Risk assessment method, device, equipment and medium

Abstract

The invention discloses a risk assessment method and device, equipment and a medium, and relates to the field of data security, and the method comprises the steps: determining a plurality of first attributes belonging to quasi identifiers and a plurality of second attributes belonging to identifiers and sensitive attributes from target attributes of desensitized data based on the industry sensitivity level standard of the industry where the desensitized data is located; the desensitized data is data obtained by desensitizing the original data; determining a data uniqueness degree value and a data complementation degree value of all data of each first attribute compared with all data of other first attributes; determining a data matching degree value between all data of each second attribute in the original data and all data of the second attribute in the desensitized data; and evaluating a risk degree value of the desensitized data based on the data uniqueness degree value, the data complementation degree value and the data matching degree value. Quantitative risk assessment can be carried out on the released desensitization data.

Description

Technical Field

[0001] The present invention relates to the field of data security, and in particular to a risk assessment method, device, equipment and medium. Background Art

[0002] At present, with the rapid development of high-tech such as data mining in recent years, the discovery of a large number of new knowledge has greatly promoted human social civilization, which has given the dissemination of information a deeper meaning. However, due to the lack of relevant mechanisms to constrain, the public release of information has caused a large amount of personal privacy to be leaked unconsciously, bringing potential security risks to the owners of private information.

[0003] Data owners randomly spread user information on the Internet, which contains personal privacy data and sensitive data, which will inevitably bring immeasurable security risks to our future work and life. Therefore, with the rise of the information age, people pay more and more attention to privacy security, and the information security issues in the information release link have also received widespread attention from all walks of life, and relevant laws and regulations are constantly being introduced. On this basis, it is also necessary to conduct data privacy leakage risk assessment on the data released after desensitization. The existing risk assessment is based on link analysis attack methods, and there is no quantitative assessment of the leakage degree.

[0004] In summary, how to conduct quantitative risk assessment on the published desensitized data is an urgent problem that needs to be solved. Summary of the invention

[0005] In view of this, the purpose of the present invention is to provide a risk assessment method, device, equipment and medium, which can perform quantitative risk assessment on the published desensitized data. The specific scheme is as follows:

[0006] In a first aspect, the present application discloses a risk assessment method, comprising:

[0007] Based on the industry sensitivity level standard of the industry in which the desensitized data belongs, several first attributes belonging to quasi-identifiers and several second attributes belonging to identifiers and sensitive attributes are determined from each target attribute of the desensitized data; the desensitized data is data obtained after desensitizing the original data;

[0008] Determine a data uniqueness value of each of the data of the first attribute compared with all of the data of other first attributes, and determine a data complementarity value between each of the data of the first attribute and all of the data of other first attributes;

[0009] Determine a data matching degree value between all data of each second attribute in the original data and all data of the second attribute in the desensitized data;

[0010] The risk level of the desensitized data is evaluated based on the data uniqueness level, the data complementarity level and the data matching level.

[0011] Optionally, the determining of a data uniqueness value of all data of each first attribute compared with all data of other first attributes includes:

[0012] Based on the information entropy calculation method, a data uniqueness value of all the data of each first attribute compared with all the data of other first attributes is determined.

[0013] Optionally, the method of calculating the information entropy to determine the data uniqueness value of all the data of each first attribute compared with all the data of other first attributes includes:

[0014] Determine a first information entropy corresponding to all data of each of the first attributes;

[0015] Determine a second information entropy of all data of each first attribute associated with all other data of the first attribute;

[0016] Calculate the difference between the second information entropy and the first information entropy corresponding to all data of each first attribute to obtain an information entropy difference;

[0017] The ratio of the information entropy difference corresponding to all the data of each first attribute to the first information entropy is calculated to determine the data uniqueness degree of all the data of each first attribute compared with all the data of other first attributes.

[0018] Optionally, determining a data complementarity value between all data of each first attribute and all data of other first attributes includes:

[0019] Determine a reference number of first attributes corresponding to each first attribute, in which all data of the first attribute corresponding to the first attribute have a data complementary relationship with all data of other first attributes; the data complementary relationship indicates that data of one first attribute and data of another first attribute in the same group can be combined to obtain data with complete meaning;

[0020] The ratio of the reference quantity corresponding to each first attribute to the target quantity is calculated to obtain a data complementarity degree value between all the data of each first attribute and all the data of other first attributes; the target quantity is the difference between the total attribute quantity of the first attribute and 1.

[0021] Optionally, determining a data matching degree value between all data of each second attribute in the original data and all data of the second attribute in the desensitized data includes:

[0022] Calculate the target distance between each data corresponding to each second attribute in the original data and the data corresponding to the second attribute in the desensitized data;

[0023] Calculate the average distance of the target distance of all data corresponding to each of the second attributes;

[0024] The difference between 1 and each of the average distances is calculated to obtain a data matching degree value between all the data of each of the second attributes in the original data and all the data of the second attribute in the desensitized data.

[0025] Optionally, calculating a target distance between each data corresponding to each second attribute in the original data and the data corresponding to the second attribute in the desensitized data includes:

[0026] If the original data is obtained, calculating the Hamming code distance between each data corresponding to each second attribute in the original data and the data corresponding to the second attribute in the desensitized data;

[0027] Determine a first data length of each data corresponding to each second attribute in the original data, and a second data length of each data corresponding to each second attribute in the desensitized data, and select a longest data length of each data corresponding to each second attribute from the first data length and the second data length;

[0028] Calculate the ratio of the Hamming code distance corresponding to each data corresponding to each second attribute to the longest data length to obtain the target distance between each data corresponding to each second attribute in the original data and the data corresponding to the second attribute in the desensitized data;

[0029] If the original data is not obtained, each data corresponding to each second attribute in the original data is matched with the data corresponding to the second attribute in the desensitized data using sensitive matching rules. If the match is successful, the target distance is set to 1; if the match fails, the target distance is set to 0.

[0030] Optionally, the evaluating the risk level of the desensitized data based on the data uniqueness level, the data complementarity level and the data matching level includes:

[0031] Determine a first average value of all the data uniqueness values, determine a second average value of all the data complementarity values, and determine a third average value of all the data matching values;

[0032] Determine a first weight, a second weight, and a third weight pre-set for the first average degree value, the second average degree value, and the third average degree value; wherein the sum of the first weight, the second weight, and the third weight is 1;

[0033] The product of each average degree value and the corresponding weight is calculated, and the sum of the products is calculated to obtain the risk degree value of the desensitized data.

[0034] In a second aspect, the present application discloses a risk assessment device, comprising:

[0035] An attribute determination module, used to determine, from each target attribute of the desensitized data, a number of first attributes belonging to quasi-identifiers and a number of second attributes belonging to identifiers and sensitive attributes; the desensitized data is data obtained after desensitizing the original data;

[0036] A data uniqueness degree value determination module, used to determine the data uniqueness degree value of all data of each first attribute compared with all data of other first attributes;

[0037] A data complementarity value determination module, used to determine the data complementarity value between all the data of each first attribute and all the data of other first attributes;

[0038] A data matching degree value determination module, used to determine a data matching degree value between all data of each second attribute in the original data and all data of the second attribute in the desensitized data;

[0039] A risk level numerical evaluation module is used to evaluate the risk level numerical value of the desensitized data based on the data uniqueness level numerical value, the data complementarity level numerical value and the data matching level numerical value.

[0040] In a third aspect, the present application discloses an electronic device, comprising:

[0041] Memory, used to store computer programs;

[0042] A processor is used to execute the computer program to implement the risk assessment method disclosed above.

[0043] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the risk assessment method disclosed above is implemented.

[0044] It can be seen that this application determines several first attributes belonging to quasi-identifiers and several second attributes belonging to identifiers and sensitive attributes from each target attribute of the desensitized data based on the industry sensitivity level standard of the industry in which the desensitized data is located; the desensitized data is the data obtained after desensitizing the original data; the data uniqueness degree value compared with all the data of each first attribute and the data complementarity degree value between all the data of each first attribute and all the data of other first attributes is determined; the data matching degree value between all the data of each second attribute in the original data and all the data of the second attribute in the desensitized data is determined; the risk degree value of the desensitized data is evaluated based on the data uniqueness degree value, the data complementarity degree value and the data matching degree value. It can be seen that the present application can perform quantitative risk assessment on the published desensitized data; the present application proposes a method for evaluating the risk degree of desensitized data using data uniqueness degree values, data complementarity degree values ​​and data matching degree values, that is, a method for quantitatively evaluating the privacy leakage degree values ​​of desensitized data. The data uniqueness degree values ​​and data complementarity degree values ​​take into account the impact of the combination of data with different attributes after desensitization on the determination of the original data corresponding to the desensitized data. The data matching degree value takes into account whether the corresponding original data can be directly determined based on the desensitized data, and the consideration is very comprehensive. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0046] Figure 1 A flow chart of a risk assessment method disclosed in this application;

[0047] Figure 2 A schematic diagram of original data disclosed in this application;

[0048] Figure 3 A specific risk assessment method flow chart disclosed in this application;

[0049] Figure 4 A schematic diagram of a risk assessment process disclosed in this application;

[0050] Figure 5 This is a schematic diagram of the structure of a risk assessment device disclosed in this application;

[0051] Figure 6This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0052] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0053] Data owners randomly spread user information on the Internet, which contains personal privacy data and sensitive data, which will inevitably bring immeasurable security risks to our future work and life. Therefore, with the rise of the information age, people pay more and more attention to privacy security, and the information security issues in the information release link have also received widespread attention from all walks of life, and relevant laws and regulations are constantly being introduced. On this basis, it is also necessary to conduct data privacy leakage risk assessment on the data released after desensitization. The existing risk assessment is based on link analysis attack methods, and there is no quantitative assessment of the leakage degree.

[0054] To this end, an embodiment of the present application proposes a risk assessment solution that can perform quantitative risk assessment on the published desensitized data.

[0055] The present application discloses a risk assessment method, see Figure 1 As shown, the method includes:

[0056] Step S11: Based on the industry sensitivity level standard of the industry in which the desensitized data is located, determine several first attributes belonging to quasi-identifiers and several second attributes belonging to identifiers and sensitive attributes from the target attributes of the desensitized data; the desensitized data is the data obtained after desensitizing the original data.

[0057] In this embodiment, based on the industry sensitivity level standard of the industry to which the desensitized data belongs, several first attributes belonging to quasi-identifiers and several second attributes belonging to identifiers and sensitive attributes are determined from each target attribute of the desensitized data, including: determining each target attribute of the desensitized data, and determining the sensitivity level corresponding to each target attribute based on the industry sensitivity level standard; determining several first attributes belonging to quasi-identifiers and several second attributes belonging to identifiers and sensitive attributes from the target attributes based on the sensitivity level.

[0058] It should be pointed out that the sensitivity level of an attribute is one of the important indicators for assessing the privacy risk of published data. It represents the sensitivity level of different attributes in structured data. The risk of privacy leakage increases sharply with the increase of the sensitivity level of the attribute. Data in different industries have different definitions of the sensitivity level of attributes, so there is a standard definition of the sensitivity level. Therefore, when defining the sensitivity level of an attribute, this solution needs to use the industry sensitivity level standard to set it. No specific examples will be given in this industry.

[0059] Specifically, according to industry specifications, a sensitive scanning module can be used to scan the data set and classify the attributes, setting the highest level 2 sensitivity level attributes as sensitive attributes, setting the attributes without sensitivity levels as non-sensitive, and setting the attributes of the remaining sensitivity levels as quasi-identifiers. This method classifies identifiers into the sensitive attributes, that is, sensitive attributes include sensitive attributes and identifiers. Other specific classification methods are not specifically limited.

[0060] It should be pointed out that identifier (I): one or more attributes in the data that can uniquely identify an individual's information subject, such as ID number, name, driver's license number, etc. Quasi-identification (Q): an attribute in the data that can uniquely identify the personal information subject in combination with other attributes, such as gender, date of birth or age. Sensitive attribute (SA): an attribute in the data set that requires special protection. During potential re-identification attacks, its value needs to be prevented from being associated with any personal information subject, such as telephone number, disease, home address. Insensitive attribute (ISA): data that does not need to be protected and does not pose any danger after being made public, such as the ID (Identity document, unique code) of a data table.

[0061] In a specific embodiment, Figure 2 is a schematic diagram of raw data. Figure 2 As shown in the figure, the target attributes include serial number, name, ID number, age, gender, zip code, telephone number and disease, where the data corresponding to each serial number is a group, and each group represents an independent subject of personal information. Figure 1 There are 8 attributes and 10,000 records in it. In addition, the serial number is a non-sensitive attribute, the name and ID number are identifiers, the age, gender and zip code are quasi-identifiers, and the phone number and disease are sensitive attributes. It should be pointed out that Figure 1The desensitized data corresponding to the original data, taking the ID card number as an example, for 924729186710261495, the desensitized data may be the data 924729******1495 without the date of birth. It should be pointed out that if the classification method proposed in this application is used, the serial number is a non-sensitive attribute, the age, gender and zip code are quasi-identifiers, and the name, ID card number, telephone number and disease are sensitive attributes.

[0062] Step S12: Determine the data uniqueness value of each of the first attribute's all data compared with all of the other first attribute's all data, and determine the data complementarity value between each of the first attribute's all data and all of the other first attribute's all data.

[0063] Step S13: Determine a data matching degree value between all data of each second attribute in the original data and all data of the second attribute in the desensitized data.

[0064] In this embodiment, the data matching degree value reflects the effect of data desensitization. The higher the data matching degree value, the worse the desensitization effect, and vice versa, the better the desensitization effect.

[0065] In this embodiment, the sensitive attribute is sensitive because it has a certain host. If it exists alone, it is not sensitive. Therefore, in the absence of source data, after the data is released, the most worrying thing is to analyze and determine the host information from the desensitized data, because the data of sensitive attributes and identifiers will first consider their sensitivity when they are released, so they will be desensitized, so the desensitization effect can be evaluated according to their needs. Although the quasi-identifier will also be desensitized, the relevance of the attribute (including data uniqueness and data complementarity) still exists after the processing, and the relevance of the attribute is very easy to ignore and leak personal privacy information, because it is easy to associate and analyze with external data to determine the data host. Therefore, first check the relevance of the quasi-identifier.

[0066] Specifically, the greater the uniqueness of the data, the smaller the similarities between different attributes, and the greater the targeting to different hosts after the combination (two very similar attributes can provide very little information, and two attributes with large differences can provide a lot of information), which means it is easier to leak personal privacy, and vice versa, it is not easy to leak personal privacy.

[0067] It should be pointed out that the data complementarity, that is, physical relevance, specifically refers to the expression of two attributes that are of the same type, or are related, or have an intersection or subset relationship; such as the ID card number and birthday, these two attributes are physically related. If the two desensitization is insufficient, such as the ID card number is stripped of the year and month, and the birthday is stripped of the day, then the association can be restored. This is defined as physical relevance, which includes not only between fields, but also between texts, and can be converted into structured data for processing through word segmentation technology. It should be pointed out that the greater the value of the data complementarity, the greater the possibility that the data can be restored, and the easier it is to determine the host to which the data corresponds.

[0068] Step S14: Evaluate the risk level of the desensitized data based on the data uniqueness level, the data complementarity level and the data matching level.

[0069] In this embodiment, the risk level value of the desensitized data is evaluated based on the data uniqueness level value, the data complementarity level value and the data matching level value, including: determining a first average level value of all the data uniqueness level values, determining a second average level value of all the data complementarity level values, and determining a third average level value of all the data matching level values; determining a first weight, a second weight and a third weight pre-set for the first average level value, the second average level value and the third average level value; wherein the sum of the first weight, the second weight and the third weight is 1; calculating the product of each average level value and the corresponding weight, and calculating the sum of the products to obtain the risk level value of the desensitized data.

[0070] Specifically, are respectively the first weight, the second weight and the third weight, Representation attributes The uniqueness of the data, Representation attributes The data complementarity value is Representation attributes The data matching degree value. represents the first average degree value, represents the second average degree value, Indicates the third average degree value, Indicates the risk level; .

[0071] It should be pointed out that the weight distribution can be changed and the emphasis value can be adjusted according to the actual situation.

[0072] It can be seen that this application determines several first attributes belonging to quasi-identifiers and several second attributes belonging to identifiers and sensitive attributes from each target attribute of the desensitized data based on the industry sensitivity level standard of the industry in which the desensitized data is located; the desensitized data is the data obtained after desensitizing the original data; the data uniqueness degree value compared with all the data of each first attribute and the data complementarity degree value between all the data of each first attribute and all the data of other first attributes is determined; the data matching degree value between all the data of each second attribute in the original data and all the data of the second attribute in the desensitized data is determined; the risk degree value of the desensitized data is evaluated based on the data uniqueness degree value, the data complementarity degree value and the data matching degree value. It can be seen that the present application can perform quantitative risk assessment on the published desensitized data; the present application proposes a method for evaluating the risk degree of desensitized data using data uniqueness degree values, data complementarity degree values ​​and data matching degree values, that is, a method for quantitatively evaluating the privacy leakage degree values ​​of desensitized data. The data uniqueness degree values ​​and data complementarity degree values ​​take into account the impact of the combination of data with different attributes after desensitization on the determination of the original data corresponding to the desensitized data. The data matching degree value takes into account whether the corresponding original data can be directly determined based on the desensitized data, which is a very comprehensive consideration.

[0073] The embodiment of the present application discloses a specific risk assessment method. Compared with the previous embodiment, this embodiment further illustrates and optimizes the technical solution. Figure 3 As shown, specifically including:

[0074] Step S21: Based on the industry sensitivity level standard of the industry in which the desensitized data is located, determine several first attributes belonging to quasi-identifiers and several second attributes belonging to identifiers and sensitive attributes from the target attributes of the desensitized data; the desensitized data is the data obtained after desensitizing the original data.

[0075] For a more specific processing procedure of step S21, reference may be made to the corresponding contents disclosed in the aforementioned embodiments, which will not be described in detail here.

[0076] Step S22: Based on the information entropy calculation method, determine the data uniqueness value of all the data of each first attribute compared with all the data of other first attributes.

[0077] In this embodiment, the method for calculating information entropy is used to determine the degree of data uniqueness of all data of each first attribute compared with all data of other first attributes, including: determining the first information entropy corresponding to all data of each first attribute; determining the second information entropy of all data of each first attribute associated with all data of other first attributes; calculating the difference between the second information entropy corresponding to all data of each first attribute and the first information entropy to obtain an information entropy difference; calculating the ratio of the information entropy difference corresponding to all data of each first attribute to the first information entropy, so as to determine the degree of data uniqueness of all data of each first attribute compared with all data of other first attributes.

[0078] Specifically, suppose there are n hosts and n sets of data, that is, there are n first attribute data and m target attributes, including , where there are b first attributes, which are and belongs to , where the first attribute There are n data in the The first attribute The data, and data have indivual, , random events The probability of occurrence is , random events The inverse of the logarithm of the probability of occurrence is defined as the self-information of the random event, denoted as ,in, , .

[0079] Information entropy indicates the uncertainty of data information. The greater the uncertainty, the more information is exposed.

[0080] The first step is to calculate the uncertainty of each individual quasi-identifier data based on information entropy :

[0081] ;

[0082] The second step is to calculate the uncertainty of a single quasi-identifier in relation to the attributes of other quasi-identifiers. :

[0083] ;

[0084] in, for Except Other combinations, express and The combination of the same row of data;

[0085] The third step is to calculate the information entropy difference :

[0086] ;

[0087] Step 4: Calculate with Relevance :

[0088] .

[0089] Step S23: Determine the reference number of first attributes for which all data of the first attribute corresponding to each first attribute have a data complementary relationship with all data of other first attributes; the data complementary relationship indicates that data of one first attribute and data of another first attribute in the same group can be combined to obtain data with complete meaning.

[0090] In a specific embodiment, the two attributes of ID card number and birthday are physically related. If the two attributes are not fully desensitized, such as removing the year and month from the ID card number and removing the day from the birthday, the association can be restored (with complete meaning). This is defined as physical correlation, which includes not only between fields but also between texts, and can be converted into structured data for processing through word segmentation technology.

[0091] Step S24: Calculate the ratio of the reference quantity corresponding to each first attribute to the target quantity, and obtain the data complementarity degree between all the data of each first attribute and all the data of other first attributes; the target quantity is the difference between the total attribute quantity of the first attribute and 1.

[0092] Specifically, let the first attribute The degree of data complementarity with other quasi-identifiers is , then the calculation equation is:

[0093] ;

[0094] in, The number of quasi-identifiers n minus 1, For other quasi-identifiers The number of physically associated relationships.

[0095] Step S25: Calculate the target distance between each data corresponding to each second attribute in the original data and the data corresponding to the second attribute in the desensitized data; calculate the average distance of the target distance of all data corresponding to each second attribute; calculate the difference between 1 and each average distance to obtain a data matching degree value between all data of each second attribute in the original data and all data of the second attribute in the desensitized data.

[0096] In this embodiment, the desensitization degree numerical score is used to evaluate the desensitization degree of the data, as well as a numerical value of the degree to which the desensitized data can be guessed compared to the original data. This application calculates the matching degree of the desensitized data with the original data.

[0097] Specifically, the calculation of the target distance between each data corresponding to each second attribute in the original data and the data corresponding to the second attribute in the desensitized data includes: if the original data is obtained, calculating the Hamming code distance between each data corresponding to each second attribute in the original data and the data corresponding to the second attribute in the desensitized data; determining the first data length of each data corresponding to each second attribute in the original data, and the second data length of each data corresponding to each second attribute in the desensitized data, and selecting the longest data length of each data corresponding to each second attribute from the first data length and the second data length; calculating the ratio of the Hamming code distance corresponding to each data corresponding to each second attribute to the longest data length to obtain the target distance between each data corresponding to each second attribute in the original data and the data corresponding to the second attribute in the desensitized data; if the original data is not obtained, matching each data corresponding to each second attribute in the original data with the data corresponding to the second attribute in the desensitized data using a sensitive matching rule, if the match is successful, setting the target distance to 1, if the match fails, setting the target distance to 0.

[0098] It should be pointed out that, assuming there are d identifiers and sensitive attributes (second attributes), and belongs to , where the first attribute There are n data in the The first attribute No. The first Row data, , and the data have indivual, For the original data The corresponding data.

[0099] The similarity of the data before and after desensitization is calculated using the Hamming code distance and normalized. Suppose the Hamming code distance before and after processing is a, then:

[0100] ;

[0101] The larger the distance, the less similar it is, and the safer it is. Therefore, the attributes before and after data processing are defined. The similarity is:

[0102] .

[0103] However, if the original data does not exist, the sensitive matching rules are used for matching. If the data can still be matched, the distance is set to 1, otherwise it is set to 0. Specifically, for each attribute of the original data, there is a specified data format, and a regular expression corresponding to the data format can be written. Then, the expression is used to match the desensitized data. If the data can still be matched, it proves that the desensitization effect is not good.

[0104] Specifically, .

[0105] Step S26: Evaluate the risk level of the desensitized data based on the data uniqueness level, the data complementarity level and the data matching level.

[0106] For a more specific processing procedure of step S26, reference may be made to the corresponding contents disclosed in the aforementioned embodiments, which will not be described in detail here.

[0107] It can be seen that this application determines several first attributes belonging to quasi-identifiers and several second attributes belonging to identifiers and sensitive attributes from each target attribute of the desensitized data based on the industry sensitivity level standard of the industry in which the desensitized data is located; the desensitized data is the data obtained after desensitizing the original data; based on the information entropy calculation method, the data uniqueness degree of all data of each first attribute compared with all data of other first attributes is determined; the reference number of first attributes corresponding to each first attribute having a data complementary relationship among all data of other first attributes is determined; the data complementary relationship indicates that the data of one first attribute of the same group can be combined with the data of another first attribute to obtain data with complete meaning; the reference number corresponding to each first attribute is calculated. The ratio of the number of considerations to the target number is used to obtain the data complementarity value between all the data of each first attribute and all the data of other first attributes; the target number is the difference between the total number of attributes of the first attribute and 1; the target distance between each data corresponding to each second attribute in the original data and the data corresponding to the second attribute in the desensitized data is calculated; the average distance of the target distance of all the data corresponding to each second attribute is calculated; the difference between 1 and each average distance is calculated to obtain the data matching degree value between all the data of each second attribute in the original data and all the data of the second attribute in the desensitized data; the risk degree value of the desensitized data is evaluated based on the data uniqueness degree value, the data complementarity degree value and the data matching degree value. It can be seen that the present application specifically discloses how to calculate the data uniqueness degree value, the data complementarity degree value and the data matching degree value, so as to perform quantitative risk assessment on the released desensitized data.

[0108] See also Figure 4 The figure is a schematic diagram of a risk assessment process. To perform risk scoring, the attribute information of the data is first determined, including disease, ID number, etc. For details, see Figure 2As shown, the attributes are then graded and classified according to the attribute levels. The specific categories include non-sensitive attributes, identifiers, quasi-identifiers, and sensitive attributes. Afterwards, the data uniqueness degree value and the data complementarity degree value are calculated for the quasi-identifier alone, and the data matching degree value is calculated for the combination of the identifier and the sensitive attribute. Then, the risk degree value corresponding to the desensitized data is calculated based on the data uniqueness degree value, the data complementarity degree value, and the data matching degree value; wherein, the calculation of the data matching degree value is divided into two calculation methods: with original data and without original data. When there is original data, the distance between the desensitized data and the original data is calculated, and the data matching degree value is calculated based on the distance. If there is no original data, regular expressions, AI language recognition, or other methods are used directly for sensitive matching, and the data matching degree value is determined based on the matching results. It should be pointed out that the original data and the corresponding desensitized data here can be patient medical records data. For details, see Figure 2 As shown, it can also be data of other scenarios, which is not specifically limited here.

[0109] Accordingly, the present application also discloses a risk assessment device, see Figure 5 As shown, the device comprises:

[0110] The attribute determination module 11 is used to determine a number of first attributes belonging to quasi-identifiers and a number of second attributes belonging to identifiers and sensitive attributes from each target attribute of the desensitized data; the desensitized data is data obtained after desensitizing the original data;

[0111] A data uniqueness degree value determination module 12, used to determine a data uniqueness degree value of all data of each first attribute compared with all data of other first attributes;

[0112] A data complementarity value determination module 13, used to determine the data complementarity value between all the data of each first attribute and all the data of other first attributes;

[0113] A data matching degree value determination module 14, used to determine a data matching degree value between all data of each second attribute in the original data and all data of the second attribute in the desensitized data;

[0114] The risk level numerical evaluation module 15 is used to evaluate the risk level numerical value of the desensitized data based on the data uniqueness level numerical value, the data complementarity level numerical value and the data matching level numerical value.

[0115] Among them, the more specific working process of each of the above modules can refer to the corresponding content disclosed in the above embodiments, which will not be repeated here.

[0116] It can be seen that this application determines several first attributes belonging to quasi-identifiers and several second attributes belonging to identifiers and sensitive attributes from each target attribute of the desensitized data based on the industry sensitivity level standard of the industry in which the desensitized data is located; the desensitized data is the data obtained after desensitizing the original data; the data uniqueness degree value compared with all the data of each first attribute and the data complementarity degree value between all the data of each first attribute and all the data of other first attributes is determined; the data matching degree value between all the data of each second attribute in the original data and all the data of the second attribute in the desensitized data is determined; the risk degree value of the desensitized data is evaluated based on the data uniqueness degree value, the data complementarity degree value and the data matching degree value. It can be seen that the present application can perform quantitative risk assessment on the published desensitized data; the present application proposes a method for evaluating the risk degree of desensitized data using data uniqueness degree values, data complementarity degree values ​​and data matching degree values, that is, a method for quantitatively evaluating the privacy leakage degree values ​​of desensitized data. The data uniqueness degree values ​​and data complementarity degree values ​​take into account the impact of the combination of data with different attributes after desensitization on the determination of the original data corresponding to the desensitized data. The data matching degree value takes into account whether the corresponding original data can be directly determined based on the desensitized data, which is a very comprehensive consideration.

[0117] Furthermore, an embodiment of the present application also provides an electronic device. Figure 6 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram cannot be regarded as any limitation on the scope of use of the present application.

[0118] Figure 6 A schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a display screen 23, an input / output interface 24, a communication interface 25, a power supply 26, and a communication bus 27. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the risk assessment method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0119] In this embodiment, the power supply 26 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 25 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 24 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0120] In addition, the memory 22, as a carrier for storing resources, may be a read-only memory, a random access memory, a disk or an optical disk, etc., and the resources stored thereon may include a computer program 221, and the storage method may be temporary storage or permanent storage. In addition to including a computer program that can be used to complete the risk assessment method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 221 may further include a computer program that can be used to complete other specific tasks.

[0121] Furthermore, an embodiment of the present application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the risk assessment method disclosed above is implemented.

[0122] The specific steps of the method can refer to the corresponding contents disclosed in the above embodiments, which will not be repeated here.

[0123] The various embodiments in this application are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0124] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0125] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0126] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0127] The above is a detailed introduction to a risk assessment method, device, equipment, and storage medium provided by the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A risk assessment method, characterized in that: include: Based on the industry sensitivity level standard of the industry in which the desensitized data is located, determining from each target attribute of the desensitized data a number of first attributes belonging to quasi-identifiers and a number of second attributes belonging to identifiers and sensitive attributes; The desensitized data is the data obtained after desensitizing the original data; Determine a data uniqueness value of each of the data of the first attribute compared with all of the data of other first attributes, and determine a data complementarity value between each of the data of the first attribute and all of the data of other first attributes; Determine a data matching degree value between all data of each second attribute in the original data and all data of the second attribute in the desensitized data; The risk level of the desensitized data is evaluated based on the data uniqueness level, the data complementarity level and the data matching level.

2. The risk assessment method according to claim 1, characterized in that: The step of determining the data uniqueness value of all the data of each first attribute compared with all the data of other first attributes includes: Based on the information entropy calculation method, a data uniqueness value of all the data of each first attribute compared with all the data of other first attributes is determined.

3. The risk assessment method according to claim 2, characterized in that: The method for calculating information entropy to determine the data uniqueness value of all data of each first attribute compared with all data of other first attributes includes: Determine a first information entropy corresponding to all data of each of the first attributes; Determine a second information entropy of all data of each first attribute associated with all other data of the first attribute; Calculate the difference between the second information entropy and the first information entropy corresponding to all data of each first attribute to obtain an information entropy difference; The ratio of the information entropy difference corresponding to all the data of each first attribute to the first information entropy is calculated to determine the data uniqueness degree of all the data of each first attribute compared with all the data of other first attributes.

4. The risk assessment method according to claim 1, characterized in that: The step of determining a data complementarity value between all the data of each first attribute and all the data of other first attributes includes: Determine a reference number of first attributes corresponding to each first attribute, in which all data of the first attribute corresponding to the first attribute have a data complementary relationship with all data of other first attributes; the data complementary relationship indicates that data of one first attribute and data of another first attribute in the same group can be combined to obtain data with complete meaning; The ratio of the reference quantity corresponding to each first attribute to the target quantity is calculated to obtain a data complementarity degree value between all the data of each first attribute and all the data of other first attributes; the target quantity is the difference between the total attribute quantity of the first attribute and 1.

5. The risk assessment method according to claim 1, characterized in that: The determining of a data matching degree value between all data of each second attribute in the original data and all data of the second attribute in the desensitized data includes: Calculate the target distance between each data corresponding to each second attribute in the original data and the data corresponding to the second attribute in the desensitized data; Calculate the average distance of the target distance of all data corresponding to each of the second attributes; The difference between 1 and each of the average distances is calculated to obtain a data matching degree value between all the data of each of the second attributes in the original data and all the data of the second attribute in the desensitized data.

6. The risk assessment method according to claim 5, characterized in that: The calculating a target distance between each data corresponding to each second attribute in the original data and the data corresponding to the second attribute in the desensitized data includes: If the original data is obtained, calculating the Hamming code distance between each data corresponding to each second attribute in the original data and the data corresponding to the second attribute in the desensitized data; Determine a first data length of each data corresponding to each second attribute in the original data, and a second data length of each data corresponding to each second attribute in the desensitized data, and select a longest data length of each data corresponding to each second attribute from the first data length and the second data length; Calculate the ratio of the Hamming code distance corresponding to each data corresponding to each second attribute to the longest data length to obtain the target distance between each data corresponding to each second attribute in the original data and the data corresponding to the second attribute in the desensitized data; If the original data is not obtained, each data corresponding to each second attribute in the original data is matched with the data corresponding to the second attribute in the desensitized data using sensitive matching rules. If the match is successful, the target distance is set to 1; if the match fails, the target distance is set to 0.

7. The risk assessment method according to any one of claims 1 to 6, characterized in that: The evaluating the risk level of the desensitized data based on the data uniqueness level, the data complementarity level and the data matching level includes: Determine a first average value of all the data uniqueness values, determine a second average value of all the data complementarity values, and determine a third average value of all the data matching values; Determine a first weight, a second weight, and a third weight pre-set for the first average degree value, the second average degree value, and the third average degree value; wherein the sum of the first weight, the second weight, and the third weight is 1; The product of each average degree value and the corresponding weight is calculated, and the sum of the products is calculated to obtain the risk degree value of the desensitized data.

8. A risk assessment device, characterized in that: include: An attribute determination module, used to determine, from each target attribute of the desensitized data, a number of first attributes belonging to the quasi-identifier and a number of second attributes belonging to the identifier and the sensitive attribute; The desensitized data is the data obtained after desensitizing the original data; A data uniqueness degree value determination module, used to determine the data uniqueness degree value of all data of each first attribute compared with all data of other first attributes; A data complementarity value determination module, used to determine the data complementarity value between all the data of each first attribute and all the data of other first attributes; A data matching degree value determination module, used to determine a data matching degree value between all data of each second attribute in the original data and all data of the second attribute in the desensitized data; A risk level numerical evaluation module is used to evaluate the risk level of the desensitized data based on the data uniqueness level, the data complementarity level and the data matching level.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the risk assessment method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store a computer program; wherein, when the computer program is executed by a processor, the risk assessment method as described in any one of claims 1 to 7 is implemented.

Images