Data risk intelligent identification method and system based on collaborative analysis

Abstract

The invention discloses a collaborative analysis-based data risk intelligent identification method and system, and relates to the technical field of data risk identification, and the method comprises the steps: collecting to-be-identified data, carrying out the four classification according to the data type, collection mode, application field and spatial dimension information, sequentially obtaining a corresponding data risk feature matrix and an influence coefficient at each stage, and obtaining a data risk feature matrix; a data risk index is obtained through normalization processing and weight calculation, then early warning information is set for data nodes, all modules of the system work cooperatively, and the whole process from data collection to risk early warning is completely covered. The method has the advantages that the shackle of traditional single-dimensional assessment is broken, multi-dimensional information is integrated, complex association among dimensions is comprehensively considered, potential data risks are deeply mined by means of progressive coefficient actuarial calculation and matrix fine processing, the resolution and precision of risk assessment are greatly improved, and the risk assessment efficiency is improved. A highly accurate, dynamic, flexible, practical and effective risk early warning effect is achieved.

Description

Technical Field

[0001] The present invention relates to the technical field of data risk identification, and in particular to a method and system for intelligently identifying data risks based on collaborative analysis. Background Art

[0002] In today's digital age, data is growing explosively and is widely distributed in various complex systems, and data security faces severe challenges. Traditional data risk identification methods are often single and isolated, and it is difficult to cope with complex and changing risk situations. Data risk intelligent identification methods and systems based on collaborative analysis have emerged. They integrate multiple data features and analysis dimensions to achieve comprehensive and accurate risk assessment, which helps to timely discover and prevent data risks, ensure the security of data assets, and maintain personal privacy, corporate interests and national security. It has great practical significance.

[0003] Existing data risk intelligent identification methods and systems based on collaborative analysis, when conducting collaborative analysis on the same data node, only evaluate data risks from a single dimension in the face of different data sources, often ignoring the interrelationships and collaborations between dimensions, resulting in low resolution and accuracy of risk assessment. Therefore, it is necessary to provide a data risk intelligent identification method and system based on collaborative analysis to solve the above-mentioned problems. Summary of the invention

[0004] In order to solve the above technical problems, a data risk intelligent identification method and system based on collaborative analysis are provided. This technical solution solves the existing data risk intelligent identification method and system based on collaborative analysis proposed in the above background technology. When performing collaborative analysis on the same data node, data risks are only evaluated from a single dimension when facing different data sources, and the interrelationships and collaborations between the dimensions are often ignored, resulting in low resolution and accuracy of risk assessment.

[0005] In order to achieve the above purpose, the technical solution adopted by the present invention is: A data risk intelligent identification method based on collaborative analysis, comprising: S100, collecting data to be identified, and determining information about the type of data to be identified, and determining a recognition mode, performing a primary classification on the data to be identified based on the information about the type of data to be identified, obtaining primary classification sub-data, and analyzing the primary classification sub-data based on the recognition mode to obtain a first data risk feature matrix, and obtaining a first data risk identification influence coefficient corresponding to the primary classification sub-data based on the first data risk feature matrix; S200, obtaining collection method information of the primary classification sub-data, and performing secondary classification on the primary classification sub-data based on the collection method information to obtain secondary classification sub-data, sorting the secondary classification sub-data according to the first data risk identification influence coefficient, and then obtaining a second data risk feature matrix and a second data risk identification influence coefficient corresponding to the sorted secondary classification sub-data based on the collection method information; S300, obtaining application field information of the secondary classification sub-data, and performing tertiary classification on the secondary classification sub-data based on the application field information to obtain tertiary classification sub-data, sorting the tertiary classification sub-data according to the second data risk identification influence coefficient, and then obtaining a third data risk feature matrix and a third risk identification influence coefficient corresponding to the sorted tertiary classification sub-data based on the application field information; S400, obtaining spatial dimension information of the three-fold classified sub-data, and performing four-fold classification on the three-fold classified sub-data based on the spatial dimension information to obtain four-fold classified sub-data, sorting the four-fold classified sub-data according to the third risk identification influence coefficient, and then obtaining a fourth data risk feature matrix and a fourth risk identification influence coefficient corresponding to the sorted four-fold classified sub-data based on the spatial dimension information; S500. Based on the first to fourth data risk feature matrices and the first to fourth risk identification influence coefficients, the data to be identified is evaluated to obtain a data risk index, and then warning information is set for the data nodes corresponding to the data to be identified based on the data risk index.

[0006] In an optional embodiment, the step of collecting the data to be identified, determining the type of data to be identified, and determining the identification mode, performing a primary classification on the data to be identified based on the type of data to be identified to obtain primary classification sub-data, and analyzing the primary classification sub-data based on the identification mode to obtain a first data risk feature matrix, and obtaining a first data risk identification influence coefficient corresponding to the primary classification sub-data based on the first data risk feature matrix, specifically includes: Obtain the data to be identified based on active collection, passive collection, manual annotation and cloud platform sharing; Determine data format information and text information of the data to be identified, and determine a first data type identification feature based on the data format information; Perform natural language processing on text information to obtain text feature information; Based on the text feature information, construct a word frequency histogram and determine a second data type identification feature; Determine the data type information to be identified according to the first data type identification feature and the second data type identification feature; Determine key identification feature information of the data to be identified based on the type of data to be identified, and determine the identification mode based on the key identification feature information; Based on the information of the data type to be identified, the data to be identified is classified into primary classification sub-data of 1 to i data types, and the primary classification sub-data of the same data type are stored in the same set, and each set contains 0 to j primary classification sub-data; According to the recognition mode, 0 to j initial classification sub-data contained in each set are analyzed in turn to obtain the first data risk feature matrix; Determine the ratio of the total number of initially classified sub-data of the i-th data type to the total number of data to be identified as the first data type influence coefficient of the i-th data type; Determine the product value of the first data risk feature matrix corresponding to the jth initial classification sub-data in the set corresponding to the i-th data type and the first data type influence coefficient of the i-th data type, and obtain the first data risk identification influence coefficient corresponding to the jth initial classification sub-data in the set corresponding to the i-th data type.

[0007] In an optional embodiment, the acquisition of collection method information of the primary classification sub-data, and secondary classification of the primary classification sub-data based on the collection method information to obtain secondary classification sub-data, sorting the secondary classification sub-data according to the first data risk identification influence coefficient, and then acquiring the second data risk feature matrix and the second data risk identification influence coefficient corresponding to the sorted secondary classification sub-data based on the collection method information, specifically includes: Determine the actively collected information, passively collected information, manually labeled information and cloud platform sharing information, and obtain the collection method information of the initial classification sub-data; Based on the information of the collection method, the initially classified sub-data is reclassified to obtain actively collected sub-data, passively collected sub-data, manually annotated sub-data, and cloud platform shared sub-data; Sequentially obtain active collection process information of actively collected sub-data, passive collection process information of passively collected sub-data, labeling process information of manually labeled sub-data, and sharing process information of cloud platform shared sub-data; Perform risk assessment on active collection process information, passive collection process information, labeling process information and shared process information to obtain a first collection risk assessment index; Based on the actively collected sub-data, the passively collected sub-data, the manually annotated sub-data, and the cloud platform shared sub-data, obtaining a second collection risk assessment index corresponding to the actively collected sub-data, the passively collected sub-data, the manually annotated sub-data, and the cloud platform shared sub-data; According to the first collection risk assessment index and the second collection risk assessment index, actively collected sub-data, passively collected sub-data, manually annotated sub-data and cloud platform shared sub-data are further labeled to obtain secondary classification sub-data; Determine the first data risk identification influence coefficient corresponding to the secondary classification sub-data, sort the secondary classification sub-data based on the first data risk identification influence coefficient, and obtain sorting information; Based on the sorting information, setting the first collection mode influence coefficient for the sorted secondary classification sub-data; Obtain a second data risk feature matrix according to the first acquisition risk assessment index and the second acquisition risk assessment index corresponding to the secondary classification sub-data; Determine the product value of the second data risk feature matrix and the first acquisition method influence coefficient to obtain the second data risk identification influence coefficient.

[0008] In an optional embodiment, the application field information of the secondary classification sub-data is obtained, and the secondary classification sub-data is classified three times based on the application field information to obtain the three-classification sub-data, and the three-classification sub-data is sorted according to the second data risk identification influence coefficient, and then based on the application field information, a third data risk feature matrix and a third risk identification influence coefficient corresponding to the sorted three-classification sub-data are obtained, specifically including: Acquire information on the collection method of the secondary classification sub-data, and determine the first application field characteristic information based on the information on the collection method of the secondary classification sub-data; Determine metadata of the secondary classification sub-data, and obtain second application field feature information of the secondary classification sub-data; Determining application field information of the secondary classification sub-data based on the first application field characteristic information and the second application field characteristic information; According to the application field information, the secondary classification sub-data is classified three times to obtain 1 to m application field sets, and each application field set contains 0 to n third-classification sub-data; Based on the second data risk identification impact coefficient, the tertiary classification sub-data in each application field set are sorted in turn; According to the application field information, a first application field sensitivity coefficient is set for the sorted third-classification sub-data; Based on the sensitivity coefficient of the first application field, a third data risk feature identification level is set for the third classification sub-data; Based on the third data risk feature identification level, the risk dimension of the three-classification sub-data is identified to obtain the third data risk feature matrix; The product value of the first application field sensitivity coefficient corresponding to the third classification sub-data and the third data risk characteristic matrix is ​​used as the third risk identification influence coefficient.

[0009] In an optional embodiment, the step of obtaining spatial dimension information of the three-times classified sub-data, and performing four-times classification on the three-times classified sub-data based on the spatial dimension information to obtain four-times classified sub-data, sorting the four-times classified sub-data according to the third risk identification influence coefficient, and then obtaining the fourth data risk feature matrix and the fourth risk identification influence coefficient corresponding to the sorted four-times classified sub-data based on the spatial dimension information, specifically includes: Obtaining physical space dimension information and network space dimension information of the three-dimensional classification sub-data, and determining the space dimension information of the three-dimensional classification sub-data; Based on the spatial dimension information, the three-classification sub-data are classified four times to obtain physical space dimension sub-data and network space dimension sub-data; Determine a first risk identification influence coefficient, a second risk identification influence coefficient, and a third risk identification influence coefficient corresponding to the physical space dimension sub-data, and obtain an average value of the first risk identification influence coefficient, the second risk identification influence coefficient, and the third risk identification influence coefficient; The physical space dimension sub-data with the smallest average value of the first risk identification influence coefficient, the second risk identification influence coefficient and the third risk identification influence coefficient is used as the physical space dimension origin sub-data; Taking the coordinate value of the physical space dimension origin sub-data as the origin, construct the risk assessment space coordinate system, and determine the coordinate values ​​of all the physical space dimension sub-data in the risk assessment space coordinate system; Determine the distance values ​​between all physical space dimension sub-data and the origin, and obtain the safety factor of the first space dimension; Based on the physical space dimension sub-data and the network space dimension sub-data, obtaining the space dimension sub-data correlation index; Conduct risk assessment on the cyberspace dimension sub-data to obtain the safety factor of the second space dimension; According to the safety factor of the first spatial dimension, the safety factor of the second spatial dimension and the spatial dimension sub-data association index, the physical spatial dimension sub-data and the cyber spatial dimension sub-data are marked respectively to obtain the four-fold classification sub-data; Sorting the four-fold classification sub-data according to the third risk identification influence coefficient, and identifying the risk dimension of the sorted four-fold classification sub-data to obtain a fourth data risk feature matrix; Determine the first spatial dimension safety factor or the second spatial dimension safety factor corresponding to the four-fold classification sub-data in sequence; Divide the first spatial dimension safety factor or the second spatial dimension safety factor corresponding to the four-fold classification sub-data by the spatial dimension sub-data association index to obtain the fourth risk feature matrix influence coefficient; The product value of the fourth risk characteristic matrix influence coefficient and the fourth data risk characteristic matrix is ​​obtained to obtain the fourth risk identification influence coefficient.

[0010] In an optional embodiment, the data to be identified is evaluated based on the first to fourth data risk feature matrices and the first to fourth risk identification influence coefficients to obtain a data risk index, and then warning information is set for the data node corresponding to the data to be identified based on the data risk index, specifically including: Normalizing the first data risk feature matrix, the second data risk feature matrix, the third data risk feature matrix, and the fourth data risk feature matrix; Obtain the sum of all elements in the first data risk feature matrix, the second data risk feature matrix, the third data risk feature matrix, and the fourth data risk feature matrix respectively, and record them as the comprehensive weight of the risk feature; The ratios of all elements in the first data risk feature matrix, the second data risk feature matrix, the third data risk feature matrix, and the fourth data risk feature matrix to the comprehensive weights of the risk features are used as the weights of the risk dimensions; Determine the data risk sub-index of the data to be identified; Based on the data risk sub-index of the data to be identified, determine the data risk index corresponding to the data node; Set warning information for data nodes according to the data risk index corresponding to the data nodes; The calculation formula of the data risk index is: ; In the formula, For the The data risk index of each data node, For the The number of risk dimensions of the risk feature matrix of each data, For the The first The weight of each risk dimension, For the The first The normalized eigenvalues ​​of the risk dimensions, For the Risk identification influence coefficient, For the The data nodes correspond to Group the data to be identified, is the total number of groups of data to be identified.

[0011] Furthermore, a data risk intelligent identification system based on collaborative analysis is proposed, which is used to implement any of the above identification methods, including: A data collection and type identification module, which is used to obtain the data to be identified based on active collection, passive collection, manual annotation and cloud platform sharing, determine the data format information and text information of the data to be identified, determine the first data type identification feature based on the data format information, perform natural language processing on the text information, construct a word frequency bar chart to determine the second data type identification feature, and thus determine the data type information to be identified; A collection method analysis module, wherein the collection method analysis module is used to determine active collection information, passive collection information, manual annotation information, and cloud platform sharing method information, perform secondary classification on the primary classification sub-data to obtain active collection sub-data, passive collection sub-data, manual annotation sub-data, and cloud platform sharing sub-data, sort the tertiary classification sub-data in each application field set based on the second data risk identification influence coefficient, set the first application field sensitivity coefficient according to the application field information, set the third data risk feature identification level based on the first application field sensitivity coefficient, perform risk dimension identification to obtain the third data risk feature matrix, and calculate the third risk identification influence coefficient; An application field analysis module, the application field analysis module is used to obtain the collection method information of the secondary classification sub-data to determine the first application field characteristic information, determine the metadata of the secondary classification sub-data to obtain the second application field characteristic information, determine the application field information based on the two, classify the secondary classification sub-data three times to obtain different application field sets, sort the three-classification sub-data in each application field set based on the second data risk identification influence coefficient, set the first application field sensitivity coefficient according to the application field information, set the third data risk characteristic identification level based on this, perform risk dimension identification to obtain the third data risk characteristic matrix, and calculate the third risk identification influence coefficient; A space dimension analysis module, the space dimension analysis module is used to obtain physical space dimension information and network space dimension information of the three-classification sub-data, classify the three-classification sub-data four times, obtain physical space dimension sub-data and network space dimension sub-data, determine the average value of the relevant risk identification influence coefficient of the physical space dimension sub-data, determine the physical space dimension origin sub-data, construct a risk assessment space coordinate system, calculate the first space dimension safety factor, obtain the space dimension sub-data association index, evaluate the network space dimension sub-data to obtain the second space dimension safety factor, mark the four-classification sub-data accordingly, and calculate the fourth data risk feature matrix and the fourth risk identification influence coefficient; The risk assessment and early warning module is used to normalize the first to fourth data risk feature matrices, calculate the elements and values ​​of each matrix as the comprehensive weight of the risk feature, and then determine the weight of each risk dimension, combine the risk identification influence coefficient, and calculate the data risk sub-index of the data to be identified according to the formula, and finally determine the data risk index corresponding to the data node. According to the data risk index corresponding to the data node, it is compared with the preset threshold, and different levels of early warning information are set for the data node. A dynamic update mechanism for early warning information is established to adjust the early warning level and response measures in time as the data risk situation changes.

[0012] In an optional embodiment, the acquisition mode analysis module includes: A collection method classification unit, the collection method classification unit is used to determine active collection information, passive collection information, manual annotation information and cloud platform sharing method information, and perform secondary classification on the primary classification sub-data to obtain active collection sub-data, passive collection sub-data, manual annotation sub-data and cloud platform sharing sub-data; A risk assessment and coefficient calculation unit is used to sequentially obtain process information of various types of collected sub-data for risk assessment, obtain a first collection risk assessment index, obtain a second collection risk assessment index based on various types of collected sub-data, mark the collected sub-data according to these two indexes to obtain secondary classified sub-data, determine the corresponding first data risk identification influence coefficient, and then calculate the second data risk feature matrix and the second data risk identification influence coefficient.

[0013] In an optional embodiment, the application field analysis module includes: An application field determination unit, the application field determination unit is used to obtain the collection method information of the secondary classification sub-data to determine the first application field characteristic information, determine the metadata of the secondary classification sub-data to obtain the second application field characteristic information, determine the application field information based on the two, and classify the secondary classification sub-data three times to obtain different application field sets; The risk characteristic and coefficient calculation unit is used to sort the third classification sub-data in each application field set based on the second data risk identification influence coefficient, set the first application field sensitivity coefficient according to the application field information, set the third data risk characteristic identification level based on this, perform risk dimension identification to obtain the third data risk characteristic matrix, and calculate the third risk identification influence coefficient.

[0014] In an optional embodiment, the risk assessment and early warning module includes: A data risk index calculation unit, which is used to normalize the first to fourth data risk feature matrices, calculate the sum of the matrix elements as the comprehensive weight of the risk feature, and then determine the weight of each risk dimension, and calculate the data risk sub-index of the data to be identified according to the formula in combination with the risk identification influence coefficient, and finally determine the data risk index corresponding to the data node; The warning information setting unit is used to compare the data risk index corresponding to the data node with the preset threshold, set different levels of warning information for the data node, and establish a dynamic update mechanism for the warning information to timely adjust the warning level and response measures as the data risk status changes.

[0015] Compared with the prior art, the present invention has the following beneficial effects: This scheme proposes a data risk intelligent identification method and system based on collaborative analysis. It classifies the identified data four times from the data type information, collection method information, application field information, and spatial dimension information in sequence. That is, the data type is first classified according to the data format, text features, etc., and then the collection method is classified twice, and then the application field is combined for three times. Finally, the spatial dimension is used for four times classification. The corresponding system also has a data collection and type identification module, a collection method analysis module, an application field analysis module, and a spatial dimension analysis module to execute these classification processes, so as to realize a comprehensive and multi-level analysis of the identified data. The classification of different dimensions allows the data to be disassembled and refined, and the risk characteristics hidden under different characteristics are excavated. The correlation and coordination between the dimensions are fully considered, and more subtle risk differences can be captured, which significantly improves the resolution of risk assessment and accurately locates risk points. This solution proposes a data risk intelligent identification method and system based on collaborative analysis. After each round of classification, the data risk identification impact coefficient will be calculated accordingly, from the first data risk identification impact coefficient after the initial classification, to the second data risk identification impact coefficient after the secondary classification, and finally to the fourth risk identification impact coefficient after the fourth classification. The coefficient calculation units in various modules of the system, such as the collection method analysis module and the application field analysis module, also participate in these complex calculations. With the help of various parameters under different classification dimensions, the degree of influence of each link on the data risk is comprehensively considered, and the risk impact is accurately quantified. Through multiple rounds of coefficient calculation, rich dimensional information is integrated to calibrate the evaluation results, which greatly improves the accuracy of risk assessment. This scheme proposes a data risk intelligent identification method and system based on collaborative analysis. Based on the first to fourth data risk feature matrices and the corresponding risk identification influence coefficients, the matrix is ​​first normalized to obtain the comprehensive weight of risk features and the weight of each risk dimension, and the data risk sub-index is calculated. Finally, the data risk index corresponding to the data node is determined, which is executed by the risk assessment and early warning module. It integrates the previous multi-dimensional analysis results, gives a quantitative judgment value of the data risk, and can compare the value with the preset threshold. It not only overcomes the problem of low precision of existing methods, but also can set early warning information for data nodes that fits the actual risk situation. With the dynamic update mechanism, the early warning level and response measures are adjusted in time with the dynamic changes of data risks to ensure data security and stability. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 This is a flow chart of a data risk intelligent identification method based on collaborative analysis proposed by the present invention; Figure 2 A flowchart for obtaining the first data risk feature matrix and the first data risk identification influence coefficient in the present invention; Figure 3 This is a flow chart for obtaining the data risk index in the present invention; Figure 4 This is a system framework diagram of a data risk intelligent identification system based on collaborative analysis proposed in the present invention. DETAILED DESCRIPTION

[0017] The following description is used to disclose the present invention so that those skilled in the art can implement the present invention. The preferred embodiments described below are only examples, and those skilled in the art may think of other obvious variations.

[0018] Reference Figure 1 - Figure 4 As shown, a data risk intelligent identification method based on collaborative analysis includes: S100, collecting data to be identified, and determining information about the type of data to be identified, and determining a recognition mode, performing a primary classification on the data to be identified based on the information about the type of data to be identified, obtaining primary classification sub-data, and analyzing the primary classification sub-data based on the recognition mode to obtain a first data risk feature matrix, and obtaining a first data risk identification influence coefficient corresponding to the primary classification sub-data based on the first data risk feature matrix; S200, obtaining collection method information of the primary classification sub-data, and performing secondary classification on the primary classification sub-data based on the collection method information to obtain secondary classification sub-data, sorting the secondary classification sub-data according to the first data risk identification influence coefficient, and then obtaining a second data risk feature matrix and a second data risk identification influence coefficient corresponding to the sorted secondary classification sub-data based on the collection method information; S300, obtaining application field information of the secondary classification sub-data, and performing tertiary classification on the secondary classification sub-data based on the application field information to obtain tertiary classification sub-data, sorting the tertiary classification sub-data according to the second data risk identification influence coefficient, and then obtaining a third data risk feature matrix and a third risk identification influence coefficient corresponding to the sorted tertiary classification sub-data based on the application field information; S400, obtaining spatial dimension information of the three-fold classified sub-data, and performing four-fold classification on the three-fold classified sub-data based on the spatial dimension information to obtain four-fold classified sub-data, sorting the four-fold classified sub-data according to the third risk identification influence coefficient, and then obtaining a fourth data risk feature matrix and a fourth risk identification influence coefficient corresponding to the sorted four-fold classified sub-data based on the spatial dimension information; S500. Based on the first to fourth data risk feature matrices and the first to fourth risk identification influence coefficients, the data to be identified is evaluated to obtain a data risk index, and then warning information is set for the data nodes corresponding to the data to be identified based on the data risk index.

[0019] Specifically, the data to be identified in this embodiment is data from different sources collected by multi-terminal collection devices or cloud platforms on the same data node (including network devices, transmission nodes, etc.) for collaborative analysis. The different source data from multi-terminal collection devices and cloud platforms are converged to the same data node, which greatly expands the volume and type of data. For example, network devices can provide underlying network operation data such as IP traffic and connection duration, and transmission nodes may provide transmission characteristic data such as data transmission rate and packet loss rate. Combined with the business application-related data gathered by the cloud platform, the analysis is no longer limited to a single dimension, and can provide a more three-dimensional insight into the full picture of the data and tap potential risks. Different data sources complement and verify each other. For example, the user login information shared by the cloud platform, combined with the geographical location changes of the user login IP monitored by the network device, once an abnormal remote login occurs, the multi-source data collaboration can more accurately lock the risk and avoid single-source data misjudgment. Collaborative analysis breaks the "island" state of each data source, making data risk identification more accurate and reliable. By collecting data through multiple terminal devices, information can be obtained from different angles. For example, in the industrial Internet of Things scenario, on the one hand, the operating parameters of the equipment, such as temperature, pressure, vibration frequency, etc., can be collected through sensors on the production equipment. These data reflect the physical state of the equipment. On the other hand, the equipment's operating time, production efficiency and other data can be obtained from the monitoring system terminal, and the equipment's maintenance records, fault history and other information can be obtained from the management system terminal. This multi-dimensional data can more comprehensively describe the operating status of the equipment, avoiding the one-sidedness that may be caused by evaluating data from only a single dimension.

[0020] Further, the data to be identified is collected, and information about the type of data to be identified is determined, and an identification mode is determined at the same time. The data to be identified is initially classified according to the information about the type of data to be identified to obtain initially classified sub-data, and the initially classified sub-data is analyzed based on the identification mode to obtain a first data risk feature matrix. Based on the first data risk feature matrix, a first data risk identification influence coefficient corresponding to the initially classified sub-data is obtained, specifically including: Obtain the data to be identified based on active collection, passive collection, manual annotation and cloud platform sharing; Determine data format information and text information of the data to be identified, and determine a first data type identification feature based on the data format information; Perform natural language processing on text information to obtain text feature information; Based on the text feature information, construct a word frequency histogram and determine a second data type identification feature; Determine the data type information to be identified according to the first data type identification feature and the second data type identification feature; Determine key identification feature information of the data to be identified based on the type of data to be identified, and determine the identification mode based on the key identification feature information; Based on the information of the data type to be identified, the data to be identified is classified into primary classification sub-data of 1 to i data types, and the primary classification sub-data of the same data type are stored in the same set, and each set contains 0 to j primary classification sub-data; According to the recognition mode, 0 to j initial classification sub-data contained in each set are analyzed in turn to obtain the first data risk feature matrix; Determine the ratio of the total number of initially classified sub-data of the i-th data type to the total number of data to be identified as the first data type influence coefficient of the i-th data type; Determine the product value of the first data risk feature matrix corresponding to the jth initial classification sub-data in the set corresponding to the i-th data type and the first data type influence coefficient of the i-th data type, and obtain the first data risk identification influence coefficient corresponding to the jth initial classification sub-data in the set corresponding to the i-th data type.

[0021] Specifically, the data to be identified are collected in four ways: active collection, passive collection, manual annotation, and cloud platform sharing. Active collection means actively sending requests to the target to obtain data, such as network scanning tools actively detecting network ports and sending crawler requests to crawl web page content; passive collection is to collect naturally generated data from existing systems or environments, such as extracting information from network traffic and system logs; manual annotation is to add tags and annotations to data manually with the help of the knowledge and experience of professionals; cloud platform sharing relies on the data resources provided by external cloud service platforms to broaden data acquisition channels. Check whether the data to be identified is structured (such as relational database tables with regular rows and columns), semi-structured (like JSON, XML, with a certain level of labels), or unstructured (such as plain text, pictures, audio) data format, and extract the first data type identification feature from the format characteristics. For example, the number and type of fields of structured data, and the file extension of unstructured data. Extract the text content in the data, use natural language processing technology, such as word segmentation, part-of-speech tagging, named entity recognition and other operations, to mine the deep semantics of the text and organize it into text feature information. Based on these text feature information, we draw a word frequency bar chart, observe the frequently appearing words and phrases, and summarize the second data type identification features. For example, in a document data, certain professional terms appear frequently, which can be used as a key clue to determine the business field to which the data belongs. We combine the first data type identification features obtained from the data format with the second data type identification features obtained from text analysis to accurately determine which specific data type the data to be identified belongs to, such as determining whether it is user order data from an e-commerce platform, user dynamic data from social media, or cyberspace mapping data.

[0022] It can be understood that the type of data to be identified includes structured data, unstructured data, etc. The key identification feature information is the key information in the data to be identified that needs to be identified after the type of data to be identified is determined based on the first data type identification feature and the second data type identification feature. The identification mode is determined based on the key identification feature information. According to the characteristics of each sub-data set, an appropriate risk identification mode is applied to identify its potential risk characteristics. For example, for structured order data, the identification mode may revolve around database query and data association analysis; if it is text-based user evaluation data, the identification mode will most likely use natural language processing methods such as text classification and sentiment analysis. The data risk features in the first data risk feature matrix include data leakage, data tampering, data loss, etc., so the expression formula for one of the initial classification sub-data can be: ,in, is the first data risk feature matrix corresponding to the jth initial classification sub-data in the i-th set, is the data type unique-hot encoding value in the first data risk feature matrix corresponding to the jth initial classification sub-data in the i-th set, is the first risk dimension in the first data risk feature matrix corresponding to the jth initially classified sub-data in the i-th set, is the second risk dimension in the first data risk feature matrix corresponding to the jth primary classification sub-data in the i-th set. The data type unique hot encoding value can be determined according to the data type of the primary classification sub-data. For example, if the data type of the primary classification sub-data is structured data, then its data type unique hot encoding value can be 1. The first risk dimension is the quantitative value of the data leakage risk corresponding to the primary classification sub-data. The second data type identification feature is used to determine the sensitive data in the primary classification sub-data. The sensitive data includes highly sensitive data, moderately sensitive data and low sensitive data. Highly sensitive data, moderately sensitive data and low sensitive data can be judged according to the word frequency bar chart and the primary classification sub-data. Assume that there are 100 records of highly sensitive data, 500 records of moderately sensitive data and 1000 records of low sensitive data. The risk value can be further adjusted by calculating the proportion of the amount of data of each sensitivity level to the total amount of data. The total amount of data is 1600, of which highly sensitive data accounts for 100 / 1600 = 0.0625, medium sensitive data accounts for 500 / 1600 = 0.3125, and low sensitive data accounts for 1000 / 1600 = 0.625. Then different weights are assigned to the proportions of highly sensitive data, medium sensitive data, and low sensitive data, and the weighted sum is obtained to obtain the quantitative value of the data leakage risk corresponding to the initial classification sub-data. Similarly, for the second risk dimension, it can be quantified from the perspective of data access control, and the violation of permissions in the statistical access control list (ACL) is counted. If within a certain period of time (such as one month), 10 unauthorized access attempts are found for highly sensitive data, and the total number of accesses is 1000, then the probability of access permission violation for highly sensitive data is 10 / 1000 = 0.01. For medium-sensitive data, if there are 20 unauthorized access attempts, the total number of accesses is 2000, and the probability of violation is 20 / 2000 = 0.01; for low-sensitive data, there are 30 unauthorized access attempts, the total number of accesses is 3000, and the probability of violation is 30 / 3000 = 0.01. Then, by assigning different weights to the violation probabilities and taking the weighted sum, we can obtain the second risk dimension.

[0023] Further, the collection method information of the primary classification sub-data is obtained, and the primary classification sub-data is secondary classified based on the collection method information to obtain secondary classification sub-data, and the secondary classification sub-data is sorted according to the first data risk identification influence coefficient, and then based on the collection method information, the second data risk feature matrix and the second data risk identification influence coefficient corresponding to the sorted secondary classification sub-data are obtained, which specifically includes: Determine the actively collected information, passively collected information, manually labeled information and cloud platform sharing information, and obtain the collection method information of the initial classification sub-data; Based on the information of the collection method, the initially classified sub-data is reclassified to obtain actively collected sub-data, passively collected sub-data, manually annotated sub-data, and cloud platform shared sub-data; Sequentially obtain active collection process information of actively collected sub-data, passive collection process information of passively collected sub-data, labeling process information of manually labeled sub-data, and sharing process information of cloud platform shared sub-data; Perform risk assessment on active collection process information, passive collection process information, labeling process information and shared process information to obtain a first collection risk assessment index; Based on the actively collected sub-data, the passively collected sub-data, the manually annotated sub-data, and the cloud platform shared sub-data, obtaining a second collection risk assessment index corresponding to the actively collected sub-data, the passively collected sub-data, the manually annotated sub-data, and the cloud platform shared sub-data; According to the first collection risk assessment index and the second collection risk assessment index, actively collected sub-data, passively collected sub-data, manually annotated sub-data and cloud platform shared sub-data are further labeled to obtain secondary classification sub-data; Determine the first data risk identification influence coefficient corresponding to the secondary classification sub-data, sort the secondary classification sub-data based on the first data risk identification influence coefficient, and obtain sorting information; Based on the sorting information, setting the first collection mode influence coefficient for the sorted secondary classification sub-data; Obtain a second data risk feature matrix according to the first acquisition risk assessment index and the second acquisition risk assessment index corresponding to the secondary classification sub-data; Determine the product value of the second data risk feature matrix and the first acquisition method influence coefficient to obtain the second data risk identification influence coefficient.

[0024] Specifically, for process information acquisition, for each type of secondary classification sub-data, we need to dig deep into its collection process information. For active collection of sub-data, we need to sort out active collection processes such as the target range and frequency of scanning, crawler crawling rules, etc.; for passive collection of sub-data, we need to sort out passive collection processes such as which system and time period to extract logs from, and according to which rules to filter network traffic; for manual labeling of sub-data, we need to clarify the qualifications of the labeling personnel and the basis for labeling; for cloud platform shared sub-data, we need to clarify the sharing process information such as data source and sharing agreement terms. Calculate the first collection risk assessment index, conduct risk assessment on the above-mentioned types of collection process information, consider security vulnerabilities, compliance, data accuracy and other factors in the process, and obtain the first collection risk assessment index after comprehensive assessment. For example, during active collection, if the scanning frequency is too high, it is easy to be detected and blocked by the target system, which will increase the risk value; if manual labeling lacks a standard process and the labeling quality is uneven, it will also increase the risk. To obtain the second collection risk assessment index, in addition to the collection process, we also need to evaluate the risks brought by factors such as data integrity, accuracy, and data volume based on the characteristics of each type of secondary classification sub-data, and obtain the second collection risk assessment index. For example, data shared on the cloud platform may result in partial data loss due to data format conversion issues, affecting data integrity and thus bringing certain risks.

[0025] It is understandable that by marking the secondary classification sub-data, combining the first collection risk assessment index and the second collection risk assessment index, adding tags to the actively collected sub-data, passively collected sub-data, manually annotated sub-data and cloud platform shared sub-data, the secondary classification sub-data can carry richer risk attribute information and further improve the definition of this type of data. Set the first collection method impact coefficient, and set the first collection method impact coefficient for the sorted secondary classification sub-data according to the sorting information. The top-ranked sub-data may be given a larger impact coefficient because of its relatively higher risk, which means that it has a greater weight in subsequent risk calculations. Construct the second data risk feature matrix, refer to the first collection risk assessment index and the second collection risk assessment index corresponding to the secondary classification sub-data, extract key risk dimensions from them, such as data integrity risk dimension, compliance risk dimension, etc., and combine them into the second data risk feature matrix. The rows of the matrix can correspond to different subsets of secondary classification sub-data, and the columns are various risk dimensions.

[0026] Further, the application field information of the secondary classification sub-data is obtained, and the secondary classification sub-data is classified three times based on the application field information to obtain the three-classification sub-data, and the three-classification sub-data is sorted according to the second data risk identification influence coefficient, and then based on the application field information, the third data risk feature matrix and the third risk identification influence coefficient corresponding to the sorted three-classification sub-data are obtained, which specifically includes: Acquire information on the collection method of the secondary classification sub-data, and determine the first application field characteristic information based on the information on the collection method of the secondary classification sub-data; Determine metadata of the secondary classification sub-data, and obtain second application field feature information of the secondary classification sub-data; Determining application field information of the secondary classification sub-data based on the first application field characteristic information and the second application field characteristic information; According to the application field information, the secondary classification sub-data is classified three times to obtain 1 to m application field sets, and each application field set contains 0 to n third-classification sub-data; Based on the second data risk identification impact coefficient, the tertiary classification sub-data in each application field set are sorted in turn; According to the application field information, a first application field sensitivity coefficient is set for the sorted third-classification sub-data; Based on the sensitivity coefficient of the first application field, a third data risk feature identification level is set for the third classification sub-data; Based on the third data risk feature identification level, the risk dimension of the three-classification sub-data is identified to obtain the third data risk feature matrix; The product value of the first application field sensitivity coefficient corresponding to the third classification sub-data and the third data risk characteristic matrix is ​​used as the third risk identification influence coefficient.

[0027] Further, spatial dimension information of the three-fold classified sub-data is obtained, and the three-fold classified sub-data is classified four times based on the spatial dimension information to obtain four-fold classified sub-data, and the four-fold classified sub-data is sorted according to the third risk identification influence coefficient, and then based on the spatial dimension information, a fourth data risk feature matrix and a fourth risk identification influence coefficient corresponding to the sorted four-fold classified sub-data are obtained, specifically including: Obtaining physical space dimension information and network space dimension information of the three-dimensional classification sub-data, and determining the space dimension information of the three-dimensional classification sub-data; Based on the spatial dimension information, the three-classification sub-data are classified four times to obtain physical space dimension sub-data and network space dimension sub-data; Determine a first risk identification influence coefficient, a second risk identification influence coefficient, and a third risk identification influence coefficient corresponding to the physical space dimension sub-data, and obtain an average value of the first risk identification influence coefficient, the second risk identification influence coefficient, and the third risk identification influence coefficient; The physical space dimension sub-data with the smallest average value of the first risk identification influence coefficient, the second risk identification influence coefficient and the third risk identification influence coefficient is used as the physical space dimension origin sub-data; Taking the coordinate value of the physical space dimension origin sub-data as the origin, construct the risk assessment space coordinate system, and determine the coordinate values ​​of all the physical space dimension sub-data in the risk assessment space coordinate system; Determine the distance values ​​between all physical space dimension sub-data and the origin, and obtain the safety factor of the first space dimension; Based on the physical space dimension sub-data and the network space dimension sub-data, obtaining the space dimension sub-data correlation index; Conduct risk assessment on the cyberspace dimension sub-data to obtain the safety factor of the second space dimension; According to the safety factor of the first spatial dimension, the safety factor of the second spatial dimension and the spatial dimension sub-data association index, the physical spatial dimension sub-data and the cyber spatial dimension sub-data are marked respectively to obtain the four-fold classification sub-data; Sorting the four-fold classification sub-data according to the third risk identification influence coefficient, and identifying the risk dimension of the sorted four-fold classification sub-data to obtain a fourth data risk feature matrix; Determine the first spatial dimension safety factor or the second spatial dimension safety factor corresponding to the four-fold classification sub-data in sequence; Divide the first spatial dimension safety factor or the second spatial dimension safety factor corresponding to the four-fold classification sub-data by the spatial dimension sub-data association index to obtain the fourth risk feature matrix influence coefficient; The product value of the fourth risk characteristic matrix influence coefficient and the fourth data risk characteristic matrix is ​​obtained to obtain the fourth risk identification influence coefficient.

[0028] Further, based on the first to fourth data risk feature matrices and the first to fourth risk identification influence coefficients, the data to be identified is evaluated to obtain a data risk index, and then warning information is set for the data node corresponding to the data to be identified based on the data risk index, specifically including: Normalizing the first data risk feature matrix, the second data risk feature matrix, the third data risk feature matrix, and the fourth data risk feature matrix; Obtain the sum of all elements in the first data risk feature matrix, the second data risk feature matrix, the third data risk feature matrix, and the fourth data risk feature matrix respectively, and record them as the comprehensive weight of the risk feature; The ratios of all elements in the first data risk feature matrix, the second data risk feature matrix, the third data risk feature matrix, and the fourth data risk feature matrix to the comprehensive weights of the risk features are used as the weights of the risk dimensions; Determine the data risk sub-index of the data to be identified; Based on the data risk sub-index of the data to be identified, determine the data risk index corresponding to the data node; Set warning information for data nodes according to the data risk index corresponding to the data nodes; The calculation formula of data risk index is: ; In the formula, For the The data risk index of each data node, For the The number of risk dimensions of the risk feature matrix of each data, For the The first The weight of each risk dimension, For the The first The normalized eigenvalues ​​of the risk dimensions, For the Risk identification influence coefficient, For the The data nodes correspond to Group the data to be identified, is the total number of groups of data to be identified.

[0029] Furthermore, a data risk intelligent identification system based on collaborative analysis is proposed, which is used to implement any of the above identification methods, including: The data collection and type identification module is used to obtain the data to be identified based on active collection, passive collection, manual annotation and cloud platform sharing, determine the data format information and text information of the data to be identified, determine the first data type identification feature based on the data format information, perform natural language processing on the text information, and construct a word frequency bar chart to determine the second data type identification feature, thereby determining the data type information to be identified; The collection method analysis module is used to determine the active collection information, passive collection information, manual annotation information and cloud platform sharing method information, and perform secondary classification on the primary classification sub-data to obtain the active collection sub-data, passive collection sub-data, manual annotation sub-data and cloud platform sharing sub-data. The tertiary classification sub-data in each application field set are sorted based on the second data risk identification influence coefficient, and the first application field sensitivity coefficient is set according to the application field information. Based on this, the third data risk feature identification level is set, and the risk dimension identification is performed to obtain the third data risk feature matrix, and the third risk identification influence coefficient is calculated; An application field analysis module, the application field analysis module is used to obtain the collection method information of the secondary classification sub-data to determine the first application field characteristic information, determine the metadata of the secondary classification sub-data to obtain the second application field characteristic information, determine the application field information based on the two, classify the secondary classification sub-data into three categories to obtain different application field sets, sort the three-category classification sub-data in each application field set based on the second data risk identification influence coefficient, set the first application field sensitivity coefficient according to the application field information, set the third data risk characteristic identification level based on this, perform risk dimension identification to obtain the third data risk characteristic matrix, and calculate the third risk identification influence coefficient; The spatial dimension analysis module is used to obtain the physical space dimension information and the network space dimension information of the three-classification sub-data, classify the three-classification sub-data four times, obtain the physical space dimension sub-data and the network space dimension sub-data, determine the average value of the relevant risk identification influence coefficient of the physical space dimension sub-data, determine the physical space dimension origin sub-data, construct the risk assessment space coordinate system, calculate the first space dimension safety factor, obtain the space dimension sub-data association index, evaluate the network space dimension sub-data to obtain the second space dimension safety factor, mark the four-classification sub-data accordingly, and calculate the fourth data risk feature matrix and the fourth risk identification influence coefficient; The risk assessment and early warning module is used to normalize the first to fourth data risk feature matrices, calculate the elements and values ​​of each matrix as the comprehensive weight of the risk feature, and then determine the weight of each risk dimension. Combined with the risk identification influence coefficient, the data risk sub-index of the data to be identified is calculated according to the formula, and finally the data risk index corresponding to the data node is determined. According to the data risk index corresponding to the data node, it is compared with the preset threshold, different levels of early warning information are set for the data node, and a dynamic update mechanism for early warning information is established to adjust the early warning level and response measures in time as the data risk situation changes.

[0030] Furthermore, the data collection and type identification module includes: Data collection unit: The data collection unit is used to obtain the data to be identified based on active collection, passive collection, manual annotation and cloud platform sharing, such as actively detecting and collecting network device information through network scanning tools (Nmap, etc.), and passively collecting network traffic data using traffic monitoring equipment (such as Wireshark). The data type determination unit is used to determine the data format information and text information of the data to be identified, determine the first data type identification feature with the data format information, perform natural language processing on the text information, and construct a word frequency bar graph to determine the second data type identification feature, thereby determining the data type information to be identified. For example, for cyberspace surveying and mapping information collection, if the data format is a structured database format, combined with the keywords in the text (such as "server", "IP address", etc.), it can be determined that it belongs to the network device information data type.

[0031] Furthermore, the collection method analysis module includes: A collection method classification unit, which is used to determine active collection information, passive collection information, manual annotation information, and cloud platform sharing method information, and to perform secondary classification on the primary classification sub-data to obtain active collection sub-data, passive collection sub-data, manual annotation sub-data, and cloud platform sharing sub-data; The risk assessment and coefficient calculation unit is used to sequentially obtain the process information of various types of collected sub-data (such as active collection process information, passive collection process information, etc.) for risk assessment, and obtain the first collection risk assessment index; obtain the second collection risk assessment index based on various types of collected sub-data; mark the collected sub-data according to these two indexes to obtain secondary classification sub-data, determine the corresponding first data risk identification influence coefficient, and then calculate the second data risk feature matrix and the second data risk identification influence coefficient. For example, for actively collected network equipment information, analyze its scanning strategy, frequency and other process information, evaluate the risk of being discovered and defended by the target network, and determine its risk coefficient at the collection method level.

[0032] Furthermore, the application field analysis module includes: The application field determination unit is used to obtain the collection method information of the secondary classification sub-data to determine the first application field characteristic information, determine the metadata of the secondary classification sub-data to obtain the second application field characteristic information, determine the application field information based on the two, and classify the secondary classification sub-data three times to obtain different application field sets. For example, for data in an enterprise network, based on the fact that it is collected from the financial department (collection method information) and the metadata contains financial transaction record characteristics, its application field is determined to be the financial field; The risk characteristics and coefficient calculation unit is used to sort the three-classification sub-data in each application field set based on the second data risk identification influence coefficient, set the first application field sensitivity coefficient according to the application field information, set the third data risk characteristic identification level based on this, perform risk dimension identification to obtain the third data risk characteristic matrix, and calculate the third risk identification influence coefficient. For example, for data in the financial field, because it involves capital transactions and has high sensitivity, a higher first application field sensitivity coefficient is set, so as to highlight the weights of key risk dimensions such as data confidentiality and integrity in the risk characteristic matrix, and calculate a coefficient that more accurately reflects the data risk in this field.

[0033] Furthermore, the spatial dimension analysis module includes: The spatial dimension classification unit is used to obtain the physical spatial dimension information (such as the geographical location of the server, the city where the data center is located, etc.) and the network spatial dimension information (such as the network hierarchy, IP address segment, etc.) of the three-classification sub-data, and classify the three-classification sub-data four times to obtain the physical spatial dimension sub-data and the network spatial dimension sub-data; The risk coefficient calculation and marking unit is used to determine the average value of the risk identification influence coefficient of the physical space dimension sub-data, determine the physical space dimension origin sub-data, construct the risk assessment space coordinate system, calculate the first space dimension safety coefficient; obtain the space dimension sub-data association index, evaluate the network space dimension sub-data to obtain the second space dimension safety coefficient, and mark the fourth classification sub-data accordingly, and calculate the fourth data risk feature matrix and the fourth risk identification influence coefficient. For example, in a multinational enterprise network, for data centers (physical space dimension sub-data) located in different countries, their safety coefficients are determined by considering factors such as the local political situation and the frequency of network attacks, and combined with their association with other parts of the network architecture (network space dimension sub-data), the risk characteristics of the data in the space dimension are comprehensively evaluated.

[0034] Furthermore, the risk assessment and early warning module includes: The data risk index calculation unit is used to normalize the first to fourth data risk feature matrices, calculate the sum of the matrix elements as the comprehensive weight of the risk feature, and then determine the weight of each risk dimension, and calculate the data risk sub-index of the data to be identified according to the formula in combination with the risk identification influence coefficient, and finally determine the data risk index corresponding to the data node; The warning information setting unit is used to compare the data risk index corresponding to the data node with the preset threshold, set different levels of warning information for the data node (such as low-risk green warning, medium-risk yellow warning, high-risk orange warning, and extremely high-risk red warning), and establish a dynamic update mechanism for warning information to adjust the warning level and response measures in a timely manner as the data risk situation changes.

[0035] The above shows and describes the basic principles, main features and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The above embodiments and descriptions only describe the principles of the present invention. The present invention may be subject to various changes and improvements without departing from the spirit and scope of the present invention. These changes and improvements fall within the scope of the present invention. The scope of protection claimed by the present invention is defined by the attached claims and their equivalents.

Claims

1. A data risk intelligent identification method based on collaborative analysis, characterized in that: include: S100, collecting data to be identified, and determining information about the type of data to be identified, and determining a recognition mode, performing a primary classification on the data to be identified based on the information about the type of data to be identified, obtaining primary classification sub-data, and analyzing the primary classification sub-data based on the recognition mode to obtain a first data risk feature matrix, and obtaining a first data risk identification influence coefficient corresponding to the primary classification sub-data based on the first data risk feature matrix; S200, obtaining collection method information of the primary classification sub-data, and performing secondary classification on the primary classification sub-data based on the collection method information to obtain secondary classification sub-data, sorting the secondary classification sub-data according to the first data risk identification influence coefficient, and then obtaining a second data risk feature matrix and a second data risk identification influence coefficient corresponding to the sorted secondary classification sub-data based on the collection method information; S300, obtaining application field information of the secondary classification sub-data, and performing tertiary classification on the secondary classification sub-data based on the application field information to obtain tertiary classification sub-data, sorting the tertiary classification sub-data according to the second data risk identification influence coefficient, and then obtaining a third data risk feature matrix and a third risk identification influence coefficient corresponding to the sorted tertiary classification sub-data based on the application field information; S400, obtaining spatial dimension information of the three-fold classified sub-data, and performing four-fold classification on the three-fold classified sub-data based on the spatial dimension information to obtain four-fold classified sub-data, sorting the four-fold classified sub-data according to the third risk identification influence coefficient, and then obtaining a fourth data risk feature matrix and a fourth risk identification influence coefficient corresponding to the sorted four-fold classified sub-data based on the spatial dimension information; S500. Based on the first to fourth data risk feature matrices and the first to fourth risk identification influence coefficients, the data to be identified is evaluated to obtain a data risk index, and then warning information is set for the data nodes corresponding to the data to be identified based on the data risk index.

2. According to claim 1, a data risk intelligent identification method based on collaborative analysis is characterized in that: The collecting of the data to be identified, determining the type of data to be identified, and determining the identification mode, performing a primary classification on the data to be identified based on the type of data to be identified to obtain primary classification sub-data, and analyzing the primary classification sub-data based on the identification mode to obtain a first data risk feature matrix, and obtaining a first data risk identification influence coefficient corresponding to the primary classification sub-data based on the first data risk feature matrix, specifically includes: Obtain the data to be identified based on active collection, passive collection, manual annotation and cloud platform sharing; Determine data format information and text information of the data to be identified, and determine a first data type identification feature based on the data format information; Perform natural language processing on text information to obtain text feature information; Based on the text feature information, construct a word frequency histogram and determine a second data type identification feature; Determine the data type information to be identified according to the first data type identification feature and the second data type identification feature; Determine key identification feature information of the data to be identified based on the type of data to be identified, and determine the identification mode based on the key identification feature information; Based on the information of the data type to be identified, the data to be identified is classified into primary classification sub-data of 1 to i data types, and the primary classification sub-data of the same data type are stored in the same set, and each set contains 0 to j primary classification sub-data; According to the recognition mode, 0 to j initial classification sub-data contained in each set are analyzed in turn to obtain the first data risk feature matrix; Determine the ratio of the total number of initially classified sub-data of the i-th data type to the total number of data to be identified as the first data type influence coefficient of the i-th data type; Determine the product value of the first data risk feature matrix corresponding to the jth initial classification sub-data in the set corresponding to the i-th data type and the first data type influence coefficient of the i-th data type, and obtain the first data risk identification influence coefficient corresponding to the jth initial classification sub-data in the set corresponding to the i-th data type.

3. The method for intelligently identifying data risks based on collaborative analysis according to claim 2 is characterized in that: The acquiring of the collection method information of the primary classification sub-data, and performing secondary classification on the primary classification sub-data based on the collection method information to obtain secondary classification sub-data, sorting the secondary classification sub-data according to the first data risk identification influence coefficient, and then acquiring the second data risk feature matrix and the second data risk identification influence coefficient corresponding to the sorted secondary classification sub-data based on the collection method information, specifically includes: Determine the actively collected information, passively collected information, manually labeled information and cloud platform sharing information, and obtain the collection method information of the initial classification sub-data; Based on the information of the collection method, the initially classified sub-data is reclassified to obtain actively collected sub-data, passively collected sub-data, manually annotated sub-data, and cloud platform shared sub-data; Sequentially obtain active collection process information of actively collected sub-data, passive collection process information of passively collected sub-data, labeling process information of manually labeled sub-data, and sharing process information of cloud platform shared sub-data; Perform risk assessment on active collection process information, passive collection process information, labeling process information and shared process information to obtain a first collection risk assessment index; Based on the actively collected sub-data, the passively collected sub-data, the manually annotated sub-data, and the cloud platform shared sub-data, obtaining a second collection risk assessment index corresponding to the actively collected sub-data, the passively collected sub-data, the manually annotated sub-data, and the cloud platform shared sub-data; According to the first collection risk assessment index and the second collection risk assessment index, actively collected sub-data, passively collected sub-data, manually annotated sub-data and cloud platform shared sub-data are further labeled to obtain secondary classification sub-data; Determine the first data risk identification influence coefficient corresponding to the secondary classification sub-data, sort the secondary classification sub-data based on the first data risk identification influence coefficient, and obtain sorting information; Based on the sorting information, setting the first collection mode influence coefficient for the sorted secondary classification sub-data; Obtain a second data risk feature matrix according to the first acquisition risk assessment index and the second acquisition risk assessment index corresponding to the secondary classification sub-data; Determine the product value of the second data risk feature matrix and the first acquisition method influence coefficient to obtain the second data risk identification influence coefficient.

4. The method for intelligently identifying data risks based on collaborative analysis according to claim 3 is characterized in that: The obtaining of application field information of the secondary classification sub-data, and performing tertiary classification on the secondary classification sub-data based on the application field information to obtain tertiary classification sub-data, sorting the tertiary classification sub-data according to the second data risk identification influence coefficient, and then obtaining the third data risk feature matrix and the third risk identification influence coefficient corresponding to the sorted tertiary classification sub-data based on the application field information, specifically includes: Acquire information on the collection method of the secondary classification sub-data, and determine the first application field characteristic information based on the information on the collection method of the secondary classification sub-data; Determine metadata of the secondary classification sub-data, and obtain second application field feature information of the secondary classification sub-data; Determining application field information of the secondary classification sub-data based on the first application field characteristic information and the second application field characteristic information; According to the application field information, the secondary classification sub-data is classified three times to obtain 1 to m application field sets, and each application field set contains 0 to n third-classification sub-data; Based on the second data risk identification impact coefficient, the tertiary classification sub-data in each application field set are sorted in turn; According to the application field information, a first application field sensitivity coefficient is set for the sorted third-classification sub-data; Based on the sensitivity coefficient of the first application field, a third data risk feature identification level is set for the third classification sub-data; Based on the third data risk feature identification level, the risk dimension of the three-classification sub-data is identified to obtain the third data risk feature matrix; The product value of the first application field sensitivity coefficient corresponding to the third classification sub-data and the third data risk characteristic matrix is ​​used as the third risk identification influence coefficient.

5. The method for intelligently identifying data risks based on collaborative analysis according to claim 4 is characterized in that: The obtaining of spatial dimension information of the three-fold classified sub-data, and performing four-fold classification on the three-fold classified sub-data based on the spatial dimension information to obtain four-fold classified sub-data, sorting the four-fold classified sub-data according to the third risk identification influence coefficient, and then obtaining a fourth data risk feature matrix and a fourth risk identification influence coefficient corresponding to the sorted four-fold classified sub-data based on the spatial dimension information, specifically includes: Obtaining physical space dimension information and network space dimension information of the three-dimensional classification sub-data, and determining the space dimension information of the three-dimensional classification sub-data; Based on the spatial dimension information, the three-classification sub-data are classified four times to obtain physical space dimension sub-data and network space dimension sub-data; Determine a first risk identification influence coefficient, a second risk identification influence coefficient, and a third risk identification influence coefficient corresponding to the physical space dimension sub-data, and obtain an average value of the first risk identification influence coefficient, the second risk identification influence coefficient, and the third risk identification influence coefficient; The physical space dimension sub-data with the smallest average value of the first risk identification influence coefficient, the second risk identification influence coefficient and the third risk identification influence coefficient is used as the physical space dimension origin sub-data; Taking the coordinate value of the physical space dimension origin sub-data as the origin, construct the risk assessment space coordinate system, and determine the coordinate values ​​of all the physical space dimension sub-data in the risk assessment space coordinate system; Determine the distance values ​​between all physical space dimension sub-data and the origin, and obtain the safety factor of the first space dimension; Based on the physical space dimension sub-data and the network space dimension sub-data, obtaining the space dimension sub-data correlation index; Conduct risk assessment on the cyberspace dimension sub-data to obtain the safety factor of the second space dimension; According to the safety factor of the first spatial dimension, the safety factor of the second spatial dimension and the spatial dimension sub-data association index, the physical spatial dimension sub-data and the cyber spatial dimension sub-data are marked respectively to obtain the four-fold classification sub-data; Sorting the four-fold classification sub-data according to the third risk identification influence coefficient, and identifying the risk dimension of the sorted four-fold classification sub-data to obtain a fourth data risk feature matrix; Determine the first spatial dimension safety factor or the second spatial dimension safety factor corresponding to the four-fold classification sub-data in sequence; Divide the first spatial dimension safety factor or the second spatial dimension safety factor corresponding to the four-fold classification sub-data by the spatial dimension sub-data association index to obtain the fourth risk feature matrix influence coefficient; The product value of the fourth risk characteristic matrix influence coefficient and the fourth data risk characteristic matrix is ​​obtained to obtain the fourth risk identification influence coefficient.

6. The method for intelligently identifying data risks based on collaborative analysis according to claim 5 is characterized in that: The method of evaluating the data to be identified based on the first to fourth data risk feature matrices and the first to fourth risk identification influence coefficients to obtain a data risk index, and then setting warning information for the data node corresponding to the data to be identified based on the data risk index specifically includes: Normalizing the first data risk feature matrix, the second data risk feature matrix, the third data risk feature matrix, and the fourth data risk feature matrix; Obtain the sum of all elements in the first data risk feature matrix, the second data risk feature matrix, the third data risk feature matrix, and the fourth data risk feature matrix respectively, and record them as the comprehensive weight of the risk feature; The ratios of all elements in the first data risk feature matrix, the second data risk feature matrix, the third data risk feature matrix, and the fourth data risk feature matrix to the comprehensive weights of the risk features are used as the weights of the risk dimensions; Determine the data risk sub-index of the data to be identified; Based on the data risk sub-index of the data to be identified, determine the data risk index corresponding to the data node; Set warning information for data nodes according to the data risk index corresponding to the data nodes; The calculation formula of the data risk index is: ； In the formula, For the The data risk index of each data node, For the The number of risk dimensions of the risk feature matrix of each data, For the The first The weight of each risk dimension, For the The first The normalized eigenvalues ​​of the risk dimensions, For the Risk identification influence coefficient, For the The data nodes correspond to Group the data to be identified, is the total number of groups of data to be identified.

7. A data risk intelligent identification system based on collaborative analysis, used to implement the identification method according to any one of claims 1 to 6, characterized in that: include: A data collection and type identification module, which is used to obtain the data to be identified based on active collection, passive collection, manual annotation and cloud platform sharing, determine the data format information and text information of the data to be identified, determine the first data type identification feature based on the data format information, perform natural language processing on the text information, construct a word frequency bar chart to determine the second data type identification feature, and thus determine the data type information to be identified; A collection method analysis module, wherein the collection method analysis module is used to determine active collection information, passive collection information, manual annotation information, and cloud platform sharing method information, perform secondary classification on the primary classification sub-data to obtain active collection sub-data, passive collection sub-data, manual annotation sub-data, and cloud platform sharing sub-data, sort the tertiary classification sub-data in each application field set based on the second data risk identification influence coefficient, set the first application field sensitivity coefficient according to the application field information, set the third data risk feature identification level based on the first application field sensitivity coefficient, perform risk dimension identification to obtain the third data risk feature matrix, and calculate the third risk identification influence coefficient; An application field analysis module, the application field analysis module is used to obtain the collection method information of the secondary classification sub-data to determine the first application field characteristic information, determine the metadata of the secondary classification sub-data to obtain the second application field characteristic information, determine the application field information based on the two, classify the secondary classification sub-data three times to obtain different application field sets, sort the three-classification sub-data in each application field set based on the second data risk identification influence coefficient, set the first application field sensitivity coefficient according to the application field information, set the third data risk characteristic identification level based on this, perform risk dimension identification to obtain the third data risk characteristic matrix, and calculate the third risk identification influence coefficient; A space dimension analysis module, the space dimension analysis module is used to obtain physical space dimension information and network space dimension information of the three-classification sub-data, classify the three-classification sub-data four times, obtain physical space dimension sub-data and network space dimension sub-data, determine the average value of the relevant risk identification influence coefficient of the physical space dimension sub-data, determine the physical space dimension origin sub-data, construct a risk assessment space coordinate system, calculate the first space dimension safety factor, obtain the space dimension sub-data association index, evaluate the network space dimension sub-data to obtain the second space dimension safety factor, mark the four-classification sub-data accordingly, and calculate the fourth data risk feature matrix and the fourth risk identification influence coefficient; The risk assessment and early warning module is used to normalize the first to fourth data risk feature matrices, calculate the elements and values ​​of each matrix as the comprehensive weight of the risk feature, and then determine the weight of each risk dimension, combine the risk identification influence coefficient, and calculate the data risk sub-index of the data to be identified according to the formula, and finally determine the data risk index corresponding to the data node. According to the data risk index corresponding to the data node, it is compared with the preset threshold, and different levels of early warning information are set for the data node. A dynamic update mechanism for early warning information is established to adjust the early warning level and response measures in time as the data risk situation changes.

8. The data risk intelligent identification system based on collaborative analysis according to claim 7 is characterized in that: The acquisition mode analysis module includes: A collection method classification unit, the collection method classification unit is used to determine active collection information, passive collection information, manual annotation information and cloud platform sharing method information, and perform secondary classification on the primary classification sub-data to obtain active collection sub-data, passive collection sub-data, manual annotation sub-data and cloud platform sharing sub-data; A risk assessment and coefficient calculation unit is used to sequentially obtain process information of various types of collected sub-data for risk assessment, obtain a first collection risk assessment index, obtain a second collection risk assessment index based on various types of collected sub-data, mark the collected sub-data according to these two indexes to obtain secondary classified sub-data, determine the corresponding first data risk identification influence coefficient, and then calculate the second data risk feature matrix and the second data risk identification influence coefficient.

9. The data risk intelligent identification system based on collaborative analysis according to claim 7 is characterized in that: The application field analysis module includes: An application field determination unit, the application field determination unit is used to obtain the collection method information of the secondary classification sub-data to determine the first application field characteristic information, determine the metadata of the secondary classification sub-data to obtain the second application field characteristic information, determine the application field information based on the two, and classify the secondary classification sub-data three times to obtain different application field sets; The risk characteristic and coefficient calculation unit is used to sort the third classification sub-data in each application field set based on the second data risk identification influence coefficient, set the first application field sensitivity coefficient according to the application field information, set the third data risk characteristic identification level based on this, perform risk dimension identification to obtain the third data risk characteristic matrix, and calculate the third risk identification influence coefficient.

10. The data risk intelligent identification system based on collaborative analysis according to claim 7 is characterized in that: The risk assessment and early warning module includes: A data risk index calculation unit, which is used to normalize the first to fourth data risk feature matrices, calculate the sum of the matrix elements as the comprehensive weight of the risk feature, and then determine the weight of each risk dimension, and calculate the data risk sub-index of the data to be identified according to the formula in combination with the risk identification influence coefficient, and finally determine the data risk index corresponding to the data node; The warning information setting unit is used to compare the data risk index corresponding to the data node with the preset threshold, set different levels of warning information for the data node, and establish a dynamic update mechanism for the warning information to timely adjust the warning level and response measures as the data risk status changes.

Images