A multi-dimensional data classification method, device and electronic device

Abstract

The present invention discloses a multi-dimensional data grading method, device and electronic device, which are used to solve the problem of low accuracy of data importance grading. When performing data grading, the present invention introduces the organizational structure information of the data source, and combines the organizational structure information, as well as the resource attributes and sensitivity of each data field itself, to predict the open attributes of each data field, thereby obtaining the open attributes of each data field; at the same time, combined with the specific deployment scenario, the data source is subjected to data attack surface risk assessment processing, thereby obtaining the deployment risk; finally, the deployment risk of the data source and the open attributes of each data field in the data source are combined to obtain the grading result of each data field; thus, the present invention performs data grading from multiple dimensions, and when grading, the correlation between data is considered, and deployment risk assessment is introduced; in this way, the accuracy of data importance grading can be improved.

Description

Technical Field

[0001] The present invention belongs to the field of data processing technology, and specifically relates to a multi-dimensional data classification method, device and electronic equipment. Background Art

[0002] The main purpose of data classification and grading is to better manage and protect data assets and ensure the security, compliance and effective use of data. By classifying and grading data, the sensitivity, importance and value of the data can be clarified, so as to formulate corresponding management strategies and security measures to prevent data leakage, tampering and abuse, thereby achieving the purpose of protecting personal privacy. At the same time, data classification and grading is also an important part of the data governance system, which helps to improve the standardization and efficiency of data management. Therefore, data classification has been widely used in the fields of data management and security protection.

[0003] At present, with the introduction of laws such as the Personal Information Protection Law, the Cybersecurity Law, and the Basic Requirements for Information Security Technology Cybersecurity Level Protection, people are becoming more and more aware of data security protection. Therefore, accurate data classification is an important prerequisite for ensuring the reliable implementation of subsequent desensitization work; however, in actual use, traditional classification methods basically only focus on the resource attributes of data (that is, basic information of the data, such as personal information, etc.), and are neither related to other data nor to actual data deployment scenarios when classifying and grading. In fact, the importance of data is closely related to deployment security risks, data ownership, and the relationship between data. This will lead to poor accuracy in data importance classification, thereby reducing the reliability of desensitization. Based on this, how to provide a high-accuracy multi-dimensional data classification method has become an urgent problem to be solved. Summary of the invention

[0004] The purpose of the present invention is to provide a multi-dimensional data classification method, device and electronic device to solve the problem of poor data classification accuracy in the prior art.

[0005] In order to achieve the above object, the present invention adopts the following technical solutions:

[0006] In a first aspect, a multi-dimensional data classification method is provided, comprising:

[0007] Acquire a target data source, wherein the target data source is structured data, the target data source includes a plurality of data fields, and each data field is used to represent a header field in the structured data;

[0008] Performing data resource attribute classification processing on each data field in the target data source to obtain data resource attributes corresponding to each data field, and after obtaining the data resource attributes of each data field, performing sensitivity identification processing on each data field to obtain the sensitivity of each data field after the sensitivity identification processing;

[0009] Determining data organization attributes of the target data source, wherein the data organization attributes include organizational structure information;

[0010] According to the organizational structure information in the data organization attribute, and the data resource attribute and sensitivity corresponding to each data field, the open attribute of each data field is obtained, wherein the open attribute of any data field is used to characterize the openness of the data corresponding to the any data field in the target data source;

[0011] Performing data attack surface risk assessment on the target data source to obtain a deployment risk of the target data source;

[0012] Based on the deployment risk of the target data source and the open attributes of each data field, each data field is graded to obtain a grading result for each data field, so that the data corresponding to each data field in the target data source is desensitized according to the grading result of each data field.

[0013] Based on the above disclosed content, after acquiring the target data source, the present invention first performs data resource attribute classification processing on each data field (i.e., table header) in the target data source to obtain the data resource attribute of each data field (i.e., which basic information each data field belongs to, such as name, gender, age, etc.); then, sensitivity identification is performed on each data field to obtain the sensitivity of each data field; then, the data organization attribute of the target data source is determined to obtain the corresponding organizational structure information; then, the open attributes of each data field can be determined in combination with the aforementioned organizational structure information, as well as the data resource attributes and sensitivity of each data field; at the same time, the present invention also performs risk assessment of the target data source from the deployment scenario, that is, performs data attack surface risk assessment processing on it, thereby obtaining deployment risks; finally, based on the aforementioned deployment risks and the open attributes of each data field, the importance grading results of each data field can be obtained.

[0014] Through the above design, the present invention introduces the organizational structure information of the data source when performing data classification, and combines the organizational structure information, as well as the resource attributes and sensitivity of each data field itself, to predict the open attributes of each data field, thereby obtaining the open attributes of each data field; at the same time, combined with the specific deployment scenario, the data source is subjected to data attack surface risk assessment processing, thereby obtaining the deployment risk; finally, the deployment risk of the data source and the open attributes of each data field in the data source are comprehensively considered to obtain the classification results of each data field; thus, the present invention performs data classification from multiple dimensions, and when classifying, the correlation between data is considered, and deployment risk assessment is introduced; in this way, the accuracy of data importance classification can be improved, thereby providing an accurate data basis for subsequent desensitization work, thereby improving the reliability of data desensitization, and therefore, the present invention is very suitable for large-scale application and promotion.

[0015] In a possible design, each data field is configured with corresponding annotation information, wherein data resource attribute classification processing is performed on each data field in the target data source to obtain data resource attributes corresponding to each data field, including:

[0016] Acquire a category vector library, wherein the category vector library contains data resource attributes corresponding to a number of historical data fields and data resource attributes corresponding to annotation information of a number of historical data fields;

[0017] For any data field, according to the any data field or the annotation information corresponding to the any data field, an attribute matching process is performed in the category vector library to obtain an attribute matching result;

[0018] Determine whether the attribute matching result is empty;

[0019] If not, the data resource attribute corresponding to any one of the data fields is obtained based on the attribute matching result.

[0020] In a possible design, if the attribute matching result is empty, the method further includes:

[0021] Acquire a template database, wherein the template database contains resource data corresponding to a number of historical data resource attributes;

[0022] Randomly selecting a plurality of data from the data corresponding to any one of the data fields as data to be matched;

[0023] Based on the data to be matched, and using a regular matching algorithm, content matching processing is performed in the template database to obtain a content matching result, wherein the content matching result includes resource data that is most similar to the data to be matched;

[0024] Determine whether the content matching result is empty;

[0025] If not, the data resource attribute corresponding to any one of the data fields is obtained based on the resource data in the content matching result that is most similar to the data to be matched.

[0026] In a possible design, if the content matching result is empty, the method further includes:

[0027] Performing a classified knowledge base query process to obtain a knowledge base query result, wherein the classified knowledge base contains a number of historical data fields and data resource attributes corresponding to each historical data field;

[0028] Determine whether the knowledge base query result is empty;

[0029] If yes, then the hot words of the data to be matched are determined by using the Bayesian average algorithm;

[0030] The hot words of the data to be matched are input into the classification model to obtain the data resource attributes corresponding to any data field, wherein the classification model is trained by taking the hot words of several sample data to be matched as input and the data resource attributes corresponding to each sample data to be matched as output.

[0031] In a possible design, sensitivity identification processing is performed on each data field to obtain the sensitivity of each data field after the sensitivity identification processing, including:

[0032] For any data field, extract the data corresponding to the any data field from the target data source, and randomly select a number of data from the extracted data to serve as conditional query information;

[0033] Using the conditional query information, performing conditional query processing in the target data source to obtain a conditional query result;

[0034] Based on the conditional query result, the sensitivity level of any data field is determined, so as to obtain the sensitivity of any data field according to the sensitivity level.

[0035] In a possible design, each data field is configured with corresponding annotation information, wherein the open attributes of each data field are obtained based on the organizational structure information in the data organization attribute, and the data resource attributes and sensitivity corresponding to each data field, including:

[0036] For any data field, configure an initial openness value for the any data field;

[0037] Performing word segmentation processing on the annotation information of any data field to obtain a plurality of words;

[0038] According to a number of words, the initial value of the openness is updated to obtain a first openness;

[0039] Based on the sensitivity corresponding to any one of the data fields, deriving a sensitivity level of any one of the data fields;

[0040] Using the sensitivity level, updating the first openness to obtain a second openness;

[0041] updating the second openness according to the organizational structure information to obtain a third openness;

[0042] Obtaining an openness scoring database and determining whether the openness scoring database is empty, wherein the openness scoring database stores historical openness attribute vectors and openness scores corresponding to a number of historical data fields;

[0043] If yes, then based on the third openness, the openness score of any data field is obtained; otherwise, the organizational structure information, and the data resource attributes and sensitivity levels corresponding to any data field are vector-encoded to obtain an open attribute vector after vector encoding;

[0044] Based on the open attribute vector, data matching is performed in the openness score database to obtain a historical open attribute vector that is most similar to the open attribute vector, and the openness score corresponding to the historical open attribute vector that is most similar to the open attribute vector is used as the openness score of any data field;

[0045] According to the openness score of any data field, the open attribute corresponding to any data field is obtained.

[0046] In a possible design, the initial value of the openness is updated according to a number of words to obtain a first openness, including:

[0047] Determine whether there are any words among the plurality of words that are identical or similar to the target word;

[0048] If yes, then the initial value of the openness is increased by a first preset score to obtain the first openness; otherwise, the initial value of the openness is directly used as the first openness;

[0049] The method of updating the first openness by using the sensitivity level to obtain the second openness includes:

[0050] Determining whether the sensitivity level is the first level, wherein the first level is used to indicate that the data corresponding to any one of the data fields is sensitive data;

[0051] If yes, then based on the first level, an updated score is calculated, and a difference between the first openness and the updated score is calculated, so as to use the difference as the second openness;

[0052] Correspondingly, updating the second openness according to the organizational structure information to obtain a third openness includes:

[0053] Obtaining an organizational structure tree, wherein the organizational structure tree is constructed in descending order of organizational structures;

[0054] Determine whether the organizational structure information matches the structure information corresponding to the target node in the organizational structure tree, wherein the target node is a terminal node in the organizational structure tree and a previous node of the terminal node;

[0055] If yes, then reducing the second openness by a second preset score to obtain a third openness; otherwise, determining whether the organizational structure information matches the structure information corresponding to the root node in the organizational structure tree;

[0056] If so, the second openness is increased by a second preset score to obtain a third openness; otherwise, the second openness is increased by a third preset score to obtain the third openness.

[0057] In a possible design, the target data source is further associated with data deployment information, wherein the data deployment information includes a data deployment location and a data interface type, and the open attribute corresponding to any data field includes an openness score;

[0058] Accordingly, a data attack surface risk assessment process is performed on the target data source to obtain the deployment risk of the target data source, including:

[0059] Calculate the deployment attack surface risk value of the target data source according to the data deployment location and the data interface type;

[0060] Based on the deployment attack surface risk value, deriving the deployment risk of the target data source;

[0061] Accordingly, based on the deployment risk of the target data source and the open attributes of each data field, each data field is graded to obtain a grading result of each data field, which includes:

[0062] For any data field, according to the deployment attack surface risk value and the openness score corresponding to the any data field, and using a weighted sum algorithm, a grading score corresponding to the any data field is calculated;

[0063] Based on the grading score corresponding to any one of the data fields, a grading result of any one of the data fields is obtained.

[0064] In a second aspect, a multi-dimensional data classification device is provided, comprising:

[0065] An acquisition unit, configured to acquire a target data source, wherein the target data source is structured data, the target data source includes a plurality of data fields, and each data field is respectively used to represent a header field in the structured data;

[0066] A sensitivity identification unit, configured to perform data resource attribute classification processing on each data field in the target data source to obtain the data resource attribute corresponding to each data field, and after obtaining the data resource attribute of each data field, perform sensitivity identification processing on each data field to obtain the sensitivity of each data field after the sensitivity identification processing;

[0067] An organization attribute extraction unit, used to determine the data organization attribute of the target data source, wherein the data organization attribute includes organization structure information;

[0068] An open attribute extraction unit, used to obtain the open attributes of each data field according to the organizational structure information in the data organization attribute, and the data resource attributes and sensitivity corresponding to each data field, wherein the open attribute of any data field is used to characterize the openness of the data corresponding to the any data field in the target data source;

[0069] A deployment risk assessment unit, configured to perform a data attack surface risk assessment process on the target data source to obtain a deployment risk of the target data source;

[0070] The grading unit is used to grade each data field based on the deployment risk of the target data source and the open attributes of each data field to obtain a grading result for each data field, so as to desensitize the data corresponding to each data field in the target data source according to the grading result of each data field.

[0071] In a third aspect, another multi-dimensional data classification device is provided. Taking the device as an electronic device as an example, the device includes a memory, a processor and a transceiver which are communicatively connected in sequence, wherein the memory is used to store computer programs, the transceiver is used to send and receive messages, and the processor is used to read the computer program to execute the multi-dimensional data classification method as described in the first aspect or any one of the possible designs in the first aspect.

[0072] In a fourth aspect, a storage medium is provided, on which instructions are stored. When the instructions are executed on a computer, the multi-dimensional data classification method as in the first aspect or any possible design of the first aspect is executed.

[0073] In a fifth aspect, a computer program product comprising instructions is provided, which, when executed on a computer, causes the computer to execute the multi-dimensional data classification method as described in the first aspect or any possible design of the first aspect.

[0074] Beneficial effects:

[0075] (1) The present invention classifies data from multiple dimensions, and when classifying, it takes into account the correlation between data and introduces deployment risk assessment; in this way, the accuracy of data importance classification can be improved, thereby providing an accurate data basis for subsequent desensitization work. Therefore, the present invention is very suitable for large-scale application and promotion.

[0076] (2) The present invention uses different intelligent classification algorithms for classification in different dimensions, thereby enhancing the rationality and effectiveness of intelligent classification.

[0077] (3) The present invention combines multiple dimensional factors to predict the classification of data fields, especially introducing the deployment attack surface dimension, thereby making the intelligent classification more scientific and reasonable. BRIEF DESCRIPTION OF THE DRAWINGS

[0078] Figure 1 A schematic diagram of the steps of the multi-dimensional data classification method provided by an embodiment of the present invention;

[0079] Figure 2 A schematic diagram of the structure of a multi-dimensional data classification device provided by an embodiment of the present invention;

[0080] Figure 3 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0081] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the present invention will be briefly introduced below in combination with the drawings and the description of the embodiments or the prior art. Obviously, the following description of the structure of the drawings is only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. It should be noted that the description of these embodiments is used to help understand the present invention, but does not constitute a limitation of the present invention.

[0082] It should be understood that although the terms first, second, etc. may be used herein to describe various units, these units should not be limited by these terms. These terms are only used to distinguish one unit from another unit. For example, a first unit can be referred to as a second unit, and similarly, a second unit can be referred to as a first unit without departing from the scope of the exemplary embodiments of the present invention.

[0083] It should be understood that the term "and / or" that may appear in this article is merely a description of the association relationship between associated objects, indicating that three relationships may exist. For example, A and / or B can represent three situations: A exists alone, B exists alone, and A and B exist at the same time. The term " / and" that may appear in this article describes another type of association object relationship, indicating that two relationships may exist. For example, A / and B can represent two situations: A exists alone, and A and B exist alone. In addition, the character " / " that may appear in this article generally indicates that the previous and next associated objects are in an "or" relationship.

[0084] Example:

[0085] See also Figure 1 As shown, the multi-dimensional data classification method provided in this embodiment performs data classification from three dimensions: data resource attributes, organizational attributes and open attributes. When classifying, the correlation between data is considered, and data deployment risk assessment is introduced; in this way, the accuracy of data importance classification can be improved, thereby providing an accurate data basis for subsequent desensitization work. Therefore, this method is very suitable for large-scale application and promotion; among them, for example, this method can be but not limited to running on the data classification end side, optionally, the data classification end can be but not limited to a personal computer (personal computer, PC), a tablet computer or a smart phone. It can be understood that the aforementioned execution subject does not constitute a limitation on the embodiments of the present application. Accordingly, the operation steps of this method can be but not limited to the following steps S1 to S6.

[0086] S1. Obtain a target data source, wherein the target data source is structured data, and the target data source includes multiple data fields, and each data field is used to represent a header field in the structured data; in this embodiment, the data field is the header in the structured data. If the target data source is enterprise personnel data, then the multiple data fields may be, but are not limited to, name, gender, age, email address, work number, etc. Of course, depending on the application scenario, the type of information contained in the target data source is different, and the corresponding data fields are also different, which are not described here one by one.

[0087] At the same time, when generating structured data, each data field is configured with corresponding annotation information, and the annotation information is an explanation of each data field; at the same time, the target data source of the example is also associated with data deployment information, wherein the data deployment information includes data deployment location and data interface type; further, the example data deployment location is whether to deploy to the intranet or the extranet, and the number of deployments in the intranet and / or the extranet, and the data interface type includes: whether it is an SSL interface and whether it supports http interface, etc.; of course, the deployment information can be specifically set according to actual use, and is not limited to the aforementioned examples.

[0088] In this way, after obtaining the target data source, data classification can be performed. In this embodiment, data classification is performed based on data resource attributes, organizational attributes and open attributes, combined with deployment risks; optionally, the classification of data resource attributes of each data field and the sensitivity identification process can be but is not limited to as shown in the following step S2.

[0089] S2. Performing data resource attribute classification processing on each data field in the target data source to obtain the data resource attribute corresponding to each data field, and after obtaining the data resource attribute of each data field, performing sensitivity identification processing on each data field to obtain the sensitivity of each data field after the sensitivity identification processing.

[0090] In this embodiment, there are many types of data resource attributes. Although each type has certain commonalities, the observation angle of each classification is different. Therefore, a single method is not sufficient to identify the classification of resource attributes. Based on this, this embodiment provides a multi-dimensional data resource identification and classification method, and takes any data field as an example for explanation. The process can be but is not limited to the following steps S201 to S204.

[0091] S201. Obtain a category vector library, wherein the category vector library contains data resource attributes corresponding to a number of historical data fields, and data resource attributes corresponding to annotation information of a number of historical data fields; in this embodiment, the category vector library can be pre-stored in the data classification end and can be called when used, and the historical data fields and various annotation information stored in the category vector library can be stored in vector form.

[0092] After the category vector library is obtained, attribute matching can be performed according to any data field or its corresponding annotation information, and the process can be but not limited to the following steps S202 to S204.

[0093] S202. For any data field, according to any data field or the annotation information corresponding to any data field, attribute matching processing is performed in the category vector library to obtain an attribute matching result; in this embodiment, any of the aforementioned data fields or the annotation information corresponding to the aforementioned data field can be converted into a vector, and then, based on the ANN (‌Approximate Nearest Neighbor)‌ vector retrieval technology, attribute matching processing is performed in the category vector library, that is, the historical data field corresponding to the any data field, or the annotation information of the historical data field corresponding to its corresponding annotation information is retrieved; of course, the aforementioned ANN vector retrieval technology is a commonly used technology for data matching, and its principle will not be repeated.

[0094] After completing the attribute matching and obtaining the attribute matching result, the digital resource attribute corresponding to any data field can be obtained based on the attribute matching result. The process can be but is not limited to the following steps S203 and S204.

[0095] S203. Determine whether the attribute matching result is empty.

[0096] S204. If not, then based on the attribute matching result, the data resource attribute corresponding to any one of the data fields is obtained; in the present embodiment, it has been explained above that the attribute matching result includes the historical data field corresponding to the any one of the data fields, or the annotation information of the historical data field corresponding to its corresponding annotation information, therefore, if the attribute matching result is not empty, then, the data resource attribute of the historical data field corresponding to the any one of the data fields, or the data resource attribute of the annotation information corresponding to the annotation information of the any one of the data fields, can be used as the data resource attribute of the any one of the data fields; for example, assuming that the data resource attribute corresponding to the most similar historical data field of data field A is name, then the data resource attribute of data field A is name; of course, the above is only for illustration, and the types of data resource attributes are not limited to this.

[0097] On the contrary, if the attribute matching result is empty, then another method needs to be used to classify the data resource attributes, and the process is shown in the following steps S205 to S209.

[0098] S205. Acquire a template database, wherein the template database contains resource data corresponding to a number of historical data resource attributes; in the present embodiment, the resource data corresponding to the historical data resource attribute is specific data content, for example, if the historical data resource attribute is an email address, then its corresponding resource data is various email addresses (such as QQ email addresses, corporate email addresses, 163 email addresses, etc.); for another example, if the historical data resource attribute is a name, then its corresponding resource data is the specific names of different people (such as Zhang San, Li Si, etc.); of course, when the historical data resource attribute is other types, its corresponding resource data will also change accordingly, which will not be elaborated here.

[0099] In this way, after the template database is obtained, content similarity matching can be performed in the template database according to the specific data content corresponding to any data field, and the matching process can be but is not limited to the following steps S206 to S209.

[0100] S206. Randomly select multiple data from the data corresponding to any of the data fields as the data to be matched; in the specific implementation, it has been explained above that the target data source is structured data, and each data field corresponds to a header field. Therefore, the target data source is equivalent to a table, and the data in the column where the header field is located is the data corresponding to the header field, that is, the data corresponding to any of the data fields.

[0101] Among them, for example, this embodiment randomly samples two data from the data corresponding to any data field as the data to be matched; then, based on the data to be matched, content similarity matching can be performed in the template database; optionally, the content similarity matching process can be but is not limited to the following steps S207 to S209.

[0102] S207. Based on the data to be matched and using a regular matching algorithm, content matching processing is performed in the template database to obtain a content matching result, wherein the content matching result includes resource data that is most similar to the data to be matched; in specific applications, it is equivalent to using a regular matching algorithm to find out the resource data in the template database that is most similar to the data to be matched; then, based on the found data, the data resource attribute corresponding to any of the aforementioned data fields is derived; in this embodiment, regular matching is a commonly used technology for data matching, and its principle is not repeated here.

[0103] After obtaining the content matching result, the data resource attribute corresponding to any of the aforementioned data fields can be obtained based on the result, and the process can be but not limited to the following steps S208 and S209.

[0104] S208. Determine whether the content matching result is empty; in this embodiment, if the content matching result is empty, it is necessary to perform attribute classification again, otherwise, execute the following step S209.

[0105] S209. If not, then based on the resource data in the content matching result that is most similar to the data to be matched, the data resource attribute corresponding to any one of the data fields is obtained; in the present embodiment, it is equivalent to using the historical data resource attribute corresponding to the resource data that is most similar to the data to be matched as the data resource attribute of the any one of the data fields; for example, if the resource data that is most similar to the data to be matched is xxx mailbox, then the data resource attribute corresponding to any one of the data fields is mailbox; at the same time, if there are multiple data to be matched, then they are selected according to the similarity, that is, the historical data resource attribute corresponding to the resource data that is most similar to the data to be matched is used as the data resource attribute of the any one of the data fields; of course, the above examples are only for illustration and are not limited to this.

[0106] Furthermore, if the content matching result is empty, it is necessary to execute the following steps S210 to S213 to classify the data resource attributes again.

[0107] S210. Perform classified knowledge base query processing to obtain knowledge base query results, wherein the classified knowledge base contains a number of historical data fields and data resource attributes corresponding to each historical data field; in this embodiment, the classified knowledge base is formed by recording the data resource attributes of each historical data field and the specific data content (such as the historical data field is an email address, then the specific data content is a specific email address) when classifying historical attributes; therefore, after obtaining the knowledge base query results, the corresponding classification method can be selected based on the knowledge base query results, and the process can be but not limited to the following steps S211 to S213.

[0108] S211. Determine whether the knowledge base query result is empty; in this embodiment, the knowledge base query result is empty, indicating that there are no classified historical data fields. At this time, it is necessary to use a model to classify data resource attributes, and the process can be but is not limited to the following steps S212 and S213.

[0109] S212. If yes, the Bayesian average algorithm is used to determine the hot words of the data to be matched. In the specific implementation, the Bayesian average method is a commonly used hot word ranking method, and its principle will not be repeated here. After the hot words of the data to be matched are determined based on the Bayesian average algorithm, the data resource attributes of any data field can be obtained based on the classification model. The process can be but not limited to the following step S213.

[0110] S213. Input the hot words of the data to be matched into the classification model to obtain the data resource attribute corresponding to any data field, wherein the classification model is trained by taking the hot words of several sample data to be matched as input and the data resource attribute corresponding to each sample data to be matched as output; in the specific implementation, the classification model is taken as an example of the Attention-GRU-Adaboost model (i.e., a classification model combining the attention mechanism-based gated recurrent unit (Attention-GRU) and the Adaboost algorithm), that is, the attention mechanism is introduced into the GRU network, and the Attention-GRU model is integrated through the Adaboost algorithm, and the training process is as follows:

[0111] (1) Data preprocessing: Normalize and standardize the input data to ensure that the data is distributed within a similar range. The input data is the data to be matched for each sample and the corresponding label data, and the label data is the real data resource data of the data to be matched for each sample.

[0112] (2) Attention-GRU model training: The attention mechanism is introduced into the GRU network to train the Attention-GRU model. During the training process, the model parameters are updated through the back-propagation algorithm so that the model can learn the attention weights of important features in the input sequence. At the same time, multiple Attention-GRU models are trained, where each model is trained on a different subset of the training set. After the training, these Attention-GRU models are used as weak classifiers.

[0113] (3) Adaboost ensemble: According to the Adaboost algorithm, weak classifiers are weighted and combined to generate strong classifiers; among them, weak classifiers with larger weights have greater influence in the final decision.

[0114] In this way, after training the classification model in the above manner, the hot words of the above-mentioned data to be matched are input into the model, and the data resource attributes corresponding to any of the data fields can be obtained; that is, the new data is classified using the strong classifier in the model to obtain the corresponding data resource attributes.

[0115] Of course, if the knowledge base query result is not empty, that is, there is a classified knowledge base, then based on the data to be matched, directly find the data content most similar to the data to be matched in the classified knowledge base, and then use the data resource attribute of the historical data field corresponding to the data content most similar to the data to be matched as the data resource attribute of any data field.

[0116] In this way, through the aforementioned steps S201 to S213, the classification of the data resource attributes of each data field can be achieved, so as to obtain the data resource attributes corresponding to each data field, that is, to obtain the specific data meaning of each data field, such as whether it represents name, email address, gender, age or other meanings; based on this, different classification methods can be used to improve the accuracy of resource attribute classification.

[0117] Furthermore, after obtaining the data resource attributes corresponding to each data field, sensitivity identification can be performed on each data field; wherein, taking any data field as an example, the sensitivity identification process is explained, which can be but is not limited to the following steps S214 to S216.

[0118] S214. For any data field, the data corresponding to the any data field is extracted from the target data source, and a number of data are randomly selected from the extracted data to serve as conditional query information; in this embodiment, a number of data are randomly selected from the target data source and from the data in the column where the any data field is located to serve as conditional query information; for example, if the any data field is an email address, then in the example of the email address, several specific email addresses are randomly selected to serve as conditional query information; of course, when the any data field is other types, the process of generating the conditional query information is consistent with the above example and will not be repeated here.

[0119] After obtaining the conditional query information, data query can be performed in the target data source based on the conditional query information, so as to obtain the sensitivity of any data field based on the query result; wherein, the data query process is shown in the following step S215.

[0120] S215. Using the conditional query information, conditional query processing is performed in the target data source to obtain a conditional query result. In a specific application, after obtaining the conditional query result, the sensitivity of any data field can be derived based on the conditional query result. The process is shown in the following step S216.

[0121] S216. Based on the conditional query result, determine the sensitivity level of any data field, so as to obtain the sensitivity of any data field according to the sensitivity level; in specific implementation, if the conditional query result is only one piece of data, then the sensitivity level of any data field is the first level (the first level can be set to 3, that is, sensitive data); otherwise, it is the second level (the second level can be set to 2, that is, non-sensitive data); of course, the value of the specific sensitivity level can be set according to actual use, and is limited to the aforementioned example.

[0122] After obtaining the sensitivity level, the sensitivity of any data field can be derived based on the sensitivity level, that is, if the sensitivity level is the first level, then the sensitivity is sensitive, otherwise, if it is the second level, it is non-sensitive.

[0123] Thus, through the aforementioned steps S201 to S216, the classification and sensitivity identification of the data resource attributes of each data field can be completed; then, this embodiment introduces the data organization attributes of the target data source into the data classification process, so as to be subsequently combined with the aforementioned data resource attributes and sensitivity to predict the open attributes of each data field; wherein, the determination process of the data organization attributes can be, but is not limited to, as shown in the following step S3,

[0124] S3. Determine the data organization attributes of the target data source, wherein the data organization attributes include organizational structure information. In specific implementation, for example, when generating the target data source (that is, generating structured data), the target data source will be configured with initial organization attributes. For example, if the target data source is the enterprise personnel data of the xx department, then the configured initial organization attributes are the structure information of the xx department. For another example, if the target data source is the financial data of the A department, then its initial organization attributes are the organizational structure of the A department. Thus, in actual use, first determine whether the target data source is configured with initial organization attributes. If so, search in the organization attribute database based on the configured initial organization attributes (of course, ANN vector retrieval technology can also be used) to obtain the organization attributes that best match the initial organization attributes, thereby serving as the data organization attributes of the target data source.

[0125] Among them, several historical organizational attributes are stored in the organizational attribute database, and each historical organizational data contains organizational structure information; thus, based on transforming the configured initial organizational attributes into vectors, the ANN vector retrieval technology can be used to find the historical organizational attributes that best match it, thereby obtaining the corresponding organizational structure information.

[0126] Of course, if the initial organization attributes are not configured, or the historical organization attributes corresponding to the initial organization attributes cannot be found in the organization attribute database, then the following step S4 is directly executed.

[0127] S4. According to the organizational structure information in the data organization attribute, and the data resource attribute and sensitivity corresponding to each data field, the open attribute of each data field is obtained, wherein the open attribute of any data field is used to characterize the openness of the data corresponding to the any data field in the target data source; in this embodiment, the openness of any data field can be measured by an openness score, and the openness can be: public data (openness score is 90-100 points), internal data (openness score is 11-89 points), confidential data (openness score is 0-10 points); in this way, the openness of each data field can be evaluated according to the open attribute.

[0128] In a specific application, any data field is taken as an example for explanation, and the process may be but is not limited to the following steps S401 to S410.

[0129] S401. For any data field, configure an initial value of openness for the data field; in specific implementation, for example, the initial value of openness can be but not limited to 10. Of course, the initial value can be specifically set according to actual use and is not limited to the above example.

[0130] After the initial value of the openness is obtained, the initial value of the openness can be updated according to the annotation information of any data field, and the process can be but not limited to the following steps S402 and S403.

[0131] S402. Perform word segmentation processing on the annotation information of any of the data fields to obtain a number of words. In this embodiment, NLP (Natural Language Processing) technology can be used to perform word segmentation processing on the aforementioned annotation information to obtain a number of words. Of course, NLP is a commonly used technology for text processing, and its principle will not be repeated here.

[0132] After completing the word segmentation processing of the annotation information of any data field, the initial value of the openness can be updated according to the word segmentation result, and the process is shown in the following step S403.

[0133] S403. Update the initial value of the openness according to a number of words to obtain a first openness; in specific applications, for example, but not limited to, first determine whether there are words that are the same or similar to the target words among the several words; wherein the target words may include, but are not limited to, words such as public, published, and open, that is, words with the meaning of public, or words similar thereto.

[0134] In this way, if there are words that are the same or similar to the target word among the aforementioned words, it is necessary to increase the initial value of the openness by the first preset score to obtain the first openness, otherwise, the initial value of the openness is directly used as the first openness; optionally, the first preset score can be but is not limited to 80, that is, when there are words that are the same or similar to the target word among the aforementioned words, the first openness is: 10+80=90; otherwise, the first openness is 10.

[0135] In this way, after the initial value of the openness is updated, the first openness can be updated according to the sensitivity obtained in the aforementioned step S2, and the process can be but not limited to the following steps S404 and S405.

[0136] S404. Based on the sensitivity corresponding to any of the data fields, the sensitivity level of any of the data fields is obtained. In the present embodiment, it has been explained above that the sensitivity is determined based on the sensitivity level. Therefore, the corresponding sensitivity level can also be obtained based on the sensitivity. Then, the first openness can be updated based on the sensitivity level. The process can be, but is not limited to, as shown in the following step S405.

[0137] S405. Using the sensitivity level, update the first openness to obtain the second openness. In specific implementation, for example, but not limited to, first determine whether the sensitivity level is the first level (the first level is used to characterize that the data corresponding to any data field is sensitive data); if so, calculate the update score based on the first level, and calculate the difference between the first openness and the update score, so as to use the difference as the second openness. For example, assuming that the sensitivity level of any data field is 3 (that is, it belongs to the first level), then multiply the sensitivity level by 20 as the update score, that is, the update score is: 20×3=60; at this time, the second openness is: the first openness minus 60.

[0138] Similarly, when the sensitivity level of any data field is the second level (that is, the sensitivity level is 2, which is non-sensitive data), the same method is used to calculate the update score (that is, 20×2=40); then, the first openness is added to the update score to obtain the second openness.

[0139] Thus, after the second openness is obtained through the aforementioned step S405, the second openness can be updated based on the organizational structure information obtained in the aforementioned step S3, and the process is shown in the following step S406.

[0140] S406. Update the second openness according to the organizational structure information to obtain a third openness. In this embodiment, the third openness can be obtained by, for example but not limited to, the following steps.

[0141] Step 1: Obtain the organizational structure tree, wherein the organizational structure tree is constructed in descending order of the organizational structure; in specific implementation, the root node (i.e., the vertex of the tree) of the organizational structure tree is the highest position (such as the chairman), and the next node of the chairman can be the general manager, and the leaf nodes of the general manager can be the administrative director, accounting director, operations director, and marketing director, etc. The leaf nodes under each director are the corresponding departments, the leaf nodes under each department are the corresponding groups, and the leaf nodes corresponding to each department are the department individuals; of course, the organizational structure tree is also pre-constructed and stored in the data classification end, and different companies have different organizational structure trees, which will not be described here one by one.

[0142] Thus, after obtaining the organizational structure tree, the second openness can be updated according to the organizational structure information of the target data source, and the process can be but not limited to the following second to fourth steps.

[0143] Step 2: Determine whether the organizational structure information matches the structure information corresponding to the target node in the organizational structure tree, wherein the target node is the terminal node in the organizational structure tree, and the previous node of the terminal node; in this embodiment, it is to determine whether the organizational structure information is at the end or the second end of the organizational structure tree. For example, assuming that the organizational structure information is the financial department, and the terminal node of the organizational structure information is an individual, it must not match the structure information corresponding to the terminal node or the previous node of the terminal node; at this time, it is necessary to execute the following third step.

[0144] Similarly, if the organizational structure information is xx personnel of xx group in the finance department, then it matches the structure information corresponding to the terminal node. At this time, it is necessary to reduce the second degree of openness, and the process is shown in the third step below.

[0145] Step 3: If yes, then reduce the second openness by a second preset score to obtain a third openness; otherwise, determine whether the organizational structure information matches the structure information corresponding to the root node in the organizational structure tree; in specific implementation, the second preset score is 20 for example; at the same time, if the organizational structure information does not match the structure information corresponding to the target node, then it is necessary to determine whether it matches the structure information corresponding to the root node (that is, the structure information corresponding to the first node of the organizational structure tree); if it matches, then it is necessary to increase the second preset score on the basis of the second openness; otherwise, then it is necessary to increase the third preset score, and the process may be but is not limited to as shown in the following step 4.

[0146] Step 4: If yes, then increase the second openness by a second preset value to obtain a third openness; otherwise, increase the second openness by a third preset value to obtain the third openness; in this embodiment, the second preset value is 20, and the third preset value is 10.

[0147] In addition, in this embodiment, if the initial organizational attribute is not configured in the aforementioned step S3, then the third preset score is directly added to the second openness to obtain the third openness.

[0148] After the second openness is updated based on the organizational structure information through the aforementioned step S406, it can be determined whether there is an openness score database, so as to obtain the final openness score based on the determination result; wherein, the specific acquisition process of the openness score can be but is not limited to the following steps S407 to S409.

[0149] S407. Obtain an openness score database and determine whether the openness score database is empty, wherein the openness score database stores historical open attribute vectors and openness scores corresponding to a number of historical data fields; in this embodiment, the openness score database is recorded in the process of historical data classification; in this way, the final openness score of any data field can be obtained based on whether the openness score data exists.

[0150] Furthermore, if there is data in the openness score database, then the following step S408 needs to be executed.

[0151] S408. If yes, then based on the third openness, the openness score of any data field is obtained; otherwise, the organizational structure information, as well as the data resource attributes and sensitivity levels corresponding to any data field are vector-encoded to obtain an open attribute vector after vector encoding; in this embodiment, if no data is recorded in the openness scoring database, then the third openness is directly used as the openness score, that is, if it is greater than 100, the value is 100, and if it is less than 0, the value is 0; otherwise, the aforementioned data is vector-converted to obtain a vector encoding, so as to use it as an open attribute vector; then, based on the open attribute vector, vector matching can be performed in the aforementioned openness scoring database to obtain the openness score of any data field based on the vector matching result; wherein the matching process is shown in the following step S409.

[0152] S409. Based on the open attribute vector, data matching is performed in the openness score database to obtain the historical open attribute vector that is most similar to the open attribute vector, and the openness score corresponding to the historical open attribute vector that is most similar to the open attribute vector is used as the openness score of any data field; in this embodiment, ANN vector retrieval technology can also be used as an example to obtain the historical open attribute that is most similar to the open attribute vector, and then the openness score corresponding to the historical open attribute that is most similar to the open attribute vector can be used as the final openness score of any data field.

[0153] Thus, after obtaining the openness score of any data field, the openness attribute of any data field can be obtained based on the score, and the process is shown in the following step S410.

[0154] S410. Based on the openness score of any data field, the openness attribute corresponding to any data field is obtained; in this embodiment, the openness score is used to classify the data corresponding to any data field into public data, internal data or confidential data, so that data classification can be performed based on the openness attribute later.

[0155] Therefore, through the aforementioned steps S401 to S410, the open attributes of each data field can be determined; then, this embodiment also needs to perform a data attack surface risk assessment of the target data source based on the deployment scenario, so as to subsequently introduce it into the data classification process, thereby improving the accuracy of the classification; wherein, the specific process of the data attack surface risk assessment can be but is not limited to as shown in the following step S5.

[0156] S5. Perform data attack surface risk assessment on the target data source to obtain the deployment risk of the target data source. In the specific implementation, it has been explained above that the target data source is also associated with data deployment information, and the data deployment information includes data deployment location and data interface type. The data deployment location is whether it is deployed to an intranet or an extranet, and the number of intranets and / or extranets deployed. The data interface type includes whether it is an SSL interface and whether it supports http interface, etc. Therefore, for example, it can be but not limited to calculating the deployment attack surface risk value of the target data source based on the data deployment location and the data interface type. Then, based on the deployment attack surface risk value, the deployment risk of the target data source is obtained.

[0157] Specifically, if the data interface is an SSL interface, its contribution value is 60, otherwise it is not included in the risk calculation; similarly, if the data interface is an http interface, its contribution value is 20, otherwise it is also not included in the risk calculation.

[0158] Based on this, the specific calculation formula for the deployment attack surface risk value can be, but is not limited to,:

[0159] R=20×number of intranets+40×number of extranets-SSL interface contribution value+http interface contribution value.

[0160] The larger R is, the higher the deployment risk is. Therefore, the deployment attack surface risk value can be directly used as the deployment risk of the target data source.

[0161] Thus, after the deployment risk of the target data source is obtained through the aforementioned step S5, a hierarchical processing can be performed in combination with the open attributes of the aforementioned data fields, and the process can be but is not limited to that shown in the following step S6.

[0162] S6. Based on the deployment risk of the target data source and the open attributes of each data field, each data field is graded to obtain a grading result for each data field, so that the data corresponding to each data field in the target data source is desensitized according to the grading result of each data field; in the specific implementation, any data field is still taken as an example for explanation, and the example may be but not limited to first calculating the grading score corresponding to any data field according to the deployment attack surface risk value and the openness score corresponding to any data field, and using a weighted sum algorithm; and then, based on the grading score corresponding to any data field, the grading result of any data field is obtained.

[0163] Specifically, the calculation formula for the grading score is:

[0164] G=w1×(100-X)+w2×R, clock, G is the grading score, X is the openness score, w1 is the weight of the open attribute, w2 is the deployment risk weight, and the values ​​of the two can be but are not limited to 0.8 and 0.2; of course, the above weights can be adjusted according to actual use.

[0165] Based on this, after calculating the grading score of each data field through the above formula, the grading result of each data field can be obtained based on the grading score; among them, level 1 is 0-20, level 2 is 20-40, level 3 is 40-60, level 4 is 60-80, and level 5 is 80-100; therefore, the corresponding grading result can be obtained by matching according to the grading score, and the higher the grading result, the higher the importance of the data; in this way, the third to fifth levels can be regarded as data that needs to be desensitized, and the first two levels can be regarded as non-desensitized data; thus, the data in the target data source can be desensitized according to the aforementioned grading results; for example, the data field of employee number has a grading result of the fifth level, then all data in the employee number column needs to be desensitized; of course, the aforementioned example is only for illustration and is not limited to this.

[0166] At the same time, for example, but not limited to the use of hash algorithms, mask algorithms, encryption algorithms, etc., the data corresponding to the third to fifth levels can be desensitized; of course, the data corresponding to the third to fifth levels can also be noised to achieve data desensitization; of course, the above examples are only illustrative and are not limited to this.

[0167] In addition, after obtaining the grading results of each data field, manual verification can be performed and the verification results can be returned; then, the verification results can be used to perform feedback reinforcement learning on the aforementioned grading algorithm to continuously improve the accuracy of grading during use.

[0168] Therefore, through the multi-dimensional data classification method described in detail in the aforementioned steps S1 to S6, the present invention classifies data from three dimensions: data resource attributes, organizational attributes, and open attributes. When classifying, the correlation between data is considered, and data deployment risk assessment is introduced; in this way, the accuracy of data importance classification can be improved, thereby providing an accurate data basis for subsequent desensitization work. Therefore, the present invention is very suitable for large-scale application and promotion.

[0169] like Figure 2 As shown, the second aspect of this embodiment provides a hardware device for implementing the multi-dimensional data classification method described in the first aspect of the embodiment, including:

[0170] The acquisition unit is used to acquire a target data source, wherein the target data source is structured data, the target data source includes a plurality of data fields, and each data field is used to represent a header field in the structured data.

[0171] The sensitivity identification unit is used to perform data resource attribute classification processing on each data field in the target data source to obtain the data resource attributes corresponding to each data field, and after obtaining the data resource attributes of each data field, perform sensitivity identification processing on each data field to obtain the sensitivity of each data field after the sensitivity identification processing.

[0172] The organization attribute extraction unit is used to determine the data organization attribute of the target data source, wherein the data organization attribute includes organization structure information.

[0173] The open attribute extraction unit is used to obtain the open attributes of each data field based on the organizational structure information in the data organization attributes, and the data resource attributes and sensitivity corresponding to each data field, wherein the open attribute of any data field is used to characterize the openness of the data corresponding to any data field in the target data source.

[0174] The deployment risk assessment unit is used to perform data attack surface risk assessment processing on the target data source to obtain the deployment risk of the target data source.

[0175] The grading unit is used to grade each data field based on the deployment risk of the target data source and the open attributes of each data field to obtain a grading result for each data field, so as to desensitize the data corresponding to each data field in the target data source according to the grading result of each data field.

[0176] The working process, working details and technical effects of the device provided in this embodiment can be found in the first aspect of the embodiment and will not be described in detail here.

[0177] like Figure 3 As shown, the third aspect of this embodiment provides another multi-dimensional data classification device, taking the device as an electronic device as an example, comprising: a memory, a processor and a transceiver that are communicatively connected in sequence, wherein the memory is used to store computer programs, the transceiver is used to send and receive messages, and the processor is used to read the computer program to execute the multi-dimensional data classification method as described in the first aspect of the embodiment.

[0178] For example, the memory may include, but is not limited to, random access memory (RAM), read only memory (ROM), flash memory, first input first output (FIFO) and / or first in last out (FILO), etc. Specifically, the processor may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor may be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). At the same time, the processor may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state.

[0179] In some embodiments, the processor may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. For example, the processor may not be limited to a microprocessor of the STM32F105 series, a reduced instruction set computer (RISC) microprocessor, an X86 architecture processor, or a processor with an integrated embedded neural network processing unit (NPU); the transceiver may be, but is not limited to, a wireless fidelity (WIFI) wireless transceiver, a Bluetooth wireless transceiver, a General Packet Radio Service (GPRS) wireless transceiver, a ZigBee protocol (a low-power LAN protocol based on the IEEE802.15.4 standard, ZigBee) wireless transceiver, a 3G transceiver, a 4G transceiver, and / or a 5G transceiver. In addition, the device may also include, but is not limited to, a power module, a display screen, and other necessary components.

[0180] The working process, working details and technical effects of the electronic device provided in this embodiment can be found in the first aspect of the embodiment and will not be described in detail here.

[0181] The fourth aspect of this embodiment provides a storage medium that stores instructions including the multi-dimensional data classification method described in the first aspect of the embodiment, that is, the storage medium stores instructions, and when the instructions are run on a computer, the multi-dimensional data classification method described in the first aspect of the embodiment is executed.

[0182] The storage medium refers to a carrier for storing data, which may include but is not limited to a floppy disk, a CD, a hard disk, a flash memory, a USB flash drive and / or a memory stick, and the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.

[0183] The working process, working details and technical effects of the storage medium provided in this embodiment can be found in the first aspect of the embodiment and will not be described in detail here.

[0184] The fifth aspect of this embodiment provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the multi-dimensional data classification method as described in the first aspect of the embodiment, wherein the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device.

[0185] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A multi-dimensional data classification method, characterized in that: include: Acquire a target data source, wherein the target data source is structured data, the target data source includes a plurality of data fields, and each data field is used to represent a header field in the structured data; Performing data resource attribute classification processing on each data field in the target data source to obtain data resource attributes corresponding to each data field, and after obtaining the data resource attributes of each data field, performing sensitivity identification processing on each data field to obtain the sensitivity of each data field after the sensitivity identification processing; Determining data organization attributes of the target data source, wherein the data organization attributes include organizational structure information; According to the organizational structure information in the data organization attribute, and the data resource attribute and sensitivity corresponding to each data field, the open attribute of each data field is obtained, wherein the open attribute of any data field is used to characterize the openness of the data corresponding to the any data field in the target data source; Performing data attack surface risk assessment on the target data source to obtain a deployment risk of the target data source; Based on the deployment risk of the target data source and the open attributes of each data field, each data field is graded to obtain a grading result for each data field, so that the data corresponding to each data field in the target data source is desensitized according to the grading result of each data field.

2. The method according to claim 1, characterized in that Each data field is configured with corresponding annotation information, wherein data resource attribute classification processing is performed on each data field in the target data source to obtain data resource attributes corresponding to each data field, including: Acquire a category vector library, wherein the category vector library contains data resource attributes corresponding to a number of historical data fields and data resource attributes corresponding to annotation information of a number of historical data fields; For any data field, according to the any data field or the annotation information corresponding to the any data field, an attribute matching process is performed in the category vector library to obtain an attribute matching result; Determine whether the attribute matching result is empty; If not, the data resource attribute corresponding to any one of the data fields is obtained based on the attribute matching result.

3. The method according to claim 2, characterized in that If the attribute matching result is empty, the method further includes: Acquire a template database, wherein the template database contains resource data corresponding to a number of historical data resource attributes; Randomly selecting a plurality of data from the data corresponding to any one of the data fields as data to be matched; Based on the data to be matched, and using a regular matching algorithm, content matching processing is performed in the template database to obtain a content matching result, wherein the content matching result includes resource data that is most similar to the data to be matched; Determine whether the content matching result is empty; If not, the data resource attribute corresponding to any one of the data fields is obtained based on the resource data in the content matching result that is most similar to the data to be matched.

4. The method according to claim 3, characterized in that If the content matching result is empty, the method further includes: Performing a classified knowledge base query process to obtain a knowledge base query result, wherein the classified knowledge base contains a number of historical data fields and data resource attributes corresponding to each historical data field; Determine whether the knowledge base query result is empty; If yes, then the hot words of the data to be matched are determined by using the Bayesian average algorithm; The hot words of the data to be matched are input into the classification model to obtain the data resource attributes corresponding to any data field, wherein the classification model is trained by taking the hot words of several sample data to be matched as input and the data resource attributes corresponding to each sample data to be matched as output.

5. The method according to claim 1, performing sensitivity identification processing on each data field to obtain the sensitivity of each data field after the sensitivity identification processing, comprising: For any data field, extract the data corresponding to the any data field from the target data source, and randomly select a number of data from the extracted data to serve as conditional query information; Using the conditional query information, performing conditional query processing in the target data source to obtain a conditional query result; Based on the conditional query result, the sensitivity level of any data field is determined, so as to obtain the sensitivity of any data field according to the sensitivity level.

6. The method according to claim 1, characterized in that Each data field is configured with corresponding annotation information, wherein the open attributes of each data field are obtained based on the organizational structure information in the data organization attribute, and the data resource attributes and sensitivity corresponding to each data field, including: For any data field, configure an initial openness value for the any data field; Performing word segmentation processing on the annotation information of any data field to obtain a plurality of words; According to a number of words, the initial value of the openness is updated to obtain a first openness; Based on the sensitivity corresponding to any one of the data fields, deriving a sensitivity level of any one of the data fields; Using the sensitivity level, updating the first openness to obtain a second openness; updating the second openness according to the organizational structure information to obtain a third openness; Obtaining an openness scoring database and determining whether the openness scoring database is empty, wherein the openness scoring database stores historical openness attribute vectors and openness scores corresponding to a number of historical data fields; If yes, then based on the third openness, the openness score of any data field is obtained; otherwise, the organizational structure information, and the data resource attributes and sensitivity levels corresponding to any data field are vector-encoded to obtain an open attribute vector after vector encoding; Based on the open attribute vector, data matching is performed in the openness score database to obtain a historical open attribute vector that is most similar to the open attribute vector, and the openness score corresponding to the historical open attribute vector that is most similar to the open attribute vector is used as the openness score of any data field; According to the openness score of any data field, the open attribute corresponding to any data field is obtained.

7. The method according to claim 6, characterized in that According to a plurality of words, the initial value of the openness is updated to obtain a first openness, including: Determine whether there are any words among the plurality of words that are identical or similar to the target word; If yes, then the initial value of the openness is increased by a first preset score to obtain the first openness; otherwise, the initial value of the openness is directly used as the first openness; The method of updating the first openness by using the sensitivity level to obtain the second openness includes: Determining whether the sensitivity level is the first level, wherein the first level is used to indicate that the data corresponding to any one of the data fields is sensitive data; If yes, then based on the first level, an updated score is calculated, and a difference between the first openness and the updated score is calculated, so as to use the difference as the second openness; Correspondingly, updating the second openness according to the organizational structure information to obtain a third openness includes: Obtaining an organizational structure tree, wherein the organizational structure tree is constructed in descending order of organizational structures; Determine whether the organizational structure information matches the structure information corresponding to the target node in the organizational structure tree, wherein the target node is a terminal node in the organizational structure tree and a previous node of the terminal node; If yes, then reducing the second openness by a second preset score to obtain a third openness; otherwise, determining whether the organizational structure information matches the structure information corresponding to the root node in the organizational structure tree; If so, the second openness is increased by a second preset score to obtain a third openness; otherwise, the second openness is increased by a third preset score to obtain the third openness.

8. The method according to claim 1, characterized in that The target data source is also associated with data deployment information, wherein the data deployment information includes a data deployment location and a data interface type, and the open attribute corresponding to any data field includes an openness score; Accordingly, a data attack surface risk assessment process is performed on the target data source to obtain the deployment risk of the target data source, including: Calculate the deployment attack surface risk value of the target data source according to the data deployment location and the data interface type; Based on the deployment attack surface risk value, deriving the deployment risk of the target data source; Accordingly, based on the deployment risk of the target data source and the open attributes of each data field, each data field is graded to obtain a grading result of each data field, which includes: For any data field, according to the deployment attack surface risk value and the openness score corresponding to the any data field, and using a weighted sum algorithm, a grading score corresponding to the any data field is calculated; Based on the grading score corresponding to any of the data fields, a grading result of any of the data fields is obtained.

9. A multi-dimensional data classification device, characterized in that: include: An acquisition unit, configured to acquire a target data source, wherein the target data source is structured data, the target data source includes a plurality of data fields, and each data field is respectively used to represent a header field in the structured data; A sensitivity identification unit, configured to perform data resource attribute classification processing on each data field in the target data source to obtain the data resource attribute corresponding to each data field, and after obtaining the data resource attribute of each data field, perform sensitivity identification processing on each data field to obtain the sensitivity of each data field after the sensitivity identification processing; An organization attribute extraction unit, used to determine the data organization attribute of the target data source, wherein the data organization attribute includes organization structure information; An open attribute extraction unit, used to obtain the open attributes of each data field according to the organizational structure information in the data organization attribute, and the data resource attributes and sensitivity corresponding to each data field, wherein the open attribute of any data field is used to characterize the openness of the data corresponding to the any data field in the target data source; A deployment risk assessment unit, used to perform a data attack surface risk assessment process on the target data source to obtain a deployment risk of the target data source; The grading unit is used to grade each data field based on the deployment risk of the target data source and the open attributes of each data field to obtain a grading result for each data field, so as to desensitize the data corresponding to each data field in the target data source according to the grading result of each data field.

10. An electronic device, characterized in that: include: A memory, a processor and a transceiver that are sequentially connected in communication, wherein the memory is used to store computer programs, the transceiver is used to send and receive messages, and the processor is used to read the computer program, and execute the multi-dimensional data classification method as described in any one of claims 1 to 8.

Images