the user access object to obtain access resource type distribution data;

[0155] Dynamic behavior feature analysis is performed on the access resource type distribution data and access behavior time characteristic data to generate dynamic access behavior features.

[0156] In this embodiment, the collected user access behavior time series data is timestamped to obtain the time point of each access event. These timestamps reflect the user's actual access time series. The extracted access behavior timestamps are used to count the number of visits of each user within a certain time window. The user's average access frequency is calculated based on the number of visits as the access behavior frequency feature. This feature reflects the activeness of the user's access behavior. For each access event, the user's stay time on the page is recorded, and the average stay time of each page is counted as the page stay time feature of the user's access behavior. This feature reflects the user's browsing behavior on different pages. Combined with the access frequency and page stay time data, the timeliness of the user's access behavior is analyzed. Features, for example, high-frequency visits but short stay time indicate browsing behavior; low-frequency visits but long stay time indicate deep learning behavior. These access behavior timeliness features are integrated into access behavior timeliness feature data, and the access behavior time series data is analyzed to identify the specific objects accessed by users, such as documents, databases, applications, etc. These access object information is used as an important feature of user access behavior. The identified access objects are classified and the distribution of user access to different types of resources is statistically calculated. This access resource type distribution data reflects the user's interests and preferences. The aforementioned access resource type distribution data and access behavior timeliness feature data are integrated and analyzed, and a machine learning model is used to mine the dynamic patterns and abnormal features of user access behavior.

[0157] In this embodiment, step S5 includes the following steps:

[0158] Step S51: Detect abnormal access behavior of the user behavior profile and extract potential abnormal access behavior data;

[0159] Step S52: Tracing the entire access path of the user's access behavior data to obtain the entire access behavior link;

[0160] Step S53: performing illegal attack behavior analysis on potential abnormal access behavior data based on the access behavior full link to obtain illegal attack access behavior data;

[0161] Step S54: quantify the risk assessment of the illegal attack access behavior data and generate a risk assessment value of the risk access behavior;

[0162] Step S55: Make an adaptive risk diagnosis decision based on the risk assessment value of the risky access behavior and construct an access behavior risk strategy.

[0163] In this embodiment, the user behavior portrait model constructed above is used to perform anomaly detection on real-time user access behavior data, and statistical learning, anomaly detection and other methods are used to identify access behaviors that deviate greatly from the user's normal behavior patterns. These access behavior data marked as abnormal are extracted as potential abnormal access behavior data. The collected user access behavior data, including normal access and abnormal access, are comprehensively traced for access paths. The traced content includes: user identity, access time, access object, access operation, etc. Through this full-link tracing, the entire behavior trajectory of the user from login to access completion is restored. These full-link access behavior data provide a basis for subsequent attack behavior analysis. The extracted abnormal access behavior data is combined with the obtained full-link access behavior for in-depth analysis, and the attack behavior is used to Pattern recognition, abnormal event association and other methods are used to identify the existing illegal attack behaviors, and the access behavior data determined to be illegal attacks are extracted as illegal attack access behavior data. For the illegal attack access behavior data obtained in the steps, its potential risk level is quantified. Factors such as the type, scale, and scope of impact of the attack behavior are considered, and a risk assessment model is designed for scoring. The assessment results are used to generate risk assessment values ​​for risky access behaviors as the basis for subsequent risk management. The risk assessment values ​​of each illegal attack access behavior are input into an adaptive risk diagnosis model. This model will automatically generate corresponding risk diagnosis decisions based on the real-time risk situation. These decisions include: triggering alarms, restricting access rights, initiating emergency responses, etc. These diagnostic decisions are summarized to form a complete set of access behavior risk management strategies.

[0164] In this embodiment, step S6 includes the following steps:

[0165] Step S61: constructing a data protection architecture for the nonlinear obfuscated mirror space to generate a data protection framework;

[0166] Step S62: mapping risk decision rules to the enterprise encryption data protection framework based on the access behavior risk strategy to build the enterprise encryption protection framework;

[0167] Step S63: Perform dynamic access control on the enterprise encryption protection framework and build an enterprise data protection model;

[0168] The dynamic access control specifically includes: identifying the access risk level of the current user based on the access behavior risk strategy;

[0169] The access risk levels include: high-risk users, medium-risk users, and low-risk users;

[0170] When the user's access risk level is high-risk, the enterprise encryption protection framework restricts the user's access behavior;

[0171] When the user's access risk level is medium risk, the enterprise encryption protection framework performs user access data obfuscation processing;

[0172] When the user's access risk level is low risk, the enterprise encryption protection framework allows the user to access data.

[0173] In this embodiment, the nonlinear obfuscated mirror space is used as the basis to design the overall architecture of data protection. It includes: encryption storage module, access control module, risk monitoring module, etc. Through the collaborative work of these functional modules, a complete data protection framework is constructed. This framework provides basic support for subsequent enterprise data protection. The obtained access behavior risk management strategy is connected to the data protection framework. According to the different risk assessment values, corresponding decision rules such as access control and risk response are formulated. These rules are mapped to the functional modules of the data protection framework to construct an enterprise-level encryption protection framework. This encryption protection framework realizes refined data access control and risk warning. The constructed encryption protection framework is deployed in the enterprise's data management system. For each user's data access request, the framework will perform real-time access control based on the dynamic risk assessment results. The means of access control include: dynamic encryption, permission control, risk warning, etc. Through this dynamic access control mechanism, a comprehensive enterprise data protection model is constructed.

[0174] Dynamic access control specifically involves inputting the user's access behavior characteristic data, such as access frequency, dwell time, access object, etc., into the risk assessment model.

[0175] Based on the risk assessment rules established in advance, the user's access behavior is scored and graded for risk.

[0176] Users are divided into three levels: high-risk users, medium-risk users and low-risk users.

[0177] If the current user is identified as being at a high risk level, the enterprise encryption protection framework will take restrictive measures on their access behavior.

[0178] Specifically include:

[0179] Deny the user's access request,

[0180] Enforce user identity verification or multi-factor authentication,

[0181] Limit user access rights and operation permissions.

[0182] If a user is identified as a medium risk level, the enterprise encryption protection framework will obfuscate the data they access.

[0183] Specifically include:

[0184] Partially desensitize the data to hide sensitive information.

[0185] Random noise disturbance is applied to the data to reduce the readability of the data.

[0186] Restrict users’ data downloading, copying, and other operations.

[0187] If the user is identified as a low risk level, the enterprise encryption protection framework will allow them to access data normally.

[0188] At this point, directly grant the user the required access rights without taking any restrictive measures.

[0189] The access behavior of low-risk users still needs to be continuously monitored and their risk level assessed.

[0190] In this embodiment, a system for preventing leakage of enterprise data assets is provided, which is used to execute the above-mentioned method for preventing leakage of enterprise data assets, including:

[0191] The data optimization module is used to obtain enterprise multimodal data sets; perform outlier filtering optimization on enterprise multimodal data sets, and perform time series clustering and serialization processing to obtain enterprise multimodal data sequences;

[0192] The compression coding module is used to perform adaptive dimensional compression coding on enterprise multimodal data sequences to generate multiple low-dimensional feature tensors; perform end-to-end loss optimization on multiple low-dimensional feature tensors to generate optimized multimodal low-dimensional tensors;

[0193] The mirror encryption module is used to perform mirror space mapping on the optimized multi-modal low-dimensional tensor to obtain a mirror encryption space; perform nonlinear transformation confusion on the mirror encryption space to obtain a nonlinear confused mirror space;

[0194] The behavior feature module is used to obtain user access behavior data; perform dynamic behavior feature mining on user access behavior data and build user behavior portraits;

[0195] Adaptive risk decision module, which is used to analyze illegal attack behaviors of user behavior profiles, make adaptive risk diagnosis decisions, and build access behavior risk strategies;

[0196] The data protection module is used to dynamically control access to the nonlinear obfuscated mirror space based on the access behavior risk strategy and build an enterprise data protection model.

[0197] The present invention organizes and optimizes enterprise multimodal data sets through outlier filtering optimization and time series clustering serialization processing, improves data quality and availability, obtains enterprise multimodal data sequences to better analyze and understand data, and provides a high-quality data foundation for subsequent processing. Adaptive dimensional compression coding reduces data storage and transmission costs, generates low-dimensional feature tensors, improves data processing efficiency, generates optimized multimodal low-dimensional tensors through end-to-end loss optimization, better retains important information and features of data, and provides more effective data representation for subsequent processing. Mirror space mapping and nonlinear transformation obfuscation enhance data security and privacy protection, ensure that data is not easily stolen or tampered with during transmission and storage, and obtains nonlinear obfuscated mirror space to effectively protect data privacy, reduce the risk of data leakage, and enhance data According to data security, dynamic behavior feature mining and user behavior portrait construction can deeply understand user behavior patterns and characteristics, provide more comprehensive information for subsequent risk analysis and decision-making, and build user behavior portraits to help enterprises more accurately identify illegal attack behaviors and take corresponding measures to protect data assets in a timely manner. Illegal attack behavior analysis and adaptive risk diagnosis decisions are conducted based on user behavior portraits to quickly respond to and prevent potential security threats. Building access behavior risk strategies can effectively reduce the risk of data leakage and improve the security and reliability of enterprise data assets. Dynamic access control of non-linear obfuscated mirror space can effectively prevent unauthorized access and data leakage, strengthen data protection, and build an enterprise data protection model to ensure that data is fully protected during transmission and storage, minimizing the risk of data leakage.

[0198] Therefore, the embodiments should be regarded as illustrative and non-restrictive from all points, and the scope of the present invention is limited by the appended claims rather than the above description, and it is therefore intended that all changes falling within the meaning and range of equivalent elements of the application documents are included in the present invention.

[0199] The above is only a specific embodiment of the present invention, so that those skilled in the art can understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but should conform to the widest scope consistent with the principles and novel features invented herein.

Claims

1. A method for preventing leakage of enterprise data assets, characterized in that: The following steps are involved: Step S1: obtaining an enterprise multimodal data set; performing outlier filtering optimization on the enterprise multimodal data set, and performing time series clustering and serialization processing, thereby obtaining an enterprise multimodal data sequence; Step S2: Adaptively compress and encode the enterprise multimodal data sequence to generate multiple low-dimensional feature tensors; perform end-to-end loss optimization on the multiple low-dimensional feature tensors to generate optimized multimodal low-dimensional tensors; Step S3: mirror space mapping is performed on the optimized multimodal low-dimensional tensor to obtain a mirror encryption space; nonlinear transformation is performed on the mirror encryption space to obtain a nonlinear obfuscated mirror space; the specific steps of step S3 are: Step S31: symmetrically encrypting the optimized multimodal low-dimensional tensor to obtain an encrypted low-dimensional tensor; Step S32: performing mirror space mapping on the encrypted low-dimensional tensor to obtain a mirror encrypted space; Step S33: Perform encrypted tensor full connection processing on the mirror encrypted space to obtain an encrypted tensor deep feature network; Step S34: performing nonlinear transformation confusion on the encrypted tensor deep feature network to obtain a nonlinear confusion mirror space; Step S4: Obtain user access behavior data; perform dynamic behavior feature mining on the user access behavior data to construct a user behavior profile; Step S5: Analyze the illegal attack behavior of the user behavior profile, make adaptive risk diagnosis decisions, and build an access behavior risk strategy; Step S6: Perform dynamic access control on the nonlinear obfuscated mirror space based on the access behavior risk strategy and build an enterprise data protection model.

2. The enterprise data asset leakage prevention method according to claim 1, characterized in that: The specific steps of step S1 are: Step S11: Acquire enterprise multimodal dataset; Step S12: performing feature type recognition and classification processing on the enterprise multimodal data set to obtain structured data and unstructured data; Step S13: monitoring the missing time points of structured data and identifying abnormal missing feature points; Step S14: performing time series prediction interpolation filling on the structured data according to the abnormal missing feature points, thereby obtaining filled structured data; Step S15: performing outlier filtering optimization on the unstructured data to generate optimized unstructured data; Step S16: Perform time series clustering and serialization processing on the filled structured data and optimized unstructured data to obtain a multimodal data sequence of the enterprise.

3. The enterprise data asset leakage prevention method according to claim 2, characterized in that: The specific steps of step S15 are: Analyze the semantic features of unstructured data to obtain the semantic features of enterprise data; Extract characteristic keywords based on the semantic features of enterprise data to obtain keywords of enterprise unstructured data; Perform text distribution analysis on keywords in enterprise unstructured data to generate keyword distribution data; Perform parameterized keyword frequency average statistics on unstructured data based on keyword distribution data to generate parameterized data frequency range; Identify abnormal outliers in unstructured data based on parameterized data frequency range and mark abnormal outlier data points; Outlier filtering is optimized for abnormal outlier data points to generate optimized unstructured data.

4. The enterprise data asset leakage prevention method according to claim 1, characterized in that: The specific steps of step S2 are: Step S21: Decomposing the enterprise multimodal data sequence into multiple dimensions, thereby generating data sequences of different dimensions; Step S22: Dimension feature analysis is performed on data sequences of different dimensions, thereby obtaining dimensional features of multiple data series; Step S23: performing adaptive dimensional compression encoding based on the dimensional features of multiple data series to generate multiple low-dimensional feature tensors; Step S24: performing compression loss calculation on multiple low-dimensional feature tensors to obtain compression tensor loss data; Step S25: normalizing the magnitude differences between the data of the multiple low-dimensional feature tensors to generate multiple standardized low-dimensional feature tensors; Step S26: performing end-to-end loss optimization on multiple standardized low-dimensional feature tensors based on the compressed tensor loss data, thereby generating an optimized multimodal low-dimensional tensor.

5. The enterprise data asset leakage prevention method according to claim 1, characterized in that: The specific steps of step S4 are: Step S41: monitoring the entire process of users accessing internal data to obtain user access behavior data; Step S42: performing time series analysis on the user access behavior data to generate access behavior time series data; Step S43: mining the dynamic behavior characteristics of the access behavior time series data to generate dynamic access behavior characteristics; Step S44: Perform global profile fitting on dynamic access behavior features to construct a user behavior profile.

6. The enterprise data asset leakage prevention method according to claim 5, characterized in that: The specific steps of step S43 are: Extract multiple access behavior timestamps based on access behavior time series data; Calculate the access frequency of the user access behavior data according to multiple access behavior timestamps to obtain the access behavior frequency; Perform page dwell time statistics on access behavior time series data to obtain the dwell time of each page; According to the access behavior frequency, the visit interval timeliness analysis is performed on the residence time of each page, so as to obtain the access behavior timeliness characteristic data; Identify user access objects based on access behavior time series data; Performing a user access resource type distribution analysis based on the user access object to obtain access resource type distribution data; Dynamic behavior feature analysis is performed on the access resource type distribution data and access behavior time characteristic data to generate dynamic access behavior features.

7. The enterprise data asset leakage prevention method according to claim 1, characterized in that: The specific steps of step S5 are: Step S51: Detect abnormal access behavior of the user behavior profile and extract potential abnormal access behavior data; Step S52: Tracing the entire access path of the user's access behavior data to obtain the entire access behavior link; Step S53: performing illegal attack behavior analysis on potential abnormal access behavior data based on the access behavior full link to obtain illegal attack access behavior data; Step S54: quantify the risk assessment of the illegal attack access behavior data and generate a risk assessment value of the risk access behavior; Step S55: Make an adaptive risk diagnosis decision based on the risk assessment value of the risky access behavior and construct an access behavior risk strategy.

8. The enterprise data asset leakage prevention method according to claim 1, characterized in that: The specific steps of step S6 are: Step S61: constructing a data protection architecture for the nonlinear obfuscated mirror space to generate a data protection framework; Step S62: mapping risk decision rules to the enterprise encryption data protection framework based on the access behavior risk strategy to build the enterprise encryption protection framework; Step S63: Perform dynamic access control on the enterprise encryption protection framework and build an enterprise data protection model; The dynamic access control specifically includes: identifying the access risk level of the current user based on the access behavior risk strategy; The access risk levels include: high-risk users, medium-risk users, and low-risk users; When the user's access risk level is high-risk, the enterprise encryption protection framework restricts the user's access behavior; When the user's access risk level is medium risk, the enterprise encryption protection framework performs user access data obfuscation processing; When the user's access risk level is low risk, the enterprise encryption protection framework allows the user to access data.

9. An enterprise data asset leakage prevention system, characterized in that: The method for preventing leakage of enterprise data assets according to claim 1 comprises: The data optimization module is used to obtain enterprise multimodal data sets; perform outlier filtering optimization on enterprise multimodal data sets, and perform time series clustering and serialization processing to obtain enterprise multimodal data sequences; The compression coding grinding module is used to perform adaptive dimensional compression coding on enterprise multimodal data sequences to generate multiple low-dimensional feature tensors; perform end-to-end loss optimization on multiple low-dimensional feature tensors to generate optimized multimodal low-dimensional tensors; The mirror encryption module is used to perform mirror space mapping on the optimized multi-modal low-dimensional tensor to obtain a mirror encryption space; perform nonlinear transformation confusion on the mirror encryption space to obtain a nonlinear confused mirror space; The behavior feature module is used to obtain user access behavior data; perform dynamic behavior feature mining on user access behavior data and build user behavior portraits; Adaptive risk decision module, which is used to analyze illegal attack behaviors of user behavior profiles, make adaptive risk diagnosis decisions, and build access behavior risk strategies; The data protection module is used to dynamically control access to the nonlinear obfuscated mirror space based on the access behavior risk strategy and build an enterprise data protection model.

Images