Archive management system and method based on data analysis

Abstract

The invention discloses an archive management system and method based on data analysis, and particularly relates to the technical field of archive management, and the method comprises the following steps: obtaining document attribute data of archives, generating document attribute vectors, carrying out clustering analysis, finding a similar group set containing similar attributes with a current archive from all archives, and carrying out clustering analysis on the similar group set; then whether an information exposure risk investigation mechanism and a transverse association risk level are triggered or not is judged; respectively carrying out content analysis and access analysis on the current archive, then generating a dynamic desensitization level of the current archive in combination with a transverse association risk level judgment result, and applying the dynamic desensitization level to the current archive in real time; according to the method, the behavior entropy access risk index is obtained by calculating the content sensitivity, dynamically evaluating the file security level and calculating the confusion degree of the user access behavior, the risk perception capability is improved, and the desensitization level of the file is automatically adjusted according to the content sensitivity, the access risk and the overall risk level, so that the data protection is more accurate.

Description

Technical Field

[0001] The present invention relates to the technical field of archive management, and more specifically, to an archive management system and method based on data analysis. Background Art

[0002] In the digital information age, archive management has gradually shifted from the traditional paper management model to electronic and intelligent management. However, the security issues of electronic archives are becoming increasingly prominent, mainly reflected in the following aspects: Traditional archive management systems usually use fixed permission control mechanisms and cannot intelligently identify abnormal access behaviors. For example, a high-privilege user may access sensitive archives during abnormal time periods, but because their permissions are sufficient, traditional systems find it difficult to identify potential risks.

[0003] Existing archive management methods usually evaluate content sensitivity based on fixed rules and cannot be dynamically adjusted according to actual conditions. For example, the sensitivity of the same document may be different at different times and in different environments, but traditional systems have difficulty perceiving this change.

[0004] Traditional desensitization methods mainly rely on preset rules, such as blocking or encrypting certain fields in a fixed format. They are unable to dynamically adjust desensitization strategies according to the risk level of the archives, resulting in insufficient or excessive data protection, affecting the effective use of archives.

[0005] Privacy protection regulations in different time periods have different requirements for data management, requiring enterprises and institutions to fully consider data sensitivity, access control and information desensitization in the process of archive management, but traditional systems are difficult to meet these requirements. To this end, the present invention provides an archive management system and method based on data analysis to solve the above problems. Summary of the invention

[0006] To achieve the above object, the present invention provides the following technical solutions: A file management method based on data analysis includes the following steps: Obtain the document attribute data of the archive, generate the document attribute vector, and perform cluster analysis to find a similar group set with similar attributes to the current archive from all archives; Based on the access data of the current archive, compare it with the average access data of similar groups to determine whether to trigger the information exposure risk investigation mechanism, and when the information exposure risk investigation mechanism is triggered, make a horizontal correlation risk level determination; Content analysis and access analysis are performed on the current file respectively, and then the horizontal correlation risk level determination results, content analysis results and access analysis results are summarized and analyzed to generate a dynamic desensitization level for the current file and apply it to the current file in real time.

[0007] In a preferred embodiment, the document attribute data consists of basic attribute data, content-derived attribute data and access attribute data.

[0008] In a preferred embodiment, the basic attributes include document type, creation department, and storage location; Content-derived attributes include multiple preset keyword tags and sensitive field counts extracted through natural language processing; Access attributes include the number of accesses and the associated user role permission level statistics.

[0009] In a preferred embodiment, the DBSCAN algorithm is used for cluster analysis.

[0010] In a preferred embodiment, comparing the access data of the current archive with the average access data of a similar group to determine whether to trigger the information exposure risk investigation mechanism means: Obtain the first data access frequency value corresponding to each user role authority level in the access data of the current file, and obtain the second data access frequency value corresponding to each user role authority level of each file in the similar group set, obtain the average value and standard deviation of the second data access frequency value corresponding to the same user role authority level through all files in the similar group set within a preset unit time, adopt the 3σ principle, set a standard value interval for each user role authority level based on the average value and standard deviation, compare the first data access frequency value corresponding to the same user role authority level with the standard value interval, if the first data access frequency value corresponding to the same user role authority level falls within the standard value interval, generate a safety signal, if the first data access frequency value corresponding to the same user role authority level does not fall within the standard value interval, generate a risk signal, and when there is a risk signal, trigger the information exposure risk investigation mechanism.

[0011] In a preferred embodiment, the horizontal correlation risk level determination refers to: Count the total number of times risk signals appear and use the total number as the horizontally associated risk level value.

[0012] In a preferred embodiment, performing content analysis on the current archives respectively refers to: Based on the sensitive data category weight, time decay factor and compliance dynamic coefficient, the content sensitivity within the current time window is calculated to generate a content sensitivity index.

[0013] In a preferred embodiment, performing access analysis on the current archives respectively refers to: Based on permission access deviation, user trust score and environmental risk factors, the chaos of access behavior is calculated to generate a behavioral entropy access risk index.

[0014] In a preferred embodiment, the dynamic desensitization level of the current file is obtained through fuzzy reasoning, and the content sensitivity index, behavior entropy access risk index and risk level value are used as input variables of fuzzy logic, and the dynamic desensitization level of the current file is used as the output variable of fuzzy logic. The input variables are fuzzified and the values ​​of the input variables are converted into fuzzy sets. The output variables are fuzzified and the output variables are converted into fuzzy sets. Fuzzy rules are formulated to describe the adaptation degree of each dynamic desensitization level under different data type combinations. The fuzzified input variables are inferred through fuzzy rules to obtain the dynamic desensitization level corresponding to the current file.

[0015] In a preferred embodiment, a file management system based on data analysis includes: A data acquisition module, used to acquire document attribute data of archives; A vector building module, used for generating a document attribute vector based on document attribute data; The cluster analysis module is used to perform clustering operations and find similar groups with similar attributes to the current file from all files; The comparative analysis module is used to compare the access data of the current archive with the average access data of similar groups to determine whether to trigger the information exposure risk investigation mechanism, and to make a horizontal correlation risk level determination when the information exposure risk investigation mechanism is triggered; The archive analysis module is used to perform content analysis and access analysis on the current archive; The fuzzy reasoning module is used to generate the dynamic desensitization level of the current file and apply it to the current file in real time based on the horizontal correlation risk level judgment results, content analysis results and access analysis results.

[0016] Technical effects and advantages of the present invention: The present invention accurately identifies sensitive information involved in archives through content sensitivity calculation, and dynamically evaluates its security level according to actual conditions, thereby preventing highly sensitive archives from being accessed by low-authority users. By analyzing user access behavior and identifying abnormal access patterns, malicious access or data leakage can be effectively prevented. Fuzzy reasoning technology is used to automatically adjust the desensitization level of archives according to content sensitivity, access risk and overall risk level, making data protection more accurate, and will not affect data availability due to excessive desensitization, nor will it cause information leakage due to insufficient desensitization. For example, in low-risk situations, only some sensitive fields are hidden, while in high-risk situations, archives can be completely desensitized or access restricted.

[0017] The present invention can quantify the degree of deviation between the user's actual access rights and the standard access rights through the calculation of the permission access deviation, and quickly discover abnormal access. Combined with the environmental risk factors, the visitor's device, network, geographic location and other information are analyzed to ensure the security of the access environment and effectively prevent unauthorized access. Cluster analysis is used to classify and manage historical archives, establish similar archive groups, and ensure more accurate risk assessment. The chaos of user access behavior is calculated through deep learning models (such as convolutional neural networks), and a behavioral entropy access risk index is generated to improve the ability to perceive risks.

[0018] The present invention can combine the regulatory weight factor and regulatory urgency calculation, and can adapt to the data protection regulations of different countries and regions in real time, such as HIPAA (Health Care Privacy Act), to ensure the compliance of archive management. Dynamically adjust the archive management strategy according to regulatory changes to avoid the risk of violations caused by policy changes. Through automated data analysis, the workload of manual review is reduced, the subjective judgment bias caused by traditional manual desensitization methods is avoided, and the intelligence level of archive management is improved. Using behavioral pattern analysis, access anomalies can be automatically discovered without the need for manual screening by administrators, thereby improving management efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to facilitate understanding by those skilled in the art, the present invention is further described below in conjunction with the accompanying drawings; Figure 1 This is a schematic diagram of a data analysis-based archive management method in the present invention.

[0020] Figure 2 This is a schematic diagram of a data analysis-based archive management system in the present invention. DETAILED DESCRIPTION

[0021] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0022] Reference Figure 1 - Figure 2 The following embodiments are obtained: Embodiment 1: A file management method based on data analysis includes the following steps: Obtain the document attribute data of the archive, generate the document attribute vector, and perform cluster analysis to find a similar group set with similar attributes to the current archive from all archives; the document attribute vector uniformly encodes unstructured archives (such as text, images) and structured metadata (such as access records) into numerical features, breaking data silos and providing standardized input for machine learning. Example: The medical record text (NLP extracts keywords), access times (normalization), and storage location (unique hot encoding) in medical archives are fused into a multidimensional vector. Clustering algorithms (such as DBSCAN) identify archive sets with similar attributes through density or hierarchical relationships, replacing manual classification and solving the lag and subjectivity of traditional rule classification. The historical behavior data of similar groups can be used as the "normal benchmark" of the current archive, such as the access frequency baseline of contract archives. It is conducive to the unified processing of multi-source heterogeneous data and improves the feasibility of analysis. At the same time, it can automatically discover emerging archive types (such as new business contracts) without manually updating classification rules.

[0023] Based on the access data of the current archive, it is compared with the average access data of the similar group set to determine whether the information exposure risk investigation mechanism is triggered, and when the information exposure risk investigation mechanism is triggered, the horizontal correlation risk level is determined; the 3σ principle sets a reasonable fluctuation range based on the historical data distribution of similar groups (mean ± 3 times the standard deviation) to avoid false alarms caused by fixed thresholds (such as reasonable access peaks caused by temporary projects). Example: Level 2 users of a certain R&D document group have an average of 50 visits per month (σ=10), and the threshold is set to 80 times. If the limit is exceeded, an alarm is triggered. Horizontal correlation analysis: Multi-role threshold-exceeding statistics identify coordinated attacks or abuse of authority. For example, Level 1 and Level 3 users abnormally access the same group at the same time, indicating internal collusion risks. Risk level quantification: The number of risk signals directly reflects the complexity of the threat. For example, the risk level of three threshold-exceeding is higher than that of a single threshold-exceeding. Problems solved: Single-point blind spot: Single-authority monitoring is prone to miss cross-role combined attacks. Static threshold defects: Traditional methods cannot adapt to business fluctuations, resulting in high false alarm rates.

[0024] Perform content analysis and access analysis on the current archive respectively, and then summarize and analyze the horizontal correlation risk level determination results, content analysis results, and access analysis results to generate a dynamic desensitization level for the current archive and apply it to the current archive in real time. Content Sensitivity Index: Quantify the inherent sensitivity of archives (such as compliance labels) to identify high-value targets. Behavioral Entropy Access Risk Index: Evaluate the abnormality of access behavior (such as permission deviation, low-trust user operations) to capture potential leakage paths. Use the centroid method to map fuzzy results to specific desensitization levels to ensure enforceability. Relying solely on content or behavior analysis is prone to misjudgment. Comprehensive evaluation improves accuracy. In addition, traditional hierarchical desensitization cannot dynamically respond to real-time risks. Fuzzy reasoning achieves elastic protection.

[0025] Document attribute data consists of basic attribute data, content-derived attribute data, and access attribute data. Basic attributes include document type, creation department, and storage location; content-derived attributes include multiple preset keyword tags and sensitive field counts extracted through natural language processing; access attributes include the number of visits and the associated user role permission level statistics.

[0026] Document attribute data is the core information that describes the characteristics of the archive, and is divided into the following three categories: Basic attribute data: Document type: category identifier of the file, such as contracts, reports, medical records, financial records, etc. Creation department: the department that generates the file, such as the human resources department, finance department, R&D center, etc. Storage location: the physical or digital storage location of the file, such as server number, cloud storage path, filing cabinet number, etc.

[0027] Content-derived attribute data: Preset keyword tags: Keywords extracted from archive content through natural language processing technology, such as "confidentiality agreement", "diagnostic report", "transaction record", etc. Sensitive field count: The number of sensitive information fields contained in the archive, such as ID number, mobile phone number, bank account number, etc.

[0028] Access attribute data: Number of visits: the total number of times the file has been accessed or downloaded. Associated user role permission level: the user role that accesses the file and its permission level, such as ordinary employee (Level 1), department administrator (Level 2), auditor (Level 3), etc.

[0029] The document attribute vector is constructed as follows: The document attribute vector is the process of converting the above attribute data into a numerical form that can be processed by a computer. The specific steps are as follows: Vectorized document types of basic attributes: Use one-hot encoding to map each type into a binary vector. For example, contracts = [1,0,0], reports = [0,1,0], and medical records = [0,0,1].

[0030] Create a department: Also use one-hot encoding, such as Human Resources Department = [1,0,0], Finance Department = [0,1,0], R&D Center = [0,0,1].

[0031] Storage location: Normalize the location numbers and map them to the [0,1] interval. For example, server 1 = 0.2, server 2 = 0.5, server 3 = 0.8.

[0032] Vectorization of content-derived attributes: Preset keyword tags: Count the frequency of each keyword in the archive and perform normalization. For example, in archive A, "confidentiality agreement" appears 3 times and "diagnosis report" appears once, which are normalized to [0.75, 0.25].

[0033] Sensitive field count: The number of sensitive fields is directly used as the feature value and normalized. For example, file A contains 5 sensitive fields and file B contains 10 sensitive fields, which are normalized to 0.5 and 1.0 respectively.

[0034] Vectorization of access attributes: Number of accesses: Normalize the number of accesses. For example, if file A is accessed 100 times and file B is accessed 200 times, the normalized values ​​are 0.5 and 1.0 respectively.

[0035] Associate user role permission levels: Map each permission level to a numerical value, such as Level1=1, Level2=2, Level3=3, and normalize them.

[0036] All the above vectors are concatenated in order to form the final document attribute vector. For example: document type: [1,0,0], creation department: [0,1,0], storage location: [0.2], keyword tag: [0.75,0.25], sensitive field count: [0.5], access count: [0.5], and permission level: [0.33]; the final vector is [1,0,0,0,1,0,0.2,0.75,0.25,0.5,0.5,0.33].

[0037] The DBSCAN algorithm is used for cluster analysis. DBSCAN is a density-based clustering algorithm. Its core idea is to divide groups by identifying the distribution of high-density areas in the data space, while being able to effectively handle noisy data. Unlike traditional distance-based clustering methods (such as K-Means), DBSCAN does not require the number of groups to be specified in advance, but automatically discovers groups through the distribution characteristics of the data itself.

[0038] The core point of the DBSCAN algorithm refers to a data point that has at least a certain number of neighbors within a specified radius. For example, if the radius is set to 100 meters and the threshold of the number of neighbors is 5, then a point is a core point if it has 5 or more neighbors within 100 meters. A border point refers to a point that has fewer neighbors within a specified radius than the threshold, but is within the neighbor range of a core point. A border point belongs to a group but is not the core of the group. A noise point refers to a data point that is neither a core point nor a border point. These points are usually located in low-density areas and are considered outliers or irrelevant data.

[0039] If a point A is within the neighborhood of a core point B, then A is said to be density-reachable from B. If there is a series of points such that each point is density-reachable from the previous point, then these points are said to be density-reachable.

[0040] Execution steps of DBSCAN algorithm: Parameter setting Set two key parameters: Radius: The distance threshold used to define the range of neighbors. Minimum number of neighbors: The threshold of the number of neighbors used to determine the core point.

[0041] Initialization: Randomly select an unvisited point from the dataset and check the number of its neighbors.

[0042] Core point determination: If the number of neighbors of a point reaches or exceeds the threshold, it is marked as a core point and a new group is created. If the threshold is not reached, it is temporarily marked as a noise point (which may be reclassified as a boundary point later). The distance between two points is calculated using the Euclidean distance.

[0043] Group expansion: For each core point, add all its neighbors to the current group. For a newly added neighbor point, if it is also a core point, recursively add its neighbors to the group. For a point whose number of neighbors does not reach the threshold, if it is within the neighbor range of a core point, it is marked as a boundary point and added to the corresponding group. All points that are not marked as core points or boundary points are considered noise points.

[0044] Repeat the above steps until all points have been visited and classified.

[0045] The advantages of the DBSCAN algorithm are: there is no need to preset the number of groups. Unlike algorithms such as K-Means, DBSCAN does not require the number of groups to be specified in advance and can automatically discover natural groups in the data. It has strong noise resistance and can effectively identify and exclude noise points. It is suitable for data sets containing outliers. It can handle groups of any shape, and its density-based characteristics enable it to discover groups of any shape, not just spherical groups. It can also dynamically adapt to data distribution. By adjusting the radius and the threshold of the number of neighbors, it can flexibly adapt to different data density distributions. The radius and the threshold of the number of neighbors can be set according to actual conditions.

[0046] Application of DBSCAN algorithm in archive management: Similar group discovery: By taking the archive attribute vector as input, DBSCAN can automatically discover archive groups with similar attributes. For example, all contract archives may form one group, and all medical records archives may form another group. Dynamic adaptation to new archives: When new archives are added to the system, DBSCAN can quickly determine the group to which they belong without retraining the model.

[0047] Based on the access data of the current archive, compared with the average access data of similar groups, it is determined whether to trigger the information exposure risk investigation mechanism: Obtain the first data access frequency value corresponding to each user role authority level in the access data of the current file, and obtain the second data access frequency value corresponding to each user role authority level of each file in the similar group set, obtain the average value and standard deviation of the second data access frequency value corresponding to the same user role authority level through all files in the similar group set within a preset unit time, adopt the 3σ principle, set a standard value interval for each user role authority level based on the average value and standard deviation, compare the first data access frequency value corresponding to the same user role authority level with the standard value interval, if the first data access frequency value corresponding to the same user role authority level falls within the standard value interval, generate a safety signal, if the first data access frequency value corresponding to the same user role authority level does not fall within the standard value interval, generate a risk signal, and when there is a risk signal, trigger the information exposure risk investigation mechanism.

[0048] The core goal of this mechanism is to dynamically identify potential abnormal access patterns by comparing the current file access behavior with the historical normal behavior of similar groups, so as to timely discover and prevent information exposure risks. Through cluster analysis, groups with similar file attributes are found, and their historical access data is used as the "normal behavior" benchmark to avoid misjudgment caused by using fixed thresholds. The access patterns of similar groups can reflect the business cycle and volatility (such as the natural increase in the number of accesses to financial files at the end of the month). Dynamic benchmarks can adapt to these changes and reduce false positives. Standard value intervals are set for different user roles (such as ordinary employees, department administrators, and auditors) to achieve refined monitoring. Example: The average number of times ordinary employees (Level 1) access contract files per month is 10 times (standard deviation is 2), so the standard value interval is [4,16] (mean ± 3σ). Application of the 3σ principle: Based on statistical principles, 99.7% of normal data falls within the range of mean ± 3 times standard deviation, and behaviors outside this range are considered abnormal. When the access frequency of a role exceeds the standard value interval, a risk signal is generated to indicate potential information exposure risks.

[0049] Traditional methods use fixed thresholds (such as no more than 20 visits per month), which cannot adapt to business fluctuations and lead to high false alarm rates. This mechanism significantly reduces the false alarm rate through dynamic benchmarks and the 3σ principle. Single-role monitoring has blind spots. Only monitoring the access behavior of a single role can easily miss cross-role coordinated attacks. This mechanism comprehensively covers potential risks through multi-role horizontal correlation analysis. Traditional methods rely on retrospective abnormal access records and cannot intercept risks in real time. This mechanism achieves pre-warning and in-process interception through real-time comparison and risk signal generation.

[0050] Horizontal correlation risk level determination means: counting the total number of times risk signals appear, and using the total number as the horizontal correlation risk level value. Horizontal correlation analysis facilitates multi-role collaborative monitoring: counting the total number of risk signals in all roles, as the horizontal correlation risk level value, to identify cross-role collaborative attacks or abuse of authority. Example: A contract file is abnormally accessed by Level 1 and Level 3 users at the same time, indicating that there may be an internal collusion risk. Trigger investigation mechanism: When there is a risk signal, the information exposure risk investigation mechanism is automatically triggered. Content analysis of the current archives refers to calculating the content sensitivity within the current time window based on the sensitive data category weight, time decay factor and compliance dynamic coefficient, and generating a content sensitivity index. Specifically: Quantify the sensitivity of the archive content within the time window, combining information timeliness and compliance changes, and the calculation formula is: ; N is the number of sensitive data categories: the total number of different types of sensitive data categories involved in the current archive, The preset sensitive data category weight represents the importance of the i-th category of sensitive data. For example, personal identity information may have a higher weight than ordinary text data. The frequency or proportion of the occurrence of the i-th category of sensitive data: Statistics on the proportion or number of occurrences of the i-th category of sensitive data in the current file, T is the current time, used to calculate the impact of changes in data sensitivity over time. The time when the data was created or last modified is the timestamp for recording the sensitive data of category i. is the time decay factor, which is used to simulate the trend that data becomes less sensitive over time. λ controls the decay speed. If the λ value is large, the data sensitivity decreases rapidly over time. If the λ value is small, the data sensitivity decays slowly. Compliance dynamic coefficient: reflects the compliance requirements of this category of data, such as the impact of regulatory changes on the importance of data. It is the content sensitivity index. The dynamic attenuation of data sensitivity is controlled by exponential changes of the time decay factor, rather than fixed value settings, which is more in line with the actual situation of the data life cycle. Combined with real-time regulatory updates, it ensures that the calculated sensitivity index can be adjusted as compliance requirements change, allowing different types of sensitive data to dynamically adjust weights according to specific scenarios (such as medical data is more sensitive than ordinary text) to support long-term analysis. According to usage requirements, rolling calculations can be performed within different time windows (such as 7 days, 30 days, 90 days) to analyze the trend of content sensitivity changes.

[0051] ; The regulatory weight coefficient corresponding to the i-th category of sensitive data: represents the importance of the i-th category of sensitive data in the current regulatory environment. For example, the regulatory weight of personal identity information will be higher, while the weight of ordinary business data will be lower. If the regulatory requirements are stricter, then The value increases. The enterprise compliance policy adjustment coefficient corresponding to the i-th type of sensitive data: reflects the enterprise's compliance requirements for specific types of data, determines whether the data sensitivity requires additional protection, and assigns a value through the protection measures taken by the enterprise for specific types of data, and then accumulates and sums them within the time window. Different industries have different requirements for data sensitivity. The preset industry compliance standard coefficient corresponding to the i-th category of sensitive data. The urgency of updating regulations corresponding to the i-th category of sensitive data is evaluated by assessing the impact of current regulations on a certain type of data and adjusting the value based on the latest changes in regulations. is the regulatory urgency influencing factor: a logistic function (sigmoid) is used to control the impact of regulatory updates on the dynamic coefficient of compliance, ensuring that changes in regulations will not cause drastic fluctuations in the data sensitivity index. β is the preset impact coefficient, which controls the impact of regulatory updates. The benchmark point for regulatory changes refers to the reference standard used to measure the degree of change between the current regulatory status and the previous regulatory status during the process of adjusting regulations or compliance requirements. It is usually a regulatory version or policy standard, which is used as a reference for judging the impact of regulations in the current time window and is used to evaluate the impact of new regulatory changes on data management and compliance requirements.

[0052] Access analysis of the current archives refers to: Based on permission access deviation, user trust score and environmental risk factors, the chaos of access behavior is calculated to generate a behavioral entropy access risk index.

[0053] Access behavior is determined by three core factors: Access deviation: measures the degree of deviation between actual access behavior and standard access rights. The access deviation value is obtained by calculating the absolute value of the difference between the user level and the standard access level for accessing archives. The larger the deviation value, the lower the match between the user's permission level and normal access behavior, and the more abnormal the access behavior.

[0054] User trust score: Calculate the user's trustworthiness based on the user's past access behavior, identity authentication records, and historical operations. This is obtained by calculating the maximum similarity between the user's current access behavior, identity authentication records, and operations and all historical access behaviors, identity authentication records, and operations under normal access conditions. This can be calculated using cosine similarity. Similarity calculation methods, such as cosine similarity, are used to measure the degree of closeness between the current behavior and the normal behavior pattern. The higher the value, the more expected the user's access behavior is.

[0055] Environmental risk factor: Considering preset factors such as the device, network, and geographic location at the time of access, the environmental risk of the user's access is assessed. The Euclidean distance is used to measure the degree of deviation between the user's access behavior to the current archive and the ideal access behavior, and the environmental risk assessment value, namely the Euclidean distance, is obtained. The environmental risk assessment value is obtained by using the Euclidean distance calculation. The higher the value, the greater the abnormality of the current access environment.

[0056] Obtain the permission access deviation value, user trust score, and environmental risk assessment value of each user in all access records in the time window, substitute them into the pre-trained machine learning model, i.e., the convolutional neural network, generate the behavior entropy access risk coefficient, and average all the behavior entropy access risk coefficients to obtain the behavior entropy access risk index. When the value of the behavior entropy access risk coefficient is large, it means that the access behavior of the archive is more abnormal. The higher the access risk, the more likely it is that: A user with abnormally low access permissions has accessed a highly sensitive file, or has exceeded the scope of their normal access permissions. The access permissions of the visitor are significantly different from the standard access permissions of the file, and there is a possibility of unauthorized access.

[0057] Abnormal user access behavior: The current visitor's operation pattern deviates greatly from his historical behavior. For example, he usually accessed during the day on weekdays, but suddenly accessed a large number of sensitive files late at night. He only accessed some low-sensitivity documents in the past, but suddenly accessed a large number of highly sensitive files at a high frequency in a short period of time. The access behavior is significantly different from the behavior pattern of the normal user group, which may be an abnormal user or malicious access.

[0058] Higher risk environment: The access request comes from an uncommon or high-risk device, IP address, or geographic location, such as a visitor who usually accesses the company network, but this request comes from overseas or an anonymous network (such as a VPN or proxy server). The access environment is less secure, such as the device failing authentication or the login location being abnormal.

[0059] Potential data leakage or security threats: The archive may be being accessed abnormally, such as malicious operations to steal sensitive data. Potential data leakage caused by illegal access (such as insiders accidentally sharing confidential files). Automated programs or crawler tools attempt to download archive data in batches.

[0060] Convolutional neural network training process: Data preparation: Collect a large amount of historical access data, including samples of normal access behavior and abnormal access behavior, to build a training data set. Data samples include permission access deviation, user trust score, and environmental risk assessment value.

[0061] Feature extraction: Use convolutional neural networks to automatically extract features from access behavior data and identify access behavior patterns. Through convolution operations at different levels, key features are extracted to improve the ability to detect abnormal access behaviors.

[0062] Model training: Use supervised learning methods to train the model through existing access records so that it can accurately distinguish normal access from abnormal access. During the training process, use cross-validation methods to optimize model performance and ensure its generalization ability.

[0063] Model optimization: Use batch normalization, regularization and other technologies to improve the stability and accuracy of the model. Adjust parameters to adapt the model to different access behavior patterns.

[0064] Deployment and real-time calculation: After training is completed, the model is deployed to the archive management system to calculate the risk factor of each access in real time and generate a behavioral entropy access risk index.

[0065] The dynamic desensitization level of the current file is obtained through fuzzy reasoning. The content sensitivity index, behavioral entropy access risk index and risk level value are taken as the input variables of fuzzy logic, and the dynamic desensitization level of the current file is taken as the output variable of fuzzy logic. The input variables are fuzzified and the values ​​of the input variables are converted into fuzzy sets. The output variables are fuzzified and the output variables are converted into fuzzy sets. Fuzzy rules are formulated to describe the adaptation degree of each dynamic desensitization level under different data type combinations. The fuzzified input variables are inferred through fuzzy rules to obtain the dynamic desensitization level corresponding to the current file.

[0066] The purpose of calculating the dynamic desensitization level is to intelligently adjust the data protection level according to the sensitivity, access risk and overall risk situation of the archive, to ensure that the data can be used within a reasonable range while preventing the leakage of sensitive information.

[0067] During the calculation process, the sensitivity of the archive content, the risk level of the access behavior, and the overall risk level are comprehensively considered. Through the fuzzy reasoning method, these factors are comprehensively analyzed to ultimately arrive at a desensitization level suitable for the current archive.

[0068] The calculation of dynamic desensitization level adopts fuzzy reasoning method, and its basic principle includes the following key steps: Fuzzification of input variables: The content sensitivity, access risk and overall risk level of the archive will be converted into fuzzy sets, so that it is no longer a single value, but has a certain degree of uncertainty. For example: content sensitivity can be divided into "low", "medium" and "high". Access risk can be divided into "safe", "suspicious" and "dangerous". The overall risk level can be divided into "mild risk", "medium risk" and "high risk".

[0069] Fuzzy processing of output variables: The desensitization level of the file will also be converted into a fuzzy set, for example: Fully public: no desensitization, suitable for ordinary data. Partial desensitization: hide some sensitive fields, such as showing part of the mobile phone number. Advanced desensitization: encrypt or fuzzify most sensitive data. Complete desensitization: hide all sensitive information and only allow specific users to view it. Restricted access: prohibit unauthorized access, and even strictly restrict some authorized users.

[0070] Formulate fuzzy rules: Define desensitization rules for different data combinations through experience and data analysis. For example: Rule 1: If the content sensitivity of the archive is low, the access risk is low, and the overall risk level is mild, it is set to fully public. Rule 2: If the content sensitivity of the archive is high, the access risk is suspicious, and the overall risk level is moderate, it is set to partially desensitized. Rule 3: If the content sensitivity of the archive is high, the access risk is high, and the overall risk level is high, it is set to advanced desensitization or complete desensitization. Rule 4: If the content sensitivity of the archive is extremely high, the access risk is extremely high, and the overall risk level reaches a dangerous level, it is set to restricted access.

[0071] Fuzzy reasoning calculation: Through fuzzy rules, the input variables are combined and calculated to infer the final desensitization level.

[0072] Defuzzification: The calculated result is usually a combination of multiple desensitization levels (for example, a value between "partial desensitization" and "advanced desensitization"), which needs to be converted into a specific desensitization level that is most suitable for the current file through the defuzzification method.

[0073] Fully public: Applicable to public documents, such as general news reports or ordinary notices. Partially desensitized: Applicable to general business data, such as customer records where some information is hidden. Advanced desensitization: Applicable to files containing sensitive information, such as financial statements, customer contracts, etc. Fully desensitized: Applicable to highly sensitive documents, such as personal identity data, medical records, etc. Restricted access: Applicable to top-secret files, which are only accessible to users with special permissions.

[0074] Embodiment 2: A file management system based on data analysis, comprising: A data acquisition module, used to acquire document attribute data of archives; A vector building module, used for generating a document attribute vector based on document attribute data; The cluster analysis module is used to perform clustering operations and find similar groups with similar attributes to the current file from all files; The comparative analysis module is used to compare the access data of the current archive with the average access data of similar groups to determine whether to trigger the information exposure risk investigation mechanism, and to make a horizontal correlation risk level determination when the information exposure risk investigation mechanism is triggered; The archive analysis module is used to perform content analysis and access analysis on the current archive; The fuzzy reasoning module is used to generate the dynamic desensitization level of the current file and apply it to the current file in real time based on the horizontal correlation risk level judgment results, content analysis results and access analysis results.

[0075] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters in the formula are set by technicians in this field according to actual conditions.

[0076] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0077] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0078] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0079] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A file management method based on data analysis, characterized in that: The following steps are involved: Obtain the document attribute data of the archive, generate the document attribute vector, and perform cluster analysis to find a similar group set with similar attributes to the current archive from all archives; Based on the access data of the current archive, compare it with the average access data of similar groups to determine whether to trigger the information exposure risk investigation mechanism, and when the information exposure risk investigation mechanism is triggered, make a horizontal correlation risk level determination; Content analysis and access analysis are performed on the current file respectively, and then the horizontal correlation risk level determination results, content analysis results and access analysis results are summarized and analyzed to generate a dynamic desensitization level for the current file and apply it to the current file in real time.

2. The archive management method based on data analysis according to claim 1, characterized in that: Document attribute data consists of basic attribute data, content-derived attribute data, and access attribute data.

3. The archive management method based on data analysis according to claim 2, characterized in that: Basic attributes include document type, creation department, and storage location; Content-derived attributes include multiple preset keyword tags and sensitive field counts extracted through natural language processing; Access attributes include the number of accesses and the associated user role permission level statistics.

4. The archive management method based on data analysis according to claim 3 is characterized in that: The DBSCAN algorithm was used for cluster analysis.

5. The archive management method based on data analysis according to claim 4 is characterized in that: Based on the access data of the current archive, compared with the average access data of similar groups, it is determined whether to trigger the information exposure risk investigation mechanism: Obtain the first data access frequency value corresponding to each user role authority level in the access data of the current file, and obtain the second data access frequency value corresponding to each user role authority level of each file in the similar group set, obtain the average value and standard deviation of the second data access frequency value corresponding to the same user role authority level through all files in the similar group set within a preset unit time, adopt the 3σ principle, set a standard value interval for each user role authority level based on the average value and standard deviation, compare the first data access frequency value corresponding to the same user role authority level with the standard value interval, if the first data access frequency value corresponding to the same user role authority level falls within the standard value interval, generate a safety signal, if the first data access frequency value corresponding to the same user role authority level does not fall within the standard value interval, generate a risk signal, and when there is a risk signal, trigger the information exposure risk investigation mechanism.

6. The archive management method based on data analysis according to claim 5, characterized in that: The horizontal correlation risk level determination refers to: Count the total number of times risk signals appear and use the total number as the horizontally associated risk level value.

7. The archive management method based on data analysis according to claim 6 is characterized in that: Conducting content analysis on the current archives separately means: Based on the sensitive data category weight, time decay factor and compliance dynamic coefficient, the content sensitivity within the current time window is calculated to generate a content sensitivity index.

8. The archive management method based on data analysis according to claim 7, characterized in that: Access analysis of the current archives refers to: Based on permission access deviation, user trust score and environmental risk factors, the chaos of access behavior is calculated to generate a behavioral entropy access risk index.

9. The archive management method based on data analysis according to claim 8, characterized in that: The dynamic desensitization level of the current file is obtained through fuzzy reasoning. The content sensitivity index, behavioral entropy access risk index and risk level value are taken as the input variables of fuzzy logic, and the dynamic desensitization level of the current file is taken as the output variable of fuzzy logic. The input variables are fuzzified and the values ​​of the input variables are converted into fuzzy sets. The output variables are fuzzified and the output variables are converted into fuzzy sets. Fuzzy rules are formulated to describe the adaptation degree of each dynamic desensitization level under different data type combinations. The fuzzified input variables are inferred through fuzzy rules to obtain the dynamic desensitization level corresponding to the current file.

10. A file management system based on data analysis, used to implement a file management method based on data analysis as claimed in any one of claims 1 to 9, characterized in that: include: A data acquisition module, used to acquire document attribute data of archives; A vector building module, used for generating a document attribute vector based on document attribute data; The cluster analysis module is used to perform clustering operations and find similar groups with similar attributes to the current file from all files; The comparative analysis module is used to compare the access data of the current archive with the average access data of similar groups to determine whether to trigger the information exposure risk investigation mechanism, and to make a horizontal correlation risk level determination when the information exposure risk investigation mechanism is triggered; The archive analysis module is used to perform content analysis and access analysis on the current archive; The fuzzy reasoning module is used to generate the dynamic desensitization level of the current file and apply it to the current file in real time based on the horizontal correlation risk level judgment results, content analysis results and access analysis results.

Images