A method for preventing software backup data leakage

Abstract

The present application relates to the field of data security, and specifically discloses a method for preventing software backup data leakage, which uses data processing technology based on deep learning to identify the sensitivity of the backup data segment by segment, so as to protect the sensitive information part in the data in a targeted manner during the data backup process. Specifically, after the backup data is divided into data segments, each data segment is used as an intermediate connection point to divide the backup data into two parts, the front and back parts, and the sensitive attributes of the data segment are determined by comprehensively analyzing the contextual semantic environment of each data segment in the forward data part and the backward data part, so as to divide the backup data into a sensitive data part and a non-sensitive data part according to the determination results of each data segment. In this way, only the sensitive data part can be encrypted during the data backup process, thereby reducing computing overhead while ensuring data security and improving the efficiency and flexibility of data processing.

Description

Technical Field

[0001] The present application relates to the field of data security, and more specifically, to a method for preventing software backup data from being leaked. Background Art

[0002] In today's digital information age, with the widespread application of software systems in various business scenarios, its data security has become the focus of attention for enterprises and individual users. Today, data has become the core asset of enterprises, organizations and even individuals. At the same time, with the continuous growth of business volume and the rapid expansion of data volume, data backup, as a key means to ensure data security, business continuity and disaster recovery, has become increasingly important. Data backup is a key link in ensuring data security and business continuity. It allows data to be restored to its original state or required state in the event of data loss, system failure or other disasters, ensuring the normal operation of enterprises and organizations.

[0003] However, with the frequent data backup operations, the security issues of backup data have become increasingly prominent. Backup data contains a lot of valuable information, and once leaked, it may bring serious security risks to users, enterprises or organizations, including but not limited to privacy leakage, loss of business secrets, economic losses and legal risks.

[0004] In order to protect the security of backup data, existing technologies usually adopt measures such as data encryption and access control to enhance the security of backup data. However, traditional data encryption methods usually adopt a one-size-fits-all encryption strategy to uniformly encrypt all backup data, which not only increases the complexity and computing overhead of the backup and recovery process, but may also cause new security risks due to improper key management. In addition, for large data sets that only contain a small amount of sensitive data, excessive encryption will also reduce the efficiency and flexibility of data processing.

[0005] Therefore, an optimized method to prevent software backup data leakage is expected. Summary of the invention

[0006] In order to solve the above technical problems, the present application is proposed. An embodiment of the present application provides a method for preventing software backup data leakage, which uses a data processing technology based on deep learning to perform sensitivity identification on a data segment-by-data segment basis for the backup data, so as to protect the sensitive information part in the data in a targeted manner during the data backup process. Specifically, after the backup data is divided into data segments, each data segment is used as an intermediate connection point to divide the data to be backed up into two parts, front and back. The sensitive attributes of the data segment are determined by comprehensively analyzing the contextual semantic environment of each data segment in the forward data part and the backward data part, so as to divide the data to be backed up into a sensitive data part and a non-sensitive data part according to the determination results of each data segment. In this way, only the sensitive data part can be encrypted during the data backup process, thereby reducing computing overhead while ensuring data security and improving the efficiency and flexibility of data processing.

[0007] According to one aspect of the present application, a method for preventing software backup data leakage is provided, which includes:

[0008] In response to receiving a backup instruction initiated by a user, performing data scanning on the data to be backed up to obtain a sensitive data portion and a non-sensitive data portion;

[0009] Using an encryption algorithm to encrypt the sensitive data portion to obtain an encrypted sensitive data portion, wherein the encryption key is generated and distributed by a key management system;

[0010] Integrate the encrypted sensitive data portion and the non-sensitive data portion to obtain encrypted backup data;

[0011] The encrypted backup data is stored in a designated storage target, wherein the designated storage target has access control restrictions.

[0012] Compared with the prior art, the method for preventing software backup data leakage provided by the present application adopts a data processing technology based on deep learning to identify the sensitivity of the backup data segment by segment, so as to protect the sensitive information part in the data in a targeted manner during the data backup process. Specifically, after the backup data is divided into data segments, each data segment is used as an intermediate connection point to divide the backup data into two parts, the front and back parts, and the sensitive attributes of the data segment are determined by comprehensively analyzing the contextual semantic environment of each data segment in the forward data part and the backward data part, so as to divide the backup data into a sensitive data part and a non-sensitive data part according to the determination results of each data segment. In this way, only the sensitive data part can be encrypted during the data backup process, thereby reducing computing overhead while ensuring data security and improving the efficiency and flexibility of data processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] By describing the embodiments of the present application in more detail in conjunction with the accompanying drawings, the above and other purposes, features and advantages of the present application will become more apparent. The accompanying drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the present application and do not constitute a limitation of the present application. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0014] Figure 1 The present invention is a flowchart of a method for preventing software backup data leakage according to an embodiment of the present application.

[0015] Figure 2 This is a flowchart of sub-step S1 of the method for preventing software backup data leakage according to an embodiment of the present application.

[0016] Figure 3 Schematic diagram of data flow of sub-step S1 of the method for preventing software backup data leakage according to an embodiment of the present application.

[0017] Figure 4 This is a flowchart of sub-step S14 of the method for preventing software backup data leakage according to an embodiment of the present application.

[0018] Figure 5 This is a flowchart of sub-step S141 of the method for preventing software backup data leakage according to an embodiment of the present application. DETAILED DESCRIPTION

[0019] As shown in this application and claims, unless the context clearly indicates an exception, the words "a", "an", "an" and / or "the" do not refer to the singular and may also include the plural. Generally speaking, the terms "include" and "comprise" only indicate the inclusion of the steps and elements that have been clearly identified, and these steps and elements do not constitute an exclusive list. The method or device may also include other steps or elements.

[0020] Although the present application makes various references to certain modules in the system according to the embodiments of the present application, any number of different modules can be used and run on the user terminal and / or server. The modules are only illustrative, and different aspects of the system and method can use different modules.

[0021] Flowcharts are used in the present application to illustrate the operations performed by the system according to the embodiments of the present application. It should be understood that the preceding or following operations are not necessarily performed accurately in order. On the contrary, various steps may be processed in reverse order or simultaneously as required. Meanwhile, other operations may also be added to these processes, or a certain step or several steps of operations may be removed from these processes.

[0022] Below, the exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application, and it should be understood that the present application is not limited to the exemplary embodiments described here.

[0023] It is worth noting that in this application, all actions to obtain data are carried out in compliance with the relevant data protection laws and policies of the country where the data is located, and with the authorization given by the owner of the corresponding device.

[0024] In response to the technical problems described in the above background technology, the present application proposes a method for preventing software backup data leakage, which uses data processing technology based on deep learning to identify the sensitivity of the backup data segment by segment, so as to protect the sensitive information part in the data in a targeted manner during the data backup process. Specifically, after the backup data is divided into data segments, each data segment is used as an intermediate connection point to divide the backup data into two parts, the front and back parts, and the sensitive attributes of the data segment are determined by comprehensively analyzing the contextual semantic environment of each data segment in the forward data part and the backward data part, so as to divide the backup data into a sensitive data part and a non-sensitive data part according to the determination results of each data segment. In this way, only the sensitive data part can be encrypted during the data backup process, thereby reducing computing overhead while ensuring data security and improving the efficiency and flexibility of data processing.

[0025] Figure 1 Flow chart of a method for preventing software backup data leakage according to an embodiment of the present application. Figure 1 As shown, the method for preventing software backup data leakage includes the following steps: S1, in response to receiving a backup instruction initiated by a user, scanning the data to be backed up to obtain a sensitive data part and a non-sensitive data part; S2, encrypting the sensitive data part using an encryption algorithm to obtain an encrypted sensitive data part, wherein an encryption key is generated and distributed by a key management system; S3, integrating the encrypted sensitive data part and the non-sensitive data part to obtain encrypted backup data; S4, storing the encrypted backup data in a designated storage target, wherein the designated storage target has access control restrictions.

[0026] In the above-mentioned method for preventing software backup data leakage, the step S1, in response to receiving a backup instruction initiated by the user, performs a data scan on the data to be backed up to obtain the sensitive data part and the non-sensitive data part. It should be understood that the data processed by modern software systems is large in scale and complex in type. In the data backup process, if the same high-intensity protection strategy is adopted for all data, it will greatly consume system resources and time costs. In fact, some data has low sensitivity, and over-protection of it is unnecessary and will reduce backup efficiency. Therefore, the present application helps to implement targeted data protection strategies by identifying sensitive data fields in the data to be backed up, which effectively improves data processing efficiency and reasonably allocates system resources while ensuring data security. Among them, Figure 2 This is a flowchart of sub-step S1 of the method for preventing software backup data leakage according to an embodiment of the present application. Figure 3 FIG. 1 is a data flow diagram of sub-step S1 of the method for preventing software backup data leakage according to an embodiment of the present application. Figure 2 and Figure 3 As shown, the step S1 includes the steps of: S11, segmenting the backup data to obtain a sequence distribution of a backup data segment text description; S12, extracting a first backup data segment text description from the sequence distribution of the backup data segment text description, and using the first backup data segment text description as an anchor point to divide the sequence distribution of the backup data segment text description into a forward sequence distribution part of the backup data segment text description and a backward sequence distribution part of the backup data segment text description; S13, contextually encoding the forward sequence distribution part of the backup data segment text description and the backward sequence distribution part of the backup data segment text description to obtain a first backup data segment text forward contextual semantic encoding vector and a first backup data segment text backward contextual semantic encoding vector; S14, performing attention-driven semantic interaction response encoding on the first backup data segment text forward contextual semantic encoding vector and the first backup data segment text backward contextual semantic encoding vector to obtain a first backup data segment text bidirectional contextual interaction semantic encoding vector; S15, identifying whether the first backup data segment text description belongs to a sensitive data part or a non-sensitive data part based on the first backup data segment text bidirectional contextual interaction semantic encoding vector.

[0027] Specifically, in step S11, the backup data is segmented to obtain a sequence distribution of the text description of the backup data segment. Specifically, in order to analyze the information content of the backup data more carefully, the present application first segments the backup data to decompose the complex and large backup data into smaller data units that are easier to process and analyze, forming a sequence distribution of the text description of the backup data segment, so as to facilitate targeted semantic analysis of each data segment, thereby identifying the sensitive information that may be contained therein.

[0028] In order to implement segmented processing of backup data, you first need to define data segments. A data segment can be the smallest independently processable data unit divided according to data type, structural characteristics or content attributes. For example, in a relational database, a data segment may be a row of records in a table or a specific field; in an unstructured data environment, such as a document or multimedia file, a data segment may correspond to a piece of text, a picture or a video clip. After determining the concept of data segments, you need to build a set of rules to guide how to scan and cut the original data to be backed up to form a series of orderly arranged data segment sets.

[0029] When the data begins to be scanned, the algorithm will traverse the entire data set and apply preset pattern matching to identify which parts contain sensitive information. During this process, the system uses advanced natural language processing technology, image recognition capabilities, and rule-based detection mechanisms to ensure that all potentially sensitive content can be accurately captured. Once the location of sensitive data is determined, the next step is to split the data stream according to established standards to create discrete but related data segments. It is worth noting that the emphasis here is on maintaining the logical connection between the original data. Even after segmentation, the various data segments still maintain a certain form of continuity, which helps in efficient reorganization in subsequent steps.

[0030] In the process of generating data segments, the data size and processing efficiency should also be considered. If a single data segment is too large, it will affect the encryption speed and increase the transmission burden; on the contrary, if it is too fragmented, it may lead to increased management complexity and be unfavorable for long-term maintenance. Therefore, it is particularly important to reasonably set the maximum capacity limit of each data segment. In addition, considering that different types of data (such as text, numbers, dates, etc.) may be suitable for different compression ratios and encoding methods, a certain degree of flexibility should be allowed so that the system can adjust the size of the data segment according to the specific situation.

[0031] After the initial segmentation is completed, the next step is to number and label each data segment, giving each segment a unique identity identifier. These identifiers not only help establish a clear sequence of data segments, but also facilitate tracking and auditing purposes. At the same time, for sensitive data segments, additional labels are added to indicate special protection requirements, such as "encryption required", "high confidentiality level", etc. For non-sensitive data segments, you can choose whether to attach the same level of labels according to the actual application scenario, or simplify the processing and only retain basic index information.

[0032] Finally, all the prepared data segments will be arranged and combined in a certain order to form the final sequence distribution. This sequence is not randomly arranged, but the result of careful arrangement based on the original data structure and logical relationship. In this way, even in the case of decentralized storage, the location of any data segment can still be quickly located by referring to the pre-set mapping table, thereby achieving efficient retrieval and recovery. Moreover, since it is clear in advance which parts belong to the category of sensitive information, it is possible to implement enhanced security policies for those key areas separately without affecting the overall performance, such as adopting higher-level encryption algorithms or stricter access control measures, so as to achieve the purpose of optimizing resource allocation while maximizing data security.

[0033] Specifically, in step S12, the first backup data segment text description is extracted from the sequence distribution of the backup data segment text description, and the sequence distribution of the backup data segment text description is divided into a forward sequence distribution part of the backup data segment text description and a backward sequence distribution part of the backup data segment text description using the first backup data segment text description as an anchor point. Here, the present application further utilizes the contextual semantic information of the sequence distribution of the backup data segment text description, and identifies the sensitive attributes of the backup data segment text description by performing forward and backward context perception on each backup data segment text description. Specifically, in the present application, taking the first backup data segment text description as an example, it is used as an anchor point to perform sequence division on the sequence distribution of the backup data segment text description, so as to be divided into a forward sequence distribution part of the backup data segment text description and a backward sequence distribution part of the backup data segment text description. Among them, the last backup data segment text description in the forward sequence distribution part of the backup data segment text description is the first backup data segment text description; the first backup data segment text description in the backward sequence distribution part of the backup data segment text description is the first backup data segment text description. In this way, the text description of the first backup data segment, as the connection and intersection of its forward data part and backward data part, can fully perceive and utilize its forward and backward contextual semantic information, so as to more accurately judge its sensitive attributes.

[0034] Specifically, in a specific example of the present application, the step S13 includes: inputting the forward sequence distribution part of the backup data segment text description and the backward sequence distribution part of the backup data segment text description into a context encoder including a Bert model and a forward LSTM respectively to obtain the forward context semantic encoding vector of the first backup data segment text and the backward context semantic encoding vector of the first backup data segment text. It should be understood that in order to achieve accurate semantic understanding of the forward sequence distribution part of the backup data segment text description and the backward sequence distribution part of the backup data segment text description, the present application further uses a context encoder including a Bert model and a forward LSTM to extract semantic features from the two, to construct the forward context semantic environment and the backward context semantic environment of the first backup data segment text description, and obtain the forward context semantic encoding vector of the first backup data segment text and the backward context semantic encoding vector of the first backup data segment text. A person of ordinary skill in the art should know that the Bert model is a powerful pre-trained language model, which is based on a bidirectional Transformer structure and can deeply understand the contextual semantic information of the text. The forward LSTM (Long Short-Term Memory) is a special recurrent neural network that is good at capturing long-term dependencies in sequence information. In the technical solution of the present application, first, the Bert model is used to semantically encode the text descriptions of each backup data segment in the input sequence distribution part, so as to use the pre-trained language knowledge and bidirectional Transformer structure of the Bert model to capture the semantic information of each backup data segment text description and obtain the contextual embedding representation of each backup data segment text description. Then, according to the position order of each backup data segment text description in the sequence distribution part, the obtained contextual embedding representation is sequentially input into the LSTM model, so as to use the cyclic structure and long-term memory capacity of the LSTM to further extract semantic features and integrate global context information of the sequence distribution of the contextual embedding representation of the input backup data segment text description, so as to obtain the overall contextual semantic feature representation of the sequence distribution part, that is, the forward contextual semantic encoding vector of the first backup data segment text and the backward contextual semantic encoding vector of the first backup data segment text.

[0035] Specifically, the step S14 performs attention-driven semantic interaction response encoding on the forward context semantic encoding vector of the first backup data segment text and the backward context semantic encoding vector of the first backup data segment text to obtain the bidirectional context interaction semantic encoding vector of the first backup data segment text. It should be understood that the sensitivity of a data segment cannot be judged only by its own content, but also needs to be combined with the semantic environment of its context. For example, a seemingly ordinary data segment "1234567890", if its forward content is "Please enter your password:", and the backward content is "Password verification successful", then combined with the context, it can be seen that the data segment is sensitive; if its context is an insignificant description, then the data segment is likely to be non-sensitive. In other words, for the sensitivity identification of the first backup data segment, considering the forward or backward context semantic features alone can only obtain one-sided information, and it is also necessary to integrate its bidirectional connection with the surrounding information. Therefore, the present application further performs interactive fusion processing on the forward context semantic encoding vector of the first backup data segment text and the backward context semantic encoding vector of the first backup data segment text, and introduces a bidirectional attention mechanism to focus on the important semantic association parts between the forward and backward context semantic information, thereby achieving a comprehensive and in-depth semantic understanding of the first backup data segment text description. Figure 4 FIG. 4 is a flowchart of sub-step S14 of the method for preventing software backup data leakage according to an embodiment of the present application. Figure 4 As shown, the step S14 includes the steps of: S141, constructing a bidirectional attention field between the forward context semantic coding vector of the first backup data segment text and the backward context semantic coding vector of the first backup data segment text to obtain the forward and backward context semantic positive attention score field of the first backup data segment text and the forward and backward context semantic reverse attention score field of the first backup data segment text; S142, performing attention balance modulation on the forward and backward context semantic positive attention score field of the first backup data segment text and the forward and backward context semantic reverse attention score field of the first backup data segment text to obtain the forward and backward context semantic positive and negative bidirectional attention balance field of the first backup data segment text; S143, based on the forward and backward context semantic positive and negative bidirectional attention balance field of the first backup data segment text, performing semantic mapping interactive response analysis on the forward context semantic coding vector of the first backup data segment text and the backward context semantic coding vector of the first backup data segment text to obtain the first backup data segment text bidirectional context interactive semantic coding vector.

[0036] Figure 5 FIG. 4 is a flowchart of sub-step S141 of the method for preventing software backup data leakage according to an embodiment of the present application. Figure 5As shown, the step S141 includes the steps of: S1411, performing homography projection transformation on the forward context semantic coding vector of the first backup data segment text and the backward context semantic coding vector of the first backup data segment text to obtain the first backup data segment text forward context semantic homography projection coding vector and the first backup data segment text backward context semantic homography projection coding vector; S1412, calculating the forward attention score field of the first backup data segment text forward context semantic homography projection coding vector relative to the first backup data segment text backward context semantic homography projection coding vector to obtain the forward and backward context semantic forward attention score field of the first backup data segment text; S1413, calculating the reverse attention score field of the first backup data segment text backward context semantic homography projection coding vector relative to the first backup data segment text forward context semantic homography projection coding vector to obtain the forward and backward context semantic reverse attention score field of the first backup data segment text.

[0037] In a specific example of the present application, the step S1411 is expressed by the formula:

[0038]

[0039]

[0040] in, represents the forward context semantic encoding vector of the first backup data segment text, represents the backward context semantic encoding vector of the first backup data segment text, and are different homography projection matrices, and They respectively represent the forward context semantic homography projection coding vector of the first backup data segment text and the backward context semantic homography projection coding vector of the first backup data segment text.

[0041] That is, the forward context semantic coding vector of the first backup data segment text and the backward context semantic coding vector of the first backup data segment text are transformed by homography projection, and the two are mapped to the same feature space. In this way, in the same feature space, the feature distance and semantic relationship of the two vectors are easier to compare and analyze, which can effectively promote semantic interaction.

[0042] In a specific example of the present application, step S1412 is expressed by the formula:

[0043]

[0044] in, represents the transpose of a vector, represents the matrix multiplication operation, is the attention score scaling factor, Represents the forward and backward context semantics positive attention score field of the first backup data segment text.

[0045] That is, in this way, we can clarify the importance of each part of the feature information when the forward context semantic features interact with the backward context semantic features, and then generate the attention weight distribution, that is, the forward attention score field. In this way, in the subsequent semantic interaction process, we can accurately focus on the key feature parts in the forward context information that are closely related to the backward context information.

[0046] In a specific example of the present application, step S1413 is expressed by the formula:

[0047]

[0048] in, Represents the forward and backward context semantic reverse attention score field of the first backup data segment text.

[0049] That is, similar to the calculation method of the forward attention score field in step S1412, the reverse attention score field calculation is carried out from the perspective of the backward context information. Through this operation, the backward context semantic feature part closely related to the forward context information is reversely found.

[0050] More specifically, the step S142 is expressed by the formula:

[0051]

[0052] in, Indicates cascade, Represents the forward and backward context semantics of the first backup data segment text, the forward and backward bidirectional attention balance field, Representation 3 3 convolution operations.

[0053] That is, in order to ensure that the association between forward and backward context semantic information can be captured in all directions during the final semantic interaction, the present application further constructs a forward and backward context semantic positive and negative bidirectional attention balance field for the text of the first backup data segment, comprehensively considering the forward and backward attention information to prevent excessive emphasis on one side or omission of important information during semantic interaction encoding, so as to make the semantic association interaction relationship between the forward and backward context information more balanced.

[0054] More specifically, the step S143 includes: first, mapping the first backup data segment text forward context semantic homography projection coding vector and the first backup data segment text backward context semantic homography projection coding vector to the first backup data segment text forward and backward context semantics forward and reverse bidirectional attention balance field to obtain the first backup data segment text forward context semantic homography projection attention modulation coding vector and the first backup data segment text backward context semantic homography projection attention modulation coding vector, which are expressed by the formula:

[0055]

[0056]

[0057] in, and Respectively represent the first backup data segment text forward context semantic homography projection attention modulation coding vector and the first backup data segment text backward context semantic homography projection attention modulation coding vector;

[0058] Then, the first backup data segment text bidirectional context interaction semantic coding vector is obtained by dividing the first backup data segment text forward context semantic homography projection attention modulation coding vector and the first backup data segment text backward context semantic homography projection attention modulation coding vector by the position point, which is expressed as:

[0059]

[0060] in, A bidirectional context interaction semantic encoding vector representing the text of the first backup data segment.

[0061] That is, the forward context semantic coding vector of the first backup data segment text and the backward context semantic coding vector of the first backup data segment text transformed by homography projection are respectively projected into the forward and backward context semantics forward and backward bidirectional attention balance field of the first backup data segment text, and the feature representation of the forward and backward coding vectors is adjusted in a targeted manner according to the distribution of the weights of the forward and backward bidirectional attention, so that the feature representations with significant correlations with each other can be effectively enhanced in the final semantic interaction coding link; and the feature representations with weak correlations are weakened accordingly. In this way, it is possible to more efficiently and accurately focus on the key semantic association parts between the forward and backward context semantic information, thereby obtaining the forward context semantic homography projection attention modulation coding vector of the first backup data segment text and the backward context semantic homography projection attention modulation coding vector of the first backup data segment text. Then, by means of position-by-position point division operations, the semantic interaction coding of the forward context semantic homography projection attention modulation coding vector of the first backup data segment text and the backward context semantic homography projection attention modulation coding vector of the first backup data segment text are performed element by element to obtain the first backup data segment text bidirectional context interaction semantic coding vector that integrates the bidirectional context semantic information. In this way, not only the semantic information contained in the data segment itself is fully considered, but also the semantic environment constructed by its context and the existing semantic associations are cleverly integrated, so that the final coding vector can more accurately and comprehensively reflect the sensitivity and contextual connection of the data segment.

[0062] Specifically, in a specific example of the present application, the step S15 includes: inputting the first backup data segment text bidirectional context interaction semantic coding vector into a data type identifier based on a classifier to obtain a recognition result, and the recognition result is used to indicate that the first backup data segment text description belongs to the sensitive data part or the non-sensitive data part. Specifically, the first backup data segment text bidirectional context interaction semantic coding vector is input into the data type identifier based on a classifier to obtain a recognition result, including: using the fully connected layer of the data type identifier to fully connect the first backup data segment text bidirectional context interaction semantic coding vector to obtain the first backup data segment text bidirectional context interaction semantic fully connected coding vector; inputting the first backup data segment text bidirectional context interaction semantic fully connected coding vector into the Softmax classification function of the data type identifier to obtain the probability value of the first backup data segment text bidirectional context interaction semantic coding vector belonging to each classification label, wherein the classification label includes the first backup data segment text description belonging to the sensitive data part and the first backup data segment text description not belonging to the sensitive data part; the classification label corresponding to the largest of the probability values ​​is determined as the recognition result. Specifically, during the training process, the classifier uses a large amount of training data to learn the characteristic differences between sensitive data and non-sensitive data, and optimizes the parameters of the classifier through continuous iteration to improve the accuracy and reliability of identifying the sensitivity of the data segment. During the identification process, the classifier learns the characteristic information of the bidirectional context interaction semantic encoding vector of the text of the first backup data segment to comprehensively consider the semantic characteristics of the data segment itself and its semantic association with the context, thereby achieving accurate judgment of the sensitivity of the data segment.

[0063] Here, when the forward context semantic coding vector of the first backup data segment text and the backward context semantic coding vector of the first backup data segment text respectively represent the forward context semantic coding features of the first backup data segment text description and the backward context semantic coding features of the first backup data segment text description, when performing an interactive response based on feature positive and negative attention fields, the insufficient correspondence between the positive and negative attention fields caused by the semantic difference in the source data context coding will cause the feature manifold of the first backup data segment text bidirectional context interactive semantic coding vector to have a feature sharpening frame, thereby affecting the accuracy of the recognition result obtained by its input based on the classifier's data type identifier due to the suppression effect of the feature likelihood.

[0064] In a preferred example, in the process of inputting the first backup data segment text bidirectional context interaction semantic coding vector into a classifier-based data type identifier to obtain a recognition result, the first backup data segment text bidirectional context interaction semantic coding vector is subjected to feature manifold modulation, and the modulation process includes:

[0065] The probability replacement unit is applied to perform chaotic sequence reorganization on the first backup data segment text bidirectional context interaction semantic coding vector to generate a backup data segment text semantic feature chaotic coding tensor, which is expressed as ,in, represents the bidirectional context interaction semantic encoding vector of the first backup data segment text, is the probability permutation operator, represents matrix multiplication, Represents the chaotic code of the semantic features of the backup data segment text;

[0066] The normed complete space coding architecture is constructed by geometric product operation of the bidirectional context interaction semantic coding vector of the first backup data segment text, which is expressed as: ,in, a transposed vector representing the bidirectional context interaction semantic encoding vector of the first backup data segment text, Represents the normed complete space encoding architecture;

[0067] The backup data segment text semantic feature chaotic coding tensor is spatially embedded with the normed complete space coding architecture to generate a backup data segment text semantic feature metric correlation non-balanced coding tensor, which is expressed as: ,in, Represents the non-balanced coding tensor of the semantic feature measurement correlation of the backup data segment text;

[0068] The morphological fractal analysis is performed on the dual tensor of the backup data segment text semantic feature metric correlation unbalanced coding tensor and the first backup data segment text bidirectional context interaction semantic coding vector to obtain the backup data segment text semantic feature unbalanced topological architecture, which is expressed as: ,in, Before retaining The truncated decomposition of singular values, Represents the unbalanced topology architecture of the textual semantic features of the backup data segment;

[0069] The first backup data segment text bidirectional context interaction semantic encoding vector is spatially fused with the backup data segment text semantic feature non-balanced topological architecture to output an optimized first backup data segment text bidirectional context interaction semantic encoding vector, which is expressed as: ,in, Represents the optimized bidirectional context interaction semantic encoding vector of the first backup data segment text.

[0070] In this way, by implementing chaotic sequence reorganization on the bidirectional contextual interaction semantic coding vector of the first backup data segment text through the probability replacement unit, and embedding it into the normed complete space defined by the geometric product operation, the analytical modeling of the metric correlation of the feature set in the non-equilibrium topological architecture can be realized. Based on this, the non-equilibrium topological architecture of the feature space is constructed using dual tensor replacement, and the low-dimensional manifold is spatially reconstructed in combination with morphological fractal analysis to avoid the suppression effect of the feature sharpening framework on the feature likelihood. In this way, the accuracy of the recognition result obtained by the data type identifier based on the classifier of the bidirectional contextual interaction semantic coding vector input of the first backup data segment text is improved.

[0071] In the above method for preventing software backup data leakage, in step S2, the sensitive data portion is encrypted using an encryption algorithm to obtain an encrypted sensitive data portion, wherein the encryption key is generated and distributed by a key management system. It should be understood that the encryption algorithm is based on complex mathematical principles and operation rules, and uses a specific key to perform a series of transformations on the original data (plaintext) to convert it into unreadable ciphertext, thereby protecting sensitive data and ensuring that even if the data is intercepted during transmission or storage, the attacker cannot easily obtain the true content of the original data.

[0072] First, before deciding which encryption algorithm to use, you must fully evaluate the characteristics and applicable scenarios of different algorithms. For data that needs to be encrypted, symmetric encryption algorithms or asymmetric encryption algorithms are usually considered. Symmetric encryption algorithms use the same key for encryption and decryption operations. The advantage is that they are fast and suitable for processing large amounts of data. Asymmetric encryption algorithms use a pair of public and private keys for encryption and decryption, where the public key is used for encryption and the private key is used for decryption. This method provides higher security and is especially suitable for small-scale data transmission or key exchange scenarios. According to actual needs, you can choose well-known algorithms such as AES (Advanced Encryption Standard) and RSA (Rivest-Shamir-Adleman), or other more professional encryption solutions.

[0073] After selecting the appropriate encryption algorithm, the next step is to implement the specific encryption process. The core task of this stage is to convert the identified sensitive data into an unreadable form, which is called "encryption". In this process, sensitive data is mapped to a seemingly random string through specific mathematical operations, and only the party with the correct decryption key can restore the original content. In order to ensure the strength of encryption, the selected algorithm should have sufficient bit length and complexity to prevent brute force attacks. At the same time, considering performance factors, it is also necessary to optimize the algorithm execution efficiency to ensure that it does not affect normal business processes.

[0074] Before the encryption operation begins, an important prerequisite is to prepare the keys required for encryption. This introduces the concept of a key management system (KMS). KMS is responsible for creating, managing, and protecting encryption keys to ensure security throughout the entire life cycle. When the system receives an encryption request, KMS automatically generates a set of fresh and unique keys based on preset rules. In order to enhance security, the key generation process often combines multiple factors, such as timestamps, random number seeds, hardware feature codes, etc., making the generated keys highly unpredictable and unique. In addition, KMS also records key-related information, such as creation time, purpose description, etc., to facilitate future audit tracking.

[0075] In the above method for preventing software backup data leakage, the step S3 integrates the encrypted sensitive data part and the non-sensitive data part to obtain encrypted backup data. It should be understood that storing sensitive data and non-sensitive data separately will not only increase the complexity of storage management, but may also cause data consistency and integrity problems during data recovery. Integrating the two into one file facilitates overall operation of data during backup, storage and recovery, and improves the convenience and efficiency of data management.

[0076] First, before data integration, all data segments to be integrated need to be preprocessed. For sensitive data segments, these encrypted data may have been converted to a specific encoding format, such as Base64 encoding, to meet transmission or storage requirements. At this time, it should be ensured that all sensitive data segments use a unified encoding method to avoid integration failures due to format differences. For non-sensitive data segments, it is determined based on actual conditions whether any form of conversion or compression is required to optimize the size and performance of the final output file.

[0077] When ready, start inserting sensitive and non-sensitive data segments into the target container one by one according to the established rules. The target container mentioned here refers to the data structure used to hold the entire encrypted backup data, which may be a database table, file system directory or other form of storage unit. No matter which container type is chosen, it is necessary to ensure that it has sufficient flexibility to support mixed storage of different types of data segments and provide necessary metadata support, such as timestamps, version numbers and other additional information for auxiliary management and tracking purposes.

[0078] During the integration process, special attention should be paid to maintaining the logical continuity and integrity between data segments. This means that even if some sensitive data segments are encrypted, the consistency of the overall data flow should not be destroyed. To this end, the system will add additional connectors or placeholders when necessary to indicate the special relationship between adjacent data segments. For example, identifiers can be added before and after sensitive data segments to indicate that this part of the content has been encrypted; or a unique number can be assigned to each data segment to build a clear data link to facilitate later parsing and retrieval.

[0079] In addition, considering the possible data recovery scenarios in the future, a detailed index file should be generated during the integration phase. This index file includes but is not limited to the following key information: the specific location of each data segment, the category (sensitive / non-sensitive), the encryption algorithm used and related parameters, key identification, etc. The existence of the index file enables the required data segment to be quickly located even in the face of large and complex data sets, and then targeted operations can be implemented. More importantly, this file itself is also strictly protected and can only be accessed by authorized users to prevent the leakage of important information.

[0080] In the above method for preventing software backup data leakage, the step S4 stores the encrypted backup data in a designated storage target, wherein the designated storage target has access control restrictions. Specifically, the access control mechanism is based on the principles of user authentication and authority management. User authentication confirms the identity of the user by verifying the credentials provided by the user (such as user name and password, digital certificate, etc.). Authority management assigns different access rights to users, such as read, write, delete, etc., based on factors such as the user's role and responsibilities. Only when the user passes the identity authentication and the authority he possesses meets the access requirements for the storage target can the data stored therein be operated accordingly. For example, in a storage system within an enterprise, ordinary employees may only be granted read access to certain non-sensitive data, while administrators have read and write access to all data.

[0081] First, when choosing a suitable storage target, you need to evaluate different types of storage solutions based on actual needs. For local environments, this may involve dedicated servers, network-attached storage (NAS) or direct-attached storage (DAS). In the cloud, there are a variety of public cloud service providers that provide object storage, block storage and file storage options. No matter which method you choose, you should ensure that the selected platform has sufficient scalability, performance level and security to meet long-term data preservation requirements. At the same time, considering the cost-effectiveness ratio, you should also analyze the investment in procurement, maintenance and operation of different solutions to make the best choice.

[0082] After selecting the storage target, the next step is to implement strict access control measures. Access control restrictions are designed to prevent unauthorized entities from accessing sensitive information and ensure that only operations that are properly authenticated and authorized can be performed. To this end, a multi-level security protection system is usually established to comprehensively protect the storage system from the physical level to the application level. For example, physical security equipment such as access control systems and surveillance cameras are installed on hardware facilities; technical means such as firewalls, intrusion detection systems (IDS), and virtual private networks (VPNs) are deployed at the network level; and in the operating system and server-side software, functions such as user authentication and role permission allocation are enabled to build a solid line of defense.

[0083] In order to further strengthen the access control effect, it is also necessary to introduce fine-grained permission management strategies. This means not only distinguishing the differences in access rights between different user groups, but also refining them to the specific file or directory level, and even setting independent read and write permissions for individual data segments. In this way, even within the same storage space, access rules can be flexibly adjusted according to the importance, sensitivity and purpose of different data. In addition, using additional conditions such as timestamps and IP address restrictions can more accurately control what types of operations are allowed when and where, greatly reducing potential risks.

[0084] In addition to statically configuring access control lists (ACLs), dynamic access control cannot be ignored. As business develops and technology advances, the original settings may gradually become inapplicable, so it is necessary to establish a continuously updated and improved permission management system. This includes regularly reviewing the existing permission allocation, deleting expired accounts or unnecessary permissions in a timely manner; adjusting defense strategies based on the latest security threat intelligence; and taking emergency measures in response to emergencies. At the same time, simplifying the permission management process through automated tools can improve work efficiency while reducing the possibility of human errors.

[0085] Before the encrypted backup data is actually stored in the specified storage target, a series of preprocessing steps need to be performed. The first is formatting preparation, that is, the necessary conversion and organization of the data according to the requirements of the storage system to ensure that it meets the specific structural specifications. Next is integrity verification, which verifies the accuracy of the data transmission process by calculating hash values ​​or other checksums to avoid data corruption caused by factors such as network fluctuations. Then there is metadata association, which adds descriptive information to each backup, such as creation time, source system identification, etc., to facilitate subsequent retrieval and management. Finally, indexing is established to create a quick search table to help users efficiently locate the required resources.

[0086] Once all preparations are completed, you can start uploading the encrypted backup data to the designated storage target. During this period, closely monitor the entire transmission process to ensure that the data flow is stable and reliable, and record the progress status in real time. For large-capacity data sets, it is recommended to adopt a batch upload strategy, which can not only reduce the instantaneous load pressure, but also better deal with possible problems. When all data is successfully stored, a comprehensive audit is immediately triggered to check whether the established process is strictly followed and confirm that no important links are missed.

[0087] In summary, a method for preventing software backup data leakage based on an embodiment of the present application is explained, which uses a data processing technology based on deep learning to perform sensitivity identification on a data segment-by-data segment basis for the data to be backed up, so as to protect the sensitive information part in the data in a targeted manner during the data backup process. Specifically, after the data to be backed up is divided into data segments, each data segment is used as an intermediate connection point to divide the data to be backed up into two parts, a front and a back part, and the sensitive attributes of the data segment are determined by comprehensively analyzing the contextual semantic environment of each data segment in the forward data part and the backward data part, thereby dividing the data to be backed up into a sensitive data part and a non-sensitive data part according to the determination results of each data segment. In this way, only the sensitive data part can be encrypted during the data backup process, thereby reducing computing overhead while ensuring data security and improving the efficiency and flexibility of data processing.

[0088] The basic principle of the present invention is described above in conjunction with specific embodiments. However, it should be pointed out that the advantages, strengths, effects, etc. mentioned in the present invention are only examples and not limitations, and it cannot be considered that these advantages, strengths, effects, etc. must be possessed by each embodiment of the present invention. In addition, the specific details of the above embodiments are only for the purpose of illustration and facilitation of understanding, rather than limitation, and the above details do not limit the present invention to being implemented by adopting the above specific details.

[0089] In the above embodiments, the description of each embodiment has its own emphasis. For the parts that are not described or recorded in detail in a certain embodiment, please refer to the relevant description of other embodiments. In the several embodiments provided by the present invention, it should be understood that the disclosed system and method can be implemented in other ways. For example, the system embodiment described above is only schematic. For example, the unit division is only a logical function division, and there may be other division methods in actual implementation. The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the scheme of this embodiment.

[0090] It will be apparent to those skilled in the art that the invention is not limited to the details of the exemplary embodiments described above and that the invention can be implemented in other specific forms without departing from the spirit or essential features of the invention. Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description, and it is intended that all variations falling within the meaning and scope of the equivalent elements of the claims be included in the invention. Any reference to a figure in a claim should not be considered as limiting the claim to which it relates.

[0091] In addition, it is obvious that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. The multiple units stated in the system claims can also be implemented by one unit through software or hardware.

[0092] Finally, it should be noted that the above description has been given for the purpose of illustration and description. In addition, the above embodiments are only used to illustrate the technical solution of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that the technical solution of the present invention can be modified or replaced by equivalents without departing from the spirit and scope of the technical solution of the present invention.

Claims

1. A method for preventing software backup data leakage, characterized in that: include: In response to receiving a backup instruction initiated by a user, performing data scanning on the data to be backed up to obtain a sensitive data portion and a non-sensitive data portion; Using an encryption algorithm to encrypt the sensitive data portion to obtain an encrypted sensitive data portion, wherein the encryption key is generated and distributed by a key management system; Integrate the encrypted sensitive data portion and the non-sensitive data portion to obtain encrypted backup data; storing the encrypted backup data in a designated storage target, wherein the designated storage target has access control restrictions; In response to receiving a backup instruction initiated by a user, performing data scanning on the data to be backed up to obtain a sensitive data portion and a non-sensitive data portion, including: Segmenting the backup data to obtain a sequence distribution of backup data segment text descriptions; Extracting a first backup data segment text description from the sequence distribution of the backup data segment text description, and dividing the sequence distribution of the backup data segment text description into a forward sequence distribution part of the backup data segment text description and a backward sequence distribution part of the backup data segment text description with the first backup data segment text description as an anchor point; Performing context semantic coding on the forward sequence distribution part of the backup data segment text description and the backward sequence distribution part of the backup data segment text description respectively to obtain a first backup data segment text forward context semantic coding vector and a first backup data segment text backward context semantic coding vector; The forward context semantic coding vector of the first backup data segment text and the backward context semantic coding vector of the first backup data segment text are subjected to attention-driven semantic interaction response coding to obtain the first backup data segment text bidirectional context interaction semantic coding vector, wherein the forward context semantic coding vector of the first backup data segment text and the backward context semantic coding vector of the first backup data segment text transformed by homography projection are respectively projected into the forward and backward context semantics positive and negative bidirectional attention balance field of the first backup data segment text, and according to the distribution of positive and negative bidirectional attention weights, the feature representation of the forward and backward coding vectors is adjusted in a targeted manner so that the feature representations with significant correlation with each other are used in the final language processing. The semantic interaction coding link can be effectively enhanced; and the feature representation with weak correlation is weakened accordingly to obtain the first backup data segment text forward context semantic homography projection attention modulation coding vector and the first backup data segment text backward context semantic homography projection attention modulation coding vector, and then, by means of position-by-position point division operation, the first backup data segment text forward context semantic homography projection attention modulation coding vector and the first backup data segment text backward context semantic homography projection attention modulation coding vector are subjected to element-by-element semantic interaction coding to obtain the first backup data segment text bidirectional context interaction semantic coding vector which integrates bidirectional context semantic information; Based on the bidirectional context interaction semantic encoding vector of the first backup data segment text, it is identified that the first backup data segment text description belongs to the sensitive data part or the non-sensitive data part.

2. The method for preventing software backup data leakage according to claim 1, characterized in that: The last backup data segment text description in the forward sequence distribution part of the backup data segment text description is the first backup data segment text description; the first backup data segment text description in the backward sequence distribution part of the backup data segment text description is the first backup data segment text description.

3. The method for preventing software backup data leakage according to claim 2, characterized in that: The forward sequence distribution part of the backup data segment text description and the backward sequence distribution part of the backup data segment text description are respectively context-semantically encoded to obtain a first backup data segment text forward context-semantically encoded vector and a first backup data segment text backward context-semantically encoded vector, including: The forward sequence distribution part of the backup data segment text description and the backward sequence distribution part of the backup data segment text description are respectively input into a context encoder including a Bert model and a forward LSTM to obtain a forward context semantic encoding vector of the first backup data segment text and a backward context semantic encoding vector of the first backup data segment text.

4. The method for preventing software backup data leakage according to claim 3, characterized in that: Performing attention-driven semantic interaction response encoding on the forward context semantic encoding vector of the first backup data segment text and the backward context semantic encoding vector of the first backup data segment text to obtain a first backup data segment text bidirectional context interaction semantic encoding vector, including: Constructing a bidirectional attention field between the forward context semantic encoding vector of the first backup data segment text and the backward context semantic encoding vector of the first backup data segment text to obtain a forward and backward context semantic positive attention score field of the first backup data segment text and a forward and backward context semantic reverse attention score field of the first backup data segment text; Performing attention balance modulation on the forward and backward context semantics positive attention score field of the first backup data segment text and the forward and backward context semantics negative attention score field of the first backup data segment text to obtain the forward and backward context semantics positive and negative bidirectional attention balance field of the first backup data segment text; Based on the forward and backward context semantics positive and negative bidirectional attention balance field of the first backup data segment text, a semantic mapping interactive response analysis is performed on the forward context semantic coding vector of the first backup data segment text and the backward context semantic coding vector of the first backup data segment text to obtain the bidirectional context interactive semantic coding vector of the first backup data segment text.

5. The method for preventing software backup data leakage according to claim 4, characterized in that: Constructing a bidirectional attention field between the forward context semantic encoding vector of the first backup data segment text and the backward context semantic encoding vector of the first backup data segment text to obtain a forward and backward context semantic forward attention score field of the first backup data segment text and a forward and backward context semantic reverse attention score field of the first backup data segment text, including: Performing homography projection transformation on the forward context semantic coding vector of the first backup data segment text and the backward context semantic coding vector of the first backup data segment text to obtain a first backup data segment text forward context semantic homography projection coding vector and a first backup data segment text backward context semantic homography projection coding vector; Calculate the forward attention score field of the forward context semantic homography projection coding vector of the first backup data segment text relative to the backward context semantic homography projection coding vector of the first backup data segment text to obtain the forward and backward context semantic forward attention score field of the first backup data segment text; Calculate the reverse attention score field of the backward context semantic homography projection coding vector of the first backup data segment text relative to the forward context semantic homography projection coding vector of the first backup data segment text to obtain the forward and backward context semantic reverse attention score field of the first backup data segment text.

6. The method for preventing software backup data leakage according to claim 5, characterized in that: Based on the forward and backward context semantics of the first backup data segment text, a semantic mapping interactive response analysis is performed on the forward context semantic encoding vector of the first backup data segment text and the backward context semantic encoding vector of the first backup data segment text to obtain the first backup data segment text bidirectional context interactive semantic encoding vector, including: Mapping the first backup data segment text forward context semantic homography projection coding vector and the first backup data segment text backward context semantic homography projection coding vector to the first backup data segment text forward and backward context semantic forward and reverse bidirectional attention balance field to obtain the first backup data segment text forward context semantic homography projection attention modulation coding vector and the first backup data segment text backward context semantic homography projection attention modulation coding vector; Calculate the position point-by-position division between the forward context semantic homography projection attention modulation coding vector of the first backup data segment text and the backward context semantic homography projection attention modulation coding vector of the first backup data segment text to obtain the bidirectional context interaction semantic coding vector of the first backup data segment text.

7. The method for preventing software backup data leakage according to claim 6, characterized in that: Based on the bidirectional context interaction semantic encoding vector of the first backup data segment text, identifying whether the first backup data segment text description belongs to the sensitive data part or the non-sensitive data part, including: The bidirectional context interaction semantic encoding vector of the first backup data segment text is input into a classifier-based data type identifier to obtain a recognition result, and the recognition result is used to indicate that the first backup data segment text description belongs to the sensitive data part or the non-sensitive data part.

8. The method for preventing software backup data leakage according to claim 7, characterized in that: Inputting the bidirectional context interaction semantic encoding vector of the first backup data segment text into a classifier-based data type identifier to obtain a recognition result, including: Performing full-connection encoding on the first backup data segment text bidirectional context interaction semantic encoding vector using the fully-connected layer of the data type identifier to obtain the first backup data segment text bidirectional context interaction semantic fully-connected encoding vector; Inputting the first backup data segment text bidirectional context interaction semantic fully connected encoding vector into the Softmax classification function of the data type identifier to obtain the probability value of the first backup data segment text bidirectional context interaction semantic encoding vector belonging to each classification label, wherein the classification label includes the first backup data segment text description belonging to the sensitive data part and the first backup data segment text description not belonging to the sensitive data part; The classification label corresponding to the largest probability value among the probability values ​​is determined as the recognition result.

Images