Log desensitization method and device, equipment, medium and program product

Abstract

The invention provides a log desensitization method which can be applied to the technical field of data processing and can be applied to the field of financial science and technology. The log desensitization method comprises the steps of obtaining to-be-desensitized log data corresponding to a target service in response to a query request for a target service log; inputting the to-be-desensitized log data into a first processing model to obtain first data, the first data representing a weighted word vector of each vocabulary in the to-be-desensitized log data; the first data are input into a second processing model to obtain second data, and the second data represent the attention degree of each vocabulary; and desensitizing the to-be-desensitized log data according to the second data to obtain desensitized log data. The invention further provides a log desensitization device and equipment, a storage medium and a program product.

Description

Technical Field

[0001] The present disclosure relates to the field of data processing, and more specifically to a log desensitization method, device, equipment, medium and program product. Background Art

[0002] With the deepening of informatization, enterprises have more and more data, and the sharing and exchange of data within departments and even across departments are becoming more and more frequent, and its security issues are becoming more and more prominent. The data contains a lot of sensitive privacy information, which will cause irreparable losses once leaked.

[0003] Currently, log management systems mostly rely on rule matching or keyword filtering to identify sensitive information. Usually, log management personnel need to manually screen sensitive information, resulting in low work efficiency. Summary of the invention

[0004] In view of the above problems, the present disclosure provides a log desensitization method, apparatus, device, medium and program product.

[0005] According to a first aspect of the present disclosure, a log desensitization method is provided, the method comprising: in response to a query request for a target business log, obtaining log data to be desensitized corresponding to the target business; inputting the log data to be desensitized into a first processing model to obtain first data, the first data representing a weighted word vector of each word in the log data to be desensitized; inputting the first data into a second processing model to obtain second data, the second data representing the attention of each word; and desensitizing the log data to be desensitized according to the second data to obtain desensitized log data.

[0006] According to an embodiment of the present disclosure, desensitizing is performed on log data to be desensitized according to the second data to obtain desensitized log data, including: when the attention degree of a first word is greater than a first threshold, desensitizing is performed on the first word to obtain standard log data, the standard log data includes at least one desensitized word, and the desensitized word corresponds to the first word one-to-one; when the attention degree of a second word is greater than a second threshold, encrypting the desensitized word corresponding to the second word in the standard log data to obtain desensitized log data; wherein the first threshold is less than the second threshold, the log data to be desensitized includes the first word, and the first word includes the second word.

[0007] According to an embodiment of the present disclosure, the first processing model includes a first sub-model and a second sub-model. The log data to be desensitized is input into the first processing model to obtain the first data, including: based on the first sub-model, converting the vocabulary in the log data to be desensitized into word vectors, and the first sub-model is used to capture the semantic representation of the vocabulary; based on the second sub-model, determining the weighted value of the vocabulary in the log data to be desensitized, and the weighted value represents the importance of the vocabulary in the log data to be desensitized; and determining the first data according to the word vector and the weighted value.

[0008] According to an embodiment of the present disclosure, the first processing model includes a third sub-model, and determines the first data according to the word vector and the weighted value, including: determining the added value of the vocabulary in the log data to be desensitized based on the third sub-model, the added value representing the frequency of occurrence of the vocabulary in the log data to be desensitized; determining the first data according to the word vector, the added value and the weighted value.

[0009] According to an embodiment of the present disclosure, first data is input into a second processing model to obtain second data, the second data representing the attention of each word, including: processing the first data to obtain third data, the third data representing the dependency relationship between words; determining the weight value of the word, the weight value representing the contribution of the word to the prediction result of the second processing model; determining the second data based on the weight value and the third data.

[0010] According to an embodiment of the present disclosure, in response to a query request for a target business log, log data to be desensitized corresponding to the target business is obtained, including: the proxy server obtains the log data to be desensitized corresponding to the request from the first log database according to the request, wherein, in response to the business server receiving the query request for the target business log, the request is forwarded to the proxy server.

[0011] According to an embodiment of the present disclosure, the method also includes: in response to a user initiating a request on the client, encrypting the request using a public key; when the private key of the business server matches the public key, decrypting the encrypted request and forwarding the request to the proxy server.

[0012] According to an embodiment of the present disclosure, the method also includes: in response to the completion of desensitization of the log data to be desensitized, the proxy server sends the desensitized log data to the business server, and the business server stores the desensitized log data in a second log database; upon request, the business server sends the desensitized log data corresponding to the request from the second log database to the client.

[0013] A second aspect of the present disclosure provides a log desensitization device, which includes: an acquisition module, which is used to respond to a query request for a target business log and obtain the log data to be desensitized corresponding to the target business; a first processing module, which is used to input the log data to be desensitized into a first processing model to obtain first data, and the first data represents a weighted word vector of each word in the log data to be desensitized; a second processing module, which is used to input the first data into a second processing model to obtain second data, and the second data represents the attention of each word; and a desensitization module, which is used to perform desensitization processing on the log data to be desensitized according to the second data to obtain desensitized log data.

[0014] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above method.

[0015] The fourth aspect of the present disclosure further provides a computer-readable storage medium on which a computer program or instruction is stored. When the computer program or instruction is executed by a processor, the steps of the log desensitization method are implemented.

[0016] The fifth aspect of the present disclosure further provides a computer program product, including a computer program or instructions, which implement the steps of the log desensitization method when executed by a processor. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0018] Figure 1 The application scenario diagram of the log desensitization method, apparatus, device, medium and program product according to the embodiment of the present disclosure is schematically shown;

[0019] Figure 2 The flowchart of the log desensitization method according to the embodiment of the present disclosure is schematically shown;

[0020] Figure 3 The following schematically shows a flow chart of judging desensitization of words according to an embodiment of the present disclosure;

[0021] Figure 4A A flowchart of a method for processing desensitized data according to a first processing model of an embodiment of the present disclosure is schematically shown;

[0022] Figure 4B A schematic diagram of a method for processing data to be desensitized according to a first processing model of an embodiment of the present disclosure is schematically shown;

[0023] Figure 5A A flowchart of a method for processing desensitized data according to a second processing model of an embodiment of the present disclosure is schematically shown;

[0024] Figure 5B A schematic diagram schematically illustrates a second processing model according to an embodiment of the present disclosure;

[0025] Figure 6 A flowchart of a log desensitization method according to another embodiment of the present disclosure is schematically shown;

[0026] Figure 7 The structure block diagram of the log desensitization device according to the embodiment of the present disclosure is schematically shown; and

[0027] Figure 8 A block diagram of an electronic device suitable for implementing a log desensitization method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0028] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0029] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0030] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0031] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0032] It should be noted that the method and device for log desensitization disclosed herein can be used for log processing in the field of financial technology, and can also be used for log processing in any field other than the field of financial technology. The application field of the method and device for log desensitization disclosed herein is not limited.

[0033] In the technical solution of the present disclosure, the user information (including but not limited to user personal information, user image information, user device information, such as location information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with relevant laws, regulations and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0034] In the scenario of using personal information for automated decision-making, the methods, devices, and systems provided by the embodiments of the present disclosure provide users with corresponding operation portals for users to choose to agree or reject the automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered. The expression "automated decision-making" here refers to the activity of automatically analyzing and evaluating a person's behavioral habits, interests and hobbies, or economic, health, credit status, etc. through computer programs, and making decisions. The expression "expert decision-making" here refers to the activity of making decisions by people who specialize in a certain field, have specialized experience, knowledge and skills, and have reached a certain level of professionalism.

[0035] The embodiment of the present disclosure provides a log desensitization method. Before introducing the technical solution provided by the embodiment of the present disclosure, the related technologies involved in the present disclosure are first described.

[0036] In related technologies, with the deepening of informatization, enterprises have more and more data, and the sharing and exchange of data within departments and even across departments are becoming more and more frequent, and its security issues are becoming more and more prominent. The data contains a large amount of sensitive privacy information, which will cause irreparable losses once leaked.

[0037] Currently, log management systems mostly rely on rule matching or keyword filtering to identify sensitive information. Usually, log management personnel need to manually screen sensitive information, resulting in low work efficiency.

[0038] For example, in the current banking environment, the log management of corporate customer data faces severe security challenges. Traditional log management systems rely on rule matching or keyword filtering to identify sensitive information, but this approach has significant flaws. First, static rules are difficult to adapt to changing data types and business scenarios, and are prone to missed detections or false positives. Second, relying solely on automated means often ignores contextual understanding and cannot accurately identify the meaning of sensitive information in a specific context. In addition, although related encryption technologies can protect data to a certain extent, they lack flexibility, especially when dealing with log data that requires frequent access and has a complex structure. The balance between encryption and decryption efficiency and data availability is difficult to grasp.

[0039] Therefore, the above-mentioned log desensitization method has the following problems: First, the accuracy of identifying sensitive information is not high, and it is easy to miss or misjudge; second, the encryption method is single and lacks flexibility, making it difficult to deal with sensitive data of different levels; third, there is a lack of continuous learning and optimization mechanism, and it is impossible to adjust the recognition rate and encryption strategy according to actual conditions; fourth, there is a lack of effective tracing and disposal methods for sensitive data that has been leaked.

[0040] An embodiment of the present disclosure provides a log desensitization method, which includes: in response to a query request for a target business log, obtaining log data to be desensitized corresponding to the target business; inputting the log data to be desensitized into a first processing model to obtain first data, the first data representing a weighted word vector of each word in the log data to be desensitized; inputting the first data into a second processing model to obtain second data, the second data representing the attention of each word; and desensitizing the log data to be desensitized according to the second data to obtain desensitized log data.

[0041] Figure 1 The application scenario diagram of the log desensitization method, apparatus, device, medium and program product according to the embodiments of the present disclosure is schematically shown.

[0042] like Figure 1 As shown, the application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 is used to provide a medium for a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired, wireless communication links, or optical fiber cables, etc.

[0043] The user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0044] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0045] The server 105 may be a server that provides various services, such as a background management server (only as an example) that provides support for websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0046] It should be noted that the log desensitization method provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the log desensitization device provided in the embodiment of the present disclosure can generally be set in the server 105. The log desensitization method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Accordingly, the log desensitization device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0047] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0048] The following will be based on Figure 1 The scene described by Figure 2~Figure 6 The log desensitization method of the disclosed embodiment is described in detail.

[0049] Figure 2 The flowchart of the log desensitization method according to an embodiment of the present disclosure is schematically shown.

[0050] like Figure 2 As shown, the log desensitization method of this embodiment includes operations S210 to S240.

[0051] In operation S210, in response to a query request for target business logs, obtain the log data to be desensitized corresponding to the target business.

[0052] Exemplarily, the log data to be desensitized refers to log data that has not been desensitized, and these data may contain sensitive information.

[0053] For example, a user needs to analyze the "order processing" business logs within a specific time period and queries all operation logs related to "order processing" within that time period (such as order creation, payment success, order shipment, etc.). The user发起 a query request through the system, and the query content is the log data of the "order processing" business between December 1, 2024 and December 2, 2024. After receiving the query request, the system identifies the "order processing" business identifier in the query request (which may be information such as business ID, business name, etc.), and then goes to the log database to find all log data related to "order processing". At this time, the system will filter out the logs that meet the requirements according to the query conditions. The filtered log data may contain some sensitive information, such as the user's name, mobile phone number, payment card number, etc. At this time, these log data will be marked as "to-be-desensitized" data.

[0054] In operation S220, input the log data to be desensitized into the first processing model to obtain first data, where the first data represents the weighted word vectors of each word in the log data to be desensitized.

[0055] Exemplarily, the log data to be desensitized is cleaned to remove irrelevant characters and stop words (such as "de", "shi", "zai", etc.) in the text to retain the key information in the text.

[0056] The first processing model can not only convert each word in the log data to be desensitized into a high-dimensional digital vector and capture the semantic relationship between words, but also make predictions on the frequency of occurrence of words in the log data to be desensitized and the importance of the word to the entire text to obtain the weighted word vector of each word.

[0057] For example, first, through preprocessing, the log data to be desensitized is cleaned to remove irrelevant characters and stop words to retain the key information. After the processing is completed, the trained Word2Vec model is used to convert the words in the log data to be desensitized into a digital form that can be processed by a machine learning model. At the same time, in order to better understand the context information in the text, the TF-IDF model combined with the bag-of-words model is used to represent the entire text to provide more accurate input data for the subsequent deep learning model.

[0058] In operation S230, the first data is input into a second processing model to obtain second data, where the second data represents the attention level of each word.

[0059] Exemplarily, the second processing model can further capture the importance of words in the text and predict more accurate sensitive words to facilitate subsequent desensitization processing.

[0060] For example, the first data is input into the second processing model, and the second processing model can more effectively identify and focus on sensitive words in the log data to be desensitized, thereby improving the ability to capture sensitive words.

[0061] In operation S240, the log data to be desensitized is desensitized according to the second data to obtain desensitized log data.

[0062] Exemplarily, after obtaining the attention levels of words in the log data to be desensitized, desensitization processing is performed to different degrees on words with different attention levels according to the attention levels of the words.

[0063] Desensitization is the process of processing sensitive information in data, with the goal of protecting user privacy and avoiding data leakage while still retaining the usefulness of the data. For example, some characters in sensitive data can be replaced with other characters to make the original data unrecognizable. For example, replace the original data 12345678 with * to ****5678. For example, the order of sensitive data can also be disrupted to make it impossible to restore. For example, sensitive data can also be encrypted so that it can only be restored to the original data through authorized decryption operations. After encryption, even if the data is leaked, outsiders cannot obtain valid information.

[0064] It can be understood that the first processing model can predict the frequency and importance of words in the log data to be desensitized; the second processing model can further capture the importance of words in the text and predict more accurate sensitive words. Therefore, the first processing model and the second processing model can automatically identify sensitive words in the log data to be desensitized, thereby more efficiently extracting key information in the log data to be desensitized for subsequent desensitization processing.

[0065] Figure 3 The following schematically shows a flow chart of judging desensitization of vocabulary according to an embodiment of the present disclosure.

[0066] As described above, in operation S240, the log data to be desensitized is desensitized according to the second data to obtain desensitized log data. Figure 3 As shown, the operation may further include operation S310 to operation S360.

[0067] In operation S310, it is determined whether the attention degree of the first word is greater than a first threshold.

[0068] In operation S320, when the attention degree of the first word is greater than the first threshold, the first word is desensitized to obtain standard log data, the standard log data includes at least one desensitized word, and the desensitized word corresponds to the first word one by one.

[0069] In operation S330, when the attention degree of the first word is less than the first threshold, the first word is not desensitized.

[0070] In operation S340, it is determined whether the attention degree of the second word is greater than a second threshold.

[0071] In operation S350, when the attention degree of the second word is greater than the second threshold, the desensitized word corresponding to the second word in the standard log data is encrypted to obtain the desensitized log data.

[0072] In operation S360, when the attention degree of the second word is less than the second threshold, the desensitized word corresponding to the second word in the standard log data is not encrypted.

[0073] Among them, the first threshold is smaller than the second threshold, the log data to be desensitized includes the first vocabulary, and the first vocabulary includes the second vocabulary.

[0074] For example, different attention levels indicate that the words have different sensitivities in the log text. Therefore, different measures can be used to perform desensitization or encryption processing for words with different sensitivities.

[0075] Information with a higher degree of sensitivity may include ID number, bank account number, password, medical record, financial status, etc., the company's undisclosed financial reports, technology patents, R&D plans, customer data, etc. Information with a lower degree of sensitivity may include personal hobbies, public social media dynamics, public product catalogs, non-confidential project descriptions, etc.

[0076] For example, the attention level may be a value of 0-10, the first threshold may be set to 3, and the second threshold may be set to 7.

[0077] For words with a degree of attention greater than 3, the first processing can be performed through desensitization. The words here include words with low sensitivity and words with high sensitivity. Further, for words with a degree of attention greater than 7, a second processing can be performed through encryption on the basis of desensitization, thereby obtaining desensitized log data.

[0078] For words with low attention (e.g., name, hobby, gender), whose attention is greater than 3 and less than 7, desensitization technology can be used to replace them with generalized or fuzzy forms. For example, personal names can be replaced with "***" or "user A", and hobbies can replace the numeric part with ***.

[0079] After desensitization is completed, for words with high attention (for example, account password, ID card number), whose attention is greater than 7, especially the part containing highly sensitive data (for example, account password, ID card number), further encryption processing can be performed. For example, symmetric encryption (such as AES algorithm) or asymmetric encryption (such as RSA algorithm) can be used to encrypt sensitive data.

[0080] In other embodiments, the identified sensitive data is desensitized, and the desensitization operation is mainly for sensitive fields such as personal identity information, phone numbers, bank account numbers, etc., and is processed by replacing or randomly generating data. For example, sensitive information such as customer phone numbers can be replaced to protect privacy information while maintaining data format consistency.

[0081]

[0082] After desensitization, the desensitized log data can be further encrypted to ensure the security of the data during transmission and storage. For example, the Advanced Encryption Standard (AES) is used as the encryption algorithm to ensure the security of data transmission.

[0083] Figure 4A A flowchart of a method for processing desensitized data according to a first processing model of an embodiment of the present disclosure is schematically shown; Figure 4B A schematic diagram of a method for processing desensitized data according to a first processing model of an embodiment of the present disclosure is schematically shown.

[0084] As described above, in operation S220, the first processing model includes a first sub-model and a second sub-model, and the log data to be desensitized is input into the first processing model to obtain the first data. Figure 4A As shown, the operation may further include operation S410 to operation S430.

[0085] In operation S410, based on the first sub-model, the words in the log data to be desensitized are converted into word vectors, and the first sub-model is used to capture the semantic representation of the words.

[0086] In operation S420, based on the second sub-model, a weighted value of a word in the log data to be desensitized is determined, where the weighted value represents the importance of the word in the log data to be desensitized.

[0087] In operation S430, first data is determined according to the word vector and the weight value.

[0088] For example, refer to Figure 4B , the first sub-model can be a Word2Vec model, and the second sub-model can be a TF-IDF model.

[0089] For example, first, load the word vector from the trained Word2Vec model, and for each word in the log data to be desensitized, find its corresponding word vector representation in the Word2Vec model to express the semantic information of the word. For each word j in the log data to be desensitized i, its word vector representation is , according to the Word2Vec model, it can be calculated by the following formula:

[0090]

[0091] Among them, W is the word vector matrix, is the one-hot vector corresponding to word j, and b is the bias term. Convert the words in the log data to be desensitized into digital vector representations. If the log data to be desensitized exists in the model, convert it to the corresponding vector; if not, use a zero vector to represent it.

[0092] At the same time, in order to better understand the contextual information in the log information data text, the TF-IDF model is used to represent the entire text. First, the word frequency (TF) of each word in the text is calculated, and the formula is as follows:

[0093]

[0094] in, represents the number of times word j appears in text i, and M is the total number of words in the data text. Then calculate the inverse document frequency (IDF) of each word, the formula is as follows:

[0095]

[0096] Where N is the total number of log information texts, Represents the number of documents containing word j. Finally, the word frequency and the inverse document frequency are multiplied to get the TF-IDF value of each word. The formula is:

[0097]

[0098] Then, the TF-IDF value of each word in the log information text data is obtained, thereby obtaining the TF-IDF vector representation of the entire text.

[0099] During the training phase, for the cleaned log data to be desensitized, sensitive information in the log information of corporate customers can be manually labeled, such as account number, transaction amount, personal identity information, etc. The processed data set is randomly divided into 70% training set, 15% validation set, and 15% test set to ensure the representativeness of each data set.

[0100] In some embodiments, the first processing model includes a third sub-model, and operation S430 determines the first data according to the word vector and the weight value, including:

[0101] Based on the third sub-model, the added value of the words in the log data to be desensitized is determined, and the added value represents the frequency of the words appearing in the log data to be desensitized.

[0102] The first data is determined according to the word vector, the additional value and the weighted value.

[0103] Exemplarily, the third sub-model may be a bag-of-words model, which uses a TF-IDF model combined with a bag-of-words model to represent the entire text. The TF-IDF model measures the relative importance of each word, while the bag-of-words model is used to represent the overall structure of the text.

[0104] The bag-of-words model is a simple text representation method that ignores the order of words and only focuses on whether the words appear in the text and the frequency of their occurrence.

[0105] When using the bag of words model, a vocabulary is created that contains all the different words. The vocabulary contains the words from multiple texts. Each text can then be represented by a vector where each position corresponds to the frequency of a word in the text. This vector representation ignores the order of the words, but it effectively captures the frequency of words in the text.

[0106] The Word2Vec model converts each word into a digital vector to obtain a word vector representation of the text. The TF-IDF model calculates a weighted value for each word, which represents the importance of the word in the text. The bag-of-words model constructs an additional value that represents the frequency vector of the text. Based on the word vector, the additional value, and the weighted value, the first data for input into the second processing model is determined.

[0107] Figure 5A A flowchart of a method for processing desensitized data according to a second processing model of an embodiment of the present disclosure is schematically shown; Figure 5B A schematic diagram of a second processing model according to an embodiment of the present disclosure is schematically shown.

[0108] As described above, in operation S230, the first data is input into the second processing model to obtain second data, and the second data represents the attention level of each word. Figure 5AAs shown, the operation may further include operation S510 to operation S530.

[0109] In operation S510, the first data is processed to obtain third data, where the third data represents the dependency relationship between words.

[0110] In operation S520, a weight value of the vocabulary is determined, where the weight value represents the contribution of the vocabulary to the prediction result of the second processing model.

[0111] In operation S530, second data is determined according to the weight value and the third data.

[0112] For example, refer to Figure 5B The second processing model can be an LSTM model (Long Short-Term Memory) integrated with the Basic Attention mechanism. The stacking of multiple layers of LSTM is adopted to increase the depth of the network to improve the model's expressiveness and prediction performance. The Basic Attention mechanism can enhance the model's ability to capture relevant information in the data sequence. The adaptive learning rate adjustment algorithm AdamW is used to optimize the training process and improve the model's generalization ability.

[0113] A multi-layer stacked long short-term memory network (LSTM) is used to increase the depth and expressiveness of the model, enabling it to capture deeper contextual information and further improve recognition performance. Each LSTM layer contains an input gate, a forget gate, an output gate, and a cell state. By stacking multiple LSTM layers, long-term dependencies in sequence data can be better captured.

[0114] Assume that the input of the lth layer LSTM is , the output is , then the forward propagation of the LSTM of layer l can be expressed as:

[0115]

[0116] in, They are The activation values ​​of the input gate, forget gate, and output gate of the layer LSTM, is the cell state, is the sigmoid activation function, represents the weight matrix, Represents the bias term. By stacking multiple LSTM layers, a deep LSTM network is formed, thereby enhancing the model's ability to process complex sequence data.

[0117] In the Basic Attention mechanism, the attention weight of each time step is calculated and the output of the LSTM layer is weighted and summed to obtain a context vector containing important information.

[0118] Suppose the output sequence of the LSTM layer is , where T is the sequence length. For each time step t, calculate its attention weight (i.e. weight value) as follows:

[0119]

[0120] Among them, v is the weight vector of attention weights, is the weight matrix, is the paranoid term, in the denominator is the unnormalized score for all time steps Then, use these attention weights to perform a weighted summation on the output of the LSTM layer to obtain the context vector c (i.e., the second data, attention):

[0121]

[0122] In the second processing model, the adaptive learning rate adjustment algorithm AdamW (Adaptive Moment Estimation with Weight Decay) is used to dynamically adjust the learning rate according to the gradient changes during the training process to speed up the training speed and improve the convergence performance of the model.

[0123] In some embodiments, the log desensitization method of the embodiment of the present disclosure further includes: updating the second data in response to the user's modification of the word attention; and desensitizing the log data to be desensitized according to the updated second data to obtain the desensitized log data.

[0124] For example, after the sensitive field identification is completed (i.e., after the second data is obtained), in order to deal with possible misjudgments, a manual correction stage is introduced. The business personnel review and correct the identification results, thereby improving the recognition accuracy of the system.

[0125] For example, business personnel can use the interactive interface to view and review the potentially sensitive fields (the degree of attention of the vocabulary) identified by the system to confirm whether there are any misjudgments. If there are any misjudgments, the business personnel will correct the misjudged fields and submit the correction results to the system. The correction results include the marked sensitive fields and the business personnel's judgment on whether the fields are sensitive. The system uses the correction results generated in the manual correction stage as training samples and uses them together with historical data to retrain the model. By continuously updating the model's training data, the model can better adapt to changes in business scenarios to improve the model's recognition capabilities.

[0126] As described above, in operation S210, in response to a query request for a target business log, log data to be desensitized corresponding to the target business is obtained. In one achievable manner, the operation may further include: the proxy server obtains the log data to be desensitized corresponding to the request from the first log database according to the request, wherein, in response to the business server receiving the query request for the target business log, the request is forwarded to the proxy server.

[0127] Exemplarily, the first log database is used to store original log data of multiple target services.

[0128] The client initiates a request to obtain the log data of the target business through the client, and the client forwards the request to the business server corresponding to the target business. Once the business server receives the user's query request, it will establish a communication link with the proxy server and send a command to the proxy server requesting to obtain the log data. After receiving the request, the proxy server obtains the original log data (log data to be desensitized) corresponding to the target business from the first log database. The proxy server then desensitizes and encrypts the original log data, which can refer to the above operations S210-S240, and will not be repeated here.

[0129] In some embodiments, the log desensitization method of the embodiments of the present disclosure also includes the following operations.

[0130] In response to a user initiating a request on the client, the request is encrypted using the public key.

[0131] When the private key of the business server matches the public key, the encrypted request is decrypted and forwarded to the proxy server.

[0132] For example, the service server has a pair of keys, including a public key and a private key. The public key is public and can be obtained by multiple users, while the private key is kept by the service server itself and is not public.

[0133] The user sends a log data query request to the business server, requesting to obtain the log data corresponding to the target business. In order to achieve communication security and prevent data from being eavesdropped or tampered with during transmission, the SSL (Secure Sockets Layer) / TLS (Transport Layer Security) secure transmission protocol can be used. The client encrypts the request data sent by the public key, and the business server uses the corresponding private key to decrypt it, ensuring the confidentiality and integrity of the data during transmission.

[0134] When a user (client) needs to send a request, the business server's public key is used to encrypt the data. This means that only the server with the corresponding private key can decrypt the data, ensuring that only the target business server can read the data content. When the encrypted data is transmitted to the server over the network, the server uses its private key to decrypt it.

[0135] It is understandable that through encrypted transmission, only the intended recipient (business server) can read the data, preventing the data from being obtained by a third party during the transmission process. The SSL / TLS protocol not only encrypts the data, but also ensures that the data is not modified during the transmission process. Even if the data is intercepted during transmission, the attacker cannot modify the data content without being discovered.

[0136] In some embodiments, the log desensitization method of the embodiments of the present disclosure also includes the following operations.

[0137] In response to completion of desensitization of the log data to be desensitized, the proxy server sends the desensitized log data to the business server, and the business server stores the desensitized log data in the second log database.

[0138] According to the request, the business server sends the desensitized log data corresponding to the request from the second log database to the client.

[0139] Exemplarily, after the proxy server completes the desensitization and encryption operations on the log data, the proxy server returns the processed log data to the business server. After receiving the encrypted and desensitized log data, the business server stores it in the second log database. When the user requests to view the log data, the business server retrieves the corresponding desensitized and encrypted data from the second log database and securely transmits it to the user end via the SSL / TLS protocol. The user end uses the corresponding key to decrypt and restore the data, and can view the desensitized and encrypted log data.

[0140] It is understandable that in the process of desensitizing and encrypting log data, proxy servers are used for data processing. The use of proxy servers can not only effectively protect sensitive information from being illegally obtained and leaked, greatly reduce the risk of data leakage, and effectively safeguard the company's business secrets and user privacy; at the same time, it also ensures the security of data during transmission or storage, and provides a solid guarantee for the integrity and credibility of the data. In addition, proxy servers also have the functions of monitoring network transmission status and optimizing network performance, which can strengthen the company's network security management and effectively prevent and respond to potential security threats.

[0141] Figure 6 The following schematically shows a flow chart of a log desensitization method according to another embodiment of the present disclosure.

[0142] In order to facilitate the understanding of the log desensitization method of the embodiment of the present disclosure, Figure 6 This method is further described.

[0143] In one implementation, as shown in FIG. 4 , the method may include operations S610 to S670.

[0144] In operation S610, the user initiates a query sentiment for a target business log on the client, and the client encrypts the data using a public key and sends it to the business server.

[0145] In operation S620, after receiving the request, the business server uses the private key to decrypt the data. If the public key and the private key match, the data can be decrypted, and the business server is the business server corresponding to the target business.

[0146] In operation S630, the service server sends the request to the proxy server.

[0147] In operation S640, the proxy server obtains the to-be-desensitized log data corresponding to the target business from the first log database.

[0148] In operation S650 , the proxy server performs desensitization processing on the log data to be desensitized.

[0149] In operation S660, the proxy server encrypts the desensitized log data to obtain the desensitized log data. The proxy server encrypts the desensitized log data and returns it to the service server.

[0150] In operation S670, the business server displays the anonymized log data to the user through the client.

[0151] Based on the above log desensitization method, the present disclosure also provides a log desensitization device. Figure 7 The device is described in detail.

[0152] Figure 7 The structural block diagram of the log desensitization device according to an embodiment of the present disclosure is schematically shown.

[0153] like Figure 7 As shown, the log desensitization device 800 of this embodiment includes an acquisition module 810 , a first processing module 820 , a second processing module 830 and a desensitization module 840 .

[0154] The acquisition module 810 is used to respond to a query request for a target business log and acquire the log data to be desensitized corresponding to the target business. In one embodiment, the acquisition module 810 can be used to perform the operation S210 described above, which will not be described in detail here.

[0155] The first processing module 820 is used to input the log data to be desensitized into the first processing model to obtain first data, and the first data represents the weighted word vector of each word in the log data to be desensitized. In one embodiment, the first processing module 820 can be used to perform the operation S220 described above, which will not be repeated here.

[0156] The second processing module 830 is used to input the first data into the second processing model to obtain second data, and the second data represents the attention level of each word. In one embodiment, the second processing module 830 can be used to perform the operation S230 described above, which will not be repeated here.

[0157] The desensitization module 840 is used to perform desensitization processing on the log data to be desensitized according to the second data to obtain the desensitized log data. In one embodiment, the desensitization module 840 can be used to perform the operation S240 described above, which will not be described in detail here.

[0158] According to an embodiment of the present disclosure, the desensitization module also includes a first desensitization sub-module and a second desensitization sub-module.

[0159] The first desensitization submodule is used to perform desensitization processing on the first word when the attention degree of the first word is greater than a first threshold to obtain standard log data, where the standard log data includes at least one desensitized word, and the desensitized word corresponds to the first word one by one.

[0160] When the attention degree of the second word is greater than the second threshold, the second desensitization submodule encrypts the desensitized words corresponding to the second word in the standard log data to obtain desensitized log data.

[0161] Among them, the first threshold is smaller than the second threshold, the log data to be desensitized includes the first vocabulary, and the first vocabulary includes the second vocabulary.

[0162] According to an embodiment of the present disclosure, the first processing module further includes a first processing sub-module, a second processing sub-module and a third processing sub-module.

[0163] The first processing submodule is used to convert the words in the log data to be desensitized into word vectors based on the first submodel, and the first submodel is used to capture the semantic representation of the words.

[0164] The second processing submodule is used to determine the weighted value of the vocabulary in the log data to be desensitized based on the second sub-model, and the weighted value represents the importance of the vocabulary in the log data to be desensitized.

[0165] The third processing submodule is used to determine the first data according to the word vector and the weighted value.

[0166] According to an embodiment of the present disclosure, the third processing submodule further includes a first processing unit and a second processing unit.

[0167] The first processing unit is used to determine the added value of the vocabulary in the log data to be desensitized based on the third sub-model, and the added value represents the frequency of occurrence of the vocabulary in the log data to be desensitized.

[0168] The second processing unit is used to determine the first data according to the word vector, the additional value and the weighted value.

[0169] According to an embodiment of the present disclosure, the second processing module further includes a fourth processing sub-module, a fifth processing sub-module and a sixth processing sub-module.

[0170] The fourth processing submodule is used to process the first data to obtain third data, where the third data represents the dependency relationship between words.

[0171] The fifth processing submodule is used to determine the weight value of the vocabulary, and the weight value represents the contribution of the vocabulary to the prediction result of the second processing model.

[0172] The sixth processing submodule is used to determine the second data according to the weight value and the third data.

[0173] According to an embodiment of the present disclosure, the acquisition module also includes an acquisition submodule.

[0174] The acquisition submodule is used for the proxy server to obtain the to-be-desensitized log data corresponding to the request from the first log database according to the request, wherein, in response to the business server receiving a query request for the target business log, the request is forwarded to the proxy server.

[0175] According to an embodiment of the present disclosure, the device further includes an encryption module and a decryption module.

[0176] The encryption module is used to encrypt the request using the public key when the user initiates a request on the client.

[0177] The decryption module is used to decrypt the encrypted request and forward the request to the proxy server when the private key and public key of the business server match each other.

[0178] According to an embodiment of the present disclosure, the device further includes a first sending module and a second sending module.

[0179] The first sending module is used for responding to the completion of desensitization of the log data to be desensitized, the proxy server sending the desensitized log data to the business server, and the business server storing the desensitized log data into the second log data.

[0180] The second sending module is used for sending the desensitized log data corresponding to the request from the second log database to the client according to the request.

[0181] According to an embodiment of the present disclosure, the acquisition module 810, the first processing module 820, the second processing module 830 and the desensitization module 840. Any multiple modules in can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, the acquisition module 810, the first processing module 820, the second processing module 830 and the desensitization module 840. At least one of can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in an appropriate combination of any of them. Alternatively, the acquisition module 810, the first processing module 820, the second processing module 830 and the desensitization module 840. At least one of the embodiments may be at least partially implemented as a computer program module, and when the computer program module is executed, the corresponding function may be performed.

[0182] Figure 8 A block diagram of an electronic device suitable for implementing a log desensitization method according to an embodiment of the present disclosure is schematically shown.

[0183] like Figure 8As shown, the electronic device 900 according to an embodiment of the present disclosure includes a processor 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage part 908 to a random access memory (RAM) 903. The processor 901 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a dedicated microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 901 may also include an onboard memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0184] In RAM 903, various programs and data required for the operation of electronic device 900 are stored. Processor 901, ROM 902 and RAM 903 are connected to each other via bus 904. Processor 901 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 902 and / or RAM 903. It should be noted that the program can also be stored in one or more memories other than ROM 902 and RAM 903. Processor 901 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in one or more memories.

[0185] According to an embodiment of the present disclosure, the electronic device 900 may further include an input / output (I / O) interface 905, which is also connected to the bus 904. The electronic device 900 may further include one or more of the following components connected to the input / output (I / O) interface 905: an input portion 906 including a keyboard, a mouse, etc.; an output portion 907 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 908 including a hard disk, etc.; and a communication portion 909 including a network interface card such as a LAN card, a modem, etc. The communication portion 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the input / output (I / O) interface 905 as needed. A removable medium 911, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 910 as needed, so that a computer program read therefrom is installed into the storage portion 908 as needed.

[0186] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0187] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 902 and / or RAM 903 described above and / or one or more memories other than ROM 902 and RAM 903.

[0188] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program includes a program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the log desensitization method provided by the embodiment of the present disclosure.

[0189] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 901. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0190] In one embodiment, the computer program may be based on a tangible storage medium such as an optical storage device, a magnetic storage device, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of a signal on a network medium, and downloaded and installed through the communication part 909, and / or installed from a removable medium 911. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0191] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 909, and / or installed from the removable medium 911. When the computer program is executed by the processor 901, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0192] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0193] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, functions and operations of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0194] It will be appreciated by those skilled in the art that the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations or combinations are not explicitly described in the present disclosure. In particular, without departing from the spirit and teachings of the present disclosure, the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0195] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A log desensitization method, characterized in that: The method comprises: In response to a query request for a target business log, obtaining log data to be desensitized corresponding to the target business; Inputting the log data to be desensitized into a first processing model to obtain first data, wherein the first data represents a weighted word vector of each word in the log data to be desensitized; Inputting the first data into a second processing model to obtain second data, wherein the second data represents the attention level of each of the words; The log data to be desensitized is desensitized according to the second data to obtain desensitized log data.

2. The method according to claim 1, characterized in that: According to the second data, the log data to be desensitized is desensitized to obtain desensitized log data, including: When the attention degree of the first word is greater than the first threshold, desensitizing the first word to obtain standard log data, wherein the standard log data includes at least one desensitized word, and the desensitized word corresponds to the first word one by one; When the attention degree of the second word is greater than a second threshold, encrypting the desensitized word corresponding to the second word in the standard log data to obtain desensitized log data; The first threshold is smaller than the second threshold, the log data to be desensitized includes the first vocabulary, and the first vocabulary includes the second vocabulary.

3. The method according to claim 1, characterized in that The first processing model includes a first sub-model and a second sub-model. The log data to be desensitized is input into the first processing model to obtain first data, including: Based on the first sub-model, converting the words in the log data to be desensitized into word vectors, wherein the first sub-model is used to capture the semantic representation of the words; Based on the second sub-model, determine a weighted value of the vocabulary in the log data to be desensitized, wherein the weighted value represents the importance of the vocabulary in the log data to be desensitized; The first data is determined according to the word vector and the weighted value.

4. The method according to claim 3, characterized in that The first processing model includes a third sub-model, and determines the first data according to the word vector and the weight value, including: Based on the third sub-model, determining an additional value of a word in the log data to be desensitized, wherein the additional value represents a frequency of occurrence of the word in the log data to be desensitized; The first data is determined according to the word vector, the additional value and the weighted value.

5. The method according to claim 1, 3 or 4, characterized in that: Inputting the first data into a second processing model to obtain second data, wherein the second data represents the attention level of each of the words, including: Processing the first data to obtain third data, wherein the third data represents the dependency relationship between the words; Determining a weight value of the vocabulary, wherein the weight value represents a contribution of the vocabulary to a prediction result of the second processing model; The second data is determined according to the weight value and the third data.

6. The method according to claim 1, characterized in that In response to a query request for a target business log, obtaining log data to be desensitized corresponding to the target business, including: The proxy server obtains the log data to be desensitized corresponding to the request from the first log database according to the request, wherein, in response to the business server receiving the query request for the target business log, the request is forwarded to the proxy server.

7. The method according to claim 2 or 6, characterized in that: The method further comprises: In response to the user initiating the request at the client, encrypting the request using a public key; When the private key of the service server matches the public key, the encrypted request is decrypted and forwarded to the proxy server.

8. The method according to claim 7, characterized in that The method further comprises: In response to completion of desensitization of the log data to be desensitized, the proxy server sends the desensitized log data to the business server, and the business server stores the desensitized log data in a second log database; According to the request, the business server sends the desensitized log data corresponding to the request from the second log database to the client.

9. A log desensitization device, characterized in that: The device comprises: An acquisition module, configured to obtain the log data to be desensitized corresponding to the target business in response to a query request for the target business log; A first processing module, configured to input the log data to be desensitized into a first processing model to obtain first data, wherein the first data represents a weighted word vector of each word in the log data to be desensitized; A second processing module, configured to input the first data into a second processing model to obtain second data, wherein the second data represents the attention level of each of the words; and The desensitizing module is used to perform desensitizing processing on the log data to be desensitized according to the second data to obtain desensitized log data.

10. An electronic device, comprising: one or more processors; a memory for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 8.

11. A computer-readable storage medium having a computer program or instruction stored thereon, characterized in that: When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

12. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images