A computer data processing system based on data security testing

Abstract

The application relates to the technical field of data processing, in particular to a computer data processing system based on data security testing, which comprises the following steps: collecting data in real time through a data collection module and adding initial security labels to the data, wherein the initial security labels comprise data source labels, data attribute labels and security level labels; constructing a multi-stage security correlation model according to the initial security labels of the data; multi-level correlation detection: according to the constructed multi-stage security correlation model, correlation detection is carried out when data flow enters each processing stage; after being marked as an abnormal correlation path, a security event alarm is immediately generated, and the abnormal condition and the source node of the data are automatically recorded; and whole-process traceability detection is carried out before data processing is completed and output. The application greatly improves the response speed of the system to data security events and the efficiency of abnormal processing, so that potential security risks can be discovered and controlled in time.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a computer data processing system based on data security testing. Background Technology

[0002] In modern computing environments for data processing and transmission, data security and traceability have become critical requirements. As industries increase their demand for real-time data processing and security management, the security risks faced by data during multi-stage and multi-node flow are constantly rising. In particular, when data sources are complex, diverse in type, and have varying sensitivities, traditional data security methods are difficult to meet the needs of full-process security monitoring of complex data flows.

[0003] Traditional data security systems primarily monitor data security through static rules and fixed policies. This approach lacks flexibility and adaptability when dealing with structured and unstructured data, as well as internal and external data sources. When data types are diverse or highly sensitive, static rules struggle to cover all potential risk scenarios, easily leading to insufficient or excessive data security policies. Furthermore, traditional anomaly detection mechanisms are mostly based on preset fixed thresholds, making it difficult to identify state anomalies and potential security threats in complex data streams in real time and accurately. This results in a slow response time to sudden risks in data flow, hindering timely detection and handling of security incidents and increasing the risk of data leakage or tampering.

[0004] To address this issue, current technologies have limited capabilities for data traceability. Because data undergoes multiple transformations, storage, and transmissions during multi-stage processing, traditional traceability methods struggle to accurately track state changes at each stage. This makes it difficult to accurately trace the data flow path and state changes after a security incident. Furthermore, data flow between different processing nodes is prone to path breaks or discontinuities, and the lack of a systematic traceability mechanism makes it difficult to guarantee the integrity of the data flow. Summary of the Invention

[0005] This invention provides a computer data processing system based on data security testing.

[0006] A computer data processing system based on data security testing includes:

[0007] Data Acquisition and Initial Labeling: Data is collected in real time through the data acquisition module and initial security labels are added to it, including data source labels, data attribute labels, and security level labels;

[0008] Multi-stage security association model construction: A multi-stage security association model is constructed based on the initial security label of the data. The security association model defines the association relationship of the data in different processing stages and outputs association parameters. The processing stages include format conversion, calculation, storage, transmission and output.

[0009] Multi-level association detection: Based on the constructed multi-stage security association model, association detection is performed when the data flow enters each processing stage. In the association detection, if the state of the data in a certain stage does not match the security association model, it is marked as an abnormal association path.

[0010] Real-time security event capture: Once a path is marked as an abnormal associated path, a security event alert is immediately generated, and the abnormal data and source node are automatically recorded;

[0011] Multi-stage data flow traceability and detection mechanism: Before data processing is completed and output, full-process traceability and detection are performed. The integrity of the data flow, transmission path and processing status of each stage are checked based on the security association records of each stage.

[0012] Optionally, the data acquisition module includes:

[0013] Data source identification unit: Used to receive external data in real time, identify the data's IP address, device ID, and application system identifier, extract information that uniquely identifies the data source, and generate and attach a data source tag T. s This includes source type and source credibility, used to distinguish data from different sources;

[0014] Attribute Analysis Unit: Analyzes the type, structure, format, and content of the received data, and generates data attribute labels T. a Data attribute tags include data type, data format, and data structure information, which are used to describe the basic characteristics of the data;

[0015] Security Level Assignment Unit: Assessing data sensitivity based on data attribute labels, classifying data into high-sensitivity, medium-sensitivity, and low-sensitivity levels, and obtaining a security level label T using a pre-defined sensitivity rule base. l ;

[0016] The tag binding unit binds the generated security tags, including data source tags, data attribute tags, and security level tags, to the data one-to-one to ensure that the data has a unique identity in the subsequent processing stage and to provide basic data for the construction of subsequent multi-stage security association models.

[0017] Optionally, the construction of the multi-stage security association model specifically includes:

[0018] Multi-stage processing definition: Dividing the data processing process into multiple stages, including format conversion, calculation, storage, transmission and output, each stage defines the state and operation mode of data in the processing flow;

[0019] Define the state of each stage as S i , where i = 1, 2, 3, 4, 5;

[0020] Initial security label analysis: Obtain initial security label information for each piece of data, including data source label, data attribute label, and security level label, as the basis for building a security association model;

[0021] Definition of Relationships: By analyzing the characteristics of data at each processing stage, secure relationships between data are established, specifically including:

[0022] Inter-stage relationships: Define the flow and state changes of data between adjacent processing stages;

[0023] Security policy association: Based on the security level labels of the data, set security policy association parameters for different stages in the multi-stage security association model;

[0024] Correlation parameter output: The data correlation parameters generated by the multi-stage security correlation model include:

[0025] Status flag parameter P state Records the processing status of data at each stage, used to identify the security status and flow status of data at different stages;

[0026] Security policy parameter P policy Define the data security requirements for each stage, including encryption requirements, access control levels, and authentication methods;

[0027] Source tracing path parameter P trace Records the source and flow path of data at different processing stages for anomaly detection and source tracing analysis;

[0028] In each stage S i The correlation parameters output by the multi-stage security correlation model include P. state ,P policy and P trace .

[0029] Optionally, the data source label T s Describe the source characteristics of the data to determine access control and trustworthiness, wherein:

[0030] Source type: Defined as either internal data (1) or external data (0);

[0031] Source credibility: The credibility level of the data source, which is a decimal value in the range [0,1], where 0 represents low credibility and 1 represents high credibility;

[0032] The data attribute label T a Describe the basic characteristics of the data to determine the data processing requirements, wherein:

[0033] Data types: defined as numeric type 1, text type 2, image type 3, and file type 4;

[0034] Data format: Encoding format: JSON, XML, CSV;

[0035] Data structure: 1 unit of structured data or 0 units of unstructured data;

[0036] The security level label T l Describe the sensitivity level of the data to set data protection requirements;

[0037] Sensitivity level: defined as high sensitivity 2, medium sensitivity 1, low sensitivity 0.

[0038] Optionally, the status identifier parameter P state In this context, the state identifier parameter for each stage is represented as follows:

[0039] P state (S i )=f(T s ,T a ,T l ), where f is the state flag generation function, calculated as follows:

[0040]

[0041] in:

[0042] State P state =1 indicates that the data is reliable and comes from internal sources;

[0043] State P state =2 indicates that the data is numerical or text-based structured data;

[0044] State P state =3 indicates that the data is highly sensitive.

[0045] Optionally, the security policy parameter P policy Calculated based on security level and data source, and expressed as follows:

[0046] P policy (S i )=g(T s ,T l ), where g is the security policy generation function:

[0047]

[0048] in:

[0049] Encryption strategy: Highly sensitive data must be encrypted during storage or transmission;

[0050] Access control policy: Access control needs to be set at each stage for data with low credibility or external data;

[0051] Basic protection strategy: Low-sensitivity data requires basic protection.

[0052] Optionally, the source tracing path parameter P trace Used to track the data transmission path at each stage, denoted as: P trace (S i = h(SrcType, S i ), where SrcType is the source type, h is the path tracing function, calculated as: P trace (S i ) = SrcType × S i When SrcType=1, it indicates an internal source, and the path record is S. i When SrcType=0, it indicates an external source, and the path includes the complete transport nodes.

[0053] Optionally, the multi-level association detection specifically includes:

[0054] State matching detection: This occurs when the data stream enters each processing stage S. i At that time, obtain the current status identifier parameter P of the data. state (S i ) and security policy parameter P policy (S i And match it with the expected parameters of the corresponding stage in the multi-stage security association model;

[0055] Detection condition verification: If the actual status identifier parameter P of the data... state (S i ) and security policy parameter P policy (S i If the state or policy does not meet the expected value of the correlation model (i.e., the state or policy does not meet the preset security requirements), it is considered a state mismatch.

[0056] Abnormal association path marking: When a state mismatch is detected, the current processing stage is marked as an abnormal association path.

[0057] Optionally, the security event alarms in the real-time security event capture include abnormal alarm information, which includes:

[0058] Anomaly type: Describes the type of mismatch detected, including state mismatch and policy mismatch;

[0059] Exception Phase: Records the handling phase Si (format conversion, calculation, storage, transmission, output) when an exception occurs;

[0060] Abnormal Time: The timestamp at which the alert was generated, used for subsequent event tracking.

[0061] Anomaly Identifier: Generates a unique alarm ID to identify the anomaly event, ensuring the uniqueness and traceability of the event. The source node is obtained through the source type in the data source label.

[0062] Optionally, the full-process traceability detection includes invoking the traceability detection mechanism before the data stream processing ends, based on the traceability path parameter P. trace Record information at each stage, check whether the processing status and transmission path of the data at each stage conform to the expectations of the multi-stage security association model, and trace the source path parameter P. trace (S i Record the data stream at each processing stage S i The transmission path and status, including the data's entry and exit times, source node, destination node, and security status at the current stage;

[0063] Also includes security association records R assoc Record and store the expected path and status requirements for each processing stage, including:

[0064] Expected source node M Source (S i ): Expected data source node;

[0065] Target node M Dest (S i ): Target node for expected data;

[0066] Expected state identifier M state (S i ): Expected data status.

[0067] The beneficial effects of this invention are:

[0068] This invention, by constructing a multi-stage security association model and combining it with initial data security tags (including data source tags, data attribute tags, and security level tags), achieves end-to-end security monitoring from data acquisition to final output. The system dynamically generates association parameters at each stage of data flow (format conversion, calculation, storage, transmission, and output) to ensure that data processing at each stage meets its specific security requirements. By introducing multi-dimensional tag analysis, the system can identify the source, attributes, and sensitivity level of data and automatically configure appropriate security strategies, such as encryption protection for highly sensitive data during storage and transmission, effectively reducing the risk of data leakage and tampering and comprehensively ensuring the security of the data flow throughout the entire processing process.

[0069] This invention enables the system to quickly identify anomalies in data status and security policies by real-time matching with a multi-stage security association model when the data stream enters each processing stage. Through precise detection of status identifier parameters and security policy parameters, when the actual state of the data does not match the expected model, it is immediately marked as an abnormal association path, automatically generating a security event alarm and recording the abnormal state. Compared with traditional fixed-policy monitoring methods, the real-time anomaly detection mechanism is more flexible and can quickly identify complex state mismatch problems based on dynamically generated association models. Through automated and accurate real-time detection, the system's response speed to data security events and efficiency in anomaly handling are greatly improved, enabling potential security risks to be detected and controlled in a timely manner.

[0070] Before data processing is completed and output, the system performs full-process traceability detection on the data stream based on traceability path parameters. By checking the data transmission path, state consistency and processing nodes at each stage, the system ensures the integrity of the data stream and the security consistency of the state at each stage. Through the traceability mechanism of path and state, the system can accurately track the flow of data at each stage and promptly detect problems such as discontinuous transmission paths and mismatched states. Attached Figure Description

[0071] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only for this invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0072] Figure 1 This is a schematic diagram of a data processing system according to an embodiment of the present invention;

[0073] Figure 2 This is a schematic diagram of the data acquisition module in an embodiment of the present invention. Detailed Implementation

[0074] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments. It should also be noted that, to make the embodiments more comprehensive, the following embodiments are the best and preferred embodiments, and those skilled in the art can use other alternative methods to implement some well-known technologies; moreover, the accompanying drawings are only for more specific description of the embodiments and are not intended to specifically limit the present invention.

[0075] like Figures 1-2 As shown, a computer data processing system based on data security testing performs security testing and correlation analysis on each processing stage of the data flow through a multi-stage data flow security correlation detection mechanism to achieve full-process data security assurance, including:

[0076] Data Acquisition and Initial Labeling: Data is collected in real time through the data acquisition module and initial security labels are added to it, including data source labels, data attribute labels, and security level labels;

[0077] Multi-stage security association model construction: Based on the initial security labels of the data, a multi-stage security association model is constructed. The security association model defines the association relationship of the data in different processing stages and outputs association parameters. The processing stages include format conversion, calculation, storage, transmission and output.

[0078] Multi-level association detection: Based on the constructed multi-stage security association model, association detection is performed when the data flow enters each processing stage. In the association detection, if the state of the data in a certain stage does not match the security association model, it is marked as an abnormal association path.

[0079] Real-time security event capture: Once a path is marked as an abnormal associated path, a security event alert is immediately generated, and the abnormal data and source node are automatically recorded;

[0080] Multi-stage data flow traceability and detection mechanism: Before data processing is completed and output, full-process traceability and detection are performed. The integrity of the data flow, transmission path and processing status of each stage are checked according to the security association records of each stage to ensure that the final data meets the integrity and security requirements.

[0081] The data acquisition module includes:

[0082] Data source identification unit: Used to receive external data in real time, identify the data's IP address, device ID, and application system identifier, extract information that uniquely identifies the data source, and generate and attach a data source tag T. s This includes source type and source credibility, used to distinguish data from different sources;

[0083] Attribute Analysis Unit: Analyzes the type, structure, format, and content of the received data, and generates data attribute labels T.a Data attribute tags include data type, data format, and data structure information, which are used to describe the basic characteristics of the data;

[0084] Security Level Assignment Unit: Assessing data sensitivity based on data attribute labels, classifying data into high-sensitivity, medium-sensitivity, and low-sensitivity levels, and obtaining a security level label T using a pre-defined sensitivity rule base. l ;

[0085] The data attribute label assessment data sensitivity analysis is as follows:

[0086] Personal Information Type: If the data attribute label contains personal information fields, such as name, ID number, address, contact information, or geographical location, it will be directly assessed as highly sensitive data.

[0087] Anonymous or de-identified data: Data that has had its identifying features removed, such as anonymous user behavior data, is assessed as moderately sensitive. Although this data does not directly point to an individual, it may still indirectly leak personal privacy in certain scenarios.

[0088] Internal access and usage: If the label indicates that the data is used for internal analysis or daily operations, such as operational log data of non-core departments, it is classified as low sensitivity.

[0089] The tag binding unit binds the generated security tags, including data source tags, data attribute tags, and security level tags, to the data one-to-one to ensure that the data has a unique identity in the subsequent processing stage and to provide basic data for the construction of subsequent multi-stage security association models.

[0090] The construction of a multi-stage security association model specifically includes:

[0091] Multi-stage processing definition: Dividing the data processing process into multiple stages, including format conversion, calculation, storage, transmission and output, each stage defines the state and operation mode of data in the processing flow;

[0092] Format conversion stage (Stage 1): Data format and encoding conversion.

[0093] Calculation Stage (Stage 2): Data calculation and processing.

[0094] Storage Stage (Stage 3): Data preservation and encrypted storage.

[0095] Transmission Stage (Stage 4): Data transmission and network security.

[0096] Output stage (Stage 5): Final data output.

[0097] Define the state of each stage as S i , where i = 1, 2, 3, 4, 5;

[0098] Initial security label analysis: Obtain initial security label information for each data point, including data source label, data attribute label, and security level label, as the basis for building a security association model.

[0099] 1. Data source tag analysis: Based on the tags of the data source, identify the source type (such as internal or external source) and source credibility of the data in order to determine the access permissions and verification strategies at different processing stages;

[0100] 2. Data attribute tag analysis: Based on data type, format, and structural attribute information, determine the operational requirements for data processing at each stage, such as data encoding requirements in the format conversion stage and precision control in the calculation stage;

[0101] 3. Security Level Label Analysis: Based on the security level (e.g., high sensitivity, medium sensitivity, low sensitivity), define the data protection requirements for different stages. For example, high sensitivity data needs to be encrypted during transmission and storage, medium sensitivity data needs access control, and low sensitivity data only needs basic protection.

[0102] Definition of Relationships: By analyzing the characteristics of data at each processing stage, secure relationships between data are established, specifically including:

[0103] Inter-stage relationships: Define the flow and state changes of data between adjacent processing stages. For example, the data output from the format conversion stage must meet the input format requirements of the calculation stage; and the security requirements of the storage and transmission stages must remain consistent.

[0104] Security policy association: Based on the security level label of the data, set security policy association parameters for different stages in the multi-stage security association model. For example, highly sensitive data needs to maintain consistency verification in the format conversion and calculation stages, and consistent encryption in the transmission and storage stages.

[0105] Correlation parameter output: The data correlation parameters generated by the multi-stage security correlation model include:

[0106] Status flag parameter P state Records the processing status of data at each stage, used to identify the security status and flow status of data at different stages;

[0107] Security policy parameter P policy Define the data security requirements for each stage, including encryption requirements, access control levels, and authentication methods;

[0108] Source tracing path parameter P traceRecords the source and flow path of data at different processing stages for anomaly detection and source tracing analysis;

[0109] In each stage S i The correlation parameters output by the multi-stage security correlation model include P. state ,P policy and P trace These parameters are dynamically adjusted based on the initial security label of the data to meet the security requirements of the data at different stages such as format conversion, calculation, storage, transmission and output.

[0110] Data source tag T s Describe the source characteristics of the data to determine access control and trustworthiness, wherein:

[0111] Source type: Defined as either internal data (1) or external data (0);

[0112] Source credibility: The credibility level of the data source, which is a decimal value in the range [0,1], where 0 represents low credibility and 1 represents high credibility;

[0113] Data attribute label T a Describe the basic characteristics of the data to determine the data processing requirements, wherein:

[0114] Data types: defined as numeric type 1, text type 2, image type 3, and file type 4;

[0115] Data format: Encoding format: JSON, XML, CSV;

[0116] Data structure: 1 unit of structured data or 0 units of unstructured data;

[0117] Security level label T l Describe the sensitivity level of the data to set data protection requirements;

[0118] Sensitivity level: defined as high sensitivity 2, medium sensitivity 1, low sensitivity 0.

[0119] Status flag parameter P state In this context, the state identifier parameter for each stage is represented as follows:

[0120] P state (S i )=f(T s ,T a ,T l ), where f is the state flag generation function, calculated as follows:

[0121]

[0122] in:

[0123] State P state =1 indicates that the data is reliable and comes from within the system, suggesting that the data has a high level of security and credibility and can be freely circulated within the system;

[0124] State P state =2 indicates that the data is numerical or text-based structured data. The format and structure of this type of data are relatively stable when it is converted between different stages, and the processing operation has a low risk.

[0125] State P state =3 indicates that the data is highly sensitive. This status requires strict security protection measures for the data at each stage, such as encrypted storage and access control during transmission, to ensure that the data is not leaked or tampered with.

[0126] State P state =0 indicates that the data does not meet other specific conditions, and is general data that is subject to basic security protection.

[0127] Security policy parameter P policy Calculated based on security level and data source, and expressed as follows:

[0128] P policy (S i )=g(T s ,T l ), where g is the security policy generation function:

[0129]

[0130] in:

[0131] Encryption strategy: Highly sensitive data must be encrypted during storage or transmission;

[0132] Access control policy: Access control needs to be set at each stage for data with low credibility or external data;

[0133] Basic protection strategy: Low-sensitivity data requires basic protection.

[0134] Source tracing path parameter P trace Used to track the data transmission path at each stage, denoted as: P trace (S i = h(SrcType, S i ), where SrcType is the source type, h is the path tracing function, calculated as: P trace (S i ) = SrcType × S i When SrcType=1, it indicates an internal source, and the path record is S. i When SrcType=0, it indicates an external source, and the path includes the complete transport nodes.

[0135] Multi-level association detection specifically includes:

[0136] State matching detection: This occurs when the data stream enters each processing stage S. i At that time, obtain the current status identifier parameter P of the data. state (S i ) and security policy parameter P policy (S i And match it with the expected parameters of the corresponding stage in the multi-stage security association model;

[0137] Detection condition verification: If the actual status identifier parameter P of the data... state (S i ) and security policy parameter P policy (S i If the state or policy does not meet the expected value of the correlation model (i.e., the state or policy does not meet the preset security requirements), it is considered a state mismatch.

[0138] Abnormal association path marking: When a state mismatch is detected, the current processing stage is marked as an abnormal association path.

[0139] Security event alerts in real-time security event capture include abnormal alarm information, which includes:

[0140] Anomaly type: Describes the type of mismatch detected, including state mismatch and policy mismatch;

[0141] Exception Phase: Records the handling phase Si (format conversion, calculation, storage, transmission, output) when an exception occurs;

[0142] Abnormal Time: The timestamp at which the alert was generated, used for subsequent event tracking.

[0143] Anomaly Identifier: Generates a unique alarm ID to identify the anomaly event, ensuring the uniqueness and traceability of the event. The source node is obtained through the source type in the data source label.

[0144] End-to-end traceability and detection includes invoking the traceability and detection mechanism before the data stream processing is completed, based on the traceability path parameter P. trace Record information at each stage, check whether the processing status and transmission path of the data at each stage conform to the expectations of the multi-stage security association model, and trace the source path parameter P. trace (S i Record the data stream at each processing stage S i The transmission path and status, including the data's entry and exit times, source node, destination node, and security status at the current stage;

[0145] Entering time Tin (S i ): Data enters stage S i Time;

[0146] Departure time T out (S i ): Data leaving stage S i Time;

[0147] SourceNode(S) i ): Data in stage S i The source node;

[0148] Target node DestNode(S) i ): Data in stage S i The target node;

[0149] Status label P state (S i ): Data in stage S i The processing status;

[0150] Also includes security association records R assoc Record and store the expected path and status requirements for each processing stage, including:

[0151] Expected source node M Source (S i ): Expected data source node;

[0152] Target node M Dest (S i ): Target node for expected data;

[0153] Expected state identifier M state (S i ): Expected data status;

[0154] The specific traceability and detection mechanism is as follows:

[0155] 1. For each processing stage S of the data stream i Check the source tracing path parameter P trace (S i The entry and exit times, source nodes, and target nodes in the model are used to ensure that the data flow conforms to the model's expectations and that there are no lost stages or abnormal paths.

[0156] 1.1 Time Consistency Check: Verify that the entry and exit times of data between stages are reasonable to ensure there are no abnormal delays or advances.

[0157] 1.2 Node Consistency Check: Verify whether the source and target nodes of the data at each stage are consistent with the expected nodes in the security association record.

[0158] 2. Transmission Path Check: Check the transmission path of the data stream to ensure that the data always flows along the path specified by the model throughout the entire processing: obtain the initial source node and the final target node of the data, compare the continuity of the source node and the target node in all stages, and ensure that the source node of the data stream in each stage is equal to the target node of the previous stage.

[0159] 3. Processing Status Check: Check whether the data status at each processing stage matches the expected status of the correlation model.

[0160] This invention encompasses any substitutions, modifications, equivalent methods, and solutions made within the spirit and scope of this invention. To provide the public with a thorough understanding of this invention, specific details are described in detail in the following preferred embodiments; however, those skilled in the art will fully understand the invention even without these details. Furthermore, to avoid unnecessary misunderstanding of the essence of this invention, well-known methods, processes, procedures, components, and circuits are not described in detail.

[0161] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A computer data processing system based on data security testing, characterized in that, include: Data Acquisition and Initial Labeling: Data is collected in real time through the data acquisition module and initial security labels are added to it, including data source labels, data attribute labels, and security level labels; Multi-stage security association model construction: A multi-stage security association model is constructed based on the initial security label of the data. The security association model defines the association relationship of the data in different processing stages and outputs association parameters. The processing stages include format conversion, calculation, storage, transmission and output. The construction of the multi-stage security association model specifically includes: Multi-stage processing definition: Dividing the data processing process into multiple stages, including format conversion, calculation, storage, transmission and output, each stage specifies the state and operation mode of the data in the processing flow; Define the state of each stage as ,in ; Initial security label analysis: Obtain initial security label information for each piece of data, including data source label, data attribute label, and security level label, as the basis for building a security association model; Definition of Relationships: By analyzing the characteristics of data at each processing stage, secure relationships between data are established, specifically including: Inter-stage relationships: Define the flow and state changes of data between adjacent processing stages; Security policy association: Based on the security level labels of the data, set security policy association parameters for different stages in the multi-stage security association model; Correlation parameter output: The data correlation parameters generated by the multi-stage security correlation model include: Status flag parameters Records the processing status of data at each stage, used to identify the security status and flow status of data at different stages; Security policy parameters Define the data security requirements for each stage, including encryption requirements, access control levels, and authentication methods; Source tracing path parameters Records the source and flow path of data at different processing stages for anomaly detection and source tracing analysis; In each stage The correlation parameters output by the multi-stage security correlation model include and ; Multi-level association detection: Based on the constructed multi-stage security association model, association detection is performed when the data flow enters each processing stage. During association detection, if the state of data at a certain stage does not match the security association model, it is marked as an abnormal association path. The multi-level association detection specifically includes: State matching detection: This occurs when the data stream enters each processing stage. At that time, obtain the current status identifier parameter of the data. and security policy parameters And match it with the expected parameters of the corresponding stage in the multi-stage security association model; Detection condition verification: If the actual status identifier parameter of the data... and security policy parameters If the value is inconsistent with the expected value of the association model, it is considered a state mismatch; Abnormal association path marking: When a state mismatch is detected, the current processing stage is marked as an abnormal association path; Real-time security event capture: Once an abnormal associated path is marked, a security event alert is immediately generated, and the abnormal data and source node are automatically recorded; Multi-stage data flow traceability and detection mechanism: Before data processing is completed and output, full-process traceability and detection are performed. The integrity of the data flow, transmission path and processing status of each stage are checked based on the security association records of each stage.

2. The computer data processing system based on data security testing according to claim 1, characterized in that, The data acquisition module includes: Data source identification unit: Used to receive external data in real time, identify the data's IP address, device ID, and application system identifier, extract information that uniquely identifies the data source, and generate and attach data source tags. This includes source type and source credibility, used to distinguish data from different sources; Attribute Analysis Unit: Analyzes the type, structure, format, and content of received data, and generates data attribute labels. Data attribute tags include data type, data format, and data structure information, which are used to describe the basic characteristics of the data; Security Level Assignment Unit: Assess data sensitivity based on data attribute labels, classify data into high-sensitivity, medium-sensitivity, and low-sensitivity levels, and obtain security level labels through a pre-defined sensitivity rule base. ; The tag binding unit binds the generated security tags, including data source tags, data attribute tags, and security level tags, to the data one-to-one to ensure that the data has a unique identity in subsequent processing stages.

3. The computer data processing system based on data security testing according to claim 1, characterized in that, The data source label Describe the source characteristics of the data to determine access control and trustworthiness, wherein: Source type: Defined as either internal data (1) or external data (0); Source credibility: The credibility level of the data source, which is a decimal value in the range [0,1], where 0 represents low credibility and 1 represents high credibility; The data attribute label Describe the basic characteristics of the data to determine the data processing requirements, wherein: Data types: defined as numeric type 1, text type 2, image type 3, and file type 4; Data format: Encoding format: JSON, XML, CSV; Data structure: 1 unit of structured data or 0 units of unstructured data; The security level label Describe the sensitivity level of the data to set data protection requirements; Sensitivity level: defined as high sensitivity 2, medium sensitivity 1, low sensitivity 0.

4. A computer data processing system based on data security testing according to claim 3, characterized in that, The status identifier parameter In this context, the state identifier parameter for each stage is represented as follows: ,in The function for generating the status identifier is calculated as follows: ； in: state This indicates that the data is reliable and comes from internal sources; state This indicates that the data is either numerical or text-based structured data; state This indicates that the data is highly sensitive.

5. A computer data processing system based on data security testing according to claim 3, characterized in that, The security policy parameters Calculated based on security level and data source, and expressed as follows: ,in Generate functions for security policies: ； in: Encryption strategy: Highly sensitive data must be encrypted during storage or transmission; Access control policy: Access control needs to be set at each stage for data with low credibility or external data; Basic protection strategy: Low-sensitivity data requires basic protection.

6. A computer data processing system based on data security testing according to claim 3, characterized in that, The source tracing path parameters Used to track the data transmission path at each stage, represented as: Where SrcType is the source type, The path tracing function is calculated as follows: When SrcType=1, it indicates an internal source, and the path record is as follows. When SrcType=0, it indicates an external source, and the path includes the complete transport nodes.

7. A computer data processing system based on data security testing according to claim 1, characterized in that, The security event alarms captured in real time include abnormal alarm information, which includes: Anomaly type: Describes the type of mismatch detected, including state mismatch and policy mismatch; Abnormal Phase: Records the handling phase Si when an abnormality occurs; Abnormal Time: The timestamp at which the alert was generated, used for subsequent event tracking; Anomaly Identifier: Generates a unique alarm ID that identifies the anomaly event. The source node obtains this ID through the source type in the data source label.

8. A computer data processing system based on data security testing according to claim 7, characterized in that, The full-process traceability detection includes invoking the traceability detection mechanism before the data stream processing is completed, based on the traceability path parameters. Record information at each stage, check whether the processing status and transmission path of data at each stage conform to the expectations of the multi-stage security association model, and trace the path parameters. Record the data stream at each processing stage The transmission path and status, including the data's entry and exit times, source node, destination node, and security status at the current stage; Also includes security association records Record and store the expected path and status requirements for each processing stage, including: Expected source node : Expected data source node; Expected target node : Target node for expected data; Expected status indicator Expected data status.

Images