Data security data flow traceability analysis method and system
By generating and executing automatic traceability instructions, calculating data flow scores and generating data security alarms, the shortcomings of existing data flow traceability technologies in terms of computationality, interpretability, timeliness and objectivity are solved, and more efficient data security is achieved analyze.
Patent Information
- Application Number
- CN202411213996.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-08-31
- Publication Date
- 2025-02-14
AI Technical Summary
The existing data flow traceability technology has insufficient calculation, interpretability, timeliness and objectivity, resulting in poor application effectiveness in data security analysis.
By collecting and marking data, a data supervision matrix and data information set are generated, and these data are used for automatic traceability instructions to calculate data flow scores and generate data security alarms.
It improves the computationality, interpretability, timeliness and objectivity of data flow traceability, and provides a more scientific and efficient data security analysis method.
Smart Images
Figure CN119442339A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of data security technology, and specifically to a data security data flow tracing analysis method and system. Background Art
[0002] With the rapid development of the digital age, the value of data security in production and life has become increasingly prominent, so it is necessary to analyze data security. The basic feature of data is that data flows due to the needs of production and life. The data flow generated during the flow process is an important indicator for assessing data security. Therefore, it is necessary to study the data flow. Furthermore, tracing the data flow to reflect the data security status is a feasible technical direction for data security analysis.
[0003] However, the existing data flow tracing has the following problems:
[0004] 1. Both the data that needs to be traced and the data generated by the traceability are too large, complex and unregulated, resulting in poor computability and interpretability;
[0005] 2. The traceability actions are mostly carried out in the form of manual instructions, resulting in poor timeliness;
[0006] 3. The analysis of traceability results is mostly based on experience, resulting in poor objectivity.
[0007] In summary, the existing technology urgently needs a technical solution that can be applied to data security analysis to optimize the computational, interpretable, timely and objective nature of data flow traceability. Summary of the invention
[0008] The purpose of this application is to provide a data security data flow tracing analysis method and system to solve the technical problems raised in the above background technology.
[0009] To achieve the above objectives, this application discloses the following technical solutions:
[0010] In a first aspect, the present application discloses a data security data flow tracing analysis method, the method comprising:
[0011] S1: Collect and mark data to obtain a data supervision matrix and a data information set. The data supervision matrix includes the length, confidentiality level and abnormal access frequency of the data. The data information set includes the data label, data operation record and data flow path;
[0012] S2: Verify the data change using the data supervision matrix to obtain a verification result, and generate an automatic traceability instruction using the verification result;
[0013] S3: Obtaining a traceability instruction, wherein the traceability instruction includes the automatic traceability instruction and the manual traceability instruction, and the manual traceability instruction is configured to be directly input by an administrator;
[0014] S4: obtaining an automatic tracing result based on the automatic tracing instruction, and obtaining a manual tracing result based on the manual tracing instruction;
[0015] S5: Calculate a data flow score based on the automatic tracing result, and obtain a data security warning based on the data flow score;
[0016] S6: Sending any one or more of the data security warning and the manual tracing result to the administrator.
[0017] Preferably, the abnormal access frequency is specifically:
[0018] Preset data traceability supervision cycle;
[0019] The rejected data access is defined as abnormal access, and the number of abnormal accesses within the data traceability supervision cycle is counted to obtain the abnormal access frequency.
[0020] Preferably, the method of verifying the data change by using the data supervision matrix to obtain the verification result specifically includes:
[0021] The data supervision matrix is specifically:
[0022] DVM=[LE,SCL,AAR]
[0023] Wherein, AAR is the abnormal access frequency, SCL is the confidentiality level, LE is the length, and DVM is the data supervision matrix;
[0024] Get the data supervision matrix DVM of the tth data traceability supervision cycle t and the data supervision matrix DVM of the t-1th data traceability supervision cycle t-1 , the data check matrix DVM is calculated, wherein the calculation formula of the data check matrix is:
[0025] ΔDVM=DVM t -DVM t-1
[0026] When the data check matrix is a zero matrix, the check result does not require tracing;
[0027] When the data check matrix is a non-zero matrix, the check result requires tracing back to the source.
[0028] Preferably, the generating of automatic traceability instructions by using the verification results specifically includes:
[0029] When the verification result indicates that traceability is required, the corresponding data verification matrix and the label of the corresponding data are obtained, and the label is defined as a traceability label;
[0030] Capturing non-zero elements in the data verification matrix, and using the non-zero elements to locate the time when the data changes;
[0031] The traceability tag and the occurrence time are packaged and defined as the automatic traceability instruction and then output.
[0032] Preferably, the manual tracing instruction includes a query tag and a query cycle input by an administrator.
[0033] Preferably, obtaining the automatic traceability result based on the automatic traceability instruction specifically includes the following steps:
[0034] A1: preset operation time threshold, abnormal access frequency change rate threshold and abnormal access frequency threshold;
[0035] A2: Using the traceability tag and the occurrence time to obtain and parse the data supervision matrix DVM of the t-th data traceability supervision cycle t And the corresponding data information set DIS t and the data supervision matrix DVM of the t-1th data traceability supervision cycle t-1 And the corresponding data information set DIS t-1 ;
[0036] A3: When the non-zero element is any one or more of the corresponding length and the security level, execute step A4; when the non-zero element is the corresponding abnormal access frequency, execute step A7;
[0037] A4: traverse the data operation records obtained in step A2, and determine whether the data changes have corresponding operation instructions. If yes, execute step A5; otherwise, output the data changes and execute step A9;
[0038] A5: Calculate the response time based on the occurrence time and the instruction time corresponding to the operation instruction, and determine whether the response time is less than or equal to the operation time threshold. If yes, execute step A6; otherwise, output the data change and execute step A9;
[0039] A6: Determine whether the non-zero element corresponding to the length and the non-zero element corresponding to the confidentiality level correspond to the content of the operation instruction, if yes, determine that the data change is normal, otherwise output the data change and execute step A9;
[0040] A7: Calculate the abnormal access frequency change rate based on the non-zero element corresponding to the abnormal access frequency, and determine whether the abnormal access frequency change rate is less than or equal to the abnormal access frequency change rate threshold. If yes, execute step A8; otherwise, output the data change and execute step A9;
[0041] A8: Determine whether the abnormal access frequency of the tth data traceability supervision cycle is less than or equal to the abnormal access frequency threshold. If so, determine that the data change is normal, and then execute step A9;
[0042] A9: Mark the location of the data change in the data flow path based on the time of occurrence of the data change, package the data supervision matrix corresponding to the data change and the marked data information set, define them as the automatic tracing result, and then output them.
[0043] Preferably, obtaining the manual tracing result based on the manual tracing instruction specifically includes:
[0044] The corresponding data supervision matrix and the data information set are obtained based on the query tag and the query period, and are packaged and defined as the manual tracing result and then output.
[0045] Preferably, steps A4 to A8 further include:
[0046] A41: Assign P4 to the execution result of step A4. When there is a change in the output data, P4=1, otherwise P4=0;
[0047] A51: Assign P5 to the execution result of step A5. When there is a change in the output data, P5=1, otherwise P5=0;
[0048] A61: Assign P6 to the execution result of step A6. When there is a change in the output data, P6=1, otherwise P6=0;
[0049] A71: Assign P7 to the execution result of step A7. When there is a change in the output data, P7=1, otherwise P7=0;
[0050] A81: Assign P8 to the execution result of step A4. When there is a change in the output data, P8=1, otherwise P8=0.
[0051] Preferably, the calculating of the data flow score based on the automatic tracing result and obtaining the data security warning based on the data flow score specifically includes:
[0052] The data security warnings include high risk warnings, medium risk warnings, low risk warnings and no risk warnings;
[0053] The data flow score is calculated using a data flow score formula, wherein the data flow score formula is specifically:
[0054] DFR=P4+P5+P6+P7+P8
[0055] Among them, DFR is the data flow score;
[0056] When DFR=5, the high risk alarm is generated;
[0057] When 3≤DFR<5, the high risk alarm is generated;
[0058] When 1≤DFR<3, the high risk alarm is generated;
[0059] When DFR=0, the high risk alarm is generated.
[0060] In a second aspect, the present application discloses a data security data flow tracing analysis system, which is applicable to the data security data flow tracing analysis method as described above, and the system includes:
[0061] A data processing module, wherein the data processing module is configured to: collect and mark data to obtain a data supervision matrix and a data information set, wherein the data supervision matrix includes the length, confidentiality level and abnormal access frequency of the data, and the data information set includes a data label, data operation record and data flow path;
[0062] A data verification module, wherein the data verification module is configured to: verify the data change using the data supervision matrix to obtain a verification result, and generate an automatic traceability instruction using the verification result;
[0063] An instruction acquisition module, wherein the instruction acquisition module is configured to: acquire a traceability instruction, wherein the traceability instruction includes the automatic traceability instruction and the manual traceability instruction, and the manual traceability instruction is configured to be directly input by an administrator;
[0064] A traceability result module, wherein the traceability result module is configured to: obtain an automatic traceability result based on the automatic traceability instruction, and obtain a manual traceability result based on the manual traceability instruction;
[0065] A source tracing analysis module, wherein the source tracing analysis module is configured to: calculate a data flow score based on the automatic source tracing result, and obtain a data security warning based on the data flow score;
[0066] A traceability display module, wherein the traceability display module is configured to send any one or more of the data security warning and the manual traceability result to an administrator.
[0067] Beneficial effects: The data security data flow traceability analysis method and system of the present application simplifies the data required for traceability and improves data standardization through the data supervision matrix and data information set, provides a data basis for improving computability, realizes real-time supervision of data changes through verification of the data supervision matrix, provides data reference for automatic traceability and improves the timeliness of traceability, fully meets the traceability requirements by dividing the traceability instruction execution, improves the objectivity of traceability by calculating the data flow score, provides a data basis for application in data security assessment, and realizes the computability, explainability, timeliness and objectivity of optimized data flow traceability applied in data security analysis. BRIEF DESCRIPTION OF THE DRAWINGS
[0068] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without paying any creative work.
[0069] Figure 1 A flowchart of a data security data flow tracing and analysis method provided in an embodiment of the present application;
[0070] Figure 2 A schematic block diagram of a data security data flow tracing and analysis system provided in an embodiment of the present application. DETAILED DESCRIPTION
[0071] The technical solutions in the embodiments of the present application are described clearly and completely below. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.
[0072] In this article, the term "comprising" is intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of more restrictions, the elements defined by the sentence "comprising..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.
[0073] In a first aspect, this embodiment discloses Figure 1 A data security data flow tracing analysis method is shown, the method comprising:
[0074] S1: Collect and mark data to obtain a data supervision matrix and a data information set. The data supervision matrix includes the length, confidentiality level and abnormal access frequency of the data. The data information set includes the data label, data operation record and data flow path.
[0075] S2: Use the data supervision matrix to verify the data changes, obtain the verification results, and use the verification results to generate automatic traceability instructions.
[0076] S3: Obtain tracing instructions. The tracing instructions include automatic tracing instructions and manual tracing instructions. The manual tracing instructions are configured to be directly input by the administrator.
[0077] S4: Obtain automatic tracing results based on automatic tracing instructions, and obtain manual tracing results based on manual tracing instructions.
[0078] S5: Calculate the data flow score based on the automatic traceability results, and obtain data security alerts based on the data flow score.
[0079] S6: Sending one or more of a data security warning and a manual tracing result to the administrator.
[0080] Through the data supervision matrix and data information set, the data required for traceability is simplified and the data standardization is improved, providing a data basis for improving computability. By verifying the data supervision matrix, real-time supervision of data changes is achieved, providing data reference for automatic traceability and improving the timeliness of traceability. By dividing the traceability instruction execution, the traceability needs are fully met, and the objectivity of traceability is improved by calculating the data flow score. This provides a data basis for data security assessment and realizes the computability, explainability, timeliness and objectivity of optimized data flow traceability applied in data security analysis.
[0081] Specifically, the abnormal access frequency is as follows:
[0082] Preset data traceability supervision cycle.
[0083] The rejected data access is defined as abnormal access. The number of abnormal accesses within a data traceability supervision cycle is counted to obtain the abnormal access frequency.
[0084] The preset data traceability supervision cycle provides a data basis for improving the timeliness of traceability. The calculation of abnormal access rate highlights the practicality of this indicator in data traceability for data security regulation analysis, and achieves optimization of data complexity and large data volume.
[0085] Specifically, the data supervision matrix is used to verify the data changes and obtain the verification results, which specifically include:
[0086] The data supervision matrix is as follows:
[0087] DVM=[LE,SCL,AAR]
[0088] Among them, AAR is the abnormal access frequency, SCL is the confidentiality level, LE is the length, and DVM is the data supervision matrix; it should be noted that this embodiment realizes the standardized processing of data through the data supervision matrix, provides a data basis for improving computational performance, and also realizes further optimization of data complexity and huge data volume.
[0089] Get the data supervision matrix DVM of the tth data traceability supervision cycle t and the data supervision matrix DVM of the t-1th data traceability supervision cycle t-1 , the data check matrix DVM is calculated, where the calculation formula of the data check matrix is:
[0090] ΔDVM=DVM t -DVM t-1
[0091] When the data check matrix is a zero matrix, the check result is that no traceability is required.
[0092] When the data check matrix is a non-zero matrix, the check result requires tracing back to the source.
[0093] The data verification matrix obtained through calculation provides a scientific data reference for automatic traceability, and optimizes the timeliness of traceability based on the time parameter of the traceability supervision cycle.
[0094] Specifically, the verification results are used to generate automatic traceability instructions, including:
[0095] When the verification result requires traceability, the corresponding data verification matrix and the label of the corresponding data are obtained, and the label is defined as the traceability label.
[0096] The non-zero elements in the data verification matrix are captured, and the non-zero elements are used to locate the time when the data change occurs.
[0097] The traceability tag and occurrence time are packaged and defined as automatic traceability instructions for output.
[0098] Specifically, the manual tracing instruction includes a query tag and a query cycle entered by an administrator.
[0099] By dividing the automatic tracing instructions and the manual tracing instructions, the data flow tracing is optimized while also ensuring that the administrator's manual tracing needs are met, thereby improving the applicability of this embodiment.
[0100] Specifically, obtaining the automatic traceability result based on the automatic traceability instruction includes the following steps:
[0101] A1: preset operation time threshold, abnormal access frequency change rate threshold and abnormal access frequency threshold; it should be noted that the thresholds preset here in this embodiment are intended to automatically and objectively perform traceability and corresponding data security assessment through data reference.
[0102] A2: Use the traceability label and occurrence time to obtain and parse the data supervision matrix DVM of the tth data traceability supervision cycle t And the corresponding data information set DIS t and the data supervision matrix DVM of the t-1th data traceability supervision cycle t-1 And the corresponding data information set DIS t-1 .
[0103] A3: When the non-zero element is any one or more of the corresponding length and confidentiality level, execute step A4; when the non-zero element is the corresponding abnormal access frequency, execute step A7.
[0104] A4: traverse the data operation records obtained in step A2, and determine whether the data changes have corresponding operation instructions. If so, execute step A5; otherwise, output the data changes and execute step A9.
[0105] A5: Calculate the response time based on the occurrence time and the instruction time corresponding to the operation instruction, and determine whether the response time is less than or equal to the operation time threshold. If so, execute step A6; otherwise, output the data changes and execute step A9.
[0106] A6: Determine whether the non-zero element corresponding to the length and the non-zero element corresponding to the confidentiality level correspond to the content of the operation instruction. If so, determine that the data change is normal. Otherwise, output the data change and execute step A9;
[0107] A7: Calculate the abnormal access frequency change rate based on the non-zero elements corresponding to the abnormal access frequency, and determine whether the abnormal access frequency change rate is less than or equal to the abnormal access frequency change rate threshold. If so, execute step A8; otherwise, output the data change and execute step A9.
[0108] A8: Determine whether the abnormal access frequency of the tth data traceability supervision cycle is less than or equal to the abnormal access frequency threshold. If so, the data change is normal, otherwise the data change is normal and execute step A9.
[0109] A9: Mark the location of the change in the data flow path based on the time of occurrence of the data change, package the data supervision matrix corresponding to the data change and the marked data information set, define them as automatic traceability results, and then output them.
[0110] By automatically obtaining traceability results, the intelligence level of traceability is improved, the timeliness of traceability is optimized, and an objective evaluation basis is provided for data security assessment.
[0111] Specifically, the manual tracing results are obtained based on the manual tracing instructions, including:
[0112] Based on the query label and query cycle, the corresponding data supervision matrix and data information set are obtained, and they are packaged and defined as manual traceability results for output.
[0113] Specifically, steps A4 to A8 further include:
[0114] A41: Assign P4 to the execution result of step A4. When there is a change in the output data, P4=1, otherwise P4=0.
[0115] A51: Assign P5 to the execution result of step A5. When there is a change in the output data, P5=1, otherwise P5=0.
[0116] A61: Assign P6 to the execution result of step A6. When there is a change in the output data, P6=1, otherwise P6=0.
[0117] A71: Assign P7 to the execution result of step A7. When there is a change in the output data, P7=1, otherwise P7=0.
[0118] A81: Assign P8 to the execution result of step A4. When there is a change in the output data, P8=1, otherwise P8=0.
[0119] By assigning values to the traceability process, a data basis is provided for quantifying the data flow status.
[0120] Specifically, the data flow score is calculated based on the automatic traceability results, and data security warnings are obtained based on the data flow score, including:
[0121] Data security alerts include high-risk alerts, medium-risk alerts, low-risk alerts, and no-risk alerts.
[0122] The data flow score is calculated using the data flow score formula, where the data flow score formula is specifically:
[0123] DFR=P4+P5+P6+P7+P8
[0124] Among them, DFR is the data flow score.
[0125] When DFR=5, a high risk alarm is generated.
[0126] When 3≤DFR<5, a high risk alarm is generated.
[0127] When 1≤DFR<3, a high risk alarm is generated.
[0128] When DFR=0, a high risk alarm is generated.
[0129] It should be noted that the data security alarm of this embodiment is provided with a corresponding data security alarm processing table, which provides a data reference for objectively calculating data security processing by quantifying the data flow status, scientifically simplifies the traceability analysis process, and provides the interpretability of the traceability results.
[0130] In a second aspect, this embodiment discloses Figure 2 A data security data flow tracing and analysis system is shown, and the system is applicable to the data security data flow tracing and analysis method as described above, and the system includes:
[0131] Data processing module, the data processing module is configured to: collect and mark data, obtain a data supervision matrix and a data information set, the data supervision matrix includes the length, confidentiality level and abnormal access frequency of the data, and the data information set includes the data label, data operation record and data flow path.
[0132] The data verification module is configured to: use the data supervision matrix to verify the data changes, obtain the verification results, and use the verification results to generate automatic traceability instructions.
[0133] The instruction acquisition module is configured to obtain traceability instructions. The traceability instructions include automatic traceability instructions and manual traceability instructions. The manual traceability instructions are configured to be directly input by the administrator.
[0134] The traceability result module is configured to obtain automatic traceability results based on automatic traceability instructions and manual traceability results based on manual traceability instructions.
[0135] The traceability analysis module is configured to calculate the data flow score based on the automatic traceability results, and obtain data security warnings based on the data flow score.
[0136] The traceability display module is configured to send one or more of data security warnings and manual traceability results to the administrator.
[0137] It should be noted that the data security data flow tracing analysis system of the present embodiment corresponds to the aforementioned data security data flow tracing analysis method. Therefore, the contents not specifically described in the data security data flow tracing analysis system of the present embodiment, for example, including but not limited to specific functional definitions, working principles and technical effects, etc., are the same as those in the aforementioned data security data flow tracing analysis method and will not be elaborated in this text.
[0138] In summary, the data security data flow tracing analysis method and system of this embodiment simplifies the data required for traceability and improves data standardization through the data supervision matrix and data information set, provides a data basis for improving computability, realizes real-time supervision of data changes through verification of the data supervision matrix, provides data reference for automatic traceability and improves the timeliness of traceability, fully meets the traceability requirements by dividing the traceability instruction execution, improves the objectivity of traceability by calculating the data flow score, provides a data basis for application in data security assessment, and realizes the computability, explainability, timeliness and objectivity of optimized data flow traceability applied in data security analysis.
[0139] In the embodiments provided in the present application, it should be understood that the embodiments described herein can be implemented in hardware, software, firmware, middleware, code or any appropriate combination thereof. For hardware implementation, the processor can be implemented in one or more of the following units: application specific integrated circuit (ASIC), digital signal processor (DSP), digital signal processing device (DSPD), programmable logic device (PLD), field programmable gate array (FPGA), processor, controller, microcontroller, microprocessor, other electronic units designed to implement the functions described herein or their combination. For software implementation, part or all of the flow of the embodiment can be completed by instructing the relevant hardware through a computer program. When implemented, the above program can be stored in a computer-readable storage medium or transmitted as one or more instructions or codes on a computer-readable storage medium. Computer-readable storage media include computer storage media and communication media, wherein the communication medium includes any medium that is convenient for transmitting a computer program from one place to another. The storage medium can be any available medium that a computer can access. The computer-readable storage medium can include but is not limited to RAM, ROM, EEPROM, CD-ROM or other optical disk storage, disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of an instruction or data structure and can be accessed by a computer.
[0140] Finally, it should be noted that the above is only a preferred embodiment of the present application and is not intended to limit the present application. Although the present application has been described in detail with reference to the aforementioned embodiments, it is still possible for those skilled in the art to modify the technical solutions described in the aforementioned embodiments or to make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.
Claims
1. A data security data flow tracing analysis method, characterized in that: The method includes: S1: Collect and mark data to obtain a data supervision matrix and a data information set. The data supervision matrix includes the length, confidentiality level and abnormal access frequency of the data. The data information set includes the data label, data operation record and data flow path; S2: Verify the data change using the data supervision matrix to obtain a verification result, and generate an automatic traceability instruction using the verification result; S3: Obtaining a traceability instruction, wherein the traceability instruction includes the automatic traceability instruction and the manual traceability instruction, and the manual traceability instruction is configured to be directly input by an administrator; S4: obtaining an automatic tracing result based on the automatic tracing instruction, and obtaining a manual tracing result based on the manual tracing instruction; S5: Calculate a data flow score based on the automatic tracing result, and obtain a data security warning based on the data flow score; S6: Sending any one or more of the data security warning and the manual tracing result to the administrator.
2. The data security data flow tracing analysis method according to claim 1 is characterized in that: The abnormal access frequency is specifically: Preset data traceability supervision cycle; The rejected data access is defined as abnormal access, and the number of abnormal accesses within the data traceability supervision cycle is counted to obtain the abnormal access frequency.
3. The data security data flow tracing analysis method according to claim 1 is characterized in that: The method of verifying the data change by using the data supervision matrix to obtain the verification result specifically includes: The data supervision matrix is specifically: DVM=[LE,SCL,AAR] Wherein, AAR is the abnormal access frequency, SCL is the confidentiality level, LE is the length, and DVM is the data supervision matrix; Get the data supervision matrix DVM of the tth data traceability supervision cycle t and the data supervision matrix DVM of the t-1th data traceability supervision cycle t-1 , the data check matrix DVM is calculated, wherein the calculation formula of the data check matrix is: ΔDVM=DVM t -DVM t-1 When the data check matrix is a zero matrix, the check result does not require tracing; When the data check matrix is a non-zero matrix, the check result requires tracing back to the source.
4. The data security data flow tracing analysis method according to claim 3 is characterized in that: The method of generating an automatic traceability instruction using the verification result specifically includes: When the verification result indicates that traceability is required, the corresponding data verification matrix and the label of the corresponding data are obtained, and the label is defined as a traceability label; Capturing non-zero elements in the data verification matrix, and using the non-zero elements to locate the time when the data changes; The traceability tag and the occurrence time are packaged and defined as the automatic traceability instruction and then output.
5. The data security data flow tracing analysis method according to claim 1 is characterized in that: The manual tracing instruction includes a query tag and a query cycle input by an administrator.
6. The data security data flow tracing analysis method according to claim 4 is characterized in that: The automatic tracing result is obtained based on the automatic tracing instruction, specifically comprising the following steps: A1: preset operation time threshold, abnormal access frequency change rate threshold and abnormal access frequency threshold; A2: Using the traceability tag and the occurrence time to obtain and parse the data supervision matrix DVM of the t-th data traceability supervision cycle t And the corresponding data information set DIS t and the data supervision matrix DVM of the t-1th data traceability supervision cycle t-1 And the corresponding data information set DIS t-1 ; A3: When the non-zero element is any one or more of the corresponding length and the security level, execute step A4; when the non-zero element is the corresponding abnormal access frequency, execute step A7; A4: traverse the data operation records obtained in step A2, and determine whether the data changes have corresponding operation instructions. If yes, execute step A5; otherwise, output the data changes and execute step A9; A5: Calculate the response time based on the occurrence time and the instruction time corresponding to the operation instruction, and determine whether the response time is less than or equal to the operation time threshold. If yes, execute step A6; otherwise, output the data change and execute step A9; A6: Determine whether the non-zero element corresponding to the length and the non-zero element corresponding to the confidentiality level correspond to the content of the operation instruction, if yes, determine that the data change is normal, otherwise output the data change and execute step A9; A7: Calculate the abnormal access frequency change rate based on the non-zero element corresponding to the abnormal access frequency, and determine whether the abnormal access frequency change rate is less than or equal to the abnormal access frequency change rate threshold. If yes, execute step A8; otherwise, output the data change and execute step A9; A8: Determine whether the abnormal access frequency of the tth data traceability supervision cycle is less than or equal to the abnormal access frequency threshold. If so, determine that the data change is normal, and then execute step A9; A9: Mark the location of the data change in the data flow path based on the time of occurrence of the data change, package the data supervision matrix corresponding to the data change and the marked data information set, define them as the automatic tracing result, and then output them.
7. The data security data flow tracing analysis method according to claim 5 is characterized in that: The obtaining of the manual tracing result based on the manual tracing instruction specifically includes: The corresponding data supervision matrix and the data information set are obtained based on the query tag and the query period, and are packaged and defined as the manual tracing result and then output.
8. The data security data flow tracing analysis method according to claim 6 is characterized in that: Steps A4 to A8 also include: A41: Assign P4 to the execution result of step A4. When there is a change in the output data, P4=1, otherwise P4=0; A51: Assign P5 to the execution result of step A5. When there is a change in the output data, P5=1, otherwise P5=0; A61: Assign P6 to the execution result of step A6. When there is a change in the output data, P6=1, otherwise P6=0; A71: Assign P7 to the execution result of step A7. When there is a change in the output data, P7=1, otherwise P7=0; A81: Assign P8 to the execution result of step A4. When there is a change in the output data, P8=1, otherwise P8=0.
9. The data security data flow tracing analysis method according to claim 8 is characterized in that: The calculating of the data flow score based on the automatic tracing result and obtaining the data security warning based on the data flow score specifically include: The data security warnings include high risk warnings, medium risk warnings, low risk warnings and no risk warnings; The data flow score is calculated using a data flow score formula, wherein the data flow score formula is specifically: DFR=P4+P5+P6+P7+P8 Among them, DFR is the data flow score; When DFR=5, the high risk alarm is generated; When 3≤DFR<5, the high risk alarm is generated; When 1≤DFR<3, the high risk alarm is generated; When DFR=0, the high risk alarm is generated.
10. A data security data flow tracing and analysis system, the system is applicable to the data security data flow tracing and analysis method according to any one of claims 1 to 9, characterized in that: The system includes: A data processing module, wherein the data processing module is configured to: collect and mark data to obtain a data supervision matrix and a data information set, wherein the data supervision matrix includes the length, confidentiality level and abnormal access frequency of the data, and the data information set includes a data label, data operation record and data flow path; A data verification module, wherein the data verification module is configured to: verify the data change using the data supervision matrix to obtain a verification result, and generate an automatic traceability instruction using the verification result; An instruction acquisition module, wherein the instruction acquisition module is configured to: acquire a traceability instruction, wherein the traceability instruction includes the automatic traceability instruction and the manual traceability instruction, and the manual traceability instruction is configured to be directly input by an administrator; A traceability result module, wherein the traceability result module is configured to: obtain an automatic traceability result based on the automatic traceability instruction, and obtain a manual traceability result based on the manual traceability instruction; A source tracing analysis module, wherein the source tracing analysis module is configured to: calculate a data flow score based on the automatic source tracing result, and obtain a data security warning based on the data flow score; A traceability display module, wherein the traceability display module is configured to send any one or more of the data security warning and the manual traceability result to an administrator.