Data classification and grading method, device and equipment and readable storage medium

Abstract

The embodiment of the invention provides a data classification and grading method and device, equipment and a readable storage medium. The method comprises the steps of obtaining a file, and determining a target first data type corresponding to to-be-processed data in the file; determining a target data identification configuration corresponding to the target first data type according to a preset mapping relationship between the first data type and the data identification configuration; different data identification configurations are used for identifying data of different first data types; based on the target data identification configuration, identifying a target field carried in the to-be-processed data, and determining a target second data type corresponding to the to-be-processed data according to the target field; and determining classification and grading information corresponding to the target second data type according to a preset mapping relationship between the second data type and the classification and grading information so as to complete classification and grading of the to-be-processed data. According to the invention, the data classification and grading efficiency can be improved.

Description

Technical Field

[0001] The present invention belongs to the field of data processing, and in particular relates to a data classification and grading method, device, electronic equipment and readable storage medium. Background Art

[0002] With the development of computer technology, data security is becoming more and more important. Improper data management may lead to personal and social security problems. When managing data, it is necessary to clarify the classification and grading of data, on this basis, the data can be managed accurately.

[0003] Currently, algorithms and models can be used to match data, determine the content of the data, and then confirm the classification and grading of the data.

[0004] However, the current solution is unable to efficiently identify and classify complex data, and is therefore inefficient. Summary of the invention

[0005] The present invention provides a data classification and grading method, device, electronic device and readable storage medium to solve the problem of low efficiency of data classification and grading in related technologies.

[0006] In a first aspect, the present invention provides a data classification and grading method, comprising:

[0007] Acquire a file, and determine a target first data type corresponding to the data to be processed in the file;

[0008] Determine a target data identification configuration corresponding to the target first data type according to a mapping relationship between a preset first data type and a data identification configuration; different data identification configurations are used to identify data of different first data types;

[0009] Based on the target data identification configuration, identify a target field carried in the data to be processed, and determine a target second data type corresponding to the data to be processed according to the target field;

[0010] According to the mapping relationship between the preset second data type and the classification and grading information, the classification and grading information corresponding to the target second data type is determined to complete the classification and grading of the data to be processed.

[0011] In a second aspect, the present invention provides a data classification and grading device, comprising:

[0012] A first type module, used to obtain a file and determine a target first data type corresponding to the data to be processed in the file;

[0013] an identification configuration module, used to determine a target data identification configuration corresponding to the target first data type according to a mapping relationship between a preset first data type and a data identification configuration; different data identification configurations are used to identify data of different first data types;

[0014] A second type module is used to identify a target field carried in the data to be processed based on the target data identification configuration, and determine a target second data type corresponding to the data to be processed according to the target field;

[0015] The classification and grading module is used to determine the classification and grading information corresponding to the target second data type according to the mapping relationship between the preset second data type and the classification and grading information, so as to complete the classification and grading of the data to be processed.

[0016] In a third aspect, the present invention provides an electronic device comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the data classification and grading method described in the first aspect is implemented.

[0017] In a fourth aspect, the present invention provides a readable storage medium, which, when instructions in the storage medium are executed by a processor of an electronic device, enables the electronic device to execute the data classification and grading method described in the first aspect.

[0018] In summary, by acquiring a file and determining the target first data type corresponding to the data to be processed in the file, according to the mapping relationship between the preset first data type and the data identification configuration, the target data identification configuration corresponding to the target first data type is determined, based on the target data identification configuration, the target field carried in the data to be processed is identified, and according to the target field, the target second data type corresponding to the data to be processed is determined, and according to the mapping relationship between the preset second data type and the classification and grading information, the classification and grading information corresponding to the target second data type is determined to complete the classification and grading of the data to be processed. It can adapt to different first types of data to be processed, accurately identify the second type corresponding to the data to be processed based on the corresponding data identification configuration, and then determine the classification and grading information of the data to be processed based on the second type, thereby improving the efficiency of data classification and grading. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or related technologies, the following briefly introduces the drawings required for use in the embodiments or related technical descriptions. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1is a flowchart of the steps of a data classification and grading method provided by an embodiment of the present invention;

[0021] Figure 2 It is a schematic diagram of the architecture of file acquisition provided by an embodiment of the present invention;

[0022] Figure 3 is a schematic diagram of a pattern matching machine provided by an embodiment of the present invention;

[0023] Figure 4 is a schematic diagram of a pattern string prefix provided by an embodiment of the present invention;

[0024] Figure 5 is a schematic diagram of a matching jump provided by an embodiment of the present invention;

[0025] Figure 6 is a flowchart of another method for classifying and grading data provided by an embodiment of the present invention;

[0026] Figure 7 This is a complete architecture diagram of data identification and classification and grading provided by an embodiment of the present invention;

[0027] Figure 8 is a structural diagram of a data classification and grading device provided by an embodiment of the present invention;

[0028] Fig. 9 It is a structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0029] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0030] Data often exists in different business systems, and the amount of data is huge. Each business system is distributed in different departments. There is a large amount of sensitive data in the business system. These data are at risk of data leakage in the process of generation, storage, transmission, sharing, and destruction. To protect these sensitive data, it is necessary to identify these data types and levels, that is, to classify and grade the data, so that different protection measures can be used to protect them in a targeted manner.

[0031] The data classification and grading method of the present application is further described below in conjunction with the relevant drawings and embodiments:

[0032] Figure 1 is a flowchart of a data classification and grading method provided by an embodiment of the present invention. Figure 1 , the method may include:

[0033] Step 101: obtain a file and determine a target first data type corresponding to the data to be processed in the file.

[0034] In the disclosed embodiment, a file including data that needs to be classified and graded can be obtained first. A target database can be connected through Java (a computer language) database connection (JDBC, Java Database Connectivity), and database / table and other files in the target database can be scanned. JDBC is an application program interface used in the Java language to regulate how client programs access databases, and provides methods for querying and updating data in databases.

[0035] In addition, more data sources can be discovered proactively based on the Network Mapper (Nmap) technology. Nmap is a technical framework for network scanning and sniffing toolkits under Linux (an operating system), which implements the Internet Control Message Protocol (ICMP) and the Transmission Control Protocol (TCP). Among them, the ICMP protocol is connectionless and is mainly used for network detection; the TCP protocol is connected and is used for application service detection. The automatic discovery capability consists of three major functions: host discovery, port scanning, and version detection. You can send a detection packet to the target host and determine whether the target host is turned on by the reply. It supports multiple host detection methods, such as ICMP's ECHO / TIMESTAMP / NETMASK packets, TCP's SYN / ACK packets, and SCTPINIT / COOKIE-ECHO packets. The characteristic information of various databases can be parsed and matched from the return packet of the target host to confirm the data source type and version information.

[0036] Based on Nmap active data source detection technology, it can scan data assets and port information, and can also identify data asset types and versions. It can scan and identify structured data, such as relational databases and structured files, and supports scanning of unstructured data, completing scanned data assets, and maximizing the improvement of asset ledgers.

[0037] The data in the file is the data to be processed that needs to be classified and graded, and the first data type corresponding to the data to be processed can include first data types such as Chinese, English, and numbers. The target first data type can be determined by regular expressions, character encoding, or machine learning models.

[0038] Figure 2 is a schematic diagram of the architecture of file acquisition provided by an embodiment of the present disclosure; Figure 2 The switch 201 can transmit data of at least one database 203 to the terminal 202 , and the terminal or server 204 for data classification and grading can also obtain data of at least one database 203 through the switch 201 .

[0039] Step 102, determining a target data identification configuration corresponding to the target first data type according to a preset mapping relationship between the first data type and the data identification configuration; different data identification configurations are used to identify data of different first data types;

[0040] In the disclosed embodiment, different data recognition configurations can distinguish and recognize data of different first data types. For example, when the target first data type is English characters, a multi-mode dictionary matching algorithm based on AC (Aho-Corasick) automaton can be used. The AC algorithm is used to match substrings in a limited set of "dictionaries" in an input string, which can achieve efficient dictionary matching recognition.

[0041] Among them, multi-pattern matching is to find all possible positions of all these pattern strings in the continuous text T1...n when there are multiple pattern strings P1, P2, P3..., Pm. For example, determine the possible positions of the pattern set (nihao, hao, hs, hsr) in the text "sdmthsgnshelfgnihaofhsmihao".

[0042] The AC algorithm converts character comparison into state transfer through a finite automaton. The time complexity of the AC algorithm is independent of the number of keywords and only related to the length of the text. Its time complexity is O(n), which is better than O(n*m), and the matching efficiency is improved by m times.

[0043] When implementing the AC algorithm, multiple keywords can be first constructed into a finite state pattern matching machine, and then the text string (data to be processed) is sent as input to the pattern matching machine for matching.

[0044] In the stage of building a pattern matching machine, the AC algorithm needs to establish three core functions, namely the goto function, the failure function, and the output function. The following uses multiple keywords {he, she, his, hers} to introduce the matching machine construction process.

[0045] The transition function represents the transition relationship between states. For example, g(pre, x) = next, which means that the current state is pre, and after inputting a character x, it is converted to the state next. Figure 33 is a schematic diagram of a pattern matching machine provided by an embodiment of the present disclosure; in the figure, there is a state transition of g(1,e)=2, that is, when in "state 1" 301, character e is input, and then it is converted to "state 2" 302.

[0046] It is understandable that the pattern matching machine may not satisfy the transition of a specific state, for example, g(5, r), when in state 5, the input character r cannot determine the corresponding state. In this case, a failure function can be constructed to determine the transition relationship between states in the event of a failure, that is, when a failure occurs, the pattern automatically switches to a certain state according to whether the pattern contains a prefix of another pattern.

[0047] Figure 4 It is a schematic diagram of the pattern string prefix provided in the embodiment of the present disclosure; "Pattern string 1" 401 contains the prefix of "Pattern string 2" 402. When matching to position a, the match of pattern string 1 fails, and then jumps to pattern string 2 for matching, without returning to the initial state (state 0) to restart matching.

[0048] Figure 5 It is a schematic diagram of the matching jump provided by the embodiment of the present disclosure; the she pattern string contains the prefix he of the hers pattern string. When the matching fails in state 5, that is, the area of ​​box 501, it can jump to state 2 to continue matching, that is, the area of ​​box 502.

[0049] The output function represents a relationship between the state and the pattern string, output(i) = {P}, which means that when the state machine reaches state i, all pattern strings in the pattern string P have been matched. For example, when it reaches state 5, the pattern strings she and he are matched successfully. As shown in Table 1 below:

[0050] Output function table

[0051] i output(i) 2 {he} 5 {she, he} 7 {his} 9 {hers}

[0052] For the first type of data such as telephone numbers and email addresses, regular expressions (RE) can also be used for identification. Regular expressions use a single string to describe and match a series of strings that conform to a certain syntactic rule. Regular expressions include common characters (for example, letters from a to z) and special characters (called "metacharacters"), which can identify texts that conform to a certain pattern (rule). For named entities such as names of people and places, the Viterbi algorithm based on natural language processing (NLP) can be used for identification, which can accurately identify the names of people and places in the data to be processed.

[0053] In addition, a word segmentation + cosine value similarity algorithm based on NLP can be used to achieve data similarity matching and solve data identification without specific rules. The number and content of the first data type and the corresponding data identification configuration are not specifically limited here.

[0054] The data recognition configuration built based on the above algorithms can be combined with regular expressions, inclusion, non-inclusion, simulation matching, suffix matching, prefix matching and other operations to detect sensitive data features, thereby forming recognition feature rules. Recognition features support the association of multiple rules through "and" and "or" logical operators to form complex recognition rules, thereby performing data feature detection more flexibly.

[0055] Step 103: Based on the target data identification configuration, identify the target field carried in the data to be processed, and determine the target second data type corresponding to the data to be processed according to the target field.

[0056] In the embodiments of the present disclosure, when performing specific identification, different target fields can be obtained according to different data identification configurations. For example, the AC algorithm data identification configuration constructed based on the telephone number rule can identify the target field of "13367778999" when the data to be processed is "ABC13367778999", and then the field can be determined as the second data type of telephone number. The Viterbi algorithm data identification configuration constructed based on the name rule can identify the target field of "Zhang San" when the data to be processed is "ABC Zhang San", and then the field can be determined as the second data type of name.

[0057] Step 104, according to the mapping relationship between the preset second data type and the classification and grading information, determine the classification and grading information corresponding to the target second data type to complete the classification and grading of the data to be processed.

[0058] In the embodiment of the present disclosure, the mapping relationship between the preset second data type and the classification and grading information includes different second data types and their corresponding classification and grading information. It is understandable that the specific content of the mapping relationship under different needs may be different. For example, the specific content of the mapping relationship used for enterprise management and the specific content of the mapping relationship used for school management are at least partially different. It is also possible to customize the classification and grading policy template (mapping relationship 0) for the enterprise according to the business characteristics of different industries.

[0059] The classification and grading information corresponding to the target second data type is determined, that is, the classification and grading information of the data to be processed is determined, thereby completing the classification and grading of the data to be processed.

[0060] In summary, by acquiring a file and determining the target first data type corresponding to the data to be processed in the file, according to the mapping relationship between the preset first data type and the data identification configuration, the target data identification configuration corresponding to the target first data type is determined, based on the target data identification configuration, the target field carried in the data to be processed is identified, and according to the target field, the target second data type corresponding to the data to be processed is determined, and according to the mapping relationship between the preset second data type and the classification and grading information, the classification and grading information corresponding to the target second data type is determined to complete the classification and grading of the data to be processed. It can adapt to different first types of data to be processed, accurately identify the second type corresponding to the data to be processed based on the corresponding data identification configuration, and then determine the classification and grading information of the data to be processed based on the second type, thereby improving the efficiency of data classification and grading.

[0061] Figure 6 Another data classification and grading method provided in the embodiment of the present application is referred to Figure 6 , methods may include:

[0062] Step 601, obtaining a file, and determining a target first data type corresponding to the data to be processed in the file;

[0063] Step 602, determining a target data identification configuration corresponding to the target first data type according to a preset mapping relationship between the first data type and the data identification configuration; different data identification configurations are used to identify data of different first data types;

[0064] Step 603, based on the target data identification configuration, identifying a target field carried in the data to be processed, and determining a target second data type corresponding to the data to be processed according to the target field;

[0065] Step 604: Determine the classification and grading information corresponding to the target second data type according to the preset mapping relationship between the second data type and the classification and grading information, so as to complete the classification and grading of the data to be processed.

[0066] For details of the above steps 601-604, please refer to Figure 1 The embodiments are not described in detail here.

[0067] In one embodiment, the step 601 of acquiring a file and determining a target first data type corresponding to the data to be processed in the file includes:

[0068] Sub-step 6011, according to the file permission configuration, obtaining at least one file corresponding to the file permission configuration;

[0069] Sub-step 6014, based on a preset sampling algorithm, obtaining data to be processed in each file; the data to be processed is part of the data in the file;

[0070] Sub-step 6015, determining the corresponding target first data type for the data to be processed in each file.

[0071] In the disclosed embodiment, when acquiring data from a target database, the corresponding database / table, i.e., at least one file, can be acquired from the target database according to the corresponding file permission configuration. The target database can be a relational database that uses a relational model to organize data.

[0072] Since the amount of data included in each file may be large, part of the data in each file may be obtained as the data to be processed based on a preset sampling algorithm. A random sampling algorithm, a leaky bucket sampling algorithm, etc. may be used, which are not limited here. For the data to be processed sampled in each file, the corresponding target first data type is determined respectively.

[0073] By implementing the embodiments of the present disclosure, at least one file corresponding to the file permission configuration is obtained according to the file permission configuration, so that the file security can be managed to avoid data leakage problems. In addition, based on the preset sampling algorithm, the data to be processed is obtained in each file, and the corresponding target first data type is determined for the data to be processed in each file, which can reduce the amount of data to be processed, reduce the pressure of data processing, and improve the efficiency of data classification and grading.

[0074] In one embodiment, before the step 6014 of obtaining the data to be processed in each file based on the preset sampling algorithm, the method further includes:

[0075] Sub-step 6012, reading a delimiter in the file, and dividing the data in the file based on the delimiter to obtain a plurality of data segments;

[0076] Sub-step 6013, when the lengths of the multiple data segments are consistent and the first data type corresponding to each data segment is the same, determining that the file is a structured file.

[0077] In the disclosed embodiment, before sampling the data, the delimiter in the file can be read to determine whether the file is a structured file. In this case, the files in the specified directory can be traversed, and the file encoding can be automatically identified by reading the file header information, and only the first N lines of data are read, and the delimiter is identified for each line of data, and the number of delimiters identified in each line of data is counted. The delimiter can separate multiple lines of data to obtain multiple data segments.

[0078] The length of each data segment and the first data type corresponding to the data segment can be determined. When the lengths of multiple data segments are consistent and the first data types corresponding to each data segment are the same, the file is determined to be a structured file. For example, if the file is a table, each row in the table is the same data, and the data length is also consistent, then the table is a structured file.

[0079] When the file is a structured file, it means that the data inside the file has a large similarity. Then, a subsequent sampling algorithm can be used to obtain part of the data as the data to be processed. Then, the classification and grading information determined based on the data to be processed is representative, and it is not necessary to identify all the data in the file, which can improve the efficiency of data classification and grading. It is understandable that after determining the classification and grading information, if the classification and grading information indicates that the corresponding data is sensitive data, the sensitive data location and sensitive data label information can be recorded. In addition, for unstructured data, the data in the file can be fully identified, and the sensitive data location and sensitive data label information can be recorded.

[0080] In one embodiment, the step of acquiring a file and determining a target first data type corresponding to the data to be processed in the file includes:

[0081] Acquire a file, and determine the data to be processed in the file; the data to be processed includes at least one sub-data;

[0082] For each sub-data, the corresponding target first data type is determined respectively.

[0083] In the disclosed embodiment, since the amount of data in the file is large, there are multiple numbers and types of data to be processed in the file, that is, the data to be processed as a whole of the file includes at least one sub-data. For example, the data to be processed in the file includes sub-data such as names of people, places, email addresses, and telephone numbers. The target first data types corresponding to these sub-data are different and need to be processed separately.

[0084] In one embodiment, the method further comprises:

[0085] Determine the field ratio of the target field in the data to be processed;

[0086] When the field proportion is less than a preset proportion threshold, the classification and grading information corresponding to the data to be processed is deleted.

[0087] In the disclosed embodiment, the target field in the data to be processed is identified based on the data identification configuration. Since the target field may be sensitive information, the field ratio of the target field in the data to be processed can be determined. The field ratio can indicate the sensitivity of the current data to be processed. When the field ratio is less than the preset ratio threshold, it indicates that the sensitivity of the current data to be processed is low, and classification and grading may not be performed, so the corresponding classification and grading information of the data to be processed can be deleted.

[0088] By implementing the embodiments of the present disclosure, the field ratio of the target field in the data to be processed is determined. When the field ratio is less than a preset ratio threshold, the corresponding classification and grading information of the data to be processed is deleted. This can reduce the data volume of the data classification and grading information and improve the conciseness of the classification and grading information.

[0089] In one embodiment, there are multiple target second data types;

[0090] The step of determining the classification and grading information corresponding to the target second data type according to the preset mapping relationship between the second data type and the classification and grading information to complete the classification and grading of the data to be processed includes:

[0091] According to the mapping relationship between the preset second data type and the classification and grading information, a set of classification and grading information corresponding to the plurality of target second data types is determined; different classification and grading information corresponds to different priorities;

[0092] According to the classification and grading information corresponding to each target second data type and its corresponding priority, determine the target classification and grading information that meets the preset priority condition in the classification and grading information set;

[0093] The target classification and grading information is used as the classification and grading information of the data to be processed to complete the classification and grading of the data to be processed.

[0094] In the embodiment of the present disclosure, there may be multiple target second data types, which may be due to different target fields being identified in the data to be processed, and different target fields corresponding to different target second data types. Based on the multiple target second data types, different classification and grading information are determined respectively, and then a classification and grading information set constructed by the multiple classification and grading information is obtained.

[0095] It is understandable that different classifications and levels can correspond to different priorities. For example, mailboxes can be classified as communication information, and ID numbers can be classified as identity information. The priority of identity information can be higher than that of communication information. In addition, for a single classification, the priority of a phone number in communication information can be higher than that of a mailbox. The priority of specific classification and level information is not specifically shown here.

[0096] The preset priority condition may be a classification and grading information with the highest priority, or may be more than one classification and grading information with the highest priority. The target classification and grading information that meets the preset priority condition may be directly used as the classification and grading information of the data to be processed.

[0097] In one embodiment, the method further comprises:

[0098] Classifying the classified and graded information in the classified and graded information set to obtain at least one information type; each information type includes at least one classified and graded information;

[0099] Determine the target information type according to the amount of classified and graded information in each information type;

[0100] The classification and grading information in the target information type is used as the classification and grading information of the file.

[0101] In the embodiment of the present disclosure, when there are multiple target second data types, some of the target second data types may be the same second data type. That is, if there are multiple target fields and some of the target fields belong to the same second data type, then when determining the second data types of the multiple target fields, it will result in multiple numbers of some second data types. Then the classification and grading information corresponding to these same second data types is also the same.

[0102] Therefore, the classified and graded information in the classified and graded information set can be classified to obtain at least one information type, each information type includes at least one classified and graded information, and at least one classified and graded information in a single information type is the same.

[0103] The target information type can be determined according to the amount of classification and grading information in each information type. For example, the information type containing the largest amount of classification and grading information can be used as the target information type. The classification and grading information in the target information type is then used as the classification and grading information of the file. It can be understood that since there are multiple and identical classification and grading information in the target information type, any classification and grading information in the target information type can be used as the classification and grading information of the file.

[0104] In one embodiment, the method further comprises:

[0105] Acquire the execution cycle and file list configuration of data classification and grading; the execution cycle indicates the frequency of data classification and grading; the file list configuration is used to indicate the files that need to be classified and graded;

[0106] The step of acquiring a file and determining a target first data type corresponding to the data to be processed in the file includes:

[0107] Based on the execution cycle, obtaining a target file indicated by the file list configuration;

[0108] Determine a target first data type corresponding to the to-be-processed data in the target file.

[0109] In the disclosed embodiment, the execution cycle of data classification and grading and the file list configuration may also be obtained. The execution cycle indicates the frequency of data classification and grading, that is, how often the data classification and grading operation is performed. The file list configuration is used to indicate the files that need to be classified and graded. It is understandable that the file list configuration may be constructed based on a whitelist or a blacklist. The files indicated by the whitelist may not be scanned and acquired, and the files indicated by the blacklist may need to be scanned and acquired every time the data classification and grading is performed.

[0110] Furthermore, when acquiring files, based on the execution cycle, the target files indicated by the file list configuration are periodically acquired, and then the target first data type corresponding to the to-be-processed data in the target file is determined.

[0111] The embodiments of the present disclosure are implemented by obtaining the execution cycle and file list configuration of data classification and grading, obtaining the target file indicated by the file list configuration based on the execution cycle, and determining the target first data type corresponding to the to-be-processed data in the target file. The execution cycle and execution range of data classification and grading can be controlled, thereby improving the flexibility and accuracy of data classification and grading.

[0112] Figure 7 It is a complete architecture diagram of data identification and classification and grading provided by the embodiments of the present disclosure; Figure 7 The first step is to obtain sample data, including XDR call records, Internet logs, call details, location information, etc. Among them, XDR call records are based on the processing of the entire Internet data, and the generated session-level detailed records of the signaling process and service transmission process include all the user's Internet information. Sample data is used for model training, and part-of-speech tagging and classification verification are performed through analysis engines based on various recognition algorithms, and then the sample file library is updated, and then machine learning including clustering / classification and feature extraction is performed, and then enters the analysis engine for a cycle. Finally, a clustered data classification and grading rule library is formed, which includes keywords / dictionaries / file fingerprints / classifiers.

[0113] It is understandable that after a large amount of data is classified and graded, a recognition result list can be formed for multiple files, and the recognition result list can include the classification and grade of each file, the classification and grade of each data in the file, etc. The user can audit and adjust the recognition results based on the recognition result list to form a final list.

[0114] The steps of implementing the above method embodiment can solve the problem of difficulty in sorting out data assets. When sorting out enterprise data assets, data classification and grading can solve the problems of incomplete digital asset registration, insufficient data asset registration, and difficulty in manual statistics, so as to better activate massive data. And solve the problem of difficulty in discovering dynamic assets. In the whole life cycle of data, there are unknown assets in dynamic data and assets that are not filed that are difficult to discover. Data classification and grading can actively scan the dynamic data in the traffic to discover unknown assets, and solve the problem of asset discovery in dynamic data. It can also solve the problem of inconsistent data standards and difficult governance. It can unify data classification and grading standards and sensitive data dashboards, and share them with other data security platforms to solve the problem of inconsistent data standards and difficult data governance.

[0115] By implementing the steps of the above method embodiment, data assets can also be audited. After the data audit is completed, all data asset data, including sensitive data information, are presented in the data asset list in a unified manner with table dimensions and field dimensions in combination with the user's departmental authority. Users can intuitively view the current distribution of sensitive data information, and support re-auditing data in the list. After classifying and grading data assets, information such as data source access and sensitive data can be comprehensively displayed, and heat maps of data source sensitivity labels, sensitive label rankings, and classification and grading can be intuitively displayed.

[0116] Figure 8 80 is a structural diagram of a data classification and grading device provided in an embodiment of the present invention. The data classification and grading device 80 may include:

[0117] The first type module 801 is used to obtain a file and determine a target first data type corresponding to the data to be processed in the file;

[0118] The identification configuration module 802 is used to determine the target data identification configuration corresponding to the target first data type according to the mapping relationship between the preset first data type and the data identification configuration; different data identification configurations are used to identify data of different first data types;

[0119] The second type module 803 is used to identify the target field carried in the data to be processed based on the target data identification configuration, and determine the target second data type corresponding to the data to be processed according to the target field;

[0120] The classification and grading module 804 is used to determine the classification and grading information corresponding to the target second data type according to the mapping relationship between the preset second data type and the classification and grading information, so as to complete the classification and grading of the data to be processed.

[0121] Optional, first type modules include:

[0122] A file permission submodule, configured to obtain, according to the file permission configuration, at least one file corresponding to the file permission configuration;

[0123] A data sampling submodule, used for obtaining the data to be processed in each file based on a preset sampling algorithm; the data to be processed is part of the data of the file;

[0124] The submodules are respectively determined to determine the corresponding target first data type for the data to be processed in each file.

[0125] Optionally, the device further comprises:

[0126] A data separation module, used for reading the separator in the file and dividing the data in the file based on the separator to obtain a plurality of data segments;

[0127] The structure determination module is used to determine that the file is a structured file when the lengths of the multiple data segments are consistent and the first data type corresponding to each data segment is the same.

[0128] Optional, first type modules include:

[0129] The sub-data sub-module is used to obtain a file and determine the data to be processed in the file; the data to be processed includes at least one sub-data;

[0130] The sub-determination sub-module is used to determine the corresponding target first data type for each sub-data.

[0131] Optionally, the device further comprises:

[0132] A field proportion module, used to determine the field proportion of the target field in the data to be processed;

[0133] The information filtering module is used to delete the classification and grading information corresponding to the data to be processed when the field proportion is less than a preset proportion threshold.

[0134] Optionally, there are multiple target second data types;

[0135] Classification and grading modules, including:

[0136] An information collection submodule, used to determine, according to a preset mapping relationship between the second data type and the classification and grading information, a set of classification and grading information corresponding to the plurality of target second data types; different classification and grading information corresponds to different priorities;

[0137] A priority information submodule, for determining, in the classification and grading information set, target classification and grading information that meets a preset priority condition according to the classification and grading information corresponding to each target second data type and its corresponding priority;

[0138] The target information submodule is used to use the target classification and grading information as the classification and grading information of the data to be processed to complete the classification and grading of the data to be processed.

[0139] Optionally, the device further comprises:

[0140] An information classification module, used for classifying the classified and graded information in the classified and graded information set to obtain at least one information type; each information type includes at least one classified and graded information;

[0141] An information quantity module is used to determine the target information type according to the quantity of classified and graded information in each information type;

[0142] The target quantity module is used to use the classification and grading information in the target information type as the classification and grading information of the file.

[0143] Optionally, the device further comprises:

[0144] The cycle list module is used to obtain the execution cycle of data classification and grading and the file list configuration; the execution cycle indicates the frequency of data classification and grading; the file list configuration is used to indicate the files that need to be classified and graded;

[0145] The first type of modules include:

[0146] A period list acquisition submodule, used for acquiring the target file indicated by the file list configuration based on the execution period;

[0147] The type identification submodule is used to determine the target first data type corresponding to the to-be-processed data in the target file.

[0148] In summary, by acquiring a file and determining the target first data type corresponding to the data to be processed in the file, according to the mapping relationship between the preset first data type and the data identification configuration, the target data identification configuration corresponding to the target first data type is determined, based on the target data identification configuration, the target field carried in the data to be processed is identified, and according to the target field, the target second data type corresponding to the data to be processed is determined, and according to the mapping relationship between the preset second data type and the classification and grading information, the classification and grading information corresponding to the target second data type is determined to complete the classification and grading of the data to be processed. It can adapt to different first types of data to be processed, accurately identify the second type corresponding to the data to be processed based on the corresponding data identification configuration, and then determine the classification and grading information of the data to be processed based on the second type, thereby improving the efficiency of data classification and grading.

[0149] The present invention also provides an electronic device, see Fig. 9 , including: a processor 1401, a memory 1402, and a computer program 14021 stored in the memory and executable on the processor, and when the processor executes the program, the data classification and grading method of the aforementioned embodiment is implemented.

[0150] The present invention also provides a readable storage medium, when the instructions in the storage medium are executed by the processor of the electronic device, the electronic device can execute the data classification and grading method of the aforementioned embodiment.

[0151] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0152] It should be noted that the various information and data obtained in the embodiments of the present invention are all obtained with the authorization of the information / data holder.

[0153] The algorithm and display provided herein are not inherently related to any particular computer, virtual system or other device. Various general purpose systems can also be used together with the teachings based on this. According to the above description, it is obvious that the structure required for constructing such systems. In addition, the present invention is not directed to any specific programming language either. It should be understood that various programming languages ​​can be utilized to realize the content of the present invention described herein, and the description of the above specific languages ​​is for disclosing the best mode of the present invention.

[0154] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0155] Similarly, it should be understood that in order to streamline the present invention and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, the various features of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting the following intention: that the claimed invention requires more features than the features explicitly recited in each claim. More specifically, as reflected in the claims below, inventive aspects lie in less than all the features of the individual embodiments disclosed above. Therefore, the claims that follow the specific embodiment are hereby expressly incorporated into the specific embodiment, with each claim itself serving as a separate embodiment of the present invention.

[0156] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition they may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed in this manner may be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0157] The various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that a microprocessor or digital signal processor (DSP) may be used in practice to implement some or all of the functions of some or all of the components in the sorting device according to the present invention. The present invention may also be implemented as a device or apparatus program for executing part or all of the methods described herein. Such a program for implementing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such a signal may be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0158] It should be noted that the above embodiments illustrate the present invention rather than limit it, and that those skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbol between brackets shall not be construed as a limitation on the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "one" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising a number of different elements and by means of a suitably programmed computer. In a unit claim enumerating a number of devices, several of these devices may be embodied by the same hardware item. The use of the words first, second, and third, etc., does not indicate any order. These words may be interpreted as names.

[0159] The user information (including but not limited to the user's device information, user personal information, etc.) and related data involved in the present invention are all information authorized by the user or by all parties.

[0160] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0161] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

[0162] The above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A data classification and grading method, characterized in that: include: Acquire a file, and determine a target first data type corresponding to the data to be processed in the file; Determine a target data identification configuration corresponding to the target first data type according to a preset mapping relationship between the first data type and the data identification configuration; Different data identification configurations are used to identify data of different first data types; Based on the target data identification configuration, identify a target field carried in the data to be processed, and determine a target second data type corresponding to the data to be processed according to the target field; According to the mapping relationship between the preset second data type and the classification and grading information, the classification and grading information corresponding to the target second data type is determined to complete the classification and grading of the data to be processed.

2. The method according to claim 1, characterized in that The step of acquiring a file and determining a target first data type corresponding to the data to be processed in the file includes: According to the file permission configuration, obtaining at least one file corresponding to the file permission configuration; Based on a preset sampling algorithm, obtaining data to be processed in each file; the data to be processed is part of the data in the file; For the data to be processed in each file, the corresponding target first data type is determined respectively.

3. The method according to claim 2, characterized in that Before the step of obtaining the data to be processed in each file based on the preset sampling algorithm, the method further includes: Reading a delimiter in the file, and dividing the data in the file based on the delimiter to obtain a plurality of data segments; When the lengths of the multiple data segments are consistent and the first data type corresponding to each data segment is the same, it is determined that the file is a structured file.

4. The method according to claim 1, characterized in that: The step of acquiring a file and determining a target first data type corresponding to the data to be processed in the file includes: Acquire a file, and determine the data to be processed in the file; the data to be processed includes at least one sub-data; For each sub-data, the corresponding target first data type is determined respectively.

5. The method according to claim 1, characterized in that The method further comprises: Determine the field ratio of the target field in the data to be processed; When the field proportion is less than a preset proportion threshold, the classification and grading information corresponding to the data to be processed is deleted.

6. The method according to claim 1, characterized in that There are multiple target second data types; The step of determining the classification and grading information corresponding to the target second data type according to the preset mapping relationship between the second data type and the classification and grading information to complete the classification and grading of the data to be processed includes: According to the mapping relationship between the preset second data type and the classification and grading information, a set of classification and grading information corresponding to the plurality of target second data types is determined; different classification and grading information corresponds to different priorities; According to the classification and grading information corresponding to each target second data type and its corresponding priority, determine the target classification and grading information that meets the preset priority condition in the classification and grading information set; The target classification and grading information is used as the classification and grading information of the data to be processed to complete the classification and grading of the data to be processed.

7. The method according to claim 6, characterized in that The method further comprises: Classifying the classified and graded information in the classified and graded information set to obtain at least one information type; each information type includes at least one classified and graded information; Determine the target information type according to the amount of classified and graded information in each information type; The classification and grading information in the target information type is used as the classification and grading information of the file.

8. The method according to claim 1, characterized in that The method further comprises: Acquire the execution cycle and file list configuration of data classification and grading; the execution cycle indicates the frequency of data classification and grading; the file list configuration is used to indicate the files that need to be classified and graded; The step of acquiring a file and determining a target first data type corresponding to the data to be processed in the file includes: Based on the execution cycle, obtaining a target file indicated by the file list configuration; Determine a target first data type corresponding to the to-be-processed data in the target file.

9. A data classification and grading device, characterized in that: include: A first type module, used to obtain a file and determine a target first data type corresponding to the data to be processed in the file; an identification configuration module, configured to determine a target data identification configuration corresponding to the target first data type according to a preset mapping relationship between the first data type and the data identification configuration; Different data identification configurations are used to identify data of different first data types; A second type module is used to identify a target field carried in the data to be processed based on the target data identification configuration, and determine a target second data type corresponding to the data to be processed according to the target field; The classification and grading module is used to determine the classification and grading information corresponding to the target second data type according to the mapping relationship between the preset second data type and the classification and grading information, so as to complete the classification and grading of the data to be processed.

10. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method according to any one of claims 1 to 8 when executing the program.

11. A readable storage medium, characterized in that: When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute any one of the methods described in claims 1-8.

Images