Network target intelligent analysis system based on OAR data desensitization system and modeling

Abstract

The invention discloses a network target intelligent analysis system based on an OAR data desensitization system and modeling. The network target intelligent analysis system comprises a desensitization data modeling analysis module and an OAR data desensitization system analysis module. According to the system, through the desensitization data modeling analysis module, on the basis of data desensitization processing, relevance and potential laws between data are deeply mined, the structure and characteristics of a target network are more accurately described, the reliability of an analysis result is enhanced, the accuracy of target network discovery is improved, the risk of misinformation and missing report is reduced, and the system is suitable for popularization and application. And the method has high flexibility and expandability. According to the system, through the OAR data desensitization system analysis module, the desensitization degree and accuracy of the desensitization data generated in the desensitization processing process can be verified, whether the data can accurately reflect the core characteristics and value of the original data or not while protecting privacy is verified, the risk of misjudgment and missed judgment is reduced, and the reliability of the system is improved. And the flexibility and efficiency of data processing are enhanced.

Description

Technical Field

[0001] The present invention relates to the technical field of network target analysis, and in particular to a network target intelligent analysis system based on OAR data desensitization system and modeling. Background Art

[0002] Data modeling is a key step in understanding and analyzing data and obtaining network targets. Network targets mainly include target organizations, target individuals, etc. It is mainly used in the field of network target analysis technology to protect privacy while mining key information. It needs to be able to accurately capture the inherent laws and relationships of data, while supporting flexible data query and analysis needs. Desensitized data modeling places higher demands on traditional data modeling technology and data analysis methods. In addition, how to maintain the authenticity and analytical value of data while protecting privacy is the core challenge facing desensitization technology. Therefore, desensitized data modeling for specific targets such as funds, networks, and communications, as well as desensitized data value analysis, are issues that need to be addressed urgently. Summary of the invention

[0003] In view of the deficiencies in the prior art, the present invention aims to provide a network target intelligent analysis system based on OAR data desensitization system and modeling.

[0004] In order to achieve the above object, the present invention adopts the following technical solution:

[0005] A network target intelligent analysis system based on OAR data desensitization system and modeling, including a desensitized data modeling analysis module and an OAR data desensitization system analysis module;

[0006] The desensitized data modeling and analysis module is used to obtain network target analysis results through the capital behavior analysis model, communication behavior model, network behavior model and target identity alignment model;

[0007] The fund behavior analysis model obtains the desensitized fund behavior data and identifies abnormal fund behavior by analyzing the fund behavior data;

[0008] The communication behavior model is used to analyze the desensitized communication behavior data, obtain the user's communication habits and social relationship network by performing feature analysis on the communication behavior data, and discover potential malicious and illegal communication behaviors;

[0009] The network behavior model is used to analyze the user's anonymized network behavior data, identify abnormal network activity patterns, and discover potential key targets or network signs;

[0010] The target identity alignment model is used to achieve accurate matching and alignment of identity information in different data sets of financial behavior data, communication behavior data, and network behavior data, and to identify and associate with specific individuals or entities under the premise of protecting user privacy;

[0011] The OAR data desensitization system analysis module is used to analyze the desensitization degree index and accuracy index of desensitized data through desensitization evaluation and accuracy assessment.

[0012] Furthermore, the indicators of desensitization evaluation include desensitized data restoration degree, desensitized data difference degree and sensitive information retention degree; the desensitized data restoration degree is used to evaluate the possibility and degree of restoring the desensitized data to the original data state under specific conditions, to ensure that the desensitization process will not damage the availability or security of the data due to excessive or insufficient desensitization; the desensitized data difference degree is used to evaluate the degree of change between the data before and after desensitization, to verify whether the desensitization process has effectively changed the sensitive characteristics of the data while keeping the non-sensitive part of the data relatively stable; the sensitive information retention degree is used to evaluate whether all predetermined sensitive information has been effectively eliminated during the desensitization process.

[0013] Furthermore, the accuracy assessment is based on the accuracy assessment of the desensitization process of historical data to verify the consistency of the final result; by selecting representative historical data as a benchmark, the data desensitization process and its subsequent analysis steps are simulated and tested; during the test, the desensitization algorithm or strategy to be evaluated is used to process the historical data, and the desensitized data and its analysis results are compared and verified using the preset evaluation indicators or evaluation models: (1) Verify whether the desensitization process is executed according to the expected rules to ensure that sensitive information is effectively removed or converted, while non-sensitive information remains relatively intact; (2) Evaluate the impact of the desensitization process on the analysis results of the data, that is, by comparing the consistency of the analysis results of the data before and after the desensitization process, determine whether the desensitization operation introduces unnecessary deviations or errors; (3) Use the known key features in the historical data to verify whether the data can still maintain the key features after desensitization to ensure the authenticity and validity of the data.

[0014] Furthermore, the analysis process of the capital behavior analysis model is specifically as follows: the capital behavior data is input into the encoder, the encoder uses the capital behavior data to compose a graph, and generates a capital behavior graph network, the capital behavior graph network includes nodes and directed edges, the nodes represent users, the directed edges represent transactions, and the arrows point from the capital outflow party to the capital recipient party; the capital behavior graph network is sub-graph matched with the capital behavior network sample library, and the capital behavior graph network that is successfully matched in the capital behavior network sample library is the capital behavior feature graph network; the decoder decodes the capital behavior feature graph network to obtain output features; the capital behavior network sample library is obtained through feature engineering and prior knowledge construction, and contains the capital behavior network graph of abnormal capital behavior to be analyzed and discovered.

[0015] Furthermore, the analysis process of the communication behavior model is specifically as follows: extracting the physical communication device information and social site information in the communication behavior data, and parsing the social site information to obtain multi-dimensional social information including social site account basic information, user profile information, content publishing information, interactive behavior information, data analysis information and user status information;

[0016] By collecting data from multiple social sites, mining multiple accounts of the same network target on different social sites, collecting the social site information of these accounts, parsing the social site information, finding the union of the social point information and performing cross-validation, removing dirty data, and obtaining the communication behavior of the same network target on multiple social sites; further, through statistical analysis of the communication time period and communication frequency of both parties of the network target, mining the potential social relationship between the two parties of the communication, obtaining the network target cluster by clustering the network target black samples, and discovering the potential malicious and illegal communication behavior of the two parties of the communication by analyzing the network targets in the same cluster.

[0017] Furthermore, the analysis process of the network behavior analysis model is specifically as follows: dividing the network behavior data into basic information, ports and services, architecture and components, and fingerprint features, recursively tracing the information items of the network behavior data, that is, retrieving new data through the currently acquired data, and recursively retrieving new data again using the new data to maximize the use of information; comparing and analyzing the traceability data to obtain the analysis results of the network behavior data, the analysis results include information about suspected identical website templates and suspected identical developers, and using the network behavior data to recursively trace the target abnormal login location, the query of sensitive information with a surge in frequency, and the information of frequent communications with known malicious IP addresses.

[0018] Furthermore, the basic information includes data on the IP address and time where the network behavior occurs, the port and service includes data on the port number and service type of the network behavior, the architecture and component includes data on the website architecture type and component type, and the fingerprint feature includes data on one or more of the browser fingerprint, device fingerprint, network fingerprint and behavioral fingerprint generated by the network behavior.

[0019] Furthermore, the target identity alignment model obtains a data set of desensitized network behavior data, communication behavior data, and financial behavior data from the Internet. First, the network target data is intersected with the desensitized network behavior data, communication behavior data, and financial behavior data to obtain the network behavior, communication behavior, and financial transaction data of the network target. The network, communication, and financial transaction data of the network target are then merged into one data set, compared with the known network target data, and associated to obtain new network targets, thereby expanding the clues to find the network target.

[0020] Furthermore, the calculation process of the desensitized data restoration degree is as follows:

[0021] Assume O is the original data, A is the desensitized data, and R is the restored data. The desensitized data restoration RDD is expressed as:

[0022]

[0023] Among them, BP is the ex ante penalty function, W i = 1 / i, P i is the N-gram score, N is set to 4; the calculation formula of BP is:

[0024]

[0025] Among them, len is the length calculation function;

[0026] P i The calculation formula is:

[0027]

[0028] Among them, N-gram is a segment of N consecutive characters or words, Counter Clip (N-gram) represents the number of N-grams in the original data O, Σ N-gram∈R Counter Clip (N-gram) represents the number of N-grams of the restored data R that appear in the original data O, Σ N-gram∈R Counter Clip (N-gram) represents the number of N-grams of the restored data R;

[0029] The specific calculation formula for the desensitization data difference degree DDD is as follows:

[0030]

[0031] Among them, D sen is the sensitive information change degree, and D non-sen is the non-sensitive information stability;

[0032] The calculation formula for the sensitive information change degree D sen is as follows:

[0033]

[0034] Among them, H is the information entropy calculation function, H(O) is the information entropy before desensitization, H(A) is the information entropy after desensitization, and n represents the number of data;

[0035] The calculation formula for the non-sensitive information stability D non-sen is as follows:

[0036]

[0037] Among them, O′ and A′ are the characteristics of the original data O and the desensitized data A respectively, MSE is the mean square error calculation formula, and MSE max is the maximum value of the mean square error;

[0038] The calculation formula for the sensitive information retention degree RDS is as follows:

[0039]

[0040] O rem is the total amount of sensitive information retained in the desensitized data, and O sen is the total amount of sensitive information in the original data; The value range of RDS is [0, 1]. RDS = 0 indicates complete desensitization, RDS = 1 indicates no desensitization, and 0 < RDS < 1 indicates that some sensitive information is retained.

[0041] Furthermore, the OAR data desensitization system analysis module selects representative historical data, processes the historical data using the desensitization processing algorithm or strategy to be evaluated, and then calculates the accuracy index according to the following formula:

[0042] Acc = w0RDD + w1DDD + w2RDS + w3K

[0043] Among them, w0, w1, w2, and w3 are weights respectively;

[0044] K is the inspection accuracy rate of the desensitization network target information, and its calculation formula is:

[0045]

[0046] Among them, the larger the K value, the higher the accuracy of desensitized network target information verification;

[0047] R I is the success rate of non-massified network target information verification. Non-massified network target information verification refers to discovering network targets through non-massified data. I Calculate as follows:

[0048]

[0049] R D is the success rate of desensitized network target information verification. Desensitized network target information verification refers to discovering network targets through desensitized data. D Calculate as follows:

[0050]

[0051] Among them, I TN Indicates the number of non-masked data that successfully verifies the network target through non-masked data. FN Indicates the number of desensitized data that failed to verify the network target through non-desensitized data, D TN Indicates the number of desensitized data that are successfully verified through desensitized data. FN Indicates the number of desensitized data that failed to pass the desensitized data verification network target.

[0052] The beneficial effects of the present invention are:

[0053] 1. The system of the present invention uses a desensitized data modeling and analysis module to deeply explore the correlation and potential rules between data on the basis of data desensitization processing, more accurately depict the structure and characteristics of the target network, enhance the reliability of the analysis results, improve the accuracy of target network discovery, reduce the risk of false positives and false negatives, and has high flexibility and scalability. It can continuously optimize model parameters to improve analysis efficiency and ensure that key information can be quickly and accurately identified in massive data.

[0054] 2. The system of the present invention can verify the degree and accuracy of the desensitization data generated by the desensitization processing flow through the OAR data desensitization system analysis module, and verify whether the data can accurately reflect the core characteristics and value of the original data while protecting privacy, thereby reducing the risk of misjudgment and missed judgment and enhancing the flexibility and efficiency of data processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 Schematic diagram of the analysis process of the fund behavior analysis model in an embodiment of the present invention;

[0056] Figure 2Schematic diagram of the analysis process of the communication behavior model in an embodiment of the present invention;

[0057] Figure 3 Schematic diagram of the analysis process of the network behavior model in an embodiment of the present invention;

[0058] Figure 4 Schematic diagram of the analysis process of the target identity alignment model in an embodiment of the present invention;

[0059] Figure 5 Schematic diagram of the principle of the OAR data desensitization system analysis module in an embodiment of the present invention. DETAILED DESCRIPTION

[0060] The present invention will be further described below in conjunction with the accompanying drawings. It should be noted that this embodiment is based on the technical solution and provides a detailed implementation method and specific operation process, but the protection scope of the present invention is not limited to this embodiment.

[0061] This embodiment provides a network target intelligent analysis system based on an OAR data desensitization system and modeling, including a desensitized data modeling analysis module and an OAR data desensitization system analysis module.

[0062] Among them, the desensitized data modeling and analysis module is used to obtain network target analysis results through the capital behavior analysis model, communication behavior model, network behavior model and target identity alignment model.

[0063] Specifically, the fund behavior analysis model obtains desensitized fund behavior data, and identifies abnormal fund behavior by analyzing key information such as transaction time, transaction amount, and transaction object in the fund behavior data, thereby discovering potential fraud, money laundering or other illegal transactions, thereby protecting the property safety of enterprises and users. The fund behavior analysis model uses the desensitized fund behavior data for learning and training to improve the accuracy and robustness of the model.

[0064] The communication behavior model is used to analyze the anonymized communication behavior data. By analyzing the communication frequency, communication object, communication content and other characteristics in the communication behavior data, the user's communication habits and social relationship network are obtained, and potential malicious and illegal communication behaviors are discovered by using statistical analysis and data mining.

[0065] The network behavior model models and analyzes the user's activities on the Internet, and deeply mines the user's desensitized network behavior data to reveal high-value user information, thereby helping to discover network targets, quickly identify abnormal network activity patterns, monitor abnormal target login locations, increased frequency of sensitive information queries, frequent communications with known malicious IP addresses, and other information, and discover potential key targets or network signs.

[0066] The target identity alignment model is used to accurately match and align identity information in different data sets such as financial behavior data, communication behavior data, and network behavior data while protecting user privacy, and plays a key role in scenarios such as target discovery. The target identity alignment model extracts, compares, and matches identity information in desensitized financial behavior data, communication behavior data, and network behavior data to accurately identify and associate specific individuals or entities during data use and analysis. This process ensures the accuracy and consistency of the data and strictly abides by relevant laws and regulations on privacy protection.

[0067] The OAR data desensitization system analysis module is used to analyze the desensitization degree index and accuracy index of desensitized data through desensitization evaluation and accuracy assessment.

[0068] Specifically, Figure 5 As shown, the indicators of desensitization evaluation include desensitized data restoration degree, desensitized data difference degree and sensitive information retention degree. The desensitized data restoration degree quantitatively evaluates the possibility and degree of restoration of desensitized data to the original data state under specific conditions, ensuring that the desensitization process will not damage the availability or security of the data due to excessive or insufficient processing. The desensitized data difference degree analyzes the degree of change between the data before and after desensitization, and verifies whether the desensitization process has effectively changed the sensitive characteristics of the data while keeping the non-sensitive part of the data relatively stable by calculating the difference index; the sensitive information retention degree examines whether all predetermined sensitive information, such as personal identity information, trade secrets, etc., has been effectively eliminated during the desensitization process, ensuring that the desensitized data cannot be used for illegal purposes or leak sensitive information under the premise of legality and compliance.

[0069] The accuracy assessment is specifically based on the accuracy assessment of the desensitization process based on historical data to verify the consistency of the final results. By selecting representative historical data as a benchmark, the data desensitization process and its subsequent analysis steps are simulated and tested. During the test, the desensitization algorithm or strategy to be evaluated is used to process the historical data, and the desensitized data and its analysis results are compared and verified using the preset evaluation indicators or evaluation models. Specifically, the following aspects can be compared and verified: (1) Verify whether the desensitization process is executed according to the expected rules to ensure that sensitive information is effectively removed or converted, while non-sensitive information remains relatively intact; (2) Evaluate the degree of influence of the desensitization process on the analysis results of the data, that is, by comparing the consistency of the analysis results of the data before and after the desensitization process, determine whether the desensitization operation introduces unnecessary deviations or errors; (3) Use the known key features in the historical data to verify whether the data after desensitization can still maintain the key features to ensure the authenticity and validity of the data.

[0070] In this embodiment, if Figure 1As shown, the analysis process of the capital behavior analysis model is specifically as follows: inputting the capital behavior data into the encoder, the encoder uses the capital behavior data to compose a graph, and generates a capital behavior graph network, the capital behavior graph network includes nodes and directed edges, the nodes represent users, the directed edges represent transactions, and the arrows point from the capital outflow party to the capital recipient party; sub-graph matching is performed on the capital behavior graph network and the capital behavior network sample library, and the capital behavior graph network that is successfully matched in the capital behavior network sample library is the capital behavior feature graph network; the decoder decodes the capital behavior feature graph network to obtain output features; the capital behavior network sample library is obtained through feature engineering and prior knowledge construction, and contains the capital behavior network graph of abnormal capital behavior to be analyzed and discovered.

[0071] In this embodiment, if Figure 2 As shown, the analysis process of the communication behavior model is specifically as follows: extracting the physical communication device information and social site information in the communication behavior data, and parsing the social site information to obtain multi-dimensional social information such as social site account basic information, user profile information, content publishing information, interactive behavior information, data analysis information and user status information; the social site account basic information includes the information data disclosed by the social site account, the user profile information includes the user's avatar and nickname on the social site, the content publishing information includes the user's posts publicly published on the social site, the interactive behavior information includes the user's likes, comments and forwarding on the social site, the data analysis information includes the social site's analysis of the user, and the user status information includes the user's online status data.

[0072] By collecting data from multiple social sites, mining multiple accounts of the same network target on different social sites, collecting social site information of these accounts, parsing the social site information, and cross-validating the social point information after union, removing some dirty data, and obtaining the communication behavior of the same network target on multiple social sites. Further, by statistically analyzing the communication time period and communication frequency of both parties of the network target, mining whether the two parties are relatives, colleagues and other potential social relationships, and obtaining network target clusters through black sample clustering of network targets, and discovering potential malicious and illegal communication behaviors of both parties by analyzing network targets in the same cluster.

[0073] In this embodiment, if Figure 3As shown in the figure, the analysis process of the network behavior analysis model is as follows: the network behavior data is divided into basic information, ports and services, architecture and components, and fingerprint features. The basic information includes data such as the IP address and time of the network behavior, ports and services include data such as the port number and service type of the network behavior, architecture and components include data such as the website architecture type and component type, and fingerprint features include data such as browser fingerprints, device fingerprints, network fingerprints, and behavior fingerprints generated by the network behavior. The information items of the network behavior data are recursively traced. For example, the IP address is usually associated with the domain name. The domain name information is retrieved, and then the website owner information is obtained. That is, new data is retrieved through the currently mastered data, and new data is recursively retrieved again using the new data to maximize the use of information. The analysis results of the network behavior data are obtained by comparing and analyzing the traceability data. The analysis results include information such as suspected identical website templates and suspected identical developers, and the network behavior data is recursively traced to achieve information such as abnormal login locations of targets, sensitive information queries with a surge in frequency, and frequent communications with known malicious IP addresses.

[0074] In this embodiment, if Figure 4 As shown in the figure, the target identity alignment model obtains different data sets such as desensitized network behavior data, communication behavior data, and financial behavior data from the Internet. At this time, the user privacy information of the open source collected data has been removed. The target identity alignment model first intersects the known network target data with the desensitized network behavior data, communication behavior data, and financial behavior data to obtain the network behavior, communication behavior, and financial transaction data of the network target, and then merges the network, communication, and financial transaction data of the network target into one data set, compares it with the known network target data, associates it to obtain a new network target, and then expands the clues to find the network target.

[0075] In this embodiment, the calculation process of the desensitized data restoration degree is as follows:

[0076] Assume O is the original data, A is the desensitized data, and R is the restored data. The restoration degree of desensitized data (RDD) is expressed as:

[0077]

[0078] Among them, BP is the ex ante penalty function, W i = 1 / i, P i is the N-gram score, and N is set to 4. The calculation formula of BP is:

[0079]

[0080] Among them, len is the length calculation function.

[0081] P i The calculation formula is:

[0082]

[0083] Among them, N-gram is a segment of N consecutive characters or words, Counter Clip (N-gram) represents the number of N-grams in the original data O, ∑ N-gram∈R Counter Clip (N-gram) represents the number of N-grams of the restored data R that appear in the original data O, ∑ N-gram∈R Counter Clip (N-gram) represents the number of N-grams of the restored data R.

[0084] In this embodiment, the specific calculation formula of the difference degree of desensitized data (DDD) is:

[0085]

[0086] Among them, D sen is the degree of change of sensitive information, D non-sen It is the stability of non-sensitive information.

[0087] Sensitive information change degree D sen The calculation formula is:

[0088]

[0089] Among them, H is the information entropy calculation function, H(O) is the information entropy before desensitization, H(A) is the information entropy after desensitization, and n represents the number of data.

[0090] Stability of non-sensitive information D non-sen The calculation formula is:

[0091]

[0092] Among them, O′ and A′ are the features of the original data O and the desensitized data A respectively, and MSE is the mean square error calculation formula. max is the maximum mean square error.

[0093] In this embodiment, the calculation formula of the retention degree of sensitive data (RDS) is:

[0094]

[0095] O rem is the total amount of sensitive information retained in the de - sensitized data, O sen is the total amount of sensitive information in the original data. The value range of RDS is [0, 1]. RDS = 0 indicates complete de - sensitization, RDS = 1 indicates no de - sensitization, and 0 < RDS < 1 indicates that some sensitive information is retained.

[0096] Specifically, in this embodiment, when calculating the accuracy index, the OAR data de - sensitization system analysis module can select representative historical data. After processing the historical data with the de - sensitization algorithm or strategy to be evaluated, the accuracy index is calculated according to the following formula:

[0097] Acc = w0RDD + w1DDD + w2RDS + w3K

[0098] where w0, w1, w2, and w3 are weights respectively;

[0099] K is the inspection accuracy rate of the target information of the de - sensitization network, and its calculation formula is:

[0100]

[0101] where the larger the value of K, the higher the inspection accuracy rate of the target information of the de - sensitization network;

[0102] R I is the success rate of inspecting the target information of the non - de - sensitization network. Inspecting the target information of the non - de - sensitization network means discovering network targets through non - de - sensitized data, R I is calculated according to the following formula:

[0103]

[0104] R D is the success rate of inspecting the target information of the de - sensitization network. Inspecting the target information of the de - sensitization network means discovering network targets through de - sensitized data, R D is calculated according to the following formula:

[0105]

[0106] where I TN represents the number of non - de - sensitized data that successfully inspect the network target through non - de - sensitized data, I FN represents the number of de - sensitized data that fail to inspect the network target through non - de - sensitized data, D TN represents the number of de - sensitized data that successfully inspect the network target through de - sensitized data, D FN represents the number of de - sensitized data that fail to inspect the network target through de - sensitized data.

[0107] For those skilled in the art, various corresponding changes and modifications can be made according to the above technical solutions and concepts, and all of these changes and modifications should be included in the protection scope of the claims of the present invention.

Claims

1. A network target intelligent analysis system based on OAR data desensitization system and modeling, characterized in that: Including desensitized data modeling analysis module and OAR data desensitization system analysis module; The desensitized data modeling and analysis module is used to obtain network target analysis results through the capital behavior analysis model, communication behavior model, network behavior model and target identity alignment model; The fund behavior analysis model obtains the desensitized fund behavior data and identifies abnormal fund behavior by analyzing the fund behavior data; The communication behavior model is used to analyze the desensitized communication behavior data, obtain the user's communication habits and social relationship network by performing feature analysis on the communication behavior data, and discover potential malicious and illegal communication behaviors; The network behavior model is used to analyze the user's anonymized network behavior data, identify abnormal network activity patterns, and discover potential key targets or network signs; The target identity alignment model is used to achieve accurate matching and alignment of identity information in different data sets of financial behavior data, communication behavior data, and network behavior data, and to identify and associate with specific individuals or entities under the premise of protecting user privacy; The OAR data desensitization system analysis module is used to analyze the desensitization degree index and accuracy index of desensitized data through desensitization evaluation and accuracy assessment.

2. The system according to claim 1, characterized in that The indicators of desensitization evaluation include desensitized data restoration degree, desensitized data difference degree and sensitive information retention degree; the desensitized data restoration degree is used to evaluate the possibility and degree of restoration of desensitized data to the original data state under specific conditions, ensuring that the desensitization process will not damage the availability or security of the data due to excessive or insufficient desensitization; the desensitized data difference degree is used to evaluate the degree of change between the data before and after desensitization, and verify whether the desensitization process has effectively changed the sensitive characteristics of the data while keeping the non-sensitive part of the data relatively stable; The sensitive information retention degree is used to evaluate whether all predetermined sensitive information has been effectively eliminated during the desensitization process.

3. The system according to claim 1, characterized in that The accuracy assessment is to evaluate the accuracy of the desensitization process based on historical data to verify the consistency of the final result; by selecting representative historical data as a benchmark, the data desensitization process and its subsequent analysis steps are simulated and tested; During the test, the desensitization algorithm or strategy to be evaluated is used to process historical data, and the desensitized data and its analysis results are compared and verified using the preset evaluation indicators or evaluation models: (1) Verify whether the desensitization process is executed according to the expected rules to ensure that sensitive information is effectively removed or converted, while non-sensitive information remains relatively intact; (2) Evaluate the impact of the desensitization process on the data analysis results, that is, by comparing the consistency of the data analysis results before and after the desensitization process, determine whether the desensitization operation introduces unnecessary bias or error; (3) Use the known key features in the historical data to verify whether the data can still maintain the key features after the desensitization process to ensure the authenticity and validity of the data.

4. The system according to claim 1, characterized in that The analysis process of the fund behavior analysis model is as follows: inputting the fund behavior data into the encoder, the encoder uses the fund behavior data to compose a graph, and generates a fund behavior graph network. The fund behavior graph network includes nodes and directed edges. The nodes represent users, the directed edges represent transactions, and the arrows point from the fund outflow party to the fund receiver party; subgraph matching is performed between the fund behavior graph network and the fund behavior network sample library. The fund behavior graph network that is successfully matched in the fund behavior network sample library is the fund behavior feature graph network; The decoder decodes the fund behavior feature graph network to obtain output features; the fund behavior network sample library is obtained through feature engineering and prior knowledge construction, and contains the fund behavior network graph of abnormal fund behavior to be analyzed and discovered.

5. The system according to claim 1, characterized in that The analysis process of the communication behavior model is as follows: extracting the physical communication device information and social site information from the communication behavior data, and parsing the social site information to obtain multi-dimensional social information including social site account basic information, user profile information, content publishing information, interactive behavior information, data analysis information, and user status information; By collecting data from multiple social sites, mining multiple accounts of the same network target on different social sites, collecting the social site information of these accounts, parsing the social site information, finding the union of the social point information and performing cross-validation, removing dirty data, and obtaining the communication behavior of the same network target on multiple social sites; further, through statistical analysis of the communication time period and communication frequency of both parties of the network target, mining the potential social relationship between the two parties of the communication, obtaining the network target cluster by clustering the network target black samples, and discovering the potential malicious and illegal communication behavior of the two parties of the communication by analyzing the network targets in the same cluster.

6. The system according to claim 1, characterized in that The analysis process of the network behavior analysis model is as follows: the network behavior data is divided into basic information, ports and services, architecture and components, and fingerprint features, and the information items of the network behavior data are recursively traced, that is, new data is retrieved through the currently acquired data, and new data is recursively retrieved again using the new data to maximize the use of information; the analysis results of the network behavior data are obtained by comparing and analyzing the traceability data. The analysis results include information about suspected identical website templates and suspected identical developers, and the network behavior data is used to recursively trace the target abnormal login location, the query of sensitive information with a surge in frequency, and the information of frequent communications with known malicious IP addresses.

7. The system according to claim 6, characterized in that The basic information includes data on the IP address and time when the network behavior occurs, the port and service include data on the port number and service type of the network behavior, the architecture and component include data on the website architecture type and component type, and the fingerprint feature includes data on one or more of the browser fingerprint, device fingerprint, network fingerprint and behavioral fingerprint generated by the network behavior.

8. The system according to claim 1, characterized in that The target identity alignment model obtains a dataset of desensitized network behavior data, communication behavior data, and financial behavior data from the Internet. First, the network target data is intersected with the desensitized network behavior data, communication behavior data, and financial behavior data to obtain the network target's network behavior, communication behavior, and financial transaction data. The network, communication, and financial transaction data of the network target are then merged into one dataset, compared with the known network target data, and associated to obtain new network targets, thereby expanding the clues to find the network target.

9. The system according to claim 2, characterized in that The calculation process of desensitized data restoration degree is as follows: Assume O is the original data, A is the desensitized data, and R is the restored data. The desensitized data restoration RDD is expressed as: Among them, BP is the ex ante penalty function, W i = 1 / i, P i is the N-gram score, N is set to 4; the calculation formula of BP is: Among them, len is the length calculation function; P i The calculation formula is: Among them, N-gram is a segment of N consecutive characters or words, Counter Clip (N-gram) represents the number of N-grams in the original data O, ∑ N-gram∈R Counter Clip (N-gram) represents the number of N-grams of the restored data R that appear in the original data O, ∑ N-gram∈R Counter Clip (N-gram) represents the number of N-grams of the restored data R; The specific calculation formula for the desensitized data difference DDD is: Among them, D sen is the degree of change of sensitive information, D non-sen It is the stability of non-sensitive information; Sensitive information change degree D sen The calculation formula is: Among them, H is the information entropy calculation function, H(O) is the information entropy before desensitization, H(A) is the information entropy after desensitization, and n represents the number of data; Stability of non-sensitive information D non-sen The calculation formula is: Among them, O′ and A′ are the features of the original data O and the desensitized data A respectively, and MSE is the mean square error calculation formula. max is the maximum mean square error; The calculation formula for sensitive information retention RDS is: O rem is the total amount of sensitive information retained in the de - sensitized data, O sen is the total amount of sensitive information in the original data; the value range of RDS is [0, 1], RDS = 0 indicates complete de - sensitization, RDS = 1 indicates no de - sensitization, and 0 < RDS < 1 indicates that some sensitive information is retained.

10. The system according to claim 9, characterized in that The OAR data desensitization system analysis module selects representative historical data, uses the desensitization processing algorithm or strategy to be evaluated to process the historical data, and then calculates the accuracy index as follows: Acc=w0RDD+w1DDD+w2RDS+w3K Among them, w0, w1, w2 and w3 are weights respectively; K is the accuracy of desensitized network target information verification, and its calculation formula is: Among them, the larger the K value, the higher the accuracy of desensitized network target information verification; R I is the success rate of non-massified network target information verification. Non-massified network target information verification refers to discovering network targets through non-massified data. I Calculate as follows: R D is the success rate of desensitized network target information verification. Desensitized network target information verification refers to discovering network targets through desensitized data. D Calculate as follows: Among them, I TN Indicates the number of non-masked data that successfully verifies the network target through non-masked data. FN Indicates the number of desensitized data that failed to verify the network target through non-desensitized data, D TN Indicates the number of desensitized data that are successfully verified through desensitized data. FN Indicates the number of desensitized data that failed to pass the desensitized data verification network target.

Images