Intelligent Classification Method and Device for Sensitive Data

Abstract

The present disclosure provides a method and device for intelligent classification of sensitive data, belonging to the technical field of information classification and recognition. The method includes: vectorizing target data to obtain a first data vector; the target data includes sensitive data; inputting the first data vector into a support vector machine model to obtain a first sensitive data classification result corresponding to the first data vector; and verifying the first sensitive data classification result based on a regular expression to obtain a second sensitive data classification result corresponding to the first data vector. The method and device for intelligent classification of sensitive data provided by the present disclosure can solve the problem of low efficiency of traditional rule-based inspection techniques.

Description

Technical Field

[0001] This disclosure belongs to the technical field of information classification and recognition, and more specifically, relates to a method and apparatus for intelligent classification of sensitive data. Background Art

[0002] In the daily operations of institutions such as governments and enterprises, a large amount of sensitive information is accumulated, including but not limited to personal identity information, biometric recognition information, various document numbers, and medical records. According to the requirements of regulations such as the Data Security Law of China and the Personal Information Protection Law, this sensitive information needs to be strictly encrypted or desensitized. To effectively implement this processing measure, the primary task is to conduct a detailed exploration of structured data to accurately identify and locate the sensitive information fields that need to be processed.

[0003] Currently, in this field, the mainstream strategy for exploring structured sensitive data is to use rule-based sensitive information exploration technology. This technology requires manually summarizing the characteristics of sensitive information in advance and then refining these characteristics into standardized formats such as regular expressions and lookup tables. However, due to the complex types of sensitive information, the rules are complex and the expressions are ambiguous. Especially when dealing with Chinese data, it is both time-consuming and laborious to manually summarize all the rules. In addition, when applying rule-based exploration technology, it is necessary to repeatedly traverse the smallest unit of structured data, and the traversal efficiency is directly limited by the character length of the smallest unit, resulting in unsatisfactory performance when dealing with large amounts of data. Summary of the Invention

[0004] The purpose of this disclosure is to provide a method for intelligent classification of sensitive data to solve the problem of low efficiency of traditional rule-based inspection technology.

[0005] In the first aspect of the embodiments of this disclosure, a method for intelligent classification of sensitive data is provided, including:

[0006] Vectorize the target data to obtain a first data vector. The target data includes sensitive data.

[0007] Input the first data vector into a support vector machine model to obtain a first sensitive data classification result corresponding to the first data vector.

[0008] Verify the first sensitive data classification result based on a regular expression to obtain a second sensitive data classification result corresponding to the first data vector.

[0009] In the second aspect of the embodiments of this disclosure, an apparatus for intelligent classification of sensitive data is provided, including:

[0010] A vectorization module for vectorizing the target data to obtain a first data vector. The target data includes sensitive data.

[0011] The first classification module is configured to input a first data vector into a support vector machine model to obtain a first sensitive data classification result corresponding to the first data vector.

[0012] The second classification module is configured to verify the first sensitive data classification result based on a regular expression to obtain a second sensitive data classification result corresponding to the first data vector.

[0013] In a third aspect of the embodiments of the present disclosure, there is provided an electronic device, including a memory, a processor, and a computer program stored in the memory and running on the processor. When the processor executes the computer program, the steps of the above-mentioned sensitive data intelligent classification method are implemented.

[0014] In a fourth aspect of the embodiments of the present disclosure, there is provided a computer-readable storage medium storing a computer program, and when the computer program is executed by a processor, the steps of the above-mentioned sensitive data intelligent classification method are implemented.

[0015] The beneficial effects of the sensitive data intelligent classification method and device provided by the embodiments of the present disclosure are as follows: By combining a support vector machine and a regular expression, the embodiments of the present disclosure perform sensitive data inspection on structured data, solving the disadvantages of rule-based inspection, such as difficult rule formation, long recognition time, and inability to perform fuzzy recognition.

[0016] Specifically, by vectorizing the target data and inputting it into a support vector machine model, the embodiments of the present disclosure can quickly obtain a preliminary sensitive data classification result by utilizing the powerful classification ability of the model, improving the classification efficiency. Verifying the preliminary result based on a regular expression can ensure the accuracy of the classification result and reduce the possibility of misjudgment. This method combines the advantages of machine learning and regular expressions, can process a large amount of data quickly, and can ensure the classification accuracy, effectively protecting sensitive information and having important practical application value.

[0017] The vectorization method of the present application performs better than the bag-of-words method. The bag-of-words method cannot capture many information of the string, such as length, the position of each character in the string, etc. While the vectorization method of the present application can well capture these feature points and improve the performance of the support vector machine. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure, the following will briefly introduce the drawings required for use in the embodiments or the description of the prior art. Obviously, the following drawings are only some embodiments of the present disclosure. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0019] Figure 1Flow chart of an intelligent classification method for sensitive data provided by an embodiment of the present disclosure;

[0020] Figure 2 Flow chart of classification using a support vector machine model provided by an embodiment of the present disclosure;

[0021] Figure 3 Flow chart of data dictionary generation provided by an embodiment of the present disclosure;

[0022] Figure 4 Flow chart of data vectorization provided by an embodiment of the present disclosure;

[0023] Figure 5 Flow chart of another intelligent classification method for sensitive data provided by an embodiment of the present disclosure;

[0024] Figure 6 Flow chart of yet another intelligent classification method for sensitive data provided by an embodiment of the present disclosure;

[0025] Figure 7 Structural block diagram of an intelligent classification device for sensitive data provided by an embodiment of the present disclosure;

[0026] Figure 8 Schematic block diagram of an electronic device provided by an embodiment of the present disclosure. Detailed implementation manners

[0027] In the following description, specific details such as specific system architectures and technologies are presented for the purpose of illustration rather than limitation, so as to thoroughly understand the embodiments of the present disclosure. However, those skilled in the art should clearly understand that the present disclosure can also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to avoid unnecessary details from hindering the description of the present disclosure.

[0028] To make the objectives, technical solutions, and advantages of the present disclosure clearer, the following will be described through specific embodiments with reference to the accompanying drawings.

[0029] Please refer to Figure 1 , Figure 1 Flow chart of an intelligent classification method for sensitive data provided by an embodiment of the present disclosure. The method may include S101 to S103.

[0030] S101: Vectorize the target data to obtain a first data vector. The target data includes sensitive data.

[0031] In this embodiment, vectorizing the target data may include: obtaining data row information from a database, and vectorizing multiple data item information in the data row information to obtain a first data vector.

[0032] Exemplarily, in a data processing scenario involving user privacy protection, a database containing multiple pieces of user information is set up. This information includes, but is not limited to, sensitive data such as name, ID number, and phone number. Data rows are accurately extracted from the database. Taking a certain user as an example, their information includes the name "Zhang San", the ID number "123456789012345678", and the phone number "13812345678". For the extracted data items, specific vectorization techniques can be used for processing. This process aims to convert unstructured information such as name, ID number, and phone number into a structured vector form, namely the first data vector.

[0033] During the vectorization process, for the ID number, it can be converted based on its unique digital sequence characteristics; for the phone number, its digital combination pattern and fixed number of digits and other characteristics are considered for vectorization. Through this method, vectorization processing of large-scale target data can be achieved, laying a solid foundation for subsequent sensitive information classification.

[0034] These first data vectors after vectorization processing are input into a pre-constructed sensitive data classification model. The sensitive data classification model, based on advanced algorithms and logic, can further classify and identify the input data vectors in detail, thus realizing the effective management and protection of user sensitive information.

[0035] S1: Input the first data vector into a support vector machine model to obtain a first sensitive data classification result corresponding to the first data vector.

[0036] As Figure 2 shown, in this embodiment, the support vector machine model extracts feature vectors according to the input first data vector. Classify the first data vector based on the feature vectors to obtain a first sensitive data classification result.

[0037] Exemplarily, input the vector V (V = [V_1, V_2,..., V_30]) into the support vector machine model for classification. The support vector machine model outputs a digital sequence R (classification result), and its length is consistent with the number of defined sensitive data types. In this sequence, the magnitude of each number reflects the probability level that the input vector V is classified as the corresponding sensitive data type; specifically, the larger the value, the higher the possibility that the vector V belongs to this sensitive category.

[0038] Suppose there are four types of sensitive data, namely: mobile phone number (T_1), ID number (T_2), passport number (T_3), and bank card number (T_4). When the support vector machine outputs the digital sequence [-6, 15, -12, 8], it means that R_1 = -6, corresponding to the mobile phone number (T_1); R_2 = 15, corresponding to the ID number (T_2); R_3 = -12, corresponding to the passport number (T_3); R_4 = 3, corresponding to the bank card number (T_4).

[0039] Select the two types of sensitive data with the largest numbers. The ID number (T_2) is the sensitive data type to which the vector V is most likely to be classified because the corresponding number (15) is the largest in the sequence. The second is the bank card number (T_4) because the corresponding number (3) is the largest among the remaining items.

[0040] S103: Verify the first sensitive data classification result based on a regular expression to obtain the second sensitive data classification result corresponding to the first data vector.

[0041] In this embodiment, the first sensitive data classification result corresponding to the first data vector includes evaluation values corresponding to multiple sensitive data types.

[0042] In this embodiment, verifying the first sensitive data classification result based on a regular expression to obtain the second sensitive data classification result corresponding to the first data vector includes:

[0043] Select N sensitive data types from multiple sensitive data types based on the evaluation values corresponding to multiple sensitive data types.

[0044] Calculate the regular expressions corresponding to the N sensitive data types respectively.

[0045] Verify the target data based on the regular expressions corresponding to the N sensitive data types.

[0046] In this embodiment, a regular expression is a tool for matching and operating on text patterns. It can check whether data conforms to a specific pattern according to predefined rules. By matching the first sensitive data classification result with the regular expression, if the match is successful, it is considered that the classification result has been verified, thereby obtaining the second sensitive data classification result corresponding to the first data vector.

[0047] Exemplarily, from the classification result R obtained according to the above embodiments, the two sensitive data types with the largest values, i.e., the highest probabilities, are selected. These two types are verified based on regular expressions. Taking R = [-6, 15, -12, 3] as an example, if the sensitive data type T includes ['phone number', 'ID number', 'passport number', 'bank card number'], then the two largest values in R are R_2 and R_4, which correspond to T_2 (ID number) and T_4 (bank card number) in the sensitive category T respectively.

[0048] The original data is checked using the regular expressions of the ID number and the bank card number. If the regular expression matching verification of a certain sensitive data type is successful, it is confirmed that the original data item belongs to this sensitive data type. If the matching verifications of both regular expressions fail, it is regarded as a false alarm, and it is determined that the original data does not belong to the category of sensitive data. For sensitive information without corresponding regular expressions, such as names, etc., manual further review can be adopted.

[0049] It can be concluded from the above that in this embodiment, by combining the support vector machine and regular expressions, sensitive data checking is performed on structured data, solving the disadvantages of rule-based checking, such as difficult rule formation, long recognition time, and inability to perform fuzzy recognition.

[0050] Specifically, in this embodiment, by vectorizing the target data and inputting it into the support vector machine model, the powerful classification ability of the model can be utilized to quickly obtain a preliminary sensitive data classification result, improving the classification efficiency. Verifying the preliminary result based on regular expressions can ensure the accuracy of the classification result and reduce the possibility of misjudgment. This method combines the advantages of machine learning and regular expressions, can not only quickly process a large amount of data, but also ensure the classification accuracy, effectively protecting sensitive information and having important practical application value.

[0051] The vectorization method of this embodiment performs better than the bag-of-words method. The bag-of-words method cannot capture many information of the string, such as length, the position of each character in the string, etc. While the vectorization method of this application can well capture these feature points and improve the performance of the support vector machine.

[0052] In an embodiment of the present disclosure, the sensitive data intelligent classification method further includes:

[0053] Performing sensitive data type annotation on the training data set. The training data set includes multiple sensitive data.

[0054] Vectorizing the annotated training data set to obtain a second data vector.

[0055] Training a preset support vector machine model based on the second data vector to obtain a support vector machine model.

[0056] In this embodiment, the support vector machine model is a classification model based on machine learning and needs to be trained before use.

[0057] In this embodiment, training the preset support vector machine model based on the second data vector to obtain the support vector machine model includes:

[0058] Training the preset support vector machine model based on the second data vector to determine the target parameters;

[0059] Obtaining the support vector machine classification model based on the target parameters.

[0060] Exemplarily, in order to automatically find the target parameters (i.e., the best parameters) of the support vector machine model, the grid search method can be adopted. The specific steps are as follows: Determine the initial search ranges of C and gamma. The range of C is set from to , and the range of gamma is to . The search step size increases in powers of 2, that is, the search sequence of C is , , , ,..., , and the search sequence of gamma is ,..., . At this time, a part of the training data can be selected. For each combination of C and gamma, perform 5-fold cross-validation and use the f-1 score as the performance evaluation criterion. Within this range, find the combination of C and gamma that can maximize the f-1 score. As the preliminary optimal parameters, and accordingly set a more refined search range. For example, if the preliminary search result is C: , gamma: , then the refined search range of C can be set from to , and the range of gamma is to , and the search step size is adjusted to 0.25. Through such a dual search strategy, the best parameters of the support vector machine model can be accurately determined.

[0061] Compared with the traditional method that relies on manual inspection of model performance and manual adjustment of parameters, this automated search method has significant advantages. Facing a large amount of data and complex data types, it is difficult for humans to accurately obtain the best parameters through means such as data analysis. Manual search not only has low efficiency but also limited accuracy, making it difficult to ensure the best classification effect. The automated grid search, on the other hand, uses a search strategy from coarse to fine. First, it determines the approximate range of the best parameters, and then further refines the search. The whole process is simple and efficient, without manual intervention, and can ensure that the selected parameters are globally optimal.

[0062] In addition, manually determining the best parameters requires the training personnel to have a deep professional background and rich experience, which has relatively high requirements for the operators. The automated search for the best parameters completely gets rid of the shackles of manual work and reduces the requirements for the operators.

[0063] Exemplarily, based on the classification requirements of sensitive data types, the corresponding training data sets are obtained in advance and these data are labeled. Specifically, if the sensitive data types include ['phone number', 'ID number', 'passport number', 'bank card number'], then four independent CSV files are prepared, and the naming of each file can follow the English name specification of each sensitive data type. For example, Phone_number.csv is used to store phone number data, Ssn.csv is used to store ID number data, Passport_number.csv is used to store passport number data, and Credit_card_number.csv is used to store bank card number data. Each file only contains string data of the corresponding type.

[0064] Furthermore, in order to efficiently process these sensitive data, a sensitive type marking system can be created. This system will be marked based on the index position of different sensitive data types in the list. For example, the phone number is marked as 0, the ID number is marked as 1, and so on. This marking system can be applied to the data processing flow without the need to build additional complex data structures to store the marking information.

[0065] This embodiment realizes the efficient and accurate classification of sensitive data by annotating the training data set, vectorizing, and training the support vector machine model. This method simplifies the data processing flow, improves the classification efficiency, and ensures the accuracy of classification through the machine learning model, effectively reducing the risk of data leakage.

[0066] As Figure 3 shown, in an embodiment of the present disclosure, the annotated training data set is vectorized to obtain a second data vector, including:

[0067] Generating a data dictionary based on the training data set.

[0068] Perform data transformation on the data of the training data set based on the data dictionary to obtain a second data vector.

[0069] In this embodiment, the data dictionary includes M non-repeating characters in the training data set.

[0070] In this embodiment, perform data transformation on the data of the training data set based on the data dictionary to obtain multiple second data vectors, including: calculating vector values corresponding to the M non-repeating characters based on an assignment function.

[0071] Concatenate the vector values corresponding to the M non-repeating characters to obtain a second data vector.

[0072] The assignment function is:

[0073]

[0074] Wherein, F_i represents the vector value corresponding to the i-th character, x represents a set constant, and M represents the total number of non-repeating characters in the data dictionary.

[0075] Exemplarily, in the process of constructing the data dictionary, normalization processing can be performed based on the training data set to ensure that the data dictionary comprehensively covers all characters in the data set and assigns values to these characters one by one. This process starts with extracting unique characters from the training data set, assigning values to all characters one by one, and storing these key-value pairs in the data dictionary.

[0076] For the specific strategy of numerical assignment, a dynamic adjustment method can be adopted. For example, the space character (' ') is fixedly assigned a value of 0, while other characters are assigned values by linear interpolation according to the total number n of characters in the data dictionary. Specifically, the assignment of these characters starts from a non-zero minimum value and gradually increases to 1. The data dictionary is constructed in the form of a Python dictionary and persistently stored in the JSON file format. Its structure is as follows:

[0077] {

[0078] " ": 0.0,

[0079] "K_1": F_1,

[0080] "K_2": F_2, ...

[0081] "K_n": F_n

[0082] }

[0083] Among them, \(K_i\) represents the \(i\)-th character in the data dictionary, and \(F_i\) represents the assignment corresponding to the \(i\)-th character in the data dictionary. The value range of \(i\) is from 1 to \(n\), where \(n\) is the total number of characters (excluding spaces) in the data dictionary. \(F_n\) is explicitly assigned as 1, serving as the upper limit of the value range.

[0084] During the assignment process, if the data dictionary contains \(n\) characters (excluding spaces), the assignment of each character is calculated by the formula \(F_i = 0+(1 / n)*i\), where \(i\) represents the serial number of the character (starting from 1). Taking 26 English letters as an example, if \(n = 26\), the assignment of the first character 'a' is 0.03846153846 (i.e., \(0+(1 / 26)*1\)), the assignment of the second character 'b' is 0.07692307692 (i.e., \(0+(1 / 26)*2\)), and so on until the last character 'z', whose assignment is 1 (i.e., \(0+(1 / 26)*26\)).

[0085] Therefore, for a dictionary containing 26 English letters, its structure will be as follows:

[0086] {

[0087] " ": 0,

[0088] "a": 0.03846153846,

[0089] "b": 0.07692307692, ...

[0090] "z": 1

[0091] }

[0092] As Figure 3 shown, this process is divided into two parts. The first part is to find all non-repeating characters from the training data, and the second part is to assign values to the non-repeating characters found in the first part. The format of the training data is a string (String) with a length of 0, and there are \(S_1\) to \(S_o\) strings in total. The length of each string is \(m\), and the content is characters (Char), including \(C_1\) to \(C_m\).

[0093] First, read the training data as a list named L_1, where each item in L_1 is a string in the training data. During initialization, establish two integer variables as loop indices, such as the first-layer index i and the second-layer index j. Create a data dictionary D with the initial content {" ": "0.0"}, and an empty list L_2. Establish a two-layer loop: the first-layer loop iterates through all the strings in L_1, and the second-layer loop iterates through all the characters in the string. Use the in instruction to determine whether the characters in the string can be found in L_2. If not, use the append instruction to add it to L_2. After traversing all the strings, obtain the list L_2 that contains all the non-repeating characters in the training data, with a length of n, and each item is a character.

[0094] Enter the assignment process. Create an integer variable p as the loop index, iterate through the characters in L_2, and calculate and assign F_p (variable type: double) through a formula. Use the current character K_p as the key of the data dictionary D, and F_p as the value corresponding to the key. Update {"K_p": "F_p"} to the dictionary through the update instruction. After completing all traversals, obtain a data dictionary whose keys are all the non-repeating characters in the training data, and the values corresponding to the keys are the assignments of the characters. Subsequently, the data can be vectorized through the data dictionary D.

[0095] Exemplarily, as Figure 4 shown, this process is to convert a string S with a length of m into a vector with a length of 30, and the conversion rule is based on the pre-created data dictionary D. The specific steps are as follows: Create a list V with a length of 30, and initialize each item in the list V to 0. Create an integer variable i as the loop index. Iterate through each character C_i in the string S, and use the in instruction to determine whether the character C_i is a key in the data dictionary D. If the character C_i exists in the data dictionary D, update the value of the corresponding V_i item in V to the corresponding value in D; if the character C_i does not exist in the data dictionary D, assign -1 to the corresponding V_i item. If the length of S is less than or equal to 30, the values starting from the m-th item in V remain 0. If the length of S is greater than 30, the characters after the 30th item are not included in V. The finally obtained V is the vector corresponding to the string S. This can ensure that each character of the string S is converted according to the assignment in the data dictionary D, and the finally obtained vector V always maintains a length of 30.

[0096] Specifically, a data dictionary can be used to convert all the data in the training dataset into vectors of length 30. The vector structure is as follows: [V_1, V_2, V_3, ……, V_30], where V_1, V_2, V_3, ……, V_30 are F_i in the data dictionary. The specific conversion method is as follows: If a string of characters is "C_1, C_2, C_3, ……, C_n", then V_1 is the value assigned to C_1 in the dictionary, V_2 is the value assigned to C_2 in the dictionary, and so on. If n < 30, the values of the extra positions are all 0; if n ≥ 30, the characters after the 30th position are not included in the vector. For example, if there is a string "abcd" in the training dataset, the converted result is V_1 = 0.03846153846, V_2 = 0.07692307692, V_3 = 0.1153846154, V_4 = 0.1538461538, and the rest are 0, and the vector is: [0.03846153846, 0.07692307692, 0.1153846154, 0.1538461538, 0, 0, 0, ……, 0].

[0097] In this embodiment, by vectorizing the labeled training dataset, the data processing efficiency and the model training accuracy are effectively improved. Specifically, by constructing a data dictionary and assigning and splicing characters in the training dataset one by one, not only the integrity and coverage of the data dictionary are ensured, but also reasonable values are assigned to the characters by means of linear interpolation, so that the relative relationship between the characters can be accurately expressed in the vector space.

[0098] In an embodiment of the present disclosure, the sensitive data intelligent classification method further includes:

[0099] Extracting data rows from the target database to obtain target data.

[0100] In this embodiment, extracting data rows from the target database to obtain target data may include: obtaining data row information and data row source information from the target database;

[0101] The data row information includes multiple data item information; the data row source information includes data row identification information and data item identification information.

[0102] Exemplarily, in the financial field, to ensure the security and compliance of customer data, it is necessary to classify sensitive data. For example, a bank extracts data rows from its target database to obtain relevant information about customers. Through the database data extraction module, data row information and data row source information are obtained from the target database. The data row information can include multiple data item information such as the customer's name, ID number, bank card number, etc.; the data row source information can include data row identification information (such as customer number, transaction serial number, etc.) and data item identification information (such as the name of the table to which it belongs, the name of the field to which it belongs, etc.). For example, when extracting the data row of a certain customer from the bank database, it contains information such as the name "Zhang San", ID number "123456789012345678", bank card number "6212345678901234", etc., and at the same time records that this data row comes from the "customer information table", and the source information such as the field name of the ID number is "IDNumber".

[0103] In this embodiment, by accurately extracting and identifying data row information and its source from the target database, comprehensive coverage and efficient classification of sensitive data are achieved. This not only improves the accuracy of data processing but also enhances data security and compliance, and has significant practical application value in fields such as finance.

[0104] In an embodiment of the present disclosure, the sensitive data intelligent classification method further includes:

[0105] Determine the server connection parameters, first-level identifier, second-level identifier, data row extraction method, and data row extraction quantity of the target database. The first-level identifier is the target database name, and the second-level identifier is the table name.

[0106] The target database includes multiple data row information.

[0107] In this embodiment, the first-level identifier can include the target database name or target database number, and the second-level identifier can include the table name or table number. The target database, table, data extraction method, and data extraction quantity can be selected from the configured database server.

[0108] In the medical industry, to ensure patient privacy and data security, the classification and processing of sensitive data are crucial. Determining the connection parameters of the target database server can include key information such as the server address, username, and password. Using the database name (such as "hospital patient database") as the first-level identifier and the table name (such as "patient basic information table") as the second-level identifier to achieve accurate data positioning.

[0109] According to actual requirements, select an appropriate data row extraction strategy, which can include full-table extraction or partial data row extraction based on specific conditions, and clearly specify the amount of data to be extracted. For example, extract 1000 data rows for subsequent analysis. For example, select the "Hospital Patient Database" as the operation object from the configured database server, specify the "Patient Basic Information Table" as the secondary identifier, adopt the full-table extraction strategy, and set 500 data rows to be extracted as the analysis sample.

[0110] This embodiment provides an efficient and accurate classification and management means for sensitive data in multi-domain databases, effectively ensuring the security and privacy of user data.

[0111] As Figure 5 shown, in an embodiment of the present disclosure, exemplary, the sensitive data intelligent classification method can be divided into an algorithm initialization module, a database data extraction module, a data vectorization module, a support vector machine data category detection module, and a rule-based verification module. Specifically, the algorithm initialization module can read and store information such as models, model configurations, and regular expressions, providing necessary support for the support vector machine data category detection module and the rule-based verification module. At the same time, key information such as server configuration information, model selection information, and data configuration information is determined.

[0112] The database data extraction module can extract data rows from the target database and record the source of the data rows (table name, database name, server configuration, etc.) and the source of the data items (table name, field name, field index number, etc.).

[0113] The data vectorization module can vectorize the data items in the data rows extracted from the target database so that the support vector machine can process them.

[0114] The support vector machine data category detection module can use the support vector machine model to classify the vectorized data and record the category.

[0115] The rule-based verification module can use rule-based detection methods to verify the classification results of the support vector machine model to reduce the error rate and false alarm rate.

[0116] As Figure 6 shown, in an embodiment of the present disclosure, exemplary, the method can be divided into the following processes: algorithm initialization, extract and check data from the database, vectorize the check data, classify through the support vector machine model, use the regular expression corresponding to the classification result to check the data category (i.e., sensitive data type), and verify whether the classification result is consistent with the regular expression. If they are consistent, the data belongs to sensitive information; if not, the data does not belong to sensitive information.

[0117] A sensitive data intelligent classification method corresponding to the above embodiments Figure 7 Figure 7 is a structural block diagram of a sensitive data intelligent classification device provided by an embodiment of the present disclosure. For ease of explanation, only parts related to the embodiments of the present disclosure are shown. Refer to Figure 7 , the sensitive data intelligent classification device 20 includes:

[0118] A vectorization module 21, configured to vectorize target data to obtain a first data vector. The target data includes sensitive data.

[0119] A first classification module 22, configured to input the first data vector into a support vector machine model to obtain a first sensitive data classification result corresponding to the first data vector.

[0120] A second classification module 23, configured to verify the first sensitive data classification result based on a regular expression to obtain a second sensitive data classification result corresponding to the first data vector.

[0121] In an embodiment of the present disclosure, the sensitive data intelligent classification device 20 further includes:

[0122] A first training module, configured to label sensitive data types for a training data set. The training data set includes multiple sensitive data.

[0123] A second training module, configured to vectorize the labeled training data set to obtain a second data vector.

[0124] A third training module, configured to train a preset support vector machine model based on the second data vector to obtain a support vector machine model.

[0125] In an embodiment of the present disclosure, the second training module includes:

[0126] A first calculation unit, configured to generate a data dictionary based on the training data set.

[0127] A second calculation unit, configured to perform data conversion on the data of the training data set based on the data dictionary to obtain a second data vector.

[0128] In an embodiment of the present disclosure, the data dictionary includes M non-repeating characters in the training data set, and the second calculation unit is specifically configured to calculate vector values corresponding to the M non-repeating characters based on an assignment function.

[0129] Concatenate the vector values corresponding to the M non-repeating characters to obtain a second data vector.

[0130] The assignment function is:

[0131]

[0132] Among them, \(F_i\) represents the vector value corresponding to the \(i\)th character, \(x\) represents a set constant, and \(M\) represents the total number of non-repeating characters in the data dictionary.

[0133] In an embodiment of the present disclosure, the first sensitive data classification result corresponding to the first data vector includes evaluation values corresponding to multiple sensitive data types. The second classification module 23 is specifically configured to select \(N\) sensitive data types from multiple sensitive data types based on the evaluation values corresponding to multiple sensitive data types.

[0134] Calculate regular expressions corresponding to the \(N\) sensitive data types respectively.

[0135] Verify the target data based on the regular expressions corresponding to the \(N\) sensitive data types.

[0136] In an embodiment of the present disclosure, the sensitive data intelligent classification device 20 further includes:

[0137] The first data acquisition module is used to extract data rows from the target database to obtain target data.

[0138] In an embodiment of the present disclosure, the sensitive data intelligent classification device 20 further includes:

[0139] The second data acquisition module is used to determine the server connection parameters, first-level identifier, second-level identifier, data row extraction method, and data row extraction quantity of the target database. The first-level identifier is the target database name, and the second-level identifier is the table name.

[0140] The target database includes multiple data row information.

[0141] See Figure 8 , Figure 8 which is a schematic block diagram of an electronic device provided in an embodiment of the present disclosure. As Figure 8 shown, the electronic device 300 in this embodiment may include: one or more processors 301, one or more input devices 302, one or more output devices 303, and one or more memories 304. The above-mentioned processors 301, input devices 302, output devices 303, and memories 304 complete mutual communication through the communication bus 305. The memory 304 is used to store computer programs, and the computer programs include program instructions. The processor 301 is used to execute the program instructions stored in the memory 304. Among them, the processor 301 is configured to call the program instructions to execute the functions of each module / unit in the above-mentioned device embodiments, such as Figure 7 the functions of the modules 21 to 23 shown.

[0142] It should be understood that in the embodiments of the present disclosure, the so-called processor 301 may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSPs), application specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0143] The input device 302 may include a touchpad, a fingerprint acquisition sensor (for acquiring the fingerprint information and the direction information of the fingerprint of the user), a microphone, etc., and the output device 303 may include a display (such as an LCD), a speaker, etc.

[0144] The memory 304 may include a read-only memory and a random access memory, and provide instructions and data to the processor 301. A part of the memory 304 may also include a non-volatile random access memory. For example, the memory 304 may also store information about the device type.

[0145] In specific implementation, the processor 301, the input device 302, and the output device 303 described in the embodiments of the present disclosure may execute the implementation manners described in the first embodiment and the second embodiment of the sensitive data intelligent classification method provided by the embodiments of the present disclosure, and may also execute the implementation manner of the electronic device 300 described in the embodiments of the present disclosure, which will not be elaborated herein.

[0146] In another embodiment of the present disclosure, a computer-readable storage medium is provided. The computer-readable storage medium stores a computer program, and the computer program includes program instructions. When the program instructions are executed by a processor, all or part of the processes in the methods of the above embodiments are implemented. It can also be completed by instructing relevant hardware through the computer program. The computer program can be stored in a computer-readable storage medium. When the computer program is executed by the processor, the steps of the above method embodiments can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in the form of source code, object code, executable file or some intermediate form, etc. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electrical carrier signal, telecommunication signal, and software distribution medium, etc.

[0147] The computer-readable storage medium can be an internal storage unit of the electronic device in any of the foregoing embodiments, such as the hard disk or memory of the electronic device. The computer-readable storage medium can also be an external storage device of the electronic device, such as a plug-in hard disk equipped on the electronic device, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. Further, the computer-readable storage medium can also include both the internal storage unit and the external storage device of the electronic device. The computer-readable storage medium is used to store the computer program and other programs and data required by the electronic device. The computer-readable storage medium can also be used to temporarily store the data that has been output or will be output.

[0148] Those of ordinary skill in the art can realize that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. To clearly illustrate the interchangeability of hardware and software, the components and steps of the examples have been generally described according to their functions in the above description. Whether these functions are executed in a hardware or software manner depends on the specific application and design constraints of the technical solution. Professional technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present disclosure.

[0149] Those skilled in the art can clearly understand that for the convenience and brevity of description, the specific working processes of the above-described electronic devices and units can refer to the corresponding processes in the foregoing method embodiments and will not be elaborated herein.

[0150] In several embodiments provided by the present application, it should be understood that the disclosed electronic devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed couplings or direct couplings or communication connections to each other can be indirect couplings or communication connections through some interfaces or units, and can also be electrical, mechanical or other forms of connection.

[0151] The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiments of the present disclosure.

[0152] In addition, each functional unit in various embodiments of the present disclosure can be integrated in a processing unit, or each unit can exist physically alone, or two or more units can be integrated in one unit. The above integrated units can be implemented in the form of hardware or in the form of software functional units.

[0153] The above is only the specific implementation manner of the present disclosure, but the protection scope of the present disclosure is not limited thereto. Any person skilled in the art within the technical scope disclosed by the present disclosure can easily think of various equivalent modifications or substitutions, and these modifications or substitutions should all be covered within the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be subject to the protection scope of the claims.

Claims

1. An intelligent classification method for sensitive data, characterized in that, Including: Obtain data row information and data row source information from the target database to obtain target data; The data row information includes multiple data item information; the data row source information includes data row identification information and data item identification information; Vectorize the target data to obtain a first data vector; the target data includes sensitive data; Input the first data vector into a support vector machine model to obtain a first sensitive data classification result corresponding to the first data vector; Verify the first sensitive data classification result based on a regular expression to obtain a second sensitive data classification result corresponding to the first data vector; The training process of the support vector machine model includes: Label the sensitive data types of the training data set; the training data set includes multiple sensitive data; Generate a data dictionary based on the training data set; the data dictionary includes M non-repeating characters in the training data set; Calculate the vector values corresponding to the M non-repeating characters based on an assignment function; The assignment function is: Where, F_i represents the vector value corresponding to the i-th character, x represents a set constant, and M represents the total number of non-repeating characters in the data dictionary; Concatenate the vector values corresponding to the M non-repeating characters to obtain a second data vector; Train a preset support vector machine model based on the second data vector to obtain the support vector machine model.

2. The intelligent classification method for sensitive data according to claim 1, wherein The first sensitive data classification result corresponding to the first data vector includes evaluation values corresponding to multiple sensitive data types. The verification of the first sensitive data classification result based on a regular expression to obtain the second sensitive data classification result corresponding to the first data vector includes: Select N sensitive data types from multiple sensitive data types based on the evaluation values corresponding to multiple sensitive data types; Calculate the regular expressions corresponding to the N sensitive data types respectively; Verify the target data based on the regular expressions corresponding to the N sensitive data types.

3. The intelligent classification method for sensitive data according to claim 1, wherein Also including: Determine the server connection parameters, first-level identifier, second-level identifier, data row extraction method, and data row extraction quantity of the target database; The first-level identifier is the target database name, and the second-level identifier is the table name; The target database includes multiple data row information.

4. An intelligent classification device for sensitive data, characterized in that, Including: A first data acquisition module, configured to obtain data row information and data row source information from the target database to obtain target data; the data row information includes multiple data item information; the data row source information includes data row identification information and data item identification information; A vectorization module, configured to vectorize the target data to obtain a first data vector; the target data includes sensitive data; A first classification module, configured to input the first data vector into a support vector machine model to obtain a first sensitive data classification result corresponding to the first data vector; A second classification module, configured to verify the first sensitive data classification result based on a regular expression to obtain a second sensitive data classification result corresponding to the first data vector; The training process of the support vector machine model includes: The first training module is used to label the sensitive data types of the training data set; the training data set includes multiple sensitive data; The second training module is used to generate a data dictionary based on the training data set; the data dictionary includes M non-repeating characters in the training data set; calculate the vector values corresponding to the M non-repeating characters based on an assignment function; the assignment function is: where F_i represents the vector value corresponding to the i-th character, x represents a set constant, and M represents the total number of non-repeating characters in the data dictionary; Concatenate the vector values corresponding to the M non-repeating characters to obtain a second data vector; The third training module is used to train a preset support vector machine model based on the second data vector to obtain the support vector machine model.

5. An electronic device, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 3.

6. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the method according to any one of claims 1 to 3.

Images