Sensitive data identification method and device, computer equipment and storage medium

Abstract

The embodiment of the invention belongs to the technical field of data processing, and relates to a sensitive data identification method and device, computer equipment and a storage medium, and the method comprises the steps: receiving a sensitive data identification request which is sent by a user terminal and carries a target map database identifier; calling a field blood relationship map corresponding to the target map database identifier, and confirming a starting point field conducted by a sensitive category in the field blood relationship map according to a vertex field rule; performing scanning operation on the content of the starting point field according to a sensitive rule to obtain a sensitive classification attribute; persisting the sensitive classification attribute to an attribute of a corresponding field vertex in a target map database corresponding to the target map database identifier; and propagating the sensitive classification attributes to downstream field vertexes according to the path of the field blood relationship map. According to the method, the sensitive type is conducted through the blood relationship path of the field, and the sensitive field can be quickly and accurately identified only by traversing the blood relationship path without scanning the data content.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a sensitive data identification method, device, computer equipment and storage medium. Background Art

[0002] Sensitive data identification is an important part of data warehouse data governance. Quickly and accurately identifying fields with sensitive information (such as personal information, corporate information, etc.) in data warehouse tables can better control access rights to data and desensitize sensitive data, thereby preventing sensitive data leakage and improving data security.

[0003] Traditional sensitive data identification methods require a lot of manpower to first classify sensitive data, extract the characteristics of each category of sensitive data content (such as keywords, data length and data format, etc.), configure them into regular expressions and other identification rules, and perform data sampling and identification rule matching on the fields of each table in the data warehouse one by one to identify sensitive fields.

[0004] However, the applicant found that as the amount of data in the data warehouse increases significantly, the above-mentioned method of identifying sensitive fields will produce recognition errors due to different proportions of table data sampling. In addition, the metadata of the table and the table data processing logic may change at any time. Regularly and repeatedly scanning the table data not only consumes a lot of cluster resources, but also affects the timeliness of the sensitive field recognition results. Summary of the invention

[0005] The purpose of the embodiments of the present application is to propose a sensitive data identification method, apparatus, computer equipment and storage medium to solve the problem that traditional sensitive data identification methods affect the timeliness of sensitive field identification results.

[0006] In order to solve the above technical problems, the embodiment of the present application provides a sensitive data identification method, which adopts the following technical solution:

[0007] Receiving a sensitive data identification request carrying a target graph database identifier sent by a user terminal;

[0008] Calling a field lineage graph corresponding to the target graph database identifier, and confirming the starting point field of sensitive category conduction in the field lineage graph according to the vertex field rule;

[0009] Scan the content of the starting point field according to the sensitivity rule to obtain a sensitive classification attribute;

[0010] Persisting the sensitive classification attribute to the attribute of the corresponding field vertex in the target graph database corresponding to the target graph database identifier;

[0011] The sensitive classification attribute is propagated to the downstream field vertices according to the path of the field lineage graph.

[0012] Furthermore, before the step of calling the field lineage graph corresponding to the target graph database identifier and confirming the starting point field of sensitive category conduction in the field lineage graph according to the vertex field rule, the following steps are also included:

[0013] Collect SQL statements submitted to the data warehouse cluster and successfully executed in real time;

[0014] Extracting each field processing function of the SQL statement according to the table metadata of the data warehouse cluster and the SQL syntax tree structure;

[0015] A directed field lineage graph is constructed with the field names in the SQL statement as vertices and the field processing functions as edge attributes, and the field lineage graph is persisted in the target graph database.

[0016] Furthermore, the step of propagating the sensitive classification attribute to the downstream field vertices according to the path of the field lineage graph specifically includes the following steps:

[0017] Determine whether the processing function of the downstream field vertex carries an aggregation attribute;

[0018] If the aggregation attribute is carried, the propagation of the path downstream is terminated;

[0019] If the aggregation class attribute is not carried, the sensitive classification attribute is propagated to the downstream field vertex.

[0020] Furthermore, the step of scanning the content of the starting point field according to the sensitivity rule to obtain the sensitive classification attribute specifically includes the following steps:

[0021] Performing a matching scan operation on the content data of the starting point field according to a pre-built sensitive data feature library;

[0022] If the matching scanning operation scans a sensitive data feature, the sensitive classification attribute corresponding to the sensitive data feature is used as the attribute label of the content data of the starting point field.

[0023] Furthermore, the step of scanning the content of the starting point field according to the sensitivity rule to obtain the sensitive classification attribute specifically includes the following steps:

[0024] Performing semantic analysis on the content data of the starting point field according to natural language processing technology to obtain keywords and semantic information;

[0025] The keywords and semantic information are matched according to preset sensitive classification rules to obtain the sensitive classification attributes.

[0026] Furthermore, the step of scanning the content of the starting point field according to the sensitivity rule to obtain the sensitive classification attribute specifically includes the following steps:

[0027] Performing word segmentation on the content data of the starting point field to obtain part of speech and word frequency features;

[0028] The part of speech and word frequency features are classified according to the Naive Bayes algorithm to obtain the sensitive classification attribute.

[0029] In order to solve the above technical problems, the embodiment of the present application further provides a sensitive data identification device, which adopts the following technical solution:

[0030] A request acquisition module, used to receive a sensitive data identification request carrying a target graph database identifier sent by a user terminal;

[0031] A starting point confirmation module, used to call a field lineage graph corresponding to the target graph database identifier, and confirm the starting point field of sensitive category conduction in the field lineage graph according to the vertex field rule;

[0032] A scanning module, used to scan the content of the starting point field according to a sensitive rule to obtain a sensitive classification attribute;

[0033] A persistence module, used to persist the sensitive classification attribute to the attribute of the corresponding field vertex in the target graph database corresponding to the target graph database identifier;

[0034] A propagation module is used to propagate the sensitive classification attribute to the downstream field vertices according to the path of the field lineage graph.

[0035] Furthermore, the device comprises:

[0036] The SQL statement collection module is used to collect SQL statements submitted to the data warehouse cluster and successfully executed in real time;

[0037] A processing function extraction module is used to extract the processing functions of each field of the SQL statement according to the table metadata of the data warehouse cluster and the SQL syntax tree structure;

[0038] A graph construction module is used to construct a directed field lineage graph with the field names in the SQL statement as vertices and the field processing functions as edge attributes, and persist the field lineage graph in the target graph database.

[0039] In order to solve the above technical problems, the embodiment of the present application further provides a computer device, which adopts the following technical solution:

[0040] It includes a memory and a processor, wherein the memory stores computer-readable instructions, and the processor implements the steps of the sensitive data identification method as described above when executing the computer-readable instructions.

[0041] In order to solve the above technical problems, the embodiment of the present application further provides a computer-readable storage medium, which adopts the following technical solution:

[0042] The computer-readable storage medium stores computer-readable instructions, which, when executed by a processor, implement the steps of the sensitive data identification method described above.

[0043] The present application provides a sensitive data identification method, including: receiving a sensitive data identification request carrying a target graph database identifier sent by a user terminal; calling a field lineage graph corresponding to the target graph database identifier, and confirming the starting point field of the sensitive category transmission in the field lineage graph according to the vertex field rule; scanning the content of the starting point field according to the sensitive rule to obtain sensitive classification attributes; persisting the sensitive classification attributes to the attributes of the corresponding field vertex in the target graph database corresponding to the target graph database identifier; propagating the sensitive classification attributes to the downstream field vertices according to the path of the field lineage graph. Compared with the prior art, the present application only selects vertex fields without upstream or vertex fields with more downstream in the data warehouse for sensitive identification and classification of data content, which greatly reduces the amount of data that needs to be scanned and saves the computing resources of the data warehouse cluster. In addition, the sensitive type is transmitted through the lineage path of the field, and only the lineage path needs to be traversed without scanning the data content, so the sensitive field can be quickly and accurately identified. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the scheme in the present application, a brief introduction is given below to the drawings required for use in the description of the embodiments of the present application. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0045] Figure 1 is an exemplary system architecture diagram to which the present application may be applied;

[0046] Figure 2 This is a flowchart of the implementation of the sensitive data identification method provided in Example 1 of the present application;

[0047] Figure 3is a schematic diagram of the structure of a sensitive data identification device provided in Embodiment 2 of the present application;

[0048] Figure 4 It is a structural diagram of an embodiment of a computer device according to the present application. DETAILED DESCRIPTION

[0049] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by technicians in the technical field of the present application; the terms used in the specification of the application herein are only for the purpose of describing specific embodiments and are not intended to limit the present application; the terms "including" and "having" and any variations thereof in the specification and claims of the present application and the above-mentioned drawings are intended to cover non-exclusive inclusions. The terms "first", "second", etc. in the specification and claims of the present application or the above-mentioned drawings are used to distinguish different objects, not to describe a specific order.

[0050] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0051] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0052] like Figure 1 As shown, the system architecture 100 may include a terminal device 101, a network 102 and a server 103. The terminal device 101 may be a laptop 1011, a tablet computer 1012 or a mobile phone 1013. The network 102 is used to provide a medium for a communication link between the terminal device 101 and the server 103. The network 102 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0053] The user can use the terminal device 101 to interact with the server 103 through the network 102 to receive or send messages, etc. Various communication client applications can be installed on the terminal device 101, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0054] The terminal device 101 can be various electronic devices with a display screen and supporting web browsing. In addition to the laptop computer 1011, the tablet computer 1012 or the mobile phone 1013, the terminal device 101 can also be an e-book reader, an MP3 player (Moving Picture Experts Group Audio Layer III), an MP4 (Moving Picture Experts Group Audio Layer IV) player, a laptop computer, a desktop computer, etc.

[0055] The server 103 may be a server that provides various services, such as a background server that provides support for a web page displayed on the terminal device 101 .

[0056] It should be noted that the sensitive data identification method provided in the embodiment of the present application is generally executed by a server / terminal device, and accordingly, the sensitive data identification device is generally set in the server / terminal device.

[0057] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0058] Embodiment 1

[0059] Continue to refer Figure 2 , shows a flow chart of an embodiment of a sensitive data identification method according to the present application. The sensitive data identification method comprises: step S201, step S202, step S203, step S204 and step S205.

[0060] In step S201, a sensitive data identification request carrying a target graph database identifier is received from a user terminal.

[0061] In the embodiments of the present application, the user terminal refers to a terminal device used to execute the image processing method for preventing document abuse provided by the present application. The user terminal can be a mobile terminal such as a mobile phone, a smart phone, a laptop computer, a digital broadcast receiver, a PDA (personal digital assistant), a PAD (tablet computer), a PMP (portable multimedia player), a navigation device, etc., as well as a fixed terminal such as a digital TV, a desktop computer, etc. It should be understood that the examples of user terminals here are only for the convenience of understanding and are not used to limit the present application.

[0062] In step S202, the field lineage graph corresponding to the target graph database identifier is called, and the starting point field of the sensitive category conduction is confirmed in the field lineage graph according to the vertex field rule.

[0063] In the embodiment of the present application, the field vertices with an in-degree of 0 and the field vertices with a smaller in-degree value and a larger out-degree value in the field lineage graph are queried as the starting points of sensitive category conduction.

[0064] In step S203, a scan operation is performed on the content of the starting point field according to the sensitivity rule to obtain a sensitive classification attribute.

[0065] In an embodiment of the present application, the data content of the starting point field is scanned according to sensitivity rules to identify whether the field content contains sensitive information, and the field content is sensitively classified.

[0066] In step S204, the sensitive classification attribute is persisted to the attribute of the corresponding field vertex in the target graph database corresponding to the target graph database identifier.

[0067] In the embodiment of the present application, the classification result is persisted to the attribute of the vertex of the corresponding field of the gallery.

[0068] In step S205, the sensitive classification attributes are propagated to the downstream field vertices according to the path of the field lineage graph.

[0069] In the embodiment of the present application, starting from the field vertex of the starting table, the sensitive classification attributes are propagated layer by layer to the downstream field vertices along the field lineage graph path.

[0070] In an embodiment of the present application, a sensitive data identification method is provided, including: receiving a sensitive data identification request carrying a target graph database identifier sent by a user terminal; calling a field lineage graph corresponding to the target graph database identifier, and confirming the starting point field of the sensitive category transmission in the field lineage graph according to the vertex field rule; scanning the content of the starting point field according to the sensitive rule to obtain sensitive classification attributes; persisting the sensitive classification attributes to the attributes of the corresponding field vertex in the target graph database corresponding to the target graph database identifier; propagating the sensitive classification attributes to the downstream field vertices according to the path of the field lineage graph. Compared with the prior art, the present application only selects vertex fields without upstream or vertex fields with more downstream in the data warehouse for sensitive identification and classification of data content, which greatly reduces the amount of data that needs to be scanned and saves the computing resources of the data warehouse cluster. In addition, the sensitive type is transmitted through the lineage path of the field, and only the lineage path needs to be traversed without scanning the data content, so the sensitive field can be quickly and accurately identified.

[0071] In some optional implementations of the embodiments of the present application, before step S202, the following steps are also included:

[0072] Collect SQL statements submitted to the data warehouse cluster and successfully executed in real time;

[0073] Extract the processing functions for each field of the SQL statement based on the table metadata and SQL syntax tree structure of the data warehouse cluster;

[0074] A directed field lineage graph is constructed with the field names in the SQL statement as vertices and the field processing functions as edge attributes, and the field lineage graph is persisted in the target graph database.

[0075] In the embodiment of the present application, the data warehouse cluster is monitored, and the SQL statements submitted to the cluster for successful execution are collected in real time. The collected SQL statements are matched according to the SQL structure, and the DML statements that will generate data lineage are retained, such as: insert...select... structure, create...as select... structure; based on the table metadata of the data warehouse cluster and the syntax tree structure of SQL, the lineage relationship at the table field level is extracted, and the processing methods (functions) of each field in the SQL statement are retained; the information extracted from the SQL statement is constructed with the field name as the vertex and the field processing function as the edge attribute, and a directed field lineage graph is constructed, and the lineage graph is persisted in the graph database.

[0076] In some optional implementations of the embodiments of the present application, step S205 specifically includes the following steps:

[0077] Determine whether the processing function of the downstream field vertex carries aggregation attributes;

[0078] If it carries aggregation attributes, the propagation of the path downstream is terminated;

[0079] If the aggregation class attribute is not carried, the sensitive classification attribute is propagated to the downstream field vertex.

[0080] In the embodiment of the present application, the field processing function in the bloodline edge needs to be analyzed first during the propagation process. If the processing function contains aggregation class attributes (such as count(), max() and other methods), the propagation of the bloodline path is terminated.

[0081] In some optional implementations of the embodiments of the present application, the above step S203 specifically includes the following steps:

[0082] Performing a matching scan operation on the content data of the starting point field according to a pre-built sensitive data feature library;

[0083] If the matching scanning operation scans a sensitive data feature, the sensitive classification attribute corresponding to the sensitive data feature is used as the attribute label of the content data of the starting point field.

[0084] In an embodiment of the present application, content data of the starting point field is obtained from a database, and then a pre-built sensitive data feature library is used to perform a matching scan on the content data, wherein the feature library contains features of various types of sensitive information. For example, the feature of an ID card number is 18 digits, the feature of a mobile phone number is 11 digits, etc.

[0085] In an embodiment of the present application, if a sensitive data feature is scanned, the sensitive classification attribute corresponding to the feature, such as "personal privacy", is used as an attribute label for the content data.

[0086] In some optional implementations of the embodiments of the present application, the above step S203 specifically includes the following steps:

[0087] Performing semantic analysis on the content data of the starting point field according to natural language processing technology to obtain keywords and semantic information;

[0088] The keywords and semantic information are matched according to preset sensitive classification rules to obtain the sensitive classification attributes.

[0089] In an embodiment of the present application, natural language processing technology can be used to perform semantic analysis on content data, and the Word2Vec algorithm can be used to extract keywords and semantic information. The sensitive attributes of the content data can be determined according to preset sensitive classification rules. For example, content containing keywords such as "bank card" and "transaction password" is classified as "financial information."

[0090] In some optional implementations of the embodiments of the present application, the above step S203 specifically includes the following steps:

[0091] Performing word segmentation on the content data of the starting point field to obtain part of speech and word frequency features;

[0092] The part of speech and word frequency features are classified according to the Naive Bayes algorithm to obtain the sensitive classification attribute.

[0093] In an embodiment of the present application, the content data can be processed by Ji eba word segmentation to extract part of speech and word frequency TF-IDF features, and classified using the Naive Bayes algorithm to determine the sensitive attributes of the content data. In practical applications, the comprehensive evaluation index of the Naive Bayes algorithm can reach 87.

[0094] In some optional implementations of the embodiments of the present application, the sensitivity level of the field can be determined based on the above classification results. If the sensitivity level exceeds the preset threshold value 75, the field data is desensitized.

[0095] The SHA-256 hash algorithm is used to irreversibly encrypt the field data of sensitive attributes, or some sensitive content is replaced with random strings to obtain desensitized field data.

[0096] Finally, replace the original field data with the desensitized data, update the field content in the MySQL database, and complete the security protection of sensitive data.

[0097] In the embodiments of the present application, sensitive information in the data can be discovered intelligently and efficiently, and accurate desensitization can be performed to maximize data security.

[0098] The embodiments of the present application can acquire and process relevant data based on artificial intelligence technology. Artificial Intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.

[0099] AI basic technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing technology, operation / interaction systems, mechatronics, etc. AI software technologies mainly include computer vision technology, robotics technology, biometrics technology, speech processing technology, natural language processing technology, and machine learning / deep learning.

[0100] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through computer-readable instructions, and the computer-readable instructions can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the aforementioned storage medium can be a non-volatile storage medium such as a disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0101] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0102] Embodiment 2

[0103] Further references Figure 3 , as a response to the above Figure 2 The present application provides an embodiment of a sensitive data identification device, and the device embodiment is similar to Figure 2 Corresponding to the method embodiment shown, the device can be specifically applied to various electronic devices.

[0104] like Figure 3 As shown, the sensitive data identification device 200 of the embodiment of the present application includes:

[0105] The request acquisition module 210 is used to receive a sensitive data identification request carrying a target graph database identifier sent by a user terminal;

[0106] The starting point confirmation module 220 is used to call the field lineage graph corresponding to the target graph database identifier, and confirm the starting point field of the sensitive category conduction in the field lineage graph according to the vertex field rule;

[0107] A scanning module 230 is used to scan the content of the starting point field according to the sensitivity rule to obtain a sensitive classification attribute;

[0108] A persistence module 240, used to persist the sensitive classification attribute to the attribute of the corresponding field vertex in the target graph database corresponding to the target graph database identifier;

[0109] The propagation module 250 is used to propagate sensitive classification attributes to downstream field vertices according to the path of the field lineage graph.

[0110] In an embodiment of the present application, a sensitive data identification device 200 is provided, including: a request acquisition module 210, for receiving a sensitive data identification request carrying a target graph database identifier sent by a user terminal; a starting point confirmation module 220, for calling a field lineage graph corresponding to the target graph database identifier, and confirming a starting point field for sensitive category conduction in the field lineage graph according to a vertex field rule; a scanning module 230, for scanning the content of the starting point field according to the sensitive rule to obtain sensitive classification attributes; a persistence module 240, for persisting the sensitive classification attributes to the attributes of the corresponding field vertex in the target graph database corresponding to the target graph database identifier; a propagation module 250, for propagating the sensitive classification attributes to the downstream field vertices according to the path of the field lineage graph. Compared with the prior art, the present application only selects vertex fields without upstream or vertex fields with more downstream in the data warehouse for sensitive identification and classification of data content, which greatly reduces the amount of data to be scanned and saves computing resources of the data warehouse cluster. In addition, the sensitive type is transmitted through the lineage path of the field, and only the lineage path needs to be traversed without scanning the data content, so that the sensitive field can be quickly and accurately identified.

[0111] In some optional implementations of the embodiments of the present application, the sensitive data identification device 200 further includes:

[0112] The SQL statement collection module is used to collect SQL statements submitted to the data warehouse cluster and successfully executed in real time;

[0113] The processing function extraction module is used to extract the processing functions of each field of the SQL statement based on the table metadata and SQL syntax tree structure of the data warehouse cluster;

[0114] The graph construction module is used to construct a directed field lineage graph with the field names in the SQL statement as vertices and the field processing functions as edge attributes, and persist the field lineage graph to the target graph database.

[0115] To solve the above technical problems, the present application also provides a computer device. Figure 4 , Figure 4 This is a basic structural block diagram of a computer device according to an embodiment of the present application.

[0116] The computer device 300 includes a memory 310, a processor 320, and a network interface 330 that are interconnected and communicated through a system bus. It should be noted that the figure only shows a computer device 300 having components 310-330, but it should be understood that it is not required to implement all the components shown, and more or fewer components can be implemented instead. Among them, those skilled in the art can understand that the computer device here is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital processors (DSPs), embedded devices, etc.

[0117] The computer device may be a computing device such as a desktop computer, a notebook, a PDA, a cloud server, etc. The computer device may interact with a user through a keyboard, a mouse, a remote controller, a touch pad, or a voice control device.

[0118] The memory 310 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 310 can be an internal storage unit of the computer device 300, such as a hard disk or memory of the computer device 300. In other embodiments, the memory 310 can also be an external storage device of the computer device 300, such as a plug-in hard disk equipped on the computer device 300, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card, etc. Of course, the memory 310 can also include both the internal storage unit of the computer device 300 and its external storage device. In the embodiment of the present application, the memory 310 is generally used to store the operating system and various application software installed on the computer device 300, such as computer-readable instructions of the sensitive data identification method. In addition, the memory 310 can also be used to temporarily store various data that have been output or are to be output.

[0119] The processor 320 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip in some embodiments. The processor 320 is generally used to control the overall operation of the computer device 300. In the embodiment of the present application, the processor 320 is used to run the computer-readable instructions stored in the memory 310 or process data, such as computer-readable instructions for running the sensitive data identification method.

[0120] The network interface 330 may include a wireless network interface or a wired network interface. The network interface 330 is generally used to establish a communication connection between the computer device 300 and other electronic devices.

[0121] The computer device provided in the present application only selects vertex fields with no upstream or vertex fields with more downstream in the data warehouse for sensitive identification and classification of data content, which greatly reduces the amount of data that needs to be scanned and saves the computing resources of the data warehouse cluster. In addition, the sensitive type is transmitted through the lineage path of the field, and it only needs to traverse the lineage path without scanning the data content, so the sensitive field can be identified quickly and accurately.

[0122] The present application also provides another embodiment, namely, providing a computer-readable storage medium, wherein the computer-readable storage medium stores computer-readable instructions, and the computer-readable instructions can be executed by at least one processor to enable the at least one processor to perform the steps of the sensitive data identification method as described above.

[0123] The computer-readable storage medium provided by the present application only selects vertex fields with no upstream or vertex fields with a large number of downstream in the data warehouse for sensitive identification and classification of data content, which greatly reduces the amount of data that needs to be scanned and saves the computing resources of the data warehouse cluster. In addition, by transmitting sensitive types through the lineage path of the field, it is only necessary to traverse the lineage path without scanning the data content, and the sensitive fields can be identified quickly and accurately.

[0124] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0125] Obviously, the embodiments described above are only some embodiments of the present application, rather than all embodiments. The preferred embodiments of the present application are given in the accompanying drawings, but they do not limit the patent scope of the present application. The present application can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present application more thorough and comprehensive. Although the present application is described in detail with reference to the aforementioned embodiments, for those skilled in the art, it is still possible to modify the technical solutions recorded in the aforementioned specific implementation methods, or to perform equivalent replacement of some of the technical features therein. Any equivalent structure made using the contents of the specification and drawings of this application, directly or indirectly used in other related technical fields, is similarly within the scope of patent protection of this application.

Claims

1. A sensitive data identification method, characterized in that: The steps include: Receiving a sensitive data identification request carrying a target graph database identifier sent by a user terminal; Calling a field lineage graph corresponding to the target graph database identifier, and confirming the starting point field of sensitive category conduction in the field lineage graph according to the vertex field rule; Scan the content of the starting point field according to the sensitivity rule to obtain a sensitive classification attribute; Persisting the sensitive classification attribute to the attribute of the corresponding field vertex in the target graph database corresponding to the target graph database identifier; The sensitive classification attribute is propagated to the downstream field vertices according to the path of the field lineage graph.

2. The sensitive data identification method according to claim 1, characterized in that: Before the step of calling the field lineage graph corresponding to the target graph database identifier and confirming the starting point field of sensitive category conduction in the field lineage graph according to the vertex field rule, the following steps are also included: Collect SQL statements submitted to the data warehouse cluster and successfully executed in real time; Extracting each field processing function of the SQL statement according to the table metadata of the data warehouse cluster and the SQL syntax tree structure; A directed field lineage graph is constructed with the field names in the SQL statement as vertices and the field processing functions as edge attributes, and the field lineage graph is persisted in the target graph database.

3. The sensitive data identification method according to claim 1, characterized in that: The step of propagating the sensitive classification attribute to the downstream field vertices according to the path of the field lineage graph specifically includes the following steps: Determine whether the processing function of the downstream field vertex carries an aggregation attribute; If the aggregation attribute is carried, the propagation of the path downstream is terminated; If the aggregation class attribute is not carried, the sensitive classification attribute is propagated to the downstream field vertex.

4. The sensitive data identification method according to claim 1, characterized in that: The step of scanning the content of the starting point field according to the sensitivity rule to obtain the sensitive classification attribute specifically includes the following steps: Performing a matching scan operation on the content data of the starting point field according to a pre-built sensitive data feature library; If the matching scanning operation scans a sensitive data feature, the sensitive classification attribute corresponding to the sensitive data feature is used as the attribute label of the content data of the starting point field.

5. The sensitive data identification method according to claim 1, characterized in that: The step of scanning the content of the starting point field according to the sensitivity rule to obtain the sensitive classification attribute specifically includes the following steps: Performing semantic analysis on the content data of the starting point field according to natural language processing technology to obtain keywords and semantic information; The keywords and semantic information are matched according to preset sensitive classification rules to obtain the sensitive classification attributes.

6. The sensitive data identification method according to claim 1, characterized in that: The step of scanning the content of the starting point field according to the sensitivity rule to obtain the sensitive classification attribute specifically includes the following steps: Performing word segmentation on the content data of the starting point field to obtain part of speech and word frequency features; The part of speech and word frequency features are classified according to the Naive Bayes algorithm to obtain the sensitive classification attribute.

7. A sensitive data identification device, characterized in that: include: A request acquisition module, used to receive a sensitive data identification request carrying a target graph database identifier sent by a user terminal; A starting point confirmation module, used to call a field lineage graph corresponding to the target graph database identifier, and confirm the starting point field of sensitive category conduction in the field lineage graph according to the vertex field rule; A scanning module, used to scan the content of the starting point field according to a sensitive rule to obtain a sensitive classification attribute; A persistence module, used to persist the sensitive classification attribute to the attribute of the corresponding field vertex in the target graph database corresponding to the target graph database identifier; A propagation module is used to propagate the sensitive classification attribute to the downstream field vertices according to the path of the field lineage graph.

8. The sensitive data identification device according to claim 7, characterized in that: The device comprises: The SQL statement collection module is used to collect SQL statements submitted to the data warehouse cluster and successfully executed in real time; A processing function extraction module is used to extract the processing functions of each field of the SQL statement according to the table metadata of the data warehouse cluster and the SQL syntax tree structure; A graph construction module is used to construct a directed field lineage graph with the field names in the SQL statement as vertices and the field processing functions as edge attributes, and persist the field lineage graph in the target graph database.

9. A computer device comprising a memory and a processor, characterized in that: The memory stores computer-readable instructions, and when the processor executes the computer-readable instructions, the steps of the sensitive data identification method as described in any one of claims 1 to 6 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-readable instructions, which, when executed by a processor, implement the steps of the sensitive data identification method as described in any one of claims 1 to 6.

Images