Data processing method and device, storage medium and computer equipment

Abstract

Embodiments of the invention provide a data processing method and apparatus, a storage medium and a computer device. The method comprises the steps of obtaining data reported by each data source from at least two data sources; comparing the data corresponding to each data source with data in a preset database, and determining a matching rate, a false alarm rate and a missing report rate of each data source; determining a quality score of each data source based on the matching rate, the false alarm rate and the missing report rate of each data source; obtaining an index value of each piece of data, and classifying target data with the same index value reported by different data sources; acquiring a data confidence score of each piece of target data in the classified data; based on the data confidence score of each piece of target data and the quality score of the data source corresponding to each piece of target data, the classification score of the classified data is determined, the quality score of each data source is effectively determined, and the same data from different data sources are classified; a reliability assessment of the classified data is provided through the quality score of each data source.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a data processing method, device, storage medium and computer equipment. Background Art

[0002] Multi-source threat intelligence refers to intelligence data from multiple different sources involving security threats and vulnerabilities. Intelligence types include Internet Protocol Address (IP) reputation, domain name analysis, compromise indicators, file reputation, Uniform Resource Locator (URL) reputation, vulnerabilities, etc. This intelligence comes from various security products, public intelligence sources, and security incidents. After processing, evaluation, and standardization, it forms structured information to support security decisions, actions, and defense. This data is used to monitor, identify, and respond to network security threats, providing organizations and individuals with key information support for combating malicious attacks and protecting network security.

[0003] In related technologies, although a variety of intelligence data can be obtained from different channels, the data quality of each data source is uneven, including differences in data accuracy and completeness. Traditional methods are difficult to comprehensively measure the quality of each data source, and cannot accurately determine which data sources provide more reliable data, thus affecting the accuracy of subsequent data processing and decision-making. For example, in the field of network security threat intelligence, the threat data provided by different security products or intelligence agencies may contain a large number of false positives or omissions. If its quality cannot be effectively evaluated, it may lead to misjudgment or failure of security defense measures. Therefore, related technologies urgently need to propose a data processing method to solve the above technical problems. Summary of the invention

[0004] The main purpose of the present application is to provide a data processing method, apparatus, storage medium and computer equipment, which can effectively determine the quality score of each data source and classify the same data from different data sources, so as to classify and evaluate the classified data by the quality score of each data source, so as to provide a reliability assessment of the data.

[0005] In a first aspect, an embodiment of the present application provides a data processing method, including:

[0006] Acquire data reported by each of the data sources from at least two data sources;

[0007] Compare the data corresponding to each of the data sources with the data in a preset database to determine the matching rate, false positive rate, and false negative rate of each of the data sources;

[0008] Determine a quality score of each of the data sources based on a matching rate, a false positive rate, and a false negative rate of each of the data sources;

[0009] Obtain the indicator value of each data, classify the target data with the same indicator value reported by different data sources, and obtain classified data;

[0010] Obtaining a data confidence score for each target data in the classified data;

[0011] Based on the data confidence score of each target data and the quality score of the data source corresponding to each target data, the classification score of the classified data is determined.

[0012] In a second aspect, an embodiment of the present application provides a data processing device, including:

[0013] A first acquisition unit, configured to acquire, from at least two data sources, data reported by each of the data sources;

[0014] A comparison unit, used to compare the data corresponding to each of the data sources with the data in a preset database, and determine the matching rate, false alarm rate and missed alarm rate of each of the data sources;

[0015] A first determining unit, configured to determine a quality score of each of the data sources based on a matching rate, a false positive rate, and a false negative rate of each of the data sources;

[0016] A classification unit is used to obtain the index value of each data, classify the target data with the same index value reported by different data sources, and obtain classified data;

[0017] A second acquisition unit, used to acquire a data confidence score of each target data in the classified data;

[0018] The second determining unit is used to determine the classification score of the classified data based on the data confidence score of each target data and the quality score of the data source corresponding to each target data.

[0019] In a third aspect, an embodiment of the present application provides a storage medium, wherein the computer-readable storage medium stores a plurality of instructions, which are suitable for loading by a processor to execute any of the above data processing methods.

[0020] In a fourth aspect, an embodiment of the present application provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements any of the above data processing methods when executing the computer program.

[0021] In an embodiment of the present application, data reported by each of the data sources is obtained from at least two data sources; the data corresponding to each of the data sources is compared with the data in a preset database to determine the matching rate, false alarm rate and missed alarm rate of each of the data sources; the quality score of each of the data sources is determined based on the matching rate, false alarm rate and missed alarm rate of each of the data sources; the index value of each data is obtained, and the target data with the same index value reported by different data sources are classified to obtain classified data; the data confidence score of each target data in the classified data is obtained; the classification score of the classified data is determined based on the data confidence score of each target data and the quality score of the data source corresponding to each target data. Compared with the related art, in which the quality of data reported by each data source is uneven and it is impossible to accurately judge which data source provides more reliable data, the embodiment of the present application effectively determines the quality score of each data source and classifies the same data from different data sources, so as to classify and evaluate the classified data according to the quality score of each data source, so as to provide data reliability evaluation.

[0022] Other features and advantages of the present disclosure will be described in the following description, and partly become apparent from the description, or understood by practicing the present disclosure. The purpose and other advantages of the present disclosure can be realized and obtained by the structures particularly pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0024] Figure 1 A schematic diagram of a data processing system according to an embodiment of the present invention.

[0025] Figure 2 A flowchart of a data processing method provided in an embodiment of the present application.

[0026] Figure 3 A schematic diagram of a data acquisition architecture provided in an embodiment of the present application.

[0027] Figure 4 A schematic diagram of the architecture for calculating the quality score of a data source provided in an embodiment of the present application.

[0028] Figure 5 A schematic diagram of the data classification architecture provided in an embodiment of the present application.

[0029] Figure 6 A schematic diagram of the structure of a data processing device provided in an embodiment of the present application.

[0030] Figure 7 A schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0031] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.

[0032] It should be noted that in some processes described in the specification, claims and the above-mentioned drawings, multiple steps appearing in a specific order are included, but it should be clearly understood that these steps may not be executed in the order in which they appear in this document or may be executed in parallel. The step numbers are only used to distinguish different steps, and the numbers themselves do not represent any execution order. In addition, descriptions such as "first", "second" or "target" in this document are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0033] Before further describing the embodiments of the present disclosure in detail, the nouns and terms involved in the embodiments of the present disclosure are described. The nouns and terms involved in the embodiments of the present disclosure are subject to the following interpretations:

[0034] Multi-source threat intelligence refers to intelligence data from multiple different sources involving security threats and vulnerabilities. The types of intelligence include Internet Protocol Address (IP) reputation, domain name analysis, compromise indicators, file reputation, Uniform Resource Locator (URL) reputation, vulnerabilities, etc. This intelligence comes from various security products, public intelligence sources and security incidents. After processing, evaluation and standardization, it forms structured information to support security decisions, actions and defense. This data is used to monitor, identify and respond to network security threats, and provide organizations and individuals with key information support to fight malicious attacks and protect network security.

[0035] The importance of multi-source threat intelligence lies in that it can provide data from different angles and sources, helping enterprises, organizations or security professionals to gain a more comprehensive understanding of current and potential security threats. This comprehensive intelligence helps predict and prevent security risks, while also supporting real-time response and security incident response, providing a stronger protection and response capability for the entire security ecosystem.

[0036] As time goes by, the sources of multi-source threat intelligence continue to increase, but it is challenging to classify intelligence data from the same categories and objects.

[0037] First, the amount of threat intelligence data is huge. This data may come from different security products, public data sources, etc., resulting in information fragmentation and differentiation, making the integration and processing of this data complicated.

[0038] Secondly, the quality and accuracy of data is a challenge, as the credibility, timeliness and validity of data sources may vary, and there is a risk of inconsistency and misreporting.

[0039] Finally, multi-source threat intelligence classification technology also faces the challenge of integrating different data sources, formats, and semantics. Effective classification requires solving the deduplication, standardization, association, and reasoning of data to produce more comprehensive and accurate threat intelligence. However, the correlation and semantic differences between data complicate the classification process and require dealing with conflicts and inconsistencies between data sources.

[0040] In order to solve the above problems, the embodiment of the present application obtains data reported by each data source from at least two data sources; compares the data corresponding to each data source with the data in the preset database to determine the matching rate, false alarm rate and missed alarm rate of each data source; determines the quality score of each data source based on the matching rate, false alarm rate and missed alarm rate of each data source; obtains the index value of each data, classifies the target data with the same index value reported by different data sources to obtain classified data; obtains the data confidence score of each target data in the classified data; determines the classification score of the classified data based on the data confidence score of each target data and the quality score of the data source corresponding to each target data, effectively determines the quality score of each data source, and classifies the same data from different data sources, so as to classify and evaluate the classified data according to the quality score of each data source, so as to provide data reliability evaluation. Please continue to refer to the following specific embodiments for details.

[0041] See also Figure 1 , Figure 1 A schematic diagram of a data processing system provided in an embodiment of the present application, which includes a data source 140, the Internet 130, a gateway 120, a computer device 110, etc.

[0042] The data source 140 includes but is not limited to a pre-configured enterprise server, or an electronic device with data reporting capabilities such as a tablet computer or a desktop computer. In addition, it can be a single device or a collection of multiple devices. The data source 140 can communicate with the Internet 130 in a wired or wireless manner to exchange data.

[0043] The data source 140 refers to a computer system that can report data to the computer device 110. Compared with ordinary terminals, the computer device 110 has higher requirements in terms of stability, security, performance, etc. The computer device 110 can be a high-performance computer in a network platform, a cluster of multiple high-performance computers, a part of a high-performance computer (such as a virtual machine), a combination of parts of multiple high-performance computers (such as virtual machines), etc.

[0044] The gateway 120 is also called an internetwork connector or a protocol converter. The gateway realizes network interconnection at the transport layer and is a computer system or device that acts as a converter. The gateway is a translator between two systems that use different communication protocols, data formats or languages, or even completely different architectures. At the same time, the gateway can also provide filtering and security functions. The message sent by the data source 140 to the computer device 110 must be sent to the corresponding computer device 110 through the gateway 120. The message sent by the computer device 110 to the data source 140 must also be sent to the corresponding data source 140 through the gateway 120.

[0045] The data processing method of the embodiment of the present disclosure may be implemented on the computer device 110 .

[0046] It should be noted that Figure 1 The scenario diagram of the data processing system shown is merely an example. The data processing system and scenario described in the embodiment of the present application are intended to more clearly illustrate the technical solution of the embodiment of the present application, and do not constitute a limitation on the technical solution provided in the embodiment of the present application. A person of ordinary skill in the art can appreciate that with the evolution of image processing technology and the emergence of new business scenarios, the technical solution provided in the embodiment of the present application is equally applicable to similar technical problems.

[0047] In this embodiment, the description will be made from the perspective of a data processing device, which can be specifically integrated into a computer device having a storage unit and a microprocessor installed therein and having computing capabilities.

[0048] See also Figure 2 , Figure 2 A flow chart of a data processing method provided in an embodiment of the present application. The data processing method includes:

[0049] In step 201, data reported by each of at least two data sources is obtained.

[0050] Among them, in response to the current diverse sources of threat intelligence data and the differences in different intelligence data provision methods, a variety of intelligence data acquisition methods are proposed, aiming to adapt to the data provision methods of various intelligence sources, including active acquisition methods through API interfaces transmitted over the network, and passive acquisition methods such as security event syslog outbound acquisition methods and file import.

[0051] For details, please refer to Figure 3 , Figure 3 Schematic diagram of the data acquisition architecture provided for the embodiment of the present application. For the active acquisition method, a continuously updated multi-source intelligence interface list is set. This list contains the interface address, request token, request content format, request parameters and other field information required for all interface requests of each intelligence source. The list supports on-demand updates to timely adapt to newly added API intelligence sources. Secondly, when it is necessary to perform intelligence queries on objects such as IP, domain names, samples, URLs, and emails, the system will automatically trigger the execution of the active collection module. The module determines the intelligence type by querying the object characteristics, and automatically calls all intelligence source A interfaces to complete the acquisition of threat intelligence.

[0052] For passive acquisition, in the network security system, security devices (such as firewalls, intrusion detection systems, antivirus software, etc.) or other security-related applications will monitor the system's operating status and network activities in real time. When a security event (such as attack behavior, abnormal traffic, security policy violation, etc.) is detected, these devices or applications will generate corresponding log messages according to the specifications of the syslog protocol.

[0053] These syslog messages containing security event details are then sent over the network to pre-configured external receivers. The receivers can be dedicated security management systems (such as security information and event management (SIEM) platforms), log servers, or other systems that need to receive and process these security event information.

[0054] Passive import can be a process in which data collectors manually input the collected data, so that the system passively receives the input data.

[0055] Regardless of which data source submits data in which data submission form, data submitted by at least two data sources will be received. After receiving the data, the data content will be cleaned to remove irrelevant data in order to retain the core data to be processed.

[0056] In step 202, the data corresponding to each of the data sources is compared with the data in a preset database to determine the matching rate, false alarm rate, and missed alarm rate of each of the data sources.

[0057] The preset database is a blacklist of threat intelligence data with potential security risks disclosed by authoritative security agencies. By comparing the data corresponding to each data source with the data in the preset database, the degree of conformity between the data provided by the data source and the known accurate data (the data in the preset database can be regarded as a relatively accurate reference standard) can be determined, thereby determining its accuracy.

[0058] For example, in the field of cybersecurity threat intelligence, the preset database contains verified malicious IP addresses, domain names and other information. By comparing the relevant data in the data source, it can be seen whether the data source can accurately identify these malicious entities.

[0059] By calculating the false alarm rate, we can clearly know the proportion of normal data in the data source that is mistakenly judged as abnormal or threatening data. In practical applications, such as intrusion detection systems, if the false alarm rate is too high, security administrators will frequently deal with false alarms, wasting time and resources, and may also reduce vigilance against real threats.

[0060] Determining the false negative rate helps understand whether the data source fails to detect actual threats or anomalies. For security defense, false negatives mean that potential threats are not discovered, which may put the system at risk of security risks.

[0061] For example, in malware detection, if a data source misses a large number of new malware, the security protection system that relies on this data source may not be able to prevent the invasion of these malware in time.

[0062] In some implementations, comparing the data corresponding to each of the data sources with the data in a preset database to determine a matching rate, a false positive rate, and a false negative rate of each of the data sources includes:

[0063] (1) obtaining the amount of matching data in the preset database and the amount of false positive data not in the preset database for the data reported by each data source;

[0064] (2) obtaining the amount of underreported data in the preset database that is not reported by each of the data sources, thereby obtaining the amount of underreported data of each of the data sources;

[0065] (3) determining the ratio of the amount of matching data of each data source to the corresponding total amount of reported data, and obtaining a matching rate of each data source;

[0066] (4) determining the ratio of the amount of false positive data of each data source to the corresponding total amount of reported data, and obtaining the false positive rate of each data source;

[0067] (5) Determine the ratio of the amount of missed data of each data source to the amount of preset data in the preset database to obtain the missed rate of each data source.

[0068] Among them, the data reported by each data source is traversed. For each piece of data, a search and match operation is performed in the preset database. A database query statement (such as the SELECT statement in SQL) or other suitable data retrieval methods can be used to perform an accurate match in the preset database based on the key features of the data (such as IP addresses, domain names, file hash values, etc. in network security threat intelligence). Whenever a matching piece of data is found, the matching data amount counter is increased by 1.

[0069] Specifically, the matching rate can be determined by referring to the following formula:

[0070] For example, a data source reported 100 pieces of data about malicious IP addresses. After comparing them one by one in the preset database, it was found that 60 IP addresses were exactly the same as the malicious IP records in the database. Then the amount of matching data for this data source is 60.

[0071] In the process of comparing the data reported by the data source with the preset database, the data that is not matched in the preset database is recorded at the same time. After traversing all the reported data of the data source, the number of unmatched data is the amount of false positive data. Continuing with the above malicious IP address data as an example, if 40 out of 100 reported data do not find the corresponding malicious IP records in the preset database, then the amount of false positive data of the data source is 40.

[0072] Then, each piece of data in the preset database is traversed, and for each piece of data, it is checked whether it has been reported by each data source. This can be achieved by performing a reverse search in the data reported by the data source. If no record matching a piece of data in the preset database is found in the data reported by a certain data source, then the counter of the amount of missed data of the data source is increased by 1, so as to obtain the amount of missed data of each data source.

[0073] For example, there are 120 malicious IP records in the preset database. After comparing with the data reported by a certain data source, it is found that 20 malicious IP records are not reported by any data source. Then the amount of underreported data of this data source is 20.

[0074] Specifically, after obtaining the amount of matching data from each data source and knowing the total amount of data reported by each data source (i.e., the total amount of reported data), when calculating the matching rate, it is only necessary to divide the amount of matching data by the total amount of reported data.

[0075] For example, the amount of matching data from a data source is 60, and the total amount of reported data is 100, then the matching rate = 60 / 100 = 0.6 (or 60%).

[0076] On the premise that the amount of false alarm data of each data source and the total amount of reported data of each data source are obtained, when calculating the false alarm rate, the amount of false alarm data is divided by the total amount of reported data.

[0077] For example, the amount of false positive data is 40, and the total amount of reported data is 100, then the false positive rate = 40 / 100 = 0.4 (or 40%).

[0078] On the premise that the amount of missed data of each data source and the preset amount of data in the preset database are obtained, when calculating the missed data rate, the amount of missed data is divided by the preset amount of data.

[0079] For example, the amount of missed data is 20, and the preset amount of data is 120, then the missed rate = 20 / 120 ≈ 0.167 (or 16.7%).

[0080] In this way, by accurately calculating the match rate, false alarm rate, and missed alarm rate, the data quality of each data source can be clearly quantified. Data sources with high match rates and low false alarm rates and missed alarm rates are regarded as more reliable sources of information. In multi-source data processing scenarios, such as cybersecurity threat intelligence analysis or financial risk assessment, this helps to prioritize high-quality data sources and improve the accuracy and credibility of data processing results. For example, in the field of cybersecurity, security teams can more accurately rely on intrusion detection system data sources with low false alarm rates to respond to real security threats in a timely and effective manner, rather than being troubled by a large number of false alarms generated by high false alarm rate data sources.

[0081] In step 203, the quality score of each of the data sources is determined based on the matching rate, false positive rate, and false negative rate of each of the data sources.

[0082] After obtaining the data of each data source in three dimensions, namely, the matching rate, the false alarm rate and the missed alarm rate, in step 202 , the quality score of each data source can be comprehensively determined.

[0083] In some implementations, determining the quality score of each of the data sources based on the matching rate, false positive rate, and false negative rate of each of the data sources includes:

[0084] (1) calculating a difference between a false alarm rate and a false alarm rate of each of the data sources to obtain a first calculation result of each of the data sources;

[0085] (2) calculating a difference between the false negative rate of the first and the false negative rate of each of the data sources to obtain a second calculation result of each of the data sources;

[0086] (3) calculating the matching rate corresponding to each of the data sources, the first calculation result, and the product of the first calculation result and the second calculation result to obtain an accuracy score for each of the data sources;

[0087] (4) determining a timeliness score for each data source based on the time at which the data source submits the data and the current time;

[0088] (5) Determine the quality score of each data source based on the accuracy score and the corresponding timeliness score of each data source.

[0089] First, the false alarm rate of each data source is obtained. The false alarm rate is calculated previously and indicates the proportion of data in the data source that is incorrectly judged as abnormal or inconsistent with the actual situation to the total amount of reported data. Then, the false alarm rate of each data source is subtracted from 1.

[0090] For example, if the false alarm rate of a data source is 0.3 (30%), the first calculation result of the data source is 1-0.3=0.7.

[0091] The false negative rate of each data source is obtained, where the false negative rate refers to the ratio of the amount of data not reported by the data source in the preset database to the amount of data in the preset database. Then, the false negative rate of each data source is subtracted from 1.

[0092] For example, if the false negative rate of a data source is 0.2 (20%), then the second calculation result of the data source is 1-0.2=0.8.

[0093] After obtaining the matching rate of each data source (the ratio of the amount of matching data to the total amount of reported data), the first calculation result (the difference between 1 and the false alarm rate), and the second calculation result (the difference between 1 and the missed alarm rate), these three values ​​are multiplied together to obtain the accuracy score of each data source.

[0094] For example, the matching rate of a data source is 0.6, the first calculation result is 0.7, and the second calculation result is 0.8. Then the accuracy score of the data source = 0.6 × 0.7 × 0.8 = 0.336.

[0095] Obtain the time when each data source submits data. This time information is usually recorded when the data source submits data, or can be obtained from the relevant metadata of the data source. At the same time, obtain the current time. The current accurate time can be obtained through the system clock. The timeliness score of each data source can be determined by the time when each data source submits data and the current time.

[0096] After obtaining the accuracy score and timeliness score of each data source, set the weight factors to measure the impact of the accuracy score and timeliness score on the quality score.

[0097] For example, the accuracy weight is α, the timeliness weight is β, and α+β=1. The values ​​of α and β can be determined according to the characteristics of the data and the application scenario. If the accuracy of the data in a certain data source is more important, α can be set larger; if timeliness is more critical, β can be increased accordingly.

[0098] The quality score of each data source is calculated by weighted summation. Quality score = α × accuracy score + β × timeliness score. For example, if the accuracy score of a data source is 0.336 and the timeliness score is 0.5 (assuming it is calculated), α = 0.7, β = 0.3, then the quality score of the data source = 0.7 × 0.336 + 0.3 × 0.5 = 0.3852.

[0099] In this way, by calculating the accuracy score and timeliness score and finally determining the quality score, the data accuracy (reflected by the matching rate, false alarm rate and missed alarm rate) and timeliness (reflected by the difference between the reporting time and the current time and the timeliness scoring function) of the data source are fully considered. In many fields, such as network security, financial data analysis, market research, etc., data accuracy and timeliness are crucial.

[0100] In some implementations, determining the timeliness score of each data source according to the reporting time of the data reported by each data source and the current time includes:

[0101] (1.1) Obtaining the difference between the reporting time of each data source and the current time, and obtaining the reporting time difference of each data source;

[0102] (1.2) Determine the timeliness score of each data source based on the reporting time difference of each data source and a preset attenuation factor.

[0103] Among them, the time difference between the submission time and the current time is calculated. The calculation unit of the time difference can be determined according to specific needs, such as seconds, minutes, hours, etc. For example, if the submission time is 10:00:00 on November 10, 2023, and the current time is 15:00:00 on November 15, 2023, calculate the time difference between the two (assuming that the unit is hours).

[0104] The timeliness score is determined based on the time difference. A timeliness score function can be set. The larger the time difference, the lower the timeliness score. For example, an exponential decay function can be used, such as the timeliness score is T = e -λ·Δt, where λ is a decay coefficient used to adjust the impact of timeliness on the score. The larger λ is, the faster the timeliness score decreases as the time difference increases. This is suitable for data scenarios with high timeliness requirements, so as to determine the timeliness score of each data source.

[0105] In this way, by obtaining the difference between the reporting time of each data source and the current time, calculations can be performed in different time units (such as seconds, minutes, hours, etc.), which makes it possible to select the most appropriate time scale to measure timeliness based on the characteristics of the data and application scenarios.

[0106] In some implementations, determining the quality score of each of the data sources based on the accuracy score and the corresponding timeliness score of each of the data sources includes:

[0107] (1.1) Obtain the product of the accuracy score of each of the data sources and the preset accuracy weight to obtain the accuracy quality of each of the data sources;

[0108] (1.2) Obtain the product of the accuracy score of each data source and the preset timeliness weight to obtain the timeliness quality of each data source;

[0109] (1.3) Determine the sum of the accuracy quality and the corresponding timeliness quality of each data source to obtain the quality score of each data source.

[0110] Among them, the accuracy score of each data source is multiplied by the preset accuracy weight to obtain the accuracy quality, which means the contribution of the data source to the overall quality when considering the accuracy factor.

[0111] For example, if the accuracy score of a data source is 0.75 and the preset accuracy weight is 0.8, the accuracy quality of the data source is 0.75×0.8=0.6. This means that when considering the accuracy factor, the contribution of the data source to the overall quality is 0.6.

[0112] The preset timeliness weight is also pre-set to measure the importance of data source timeliness in the overall quality assessment. It complements the preset accuracy weight and jointly determines the data source quality score. For example, in the processing of financial transaction data with high real-time requirements, the preset timeliness weight may be 0.2 (the preset accuracy weight may be 0.8, and the sum of the two is 1), emphasizing the importance of timeliness in this scenario.

[0113] Specifically, the accuracy score of each data source is multiplied by the preset timeliness weight to obtain the timeliness quality.

[0114] For example, if the accuracy score of a data source is 0.75 and the preset timeliness weight is 0.2, the timeliness quality of the data source is 0.75×0.2=0.15. This means that from the perspective of timeliness, the contribution of the data source to the overall quality is 0.15.

[0115] For each data source, after calculating its accuracy quality and timeliness quality respectively, the accuracy quality and timeliness quality of each data source are added together to obtain the quality score of the data source.

[0116] For example, if the accuracy quality of a data source is 0.6 and the timeliness quality is 0.15, the quality score of the data source is 0.6+0.15=0.75. This quality score comprehensively reflects the overall performance of the data source in terms of accuracy and timeliness. In multi-source data processing, different data sources can be compared and screened according to the quality score, or their weights can be determined in operations such as data classification, thereby optimizing data processing results and improving the reliability and effectiveness of decision-making. For example, when classifying data, data sources with high quality scores may account for a larger proportion of the classification results to ensure that the classified data can better reflect the actual situation.

[0117] In this way, by separately calculating the accuracy quality (the product of the accuracy score and the preset accuracy weight) and the timeliness quality (the product of the accuracy score and the preset timeliness weight), and adding the two together to obtain the quality score, this method can effectively balance the accuracy and timeliness of data in data source quality assessment.

[0118] For details, please refer to Figure 4 , Figure 4 A schematic diagram of the architecture for calculating the quality score of a data source provided in an embodiment of the present application. A blacklist table is established by collecting blacklist data. When data X is received from data source N, the quality of data source N is evaluated. Specifically, a comprehensive evaluation is performed from two dimensions: data source accuracy and timeliness. The weight value of data source N in the weight of data source 1 to data source N is combined to determine the final quality score of data source N.

[0119] In step 204, the index value of each data is obtained, and the target data with the same index value reported by different data sources are classified to obtain classified data.

[0120] The indicator value may be data such as the IP address of the data and the domain name to which it belongs. The target data with the same indicator value reported by different data sources are classified to obtain classified data.

[0121] In some implementations, obtaining the indicator value of each data and classifying the target data with the same indicator value reported by different data sources to obtain the classified data includes:

[0122] (1) Obtain the indicator value of each data, classify the data with the same indicator value reported by different data sources, and record the current classification time;

[0123] (2) obtaining the general fields included in each general field type in each target data after classification;

[0124] (3) When the field information included in each general field type between each of the target data is the same, the field information included in each of the general field types is recorded, and the data source, data source quality score, and current classification time of each of the target data are recorded in turn to obtain classified data.

[0125] The data format of each data may be in accordance with the data format shown in Table 1.

[0126] Table 1

[0127]

[0128] Each data includes an indicator value, field information corresponding to each general field type (for example, the field information corresponding to general field type 1 is A), data confidence, a quality score of the data source to which it belongs, and the data source.

[0129] Table 2

[0130]

[0131] By classifying the target data with the same indicator value but different data sources, for example, classify the data with the same indicator value of "192.168.123.X" but belonging to data sources A, B, and C respectively, and record the current classification time.

[0132] Specifically, after classification, the general fields included in each general field type in each target data are obtained (for example, field information A corresponding to general field type 1 is obtained in Table 2)

[0133] When the field information included in each general field type between each target data is the same (for example, the field information corresponding to each general field type 1 in Table 2 is A), record the field information included in each general field type, and record the data source, data source quality score, and current classification time of each target data in turn to obtain classified data.

[0134] Referring to Table 2, the final classification data may be in the form of:

[0135] {

[0136] "Indicator value":"192.168.123.X",

[0137] "General Field Type 1":"A",

[0138] "Source Information":[

[0139] {"Data source":"A","Data source quality score":0.9},

[0140] {"Data source":"B","Data source quality score":0.8},

[0141] {"Data source":"C","Data source quality score":0.7}

[0142] ],

[0143] "Classification time":"2024-11-26 15:30:00"

[0144] }

[0145] In this way, by obtaining the indicator value of each data, the data with the same indicator value reported by different data sources are classified, and the preliminary integration of data is achieved. This method can quickly gather related data scattered in multiple data sources, laying the foundation for subsequent unified analysis and processing. For example, in the field of network security, the threat intelligence data about the same IP address (indicator value) from different security devices (such as firewalls, intrusion detection systems, etc.) are classified to facilitate a comprehensive understanding of the overall security situation of the IP address, avoiding the tedious process of analyzing data from data sources one by one, and improving data processing efficiency.

[0146] The specific format of each data (such as indicator value, common field type, confidence level, data source quality score, and data source, etc.) is clarified and followed in the classification process, so that the data from different data sources are standardized in structure. This helps to eliminate compatibility issues caused by data format differences and facilitates subsequent data processing and storage.

[0147] In some embodiments, the method further comprises:

[0148] (1) when there are target universal field types with different field information between each of the target data, determining the credible data with the highest quality score of the corresponding data source;

[0149] (2) obtaining target field information included in the target general field type in the trusted data;

[0150] (3) Record the field information of the general field type with the same field information, as well as the target field information, and sequentially record the data source, data source quality score, and current classification time of each target data to obtain classified data.

[0151] Among them, please refer to Table 3. When there is a target universal field type with different field information between each target data after classification (for example, there are two different field information A and B corresponding to universal field type 1 in Table 3, then universal field type 1 is the target universal field type), determine the credible data with the highest quality score of the corresponding data source (for example, the highest quality score of the data source in Table 3 is 0.9, then the data in the first row is determined as credible data).

[0152] Table 3

[0153]

[0154]

[0155] Specifically, the target field information included in the target universal field type in the trusted data is obtained, indicating that when there are differences in the universal fields, the target field information included in the target universal field type in the trusted data is preferentially selected as the correct and trusted field information.

[0156] In this way, when classifying, the field information of the general field type with the same field information and the target field information are recorded, and the data source, data source quality score, and current classification time of each target data are recorded in turn to obtain classified data.

[0157] Referring to Table 3, the final classification data is:

[0158] {

[0159] "Indicator value":"192.168.123.X",

[0160] "General field type 1": "A", (the data in the third row is less credible, so the field information A about general field type 1 in the credible data in the first row is used as the target field information, and B in the data in the third row is not recorded)

[0161] "Source Information":[

[0162] {"Data source":"A","Data source quality score":0.9},

[0163] {"Data source":"B","Data source quality score":0.8},

[0164] {"Data source":"C","Data source quality score":0.7}

[0165] ],

[0166] "Classification time":"2024-11-26 15:30:00"

[0167] }

[0168] In this way, when there are common field types with different field information between the target data, by determining the credible data with the highest quality score of the corresponding data source, data from more reliable data sources can be preferentially selected. In a multi-source data environment, the data quality of different data sources varies. This method can effectively reduce the impact of low-quality data source data on the final result.

[0169] In step 205, a data confidence score of each target data in the classified data is obtained.

[0170] The data confidence score is the confidence score that the data source evaluates for the data when collecting data. In order to subsequently determine the classification score of the classified data, the data confidence score of each target data is required to determine it. Therefore, it is necessary to obtain the data confidence score of each target data in the classified data.

[0171] In step 206, the classification score of the classified data is determined based on the data confidence score of each target data and the quality score of the data source corresponding to each target data.

[0172] After the data confidence score of each target data is obtained in step 205, the classification score of the classified data can be comprehensively determined in combination with the quality score of the data source corresponding to each target data.

[0173] In some implementations, determining the classification score of the classified data based on the data confidence score of each target data and the quality score of the data source corresponding to each target data includes:

[0174] (1) determining the product of the data confidence score of each target data and the quality score of the corresponding data source to obtain the weighted credibility of each target data;

[0175] (2) calculating the sum of the third calculation results of the plurality of target data to obtain a total weighted credibility;

[0176] (3) Obtaining the sum of the quality scores of the data sources corresponding to each of the target data to obtain the total quality score of the data source;

[0177] (4) Determine the ratio of the total weighted credibility to the total quality score to obtain a classification score for the classified data.

[0178] For each target data, first obtain its own data confidence score. This confidence score is usually a quantitative assessment of the accuracy or reliability of the data when the data source submits the data. The value range may be determined according to the specific scoring system, such as between 0 and 100 or between 0 and 1, etc., indicating the degree of trust in the data. At the same time, obtain the quality score of the data source to which the target data belongs. This quality score is calculated through a series of previous evaluations and reflects the overall data quality of the data source. It also has a specific value range (such as between 0 and 1, etc.).

[0179] For example, the data confidence score of a certain target data is 0.8 (indicating that the data has a high confidence level), and the quality score of the data source to which it belongs is 0.7.

[0180] Multiply the data confidence score by the corresponding data source quality score to obtain the weighted credibility of the target data.

[0181] For example, if the data confidence score of a target data is 0.8 (indicating that the data has a high confidence level), and the quality score of its data source is 0.7, the weighted confidence level is 0.8×0.7=0.56. This weighted confidence level takes into account the confidence level of the data itself and the quality of the data source, which means that after considering the impact of the data source quality, the relative confidence level of the data is 0.56.

[0182] After the weighted credibility has been calculated for each target data, the weighted credibility of these target data is added together to obtain the total weighted credibility, which reflects the overall credibility level of all target data after comprehensively considering their own confidence and the quality of the data source.

[0183] For example, there are three target data, whose weighted credibility are 0.56, 0.45 and 0.6 respectively, and the total weighted credibility is 0.56+0.45+0.6=1.61.

[0184] Specifically, for each target data, the quality score of the data source to which it belongs is obtained again. The quality scores of these data sources are added together to obtain the total quality score of the data source, which represents the overall quality level of all data sources involved in the classification.

[0185] For example, the quality scores of the data sources to which the three target data belong are 0.7, 0.6, and 0.8 respectively, and the total quality score is 0.7+0.6+0.8=2.1.

[0186] Specifically, the total weighted credibility is divided by the total quality score to obtain the classification score of the classified data. This classification score comprehensively reflects the relative quality or reliability level of the classified data after considering the confidence of each target data, the quality of the data source, and the overall data source quality. In multi-source data processing, this classification score can be used to compare the quality of different classified data. For example, when classifying data, the weights of different classified data in the classification results can be determined based on the classification score, or when screening data, the classified data with higher quality can be selected for further analysis or use based on the classification score.

[0187] For example, the total weighted credibility of the classified data is 1.61, and the total quality score is 2.1, then the classification score = 1.61 ÷ 2.1 ≈ 0.767.

[0188] In this way, the weighted credibility is obtained by calculating the product of the data confidence score of each target data and the data source quality score, so as to comprehensively consider the confidence of the data itself and the quality of the data source. The total weighted credibility, that is, the sum of the weighted credibility of all target data, is calculated to reflect the overall credibility level of a set of classified data as a whole. This helps to compare and select between multiple sets of classified data and determine which set of data is more trustworthy. The classification score (the ratio of the total weighted credibility to the total quality score) provides a reasonable basis for data classification. In the process of multi-source data classification, the weights of different classified data in the classification results can be determined according to the classification score.

[0189] For details, please refer to Figure 5 , Figure 5 A schematic diagram of the data classification architecture provided in the embodiment of the present application. Obtain data containing confidence scores, parse each data using the parsing rules in the data parsing rule library, categorize data with the same indicator value using the indicator information library, and finally store the categorized data in the categorization database.

[0190] As can be seen from the above, the embodiment of the present application obtains the data reported by each of the data sources from at least two data sources; compares the data corresponding to each of the data sources with the data in the preset database to determine the matching rate, false alarm rate and missed alarm rate of each of the data sources; determines the quality score of each of the data sources based on the matching rate, false alarm rate and missed alarm rate of each of the data sources; obtains the index value of each data, classifies the target data with the same index value reported by different data sources to obtain classified data; obtains the data confidence score of each target data in the classified data; determines the classification score of the classified data based on the data confidence score of each target data and the quality score of the data source corresponding to each target data. Compared with the related art, the data quality reported by each data source is uneven, and it is impossible to accurately judge which data source provides more reliable data. The embodiment of the present application effectively determines the quality score of each data source and classifies the same data from different data sources, so as to classify and evaluate the classified data according to the quality score of each data source, so as to provide data reliability evaluation.

[0191] The specific implementation of the above steps can be found in the previous embodiments, which will not be described in detail here.

[0192] In order to better implement the data processing method provided in the embodiment of the present application, the embodiment of the present application also provides a device based on the above data processing method. The meanings of the terms are the same as those in the above data processing method, and the specific implementation details can refer to the description in the method embodiment.

[0193] See also Figure 6 , Figure 6 The data processing device provided in the embodiment of the present application is a schematic diagram of the structure of the data processing device, which is applied to a computer device. The data processing device may include a first acquisition unit 601, a comparison unit 602, a first determination unit 603, a classification unit 604, a second acquisition unit 605, and a second determination unit 606.

[0194] A first acquisition unit 601 is used to acquire, from at least two data sources, data reported by each of the data sources;

[0195] A comparison unit 602 is used to compare the data corresponding to each of the data sources with the data in a preset database to determine the matching rate, false alarm rate and missed alarm rate of each of the data sources;

[0196] A first determining unit 603 is used to determine a quality score of each of the data sources based on a matching rate, a false alarm rate, and a false negative rate of each of the data sources;

[0197] The classification unit 604 is used to obtain the index value of each data, classify the target data with the same index value reported by different data sources, and obtain classified data;

[0198] A second acquisition unit 605 is used to acquire a data confidence score of each target data in the classified data;

[0199] The second determining unit 606 is configured to determine the classification score of the classified data based on the data confidence score of each target data and the quality score of the data source corresponding to each target data.

[0200] In some embodiments, the comparison unit 602 is used to:

[0201] Obtaining the amount of matching data in the preset database and the amount of false positive data not in the preset database for the data reported by each of the data sources;

[0202] Acquire the amount of underreported data in the preset database that is not reported by each of the data sources, and obtain the amount of underreported data of each of the data sources;

[0203] Determine the ratio of the amount of matching data of each data source to the corresponding total amount of reported data to obtain a matching rate of each data source;

[0204] Determine the ratio of the amount of false positive data of each data source to the corresponding total amount of reported data to obtain the false positive rate of each data source;

[0205] The ratio of the amount of missed data of each data source to the amount of preset data in the preset database is determined to obtain the missed rate of each data source.

[0206] In some embodiments, the first determining unit 603 includes:

[0207] A first calculation subunit, used for calculating a difference between a false alarm rate of a data source and a false alarm rate of each data source, to obtain a first calculation result of each data source;

[0208] A second calculation subunit is used to calculate a difference between the false negative rate of each of the data sources and obtain a second calculation result of each of the data sources;

[0209] A third calculation subunit is used to calculate the matching rate corresponding to each of the data sources, the first calculation result and the product of the first calculation result and the second calculation result to obtain an accuracy score for each of the data sources;

[0210] A first determining subunit is used to determine the timeliness score of each data source according to the reporting time of the data reported by each data source and the current time;

[0211] The second determining subunit is used to determine the quality score of each of the data sources based on the accuracy score and the corresponding timeliness score of each of the data sources.

[0212] In some embodiments, the first determining subunit is configured to:

[0213] Obtaining the difference between the reporting time of each data source and the current time, to obtain the reporting time difference of each data source;

[0214] The timeliness score of each of the data sources is determined based on the reporting time difference of each of the data sources and a preset attenuation factor.

[0215] In some embodiments, the second determining subunit is configured to:

[0216] Obtaining the product of the accuracy score of each of the data sources and a preset accuracy weight to obtain the accuracy quality of each of the data sources;

[0217] Obtaining the product of the accuracy score of each of the data sources and the preset timeliness weight to obtain the timeliness quality of each of the data sources;

[0218] The sum of the accuracy quality and the corresponding timeliness quality of each of the data sources is determined to obtain a quality score for each of the data sources.

[0219] In some embodiments, the classification unit 604 is configured to:

[0220] Obtain the indicator value of each data, classify the data with the same indicator value reported by different data sources, and record the current classification time;

[0221] Obtain the common fields included in each common field type in each target data after classification;

[0222] When the field information included in each general field type between each of the target data is the same, the field information included in each of the general field types is recorded, and the data source, data source quality score, and current classification time of each of the target data are recorded in turn to obtain classified data.

[0223] In some embodiments, the classification unit 604 is further configured to:

[0224] When there is a target universal field type with different field information between each of the target data, determining the credible data with the highest quality score of the corresponding data source;

[0225] Acquire target field information included in the target general field type in the trusted data;

[0226] The field information of the general field type with the same field information is recorded, as well as the target field information, and the data source, data source quality score, and current classification time of each target data are recorded in sequence to obtain classified data.

[0227] In some embodiments, the second determining unit 606 is configured to:

[0228] Determine the product of the data confidence score of each target data and the quality score of the corresponding data source to obtain the weighted credibility of each target data;

[0229] Calculating a sum of the third calculation results of the plurality of target data to obtain a total weighted credibility;

[0230] Obtaining the sum of the quality scores of the data sources corresponding to each of the target data to obtain the total quality score of the data source;

[0231] The ratio of the total weighted credibility to the total quality score is determined to obtain a classification score for the classified data.

[0232] The specific implementation of each of the above units can be found in the previous embodiments, which will not be described in detail here.

[0233] As can be seen from the above, the embodiment of the present application obtains the data reported by each data source from at least two data sources through the first acquisition unit 601; the comparison unit 602 compares the data corresponding to each data source with the data in the preset database, and determines the matching rate, false alarm rate and missed alarm rate of each data source; the first determination unit 603 determines the quality score of each data source based on the matching rate, false alarm rate and missed alarm rate of each data source; the classification unit 604 obtains the index value of each data, classifies the target data with the same index value reported by different data sources, and obtains classified data; the second acquisition unit 605 obtains the data confidence score of each target data in the classified data; the second determination unit 606 determines the classification score of the classified data based on the data confidence score of each target data and the quality score of the data source corresponding to each target data. Compared with the related art, in which the quality of data reported by each data source varies and it is impossible to accurately determine which data sources provide more reliable data, the embodiment of the present application effectively determines the quality score of each data source and classifies the same data from different data sources, so as to classify and evaluate the classified data according to the quality score of each data source, so as to provide a reliability assessment of the data.

[0234] The specific implementation of each of the above units can be found in the previous embodiments, which will not be described in detail here.

[0235] Reference Figure 7 , Figure 7The block diagram of the structure of part of the computer device 110 for implementing the embodiment of the present disclosure. The computer device 110 may have relatively large differences due to different configurations or performances, and may include one or more central processing units (CPUs) 622 (for example, one or more processors) and memory 632, and one or more storage media 630 (for example, one or more mass storage devices) storing application programs 642 or data 644. Among them, the memory 632 and the storage medium 630 can be temporary storage or permanent storage. The program stored in the storage medium 630 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations on the server 600. Furthermore, the central processing unit 622 can be configured to communicate with the storage medium 630 and execute a series of instruction operations in the storage medium 630 on the server 600.

[0236] The computer device 110 may also include one or more power supplies 626, one or more wired or wireless network interfaces 650, one or more input and output interfaces 658, and / or one or more operating systems 641, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, etc.

[0237] The central processor 622 in the computer device 110 may be used to execute the data processing method of the embodiment of the present disclosure, for example:

[0238] Acquire data reported by each of the data sources from at least two data sources;

[0239] Compare the data corresponding to each of the data sources with the data in a preset database to determine the matching rate, false positive rate, and false negative rate of each of the data sources;

[0240] Determine a quality score of each of the data sources based on a matching rate, a false positive rate, and a false negative rate of each of the data sources;

[0241] Obtain the indicator value of each data, classify the target data with the same indicator value reported by different data sources, and obtain classified data;

[0242] Obtaining a data confidence score for each target data in the classified data;

[0243] Based on the data confidence score of each target data and the quality score of the data source corresponding to each target data, the classification score of the classified data is determined.

[0244] The embodiments of the present disclosure further provide a computer-readable storage medium, which is used to store program codes, and the program codes are used to execute the data processing methods of the aforementioned embodiments.

[0245] The present disclosure also provides a computer program product, which includes a computer program. The processor of a computer device reads and executes the computer program, so that the computer device executes the above-mentioned data processing method. For example:

[0246] Acquire data reported by each of the data sources from at least two data sources;

[0247] Compare the data corresponding to each of the data sources with the data in a preset database to determine the matching rate, false positive rate, and false negative rate of each of the data sources;

[0248] Determine a quality score of each of the data sources based on a matching rate, a false positive rate, and a false negative rate of each of the data sources;

[0249] Obtain the indicator value of each data, classify the target data with the same indicator value reported by different data sources, and obtain classified data;

[0250] Obtaining a data confidence score for each target data in the classified data;

[0251] Based on the data confidence score of each target data and the quality score of the data source corresponding to each target data, the classification score of the classified data is determined.

[0252] In addition, the terms "comprises" and "includes" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or apparatus that includes a series of steps or elements is not necessarily limited to those steps or elements explicitly listed, but may include other steps or elements not explicitly listed or inherent to such process, method, product or apparatus.

[0253] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0254] It should be understood that in the description of the embodiments of the present application, the meaning of multiple (or multiple items) is more than two, greater than, less than, exceed, etc. are understood to not include the number, and above, below, within, etc. are understood to include the number.

[0255] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0256] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0257] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0258] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store program codes.

[0259] It should also be understood that the various implementations provided in the embodiments of the present application can be combined arbitrarily to achieve different technical effects.

[0260] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program with a predetermined function, and works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as processing circuits or memories) or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be part of an overall module or unit that includes the function of the module or unit.

[0261] The above is a specific description of the implementation method of the present application, but the present application is not limited to the above-mentioned implementation method. Technical personnel familiar with the field can also make various equivalent modifications or substitutions without violating the spirit of the present application. These equivalent modifications or substitutions are all included in the scope defined by the claims of the present application.

Claims

1. A data processing method, characterized in that: include: Acquire data reported by each of the data sources from at least two data sources; Compare the data corresponding to each of the data sources with the data in a preset database to determine the matching rate, false positive rate, and false negative rate of each of the data sources; Determine a quality score of each of the data sources based on a matching rate, a false positive rate, and a false negative rate of each of the data sources; Obtain the indicator value of each data, classify the target data with the same indicator value reported by different data sources, and obtain classified data; Obtaining a data confidence score for each target data in the classified data; Based on the data confidence score of each target data and the quality score of the data source corresponding to each target data, the classification score of the classified data is determined.

2. The data processing method according to claim 1, characterized in that: The comparing the data corresponding to each of the data sources with the data in the preset database to determine the matching rate, false alarm rate and missed alarm rate of each of the data sources includes: Obtaining the amount of matching data in the preset database and the amount of false positive data not in the preset database for the data reported by each of the data sources; Acquire the amount of underreported data in the preset database that is not reported by each of the data sources, and obtain the amount of underreported data of each of the data sources; Determine the ratio of the amount of matching data of each data source to the corresponding total amount of reported data to obtain a matching rate of each data source; Determine the ratio of the amount of false positive data of each data source to the corresponding total amount of reported data to obtain the false positive rate of each data source; The ratio of the amount of missed data of each data source to the amount of preset data in the preset database is determined to obtain the missed rate of each data source.

3. The data processing method according to claim 2, characterized in that: Determining the quality score of each data source based on the matching rate, false alarm rate, and missed alarm rate of each data source includes: Calculate a difference between the false alarm rate of the first and the false alarm rate of each of the data sources to obtain a first calculation result of each of the data sources; Calculate a difference between the false negative rate of the first and the false negative rate of each of the data sources to obtain a second calculation result of each of the data sources; Calculate the matching rate corresponding to each of the data sources, the first calculation result, and the product of the first calculation result and the second calculation result to obtain an accuracy score for each of the data sources; Determine the timeliness score of each data source according to the reporting time of the data reported by each data source and the current time; Based on the accuracy score and the corresponding timeliness score of each of the data sources, a quality score of each of the data sources is determined.

4. The data processing method according to claim 3, characterized in that: Determining the timeliness score of each data source according to the reporting time of the data reported by each data source and the current time includes: Obtaining the difference between the reporting time of each data source and the current time, to obtain the reporting time difference of each data source; The timeliness score of each of the data sources is determined based on the reporting time difference of each of the data sources and a preset attenuation factor.

5. The data processing method according to claim 3, characterized in that: Determining the quality score of each data source based on the accuracy score and the corresponding timeliness score of each data source includes: Obtaining the product of the accuracy score of each of the data sources and a preset accuracy weight to obtain the accuracy quality of each of the data sources; Obtaining the product of the accuracy score of each of the data sources and the preset timeliness weight to obtain the timeliness quality of each of the data sources; The sum of the accuracy quality and the corresponding timeliness quality of each of the data sources is determined to obtain a quality score for each of the data sources.

6. The data processing method according to claim 1, characterized in that: The step of obtaining the index value of each data and classifying the target data with the same index value reported by different data sources to obtain classified data includes: Obtain the indicator value of each data, classify the data with the same indicator value reported by different data sources, and record the current classification time; Obtain the common fields included in each common field type in each target data after classification; When the field information included in each general field type between each of the target data is the same, the field information included in each of the general field types is recorded, and the data source, data source quality score, and current classification time of each of the target data are recorded in turn to obtain classified data.

7. The data processing method according to claim 6, characterized in that: The method further comprises: When there is a target universal field type with different field information between each of the target data, determining the credible data with the highest quality score of the corresponding data source; Acquire target field information included in the target general field type in the trusted data; The field information of the general field type with the same field information is recorded, as well as the target field information, and the data source, data source quality score, and current classification time of each target data are recorded in sequence to obtain classified data.

8. The data processing method according to any one of claims 1 to 7, characterized in that: The determining the classification score of the classified data based on the data confidence score of each target data and the quality score of the data source corresponding to each target data includes: Determine the product of the data confidence score of each target data and the quality score of the corresponding data source to obtain the weighted credibility of each target data; Calculating a sum of the third calculation results of the plurality of target data to obtain a total weighted credibility; Obtaining the sum of the quality scores of the data sources corresponding to each of the target data to obtain the total quality score of the data source; The ratio of the total weighted credibility to the total quality score is determined to obtain a classification score for the classified data.

9. A data processing device, characterized in that: include: A first acquisition unit, configured to acquire, from at least two data sources, data reported by each of the data sources; A comparison unit, used to compare the data corresponding to each of the data sources with the data in a preset database, and determine the matching rate, false alarm rate and missed alarm rate of each of the data sources; A first determining unit, configured to determine a quality score of each of the data sources based on a matching rate, a false positive rate, and a false negative rate of each of the data sources; A classification unit is used to obtain the index value of each data, classify the target data with the same index value reported by different data sources, and obtain classified data; A second acquisition unit, used to acquire a data confidence score of each target data in the classified data; The second determining unit is used to determine the classification score of the classified data based on the data confidence score of each target data and the quality score of the data source corresponding to each target data.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor to execute the data processing method according to any one of claims 1 to 8.

11. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the data processing method according to any one of claims 1 to 8 is implemented.

Images