Sensitive data identification and protection method and system based on intelligent matching

Abstract

The present invention provides a sensitive data identification and protection method and system based on intelligent matching, which relates to the field of data processing technology, including semantic analysis of sensitive data through natural language processing models, construction of multi-level knowledge graphs; node encoding and relationship strength calculation using graph neural networks and attention mechanisms; node sensitivity weights and classification using graph structure importance evaluation algorithms; application of corresponding data protection schemes according to sensitivity levels, and identification of associated nodes through graph traversal algorithms for hierarchical protection. The present invention realizes intelligent identification, precise classification and comprehensive protection of sensitive data, and improves data security.

Description

Technical Field

[0001] The present invention relates to data processing technology, and in particular to a sensitive data identification and protection method and system based on intelligent matching. Background Art

[0002] With the advent of the big data era, enterprises and organizations have accumulated massive amounts of data resources. These data often contain a large amount of sensitive information, such as personal privacy data, business secrets, financial transaction records, etc. How to effectively identify and protect these sensitive data has become an important issue in the field of data security. Traditional sensitive data identification methods mainly rely on rules such as keyword matching and regular expressions to identify specific types of sensitive information through predefined patterns. At the same time, existing data protection solutions usually adopt unified encryption and access control strategies to implement the same protection measures for sensitive data of different levels.

[0003] The existing technology has the following main problems:

[0004] Traditional rule-matching-based sensitive data identification methods have difficulty accurately understanding the semantic content and contextual relationships of data, and are prone to misjudgment and omission. Especially when processing unstructured data, it is impossible to effectively identify implicit sensitive information, resulting in insufficient accuracy and completeness in sensitive data identification.

[0005] Existing sensitive data classification methods lack in-depth analysis of the relationship between data, often evaluate data in isolation, and ignore the propagation effect of sensitive information between related data. This results in some seemingly ordinary information that is closely related to highly sensitive data not being properly protected.

[0006] Current data protection solutions generally adopt a one-size-fits-all protection strategy, failing to implement differentiated protection based on the sensitivity and association of data. This approach not only wastes system resources, but also may result in some sensitive data not being adequately protected, posing security risks. Summary of the invention

[0007] The embodiments of the present invention provide a sensitive data identification and protection method and system based on intelligent matching, which can solve the problems in the prior art.

[0008] A first aspect of an embodiment of the present invention provides a sensitive data identification and protection method based on intelligent matching, comprising:

[0009] Acquire sensitive data from the target data source, and use a natural language processing model to perform semantic analysis on the sensitive data, extract entity information, attribute information, and relationship information from the sensitive data; construct the entity information as nodes of a knowledge graph, use the attribute information as attribute identifiers of the nodes, and construct the relationship information as edges between nodes in the knowledge graph, to generate a knowledge graph containing multi-level sensitive data association relationships; wherein the nodes of the knowledge graph are encoded with feature vectors through a graph neural network, and the edges are calculated for relationship strength through an attention mechanism;

[0010] Based on the out-degree, in-degree and edge relationship strength of the nodes in the knowledge graph, a graph structure importance evaluation algorithm is used to calculate the sensitivity weight of each node, and the graph structure importance evaluation algorithm includes node centrality calculation and node influence propagation calculation; the nodes in the knowledge graph are graded according to the sensitivity weights of the nodes, the nodes are divided into different sensitive data levels based on a preset sensitivity level threshold, and the sensitive data level of each node is marked in the knowledge graph;

[0011] For nodes with different sensitive data levels in the knowledge graph, data protection schemes of corresponding levels are obtained from a preset hierarchical protection strategy library, and the data protection schemes include data storage encryption schemes, data access control schemes, and data transmission protection schemes; based on a graph traversal algorithm, all nodes that are directly or indirectly associated with the target node are identified, the sensitive data level of the target node is propagated to the associated nodes, and the associated nodes are hierarchically protected with a data protection scheme that is not lower than the sensitive data level of the target node.

[0012] The entity information is constructed as a node of a knowledge graph, the attribute information is used as an attribute identifier of the node, and the relationship information is constructed as an edge between nodes in the knowledge graph. Generating a knowledge graph containing multi-level sensitive data association relationships includes:

[0013] Receive the preprocessed sensitive data, and extract entity information from the sensitive data using named entity recognition technology, construct a unique identifier for each entity information, and map the entity information to a node in a knowledge graph; convert the attribute information of the node into an attribute feature vector based on a word embedding model, and associate the attribute feature vector with the entity information of the node; calculate the attribute sensitivity of the attribute feature vector using a predefined sensitivity evaluation rule, and use the attribute sensitivity as the attribute identifier of the node;

[0014] Based on semantic similarity calculation and node interaction frequency analysis, a relationship edge between nodes in the knowledge graph is established, and the relationship strength of the relationship edge is calculated by dividing the product of the semantic similarity and the interaction frequency between the nodes by the square root of the path distance between the nodes; the relationship edge between the nodes is divided into direct relationship edge, indirect relationship edge and derived relationship edge, wherein the direct relationship edge indicates that there is a direct data association between the nodes, the indirect relationship edge indicates a transitive relationship between the nodes established through an intermediate node, and the derived relationship edge indicates a potential relationship derived based on rule reasoning;

[0015] Construct a multi-level association structure of the knowledge graph, the multi-level association structure includes a direct association layer, an indirect association layer and an extended association layer, calculate the propagation strength between different levels, the propagation strength is calculated by the power of the level attenuation factor and the product of the relationship strength of each relationship edge on the path; wherein the level attenuation factor has a value range greater than zero and less than one, and the propagation strength decays with the increase of the association level; based on the propagation strength, weights are assigned to the nodes in the knowledge graph to generate a knowledge graph with multi-level sensitive data association relationships.

[0016] Based on the out-degree, in-degree and edge relationship strength of the nodes in the knowledge graph, the sensitivity weight of each node is calculated using a graph structure importance evaluation algorithm, which includes node centrality calculation and node influence propagation calculation, including:

[0017] Calculate the out-degree value and in-degree value of each node in the knowledge graph, wherein the out-degree value is obtained by calculating the number of edges connected to the node, and the in-degree value is obtained by calculating the number of edges pointing to the node; calculate the degree centrality of the node based on the out-degree value and in-degree value of the node, calculate the closeness centrality of the node based on the shortest path length between the node and other nodes, and calculate the betweenness centrality of the node based on the ratio of the number of shortest paths passing through the node to the total number of shortest paths between node pairs in the knowledge graph;

[0018] The degree centrality, closeness centrality, and betweenness centrality of the node are multiplied by the preset first weight coefficient, second weight coefficient, and third weight coefficient respectively, and the sum is calculated to obtain the initial influence value of the node, where the sum of the first weight coefficient, the second weight coefficient, and the third weight coefficient is one; the initial influence value of the node is iteratively calculated based on the influence propagation model to obtain the current influence value of the node;

[0019] The structural importance of the node is calculated based on the current influence value of the node, and the structural importance is obtained by multiplying the normalized current influence value of the node and the strength score of the node-associated edge with the preset fourth weight coefficient and fifth weight coefficient respectively, and summing them up; the product of the structural importance of the node and the influencing factor adjustment item is used as the sensitivity weight of the node, and the influencing factor adjustment item includes multiple preset influencing factors, each of which corresponds to an influencing factor weight coefficient, and the influencing factor adjustment item is calculated by the score of each influencing factor and the corresponding influencing factor weight coefficient.

[0020] Grading the nodes in the knowledge graph according to the sensitivity weights of the nodes, dividing the nodes into different sensitive data levels based on a preset sensitivity level threshold, and marking the sensitive data level of each node in the knowledge graph includes:

[0021] Establish a sensitivity grading system for nodes in the knowledge graph, the sensitivity grading system includes a core sensitivity level, a highly sensitive level, a medium sensitivity level and a general sensitivity level sorted from high to low, and set a core sensitivity level threshold, a highly sensitive level threshold and a medium sensitivity level threshold, the core sensitivity level threshold is greater than the highly sensitive level threshold, and the highly sensitive level threshold is greater than the medium sensitivity level threshold;

[0022] Calculate the normalized sensitivity weight of the node in the knowledge graph, by subtracting the minimum sensitivity weight of all nodes in the knowledge graph from the sensitivity weight of the node, and then dividing it by the difference between the maximum and minimum sensitivity weights of all nodes in the knowledge graph, to obtain the normalized sensitivity weight of the node; compare the normalized sensitivity weight of the node with the core sensitivity level threshold, the high sensitivity level threshold and the medium sensitivity level threshold, and classify the node as the core sensitivity level when the normalized sensitivity weight is greater than or equal to the core sensitivity level threshold, classify the node as the high sensitivity level when the normalized sensitivity weight is greater than or equal to the high sensitivity level threshold and less than the core sensitivity level threshold, classify the node as the medium sensitivity level when the normalized sensitivity weight is greater than or equal to the medium sensitivity level threshold and less than the high sensitivity level threshold, and classify the node as the general sensitivity level when the normalized sensitivity weight is less than the medium sensitivity level threshold;

[0023] Calculate the intra-class cohesion of nodes in each sensitivity level and the inter-class separation between adjacent sensitivity levels, the intra-class cohesion is obtained by calculating the average value of the difference between the normalized sensitivity weights of nodes in the same sensitivity level and the average value of the normalized sensitivity weights of all nodes in the sensitivity level, and the inter-class separation is obtained by calculating the absolute value of the difference between the average values ​​of the normalized sensitivity weights of nodes in two adjacent sensitivity levels; optimize the core sensitivity level threshold, the highly sensitive level threshold and the moderate sensitivity level threshold based on the ratio of the intra-class cohesion to the inter-class separation; calculate the sensitivity level labeling vector of the node, the sensitivity level labeling vector contains the probability distribution of the node belonging to each sensitivity level, and add a sensitivity level label to the node in the knowledge graph.

[0024] Based on the graph traversal algorithm, all nodes that are directly or indirectly associated with the target node are identified, the sensitive data level of the target node is propagated to the associated nodes, and the associated nodes are protected by a data protection scheme that is not lower than the sensitive data level of the target node, including:

[0025] Obtain the sensitive data level of the target node in the knowledge graph, traverse the knowledge graph based on the breadth-first traversal strategy, use a queue to record the nodes to be visited, add the target node as the initial node to the queue, and establish a set of visited nodes; calculate the shortest path length from the target node to the currently traversed node, and when the shortest path length is less than or equal to the preset maximum traversal depth threshold, mark the currently traversed node as an associated node;

[0026] Calculating the association strength between the target node and the associated node, the association strength is obtained by dividing the weight of the edge between the target node and the associated node by the square root of the product of the out-degree value of the target node and the in-degree value of the associated node, and then multiplying the result by a negative exponential distance decay factor, wherein the negative exponential distance decay factor is calculated by a preset decay coefficient and the shortest path length;

[0027] Calculating a propagation weight of the sensitivity level based on the association strength, wherein the propagation weight is obtained by multiplying a distance decay function by an association strength adjustment function, wherein the distance decay function adopts a negative exponential form, and the association strength adjustment function adopts a Sigmoid function; selecting a path with the largest propagation weight product as a sensitivity level propagation path among multiple paths from the target node to the associated node, and multiplying the propagation weight product on the propagation path by the sensitive data level of the target node to obtain a propagation sensitivity level of the associated node;

[0028] Compare the original sensitivity level and the propagation sensitivity level of the associated node, and select the higher level of the two as the protection level of the associated node; calculate the protection strength of the associated node based on the protection level and the node importance factor, and the node importance factor is weighted by a preset protection level weight coefficient; calculate the impact range of the propagation of the target node sensitivity level, which is obtained by dividing the difference between the protection level of the associated node and the original sensitivity level by the cumulative sum of the shortest path lengths, adaptively adjust the preset protection threshold based on the impact range, and implement hierarchical protection for the associated node according to the adjusted protection threshold.

[0029] For nodes with different sensitive data levels in the knowledge graph, data protection schemes of corresponding levels are obtained from a preset hierarchical protection strategy library. The data protection schemes include data storage encryption schemes, data access control schemes, and data transmission protection schemes, including:

[0030] Construct a mapping matrix between sensitivity level and protection dimension, where the protection dimension includes data storage encryption dimension, data access control dimension and data transmission protection dimension, calculate the dimension weight coefficient and risk adjustment coefficient of each protection dimension, and calculate the policy strength of different sensitivity levels in each protection dimension by combining the basic protection level and level risk factor;

[0031] Select a data storage encryption scheme based on the strength of the strategy, evaluate the strength of the encryption algorithm by setting the evaluation index weight, and set the key update cycle according to the sensitivity level, and the key update cycle is determined by the negative exponential function relationship between the basic update cycle and the sensitivity level; construct an access permission matrix for users and resources, and calculate the credibility score of users accessing resources based on multi-dimensional trust factors, and the credibility score is obtained by the weighted average of the trust factor scores of each dimension;

[0032] Conduct security assessment on data transmission channels, assign weight coefficients to the encryption strength, authentication strength, and integrity protection strength of the transmission channels, and calculate the security strength of the transmission channels; optimize data transmission routes based on link security levels and link reliability, and determine the route security score by calculating the product of the lowest security level in the transmission path and the link reliability;

[0033] Set the evaluation dimensions of the protection plan, assign evaluation weights to different dimensions, and calculate the comprehensive protection strength through the weighted average of the protection metrics of each dimension; determine the strategy adjustment step based on the difference between the target protection level and the current protection level, and perform adaptive optimization and adjustment on the protection plan; obtain the data protection plan from the preset hierarchical protection strategy library, and apply the data protection plan to the nodes of the corresponding sensitivity level in the knowledge graph.

[0034] A second aspect of an embodiment of the present invention provides a sensitive data identification and protection system based on intelligent matching, including:

[0035] The first unit is used to obtain sensitive data from a target data source, and perform semantic analysis on the sensitive data using a natural language processing model to extract entity information, attribute information, and relationship information from the sensitive data; construct the entity information as nodes of a knowledge graph, use the attribute information as an attribute identifier of the node, and construct the relationship information as edges between nodes in the knowledge graph to generate a knowledge graph containing multi-level sensitive data association relationships; wherein the nodes of the knowledge graph are encoded with feature vectors through a graph neural network, and the edges are calculated for relationship strength through an attention mechanism;

[0036] The second unit is used to calculate the sensitivity weight of each node based on the out-degree, in-degree and edge relationship strength of the nodes in the knowledge graph using a graph structure importance evaluation algorithm, wherein the graph structure importance evaluation algorithm includes node centrality calculation and node influence propagation calculation; classify the nodes in the knowledge graph according to the sensitivity weight of the nodes, divide the nodes into different sensitive data levels based on a preset sensitivity level threshold, and mark the sensitive data level of each node in the knowledge graph;

[0037] The third unit is used to obtain data protection schemes of corresponding levels from a preset hierarchical protection strategy library for nodes with different sensitive data levels in the knowledge graph, wherein the data protection schemes include data storage encryption schemes, data access control schemes, and data transmission protection schemes; identify all nodes that are directly or indirectly associated with the target node based on a graph traversal algorithm, propagate the sensitive data level of the target node to associated nodes, and perform hierarchical protection on the associated nodes using a data protection scheme that is not lower than the sensitive data level of the target node.

[0038] A third aspect of the embodiments of the present invention

[0039] An electronic device is provided, comprising:

[0040] processor;

[0041] a memory for storing processor-executable instructions;

[0042] The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0043] According to a fourth aspect of the embodiments of the present invention,

[0044] A computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the aforementioned method is implemented.

[0045] The beneficial effects of this application are as follows:

[0046] By using natural language processing models to perform semantic analysis on sensitive data and constructing a knowledge graph containing multi-level associations, and combining graph neural networks and attention mechanisms for feature encoding and relationship strength calculation, it is possible to comprehensively and accurately capture and express the complex associations between sensitive data, providing a reliable data foundation for subsequent sensitivity assessments.

[0047] Based on the structural characteristics of the knowledge graph, a graph structure importance assessment algorithm is used to calculate the node sensitivity weights and classify them. This not only takes into account the importance of the node itself, but also incorporates the influence propagation effect between nodes, making the classification results of sensitive data more scientific and reasonable, and able to accurately reflect the actual sensitivity of the data.

[0048] By identifying related nodes and propagating sensitivity through a graph traversal algorithm, and matching the corresponding level of hierarchical protection strategy, the accuracy and relevance of sensitive data protection are achieved, the security risks that may be caused by isolated protection are avoided, and all-round security protection of sensitive data in storage, access and transmission is ensured. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 A flowchart of a sensitive data identification and protection method based on intelligent matching according to an embodiment of the present invention;

[0050] Figure 2 It is a structural diagram of a sensitive data identification and protection system based on intelligent matching according to an embodiment of the present invention. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0052] The technical solution of the present invention is described in detail with specific embodiments below. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0053] Figure 1 FIG. 1 is a flow chart of a sensitive data identification and protection method based on intelligent matching according to an embodiment of the present invention. Figure 1 As shown, the method includes:

[0054] S101. Acquire sensitive data from the target data source, and use a natural language processing model to perform semantic analysis on the sensitive data, extract entity information, attribute information, and relationship information from the sensitive data; construct the entity information as nodes of a knowledge graph, use the attribute information as attribute identifiers of the nodes, and construct the relationship information as edges between nodes in the knowledge graph, to generate a knowledge graph containing multi-level sensitive data association relationships; wherein the nodes of the knowledge graph are encoded with feature vectors through a graph neural network, and the edges are calculated for relationship strength through an attention mechanism;

[0055] S102. Based on the out-degree, in-degree and edge relationship strength of the nodes in the knowledge graph, a graph structure importance evaluation algorithm is used to calculate the sensitivity weight of each node, and the graph structure importance evaluation algorithm includes node centrality calculation and node influence propagation calculation; the nodes in the knowledge graph are graded according to the sensitivity weights of the nodes, the nodes are divided into different sensitive data levels based on a preset sensitivity level threshold, and the sensitive data level of each node is marked in the knowledge graph;

[0056] S103. For nodes with different sensitive data levels in the knowledge graph, obtain data protection schemes of corresponding levels from a preset hierarchical protection strategy library, wherein the data protection schemes include data storage encryption schemes, data access control schemes, and data transmission protection schemes; based on a graph traversal algorithm, identify all nodes that are directly or indirectly associated with the target node, propagate the sensitive data level of the target node to associated nodes, and perform hierarchical protection on the associated nodes using a data protection scheme that is no lower than the sensitive data level of the target node.

[0057] In an optional implementation, the entity information is constructed as a node of a knowledge graph, the attribute information is used as an attribute identifier of the node, and the relationship information is constructed as an edge between nodes in the knowledge graph. Generating a knowledge graph containing multi-level sensitive data association relationships includes:

[0058] Receive the preprocessed sensitive data, and extract entity information from the sensitive data using named entity recognition technology, construct a unique identifier for each entity information, and map the entity information to a node in a knowledge graph; convert the attribute information of the node into an attribute feature vector based on a word embedding model, and associate the attribute feature vector with the entity information of the node; calculate the attribute sensitivity of the attribute feature vector using a predefined sensitivity evaluation rule, and use the attribute sensitivity as the attribute identifier of the node;

[0059] Based on semantic similarity calculation and node interaction frequency analysis, a relationship edge between nodes in the knowledge graph is established, and the relationship strength of the relationship edge is calculated by dividing the product of the semantic similarity and the interaction frequency between the nodes by the square root of the path distance between the nodes; the relationship edge between the nodes is divided into direct relationship edge, indirect relationship edge and derived relationship edge, wherein the direct relationship edge indicates that there is a direct data association between the nodes, the indirect relationship edge indicates a transitive relationship between the nodes established through an intermediate node, and the derived relationship edge indicates a potential relationship derived based on rule reasoning;

[0060] Construct a multi-level association structure of the knowledge graph, the multi-level association structure includes a direct association layer, an indirect association layer and an extended association layer, calculate the propagation strength between different levels, the propagation strength is calculated by the power of the level attenuation factor and the product of the relationship strength of each relationship edge on the path; wherein the level attenuation factor has a value range greater than zero and less than one, and the propagation strength decays with the increase of the association level; based on the propagation strength, weights are assigned to the nodes in the knowledge graph to generate a knowledge graph with multi-level sensitive data association relationships.

[0061] First, the input sensitive data is preprocessed and entity recognized. Entity information is identified from the text through natural language processing technologies such as word segmentation and part-of-speech tagging. For example, from the employee file text "Engineer Zhang is responsible for the development of Project A", "Engineer Zhang" can be identified as a person entity and "Project A" as a project entity. A unique identifier is generated for each entity, such as "P001" to represent the person entity. The entity information is constructed as a node of the knowledge graph.

[0062] Then, attribute feature extraction and sensitivity calculation are performed. Word embedding models such as Word2Vec are used to convert the attribute information of the node into a feature vector. For example, attributes such as employee positions and salaries are converted into numerical vectors. Attribute sensitivity is calculated according to predefined sensitivity evaluation rules, which include factors such as data type sensitivity and usage scenario sensitivity. For example, the sensitivity of position information is 0.3, and the sensitivity of salary information is 0.8. The calculated sensitivity is used as the attribute identifier of the node.

[0063] Then establish the relationship edge between nodes. The semantic similarity is obtained by calculating the cosine similarity of the node attribute vectors, and the interaction frequency is obtained by counting the data access frequency between nodes. The strength of the relationship edge is obtained by multiplying the two and dividing by the square root of the shortest path distance between nodes. For example, if the semantic similarity of two project nodes is 0.7, the interaction frequency is 10 times / day, and the path distance is 2, then the relationship strength is 2.47. According to the relationship type, the edges are divided into direct relationship edges, indirect relationship edges, and derived relationship edges.

[0064] Finally, a multi-level association structure is constructed. The level attenuation factor is set to 0.8. As the level of association increases, the propagation strength decays step by step. When calculating the propagation strength between different levels, multiply the power of the level attenuation factor by the strength of each relationship edge on the path. For example, the attenuation factor of the second-level association is 0.64. If there are two relationship edges with strengths of 2.47 and 1.85 on the path, the propagation strength is 2.93. Weights are assigned to nodes based on the propagation strength to generate the final multi-level knowledge graph.

[0065] This application can achieve:

[0066] Through named entity recognition and unique identifier mapping, accurate identification and standardized representation of sensitive data entities are achieved, improving the accuracy and reliability of knowledge graph construction.

[0067] The attribute feature extraction method based on word embedding model and predefined rules not only retains the semantic characteristics of attribute information, but also realizes the quantitative assessment of sensitivity, so that the knowledge graph has the ability to manage sensitive data in a hierarchical manner.

[0068] The adoption of a multi-level association structure and a propagation intensity attenuation mechanism not only shows the direct and indirect associations between sensitive data, but also controls the propagation scope of sensitive information through hierarchical attenuation, thereby enhancing the security and controllability of the knowledge graph.

[0069] In an optional implementation, based on the out-degree, in-degree and edge relationship strength of the nodes in the knowledge graph, a graph structure importance evaluation algorithm is used to calculate the sensitivity weight of each node, and the graph structure importance evaluation algorithm includes node centrality calculation and node influence propagation calculation including:

[0070] Calculate the out-degree value and in-degree value of each node in the knowledge graph, wherein the out-degree value is obtained by calculating the number of edges connected to the node, and the in-degree value is obtained by calculating the number of edges pointing to the node; calculate the degree centrality of the node based on the out-degree value and in-degree value of the node, calculate the closeness centrality of the node based on the shortest path length between the node and other nodes, and calculate the betweenness centrality of the node based on the ratio of the number of shortest paths passing through the node to the total number of shortest paths between node pairs in the knowledge graph;

[0071] The degree centrality, closeness centrality, and betweenness centrality of the node are multiplied by the preset first weight coefficient, second weight coefficient, and third weight coefficient respectively, and the sum is calculated to obtain the initial influence value of the node, where the sum of the first weight coefficient, the second weight coefficient, and the third weight coefficient is one; the initial influence value of the node is iteratively calculated based on the influence propagation model to obtain the current influence value of the node;

[0072] The structural importance of the node is calculated based on the current influence value of the node, and the structural importance is obtained by multiplying the normalized current influence value of the node and the strength score of the node-associated edge with the preset fourth weight coefficient and fifth weight coefficient respectively, and summing them up; the product of the structural importance of the node and the influencing factor adjustment item is used as the sensitivity weight of the node, and the influencing factor adjustment item includes multiple preset influencing factors, each of which corresponds to an influencing factor weight coefficient, and the influencing factor adjustment item is calculated by the score of each influencing factor and the corresponding influencing factor weight coefficient.

[0073] The node sensitivity weight calculation method based on knowledge graph first needs to obtain the complete knowledge graph data, including node information, edge relationship information, etc. For each node, its importance is evaluated by analyzing its structural features in the graph.

[0074] First, calculate the node centrality. For each node in the knowledge graph, count its out-degree value and in-degree value. The out-degree value indicates the number of edges connected to the node, and the in-degree value indicates the number of edges pointing to the node. For example, if a node has 5 out-edges and 3 in-edges, its out-degree value is 5 and its in-degree value is 3. Degree centrality is calculated based on out-degree and in-degree values. The degree centrality of a node is the sum of its out-degree value and in-degree value divided by the number of all possible edges in the graph.

[0075] Next, calculate the closeness centrality of the node. Use the breadth-first search algorithm to calculate the shortest path length from the target node to all other nodes. For example, if the average shortest path length from node A to other nodes is 2.5, then its closeness centrality is the inverse of the average value.

[0076] Then calculate the betweenness centrality of the node. Count the shortest paths between all node pairs and calculate the ratio of the number of shortest paths passing through the target node to the total number of shortest paths. Assuming there are 100 shortest paths in the knowledge graph, 30 of which pass through node B, then the betweenness centrality of node B is 0.3.

[0077] The three calculated centrality indicators are multiplied by the preset weight coefficients and summed to obtain the initial influence value of the node. The sum of the preset three weight coefficients is 1, for example, they can be set to 0.4, 0.3, and 0.3. If the degree centrality of a node is 0.6, the closeness centrality is 0.4, and the betweenness centrality is 0.5, then its initial influence value is 0.6×0.4 + 0.4×0.3 +0.5×0.3 = 0.51.

[0078] The influence propagation model is used to iteratively calculate the initial influence value. In each iteration, the influence of the node is propagated to the adjacent nodes through the edge relationship until the influence value of each node tends to be stable. For example, after 10 iterations, the influence value of a node changes from 0.51 to 0.48.

[0079] The structural importance of the node is calculated based on the current influence value. The current influence value of the node is normalized, and then the average strength score of the edges associated with the node is multiplied by the preset weight coefficients (such as 0.6 and 0.4) and summed. For example, if the normalized influence value of a node is 0.75 and the average strength score of the associated edges is 0.8, its structural importance is 0.75×0.6 + 0.8×0.4 = 0.77.

[0080] Finally, the influencing factor adjustment item is introduced, which includes multiple preset influencing factors, such as data timeliness, data reliability, etc. Each influencing factor has a corresponding score and weight coefficient. The weighted sum of the score and weight coefficient of each influencing factor is used as the adjustment item, and multiplied by the structural importance of the node to obtain the final sensitivity weight.

[0081] This application can achieve:

[0082] This method comprehensively considers the structural characteristics of nodes and the relationship strength of edges, and can more accurately evaluate the importance and sensitivity of nodes in the knowledge graph.

[0083] By introducing a variety of centrality indicators and influence propagation models, the status of nodes in the local and global network structure is fully considered, making the calculation of node importance more comprehensive and reasonable.

[0084] By adopting the influencing factor adjustment mechanism, various parameters can be flexibly adjusted according to the actual application scenarios, which improves the adaptability and scalability of the method and makes the calculation results more in line with actual needs.

[0085] In an optional implementation, grading the nodes in the knowledge graph according to the sensitivity weights of the nodes, dividing the nodes into different sensitive data levels based on a preset sensitivity level threshold, and marking the sensitive data level of each node in the knowledge graph includes:

[0086] Establish a sensitivity grading system for nodes in the knowledge graph, the sensitivity grading system includes a core sensitivity level, a highly sensitive level, a medium sensitivity level and a general sensitivity level sorted from high to low, and set a core sensitivity level threshold, a highly sensitive level threshold and a medium sensitivity level threshold, the core sensitivity level threshold is greater than the highly sensitive level threshold, and the highly sensitive level threshold is greater than the medium sensitivity level threshold;

[0087] Calculate the normalized sensitivity weight of the node in the knowledge graph, by subtracting the minimum sensitivity weight of all nodes in the knowledge graph from the sensitivity weight of the node, and then dividing it by the difference between the maximum and minimum sensitivity weights of all nodes in the knowledge graph, to obtain the normalized sensitivity weight of the node; compare the normalized sensitivity weight of the node with the core sensitivity level threshold, the high sensitivity level threshold and the medium sensitivity level threshold, and classify the node as the core sensitivity level when the normalized sensitivity weight is greater than or equal to the core sensitivity level threshold, classify the node as the high sensitivity level when the normalized sensitivity weight is greater than or equal to the high sensitivity level threshold and less than the core sensitivity level threshold, classify the node as the medium sensitivity level when the normalized sensitivity weight is greater than or equal to the medium sensitivity level threshold and less than the high sensitivity level threshold, and classify the node as the general sensitivity level when the normalized sensitivity weight is less than the medium sensitivity level threshold;

[0088] Calculate the intra-class cohesion of nodes in each sensitivity level and the inter-class separation between adjacent sensitivity levels, the intra-class cohesion is obtained by calculating the average value of the difference between the normalized sensitivity weights of nodes in the same sensitivity level and the average value of the normalized sensitivity weights of all nodes in the sensitivity level, and the inter-class separation is obtained by calculating the absolute value of the difference between the average values ​​of the normalized sensitivity weights of nodes in two adjacent sensitivity levels; optimize the core sensitivity level threshold, the highly sensitive level threshold and the moderate sensitivity level threshold based on the ratio of the intra-class cohesion to the inter-class separation; calculate the sensitivity level labeling vector of the node, the sensitivity level labeling vector contains the probability distribution of the node belonging to each sensitivity level, and add a sensitivity level label to the node in the knowledge graph.

[0089] This embodiment provides a sensitive data classification method based on knowledge graph. The method first establishes a sensitivity classification system for nodes in the knowledge graph, then calculates the normalized sensitivity weight of the node, and divides the node into different sensitive data levels according to a preset threshold. Finally, by optimizing the threshold and calculating the sensitivity level label vector, accurate classification of nodes in the knowledge graph is achieved.

[0090] First, a sensitivity grading system for nodes in the knowledge graph is established. The grading system includes four levels, from high to low, namely core sensitivity level, highly sensitive level, moderate sensitivity level and general sensitivity level. At the same time, three thresholds are set: core sensitivity level threshold, highly sensitive level threshold and moderate sensitivity level threshold. The size relationship of these thresholds is: core sensitivity level threshold>highly sensitive level threshold>moderate sensitivity level threshold.

[0091] For example, the core sensitivity level threshold can be initially set to 0.8, the highly sensitive level threshold to 0.6, and the medium sensitive level threshold to 0.4. These initial thresholds can be adjusted according to specific application scenarios.

[0092] Next, calculate the normalized sensitivity weights of the nodes in the knowledge graph. First, get the sensitivity weights of all nodes in the knowledge graph. Suppose there is a knowledge graph with 10 nodes, where the sensitivity weights of the nodes are 5, 8, 12, 15, 20, 25, 30, 35, 40, and 45 respectively.

[0093] To calculate the normalized sensitivity weights, we need to find the minimum and maximum sensitivity weights among all nodes. In this example, the minimum is 5 and the maximum is 45. Then, the sensitivity weights of each node are normalized.

[0094] Taking a node with a sensitivity weight of 25 as an example, the calculation process of its normalized sensitivity weight is as follows:

[0095] 1. Subtract the minimum value from the sensitivity weight of the node: 25 - 5 = 20;

[0096] 2. Calculate the difference between the maximum and minimum values: 45 - 5 = 40;

[0097] 3. Divide the result of the first step by the result of the second step: 20 / 40 = 0.5;

[0098] Therefore, the normalized sensitivity weight of this node is 0.5.

[0099] Repeat this process for all nodes in the knowledge graph to obtain the normalized sensitivity weight of each node.

[0100] Then, the normalized sensitivity weight of each node is compared with the preset sensitivity level threshold to determine the sensitive data level to which it belongs. The specific rules are as follows:

[0101] - If the normalized sensitivity weight ≥ the core sensitivity level threshold, the node is classified as core sensitivity level;

[0102] - If the high sensitivity level threshold ≤ normalized sensitivity weight < core sensitivity level threshold, the node is classified as a high sensitivity level;

[0103] - If the medium sensitivity level threshold ≤ normalized sensitivity weight < high sensitivity level threshold, the node is classified as medium sensitivity level;

[0104] - If the normalized sensitivity weight is less than the medium sensitivity level threshold, the node is classified as a normal sensitivity level;

[0105] Continuing with the above example, assuming that the normalized sensitivity weight of a node is 0.5, the node will be classified as medium sensitive according to the preset thresholds (core sensitivity threshold is 0.8, high sensitivity threshold is 0.6, medium sensitivity threshold is 0.4).

[0106] In order to further optimize the classification results, it is necessary to calculate the intra-class cohesion of nodes in each sensitivity level and the inter-class separation between adjacent sensitivity levels.

[0107] The calculation process of class cohesion is as follows:

[0108] 1. Calculate the average of the normalized sensitivity weights of all nodes in the same sensitivity level;

[0109] 2. Calculate the difference between the normalized sensitivity weight of each node in the sensitivity level and the average value;

[0110] 3. Calculate the average of these differences, which is the class cohesion;

[0111] The calculation process of the inter-class separation is as follows:

[0112] 1. Calculate the average value of the normalized sensitivity weights of nodes in two adjacent sensitivity levels;

[0113] 2. Calculate the absolute value of the difference between the two means, which is the degree of separation between classes;

[0114] For example, suppose the medium sensitivity level contains 3 nodes with normalized sensitivity weights of 0.45, 0.50, and 0.55. First, calculate the average: (0.45 + 0.50 + 0.55) / 3 = 0.50. Then calculate the difference between each node and the average: |0.45 - 0.50| = 0.05, |0.50 - 0.50| = 0, |0.55 - 0.50| = 0.05. Finally, calculate the average of these differences: (0.05 + 0 + 0.05) / 3 ≈ 0.033. Therefore, the class cohesion of the medium sensitivity level is 0.033.

[0115] For the inter-class separation, assume that the average normalized sensitivity weight of nodes in the highly sensitive level is 0.70, and the average value of the moderately sensitive level is 0.50. Then the inter-class separation between these two levels is: |0.70 - 0.50| = 0.20.

[0116] Based on the ratio of intra-class cohesion to inter-class separation, the core sensitivity level threshold, high sensitivity level threshold, and medium sensitivity level threshold can be optimized. The goal of optimization is to make the intra-class cohesion as small as possible and the inter-class separation as large as possible. By adjusting the threshold, the intra-class cohesion and inter-class separation can be repeatedly calculated until the optimal threshold combination is found.

[0117] Finally, the sensitivity level label vector of each node is calculated. This vector contains the probability distribution of the node belonging to each sensitivity level. For example, for a node with a normalized sensitivity weight of 0.55, its sensitivity level label vector may be [0.05, 0.15, 0.70, 0.10], indicating that the probability of the node belonging to the core sensitivity level is 5%, the probability of belonging to the highly sensitive level is 15%, the probability of belonging to the moderate sensitivity level is 70%, and the probability of belonging to the general sensitivity level is 10%.

[0118] The calculated sensitivity level labeling vector is added to the corresponding node in the knowledge graph to complete the sensitive data classification labeling of the nodes in the knowledge graph.

[0119] This application can achieve:

[0120] This method achieves accurate classification of nodes in the knowledge graph by establishing a sensitivity classification system and calculating normalized sensitivity weights, effectively identifying and protecting sensitive data of different levels.

[0121] By calculating the intra-class cohesion and inter-class separation and optimizing the sensitivity level threshold based on these indicators, the accuracy and reliability of the classification results are improved, making the boundaries between different sensitivity levels clearer.

[0122] The introduction of the sensitivity level marking vector not only gives the final sensitivity level of the node, but also provides the probability distribution of the node belonging to each sensitivity level, providing a more flexible and sophisticated basis for subsequent data protection and access control strategies.

[0123] In an optional implementation, all nodes directly or indirectly associated with a target node are identified based on a graph traversal algorithm, the sensitive data level of the target node is propagated to associated nodes, and a data protection scheme no lower than the sensitive data level of the target node is adopted for hierarchical protection of the associated nodes, including:

[0124] Obtain the sensitive data level of the target node in the knowledge graph, traverse the knowledge graph based on the breadth-first traversal strategy, use a queue to record the nodes to be visited, add the target node as the initial node to the queue, and establish a set of visited nodes; calculate the shortest path length from the target node to the currently traversed node, and when the shortest path length is less than or equal to the preset maximum traversal depth threshold, mark the currently traversed node as an associated node;

[0125] Calculating the association strength between the target node and the associated node, the association strength is obtained by dividing the weight of the edge between the target node and the associated node by the square root of the product of the out-degree value of the target node and the in-degree value of the associated node, and then multiplying the result by a negative exponential distance decay factor, wherein the negative exponential distance decay factor is calculated by a preset decay coefficient and the shortest path length;

[0126] Calculating a propagation weight of the sensitivity level based on the association strength, wherein the propagation weight is obtained by multiplying a distance decay function by an association strength adjustment function, wherein the distance decay function adopts a negative exponential form, and the association strength adjustment function adopts a Sigmoid function; selecting a path with the largest propagation weight product as a sensitivity level propagation path among multiple paths from the target node to the associated node, and multiplying the propagation weight product on the propagation path by the sensitive data level of the target node to obtain a propagation sensitivity level of the associated node;

[0127] Compare the original sensitivity level and the propagation sensitivity level of the associated node, and select the higher level of the two as the protection level of the associated node; calculate the protection strength of the associated node based on the protection level and the node importance factor, and the node importance factor is weighted by a preset protection level weight coefficient; calculate the impact range of the propagation of the target node sensitivity level, which is obtained by dividing the difference between the protection level of the associated node and the original sensitivity level by the cumulative sum of the shortest path lengths, adaptively adjust the preset protection threshold based on the impact range, and implement hierarchical protection for the associated node according to the adjusted protection threshold.

[0128] The specific implementation process of identifying associated nodes in the knowledge graph and performing sensitive data level propagation is as follows:

[0129] First, obtain the sensitive data level information of the target node in the knowledge graph. Taking a certain enterprise knowledge graph as an example, the target node is a core technology information node, and its sensitive data level is 9 (assuming the sensitivity level range is 0-10). Use the breadth-first strategy to traverse the knowledge graph, and use a queue to store the nodes to be visited. Add the target node as the initial node to the queue, and create a set of visited nodes for deduplication. During the traversal process, the nodes connected to the target node are visited in turn through the first-in-first-out feature of the queue.

[0130] For the node currently being traversed, calculate the shortest path length between it and the target node. Assuming that the preset maximum traversal depth threshold is 3, when the shortest path length is less than or equal to 3, mark the current node as an associated node. For example, if the shortest path length between a node and the target node is 2, which is less than the threshold 3, it will be marked as an associated node.

[0131] Next, calculate the association strength between the target node and the associated node. Take the target node and an associated node as an example, assuming that the weight of the edge between them is 0.8, the out-degree value of the target node is 5, the in-degree value of the associated node is 3, the preset attenuation coefficient is 0.5, and the shortest path length is 2. The association strength is 0.6 through calculation.

[0132] The propagation weight of the sensitive level is calculated based on the above association strength. The propagation weight is obtained by multiplying the distance decay function in the form of a negative exponential with the association strength adjustment function in the form of a Sigmoid. When there are multiple propagation paths, the path with the largest propagation weight product is selected as the sensitive level propagation path. Assuming that the propagation weight product of the optimal propagation path is 0.7 and the target node sensitivity level is 9, the propagation sensitivity level of the associated node is 6.3.

[0133] Compare the original sensitivity level of the associated node (assuming it is 5) with the propagation sensitivity level (6.3), and take the higher value 6.3 as the protection level of the associated node. Calculate the protection strength by combining the node importance factor. Assuming the protection level weight coefficient is 1.2, the protection strength of the associated node is 7.56.

[0134] Finally, the impact range of the target node sensitivity level propagation is calculated. Assuming that the sum of the difference between the protection level of all associated nodes and the original sensitivity level is 15, and the cumulative sum of the shortest path length is 8, the impact range is 1.875. Based on the impact range, the preset protection threshold is dynamically adjusted, and then the corresponding level of protection measures are implemented for the associated nodes.

[0135] This application can achieve:

[0136] Part 1: Through breadth-first traversal and shortest path analysis, nodes that are directly or indirectly associated with the target node are accurately identified to avoid missing important associations. At the same time, by limiting the maximum traversal depth threshold, resources are prevented from being wasted due to an excessively large scope of association analysis.

[0137] Part 2: The calculation method of association strength and propagation weight is adopted, and multiple influencing factors such as edge weights between nodes, node degree values, and path distance are considered to achieve accurate propagation of sensitivity levels, so that the nodes farther away from the target node and the weaker the association obtain lower propagation sensitivity levels.

[0138] Part 3: Through the mechanism of dynamically adjusting the protection threshold and combining the node importance factor, adaptive hierarchical protection of associated nodes is achieved, which not only ensures data security but also avoids excessive protection measures, achieving the effect of matching protection intensity with actual needs.

[0139] In an optional implementation, for nodes with different sensitive data levels in the knowledge graph, a data protection scheme of the corresponding level is obtained from a preset hierarchical protection strategy library, and the data protection scheme includes a data storage encryption scheme, a data access control scheme, and a data transmission protection scheme including:

[0140] Construct a mapping matrix between sensitivity level and protection dimension, where the protection dimension includes data storage encryption dimension, data access control dimension and data transmission protection dimension, calculate the dimension weight coefficient and risk adjustment coefficient of each protection dimension, and calculate the policy strength of different sensitivity levels in each protection dimension by combining the basic protection level and level risk factor;

[0141] Select a data storage encryption scheme based on the strength of the strategy, evaluate the strength of the encryption algorithm by setting the evaluation index weight, and set the key update cycle according to the sensitivity level, and the key update cycle is determined by the negative exponential function relationship between the basic update cycle and the sensitivity level; construct an access permission matrix for users and resources, and calculate the credibility score of users accessing resources based on multi-dimensional trust factors, and the credibility score is obtained by the weighted average of the trust factor scores of each dimension;

[0142] Conduct security assessment on data transmission channels, assign weight coefficients to the encryption strength, authentication strength, and integrity protection strength of the transmission channels, and calculate the security strength of the transmission channels; optimize data transmission routes based on link security levels and link reliability, and determine the route security score by calculating the product of the lowest security level in the transmission path and the link reliability;

[0143] Set the evaluation dimensions of the protection plan, assign evaluation weights to different dimensions, and calculate the comprehensive protection strength through the weighted average of the protection metrics of each dimension; determine the strategy adjustment step based on the difference between the target protection level and the current protection level, and perform adaptive optimization and adjustment on the protection plan; obtain the data protection plan from the preset hierarchical protection strategy library, and apply the data protection plan to the nodes of the corresponding sensitivity level in the knowledge graph.

[0144] For the protection of sensitive data in the knowledge graph, we first build a mapping relationship between sensitivity levels and protection dimensions. Sensitive data is divided into four levels: general, confidential, confidential, and top secret. The protection dimensions include data storage encryption, access control, and transmission protection.

[0145] In terms of data storage encryption, different encryption schemes of different strengths are used for different levels of data. Ordinary data can use lightweight encryption algorithms, confidentiality data can use standard encryption algorithms, secret level data can use enhanced encryption algorithms, and top secret data can use double encryption schemes. The key update cycle shortens as the sensitivity level increases. Ordinary data can be updated every 90 days, secret level data can be updated every 60 days, secret level data can be updated every 30 days, and top secret data can be updated every 15 days.

[0146] In the access control dimension, a corresponding relationship between user and resource access rights is established. The credibility score is calculated by analyzing multiple dimensions such as the user's identity authentication strength, historical behavior reputation, and environmental safety. For example, when a user accesses ordinary-level data, the credibility threshold is set to 0.6, the confidentiality level is set to 0.75, the confidential level is set to 0.85, and the top secret level is set to 0.95. Access is allowed only when the user's credibility score exceeds the corresponding level threshold.

[0147] In the dimension of transmission protection, the data transmission channel is evaluated for security. The evaluation indicators include encryption strength, authentication mechanism and integrity verification. The channel security strength for ordinary data transmission is required to be no less than 0.7, the confidentiality level is no less than 0.8, the secret level is no less than 0.9, and the top secret level is required to be above 0.95. When selecting a route, the link security level and reliability are comprehensively considered, and the transmission path with the highest security score is selected.

[0148] The protection scheme is evaluated and optimized regularly. The evaluation dimensions include encryption strength, access control strictness, transmission security, etc. When the actual protection strength is lower than the target level, it is optimized by adjusting the encryption algorithm, increasing the access control threshold, optimizing the transmission route, etc. until the expected protection strength is reached.

[0149] This application can achieve:

[0150] Part 1: By establishing a mapping relationship between sensitivity levels and protection dimensions, differentiated protection of data at different levels is achieved, avoiding over-protection or under-protection, and improving the accuracy of data protection and resource utilization efficiency.

[0151] Part 2: A multi-dimensional protection solution evaluation mechanism is adopted to comprehensively measure the effectiveness of data protection and promptly identify weak links in protection. Through adaptive optimization, it ensures that security needs are continuously met, thereby improving the reliability and adaptability of the protection solution.

[0152] Part 3: Dynamically adjust the key update cycle and access control strategy based on the data sensitivity level, taking into account the system operation efficiency while ensuring security, achieving a balance between security and efficiency, and improving the practicality of the overall system.

[0153] Figure 2 FIG. 1 is a schematic diagram of the structure of a sensitive data identification and protection system based on intelligent matching according to an embodiment of the present invention. Figure 2 As shown, the system comprises:

[0154] The first unit is used to obtain sensitive data from a target data source, and perform semantic analysis on the sensitive data using a natural language processing model to extract entity information, attribute information, and relationship information from the sensitive data; construct the entity information as nodes of a knowledge graph, use the attribute information as an attribute identifier of the node, and construct the relationship information as edges between nodes in the knowledge graph to generate a knowledge graph containing multi-level sensitive data association relationships; wherein the nodes of the knowledge graph are encoded with feature vectors through a graph neural network, and the edges are calculated for relationship strength through an attention mechanism;

[0155] The second unit is used to calculate the sensitivity weight of each node based on the out-degree, in-degree and edge relationship strength of the nodes in the knowledge graph using a graph structure importance evaluation algorithm, wherein the graph structure importance evaluation algorithm includes node centrality calculation and node influence propagation calculation; classify the nodes in the knowledge graph according to the sensitivity weight of the nodes, divide the nodes into different sensitive data levels based on a preset sensitivity level threshold, and mark the sensitive data level of each node in the knowledge graph;

[0156] The third unit is used to obtain data protection schemes of corresponding levels from a preset hierarchical protection strategy library for nodes with different sensitive data levels in the knowledge graph, wherein the data protection schemes include data storage encryption schemes, data access control schemes, and data transmission protection schemes; identify all nodes that are directly or indirectly associated with the target node based on a graph traversal algorithm, propagate the sensitive data level of the target node to associated nodes, and perform hierarchical protection on the associated nodes using a data protection scheme that is not lower than the sensitive data level of the target node.

[0157] According to a third aspect of the embodiments of the present invention,

[0158] An electronic device is provided, comprising:

[0159] processor;

[0160] a memory for storing processor-executable instructions;

[0161] The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0162] According to a fourth aspect of the embodiments of the present invention,

[0163] A computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the aforementioned method is implemented.

[0164] The present invention may be a method, an apparatus, a system and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for executing various aspects of the present invention.

[0165] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A sensitive data identification and protection method based on intelligent matching, characterized in that: include: Acquire sensitive data from the target data source, and use a natural language processing model to perform semantic analysis on the sensitive data to extract entity information, attribute information, and relationship information from the sensitive data; The entity information is constructed as a node of a knowledge graph, the attribute information is used as an attribute identifier of the node, and the relationship information is constructed as an edge between nodes in the knowledge graph, so as to generate a knowledge graph containing multi-level sensitive data association relationships; wherein the nodes of the knowledge graph are encoded with feature vectors through a graph neural network, and the edges are calculated for relationship strength through an attention mechanism; Based on the out-degree, in-degree and edge relationship strength of the nodes in the knowledge graph, a graph structure importance evaluation algorithm is used to calculate the sensitivity weight of each node, and the graph structure importance evaluation algorithm includes node centrality calculation and node influence propagation calculation; the nodes in the knowledge graph are graded according to the sensitivity weights of the nodes, the nodes are divided into different sensitive data levels based on a preset sensitivity level threshold, and the sensitive data level of each node is marked in the knowledge graph; For nodes with different sensitive data levels in the knowledge graph, data protection schemes of corresponding levels are obtained from a preset hierarchical protection strategy library, and the data protection schemes include data storage encryption schemes, data access control schemes, and data transmission protection schemes; based on a graph traversal algorithm, all nodes that are directly or indirectly associated with the target node are identified, the sensitive data level of the target node is propagated to the associated nodes, and the associated nodes are hierarchically protected with a data protection scheme that is not lower than the sensitive data level of the target node.

2. The method according to claim 1, characterized in that The entity information is constructed as a node of a knowledge graph, the attribute information is used as an attribute identifier of the node, and the relationship information is constructed as an edge between nodes in the knowledge graph. Generating a knowledge graph containing multi-level sensitive data association relationships includes: Receive the preprocessed sensitive data, and extract entity information from the sensitive data using named entity recognition technology, construct a unique identifier for each entity information, and map the entity information to a node in a knowledge graph; convert the attribute information of the node into an attribute feature vector based on a word embedding model, and associate the attribute feature vector with the entity information of the node; calculate the attribute sensitivity of the attribute feature vector using a predefined sensitivity evaluation rule, and use the attribute sensitivity as the attribute identifier of the node; Based on semantic similarity calculation and node interaction frequency analysis, a relationship edge between nodes in the knowledge graph is established, and the relationship strength of the relationship edge is calculated by dividing the product of the semantic similarity and the interaction frequency between the nodes by the square root of the path distance between the nodes; the relationship edge between the nodes is divided into direct relationship edge, indirect relationship edge and derived relationship edge, wherein the direct relationship edge indicates that there is a direct data association between the nodes, the indirect relationship edge indicates a transitive relationship between the nodes established through an intermediate node, and the derived relationship edge indicates a potential relationship derived based on rule reasoning; Construct a multi-level association structure of the knowledge graph, the multi-level association structure includes a direct association layer, an indirect association layer and an extended association layer, calculate the propagation strength between different levels, the propagation strength is calculated by the power of the level attenuation factor and the product of the relationship strength of each relationship edge on the path; wherein the level attenuation factor has a value range greater than zero and less than one, and the propagation strength decays with the increase of the association level; based on the propagation strength, weights are assigned to the nodes in the knowledge graph to generate a knowledge graph with multi-level sensitive data association relationships.

3. The method according to claim 1, characterized in that: Based on the out-degree, in-degree and edge relationship strength of the nodes in the knowledge graph, the sensitivity weight of each node is calculated using a graph structure importance evaluation algorithm. The graph structure importance evaluation algorithm includes node centrality calculation and node influence propagation calculation, including: Calculate the out-degree value and in-degree value of each node in the knowledge graph, wherein the out-degree value is obtained by calculating the number of edges connected to the node, and the in-degree value is obtained by calculating the number of edges pointing to the node; calculate the degree centrality of the node based on the out-degree value and in-degree value of the node, calculate the closeness centrality of the node based on the shortest path length between the node and other nodes, and calculate the betweenness centrality of the node based on the ratio of the number of shortest paths passing through the node to the total number of shortest paths between node pairs in the knowledge graph; The degree centrality, closeness centrality, and betweenness centrality of the node are multiplied by the preset first weight coefficient, second weight coefficient, and third weight coefficient respectively, and the sum is calculated to obtain the initial influence value of the node, where the sum of the first weight coefficient, the second weight coefficient, and the third weight coefficient is one; the initial influence value of the node is iteratively calculated based on the influence propagation model to obtain the current influence value of the node; The structural importance of the node is calculated based on the current influence value of the node, and the structural importance is obtained by multiplying the normalized current influence value of the node and the strength score of the node-associated edge with the preset fourth weight coefficient and fifth weight coefficient respectively, and summing them up; the product of the structural importance of the node and the influencing factor adjustment item is used as the sensitivity weight of the node, and the influencing factor adjustment item includes multiple preset influencing factors, each of which corresponds to an influencing factor weight coefficient, and the influencing factor adjustment item is calculated by the score of each influencing factor and the corresponding influencing factor weight coefficient.

4. The method according to claim 1, characterized in that Grading the nodes in the knowledge graph according to the sensitivity weights of the nodes, dividing the nodes into different sensitive data levels based on a preset sensitivity level threshold, and marking the sensitive data level of each node in the knowledge graph includes: Establish a sensitivity grading system for nodes in the knowledge graph, the sensitivity grading system includes a core sensitivity level, a highly sensitive level, a medium sensitivity level and a general sensitivity level sorted from high to low, and set a core sensitivity level threshold, a highly sensitive level threshold and a medium sensitivity level threshold, the core sensitivity level threshold is greater than the highly sensitive level threshold, and the highly sensitive level threshold is greater than the medium sensitivity level threshold; Calculate the normalized sensitivity weight of the node in the knowledge graph, by subtracting the minimum sensitivity weight of all nodes in the knowledge graph from the sensitivity weight of the node, and then dividing it by the difference between the maximum and minimum sensitivity weights of all nodes in the knowledge graph, to obtain the normalized sensitivity weight of the node; compare the normalized sensitivity weight of the node with the core sensitivity level threshold, the high sensitivity level threshold and the medium sensitivity level threshold, and classify the node as the core sensitivity level when the normalized sensitivity weight is greater than or equal to the core sensitivity level threshold, classify the node as the high sensitivity level when the normalized sensitivity weight is greater than or equal to the high sensitivity level threshold and less than the core sensitivity level threshold, classify the node as the medium sensitivity level when the normalized sensitivity weight is greater than or equal to the medium sensitivity level threshold and less than the high sensitivity level threshold, and classify the node as the general sensitivity level when the normalized sensitivity weight is less than the medium sensitivity level threshold; Calculate the intra-class cohesion of nodes in each sensitivity level and the inter-class separation between adjacent sensitivity levels, the intra-class cohesion is obtained by calculating the average value of the difference between the normalized sensitivity weights of nodes in the same sensitivity level and the average value of the normalized sensitivity weights of all nodes in the sensitivity level, and the inter-class separation is obtained by calculating the absolute value of the difference between the average values ​​of the normalized sensitivity weights of nodes in two adjacent sensitivity levels; optimize the core sensitivity level threshold, the highly sensitive level threshold and the moderate sensitivity level threshold based on the ratio of the intra-class cohesion to the inter-class separation; calculate the sensitivity level labeling vector of the node, the sensitivity level labeling vector contains the probability distribution of the node belonging to each sensitivity level, and add a sensitivity level label to the node in the knowledge graph.

5. The method according to claim 1, characterized in that Based on the graph traversal algorithm, all nodes that are directly or indirectly associated with the target node are identified, the sensitive data level of the target node is propagated to the associated nodes, and the associated nodes are protected by a data protection scheme that is not lower than the sensitive data level of the target node, including: Obtain the sensitive data level of the target node in the knowledge graph, traverse the knowledge graph based on the breadth-first traversal strategy, use a queue to record the nodes to be visited, add the target node as the initial node to the queue, and establish a set of visited nodes; calculate the shortest path length from the target node to the currently traversed node, and when the shortest path length is less than or equal to the preset maximum traversal depth threshold, mark the currently traversed node as an associated node; Calculating the association strength between the target node and the associated node, the association strength is obtained by dividing the weight of the edge between the target node and the associated node by the square root of the product of the out-degree value of the target node and the in-degree value of the associated node, and then multiplying the result by a negative exponential distance decay factor, wherein the negative exponential distance decay factor is calculated by a preset decay coefficient and the shortest path length; Calculating a propagation weight of the sensitivity level based on the association strength, wherein the propagation weight is obtained by multiplying a distance decay function by an association strength adjustment function, wherein the distance decay function adopts a negative exponential form, and the association strength adjustment function adopts a Sigmoid function; selecting a path with the largest propagation weight product as a sensitivity level propagation path among multiple paths from the target node to the associated node, and multiplying the propagation weight product on the propagation path by the sensitive data level of the target node to obtain a propagation sensitivity level of the associated node; Compare the original sensitivity level and the propagation sensitivity level of the associated node, and select the higher level of the two as the protection level of the associated node; calculate the protection strength of the associated node based on the protection level and the node importance factor, and the node importance factor is weighted by a preset protection level weight coefficient; calculate the impact range of the propagation of the target node sensitivity level, which is obtained by dividing the difference between the protection level of the associated node and the original sensitivity level by the cumulative sum of the shortest path lengths, adaptively adjust the preset protection threshold based on the impact range, and implement hierarchical protection for the associated node according to the adjusted protection threshold.

6. The method according to claim 1, characterized in that For nodes with different sensitive data levels in the knowledge graph, data protection schemes of corresponding levels are obtained from a preset hierarchical protection strategy library. The data protection schemes include data storage encryption schemes, data access control schemes, and data transmission protection schemes, including: Construct a mapping matrix between sensitivity level and protection dimension, where the protection dimension includes data storage encryption dimension, data access control dimension and data transmission protection dimension, calculate the dimension weight coefficient and risk adjustment coefficient of each protection dimension, and calculate the policy strength of different sensitivity levels in each protection dimension by combining the basic protection level and level risk factor; Select a data storage encryption scheme based on the strength of the strategy, evaluate the strength of the encryption algorithm by setting the evaluation index weight, and set the key update cycle according to the sensitivity level, and the key update cycle is determined by the negative exponential function relationship between the basic update cycle and the sensitivity level; construct an access permission matrix for users and resources, and calculate the credibility score of users accessing resources based on multi-dimensional trust factors, and the credibility score is obtained by the weighted average of the trust factor scores of each dimension; Conduct security assessment on data transmission channels, assign weight coefficients to the encryption strength, authentication strength, and integrity protection strength of the transmission channels, and calculate the security strength of the transmission channels; optimize data transmission routes based on link security levels and link reliability, and determine the route security score by calculating the product of the lowest security level in the transmission path and the link reliability; Set the evaluation dimensions of the protection plan, assign evaluation weights to different dimensions, and calculate the comprehensive protection strength through the weighted average of the protection metrics of each dimension; determine the strategy adjustment step based on the difference between the target protection level and the current protection level, and perform adaptive optimization and adjustment on the protection plan; obtain the data protection plan from the preset hierarchical protection strategy library, and apply the data protection plan to the nodes of the corresponding sensitivity level in the knowledge graph.

7. A sensitive data identification and protection system based on intelligent matching, used to implement the method according to any one of claims 1 to 6, characterized in that: include: The first unit is used to obtain sensitive data in the target data source, and perform semantic analysis on the sensitive data using a natural language processing model to extract entity information, attribute information and relationship information in the sensitive data; The entity information is constructed as a node of a knowledge graph, the attribute information is used as an attribute identifier of the node, and the relationship information is constructed as an edge between nodes in the knowledge graph, so as to generate a knowledge graph containing multi-level sensitive data association relationships; wherein the nodes of the knowledge graph are encoded with feature vectors through a graph neural network, and the edges are calculated for relationship strength through an attention mechanism; The second unit is used to calculate the sensitivity weight of each node based on the out-degree, in-degree and edge relationship strength of the nodes in the knowledge graph using a graph structure importance evaluation algorithm, wherein the graph structure importance evaluation algorithm includes node centrality calculation and node influence propagation calculation; classify the nodes in the knowledge graph according to the sensitivity weight of the nodes, divide the nodes into different sensitive data levels based on a preset sensitivity level threshold, and mark the sensitive data level of each node in the knowledge graph; The third unit is used to obtain data protection schemes of corresponding levels from a preset hierarchical protection strategy library for nodes with different sensitive data levels in the knowledge graph, wherein the data protection schemes include data storage encryption schemes, data access control schemes, and data transmission protection schemes; identify all nodes that are directly or indirectly associated with the target node based on a graph traversal algorithm, propagate the sensitive data level of the target node to associated nodes, and perform hierarchical protection on the associated nodes using a data protection scheme that is not lower than the sensitive data level of the target node.

8. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images