Data asset security management method, device, equipment, medium and program product

Abstract

The invention provides a data asset management method which can be applied to the technical field of data security and financial science and technology. The method comprises the following steps: acquiring data assets of multiple data sources, and normalizing the data assets to obtain original asset data; extracting a plurality of original data features of the original asset data, and selecting a plurality of target data features from the plurality of original data features based on a preset statistical demand; clustering the original asset data based on the plurality of target data features to obtain a plurality of asset data modules; and checking the plurality of asset data modules in parallel through multiple threads to obtain a security check result based on the plurality of asset data modules. The invention further provides a data asset security management device and equipment, a storage medium and a program product.

Description

Technical Field

[0001] The present disclosure relates to the fields of data security and financial technology, and specifically to a data asset security management method, device, equipment, medium and program product. Background Art

[0002] In the information age, the development of the financial industry is more closely integrated with information technology. Maintaining information security in the financial industry is conducive to promoting financial innovation and service development. The existing centralized security asset management and control system has the following shortcomings. First, the system has many data sources and slow processing speed. The integration and processing of all data sources leads to a large number of system process table fields, which increases the complexity of the code and reduces the efficiency of system operation. At the same time, some upstream applications send incomplete data source field information, and the system has many special processing and frequent interactions with the database, which affects the overall performance of the system. Second, the business logic between system modules is complex and highly coupled. If a problem occurs in one module, it will affect the data processing process of other modules, thereby affecting the timeliness of the security inspection of the entire group. Third, the system has low scalability. When a new module is connected to the system, it is necessary to expand all the process table fields of the system, which increases the system development cost and is not conducive to system maintenance. Summary of the invention

[0003] In view of the above problems, the present disclosure provides a data asset security management method, apparatus, device, medium and program product that improve the timeliness of data security checks, system operation efficiency and system scalability.

[0004] A first aspect of the present disclosure provides a data asset security management method, the method comprising: acquiring data assets from multiple data sources, normalizing the data assets to obtain original asset data; extracting multiple original data features of the original asset data, and selecting multiple target data features from the multiple original data features based on preset statistical requirements; clustering the original asset data based on the multiple target data features to obtain multiple asset data modules; and checking the multiple asset data modules in parallel through multi-threading to obtain security inspection results based on the multiple asset data modules.

[0005] According to an embodiment of the present disclosure, the acquiring of data assets from multiple data sources, normalizing the data assets, and obtaining original asset data includes: acquiring data assets from the multiple data sources, filtering the data assets based on preset data specifications, and obtaining original input data; and converting the original input data into a normalized format to obtain the original asset data.

[0006] According to an embodiment of the present disclosure, the extracting of multiple original data features of the original asset data and selecting multiple target data features from the multiple original data features based on preset statistical requirements include: extracting multiple original data features of the original asset data based on principal component analysis; setting filtering association rules based on the preset statistical requirements, sorting the multiple original data features, and selecting the original data features ranked in the top N positions as the target data features.

[0007] According to an embodiment of the present disclosure, the method clusters the original asset data based on the multiple target data features to obtain multiple asset data modules, including: standardizing each type of data included in the original asset data; vectorizing the standardized original asset data based on the multiple target data features to obtain the values ​​of the original asset data on each target data feature; assigning the standardized original asset data to a preset number of clusters, calculating the Euclidean distance between the values ​​of the original asset data on each target data feature and the center point in the cluster for clustering; adjusting the center point based on the clustering result to repeatedly iteratively cluster the original asset data until the change in the position of the center point remains within a preset range, thereby obtaining the multiple asset data modules.

[0008] According to an embodiment of the present disclosure, the standardization processing of each type of data included in the original asset data includes: calculating the standard deviation and mean of each type of data of the original asset data; calculating the difference between each type of data in each group of data in the original asset data and the mean of the corresponding category data, and calculating the ratio of the difference to the standard deviation of the corresponding category data to obtain standardized data.

[0009] According to an embodiment of the present disclosure, the method of checking the multiple asset data modules in parallel through multiple threads to obtain security check results based on the multiple asset data modules includes: calculating a resource allocation coefficient based on the amount of data of each asset data module in the multiple asset data modules and the complexity of the security check; starting a thread pool, and allocating threads to perform security checks based on the resource allocation coefficients of each asset data module to obtain the security check results; wherein, the higher the resource allocation coefficient of the asset data module, the more computing resources the corresponding thread has.

[0010] According to an embodiment of the present disclosure, the method of calculating the resource allocation coefficient based on the data volume and the complexity of the security check of each asset data module among the multiple asset data modules includes: calculating the proportion of the data volume of the asset data module to the total data volume of the multiple asset data modules to obtain the data volume coefficient; calculating the proportion of the complexity of the security check of the asset data module to the total complexity of the multiple asset data modules to obtain the complexity coefficient; calculating the sum of the data volume coefficient and the complexity coefficient to obtain the resource allocation coefficient.

[0011] The second aspect of the present disclosure provides a data asset security management device, which includes: a data acquisition module, which is used to acquire data assets from multiple data sources, standardize the data assets, and obtain original asset data; a feature extraction module, which is used to extract multiple original data features of the original asset data, and select multiple target data features from the multiple original data features based on preset statistical requirements; a data clustering module, which is used to cluster the original asset data based on the multiple target data features to obtain multiple asset data modules; and a parallel inspection module, which is used to parallelly inspect the multiple asset data modules through multiple threads to obtain security inspection results based on the multiple asset data modules.

[0012] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above method.

[0013] The fourth aspect of the present disclosure further provides a computer-readable storage medium having a computer program or instructions stored thereon, which implements the steps of the above method when the above computer program or instructions are executed by a processor.

[0014] The fifth aspect of the present disclosure further provides a computer program product, including a computer program or instructions, which implement the steps of the above method when the above computer program or instructions are executed by a processor. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0016] Figure 1 The application scenario diagram of the data asset security management method, apparatus, device, medium and program product according to the embodiment of the present disclosure is schematically shown;

[0017] Figure 2 A flowchart of a data asset security management method according to an embodiment of the present disclosure is schematically shown;

[0018] Figure 3 A schematic diagram of a data asset security management device according to an embodiment of the present disclosure is shown; and

[0019] Figure 4 A block diagram of an electronic device suitable for implementing a data asset security management method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0020] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0021] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0022] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0023] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0024] It should be noted that the data asset security management method and device provided by the present disclosure can be used for applications in data security testing in the financial field, and can also be used for applications in data security testing in any field other than the financial field. The application field of the data asset security management method and device provided by the present disclosure is not limited.

[0025] In the technical solution of the present disclosure, the user information (including but not limited to user personal information, user image information, user device information, such as location information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with relevant laws, regulations and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0026] In the scenario of using personal information for automated decision-making, the methods, devices, and systems provided by the embodiments of the present disclosure provide users with corresponding operation portals for users to choose to agree or reject the automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered. The expression "automated decision-making" here refers to the activity of automatically analyzing and evaluating a person's behavioral habits, interests and hobbies, or economic, health, credit status, etc. through computer programs, and making decisions. The expression "expert decision-making" here refers to the activity of making decisions by people who specialize in a certain field, have specialized experience, knowledge and skills, and have reached a certain level of professionalism.

[0027] An embodiment of the present disclosure provides a data asset security management method, which includes: acquiring data assets from multiple data sources, normalizing the data assets, and obtaining original asset data; extracting multiple original data features of the original asset data, and selecting multiple target data features from the multiple original data features based on preset statistical requirements; clustering the original asset data based on the multiple target data features to obtain multiple asset data modules; and checking the multiple asset data modules in parallel through multi-threading to obtain security inspection results based on the multiple asset data modules.

[0028] Figure 1 The application scenario diagram of the data asset security management method according to the embodiment of the present disclosure is schematically shown.

[0029] like Figure 1 As shown, the application scenario 100 according to this embodiment may include an application scenario in which a bank performs security checks on data assets. The network 104 is used as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0030] The user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0031] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0032] The server 105 may be a server that provides various services, such as a background management server (only as an example) that provides support for websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0033] It should be noted that the data asset security management method provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the data asset security management device provided in the embodiment of the present disclosure can generally be set in the server 105. The data asset security management method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Accordingly, the data asset security management device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0034] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0035] The following will be based on Figure 1 The scene described by Figure 2 The data asset security management method of the disclosed embodiment is described in detail.

[0036] Figure 2 The flowchart of the data asset security management method according to the embodiment of the present disclosure is schematically shown.

[0037] like Figure 2 As shown, the data asset security management method of this embodiment includes operations S210 to S240, and the transaction processing method can be executed sequentially.

[0038] In operation S210, data assets from multiple data sources are acquired, and the data assets are normalized to obtain original asset data.

[0039] In the centralized security asset management and control system, security assets include clients, servers, databases, network devices, special terminals and other types. The data generated from these security assets are data assets. Among them, the data sources of data assets mainly include basic information maintenance data and upstream application log data. Basic information maintenance data includes data tables maintained by system administrators such as organization list, user list, user permission table, role table, system menu table, security product installation exception table, terminal asset information table, special terminal table, and organization conversion information table. Upstream application log data is the main content of security checks. It is a log file sent by upstream applications through the file transfer platform, including TMS, WSUS, OSCE, UCM, CMDB, RSAS and other types.

[0040] Due to the diversity of data sources, data assets need to be standardized before security checks are conducted. The specifications of data assets can include log file names, file contents, and data formats that meet preset specifications. Data that meets the specifications will be stored in the database, and data that does not meet the specifications will be cleaned up regularly, so that preliminary data sorting can be achieved, which can simplify the steps and processes of data security checks to a certain extent.

[0041] In operation S220, a plurality of original data features of the original asset data are extracted, and a plurality of target data features are selected from the plurality of original data features based on preset statistical requirements.

[0042] In the disclosed embodiment, data redundancy and data dimension can be reduced by extracting data features. The efficiency of subsequent data processing can be accelerated by reducing the amount of feature data. Furthermore, by further selecting target data features, the amount of feature data can be further reduced on the basis of the original data features, and the data in the asset data module can be highly aggregated based on the features in the subsequent process, and the aggregation direction of each asset data module is more targeted.

[0043] In operation S230 , the original asset data is clustered based on a plurality of target data features to obtain a plurality of asset data modules.

[0044] In the disclosed embodiment, by using the k-means clustering algorithm, the existing multi-data source cross-processing logic is split into k modules, and the modules obtained after the decomposition can independently process data, thereby splitting the highly coupled business logic and splitting the highly coupled modules into multiple highly cohesive modules, reducing the complexity of data processing and improving data processing efficiency.

[0045] In operation S240, multiple asset data modules are checked in parallel through multiple threads to obtain security check results based on the multiple asset data modules.

[0046] According to the embodiments of the present disclosure, after decoupling the original asset data, a multi-threaded parallel processing method is introduced to achieve parallel processing of data in each module and simultaneous processing of data in multiple modules, thereby reducing the waiting time and response speed of the modules. Even if a module fails, it will not affect the operation of other modules, greatly improving the execution efficiency of the system and ensuring stable operation of the system.

[0047] According to the data asset security management method provided by the embodiment of the present disclosure, through clustering algorithm and multi-threaded parallel processing, on the one hand, the operational stability of the centralized security asset management and control system and the efficiency of the security inspection of the entire group are improved, helping the information security construction of the entire group to reach a new level. On the other hand, the code scalability and portability are improved, reducing the difficulty for developers to expand modules and operate and maintain systems.

[0048] According to operation S210, data assets from multiple data sources are acquired, and the data assets are normalized to obtain original asset data, which may include operations S211-S212.

[0049] In operation S211, data assets from multiple data sources are obtained, and the data assets are filtered based on preset data specifications to obtain original storage data.

[0050] Standardizing upstream application log data can improve data quality from the source and reduce the complexity of business logic. In the disclosed embodiment, the upstream application sends various types of log files to the specified directory of the file receiving server of the system that executes the data asset security management method at the specified time according to the preset security asset centralized management and control data submission specifications and requirements. The system can execute the data warehousing script through timed scheduling tasks. Read the log files in the corresponding directory of the server, back up the files first, and then store them separately to obtain all the original warehousing data tables.

[0051] In order to improve the quality of system data, strict control is implemented on the file name, field length of file content and separators between fields in the database script. The system only processes files whose file names conform to the format specifications. The general format of the file name is "upstream application abbreviation-upload file type-institution information-upload server information-upload date"; on the other hand, the system only parses data whose field length in the file content does not exceed the set maximum value and the fields are separated by ESC. For files that do not meet the above conditions, regular cleaning is carried out, and email reminders are sent to the problematic branches / institutions to make rectifications.

[0052] In operation S212, the original storage data is converted into a standardized format to obtain original asset data.

[0053] Furthermore, due to different data sources, log data from different data sources may be stored in different formats. Before the original data is stored in the database, the log data from different data sources will be converted into a unified standardized format. For example, data from different equipment sources and different institutional sources will be converted and stored in a unified format, which will facilitate unified security checks later.

[0054] According to operation S220, a plurality of original data features of the original asset data are extracted, and a plurality of target data features are selected from the plurality of original data features based on preset statistical requirements, which may include S221-S222.

[0055] In operation S221 , a plurality of original data features of the original asset data are extracted based on a principal component analysis method.

[0056] Principal component analysis is a commonly used data dimensionality reduction method. Its basic idea is to calculate a set of new features from a set of features, which are arranged in descending order of importance. They are linear combinations of the original features, and the new features are uncorrelated. We calculate the mapping value of the original features on the new features, which is the new sample after dimensionality reduction. In other words, the goal of principal component analysis is to transform the original features with a set of orthogonal vectors to obtain new features, which are linear combinations of the original features. Extracting data features based on principal component analysis has been widely used in practical applications, so I will not go into details here.

[0057] In operation S222, a filtering association rule is set based on a preset statistical requirement, a plurality of original data features are sorted, and original data features ranked in the top N positions are selected as target data features, where N is an integer greater than 1.

[0058] In the disclosed embodiment, on the basis of extracting the original data features by principal component analysis, in order to further clarify the bias of data security detection, further feature screening is performed on the basis of the original data features. By extracting and selecting data features, the features that meet the division of asset data modules are screened, so that the data in the asset data module is highly aggregated based on the features, and the aggregation direction of each asset data module is more targeted.

[0059] By extracting and selecting features from the original asset data, data redundancy and data dimension can be reduced. Reducing the number of features can speed up data processing efficiency.

[0060] Taking the data object as an example, the three characteristics of "asset type", "log type" and "data volume" can include client, server, database, network equipment, and special terminal, which are represented by 1, 2, 3, 4, and 5 respectively; "log type" can include TMS, WSUS, OSCE, UCM, CMDB, and RSAS, which are represented by 1, 2, 3, 4, 5, and 6 respectively; "data volume" identifies the data volume of each type of data table. Since different types of assets need to upload different application data, in this embodiment, the client needs to upload a1 applications, the server needs to upload a2, the database needs to upload a3, the network equipment needs to upload a4, and the special terminal needs to upload a5. The number of data objects is the sum of applications that all types of assets need to install, that is, the sum of a1, a2, a3, a4, and a5.

[0061] According to operation S230, clustering the original asset data based on multiple target data features to obtain multiple asset data modules may include operations S231-S234.

[0062] In operation S231, various types of data included in the original asset data are standardized.

[0063] Standardizing data objects can eliminate the problem of slow algorithm convergence caused by inconsistent dimensions of different features and the problem of large-dimensional features covering small-dimensional features during calculations.

[0064] The standardization process may include S2311~S2312.

[0065] In operation S2311, the standard deviation and mean of each type of data of the original asset data are calculated.

[0066] In operation S2312, the difference between each type of data in each group of data in the original asset data and the mean of the corresponding category data is calculated, and the ratio of the difference to the standard deviation of the corresponding category data is calculated to obtain standardized data.

[0067] Through this method, this type of data is processed into a value with a mean of 0 and a standard deviation of 1. The calculation formula is as follows

[0068]

[0069] Among them, x i represents a type of data in the i-th group of data, mean represents the average value of this type of data, Indicates the standard deviation of this type of data, x' i Represents the data after normalization.

[0070] In operation S232, the standardized original asset data is vectorized based on multiple target data features to obtain the value of the original asset data at each target data feature.

[0071] In operation S233, the standardized original asset data is distributed to a preset number of clusters, and the Euclidean distance between the value of the original asset data on each target data feature and the center point in the cluster is calculated for clustering.

[0072] In operation S234, the original asset data is iteratively clustered by adjusting the center point based on the clustering result until the change in the position of the center point remains within a preset range, thereby obtaining a plurality of asset data modules.

[0073] In the disclosed embodiment, the k-means clustering algorithm based on average distance is used for decomposition. The idea of ​​the k-means algorithm is to randomly assign all data objects to k clusters, and then cluster them based on Euclidean distance, constantly adjust the position of the cluster center point, and iterate repeatedly until the center point no longer drifts, that is, clustering is completed. The advantages of the k-means clustering algorithm are low computational complexity and higher efficiency. Among them, the Euclidean distance is based on the following formula:

[0074]

[0075] Where, d ij represents the Euclidean distance between data objects i and j, x ik and x jk They represent the values ​​of the kth feature of data objects i and j respectively, and m represents the number of features of the data object.

[0076] According to operation S240, multiple asset data modules are checked in parallel through multiple threads to obtain security check results based on the multiple asset data modules, which may include operations S241-S242.

[0077] In operation S241 , a resource allocation coefficient is calculated based on the data volume of each of the plurality of asset data modules and the complexity of the security check.

[0078] Calculating the resource allocation coefficient includes the following steps.

[0079] In operation S2411, the proportion of the data volume of the asset data module to the total data volume of the multiple asset data modules is calculated to obtain a data volume coefficient. The data volume coefficient calculation formula is as follows:

[0080]

[0081] Where Dv(i) represents the data volume of the i-th asset data module, k represents the number of asset data modules, and C Dv (i) represents the data volume coefficient of the i-th asset data module.

[0082] In operation S2412, the complexity of the security check of the asset data module accounts for the proportion of the total complexity of multiple asset data modules to obtain a complexity coefficient. The calculation formula of the complexity coefficient is as follows:

[0083]

[0084] Where Bl(i) represents the logic complexity of the i-th asset data module, k represents the number of asset data modules, and C Bl (i) represents the complexity coefficient of the i-th asset data module.

[0085] In operation S2413, the sum of the data volume coefficient and the complexity coefficient is calculated to obtain the resource allocation coefficient, and the calculation formula is as follows:

[0086]

[0087] Among them, C Cr (i) represents the resource allocation coefficient of the i-th asset data module.

[0088] In operation S241, the thread pool is started, and threads are allocated to perform security checks based on resource allocation coefficients of each asset data module to obtain security check results.

[0089] The higher the resource allocation coefficient of the asset data module, the more computing resources the corresponding thread has. Considering the different data volumes and the complexity of the security check logic of each module, different computing resources are allocated to different modules. For modules with large data volumes and high complexity of security check logic, more computing resources are allocated.

[0090] The security check results obtained according to the above steps can provide users with page display and maintenance functions, so that users can promptly discover and complete rectification work for problematic assets found during the inspection.

[0091] According to the data asset security management method provided by the embodiment of the present disclosure, through the k-means clustering algorithm and multi-threaded parallel processing mode, on the one hand, the operational stability of the centralized control system of security assets and the efficiency of the security inspection of the whole group are improved, and the information security construction of the whole group is helped to reach a new level. On the other hand, the scalability and portability of the code are improved, and the difficulty of developers to expand modules and operation and maintenance systems is reduced. By using a clustering algorithm, the existing multi-data source cross-processing logic is split into k modules, and the modules obtained after decomposition can independently process data. At the same time, when adding new application log data access, without modifying the overall logic of the system, only the newly accessed data table, data processing logic and result display need to be added. Using a multi-threaded parallel processing method, multiple module data are processed simultaneously and different modules obtain different computing resources according to the resource allocation coefficient, reducing the waiting time and response speed of the module. Even if there is a module failure, it will not affect the operation of other modules, greatly improving the execution efficiency of the system and ensuring the stable operation of the system.

[0092] Based on the above data asset security management method, the present disclosure also provides a data asset security management device. Figure 3 The device is described in detail.

[0093] Figure 3 The structural block diagram of the data asset security management device according to an embodiment of the present disclosure is schematically shown.

[0094] As shown in the figure, the data asset security management device 300 of this embodiment includes a data acquisition module 310 , a feature extraction module 320 , a data clustering module 330 and a parallel checking module 340 .

[0095] The data acquisition module 310 is used to acquire data assets from multiple data sources, perform standardization on the data assets, and obtain original asset data. In one embodiment, the data acquisition module 310 can be used to perform the operation S210 described above, which will not be described in detail here.

[0096] The feature extraction module 320 is used to extract multiple raw data features of the raw asset data, and select multiple target data features from the multiple raw data features based on preset statistical requirements. In one embodiment, the feature extraction module 320 can be used to perform the operation S220 described above, which will not be repeated here.

[0097] The data clustering module 330 is used to cluster the original asset data based on multiple target data features to obtain multiple asset data modules. In one embodiment, the data clustering module 330 can be used to perform the operation S230 described above, which will not be described in detail here.

[0098] The parallel check module 340 is used to check multiple asset data modules in parallel through multi-threading to obtain security check results based on multiple asset data modules. In one embodiment, the parallel check module 340 can be used to perform the operation S240 described above, which will not be repeated here.

[0099] According to an embodiment of the present disclosure, any multiple modules of the data acquisition module 310, the feature extraction module 320, the data clustering module 330 and the parallel inspection module 340 can be combined in one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the data acquisition module 310, the feature extraction module 320, the data clustering module 330 and the parallel inspection module 340 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in a suitable combination of any of them. Alternatively, at least one of the data acquisition module 310 , the feature extraction module 320 , the data clustering module 330 , and the parallel checking module 340 may be at least partially implemented as a computer program module, and when the computer program module is executed, a corresponding function may be performed.

[0100] Figure 4 A block diagram of an electronic device suitable for implementing a data asset security management method according to an embodiment of the present disclosure is schematically shown.

[0101] like Figure 4 As shown, the electronic device 400 according to an embodiment of the present disclosure includes a processor 401, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 402 or a program loaded from a storage part 408 to a random access memory (RAM) 403. The processor 401 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a dedicated microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 401 may also include an onboard memory for caching purposes. The processor 401 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0102] In RAM 403, various programs and data required for the operation of electronic device 400 are stored. Processor 401, ROM 402 and RAM 403 are connected to each other via bus 404. Processor 401 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 402 and / or RAM 403. It should be noted that the program can also be stored in one or more memories other than ROM 402 and RAM 403. Processor 401 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in one or more memories.

[0103] According to an embodiment of the present disclosure, the electronic device 400 may further include an input / output (I / O) interface 405, which is also connected to the bus 404. The electronic device 400 may further include one or more of the following components connected to the input / output (I / O) interface 405: an input portion 406 including a keyboard, a mouse, etc.; an output portion 407 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 408 including a hard disk, etc.; and a communication portion 409 including a network interface card such as a LAN card, a modem, etc. The communication portion 409 performs communication processing via a network such as the Internet. A drive 410 is also connected to the input / output (I / O) interface 405 as needed. A removable medium 411, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 410 as needed, so that a computer program read therefrom is installed into the storage portion 408 as needed.

[0104] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0105] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, it may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, the computer-readable storage medium may include the ROM 402 and / or RAM 403 described above and / or one or more memories other than ROM 402 and RAM 403.

[0106] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the data asset security management method provided by the embodiment of the present disclosure.

[0107] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 401. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0108] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 409, and / or installed from the removable medium 411. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0109] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 409, and / or installed from the removable medium 411. When the computer program is executed by the processor 401, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, apparatus, module, unit, etc. described above can be implemented by a computer program module.

[0110] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0111] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0112] It will be appreciated by those skilled in the art that the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations or combinations are not explicitly described in the present disclosure. In particular, without departing from the spirit and teachings of the present disclosure, the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0113] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A data asset security management method, characterized in that: The method comprises: Acquire data assets from multiple data sources, perform normalization on the data assets, and obtain original asset data; Extracting a plurality of original data features of the original asset data, and selecting a plurality of target data features from the plurality of original data features based on preset statistical requirements; Clustering the original asset data based on the multiple target data features to obtain multiple asset data modules; The multiple asset data modules are checked in parallel through multiple threads to obtain security check results based on the multiple asset data modules.

2. The method according to claim 1, characterized in that The acquiring of data assets from multiple data sources and normalizing the data assets to obtain original asset data includes: Acquire data assets from the multiple data sources, filter the data assets based on preset data specifications, and obtain original data stored in the warehouse; The original storage data is converted into a standardized format to obtain the original asset data.

3. The method according to claim 1, characterized in that The extracting a plurality of original data features of the original asset data and selecting a plurality of target data features from the plurality of original data features based on preset statistical requirements comprises: Extracting multiple raw data features of the raw asset data based on principal component analysis; A filtering association rule is set based on the preset statistical requirement, the multiple original data features are sorted, and the original data features ranked in the top N positions are selected as the target data features.

4. The method according to claim 1, characterized in that: The method clusters the original asset data based on the multiple target data features to obtain multiple asset data modules including: Standardizing various types of data included in the original asset data respectively; Vectorizing the standardized original asset data based on the multiple target data features to obtain the value of the original asset data on each target data feature; Allocate the standardized raw asset data to a preset number of clusters, and calculate the Euclidean distance between the value of the raw asset data on each target data feature and the center point in the cluster for clustering; The center point is adjusted based on the clustering result to perform iterative clustering on the original asset data until the change in the position of the center point remains within a preset range, thereby obtaining the multiple asset data modules.

5. The method according to claim 4, characterized in that The standardization of various types of data included in the original asset data includes: Calculate the standard deviation and mean of various types of data of the original asset data; The difference between each type of data in each group of data in the original asset data and the mean of the corresponding category data is calculated, and the ratio of the difference to the standard deviation of the corresponding category data is calculated to obtain standardized data.

6. The method according to claim 1, characterized in that The obtaining of security check results based on the multiple asset data modules by checking the multiple asset data modules in parallel through multiple threads includes: Calculating a resource allocation coefficient based on the data volume of each asset data module in the plurality of asset data modules and the complexity of the security check; Starting a thread pool, allocating threads to perform security checks based on resource allocation coefficients of each of the asset data modules, and obtaining the security check results; Among them, the higher the resource allocation coefficient of the asset data module, the more computing resources the corresponding thread has.

7. The method according to claim 6, characterized in that The calculating of the resource allocation coefficient based on the data volume of each asset data module in the plurality of asset data modules and the complexity of the security check comprises: Calculate the proportion of the data volume of the asset data module to the total data volume of the multiple asset data modules to obtain a data volume coefficient; Calculating the ratio of the complexity of the security check of the asset data module to the total complexity of the multiple asset data modules to obtain a complexity coefficient; The sum of the data volume coefficient and the complexity coefficient is calculated to obtain the resource allocation coefficient.

8. A data asset security management device, characterized in that: The device comprises: A data acquisition module is used to acquire data assets from multiple data sources, perform standardization on the data assets, and obtain original asset data; A feature extraction module, used to extract multiple original data features of the original asset data, and select multiple target data features from the multiple original data features based on preset statistical requirements; A data clustering module, used for clustering the original asset data based on the multiple target data features to obtain multiple asset data modules; The parallel inspection module is used to inspect the multiple asset data modules in parallel through multiple threads to obtain security inspection results based on the multiple asset data modules.

9. An electronic device, comprising: one or more processors; a memory for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program or instruction stored thereon, characterized in that: When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

11. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images