Computer data processing system based on data security test

Abstract

The invention relates to the technical field of data processing, in particular to a computer data processing system based on data security testing, which is characterized in that data is collected in real time through a data acquisition module, and initial security tags including a data source tag, a data attribute tag and a security level tag are added to the data; constructing a multi-stage security association model according to the initial security label of the data; multi-level association detection: according to the constructed multi-stage security association model, performing association detection when the data stream enters each processing stage; after the association path is marked as an abnormal association path, a security event alarm is generated immediately, and the abnormal condition and the source node of the data are recorded automatically; and before data processing is completed and output, full-process traceability detection is carried out. According to the invention, the response speed of the system to the data security event and the exception handling efficiency are greatly improved, so that the potential security risk can be found and controlled in time.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to a computer data processing system based on data security testing. Background Art

[0002] In the modern computing environment of data processing and transmission, data security and traceability have become key requirements. With the increasing demand for real-time data processing and security management in various industries, the security risks faced by data in the multi-stage and multi-node flow process continue to rise, especially when the data sources are complex, diverse in types and with different sensitivities. Traditional data security assurance methods are difficult to meet the needs of full-process security monitoring of complex data flows.

[0003] Traditional data security systems mainly monitor data security through static rules and fixed policies. This approach lacks flexibility and adaptability when dealing with structured and unstructured data, internal and external data sources. When the data types are diverse or the sensitivity level is high, static rules are difficult to cover all potential risk scenarios, and data security policies are prone to insufficient or overprotection. In addition, traditional anomaly detection mechanisms are mostly based on preset fixed thresholds, which make it difficult to identify state anomalies and potential security threats in complex data flows in real time and accurately. This makes the system slow to respond to sudden risks in data flow, making it difficult to detect and handle security incidents in a timely manner, increasing the risk of data leakage or tampering.

[0004] In response to this problem, current technology has limited data traceability capabilities. Since data undergoes multiple conversions, storage, and transmissions during multi-stage processing, traditional traceability methods are difficult to accurately track state changes at each stage, making it difficult to accurately trace the data flow path and state changes after a security incident occurs. In addition, when data flows between different processing nodes, path breakpoints or discontinuities are prone to occur, and the lack of a systematic traceability mechanism makes it difficult to ensure the integrity of the data flow. Summary of the invention

[0005] The invention provides a computer data processing system based on data security testing.

[0006] A computer data processing system based on data security testing, comprising:

[0007] Data collection and initial labeling: The data collection module collects data in real time and adds initial security labels to it, including data source labels, data attribute labels, and security level labels;

[0008] Multi-stage security association model construction: A multi-stage security association model is constructed based on the initial security label of the data. The security association model defines the association relationship of the data in different processing stages and outputs association parameters. The processing stages include format conversion, calculation, storage, transmission and output.

[0009] Multi-level association detection: Based on the constructed multi-stage security association model, association detection is performed when the data flow enters each processing stage. During the association detection, if it is detected that the state of the data at a certain stage does not match the security association model, it is marked as an abnormal association path;

[0010] Real-time capture of security events: After marking as an abnormal correlation path, a security event alert is immediately generated, and the abnormal situation and source node of the data are automatically recorded;

[0011] Multi-stage data flow traceability detection mechanism: Before data processing is completed and output, full-process traceability detection is carried out to check the integrity of the data flow, the transmission path and the processing status of each stage based on the security association records of each stage.

[0012] Optionally, the data acquisition module includes:

[0013] Data source identification unit: used to receive external data in real time, identify the IP address, device ID, and application system ID of the data, extract information that can uniquely identify the source of the data, generate and attach a data source tag T s , including source type and source credibility, which are used to distinguish data from different sources;

[0014] Attribute analysis unit: analyzes the type, structure, format and content of received data and generates data attribute tags T a ,Data attribute tags include data type, data format, and data structure information, which are used to describe the basic characteristics of data;

[0015] Security level assignment unit: Evaluate data sensitivity based on data attribute labels, classify data into high sensitivity level, medium sensitivity level, and low sensitivity level, and classify data using a preset sensitivity rule library to obtain a security level label T l ;

[0016] The label binding unit binds the generated security labels including data source labels, data attribute labels and security level labels to the data one by one to ensure that the data has a unique identity in the subsequent processing stage and provide basic data for the subsequent multi-stage security association model construction.

[0017] Optionally, the multi-stage security association model construction specifically includes:

[0018] Multi-stage processing definition: The data processing process is divided into multiple stages, including format conversion, calculation, storage, transmission and output. Each stage specifies the state and operation mode of the data in the processing flow;

[0019] Define the state of each stage as S i , where i = 1, 2, 3, 4, 5;

[0020] Initial security label analysis: Obtain the initial security label information of each data, including data source label, data attribute label and security level label, as the basis for building a security association model;

[0021] Definition of association relationship: By analyzing the characteristics of data at each processing stage, a secure association relationship of data is established, including:

[0022] Inter-stage association: defines the flow relationship and state changes of data between adjacent processing stages;

[0023] Security policy association: According to the security level label of the data, security policy association parameters of different stages are set in the multi-stage security association model;

[0024] Association parameter output: The data association parameters generated by the multi-stage security association model include:

[0025] Status identification parameter P state : Record the processing status of data at each stage, used to identify the security status and flow status of data at different stages;

[0026] Security policy parameter P policy : Define data security requirements at each stage, including encryption requirements, access control levels, and authentication methods;

[0027] Traceability path parameter P trace : Record the source and flow path of data at different processing stages for anomaly detection and traceability analysis;

[0028] At each stage S i The association parameters output by the multi-stage security association model include P state ,P policy and P trace .

[0029] Optionally, the data source tag T s Describes the source characteristics of data, which is used to determine access control and trustworthiness, including:

[0030] Source type: defined as internal data 1 or external data 0;

[0031] Source credibility: The credibility level of the data source, which is a decimal value between [0,1], where 0 represents low credibility and 1 represents high credibility;

[0032] The data attribute tag T a Describes the basic characteristics of data and is used to determine the processing requirements of the data, including:

[0033] Data type: defined as numeric type 1, text type 2, image type 3, file type 4;

[0034] Data format: encoding format: JSON, XML, CSV;

[0035] Data structure: structured data 1 or unstructured data 0;

[0036] The security level label T l Describe the sensitivity level of the data, which is used to set the protection requirements of the data;

[0037] Sensitivity level: defined as high sensitivity 2, medium sensitivity 1, low sensitivity 0.

[0038] Optionally, the state identification parameter P state In the above equation, the state identification parameters of each stage are expressed as:

[0039] P state (S i )=f(T s ,T a ,T l ), where f is the state identification generation function, which is calculated as follows:

[0040]

[0041] in:

[0042] Status P state =1 means the data is reliable and comes from internal sources;

[0043] Status P state =2 means the data is numerical or text structured data;

[0044] Status P state =3 means the data is highly sensitive.

[0045] Optionally, the security policy parameter P policy Calculated according to security level and data source, expressed as:

[0046] P policy (S i )=g(T s ,T l ), where g is the security policy generation function:

[0047]

[0048] in:

[0049] Encryption strategy: Highly sensitive data must be encrypted when stored or transmitted;

[0050] Access control strategy: low credibility or external data requires access control at each stage;

[0051] Basic protection strategy: Basic protection should be applied to low-sensitivity data.

[0052] Optionally, the traceability path parameter P trace Used to track the transmission path of data at each stage, expressed as: P trace (S i )=h(SrcType,S i ), where SrcType is the source type and h is the path tracing function, calculated as: P trace (S i )=SrcType×S i When SrcType = 1, it indicates internal source, and the path record is S i ; When SrcType = 0, it indicates an external source and the path includes the complete transmission nodes.

[0053] Optionally, the multi-level association detection specifically includes:

[0054] State matching detection: When the data flow enters each processing stage S i When the current state identification parameter P of the data is obtained state (S i ) and security policy parameter P policy (S i ), and matching them with the expected parameters of the corresponding stage in the multi-stage security association model;

[0055] Detection condition verification: If the actual state of the data identifies the parameter P state (S i ) and security policy parameter P policy (S i ) is inconsistent with the expected value of the associated model (i.e., the state or policy does not meet the preset security requirements), it is considered a state mismatch;

[0056] Abnormal correlation path marking: When a state mismatch is detected, the current processing stage is marked as an abnormal correlation path.

[0057] Optionally, the security event alarm in the real-time capture of the security event includes abnormal alarm information, and the abnormal alarm information includes:

[0058] Anomaly type: describes the type of mismatch detected, including state mismatch and policy mismatch;

[0059] Abnormal stage: record the abnormal processing stage Si (format conversion, calculation, storage, transmission, output);

[0060] Abnormal time: The timestamp when the alarm was generated, used for subsequent event tracking.

[0061] Abnormal identification: Generates an alarm ID that uniquely identifies the abnormal event to ensure the uniqueness and traceability of the event. The source node is obtained through the source type in the data source label.

[0062] Optionally, the whole process traceability detection includes calling the traceability detection mechanism before the data flow processing is completed, according to the traceability path parameter P trace Record the information of each stage, check whether the processing status and transmission path of the data in each processing stage meet the expectations of the multi-stage security association model, and trace the path parameter P trace (S i ) Record the data flow at each processing stage S i The transmission path and status of the data, including the entry and exit time, source node, target node and security status of the data at the current stage;

[0063] It also includes security association record R assoc : Record and store the expected path and status requirements for each processing stage, including:

[0064] Expected source node M Source (S i ): expected data source node;

[0065] Expected target node M Dest (S i ): expected data target node;

[0066] Expected status indicator M state (S i ): Expected data status.

[0067] Beneficial effects of the present invention:

[0068] The present invention realizes the whole process security monitoring from data acquisition to final output by constructing a multi-stage security association model and combining the initial security labels of the data (including data source labels, data attribute labels and security level labels). The system dynamically generates association parameters in each stage of data flow (format conversion, calculation, storage, transmission and output) to ensure that the data processing in each stage meets its specific security requirements. The introduction of multi-dimensional label analysis enables the system to identify the source, attributes and sensitivity level of the data and automatically configure appropriate security policies, such as encryption protection of highly sensitive data in the storage and transmission stages, which effectively reduces the risk of data leakage and tampering and comprehensively guarantees the security of the data flow in the entire processing process.

[0069] In the present invention, when the data flow enters each processing stage, the system can quickly identify abnormal situations of data status and security policy through real-time matching with the multi-stage security association model. Through accurate detection of status identification parameters and security policy parameters, when the actual status of the data does not match the expected model, it is immediately marked as an abnormal association path, and a security event alarm is automatically generated and the abnormal status is recorded. Compared with the traditional fixed policy monitoring method, the real-time anomaly detection mechanism is more flexible and can quickly identify complex status mismatch problems based on the dynamically generated association model. Through automatic and accurate real-time detection, the system's response speed to data security events and the efficiency of exception handling are greatly improved, so that potential security risks can be discovered and controlled in a timely manner.

[0070] In the present invention, before data processing is completed and output, the system performs full-process traceability detection on the data flow based on the traceability path parameters, and ensures the integrity of the data flow and the security consistency of the status at each stage by checking the transmission path, state consistency and processing nodes of the data at each stage. Through the traceability mechanism of the path and state, the system can accurately track the flow of data at each stage and promptly discover problems such as discontinuity of the transmission path and mismatch of the status. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only for the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0072] Figure 1 A schematic diagram of a data processing system according to an embodiment of the present invention;

[0073] Figure 2 Schematic diagram of a data acquisition module according to an embodiment of the present invention. DETAILED DESCRIPTION

[0074] The present invention is described in detail below in conjunction with the accompanying drawings and specific embodiments. At the same time, it is explained here that in order to make the embodiments more detailed, the following embodiments are the best and preferred embodiments, and those skilled in the art may also adopt other alternatives to implement some known technologies; and the accompanying drawings are only for more specific description of the embodiments, and are not intended to specifically limit the present invention.

[0075] like Figure 1-Figure 2 As shown, a computer data processing system based on data security testing performs security testing and correlation analysis on each processing stage of the data flow through a security correlation detection mechanism of a multi-stage data flow, so as to achieve security protection of the entire data process, including:

[0076] Data collection and initial labeling: The data collection module collects data in real time and adds initial security labels to it, including data source labels, data attribute labels, and security level labels;

[0077] Multi-stage security association model construction: A multi-stage security association model is constructed based on the initial security label of the data. The security association model defines the association relationship of the data in different processing stages and outputs the association parameters. The processing stages include format conversion, calculation, storage, transmission and output.

[0078] Multi-level association detection: Based on the constructed multi-stage security association model, association detection is performed when the data flow enters each processing stage. During the association detection, if it is detected that the state of the data at a certain stage does not match the security association model, it is marked as an abnormal association path;

[0079] Real-time capture of security events: After marking as an abnormal correlation path, a security event alert is immediately generated, and the abnormal situation and source node of the data are automatically recorded;

[0080] Multi-stage data flow traceability detection mechanism: Before data processing is completed and output, full-process traceability detection is carried out to check the integrity of the data flow, the transmission path and the processing status of each stage based on the security association records of each stage to ensure that the final data meets the integrity and security requirements.

[0081] The data acquisition module includes:

[0082] Data source identification unit: used to receive external data in real time, identify the IP address, device ID, and application system ID of the data, extract information that can uniquely identify the source of the data, generate and attach a data source tag T s , including source type and source credibility, which are used to distinguish data from different sources;

[0083] Attribute analysis unit: analyzes the type, structure, format and content of received data and generates data attribute tags Ta ,Data attribute tags include data type, data format, and data structure information, which are used to describe the basic characteristics of data;

[0084] Security level assignment unit: Evaluate data sensitivity based on data attribute labels, classify data into high sensitivity level, medium sensitivity level, and low sensitivity level, and classify data using a preset sensitivity rule library to obtain a security level label T l ;

[0085] The data attribute label evaluation data sensitivity analysis is as follows:

[0086] Personal information type: If the data attribute label contains personal information fields, such as name, ID number, address, contact information, and geographic location, it is directly evaluated as highly sensitive data.

[0087] Anonymous or de-identified data: Data from which identifying identifiers have been removed, such as anonymous user behavior data, is assessed as medium sensitive. Although this data does not directly point to an individual, it may still indirectly disclose personal privacy in certain scenarios.

[0088] Internal access and use: If the label indicates that the data is used for internal analysis or daily operations, such as operation log data of non-core departments, it is low sensitivity.

[0089] The label binding unit binds the generated security labels including data source labels, data attribute labels and security level labels to the data one by one to ensure that the data has a unique identity in the subsequent processing stage and provide basic data for the subsequent multi-stage security association model construction.

[0090] The construction of the multi-stage security association model specifically includes:

[0091] Multi-stage processing definition: The data processing process is divided into multiple stages, including format conversion, calculation, storage, transmission and output. Each stage specifies the state and operation mode of the data in the processing flow;

[0092] Format conversion stage (Stage 1): data format and encoding conversion.

[0093] Calculation stage (Stage 2): data calculation and processing.

[0094] Storage stage (Stage 3): data preservation and encrypted storage.

[0095] Transmission stage (Stage 4): data transmission and network security.

[0096] Output stage (Stage 5): Final data output.

[0097] Define the state of each stage as S i , where i = 1, 2, 3, 4, 5;

[0098] Initial security label analysis: Obtain the initial security label information of each data, including data source label, data attribute label, and security level label, as the basis for building a security association model:

[0099] 1. Data source label analysis: Based on the labels of data sources, identify the source type (such as internal or external source) and source credibility of the data in order to determine the access rights and verification strategies at different processing stages;

[0100] 2. Data attribute label analysis: According to the data type, format, and structure attribute information, determine the operational requirements for data processing at each stage, such as data encoding requirements at the format conversion stage, precision control at the calculation stage, etc.;

[0101] 3. Security level label analysis: Based on the security level (such as high sensitivity, medium sensitivity, and low sensitivity), define the data protection requirements at different stages. For example, high-sensitivity data requires encrypted transmission and storage, medium-sensitivity data requires access control, and low-sensitivity data only requires basic protection.

[0102] Definition of association relationship: By analyzing the characteristics of data at each processing stage, a secure association relationship of data is established, including:

[0103] Inter-stage association: defines the flow relationship and state changes of data between adjacent processing stages. For example, the data output in the format conversion stage must meet the input format requirements of the calculation stage; the security requirements in the storage and transmission stages must be consistent;

[0104] Security policy association: According to the security level label of the data, security policy association parameters for different stages are set in the multi-stage security association model. For example, highly sensitive data needs to maintain consistency verification during format conversion and calculation, and needs to be consistently encrypted during transmission and storage.

[0105] Association parameter output: The data association parameters generated by the multi-stage security association model include:

[0106] Status identification parameter P state : Record the processing status of data at each stage, used to identify the security status and flow status of data at different stages;

[0107] Security policy parameter P policy : Define data security requirements at each stage, including encryption requirements, access control levels, and authentication methods;

[0108] Traceability path parameter P trace: Record the source and flow path of data at different processing stages for anomaly detection and traceability analysis;

[0109] At each stage S i The association parameters output by the multi-stage security association model include P state ,P policy and P trace ,These parameters are dynamically adjusted according to the initial security label of the data to meet the security requirements of data at different stages such as format conversion, calculation, storage, transmission and output.

[0110] Data source tag T s Describes the source characteristics of data, which is used to determine access control and trustworthiness, including:

[0111] Source type: defined as internal data 1 or external data 0;

[0112] Source credibility: The credibility level of the data source, which is a decimal value between [0,1], where 0 represents low credibility and 1 represents high credibility;

[0113] Data attribute tag T a Describes the basic characteristics of data and is used to determine the processing requirements of the data, including:

[0114] Data type: defined as numeric type 1, text type 2, image type 3, file type 4;

[0115] Data format: encoding format: JSON, XML, CSV;

[0116] Data structure: structured data 1 or unstructured data 0;

[0117] Security Level Label T l Describe the sensitivity level of the data, which is used to set the protection requirements of the data;

[0118] Sensitivity level: defined as high sensitivity 2, medium sensitivity 1, low sensitivity 0.

[0119] Status identification parameter P state In the above equation, the state identification parameters of each stage are expressed as:

[0120] P state (S i )=f(T s ,T a ,T l ), where f is the state identification generation function, which is calculated as follows:

[0121]

[0122] in:

[0123] Status P state =1 means the data is credible and comes from within, indicating that the data has high security and credibility and can be allowed to flow freely within the system;

[0124] Status P state =2 means that the data is numerical or text-based structured data. The format and structure of this type of data are relatively stable when converted between stages, and the processing risk is low;

[0125] Status P state =3 means the data is highly sensitive. This status requires strict security protection measures for the data at all stages, such as encrypted storage and permission control during transmission, to ensure that the data is not leaked or tampered with.

[0126] Status P state =0 means that the data does not meet other specific conditions and is general data, applicable to basic security protection.

[0127] Security policy parameter P policy Calculated according to security level and data source, expressed as:

[0128] P policy (S i )=g(T s ,T l ), where g is the security policy generation function:

[0129]

[0130] in:

[0131] Encryption strategy: Highly sensitive data must be encrypted when stored or transmitted;

[0132] Access control strategy: low credibility or external data requires access control at each stage;

[0133] Basic protection strategy: Basic protection should be applied to low-sensitivity data.

[0134] Traceability path parameter P trace Used to track the transmission path of data at each stage, expressed as: P trace (S i )=h(SrcType,S i ), where SrcType is the source type and h is the path tracing function, calculated as: P trace (S i )=SrcType×S i When SrcType = 1, it indicates internal source, and the path record is S i ; When SrcType = 0, it indicates an external source and the path includes the complete transmission nodes.

[0135] Multi-level association detection specifically includes:

[0136] State matching detection: When the data flow enters each processing stage S i When the current state identification parameter P of the data is obtained state (S i ) and security policy parameter P policy (S i ), and matching them with the expected parameters of the corresponding stage in the multi-stage security association model;

[0137] Detection condition verification: If the actual state of the data identifies the parameter P state (S i ) and security policy parameter P policy (S i ) is inconsistent with the expected value of the associated model (i.e., the state or policy does not meet the preset security requirements), it is considered a state mismatch;

[0138] Abnormal correlation path marking: When a state mismatch is detected, the current processing stage is marked as an abnormal correlation path.

[0139] The security event alarm in the real-time capture of security events includes abnormal alarm information, which includes:

[0140] Anomaly type: describes the type of mismatch detected, including state mismatch and policy mismatch;

[0141] Abnormal stage: record the abnormal processing stage Si (format conversion, calculation, storage, transmission, output);

[0142] Abnormal time: The timestamp when the alarm was generated, used for subsequent event tracking.

[0143] Abnormal identification: Generates an alarm ID that uniquely identifies the abnormal event to ensure the uniqueness and traceability of the event. The source node is obtained through the source type in the data source label.

[0144] The whole process traceability detection includes calling the traceability detection mechanism before the end of the data flow processing process, according to the traceability path parameter P trace Record the information of each stage, check whether the processing status and transmission path of the data in each processing stage meet the expectations of the multi-stage security association model, and trace the path parameter P trace (S i ) Record the data flow at each processing stage S i The transmission path and status of the data, including the entry and exit time, source node, target node and security status of the data at the current stage;

[0145] Enter time Tin (S i ): Data enters stage S i time;

[0146] Departure time T out (S i ): Data leaves the stage S i time;

[0147] SourceNode(S i ): Data in stage S i The source node of

[0148] DestNode(S i ): Data in stage S i The target node;

[0149] Status indicator P state (S i ): Data in stage S i The processing status of

[0150] It also includes security association record R assoc : Record and store the expected path and status requirements for each processing stage, including:

[0151] Expected source node M Source (S i ): expected data source node;

[0152] Expected target node M Dest (S i ): expected data target node;

[0153] Expected status indicator M state (S i ): expected data status;

[0154] The traceability detection mechanism is as follows:

[0155] 1. For each processing stage S of the data flow i , check the traceability path parameter P trace (S i ) to ensure that the flow of data meets the expectations of the model and there are no missing stages or path anomalies;

[0156] 1.1, Time consistency check: Verify that the entry and exit times of data between stages are reasonable to ensure that there are no abnormal delays or advances.

[0157] 1.2, Node consistency check: Verify whether the source node and target node of the data at each stage are consistent with the expected nodes in the security association record.

[0158] 2. Transmission path check: Check the transmission path of the data flow to ensure that the data always flows along the path specified by the model during the entire processing process: obtain the initial source node and final target node of the data, compare the continuity of the source nodes and target nodes of all stages, and ensure that the source node of the data flow at each stage is equal to the target node of the previous stage.

[0159] 3. Processing status check: Check whether the data status at each processing stage conforms to the expected status of the associated model.

[0160] The present invention covers any substitution, modification, equivalent method and scheme made on the essence and scope of the present invention. In order to make the public have a thorough understanding of the present invention, specific details are described in detail in the following preferred embodiments of the present invention, but those skilled in the art can fully understand the present invention without the description of these details. In addition, in order to avoid unnecessary confusion about the essence of the present invention, well-known methods, processes, procedures, components and circuits are not described in detail.

[0161] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A computer data processing system based on data security testing, characterized in that: include: Data collection and initial labeling: The data collection module collects data in real time and adds initial security labels to it, including data source labels, data attribute labels, and security level labels; Multi-stage security association model construction: A multi-stage security association model is constructed based on the initial security label of the data. The security association model defines the association relationship of the data in different processing stages and outputs association parameters. The processing stages include format conversion, calculation, storage, transmission and output. Multi-level association detection: Based on the constructed multi-stage security association model, association detection is performed when the data flow enters each processing stage. During the association detection, if it is detected that the state of the data at a certain stage does not match the security association model, it is marked as an abnormal association path; Real-time capture of security events: After marking as an abnormal correlation path, a security event alert is immediately generated, and the abnormal situation and source node of the data are automatically recorded; Multi-stage data flow traceability detection mechanism: Before data processing is completed and output, full-process traceability detection is carried out to check the integrity of the data flow, the transmission path and the processing status of each stage based on the security association records of each stage.

2. A computer data processing system based on data security testing according to claim 1, characterized in that: The data acquisition module comprises: Data source identification unit: used to receive external data in real time, identify the IP address, device ID, and application system ID of the data, extract information that can uniquely identify the source of the data, generate and attach a data source tag T s , including source type and source credibility, which are used to distinguish data from different sources; Attribute analysis unit: analyzes the type, structure, format and content of received data and generates data attribute tags T a ,Data attribute tags include data type, data format, and data structure information, which are used to describe the basic characteristics of data; Security level assignment unit: Evaluate data sensitivity based on data attribute labels, classify data into high sensitivity level, medium sensitivity level, and low sensitivity level, and classify data using a preset sensitivity rule library to obtain a security level label T l ; The label binding unit binds the generated security labels including data source labels, data attribute labels and security level labels to the data one by one to ensure that the data has a unique identity in the subsequent processing stage.

3. A computer data processing system based on data security testing according to claim 2, characterized in that: The multi-stage security association model construction specifically includes: Multi-stage processing definition: The data processing process is divided into multiple stages, including format conversion, calculation, storage, transmission and output. Each stage specifies the state and operation mode of the data in the processing flow; Define the state of each stage as S i , where i = 1, 2, 3, 4, 5; Initial security label analysis: Obtain the initial security label information of each data, including data source label, data attribute label and security level label, as the basis for building a security association model; Definition of association relationship: By analyzing the characteristics of data at each processing stage, a secure association relationship of data is established, including: Inter-stage association: defines the flow relationship and state changes of data between adjacent processing stages; Security policy association: According to the security level label of the data, security policy association parameters of different stages are set in the multi-stage security association model; Association parameter output: The data association parameters generated by the multi-stage security association model include: Status identification parameter P state : Record the processing status of data at each stage, used to identify the security status and flow status of data at different stages; Security policy parameter P policy : Define data security requirements at each stage, including encryption requirements, access control levels, and authentication methods; Traceability path parameter P trace : Record the source and flow path of data at different processing stages for anomaly detection and traceability analysis; At each stage S i The association parameters output by the multi-stage security association model include P state ,P policy and P trace .

4. A computer data processing system based on data security testing according to claim 3, characterized in that: The data source tag T s Describes the source characteristics of data, which is used to determine access control and trustworthiness, including: Source type: defined as internal data 1 or external data 0; Source credibility: The credibility level of the data source, which is a decimal value between [0,1], where 0 represents low credibility and 1 represents high credibility; The data attribute tag T a Describes the basic characteristics of data and is used to determine the processing requirements of the data, including: Data type: defined as numeric type 1, text type 2, image type 3, file type 4; Data format: encoding format: JSON, XML, CSV; Data structure: structured data 1 or unstructured data 0; The security level label T l Describe the sensitivity level of the data, which is used to set the protection requirements of the data; Sensitivity level: defined as high sensitivity 2, medium sensitivity 1, low sensitivity 0.

5. A computer data processing system based on data security testing according to claim 4, characterized in that: The state identification parameter P state In the above equation, the state identification parameters of each stage are expressed as: P state (S i )=f(T s ,T a ,T l ), where f is the state identification generation function, which is calculated as follows: in: Status P state =1 means the data is reliable and comes from internal sources; Status P state =2 means the data is numerical or text structured data; Status P state =3 means the data is highly sensitive.

6. A computer data processing system based on data security testing according to claim 4, characterized in that: The security policy parameter P policy Calculated according to security level and data source, expressed as: P policy (S i )=g(T s ,T l ), where g is the security policy generation function: in: Encryption strategy: Highly sensitive data must be encrypted when stored or transmitted; Access control strategy: low credibility or external data requires access control at each stage; Basic protection strategy: Basic protection should be applied to low-sensitivity data.

7. A computer data processing system based on data security testing according to claim 4, characterized in that: The traceability path parameter P trace Used to track the transmission path of data at each stage, expressed as: P trace (S i )=h(SrcType,S i ), where SrcType is the source type and h is the path tracing function, calculated as: P trace (S i )=SrcType×S i When SrcType = 1, it indicates internal source, and the path record is S i ; When SrcType = 0, it indicates an external source and the path includes the complete transmission nodes.

8. A computer data processing system based on data security testing according to claim 4, characterized in that: The multi-level association detection specifically includes: State matching detection: When the data flow enters each processing stage S i When the current state identification parameter P of the data is obtained state (S i ) and security policy parameter P policy (S i ), and matching them with the expected parameters of the corresponding stage in the multi-stage security association model; Detection condition verification: If the actual state of the data identifies the parameter P state (S i ) and security policy parameter P policy (S i ) is inconsistent with the expected value of the associated model, it is considered a state mismatch; Abnormal correlation path marking: When a state mismatch is detected, the current processing stage is marked as an abnormal correlation path.

9. A computer data processing system based on data security testing according to claim 8, characterized in that: The security event alarm in the real-time capture of the security event includes abnormal alarm information, and the abnormal alarm information includes: Anomaly type: describes the type of mismatch detected, including state mismatch and policy mismatch; Abnormal stage: record the abnormal processing stage Si; Abnormal time: The timestamp when the alarm was generated, which is used for subsequent event tracking; Abnormal ID: Generates an alarm ID that uniquely identifies the abnormal event. The source node is obtained through the source type in the data source tag.

10. A computer data processing system based on data security testing according to claim 9, characterized in that: The whole process traceability detection includes calling the traceability detection mechanism before the data flow processing is completed, according to the traceability path parameter P trace Record the information of each stage, check whether the processing status and transmission path of the data in each processing stage meet the expectations of the multi-stage security association model, and trace the path parameter P trace (S i ) Record the data flow at each processing stage S i The transmission path and status of the data, including the entry and exit time, source node, target node and security status of the data at the current stage; It also includes security association record R assoc : Record and store the expected path and status requirements for each processing stage, including: Expected source node M Source (S i ): expected data source node; Expected target node M Dest (S i ): expected data target node; Expected status indicator M state (S i ): Expected data status.

Images