Data supervision method and device, electronic equipment and storage medium

Abstract

The invention provides a data supervision method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining an evidence storage requirement subset corresponding to a business system from an evidence storage requirement set based on the attribute of the business system, and transmitting the evidence storage requirement subset to the business system, enabling the business system to generate evidence storage information of the supervised data based on the operation log of the supervised data and the evidence storage requirement subset in the circulation process of the supervised data; receiving evidence storage information of the supervised data returned by the service system, and analyzing the evidence storage information to obtain an analysis result; and based on the analysis result, determining whether there is an exception in the circulation process of the supervised data, and if there is an exception, determining an exceptional node based on the evidence information, and disposing the exceptional node to obtain a disposal result. According to the invention, information collection and step-by-step convergence and step-by-step evidence storage are carried out on related nodes of data circulation, so that multi-layer collaborative linkage supervision can be formed, and self-supervision of the whole network is realized.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a data supervision method, device, electronic equipment and storage medium. Background Art

[0002] Data supervision in mobile communication networks is a crucial link, which involves comprehensive and detailed management of various types of data generated in the network. These data include user behavior data, network status data and business data, which together form the basis for the operation of mobile communication networks. The main task of data supervision is to collect, store, analyze and monitor these data to ensure the integrity, accuracy, security and compliance of the data.

[0003] However, in the current mobile communication network, data supervision is mainly carried out on a system or part of a system basis, and only local information can be supervised, that is, each subsystem or department is independent and lacks a unified data management and supervision platform. This decentralized supervision model leads to serious data island phenomenon, making it difficult to share and coordinate data between different systems, and difficult to achieve self-regulation of the entire network, thus limiting the breadth and depth of supervision. Summary of the invention

[0004] The present invention provides a data supervision method, device, electronic device and storage medium, which are used to solve the problems of independent supervision of data and data islands in related technologies.

[0005] The present invention provides a data supervision method, which is applied to a self-supervision platform and comprises: Based on the attributes of the business system, a subset of evidence requirements corresponding to the business system is obtained from the evidence requirement set, and the subset of evidence requirements is sent to the business system, so that the business system generates evidence information of the supervised data based on the operation log of the supervised data and the subset of evidence requirements during the circulation of the supervised data; Receiving the evidence information of the supervised data returned by the business system, and analyzing the evidence information to obtain an analysis result; Based on the analysis result, determine whether there is an abnormality in the flow of the supervised data; if there is an abnormality, determine the abnormal node based on the stored evidence information, and deal with the abnormal node to obtain a disposal result; Among them, the business system includes at least one of a business support system, an operation support system and a big data lake, the big data lake includes a data lake provincial node and a data lake group node, the regulated data is collected from the business support system and / or the operation support system, and the flow process of the regulated data includes at least one of the following: the regulated data is transmitted to an external enterprise, the regulated data is stored in the data lake provincial node, and the regulated data is aggregated from the data lake provincial node to the data lake group node.

[0006] A data supervision method provided by the present invention further includes: When it is detected that the regulated data is transmitted to an external enterprise, the authority of the external enterprise is obtained, and based on the authority of the external enterprise, the authority control is performed on the regulated data to be transmitted, and the authority control includes at least one of data classification and grading, data desensitization, data deletion, and data encryption.

[0007] According to a data supervision method provided by the present invention, the analyzing the stored evidence information to obtain the analysis result includes: The stored evidence information is analyzed based on preset analysis rules to obtain the analysis results, wherein the preset analysis rules include at least one of alarm event triggering, full analysis under non-alarm conditions, and sampling analysis under non-alarm conditions.

[0008] A data supervision method provided by the present invention further includes: Based on the attributes of the business system, obtaining a subset of evidence elements corresponding to the business system from the set of evidence elements, and sending the subset of evidence elements to the business system, so that the business system generates an evidence index of the supervised data based on the subset of evidence elements and the evidence information of the supervised data; Receive the evidence index of the supervised data sent by the business system, and save the evidence index.

[0009] A data supervision method provided by the present invention further includes: Receive data supervision requests; Based on the evidence index of the regulated data carried in the data supervision request, at least one of the evidence information, analysis results, and disposal results of the regulated data is obtained and sent to the sender of the data supervision request.

[0010] According to a data supervision method provided by the present invention, the evidence index includes an index ID, a source system, and a summary.

[0011] According to a data supervision method provided by the present invention, the attributes of the business system include at least one of a business type, a system name, a system identifier, and a system address.

[0012] According to a data supervision method provided by the present invention, the evidence requirement set includes at least one of evidence granularity, evidence frequency, and evidence priority.

[0013] According to a data supervision method provided by the present invention, the supervision content of the supervised data includes at least one of whether data operations are documented, whether data operations are compliant, whether data transfer is documented, whether data transfer is authorized, whether data is effectively classified and graded, whether data is effectively desensitized on demand, whether data is effectively deleted, unauthenticated data interface, traversable data interface, executable database query interface, account brute force cracking, abnormal single return data volume, abnormal cumulative return data volume, too much sensitive data in a single request, account login abnormality, VPN abnormality, database operation abnormality, data operation abnormality, file operation abnormality, host network device operation abnormality, and application operation abnormality.

[0014] According to a data supervision method provided by the present invention, the supervised data includes at least one of user basic information, user service information, user consumption account information, online behavior information, location information and user tag portrait information.

[0015] According to a data supervision method provided by the present invention, the business support system includes at least one of a customer relationship management system and a billing accounting system, and the operation support system includes at least one of a signaling monitoring platform, an open information dynamic data fusion aggregation platform, a fixed network / mobile network deep packet analysis device, an IP aggregation analysis platform, an Internet log retention system, and a mobile business perception analysis platform.

[0016] The present invention also provides a data supervision method, which is applied to a business system and comprises: In the process of circulation of the supervised data, based on the subset of evidence requirements and the operation log of the supervised data, the evidence information of the supervised data is generated, wherein the subset of evidence requirements is selected and sent by the self-supervision platform from the set of evidence requirements based on the attributes of the business system; Sending the evidence information of the supervised data to the self-supervision platform, so that the self-supervision platform analyzes the evidence information, and determines whether there is an abnormality in the flow of the supervised data based on the analysis result. If there is an abnormality, the abnormal node is determined based on the evidence information, and the abnormal node is handled to obtain a handling result; Among them, the business system includes at least one of a business support system, an operation support system and a big data lake, the big data lake includes a data lake provincial node and a data lake group node, the regulated data is collected from the business support system and / or the operation support system, and the flow process of the regulated data includes at least one of the regulated data being transmitted to an external enterprise, the regulated data being stored in the data lake provincial node, and the regulated data being aggregated from the data lake provincial node to the data lake group node.

[0017] The present invention also provides a data supervision device, which is applied to a self-supervision platform and includes: A sending unit, configured to obtain, based on the attributes of the business system, a subset of evidence requirements corresponding to the business system from the set of evidence requirements, and send the subset of evidence requirements to the business system, so that the business system generates evidence information of the regulated data based on the operation log of the regulated data and the subset of evidence requirements during the flow of the regulated data; An analysis unit, configured to receive the evidence information of the supervised data returned by the business system, and analyze the evidence information to obtain an analysis result; A handling unit, configured to determine whether there is an abnormality in the flow of the supervised data based on the analysis result, and if there is an abnormality, determine the abnormal node based on the stored evidence information, and handle the abnormal node to obtain a handling result; Among them, the business system includes at least one of a business support system, an operation support system and a big data lake, the big data lake includes a data lake provincial node and a data lake group node, the regulated data is collected from the business support system and / or the operation support system, and the flow process of the regulated data includes at least one of the regulated data being transmitted to an external enterprise, the regulated data being stored in the data lake provincial node, and the regulated data being aggregated from the data lake provincial node to the data lake group node.

[0018] The present invention also provides a data supervision device, which is applied to a business system and includes: An information generating unit, configured to generate evidence information of the supervised data based on a subset of evidence requirements and an operation log of the supervised data during the circulation of the supervised data, wherein the subset of evidence requirements is selected and sent by the self-supervision platform from the set of evidence requirements based on the attributes of the business system; An information sending unit, used for sending the evidence information of the supervised data to the self-supervision platform, so that the self-supervision platform analyzes the evidence information, and determines whether there is an abnormality in the flow of the supervised data based on the analysis result, and if there is an abnormality, determines the abnormal node based on the evidence information, and handles the abnormal node to obtain a handling result; Among them, the business system includes at least one of a business support system, an operation support system and a big data lake, the big data lake includes a data lake provincial node and a data lake group node, the regulated data is collected from the business support system and / or the operation support system, and the flow process of the regulated data includes at least one of the regulated data being transmitted to an external enterprise, the regulated data being stored in the data lake provincial node, and the regulated data being aggregated from the data lake provincial node to the data lake group node.

[0019] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, any of the data supervision methods described above is implemented.

[0020] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the data supervision method as described in any one of the above is implemented.

[0021] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements any of the data supervision methods described above.

[0022] The data supervision method, device, electronic device and storage medium provided by the present invention dynamically obtain a subset of evidence requirements according to the attributes of the business system through a self-supervision platform, and send it to the corresponding business system, so that the supervision strategy can be flexibly adjusted according to different business needs and compliance requirements. The business system generates corresponding evidence information during the flow of supervised data, which can ensure the traceability of data and realize the supervision of the whole process of data flow. By analyzing the evidence information, the self-supervision platform can detect whether there is abnormal behavior in the data flow process. Once abnormal behavior is found, the self-supervision platform can quickly locate the abnormal node and take corresponding disposal measures. In addition, in the business support system and the operation support system, the supervised data is collected and integrated. Through the big data lake, the data from different business systems can be uniformly stored and managed, and the step-by-step convergence of the supervised data is realized; in the process of data transmission from the business system to the data lake provincial node, and then from the data lake provincial node to the data lake group node, each node will generate and save the corresponding evidence information. This step-by-step evidence method can effectively supervise the data of the mobile communication network throughout the process, thereby ensuring the security and integrity of the data. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the present invention or related technologies, the following briefly introduces the drawings required for use in the embodiments or related technical descriptions. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0024] Figure 1 This is one of the flow charts of the data supervision method provided by the present invention; Figure 2 This is the second flow chart of the data supervision method provided by the present invention; Figure 3 It is a schematic diagram of a regulatory framework applicable to a mobile communication network provided by the present invention; Figure 4 It is one of the structural schematic diagrams of the data supervision device provided by the present invention; Figure 5 This is the second structural diagram of the data supervision device provided by the present invention; Figure 6 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0025] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0026] Mobile communication networks store a large amount of user information and business data. Once these data are leaked or tampered with, they may cause serious security problems. Through data supervision, the flow and changes of data in the network can be monitored in real time, and potential security threats can be discovered and responded to in a timely manner, thereby effectively ensuring the stable operation of the network and the security of user data. In addition, data supervision also plays an important role in maintaining market order, supporting business optimization, and helping enterprises meet compliance requirements.

[0027] However, in the current communication network, data supervision is mainly carried out on a system or part of a system basis. This decentralized supervision model can only manage and control local information, which limits the comprehensiveness and real-time nature of information and makes it difficult to achieve macro-control of the entire communication network. Specifically, the existing regulatory framework can only implement a "divide and rule" strategy within mobile communication companies, that is, each subsystem or department is independent and lacks a unified data management and supervision platform. This decentralized supervision model leads to serious data islands, making it difficult to share and coordinate data between different systems, thus limiting the breadth and depth of supervision.

[0028] In addition, the existing regulatory model lacks a joint regulatory mechanism across enterprises. Although there is traffic monitoring at certain key nodes or levels, these monitoring are usually limited to a specific scope and cannot cover all business nodes in a wide range. This limited supervision not only affects the timely discovery and response to potential risks, but also limits the effectiveness and comprehensiveness of regulatory measures.

[0029] In this regard, the present invention provides a data supervision method suitable for mobile communication networks, which is mainly used to solve the problems of independent supervision of data and data islands. By combining the supervised data of each business system, storing them level by level, and reserving interfaces for regulatory departments, self-supervision of the entire network and supervision by regulatory departments are achieved, thus overcoming the above-mentioned defects.

[0030] It should be noted that the self-regulatory platform is the core component of data supervision and is responsible for the initiation, monitoring and analysis of the entire data supervision process. The self-regulatory platform can retrieve and send the corresponding subset of evidence requirements from the preset evidence requirement set to the business system based on the attributes of the business system. At the same time, it is also responsible for receiving the evidence information returned by the business system and conducting in-depth analysis of this information to determine whether there are any anomalies in the data flow process. Once an anomaly is found, the self-regulatory platform will locate the abnormal node based on the evidence information and take corresponding disposal measures.

[0031] The self-regulatory platform includes modules such as the data flow and evidence platform, the personal rights protection supervision system, the interface machine of the superior regulatory department, and the console. The data flow and evidence platform is used to save the evidence index of the regulated data; the personal rights protection supervision system is composed of the abnormal operation aggregation storage system, the abnormal operation fusion analysis system, the infringement incident tracing system, and the rights protection supervision and disposal system; the interface machine of the superior regulatory department is connected to the data flow and evidence platform to provide a data pulling interface to the superior regulatory department; the console is deployed in the safe house for on-demand sampling supervision by the superior regulatory department.

[0032] Business systems refer to systems that generate, process or store regulated data, and they constitute the objects of data supervision. In the embodiment of the present invention, the business system includes but is not limited to at least one of a business support system, an operation support system and a big data lake. These systems receive a subset of evidence requirements sent from the supervision platform according to their own business needs and compliance requirements, and generate corresponding evidence information during the data flow process. Here, the business support system (Business Support System, BSS) is usually responsible for processing business-related data, such as user information, business orders, etc. They are the basis of business operations and ensure the smooth progress of the business. The operation support system (Operation Support System, OSS) focuses on network operations, equipment management and troubleshooting. They ensure the stability and reliability of the network by monitoring and analyzing network data. The big data lake is a platform for centralized storage of large amounts of data, which allows enterprises to store and analyze various types of data in a low-cost and efficient manner.

[0033] Among them, the BSS system includes but is not limited to the Customer Relationship Management (CRM) system, billing and accounting system, etc.; the OSS system includes but is not limited to the signaling monitoring platform, the open information dynamic data (OIDD) fusion aggregation platform, the fixed network / mobile network deep packet (DPI) analysis equipment, the IP aggregation analysis platform, the Internet log retention system, the mobile service perception analysis platform, etc.

[0034] The big data lake includes provincial data lake nodes and group data lake nodes. Provincial data lake nodes are geographically distributed storage units of the big data lake, which are responsible for storing and managing data in the province or region. Group data lake nodes (or data lake center nodes) are the core of the big data lake, which are responsible for aggregating and storing data from various provincial nodes.

[0035] Figure 1 This is one of the flow charts of the data supervision method provided by the present invention, such as Figure 1 As shown, the method is applied to a self-regulatory platform, and the method includes: Step 110, based on the attributes of the business system, obtaining a subset of evidence requirements corresponding to the business system from the evidence requirement set, and sending the subset of evidence requirements to the business system, so that the business system generates evidence information of the supervised data based on the operation log of the supervised data and the subset of evidence requirements during the flow of the supervised data; Among them, the business system includes at least one of a business support system, an operation support system and a big data lake, the big data lake includes a data lake provincial node and a data lake group node, the regulated data is collected from the business support system and / or the operation support system, and the flow process of the regulated data includes at least one of the following: the regulated data is transmitted to an external enterprise, the regulated data is stored in the data lake provincial node, and the regulated data is aggregated from the data lake provincial node to the data lake group node.

[0036] Specifically, the method provided in the embodiment of the present invention can be applied to a self-regulatory platform. A user can set a set of evidence requirements through the console of the self-regulatory platform and send it to the personal rights protection supervision system. The supervision system can select a subset of evidence requirements corresponding to the business system from the set of evidence requirements based on the attributes of the business system and send it to the business system. Here, the attributes of the business system refer to factors that can affect the selection of the subset of evidence requirements. For example, the attributes of the business system include but are not limited to the business type, system name, system identifier, system address, etc. of the business system.

[0037] It can be understood that the evidence requirement set is a comprehensive collection of multiple evidence requirements. For example, the evidence requirement set may include evidence granularity, evidence frequency, evidence priority, etc. It specifies in detail the key parameters such as evidence granularity, evidence frequency, and evidence priority of data in different scenarios. The evidence requirement subset is a set of evidence requirements that are selected from the evidence requirement set based on the attributes of a specific business system and are applicable to the business system. It contains all the evidence requirements that the business system needs to comply with to ensure the compliance and traceability of the data. For a certain business system, after selecting the subset of evidence requirements related to the business system, the personal rights protection and supervision system can send the subset of evidence requirements to the business system through a secure and reliable communication channel.

[0038] After receiving the evidence requirement subset, the business system can call the evidence information generation algorithm to generate corresponding evidence information according to the evidence requirement subset and the operation log of the regulated data during the circulation of the regulated data. Here, the evidence information generation algorithm refers to a specific calculation step or method for generating evidence information according to the evidence requirement subset and the operation log of the data during the circulation of the regulated data. The algorithm can be pre-built according to the actual application requirements, or it can be directly implemented using the existing evidence information generation algorithm (such as evidence information generation based on hash algorithm, evidence information generation based on blockchain, evidence information generation based on smart contract, etc.), which is not specifically limited in the embodiment of the present invention. Regulated data refers to various types of information related to users and services in the mobile communication network, such as user basic information, user service information, user consumption account information, Internet behavior information, location information, and user tag portrait information. The regulated data can be data collected from the BSS system, data collected from the OSS system, or data collected from both the BSS system and the OSS system, which is not specifically limited in the embodiment of the present invention. It should be understood that in order to collect the supervised data in the BSS system and / or OSS system, the data type, scope and frequency to be collected can be determined according to the supervision requirements and business needs, and then a specific plan for data collection can be formulated, including the collection method, interface design, data transmission protocol, etc. Then, the supervised data can be extracted from the BSS system and / or OSS system using the collection tools or interfaces. The collected data can also be verified and cleaned to ensure the accuracy and integrity of the data.

[0039] After the supervised data is collected from the BSS system and / or OSS system, the data can be packaged in the agreed format and the packaged data can be transferred to the provincial node of the data lake for storage using the data transmission protocol. In the provincial node of the data lake, the supervised data can be saved using distributed storage technology. In addition, for the supervised data stored in the provincial node of the data lake, data synchronization tools or technologies can be used to aggregate the data in the provincial node to the group node of the data lake in real time or periodically, so as to integrate and merge the data from different provincial nodes in the group node to form a global data view.

[0040] The circulation process of regulated data refers to multiple links involving data collection, storage, processing, aggregation, transmission, and use. For example, the circulation process of regulated data may include the transmission of regulated data to external enterprises, the storage of regulated data to provincial nodes of the data lake, and the aggregation of regulated data from provincial nodes of the data lake to the group nodes of the data lake. It should be understood that external enterprises refer to third-party enterprises that have business dealings or data exchanges with regulated entities.

[0041] Specifically, during the flow of regulated data, the business system will first capture all operation logs of the regulated data during the flow process. These logs record in detail key information such as the source, destination, operation time, operation type (such as reading, writing, deleting, etc.) and operation results of the data. The business system will then filter and match the captured operation logs according to the evidence requirement subset. The evidence requirement subset specifies which operations need to be recorded as evidence information, as well as the specific format and content requirements of the evidence information. After matching the evidence requirements, the business system will extract the corresponding information from the operation log according to these requirements, and call the evidence information generation algorithm to generate evidence information that meets the requirements. This evidence information may include the unique identifier of the data, the operation timestamp, the operation type, the operation result, and related metadata. The generated evidence information will be stored by the business system and transmitted to the personal rights protection supervision system of the self-regulatory platform through a secure channel for subsequent analysis.

[0042] It should be understood that the operation log of regulated data refers to a series of detailed information about data operations recorded by the business system during the data flow process. These logs may include the source, destination, operation time, operation type (such as reading, writing, deleting, etc.), operation results, and related metadata of the data. The evidence information of regulated data refers to the information extracted and generated from the operation log according to the subset of evidence requirements, which is used to record and prove the key operations in the data flow process. Evidence information is tamper-proof and traceable, and is an important means to ensure data compliance and security. Through evidence information, the self-regulatory platform can track the flow path of data, analyze the operational behavior of data, and take timely measures to deal with it when abnormalities are found.

[0043] Step 120: receiving the evidence information of the supervised data returned by the business system, and analyzing the evidence information to obtain an analysis result.

[0044] Specifically, after the business system generates the evidence information of the regulated data, it will send the evidence information to the personal rights protection supervision system of the self-regulatory platform, and analyze the generated evidence information through the analysis system in the supervision system to obtain the analysis results. For example, the analysis system can use data analysis tools and technologies (such as data mining, machine learning, etc.) to conduct in-depth analysis of the generated evidence information, including analyzing key indicators such as the flow path of the data, operation type, and operation frequency, in order to discover potential risks and anomalies. The analysis results refer to the conclusions or findings drawn by the self-regulatory platform after analyzing the evidence information of the regulated data. These results may include the flow of data, compliance assessment of operational behavior, identification of potential risks, etc.

[0045] Step 130, based on the analysis result, determine whether there is an abnormality in the flow of the supervised data. If there is an abnormality, determine the abnormal node based on the stored evidence information, and deal with the abnormal node to obtain a disposal result.

[0046] Specifically, after obtaining the analysis results, the self-regulatory platform can determine whether there are any abnormalities in the flow of regulated data based on the analysis results. For example, reasonable thresholds (such as operation frequency, data flow speed, etc.) can be set according to business needs and regulatory requirements, and the analysis results can be compared with the set thresholds to analyze whether the data flow and operation behaviors exceed the normal range. Through data analysis technology, potential abnormal behaviors or risk points can be identified, such as data leakage, illegal access, etc.

[0047] If it is determined that there are anomalies in the flow of regulated data, the abnormal nodes can be determined based on the evidence information. Specifically, first find the data operations or flow links that are beyond the normal range or have potential risks in the analysis results; then, track the specific location and nodes of the abnormal behavior through the flow path and operation log in the evidence information; combined with the architecture of the business system and the logic of data flow, the specific nodes or components that cause the anomaly can be determined. It should be understood that abnormal nodes refer to nodes where abnormal behavior or risks occur during the flow of regulated data. These nodes may be a module, an interface, or a specific operation link in the business system.

[0048] After the abnormal nodes are identified, they can be handled, and the handling methods may include issuing alarms, isolating risks, investigating causes, fixing problems, etc. For example, when an abnormal node is found, the self-regulatory platform can immediately issue an alarm to notify relevant personnel or systems; it can also isolate the abnormal node to prevent the risk from spreading or causing greater losses; it can also conduct in-depth investigations on abnormal nodes, analyze the causes and background of abnormal behavior, and take corresponding measures to fix the problem based on the investigation results, such as updating the system, modifying configurations, and strengthening security protection.

[0049] After the abnormal node is handled, the corresponding handling result can be obtained. Here, the handling result refers to the effect or achievement obtained after handling the abnormal node. These results may include the repair of the problem, the degree of risk elimination, the recovery of the business system, etc. Subsequently, the analysis results and handling results can be reported to the superior system. It should be noted that there are many analysis systems and handling systems, which are deployed in layers and grades. Each system will aggregate the analysis results and handling results to the superior system, and the superior system will also report to the superior system.

[0050] The method provided by the embodiment of the present invention dynamically obtains a subset of evidence requirements according to the attributes of the business system through the self-regulatory platform, and sends it to the corresponding business system, so that the regulatory strategy can be flexibly adjusted according to different business needs and compliance requirements. The business system generates corresponding evidence information during the flow of regulated data, which can ensure the traceability of data and realize the supervision of the entire process of data flow. By analyzing the evidence information, the self-regulatory platform can detect whether there is abnormal behavior in the data flow process. Once abnormal behavior is found, the self-regulatory platform can quickly locate the abnormal node and take corresponding disposal measures. In addition, in the business support system and the operation support system, the regulated data is collected and integrated. Through the big data lake, data from different business systems can be uniformly stored and managed, realizing the step-by-step convergence of the regulated data; in the process of data transmission from the business system to the data lake provincial node, and then from the data lake provincial node to the data lake group node, each node will generate and save the corresponding evidence information. This step-by-step evidence method can effectively supervise the data of the mobile communication network throughout the process, thereby ensuring the security and integrity of the data.

[0051] Based on the above embodiment, the method further includes: When it is detected that the regulated data is transmitted to an external enterprise, the authority of the external enterprise is obtained, and based on the authority of the external enterprise, the authority control is performed on the regulated data to be transmitted, and the authority control includes at least one of data classification and grading, data desensitization, data deletion, and data encryption.

[0052] It should be noted that for relevant data in the OSS system or big data lake, external enterprises can obtain and query it according to their needs. When users log in to the system to view various types of data, they need to control the acquired data according to permissions. When the data is to be passed to external enterprises, the passed data also needs to be controlled according to permissions to achieve secure access to the data.

[0053] Specifically, when the self-regulatory platform detects that data is being transferred to an external enterprise, it indicates that the external enterprise is querying and acquiring the regulated data. In this case, the self-regulatory platform can control the permissions of the transferred data according to the permissions of the external enterprise. Here, the permissions of the external enterprise refer to the rights and restrictions of the external enterprise to access, use, and process the regulated data of the business system during the data sharing or interaction process. For example, the permissions of the external enterprise may include data access rights (specifying which data can be accessed or shared), data use rights (specifying the purpose, method, and scope of data use), data processing rights (restrictions on operations performed on data), data sharing period (the validity period of data sharing), etc.

[0054] According to the authority of the external enterprise, the regulated data to be transmitted shall be subject to authority control. The control methods may include data classification and grading, data desensitization, data deletion, data encryption, etc. Here, data classification and grading refers to classifying and grading the regulated data according to the sensitivity according to the authority requirements of the external enterprise to ensure that only data that meets the authority requirements is transmitted. Data desensitization refers to desensitizing sensitive data, such as replacement, encryption or obfuscation, to protect personal privacy and business secrets. Data deletion means deleting the data before transmission if the external enterprise does not have access to specific data. Data encryption refers to encrypting the transmitted data to ensure the security of the data during transmission. In addition, in the process of transmitting data to external enterprises, it is necessary to record detailed logs of data transmission and generate corresponding evidence information for subsequent analysis and tracing.

[0055] Based on any of the above embodiments, in step 120, analyzing the stored evidence information to obtain an analysis result includes: The stored evidence information is analyzed based on preset analysis rules to obtain the analysis results, wherein the preset analysis rules include at least one of alarm event triggering, full analysis under non-alarm conditions, and sampling analysis under non-alarm conditions.

[0056] Specifically, when analyzing the generated evidence information, the analysis system can analyze it according to the preset analysis rules. The preset analysis rules here refer to a series of analysis methods and standards preset according to business needs, compliance requirements or data characteristics before the analysis system analyzes the evidence information of the regulated data. These rules are used to guide the analysis system on how to analyze the evidence information efficiently and accurately to discover potential problems, risks or anomalies.

[0057] It is understood that the preset analysis rules include, but are not limited to: triggered by specific alarm events, full analysis in non-alarm situations, sampling analysis in non-alarm situations, etc. Among them, alarm event triggering means that when the analysis system detects a specific abnormal situation or reaches the preset alarm condition, the analysis rules are automatically triggered to conduct in-depth analysis of the stored evidence information. For example, when the system detects alarm events such as data leakage, illegal access, or abnormal data fluctuations, the corresponding analysis rules are immediately activated to conduct detailed review and analysis of the data involved.

[0058] Full analysis in non-alarm situations means that the analysis system conducts a comprehensive analysis of all evidence information when no alarm event occurs. This type of analysis is usually used for regular data review, risk assessment, or compliance checks to ensure data integrity and security. Full analysis requires reviewing all data one by one, which is time-consuming but can identify potential problems and risks.

[0059] Sampling analysis in non-alarm situations means that when no alarm event occurs, the analysis system randomly selects a portion of data from the evidence information for analysis. Sampling analysis is usually used in large-scale data sets to improve analysis efficiency. Through reasonable sampling methods and sample size selection, sampling analysis can quickly discover anomalies or trends in data while ensuring a certain degree of accuracy.

[0060] Specifically, when the analysis system analyzes the evidence information according to the preset analysis rules, it can be achieved through the following steps: first, determine the analysis target, clarify the purpose and scope of the analysis, such as discovering data leakage, evaluating data quality or checking compliance, etc.; then, according to the analysis target, select appropriate rules from the preset analysis rules for analysis. For example, if the goal is to discover data leakage, you can choose the analysis rules triggered by specific alarm events; then, analyze the generated evidence information according to the selected analysis rules, including data screening, pattern recognition, anomaly detection and other steps; finally, evaluate the analysis results to determine whether there are potential problems or risks. If problems are found, further inspection and corresponding measures are required.

[0061] Based on any of the above embodiments, the method further includes: Based on the attributes of the business system, obtaining a subset of evidence elements corresponding to the business system from the set of evidence elements, and sending the subset of evidence elements to the business system, so that the business system generates an evidence index of the supervised data based on the subset of evidence elements and the evidence information of the supervised data; Receive the evidence index of the supervised data sent by the business system, and save the evidence index.

[0062] Specifically, the console of the self-regulatory platform is also provided with a collection of evidence elements. Users can set the evidence elements through the console according to their needs and send them to the personal rights protection supervision system. The supervision system will select the subset of evidence elements corresponding to the business system from the collection of evidence elements according to the attributes of the business system and send it to the business system. Here, the collection of evidence elements refers to a collection of information issued by the self-regulatory platform that cannot be predicted by other systems. These evidence elements are specially used to generate evidence information to ensure the authenticity and integrity of the data. Each element in the collection of evidence elements has a certain uniqueness and unpredictability, which increases the reliability and security of data evidence. The subset of evidence elements refers to a collection of some elements selected from the collection of evidence elements according to specific conditions or attributes. For different business systems, the required evidence elements will also be different due to their different attributes and requirements. Therefore, the supervision system will select the corresponding subset of evidence elements from the collection of evidence elements according to the attributes of the business system and send it to the business system for use.

[0063] After receiving the subset of evidence elements, the business system will generate a corresponding evidence index based on the subset of evidence elements and the generated evidence information of the regulated data, and upload it to the data flow evidence platform so that the superior regulatory authorities can conduct supervision based on the evidence index. Here, the evidence index of regulated data refers to a tool generated by the business system based on the subset of evidence elements and the evidence information of the regulated data, which is used to identify and track the evidence information of the regulated data. It can contain key information related to the evidence of the regulated data, such as index ID, evidence time, source system, evidence location, summary, etc. Through the evidence index, the business system can quickly locate specific evidence information and conduct subsequent processing and analysis.

[0064] After the business system generates the evidence index of the regulated data, it will upload the evidence index to the data flow and evidence platform so that the evidence platform can save it. By saving the evidence index, the self-regulatory platform can easily track the flow and evidence of the regulated data to ensure the compliance and security of the data. When abnormal events such as data leakage and illegal access occur, the self-regulatory platform can quickly locate the relevant evidence information through the evidence index, providing strong support for risk warning and response.

[0065] Based on any of the above embodiments, the method further includes: Receive data supervision requests; Based on the evidence index of the regulated data carried in the data supervision request, at least one of the evidence information, analysis results, and disposal results of the regulated data is obtained and sent to the sender of the data supervision request.

[0066] It should be noted that the data flow and evidence storage platform can send the evidence index to the interface machine of the superior regulatory department. At the same time, the analysis system can also send the output analysis results to the interface machine, so that the superior regulatory department can directly pull detailed evidence information from the business system, or the data flow and evidence storage platform, or the regulatory system through the interface machine based on the alarm information, evidence index, etc.

[0067] Specifically, a data supervision request refers to a request initiated by a superior regulatory department to obtain the evidence information, analysis results, disposal results, etc. of the regulated data. The self-regulatory platform receives data supervision requests initiated by superior regulatory departments through the interface machine. The interface machine is a bridge between the superior regulatory department and the self-regulatory platform. It is responsible for receiving, parsing and forwarding data supervision requests. When the superior regulatory department sends data supervision requests through the interface machine, the self-regulatory platform can capture and process these requests in real time.

[0068] When the superior regulatory department initiates a data supervision request, it usually initiates it based on the alarm information, evidence index, etc. Therefore, the data supervision request will carry the evidence index of the supervised data. Through this index, the self-regulatory platform can accurately and quickly find the supervised data and the corresponding evidence information, analysis results, disposal results, etc. Specifically, after receiving the data supervision request, the interface machine will parse the evidence index in the request, and search for the evidence information, analysis results and disposal results of the supervised data in the business system, circulation evidence platform, regulatory system, etc. according to this index. After finding this information, the self-regulatory platform will package the evidence information, analysis results and disposal results through the interface machine and return them to the sender of the data supervision request. It should be understood that the sender of the data supervision request refers to the entity that initiates the data supervision request, such as the superior regulatory department. These departments are responsible for supervising and managing the use and storage of data to ensure the compliance and security of the data.

[0069] Based on any of the above embodiments, the evidence index includes an index ID, a source system, and a summary.

[0070] Specifically, the evidence index includes but is not limited to the index ID, source system, summary, etc. Among them, the index ID is the unique identifier of the evidence index, which is used to uniquely identify and locate the evidence information. It can be a string composed of numbers, letters or special characters, which is highly unique and unpredictable. The generation of the index ID usually follows certain rules and algorithms to ensure its uniqueness and security. In the process of data supervision, the index ID can be used to quickly find and locate specific evidence information, improving the efficiency and accuracy of data retrieval.

[0071] The source system refers to the system or platform that generates or stores the regulated data. In the data regulation process, the source system is responsible for providing the original information and evidence information of the regulated data. By recording the information of the source system, the source and flow of the data can be traced, thereby verifying the compliance and security of the data. In the evidence index, the information of the source system can include key attributes such as the system name, identifier, and IP address.

[0072] A summary refers to the result of refining and summarizing the evidence information of the regulated data. It can contain the key information, characteristics or results of the regulated data and present them in a concise and clear manner. The purpose of the summary is to provide a way to quickly understand the content of the evidence information while reducing the redundancy and complexity of the data. In the process of data supervision, the summary can be used to quickly screen and filter the evidence information and improve the efficiency and accuracy of data processing.

[0073] It can be understood that through the three elements of index ID, source system and summary, the regulated data can be quickly located, traced and verified to ensure the compliance, security and validity of the data.

[0074] Based on any of the above embodiments, the attribute of the business system includes at least one of a business type, a system name, a system identifier, and a system address.

[0075] Specifically, the business type refers to the specific business field or process supported or managed by the business system. It reflects the core functions and objectives of the business system and the role it plays in the operation of the enterprise. The system name refers to the formal or official name of the business system, which is used to identify and distinguish different business systems. The system identifier is a unique identifier of the business system at the technical level, which is used to uniquely identify and locate the business system in the system. It can be a string of numbers, letters or special characters, or a specific code or number. The system address refers to the location or access path of the business system in the network. It can be an IP address, domain name or URL, etc., which is used to indicate how users or devices connect to the business system.

[0076] Based on any of the above embodiments, the evidence storage requirement set includes at least one of evidence storage granularity, evidence storage frequency, and evidence storage priority.

[0077] Specifically, the evidence storage requirement set includes but is not limited to the granularity of evidence storage, the frequency of evidence storage, the priority of evidence storage, etc. Among them, the granularity of evidence storage refers to the level of detail of the evidence storage information, for example, whether to record every step of the entire data flow process, or only record the operations of key nodes; whether to record the specific content of the data, or only record the metadata of the data (such as timestamp, operation type, etc.).

[0078] The frequency of evidence storage refers to the frequency of generating evidence information. For example, is the evidence information generated in real time or at a certain time interval (such as every hour, every day, or every week).

[0079] Evidence priority refers to the priority ranking of different evidence requirements when resources are limited. For example, the evidence requirement for sensitive data may have a higher priority.

[0080] Based on any of the above embodiments, the supervision content of the regulated data includes whether the data operation is evidenced, whether the data operation is compliant, whether the data flow is evidenced, whether the data flow is authorized, whether the data is effectively classified and graded, whether the data is effectively desensitized on demand, whether the data is effectively deleted, the data interface is not authenticated, the data interface is traversable, the database query interface is executable, the account is brute-force cracked, the single return data volume is abnormal, the cumulative return data volume is abnormal, too much sensitive data is requested in a single request, account login abnormality, VPN abnormality, database operation abnormality, data operation abnormality, file operation abnormality, host network device operation abnormality, and application operation abnormality.

[0081] Specifically, data supervision covers multiple aspects of the data life cycle. These supervision contents together constitute a complete framework for data supervision, which aims to ensure the compliance, security and effectiveness of data.

[0082] Among them, whether data operations are recorded means checking whether data operations (such as creation, modification, deletion, etc.) have been recorded and stored for subsequent audit and traceability. Whether data operations are compliant means evaluating whether data operations comply with relevant laws, regulations, policies and internal corporate regulations. Whether data transfer is recorded means monitoring the data transfer process (such as sharing, exchange, transmission, etc.) and checking whether these processes have been recorded. Whether data transfer is authorized means checking whether data transfer has gone through the appropriate authorization and approval process.

[0083] Whether data is effectively classified and graded refers to evaluating whether data is reasonably classified and graded according to its attributes, characteristics and importance. Whether data is effectively desensitized on demand refers to checking whether sensitive data is effectively desensitized to meet business needs while protecting privacy. Whether data is effectively deleted refers to evaluating whether data is deleted promptly and effectively when it is no longer needed.

[0084] Data interface unauthentication means checking whether the data interface has problems with identity authentication and authorization. Data interface traversability means evaluating whether the data interface allows unauthorized traversal operations, thereby exposing data. Executable database query interface means checking whether there is an interface that allows unauthorized database query.

[0085] Account brute force hacking refers to monitoring whether there are attempts to brute force hack an account. Abnormal single return data volume refers to checking whether a data request returns an abnormally large amount of data, which may indicate a risk of data leakage. Abnormal cumulative return data volume refers to evaluating whether the cumulative return data volume of data requests is abnormal to detect long-term data leakage trends. Too much sensitive data in a single request refers to checking whether a single data request requests too much sensitive data.

[0086] Account login anomalies refer to monitoring whether there are any anomalies in account login behavior, such as frequent login failures, remote logins, etc. VPN anomalies refer to checking whether there are any anomalies in VPN usage, such as unauthorized VPN connections, VPN traffic anomalies, etc.

[0087] Database operation anomalies refer to monitoring whether there are abnormalities in database operations, such as unauthorized access, abnormal data modification, etc. Data operation anomalies refer to checking whether there are abnormalities in data operations, such as data tampering, data corruption, etc. File operation anomalies refer to monitoring whether there are abnormalities in file operations, such as unauthorized file access, file deletion, etc. Host network device operation anomalies refer to checking whether there are abnormalities in the operation of hosts and network devices, such as unauthorized access, configuration changes, etc. Application operation anomalies refer to monitoring whether there are abnormalities in the operation of application programs, such as abnormal data transmission, unauthorized access, etc.

[0088] Based on any of the above embodiments, the supervised data includes at least one of user basic information, user service information, user consumption account information, online behavior information, location information and user tag portrait information.

[0089] Specifically, the categories of regulated data include, but are not limited to: basic user information, user service information, user consumption account information, online behavior information, location information, and user tag profile information. Among them, basic user information refers to basic data that can directly identify or associate with a specific user individual, such as the user's name, gender, age, ID number, contact information (such as telephone number, email address), address, etc. User service information refers to service-related data generated by users in the process of using a certain service or product, such as user service request records, service response time, service completion status, service evaluation, etc. User consumption account information refers to consumption and account-related data generated by users in the process of using services or purchasing products, such as user consumption records, payment information, account balances, bill details, etc. Online behavior information refers to data related to online behavior generated by users during network activities, such as users' browsing history, search history, click behavior, download history, online time, etc. Location information refers to data that can reflect the user's current or historical location, such as the user's GPS coordinates, base station positioning information, Wi-Fi positioning information, etc. User tag portrait information refers to a data set that can describe user characteristics and preferences by analyzing and mining user basic information, behavior data, etc. For example, user tag portrait information may include user interest preferences, consumption habits, social relationships, credit ratings, and other labels.

[0090] Based on any of the above embodiments, the business support system includes at least one of a customer relationship management system and a billing accounting system, and the operation support system includes at least one of a signaling monitoring platform, an open information dynamic data fusion aggregation platform, a fixed network / mobile network deep packet analysis device, an IP aggregation analysis platform, an Internet log retention system, and a mobile business perception analysis platform.

[0091] Specifically, the BSS system includes but is not limited to the customer relationship management (CRM) system and the billing and accounting system. The CRM system is a system that uses information science and technology to automate marketing, sales, service and other activities with customer data management as the core, and establishes a system for collecting, managing, analyzing and utilizing customer information. The billing and accounting system is one of the most critical core systems of the telecommunications operation support system, which can ensure the accurate calculation and timely collection of user fees, while providing detailed accounting information.

[0092] OSS systems include but are not limited to signaling monitoring platform, open information dynamic data (OIDD) fusion and aggregation platform, fixed network / mobile network deep packet (DPI) analysis equipment, IP aggregation and analysis platform, Internet log retention system, mobile service perception and analysis platform, etc. Among them, the signaling monitoring system is a system used to monitor signaling information in the communication network. Through the collection, analysis and processing of signaling data, it realizes the functions of monitoring the performance of the communication network and fault diagnosis. The data fusion platform is a software system that integrates, manages, analyzes and applies multi-source heterogeneous data. The open information dynamic data fusion and aggregation platform refers to the platform that can dynamically integrate, fuse and manage data from different sources and formats, and provide consistent data views and powerful analysis capabilities for data analysis and decision making.

[0093] Fixed / mobile network deep packet analysis equipment (DPI) is a device used to deeply analyze and parse data packets in the communication network. IP aggregation analysis platform is a system used to aggregate, analyze and manage IP address data. Internet log retention system refers to a system used to collect and store user Internet behavior logs. Mobile service perception analysis platform is a system used to perceive and analyze mobile network services.

[0094] Based on any of the above embodiments, Figure 2 This is the second flow chart of the data supervision method provided by the present invention, such as Figure 2 As shown, the method is applied to a business system, and the method includes: Step 210, in the process of circulation of the supervised data, based on the subset of evidence requirements and the operation log of the supervised data, generating evidence information of the supervised data, wherein the subset of evidence requirements is selected and sent by the self-supervision platform from the set of evidence requirements based on the attributes of the business system; Step 220, sending the evidence information of the supervised data to the self-supervision platform, so that the self-supervision platform analyzes the evidence information, and determines whether there is an abnormality in the flow of the supervised data based on the analysis result. If there is an abnormality, the abnormal node is determined based on the evidence information, and the abnormal node is processed to obtain a processing result; Among them, the business system includes at least one of a business support system, an operation support system and a big data lake, the big data lake includes a data lake provincial node and a data lake group node, the regulated data is collected from the business support system and / or the operation support system, and the flow process of the regulated data includes at least one of the regulated data being transmitted to an external enterprise, the regulated data being stored in the data lake provincial node, and the regulated data being aggregated from the data lake provincial node to the data lake group node.

[0095] It should be noted that the method provided in the embodiment of the present invention can be applied to the business system. The console of the self-regulatory platform is provided with a set of evidence requirements and sent to the personal rights protection supervision system. The supervision system can select a subset of evidence requirements from the set of evidence requirements according to the attributes of the business system and send it to the business system. During the circulation of the supervised data, the business system can call the evidence information generation algorithm according to the subset of evidence requirements and the operation log of the supervised data, generate evidence information, and send the evidence information to the self-regulatory platform.

[0096] The self-regulatory platform can analyze the received evidence information and determine whether there are any abnormalities in the data flow process based on the analysis results. If there are any abnormalities, the abnormal nodes can be determined based on the evidence information and handled.

[0097] It is understandable that the business system may include at least one of a BSS system, an OSS system, and a big data lake, and the big data lake includes a data lake provincial node and a data lake group node. The supervised data may be collected from the BSS system and / or the OSS system. The supervised data may be transmitted to external enterprises, and the supervised data may also be stored in the data lake provincial node, and the data in the data lake provincial node may be further aggregated to the data lake group node. In the process of data transmission, storage, aggregation, etc., it is necessary to store evidence and generate evidence information so that subsequent analysis can be performed based on the evidence information.

[0098] The method provided by the embodiment of the present invention dynamically obtains a subset of evidence requirements according to the attributes of the business system through the self-regulatory platform, and sends it to the corresponding business system, so that the regulatory strategy can be flexibly adjusted according to different business needs and compliance requirements. The business system generates corresponding evidence information during the flow of regulated data, which can ensure the traceability of data and realize the supervision of the entire process of data flow. By analyzing the evidence information, the self-regulatory platform can detect whether there is abnormal behavior in the data flow process. Once abnormal behavior is found, the self-regulatory platform can quickly locate the abnormal node and take corresponding disposal measures. In addition, in the business support system and the operation support system, the regulated data is collected and integrated. Through the big data lake, data from different business systems can be uniformly stored and managed, realizing the step-by-step convergence of the regulated data; in the process of data transmission from the business system to the data lake provincial node, and then from the data lake provincial node to the data lake group node, each node will generate and save the corresponding evidence information. This step-by-step evidence method can effectively supervise the data of the mobile communication network throughout the process, thereby ensuring the security and integrity of the data.

[0099] It should be noted that other embodiments or specific implementations of the data supervision method applied to the business system of the present invention can refer to the above-mentioned method embodiments and will not be described in detail here.

[0100] Based on any of the above embodiments, Figure 3 Schematic diagram of a supervision framework applicable to a mobile communication network provided by the present invention, such as Figure 3 As shown, the supervision method provided by the embodiment of the present invention can form multi-layer collaborative supervision by collecting information at relevant nodes of the mobile communication network and aggregating it step by step, and can realize self-regulation of the entire network and supervision by the regulatory department by combining and storing the log information of the mobile communication service system step by step, and reserving an interface for the regulatory department. The method includes: S1, set the evidence requirement set and evidence element set from the console of the supervision platform, and send them to the personal rights protection supervision system; S2, the personal rights protection supervision system selects a subset of evidence requirements and a subset of evidence elements from the set of evidence requirements and the set of evidence elements according to the attributes of the business system, and sends them to the business system, where the evidence requirements include but are not limited to the granularity, frequency and priority of evidence, and the evidence elements are information sent from the supervision platform that cannot be predicted by other systems and are used to generate evidence information; S3: The business system calls the evidence information generation algorithm to generate evidence information based on the evidence requirement subset and the personal information operation log related to the supervision content (i.e., the supervised data); S4, the business system generates a proof index based on the proof element subset and the proof information, and uploads the proof index to the data flow proof platform; S5, the analysis system of the self-regulatory platform analyzes the generated evidence information according to the preset analysis rules to obtain the analysis results; S6, based on the analysis results, determine whether there is an abnormality in the data flow process. If there is an abnormality, determine the abnormal node based on the evidence information, and deal with the abnormal node to obtain the disposal result, and report the analysis result and disposal result to the superior system; S7, sending all the evidence indexes in the data flow evidence storage platform and the analysis results output by the analysis system to the interface machine of the superior regulatory department; S8, the superior regulatory department pulls detailed evidence information directly from the business system, data flow evidence platform or regulatory system through the interface machine based on the alarm information, evidence index, etc.

[0101] It should be noted that the above-mentioned supervision system can be flexibly deployed as long as there is a business system and traffic information. In the embodiment of the present invention, the scope of supervision objects (i.e., business systems) includes but is not limited to BSS systems, OSS systems, big data, etc. Matters for data supervision mainly include the application, acquisition, use, processing, and transmission of personal information-related data.

[0102] The supervision content includes but is not limited to: whether data operations are documented, whether data operations are compliant, whether data transfer is documented, whether data transfer is authorized, whether it is effectively classified and graded, whether it is effectively desensitized on demand, whether it is effectively deleted, unauthenticated data interface, traversable interface, executable database query interface, account brute force cracking, abnormal single return data volume, abnormal cumulative return data volume, too much sensitive data in a single request, account login abnormality, VPN abnormality, database operation abnormality, data (file) operation abnormality, host network device operation abnormality, application operation abnormality.

[0103] Categories of personal information include, but are not limited to: user basic information, user service information, user consumption account information, online behavior information, location information, and user tag portrait information.

[0104] The business systems include but are not limited to: BSS system, OSS system, and big data lake.

[0105] The BSS system includes but is not limited to: a CRM system and a billing system.

[0106] The OSS system includes but is not limited to: signaling monitoring platform, OIDD fusion aggregation platform, fixed network / mobile network DPI equipment, IP aggregation analysis platform, Internet log retention system, mobile service perception analysis platform, etc.

[0107] The big data lake includes but is not limited to: data lake group node and data lake provincial node.

[0108] like Figure 3 As shown in the figure, the specific flow of data flow, log flow, control flow and supervision flow under this supervision architecture is shown in the figure. The following will introduce them separately: (1) Data flow Users access the telecommunications network through terminals or applications, and transmit signaling information to the service support network during communication. Among them, telecommunications networks include but are not limited to communication networks and service networks. Communication networks include but are not limited to IP networks, signaling networks, fixed-line core networks, 5G core networks, and 4G core networks; terminals or applications include but are not limited to telephones, computers, mobile phones, Pads, TVs, home gateways, APP / SDKs; access methods include but are not limited to: optical fiber, 5G, 4G, WiFi, etc.

[0109] Signaling information includes but is not limited to cell information, base station information, triangulation positioning information, and longitude and latitude information; Internet behavior information includes but is not limited to browsing website addresses, APP information, Internet start time, Internet end time, and traffic volume; call record information includes but is not limited to call records, SMS records, and Internet records; value-added service information includes but is not limited to subscription records and usage records.

[0110] Signaling information transmission: Signaling information is transmitted from the communication network and business network to the provincial signaling monitoring platform, and from the provincial signaling monitoring platform to the group signaling monitoring platform; fixed-line Internet access behavior is transmitted from the fixed-line core network to the fixed-line DPI device, and from the DPI device to the provincial convergence analysis platform, and further summarized to the group convergence analysis platform and the provincial big data platform (i.e., the provincial node of the data lake), and pushed by the provincial big data platform to the group big data platform (i.e., the central node of the data lake).

[0111] Fixed-line / mobile Internet access behavior: Fixed-line / mobile Internet access behavior information is collected by fixed-line DPI devices and mobile DPI devices in OSS respectively, and transmitted to the provincial convergence analysis platform, which is then sent to the group convergence analysis platform and provincial big data platform respectively, and then pushed to the group big data platform by the provincial big data platform; User account information: pushed by the billing business system in the BSS system to the provincial big data platform, and pushed by the provincial big data platform to the group big data platform; User information and service information: pushed by the CRM system in the BSS system to the provincial big data platform, and pushed by the provincial big data platform to the group big data platform; User tag portrait: Based on the information owned by the provincial big data platform, the user tag portrait is automatically generated and further pushed to the group big data platform; Location information: The group signaling monitoring system pushes the user location to the OIDD convergence platform, and then the OIDD convergence platform pushes the location information to the group big data platform; (2) Log stream (i.e., evidence stream) Between the Group Data Flow Evidence Storage Platform and the Provincial Data Flow Evidence Storage Platform: The Provincial Data Flow Evidence Storage Platform generates an evidence storage index based on the evidence storage information. The evidence storage index includes but is not limited to: ID, source system, summary; and sends the evidence storage index to the Group Data Flow Evidence Storage Platform; Between the Group Data Flow Evidence Storage Platform and the systems under its jurisdiction: the governed systems generate evidence storage indexes based on evidence storage information, including but not limited to: ID, source system, summary; and send the evidence storage indexes to the Group Data Flow Evidence Storage Platform; Between the provincial data circulation and evidence storage platform and the systems under its jurisdiction: the governed systems generate evidence indexes based on the evidence information, and the evidence indexes include but are not limited to: ID, source system, summary; and send the evidence indexes to the provincial data circulation and evidence storage platform.

[0112] (3) Control flow When a salesperson or user logs into the system to view various types of information, the information obtained needs to be controlled according to the authority. The control methods mainly include: data classification and grading, data desensitization, data deletion, data encryption, etc. When data is to be transmitted to external enterprises, the transmitted information also needs to be controlled according to the authority. The control methods mainly include: data classification and grading, data desensitization, data deletion, data encryption, etc.

[0113] (4) Regulatory flow The index information in the data transfer and evidence storage platform and the output results of the analysis system are all sent to the interface machine of the superior regulatory department; The superior regulatory department can directly obtain detailed evidence information from the business system, data flow and evidence storage platform or regulatory system through the interface machine based on the alarm information, index information, etc.

[0114] The data supervision device provided by the present invention is described below. The data supervision device described below and the data supervision method described above can be referenced to each other.

[0115] Based on any of the above embodiments, Figure 4 is one of the structural diagrams of the data supervision device provided by the present invention, such as Figure 4 As shown, the device is applied to a self-regulatory platform, and the device includes: The sending unit 410 is configured to obtain, based on the attributes of the business system, a subset of evidence requirements corresponding to the business system from the evidence requirement set, and send the subset of evidence requirements to the business system, so that the business system generates evidence information of the supervised data based on the operation log of the supervised data and the subset of evidence requirements during the flow of the supervised data; The analysis unit 420 is used to receive the evidence information of the supervised data returned by the business system, and analyze the evidence information to obtain an analysis result; A handling unit 430 is used to determine whether there is an abnormality in the flow of the supervised data based on the analysis result, and if there is an abnormality, determine the abnormal node based on the stored evidence information, and handle the abnormal node to obtain a handling result; Among them, the business system includes at least one of a business support system, an operation support system and a big data lake, the big data lake includes a data lake provincial node and a data lake group node, the regulated data is collected from the business support system and / or the operation support system, and the flow process of the regulated data includes at least one of the regulated data being transmitted to an external enterprise, the regulated data being stored in the data lake provincial node, and the regulated data being aggregated from the data lake provincial node to the data lake group node.

[0116] The device provided by the embodiment of the present invention dynamically obtains a subset of evidence requirements according to the attributes of the business system through the self-regulatory platform, and sends it to the corresponding business system, so that the supervision strategy can be flexibly adjusted according to different business needs and compliance requirements. The business system generates corresponding evidence information during the flow of regulated data, which can ensure the traceability of data and realize the supervision of the entire process of data flow. By analyzing the evidence information, the self-regulatory platform can detect whether there is abnormal behavior in the data flow process. Once abnormal behavior is found, the self-regulatory platform can quickly locate the abnormal node and take corresponding disposal measures. In addition, in the business support system and the operation support system, the regulated data is collected and integrated. Through the big data lake, data from different business systems can be uniformly stored and managed, realizing the step-by-step convergence of the regulated data; in the process of data transmission from the business system to the data lake provincial node, and then from the data lake provincial node to the data lake group node, each node will generate and save the corresponding evidence information. This step-by-step evidence method can effectively supervise the data of the mobile communication network throughout the process, thereby ensuring the security and integrity of the data.

[0117] Based on any of the above embodiments, the device also includes a permission control unit, which is used to obtain the permission of the external enterprise when it is detected that the regulated data is transmitted to the external enterprise, and based on the permission of the external enterprise, perform permission control on the regulated data to be transmitted, and the permission control includes at least one of data classification and grading, data desensitization, data deletion, and data encryption.

[0118] Based on any of the above embodiments, the analysis unit 420 is specifically used to: analyze the stored evidence information based on preset analysis rules to obtain the analysis results, and the preset analysis rules include at least one of alarm event triggering, full analysis under non-alarm conditions, and sampling analysis under non-alarm conditions.

[0119] Based on any of the above embodiments, the device also includes an evidence index unit, which is used to: obtain a subset of evidence elements corresponding to the business system from the evidence element set based on the attributes of the business system, and send the subset of evidence elements to the business system, so that the business system generates an evidence index of the regulated data based on the subset of evidence elements and the evidence information of the regulated data; receive the evidence index of the regulated data sent by the business system, and save the evidence index.

[0120] Based on any of the above embodiments, the device also includes a supervision unit, which is used to: receive a data supervision request; based on the evidence index of the regulated data carried in the data supervision request, obtain at least one of the evidence information, analysis results, and disposal results of the regulated data, and send it to the sender of the data supervision request.

[0121] Based on any of the above embodiments, the evidence index includes an index ID, a source system, and a summary.

[0122] Based on any of the above embodiments, the attribute of the business system includes at least one of a business type, a system name, a system identifier, and a system address.

[0123] Based on any of the above embodiments, the evidence storage requirement set includes at least one of evidence storage granularity, evidence storage frequency, and evidence storage priority.

[0124] Based on any of the above embodiments, the supervision content of the regulated data includes whether the data operation is evidenced, whether the data operation is compliant, whether the data flow is evidenced, whether the data flow is authorized, whether the data is effectively classified and graded, whether the data is effectively desensitized on demand, whether the data is effectively deleted, the data interface is not authenticated, the data interface is traversable, the database query interface is executable, the account is brute-force cracked, the single return data volume is abnormal, the cumulative return data volume is abnormal, too much sensitive data is requested in a single request, account login abnormality, VPN abnormality, database operation abnormality, data operation abnormality, file operation abnormality, host network device operation abnormality, and application operation abnormality.

[0125] Based on any of the above embodiments, the business support system includes at least one of a customer relationship management system and a billing accounting system, and the operation support system includes at least one of a signaling monitoring platform, an open information dynamic data fusion aggregation platform, a fixed network / mobile network deep packet analysis device, an IP aggregation analysis platform, an Internet log retention system, and a mobile business perception analysis platform.

[0126] Based on any of the above embodiments, Figure 5 This is the second structural diagram of the data supervision device provided by the present invention, such as Figure 5 As shown, the device is applied to a business system, and the device includes: The information generating unit 510 is used to generate the evidence information of the supervised data based on the evidence requirement subset and the operation log of the supervised data during the circulation process of the supervised data, wherein the evidence requirement subset is selected and sent by the self-supervision platform from the evidence requirement set based on the attributes of the business system; An information sending unit 520 is used to send the evidence information of the supervised data to the self-supervision platform, so that the self-supervision platform analyzes the evidence information and determines whether there is an abnormality in the flow of the supervised data based on the analysis result. If there is an abnormality, the abnormal node is determined based on the evidence information, and the abnormal node is processed to obtain a processing result; Among them, the business system includes at least one of a business support system, an operation support system and a big data lake, the big data lake includes a data lake provincial node and a data lake group node, the regulated data is collected from the business support system and / or the operation support system, and the flow process of the regulated data includes at least one of the regulated data being transmitted to an external enterprise, the regulated data being stored in the data lake provincial node, and the regulated data being aggregated from the data lake provincial node to the data lake group node.

[0127] The device provided by the embodiment of the present invention dynamically obtains a subset of evidence requirements according to the attributes of the business system through the self-regulatory platform, and sends it to the corresponding business system, so that the supervision strategy can be flexibly adjusted according to different business needs and compliance requirements. The business system generates corresponding evidence information during the flow of regulated data, which can ensure the traceability of data and realize the supervision of the entire process of data flow. By analyzing the evidence information, the self-regulatory platform can detect whether there is abnormal behavior in the data flow process. Once abnormal behavior is found, the self-regulatory platform can quickly locate the abnormal node and take corresponding disposal measures. In addition, in the business support system and the operation support system, the regulated data is collected and integrated. Through the big data lake, data from different business systems can be uniformly stored and managed, realizing the step-by-step convergence of the regulated data; in the process of data transmission from the business system to the data lake provincial node, and then from the data lake provincial node to the data lake group node, each node will generate and save the corresponding evidence information. This step-by-step evidence method can effectively supervise the data of the mobile communication network throughout the process, thereby ensuring the security and integrity of the data.

[0128] Other embodiments or specific implementations of the data supervision device of the present invention applied to a business system may refer to the above-mentioned method embodiments and will not be described in detail here.

[0129] Figure 6 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 6As shown, the electronic device may include: a processor 610, a communication interface 620, a memory 630 and a communication bus 640, wherein the processor 610, the communication interface 620, and the memory 630 communicate with each other via the communication bus 640. The processor 610 may call the logic instructions in the memory 630 to execute a data supervision method, which is applied to a self-supervision platform. The method includes: based on the attributes of the business system, obtaining a subset of the evidence requirements corresponding to the business system from the evidence requirements set, and sending the subset of evidence requirements to the business system, so that the business system generates the evidence information of the regulated data based on the operation log of the regulated data and the subset of evidence requirements during the flow of the regulated data; receiving the evidence information of the regulated data returned by the business system, and analyzing the evidence information to obtain an analysis result; based on the analysis result, judging the flow of the regulated data Whether there is an abnormality in the transfer process, if there is an abnormality, determine the abnormal node based on the evidence information, and deal with the abnormal node to obtain a disposal result; wherein, the business system includes at least one of a business support system, an operation support system and a big data lake, the big data lake includes a data lake provincial node and a data lake group node, the regulated data is collected from the business support system and / or the operation support system, and the flow process of the regulated data includes at least one of the regulated data being transmitted to an external enterprise, the regulated data being stored in the data lake provincial node, and the regulated data being aggregated from the data lake provincial node to the data lake group node.

[0130] The processor 610 may also call the logic instructions in the memory 630 to execute the data supervision method, which is applied to the business system. The method includes: in the flow process of the supervised data, based on the evidence requirement subset and the operation log of the supervised data, generating the evidence information of the supervised data, wherein the evidence requirement subset is selected and sent by the self-supervision platform from the evidence requirement set based on the attributes of the business system; sending the evidence information of the supervised data to the self-supervision platform, so that the self-supervision platform analyzes the evidence information, and judging whether there is an abnormality in the flow process of the supervised data based on the analysis result, If there is an abnormality, the abnormal node is determined based on the stored evidence information, and the abnormal node is disposed of to obtain a disposal result; wherein, the business system includes at least one of a business support system, an operation support system and a big data lake, the big data lake includes a data lake provincial node and a data lake group node, the regulated data is collected from the business support system and / or the operation support system, and the flow process of the regulated data includes at least one of the regulated data being transmitted to an external enterprise, the regulated data being stored in the data lake provincial node, and the regulated data being aggregated from the data lake provincial node to the data lake group node.

[0131] In addition, the logic instructions in the above-mentioned memory 630 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present invention, or the part that contributes to the relevant technology or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0132] On the other hand, the present invention also provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the data supervision method provided by the above methods. The method is applied to a self-supervision platform. The method includes: based on the attributes of the business system, obtaining a subset of evidence requirements corresponding to the business system from a set of evidence requirements, and sending the subset of evidence requirements to the business system, so that the business system generates evidence information of the regulated data based on the operation log of the regulated data and the subset of evidence requirements during the circulation of the regulated data; receiving the evidence information of the regulated data returned by the business system, and processing the evidence information; The information is analyzed to obtain an analysis result; based on the analysis result, it is determined whether there is an abnormality in the flow of the regulated data. If there is an abnormality, the abnormal node is determined based on the evidence information, and the abnormal node is disposed of to obtain a disposal result; wherein the business system includes at least one of a business support system, an operation support system and a big data lake, the big data lake includes a data lake provincial node and a data lake group node, the regulated data is collected from the business support system and / or the operation support system, and the flow process of the regulated data includes at least one of the following: the regulated data is transmitted to an external enterprise, the regulated data is stored in the data lake provincial node, and the regulated data is aggregated from the data lake provincial node to the data lake group node.

[0133] In addition, when the computer program is executed by the processor, the computer can also execute the data supervision method provided by the above methods, which is applied to the business system, and the method includes: in the circulation process of the supervised data, based on the subset of evidence requirements and the operation log of the supervised data, generating the evidence information of the supervised data, wherein the subset of evidence requirements is selected and sent by the self-supervision platform from the set of evidence requirements based on the attributes of the business system; sending the evidence information of the supervised data to the self-supervision platform, so that the self-supervision platform analyzes the evidence information, and judging whether there is any problem in the circulation process of the supervised data based on the analysis result. In the case of an exception, if an exception exists, the abnormal node is determined based on the evidence information, and the abnormal node is disposed of to obtain a disposal result; wherein, the business system includes at least one of a business support system, an operation support system and a big data lake, the big data lake includes a data lake provincial node and a data lake group node, the regulated data is collected from the business support system and / or the operation support system, and the flow process of the regulated data includes at least one of the regulated data being transmitted to an external enterprise, the regulated data being stored in the data lake provincial node, and the regulated data being aggregated from the data lake provincial node to the data lake group node.

[0134] On the other hand, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the data supervision method provided by the above-mentioned methods, the method being applied to a self-supervision platform, the method comprising: based on the attributes of the business system, obtaining a subset of the evidence requirements corresponding to the business system from a set of evidence requirements, and sending the subset of evidence requirements to the business system, so that the business system generates evidence information of the regulated data based on the operation log of the regulated data and the subset of evidence requirements during the circulation of the regulated data; receiving the evidence information of the regulated data returned by the business system, and analyzing the evidence information to obtain an analysis result; based on The analysis result determines whether there is an anomaly in the flow process of the regulated data. If there is an anomaly, the abnormal node is determined based on the stored evidence information, and the abnormal node is disposed of to obtain a disposal result; wherein, the business system includes at least one of a business support system, an operation support system and a big data lake, the big data lake includes a data lake provincial node and a data lake group node, the regulated data is collected from the business support system and / or the operation support system, and the flow process of the regulated data includes at least one of the regulated data being transmitted to an external enterprise, the regulated data being stored in the data lake provincial node, and the regulated data being aggregated from the data lake provincial node to the data lake group node.

[0135] In addition, when the computer program is executed by the processor, it is implemented to execute the data supervision method provided by the above methods, which is applied to the business system, and the method includes: in the circulation process of the supervised data, based on the subset of evidence requirements and the operation log of the supervised data, generating the evidence information of the supervised data, wherein the subset of evidence requirements is selected and sent by the self-supervision platform from the set of evidence requirements based on the attributes of the business system; sending the evidence information of the supervised data to the self-supervision platform, so that the self-supervision platform analyzes the evidence information, and judging whether there is any abnormality in the circulation process of the supervised data based on the analysis result. If there is an abnormality, the abnormal node is determined based on the evidence information, and the abnormal node is disposed of to obtain a disposal result; wherein the business system includes at least one of a business support system, an operation support system and a big data lake, the big data lake includes a data lake provincial node and a data lake group node, the regulated data is collected from the business support system and / or the operation support system, and the flow process of the regulated data includes at least one of the regulated data being transmitted to an external enterprise, the regulated data being stored in the data lake provincial node, and the regulated data being aggregated from the data lake provincial node to the data lake group node.

[0136] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0137] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the relevant technology can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiment.

[0138] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A data supervision method, characterized in that: The method is applied to a self-regulatory platform, and the method comprises: Based on the attributes of the business system, a subset of evidence requirements corresponding to the business system is obtained from the evidence requirement set, and the subset of evidence requirements is sent to the business system, so that the business system generates evidence information of the supervised data based on the operation log of the supervised data and the subset of evidence requirements during the circulation of the supervised data; Receiving the evidence information of the supervised data returned by the business system, and analyzing the evidence information to obtain an analysis result; Based on the analysis result, determine whether there is an abnormality in the flow of the supervised data; if there is an abnormality, determine the abnormal node based on the stored evidence information, and deal with the abnormal node to obtain a disposal result; Among them, the business system includes at least one of a business support system, an operation support system and a big data lake, the big data lake includes a data lake provincial node and a data lake group node, the regulated data is collected from the business support system and / or the operation support system, and the flow process of the regulated data includes at least one of the following: the regulated data is transmitted to an external enterprise, the regulated data is stored in the data lake provincial node, and the regulated data is aggregated from the data lake provincial node to the data lake group node.

2. The data supervision method according to claim 1, characterized in that: Also includes: When it is detected that the regulated data is transmitted to an external enterprise, the authority of the external enterprise is obtained, and based on the authority of the external enterprise, the authority control is performed on the regulated data to be transmitted, and the authority control includes at least one of data classification and grading, data desensitization, data deletion, and data encryption.

3. The data supervision method according to claim 1, characterized in that: The analyzing the stored evidence information to obtain the analysis result includes: The stored evidence information is analyzed based on preset analysis rules to obtain the analysis results, wherein the preset analysis rules include at least one of alarm event triggering, full analysis under non-alarm conditions, and sampling analysis under non-alarm conditions.

4. The data supervision method according to claim 1, characterized in that: Also includes: Based on the attributes of the business system, obtaining a subset of evidence elements corresponding to the business system from the set of evidence elements, and sending the subset of evidence elements to the business system, so that the business system generates an evidence index of the supervised data based on the subset of evidence elements and the evidence information of the supervised data; Receive the evidence index of the supervised data sent by the business system, and save the evidence index.

5. The data supervision method according to claim 4, characterized in that: Also includes: Receive data supervision requests; Based on the evidence index of the regulated data carried in the data supervision request, at least one of the evidence information, analysis results, and disposal results of the regulated data is obtained and sent to the sender of the data supervision request.

6. The data supervision method according to claim 4, characterized in that: The evidence index includes an index ID, a source system, and a summary.

7. The data supervision method according to any one of claims 1 to 6, characterized in that: The attributes of the business system include at least one of a business type, a system name, a system identifier, and a system address.

8. The data supervision method according to any one of claims 1 to 6, characterized in that: The evidence storage requirement set includes at least one of evidence storage granularity, evidence storage frequency, and evidence storage priority.

9. The data supervision method according to any one of claims 1 to 6, characterized in that: The supervision content of the regulated data includes at least one of whether data operations are documented, whether data operations are compliant, whether data transfer is documented, whether data transfer is authorized, whether data is effectively classified and graded, whether data is effectively desensitized on demand, whether data is effectively deleted, unauthenticated data interface, traversable data interface, executable database query interface, account brute force cracking, abnormal single return data volume, abnormal cumulative return data volume, too much sensitive data in a single request, account login abnormality, VPN abnormality, database operation abnormality, data operation abnormality, file operation abnormality, host network device operation abnormality, and application operation abnormality.

10. The data supervision method according to any one of claims 1 to 6, characterized in that: The supervised data includes at least one of user basic information, user service information, user consumption account information, online behavior information, location information and user tag portrait information.

11. The data supervision method according to any one of claims 1 to 6, characterized in that: The business support system includes at least one of a customer relationship management system and a billing accounting system, and the operation support system includes at least one of a signaling monitoring platform, an open information dynamic data fusion aggregation platform, a fixed network / mobile network deep packet analysis device, an IP aggregation analysis platform, an Internet log retention system, and a mobile business perception analysis platform.

12. A data supervision method, characterized in that: The method is applied to a business system, and the method comprises: In the process of circulation of the supervised data, based on the subset of evidence requirements and the operation log of the supervised data, the evidence information of the supervised data is generated, wherein the subset of evidence requirements is selected and sent by the self-supervision platform from the set of evidence requirements based on the attributes of the business system; Sending the evidence information of the supervised data to the self-supervision platform, so that the self-supervision platform analyzes the evidence information, and determines whether there is an abnormality in the flow of the supervised data based on the analysis result. If there is an abnormality, the abnormal node is determined based on the evidence information, and the abnormal node is handled to obtain a handling result; Among them, the business system includes at least one of a business support system, an operation support system and a big data lake, the big data lake includes a data lake provincial node and a data lake group node, the regulated data is collected from the business support system and / or the operation support system, and the flow process of the regulated data includes at least one of the regulated data being transmitted to an external enterprise, the regulated data being stored in the data lake provincial node, and the regulated data being aggregated from the data lake provincial node to the data lake group node.

13. A data supervision device, characterized in that: The device is applied to a self-regulatory platform, and comprises: A sending unit, configured to obtain, based on the attributes of the business system, a subset of evidence requirements corresponding to the business system from the set of evidence requirements, and send the subset of evidence requirements to the business system, so that the business system generates evidence information of the regulated data based on the operation log of the regulated data and the subset of evidence requirements during the flow of the regulated data; An analysis unit, configured to receive the evidence information of the supervised data returned by the business system, and analyze the evidence information to obtain an analysis result; A handling unit, configured to determine whether there is an abnormality in the flow of the supervised data based on the analysis result, and if there is an abnormality, determine the abnormal node based on the stored evidence information, and handle the abnormal node to obtain a handling result; Among them, the business system includes at least one of a business support system, an operation support system and a big data lake, the big data lake includes a data lake provincial node and a data lake group node, the regulated data is collected from the business support system and / or the operation support system, and the flow process of the regulated data includes at least one of the regulated data being transmitted to an external enterprise, the regulated data being stored in the data lake provincial node, and the regulated data being aggregated from the data lake provincial node to the data lake group node.

14. A data supervision device, characterized in that: The device is applied to a business system, and the device includes: An information generating unit, configured to generate evidence information of the supervised data based on a subset of evidence requirements and an operation log of the supervised data during the circulation of the supervised data, wherein the subset of evidence requirements is selected and sent by the self-supervision platform from the set of evidence requirements based on the attributes of the business system; An information sending unit, used for sending the evidence information of the supervised data to the self-supervision platform, so that the self-supervision platform analyzes the evidence information, and determines whether there is an abnormality in the flow of the supervised data based on the analysis result, and if there is an abnormality, determines the abnormal node based on the evidence information, and handles the abnormal node to obtain a handling result; Among them, the business system includes at least one of a business support system, an operation support system and a big data lake, the big data lake includes a data lake provincial node and a data lake group node, the regulated data is collected from the business support system and / or the operation support system, and the flow process of the regulated data includes at least one of the regulated data being transmitted to an external enterprise, the regulated data being stored in the data lake provincial node, and the regulated data being aggregated from the data lake provincial node to the data lake group node.

15. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the data supervision method according to any one of claims 1 to 12 is implemented.

16. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the data supervision method according to any one of claims 1 to 12 is implemented.

Images