An archive management system and method based on data analysis

Abstract

The present invention discloses an archive management system and method based on data analysis, specifically relating to the technical field of archive management, and includes the following steps: obtaining the document attribute data of the archives, generating document attribute vectors, and performing clustering analysis to find a set of similar groups containing similar attributes to the current archive from all archives, and then determining whether to trigger the information exposure risk investigation mechanism and the horizontal association risk level; performing content analysis and access analysis on the current archive respectively, and then combining the determination results of the horizontal association risk level to generate the dynamic desensitization level of the current archive and applying it to the current archive in real time; the present invention dynamically evaluates the archive security level through content sensitivity calculation, calculates the chaos degree of the user access behavior, obtains the behavior entropy access risk index, improves the risk perception ability, and automatically adjusts the desensitization level of the archives according to the content sensitivity, access risk and overall risk level, making data protection more accurate.

Description

Technical Field

[0001] The present invention relates to the technical field of file management. More specifically, the present invention relates to a file management system and method based on data analysis. Background Art

[0002] In the digital information age, file management has gradually shifted from the traditional paper management mode to electronic and intelligent management. However, the security issues of electronic files have become increasingly prominent, mainly reflected in the following aspects:

[0003] Traditional file management systems usually adopt a fixed permission control mechanism and cannot intelligently identify abnormal access behaviors. For example, a high-privilege user may access sensitive files during abnormal time periods, but due to their sufficient permissions, it is difficult for traditional systems to identify potential risks.

[0004] Existing file management methods usually evaluate the sensitivity of content based on fixed rules and cannot be dynamically adjusted according to actual situations. For example, the sensitivity of the same file may be different at different times and in different environments, but it is difficult for traditional systems to perceive this change.

[0005] Traditional desensitization methods mainly rely on preset rules, such as masking or encrypting certain fields in a fixed format, and cannot dynamically adjust the desensitization strategy according to the risk level of the file, resulting in insufficient or excessive data protection and affecting the effective utilization of files.

[0006] The privacy protection regulations in each time period have put forward different requirements for data management, requiring enterprises and institutions to fully consider data sensitivity, access control, and information desensitization during the file management process. However, traditional systems are difficult to meet these requirements. Therefore, the present invention provides a file management system and method based on data analysis in order to solve the above problems. Summary of the Invention

[0007] To achieve the above object, the present invention provides the following technical solutions:

[0008] A file management method based on data analysis, comprising the following steps:

[0009] Obtain the document attribute data of the file, generate a document attribute vector, and perform clustering analysis to find a set of similar groups containing similar attributes to the current file from all files;

[0010] Based on the access data of the current file, compare it with the average access data of the set of similar groups, determine whether to trigger the information exposure risk investigation mechanism, and when triggering the information exposure risk investigation mechanism, perform a horizontal association risk level determination;

[0011] Perform content analysis and access analysis on the current file respectively, and then conduct a summary analysis of the horizontal correlation risk level determination results, content analysis results, and access analysis results to generate the dynamic desensitization level of the current file and apply it to the current file in real time.

[0012] In a preferred embodiment, the document attribute data consists of basic attribute data, content-derived attribute data, and access attribute data.

[0013] In a preferred embodiment, the basic attributes include document type, creation department, and storage location;

[0014] The content-derived attributes include multiple preset keyword tags extracted through natural language processing and sensitive field counts;

[0015] The access attributes include access times and the statistical results of the associated user role permission levels.

[0016] In a preferred embodiment, the DBSCAN algorithm is used for clustering analysis.

[0017] In a preferred embodiment, based on the access data of the current file, comparing it with the average access data of the similar group set to determine whether to trigger the information exposure risk investigation mechanism refers to:

[0018] Obtain the first data access frequency values corresponding to each user role permission level in the access data of the current file, and obtain the second data access frequency values corresponding to each user role permission level of each file in the similar group set. Obtain the average value and standard deviation of the second data access frequency values corresponding to the same user role permission level of all files in the similar group set within a preset unit time. Adopt the 3σ principle to set the standard value interval for each user role permission level based on the average value and standard deviation. Compare the first data access frequency value corresponding to the same user role permission level with the standard value interval. If the first data access frequency value corresponding to the same user role permission level falls within the standard value interval, a security signal is generated. If the first data access frequency value corresponding to the same user role permission level does not fall within the standard value interval, a risk signal is generated. When there is a risk signal, trigger the information exposure risk investigation mechanism.

[0019] In a preferred embodiment, the determination of the horizontal correlation risk level refers to:

[0020] Count the total number of occurrences of risk signals, and use the total number as the risk level value of the horizontal correlation.

[0021] In a preferred embodiment, performing content analysis on the current file respectively refers to:

[0022] Calculate the content sensitivity within the current time window based on the sensitive data category weight, time decay factor, and compliance dynamic coefficient, and generate a content sensitivity index.

[0023] In a preferred embodiment, performing access analysis on the current file respectively refers to:

[0024] Calculate the chaos degree of the access behavior based on the permission access deviation, user trust score, and environmental risk factor, and generate a behavioral entropy access risk index.

[0025] In a preferred embodiment, the dynamic desensitization level of the current file is obtained through fuzzy inference. The content sensitivity index, behavioral entropy access risk index, and risk level value are used as input variables of fuzzy logic together, and the dynamic desensitization level of the current file is used as the output variable of fuzzy logic. Perform fuzzy processing on the input variables, convert the values of the input variables into fuzzy sets, perform fuzzy processing on the output variable, convert the output variable into a fuzzy set, formulate fuzzy rules to describe the adaptation degree of each dynamic desensitization level under different data type combinations, and infer the fuzzy input variables through the fuzzy rules to obtain the dynamic desensitization level corresponding to the current file.

[0026] In a preferred embodiment, a file management system based on data analysis includes:

[0027] A data acquisition module for acquiring the document attribute data of the file;

[0028] A vector construction module for generating a document attribute vector based on the document attribute data;

[0029] A clustering analysis module for performing clustering operations to find a set of similar groups containing similar attributes to the current file from all files;

[0030] A comparative analysis module for comparing the access data of the current file with the average access data of the set of similar groups to determine whether to trigger the information exposure risk investigation mechanism, and when triggering the information exposure risk investigation mechanism, perform a horizontal correlation risk level determination;

[0031] A file analysis module for performing content analysis and access analysis on the current file respectively;

[0032] A fuzzy inference module for generating the dynamic desensitization level of the current file according to the horizontal correlation risk level determination result, content analysis result, and access analysis result, and applying it to the current file in real time.

[0033] The technical effects and advantages of the present invention:

[0034] Through content sensitivity calculation, the present invention accurately identifies sensitive information involved in files, dynamically evaluates its security level according to the actual situation, and prevents high-sensitivity files from being accessed by low-privilege users. By analyzing user access behaviors and identifying abnormal access patterns, malicious access or data leakage can be effectively prevented. Using fuzzy inference technology, according to content sensitivity, access risk, and overall risk level, the desensitization level of files is automatically adjusted to make data protection more accurate, without affecting the availability of data due to excessive desensitization, nor causing information leakage due to insufficient desensitization. For example, in low-risk situations, only some sensitive fields are hidden, while in high-risk situations, the files can be fully desensitized or access-restricted.

[0035] Through permission access deviation calculation, the present invention can quantify the deviation degree between the actual access permission of a user and the standard access permission, and quickly discover abnormal access. By combining environmental risk factors to analyze information such as the device, network, and geographical location of the visitor, the security of the access environment is ensured, and unauthorized access is effectively prevented. Cluster analysis is used to classify and manage historical files, establish groups of similar files, and ensure more accurate risk assessment. By calculating the chaos degree of user access behaviors through a deep learning model (such as a convolutional neural network), a behavioral entropy access risk index is generated to improve the perception ability of risks.

[0036] The present invention can be combined with the calculation of regulatory weight factors and regulatory urgency, and can adapt to data protection regulations in different countries and regions in real time, such as HIPAA (Health Insurance Portability and Accountability Act), etc., to ensure the compliance of file management. Dynamically adjust the file management strategy according to regulatory changes to avoid the risk of violations caused by policy changes. Through automated data analysis, the workload of manual review is reduced, the subjective judgment deviation brought by traditional manual desensitization methods is avoided, and the intelligence level of file management is improved. Using behavioral pattern analysis, abnormal access can be automatically discovered without manual screening by administrators, improving management efficiency. Brief Description of the Drawings

[0037] For the convenience of those skilled in the art to understand, the present invention will be further described below in conjunction with the accompanying drawings;

[0038] Figure 1 It is a schematic diagram of a file management method based on data analysis in the present invention.

[0039] Figure 2 It is a schematic diagram of a file management system based on data analysis in the present invention. Detailed Embodiments

[0040] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0041] Reference Figure 1 - Figure 2 The following examples were obtained:

[0042] Example 1:

[0043] A data analysis-based archive management method comprises the following steps:

[0044] Document attribute data from archives is obtained, document attribute vectors are generated, and cluster analysis is performed to identify similar groups across all archives that share similar attributes with the current archive. Document attribute vectors unify unstructured archive data (such as text and images) and structured metadata (such as access records) into numerical features, breaking down data silos and providing standardized input for machine learning. For example, medical records contain medical records (keyword extraction using NLP), access counts (normalization), and storage locations (one-hot encoding) combined into a multidimensional vector. Clustering algorithms (such as DBSCAN) identify groups of archives with similar attributes based on density or hierarchical relationships, replacing manual classification and addressing the lag and subjectivity of traditional rule-based classification. Historical behavioral data for similar groups can serve as a "normal baseline" for the current archive, such as a baseline for access frequency of contract archives. This facilitates unified processing of multi-source, heterogeneous data, improving analytical feasibility, and automatically discovering emerging archive types (such as new business contracts) without the need for manual updates to classification rules.

[0045] Based on the access data of the current file, compare it with the average access data of the set of similar groups to determine whether to trigger the information exposure risk investigation mechanism. When the information exposure risk investigation mechanism is triggered, conduct a horizontal correlation risk level determination; the 3σ principle sets a reasonable fluctuation range based on the historical data distribution (mean ± 3 times the standard deviation) of similar groups to avoid false alarms caused by fixed thresholds (such as reasonable access peaks caused by temporary projects). Example: The average monthly access of Level 2 users in a certain R & D document group is 50 times (σ = 10), and the threshold is set at 80 times. If the limit is exceeded, an alarm is triggered. Horizontal correlation analysis: Statistical identification of collaborative attacks or abuse of authority by multiple roles exceeding the threshold. For example, if Level 1 and Level 3 users access the same group abnormally at the same time, it indicates the risk of internal collusion. Risk level quantification: The number of risk signals directly reflects the complexity of the threat. For example, the risk level of 3 times exceeding the threshold is higher than that of a single time exceeding the threshold. Problems solved: Single - point blind spot: Single - permission monitoring is prone to missing cross - role combination attacks. Defects of static thresholds: Traditional methods cannot adapt to business fluctuations, resulting in a high false alarm rate.

[0046] Conduct content analysis and access analysis on the current file respectively, and then conduct a comprehensive analysis of the horizontal correlation risk level determination result, content analysis result, and access analysis result to generate the dynamic desensitization level of the current file and apply it to the current file in real - time. Content sensitivity index: Quantify the inherent sensitivity of the file (such as compliance labels) to identify high - value targets. Behavioral entropy access risk index: Evaluate the abnormality of access behavior (such as permission deviation, operations of low - trust users) to capture potential leakage paths. Map the fuzzy results to specific desensitization levels through the centroid method to ensure executability. Relying solely on content or behavior analysis is prone to misjudgment. Comprehensive evaluation improves accuracy. Moreover, traditional hierarchical desensitization cannot respond dynamically to real - time risks, and fuzzy reasoning realizes flexible protection.

[0047] Document attribute data consists of basic attribute data, content - derived attribute data, and access attribute data. Basic attributes include document type, creation department, and storage location; content - derived attributes include multiple preset keyword tags extracted through natural language processing and sensitive field counts; access attributes include access times and statistical information on the permission levels of associated user roles.

[0048] Document attribute data is the core information describing the characteristics of the file and is divided into the following three categories:

[0049] Basic attribute data: Document type: The category identifier of the file, such as contract, report, medical record, financial record, etc. Creation department: The department that generates the file, such as Human Resources Department, Finance Department, R & D Center, etc. Storage location: The physical or digital storage location of the file, such as server number, cloud storage path, file cabinet number, etc.

[0050] Content Derived Attribute Data: Preset Keyword Tags: Keywords extracted from archival content through natural language processing techniques, such as "confidentiality agreement", "diagnostic report", "transaction record", etc. Sensitive Field Count: The number of sensitive information fields contained in the archive, such as ID numbers, mobile phone numbers, bank account numbers, etc.

[0051] Access Attribute Data: Number of Accesses: The total number of times the archive is retrieved or downloaded. Associated User Role Permission Level: The user role accessing the archive and their permission level, such as ordinary employee (Level1), department administrator (Level2), auditor (Level3), etc.

[0052] The construction method of the document attribute vector is as follows: The document attribute vector is the process of converting the above attribute data into a numerical form that can be processed by a computer. The specific steps are as follows:

[0053] Vectorization of Basic Attributes Document Type: Using one-hot encoding, each type is mapped to a binary vector. For example, contract = [1, 0, 0], report = [0, 1, 0], medical record = [0, 0, 1].

[0054] Creating Department: Also using one-hot encoding, such as Human Resources Department = [1, 0, 0], Finance Department = [0, 1, 0], R & D Center = [0, 0, 1].

[0055] Storage Location: Normalize the location number and map it to the interval [0, 1]. For example, Server 1 = 0.2, Server 2 = 0.5, Server 3 = 0.8.

[0056] Vectorization of Content Derived Attributes: Preset Keyword Tags: Count the frequency of each keyword in the archive and perform normalization. For example, in Archive A, "confidentiality agreement" appears 3 times and "diagnostic report" appears 1 time. After normalization, it is [0.75, 0.25].

[0057] Sensitive Field Count: Directly use the number of sensitive fields as the feature value and perform normalization. For example, Archive A contains 5 sensitive fields and Archive B contains 10 sensitive fields. After normalization, they are 0.5 and 1.0 respectively.

[0058] Vectorization of Access Attributes: Number of Accesses: Normalize the number of accesses. For example, Archive A is accessed 100 times and Archive B is accessed 200 times. After normalization, they are 0.5 and 1.0 respectively.

[0059] Associated User Role Permission Level: Map each permission level to a numerical value, such as Level1 = 1, Level2 = 2, Level3 = 3, and perform normalization.

[0060] Concatenate all the above vectors in order to form the final document attribute vector. For example: document type: [1, 0, 0], creation department: [0, 1, 0], storage location: [0.2], keyword tags: [0.75, 0.25], sensitive field count: [0.5], access times: [0.5], and permission level: [0.33]; final vector: [1, 0, 0, 0, 1, 0, 0.2, 0.75, 0.25, 0.5, 0.5, 0.33].

[0061] The DBSCAN algorithm is used for clustering analysis. DBSCAN is a density-based clustering algorithm. Its core idea is to divide groups by identifying the distribution of high-density regions in the data space and can effectively handle noise data. Different from traditional distance-based clustering methods (such as K-Means), DBSCAN does not require specifying the number of groups in advance but automatically discovers groups through the distribution characteristics of the data itself.

[0062] The core point of the DBSCAN algorithm refers to a data point that has at least a certain number of neighbors within a specified radius range. For example, if the radius is set to 100 meters and the neighbor quantity threshold is 5, then a point is a core point if it has 5 or more neighbors within 100 meters. A border point is a point that has fewer neighbors than the threshold within the specified radius range but is within the neighbor range of a certain core point. Border points belong to a certain group but are not the core of the group. Noise points are data points that are neither core points nor border points. These points are usually located in low-density regions and are considered outliers or irrelevant data.

[0063] If a point A is within the neighbor range of a core point B, then it is said that A density-reaches from B. If there exists a series of points such that each point density-reaches from the previous point, then these points are said to be density-reachable.

[0064] Execution steps of the DBSCAN algorithm: Parameter setting Set two key parameters: Radius: The distance threshold used to define the neighbor range. Minimum number of neighbors: The neighbor quantity threshold used to judge core points.

[0065] Initialization: Randomly select an unvisited point from the dataset and check the number of its neighbors.

[0066] Core point determination: If the number of neighbors of this point reaches or exceeds the quantity threshold, then mark it as a core point and create a new group. If it does not reach the quantity threshold, then temporarily mark it as a noise point (it may be reclassified as a border point later). The distance between two points is calculated by the Euclidean distance.

[0067] Cluster Expansion: For each core point, add all its neighbors to the current cluster. For the newly added neighbor points, if it is also a core point, recursively add its neighbors to the cluster. For points whose number of neighbors does not reach the threshold, if it is within the neighbor range of a certain core point, mark it as a border point and add it to the corresponding cluster. All points that are not marked as core points or border points are regarded as noise points.

[0068] Repeat the above steps until all points are visited and classified.

[0069] The advantages of the DBSCAN algorithm are as follows: It does not require presetting the number of clusters. Different from algorithms such as K-Means, DBSCAN does not need to pre-specify the number of clusters and can automatically discover natural clusters in the data. It has strong anti-noise ability and can effectively identify and exclude noise points, being suitable for datasets containing outliers. It can handle clusters of arbitrary shapes. Its density-based property enables it to discover clusters of arbitrary shapes, not just spherical clusters. It can also dynamically adapt to the data distribution. By adjusting the radius and the neighbor number threshold, it can flexibly adapt to different data density distributions, and the radius and neighbor number threshold can be set according to the actual situation.

[0070] Application of the DBSCAN algorithm in file management: Discovery of similar clusters: By taking the file attribute vector as the input, DBSCAN can automatically discover clusters of files with similar attributes. For example, all contract files may form one cluster, and all medical record files may form another cluster. Dynamically adapting to newly added files: When a newly added file joins the system, DBSCAN can quickly determine its belonging cluster without retraining the model.

[0071] Based on the access data of the current file, comparing it with the average access data of the set of similar clusters to determine whether to trigger the information exposure risk investigation mechanism means:

[0072] Obtain the first data access frequency value corresponding to each user role permission level in the access data of the current file, and obtain the second data access frequency value corresponding to each user role permission level of each file in the set of similar clusters. Obtain the average value and standard deviation of the second data access frequency values corresponding to the same user role permission level of all files in the set of similar clusters within a preset unit time. Adopt the 3σ principle to set a standard value interval for each user role permission level based on the average value and standard deviation. Compare the first data access frequency value corresponding to the same user role permission level with the standard value interval. If the first data access frequency value corresponding to the same user role permission level falls within the standard value interval, generate a security signal. If the first data access frequency value corresponding to the same user role permission level does not fall within the standard value interval, generate a risk signal. When there is a risk signal, trigger the information exposure risk investigation mechanism.

[0073] The core objective of this mechanism is to dynamically identify potential abnormal access patterns by comparing the access behavior of the current file with the historical normal behavior of similar groups, so as to detect and prevent the risk of information exposure in a timely manner. By means of cluster analysis, groups similar to the attributes of the current file are found, and their historical access data is used as the benchmark of "normal behavior", avoiding misjudgment caused by using a fixed threshold. The access patterns of similar groups can reflect business periodicity and volatility (such as the natural increase in the access volume of financial files at the end of the month), and the dynamic benchmark can adapt to these changes and reduce false alarms. Standard value intervals are set for different user roles (such as ordinary employees, department administrators, auditors) respectively to achieve refined monitoring. Example: The average monthly access times of ordinary employees (Level1) to contract files is 10 times (standard deviation is 2), then the standard value interval is [4, 16] (mean ± 3σ). Application of the 3σ principle: Based on statistical principles, 99.7% of the normal data falls within the range of mean ± 3 times the standard deviation, and behaviors outside this range are regarded as abnormal. When the access frequency of a certain role exceeds the standard value interval, a risk signal is generated to prompt the potential risk of information exposure.

[0074] Traditional methods use a fixed threshold (such as the monthly access times not exceeding 20 times), which cannot adapt to business fluctuations and result in a high false alarm rate. This mechanism significantly reduces the false alarm rate through a dynamic benchmark and the 3σ principle. There are blind spots in single-role monitoring. Only monitoring the access behavior of a single role is likely to miss cross-role collaborative attacks. This mechanism comprehensively covers potential risks through multi-role horizontal correlation analysis. Traditional methods rely on retrospectively investigating abnormal access records afterwards and cannot intercept risks in real time. This mechanism realizes early warning before events and interception during events through real-time comparison and risk signal generation.

[0075] The determination of the horizontal correlation risk level refers to: counting the total number of occurrences of risk signals, and taking the total number as the risk level value of horizontal correlation. Horizontal correlation analysis is conducive to multi-role collaborative monitoring: counting the total number of risk signals among all roles as the horizontal correlation risk level value to identify cross-role collaborative attacks or abuse of permissions. Example: A certain contract file is abnormally accessed by Level1 and Level3 users at the same time, indicating that there may be a risk of internal collusion. Trigger the investigation mechanism: When there is a risk signal, the information exposure risk investigation mechanism is automatically triggered.

[0076] Conducting content analysis on the current file respectively means: calculating the content sensitivity within the current time window based on the weight of sensitive data categories, the time decay factor, and the compliance dynamic coefficient, and generating a content sensitivity index. Specifically:

[0077] Quantify the content sensitivity of the file within the time window, combined with information timeliness and compliance changes. The calculation formula is:

[0078] ; N is the number of sensitive data categories: the total number of different types of sensitive data categories involved in the current file, is the preset weight of the sensitive data category: representing the importance of the i-th type of sensitive data. For example, personal identity information may have a higher weight than ordinary text data. is the occurrence frequency or proportion of the i-th type of sensitive data: counting the proportion or occurrence times of the i-th type of sensitive data in the current file. T is the current time, used to calculate the impact of data sensitivity change over time. is the data creation or last modification time, which is the timestamp for recording the i-th type of sensitive data, is the time decay factor, which is used to simulate the trend that data becomes less sensitive over time. The λ controls the decay speed. If the λ value is large, the data sensitivity decreases rapidly over time. If the λ value is small, the data sensitivity decays slowly. is the compliance dynamic coefficient: reflecting the compliance requirements of this category of data, such as the impact of regulatory changes on the importance of data. is the content sensitivity index. Through the exponential change of the time decay factor, it controls the dynamic decay of data sensitivity, rather than setting a fixed value, which is more in line with the actual situation of the data life cycle. Combined with real-time regulatory updates, it ensures that the calculated sensitivity index can be adjusted according to compliance requirements. It allows different types of sensitive data to dynamically adjust weights according to specific scenarios (such as medical data being more sensitive than ordinary text), supports long-term analysis, and can perform rolling calculations within different time windows (such as 7 days, 30 days, 90 days) according to usage requirements to analyze the change trend of content sensitivity.

[0079] ; is the regulatory weight coefficient corresponding to the i-th type of sensitive data: representing the importance of the i-th type of sensitive data in the current regulatory environment. For example, the regulatory weight of personal identity information will be higher, while the weight of ordinary business data is lower. If the regulatory requirements are more stringent, the value increases. is the enterprise compliance strategy adjustment coefficient corresponding to the i-th type of sensitive data: reflecting the enterprise's compliance requirements for specific types of data, determining whether additional protection is required for data sensitivity, and assigning values through the protection measures taken by the enterprise for specific types of data, and then accumulating and summing within the time window. Different industries have different sensitivity requirements for data, is the preset industry compliance standard coefficient corresponding to the i-th type of sensitive data. is the regulatory update urgency corresponding to the i-th type of sensitive data, evaluating the impact degree of the current regulations on a certain type of data, and adjusting and assigning values based on the latest regulatory changes, Let $\alpha$ be the regulatory urgency impact factor: A logistic function (sigmoid) is used to control the impact of regulatory updates on the compliance dynamic coefficient, ensuring that changes in regulations do not cause drastic fluctuations in the data sensitivity index. $\beta$ is the preset impact coefficient that controls the amplitude of the impact of regulatory updates. $t_0$ represents the baseline point of regulatory change. The baseline point of regulatory change refers to a reference standard used to measure the degree of change between the current regulatory state and the past regulatory state during the adjustment of regulations or compliance requirements. It is usually a regulatory version or policy standard that serves as a reference for judging the impact of regulations within the current time window and is used to evaluate the impact of new regulatory changes on data management and compliance requirements.

[0080] Performing access analysis on the current file respectively means:

[0081] Based on the access deviation of permissions, user trust score, and environmental risk factors, calculate the chaos degree of access behavior and generate the behavioral entropy access risk index.

[0082] Access behavior is determined by three core factors: Access deviation of permissions: Measures the degree of deviation between the actual access behavior and the standard access permissions. The access deviation value is obtained by calculating the absolute value of the difference between the user level and the standard access permission level of the accessed file. The larger the deviation value, the lower the matching degree between the user's permission level and the normal access behavior, and the higher the abnormality of the access behavior.

[0083] User trust score: Based on the user's past access behavior, identity authentication records, and historical operations, calculate their credibility. It can be obtained by calculating the maximum similarity between the user's current access behavior, identity authentication records, and operations and all historical access behaviors, identity authentication records, and operations under normal access conditions, and can be calculated through cosine similarity. A similarity calculation method, such as cosine similarity, is used to measure the closeness of the current behavior to the normal behavior pattern. The higher the value, the more in line with expectations the user's access behavior is.

[0084] Environmental risk factor: Consider preset factors such as the device, network, and geographical location during access to evaluate the environmental risk of the user's access. The Euclidean distance is used to measure the degree of deviation between the user's access behavior to the current file and the ideal access behavior, and the environmental risk assessment value, that is, the Euclidean distance, is obtained. By calculating the Euclidean distance, the environmental risk assessment value is obtained. The higher the value, the greater the abnormality of the current access environment.

[0085] Obtain the permission access deviation value, user trust score, and environmental risk assessment value for each user in all access records within the time window. Substitute these values into a pre-trained machine learning model, namely a convolutional neural network, to generate a behavioral entropy access risk coefficient. Calculate the average value of all behavioral entropy access risk coefficients to obtain the behavioral entropy access risk index. When the value of the behavioral entropy access risk coefficient is large, it indicates that the access behavior of the file is more abnormal and the access risk is higher, which may imply the following situations:

[0086] The access permission is abnormal. A low-privilege user has accessed a highly sensitive file or exceeded the scope of permissions they usually access. The permissions of the visitor differ significantly from the standard access permissions of the file, indicating a possibility of unauthorized access.

[0087] The user's access behavior is abnormal: The operation mode of the current visitor deviates significantly from their historical behavior. For example, they usually accessed during weekdays during the day, but suddenly accessed a large number of sensitive files late at night. They used to only access some low-sensitivity documents, but suddenly accessed a large number of high-sensitivity files frequently within a short period. The access behavior is significantly different from the behavior patterns of the normal user group, which may indicate an abnormal user or malicious access.

[0088] The environmental risk is relatively high: The access request comes from an uncommon or high-risk device, IP address, or geographical location. For example, the visitor usually accesses through the company network, but this request comes from overseas or an anonymous network (such as a VPN or proxy server). The security of the access environment is relatively low, such as the device not passing authentication or the login location being abnormal.

[0089] Potential data leakage or security threats: The file may be being accessed abnormally. For example, malicious operations to steal sensitive data. Potential data leakage caused by unauthorized access (such as accidental sharing of confidential files by insiders). Automated programs or crawler tools attempting to download file data in batches.

[0090] Convolutional neural network training process: Data preparation: Collect a large amount of historical access data, including samples of normal access behavior and abnormal access behavior, to construct a training dataset. The data samples include permission access deviation, user trust score, and environmental risk assessment value.

[0091] Feature extraction: Use a convolutional neural network to automatically extract features from the access behavior data and identify the patterns of access behavior. Through convolutional operations at different levels, key features are extracted to improve the detection ability for abnormal access behavior.

[0092] Model training: Adopt a supervised learning method to train the model through existing access records so that it can accurately distinguish normal access from abnormal access. During the training process, use the cross-validation method to optimize the model performance and ensure its generalization ability.

[0093] Model Optimization: Techniques such as batch normalization and regularization are adopted to improve the stability and accuracy of the model. By adjusting parameters, the model is made to adapt to different access behavior patterns.

[0094] Deployment and Real-time Calculation: After training, the model is deployed into the archive management system to calculate the risk coefficient for each access in real time and generate a behavioral entropy access risk index.

[0095] The current dynamic desensitization level of the archive is obtained through fuzzy inference. The content sensitivity index, the behavioral entropy access risk index, and the risk level value are used together as input variables for fuzzy logic, and the current dynamic desensitization level of the archive is used as the output variable of fuzzy logic. The input variables are fuzzified, converting the values of the input variables into fuzzy sets, and the output variable is fuzzified, converting the output variable into a fuzzy set. Fuzzy rules are formulated to describe the adaptability of each dynamic desensitization level under different combinations of data types. The fuzzified input variables are inferred through the fuzzy rules to obtain the corresponding dynamic desensitization level of the current archive.

[0096] The purpose of calculating the dynamic desensitization level is to intelligently adjust the data protection level according to the sensitivity, access risk, and overall risk situation of the archive, ensuring that the data can be used within a reasonable range while preventing the leakage of sensitive information.

[0097] During the calculation process, the content sensitivity of the archive, the risk degree of access behavior, and the overall risk level are comprehensively considered. Through the method of fuzzy inference, these factors are comprehensively analyzed, and finally, the desensitization level suitable for the current archive is obtained.

[0098] The calculation of the dynamic desensitization level uses the method of fuzzy inference, and its basic principle includes the following key steps: Fuzzification of input variables: The content sensitivity, access risk, and overall risk level of the archive are converted into fuzzy sets, making them no longer single numerical values but having a certain degree of uncertainty. For example, the content sensitivity can be divided into "low", "medium", and "high". The access risk can be divided into "safe", "suspicious", and "dangerous". The overall risk level can be divided into "low risk", "medium risk", and "high risk".

[0099] Fuzzification of output variables: The desensitization level of the archive is also converted into a fuzzy set. For example, fully public: no desensitization processing, applicable to ordinary data. Partial desensitization: Hide some sensitive fields, such as showing only part of the digits of a mobile phone number. Advanced desensitization: Encrypt or fuzzify most sensitive data. Full desensitization: Hide all sensitive information and only allow specific users to view. Access restricted: Prohibit unauthorized access and even strictly restrict some authorized users.

[0100] Formulate fuzzy rules: Define desensitization rules for different data combinations through experience and data analysis. For example: Rule 1: If the content sensitivity of the file is low, the access risk is low, and the overall risk level is a low risk, then it is set to be fully public. Rule 2: If the content sensitivity of the file is high, the access risk is suspicious, and the overall risk level is a medium risk, then it is set to be partially desensitized. Rule 3: If the content sensitivity of the file is high, the access risk is high, and the overall risk level is a high risk, then it is set to be highly desensitized or fully desensitized. Rule 4: If the content sensitivity of the file is extremely high, the access risk is extremely high, and the overall risk level reaches the dangerous level, then it is set to have restricted access.

[0101] Fuzzy inference calculation: Through fuzzy rules, combine and calculate the input variables to infer the final desensitization level.

[0102] Defuzzification: The calculated result is usually a combination of multiple desensitization levels (such as a value between "partially desensitized" and "highly desensitized"), and it is necessary to convert it into the specific desensitization level most suitable for the current file through defuzzification methods.

[0103] Fully public: Applicable to public documents, such as general news reports or ordinary notices. Partially desensitized: Applicable to general business data, such as hiding some information in customer records. Highly desensitized: Applicable to files containing sensitive information, such as financial statements, customer contracts, etc. Fully desensitized: Applicable to highly sensitive documents, such as personal identity data, medical records, etc. Restricted access: Applicable to top-secret files, and only special permission users are allowed to access.

[0104] Embodiment 2: An archive management system based on data analysis, comprising:

[0105] A data acquisition module for acquiring the document attribute data of the archive;

[0106] A vector construction module for generating a document attribute vector based on the document attribute data;

[0107] A clustering analysis module for performing clustering operations to find a set of similar groups with similar attributes to the current archive from all archives;

[0108] A comparative analysis module for comparing the access data of the current archive with the average access data of the set of similar groups, determining whether to trigger the information exposure risk investigation mechanism, and performing a horizontal association risk level determination when the information exposure risk investigation mechanism is triggered;

[0109] An archive analysis module for performing content analysis and access analysis on the current archive respectively;

[0110] The fuzzy inference module is used to generate the dynamic desensitization level of the current file according to the determination result of the horizontal correlation risk level, the content analysis result, and the access analysis result, and apply it to the current file in real time.

[0111] All the above formulas are dimensionless and take their numerical calculations. The formulas are obtained by collecting a large amount of data for software simulation to get a formula closest to the actual situation. The preset parameters in the formulas are set by those skilled in the art according to the actual situation.

[0112] It should be understood that in various embodiments of the present application, the magnitudes of the sequence numbers of the above processes do not mean the order of execution. The order of execution of each process should be determined according to its function and internal logic, and should not constitute any limitation to the implementation process of the embodiments of the present application.

[0113] Those of ordinary skill in the art can realize that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be implemented by electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are executed in a hardware or software manner depends on the specific application and design constraints of the technical solution. Professional technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present application.

[0114] Those skilled in the art can clearly understand that for the convenience and conciseness of description, the specific working processes of the systems, devices, and units described above can refer to the corresponding processes in the foregoing method embodiments, and will not be elaborated herein.

[0115] The above is only the specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present application, and all of them should be covered by the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A file management method based on data analysis, characterized in that, It includes the following steps: Obtain the document attribute data of the file, generate a document attribute vector, and perform clustering analysis to find a set of similar groups containing similar attributes to the current file from all files; Based on the access data of the current file, compare it with the average access data of the set of similar groups to determine whether to trigger the information exposure risk investigation mechanism, and when triggering the information exposure risk investigation mechanism, determine the horizontal association risk level; Conduct content analysis and access analysis on the current file respectively, and then conduct a summary analysis of the horizontal association risk level determination result, content analysis result, and access analysis result to generate the dynamic desensitization level of the current file and apply it to the current file in real time; Conducting content analysis on the current file respectively means: Based on the sensitive data category weight, time decay factor, and compliance dynamic coefficient, calculate the content sensitivity within the current time window to generate a content sensitivity index; Conducting access analysis on the current file respectively means: Based on the permission access deviation, user trust score, and environmental risk factor, calculate the chaos degree of the access behavior to generate a behavior entropy access risk index; The dynamic desensitization level of the current file is obtained through fuzzy inference. The content sensitivity index, behavior entropy access risk index, and risk level value are used as input variables of fuzzy logic, and the dynamic desensitization level of the current file is used as the output variable of fuzzy logic. The input variables are fuzzified, the values of the input variables are converted into fuzzy sets, the output variable is fuzzified, the output variable is converted into a fuzzy set, and fuzzy rules are formulated to describe the adaptation degree of each dynamic desensitization level under different combinations of data types. The fuzzified input variables are inferred through the fuzzy rules to obtain the dynamic desensitization level corresponding to the current file.

2. The archival management method based on data analysis according to claim 1, characterized in that, The document attribute data consists of basic attribute data, content derivative attribute data, and access attribute data.

3. The archival management method based on data analysis according to claim 2, wherein, The basic attributes include document type, creation department, and storage location; The content derivative attributes include multiple preset keyword tags extracted through natural language processing and sensitive field counts; The access attributes include access times and statistical information on the permission levels of associated user roles.

4. The archival management method based on data analysis according to claim 3, wherein The DBSCAN algorithm is used for clustering analysis.

5. The archival management method based on data analysis according to claim 4, characterized in that, Based on the access data of the current file, comparing it with the average access data of the set of similar groups to determine whether to trigger the information exposure risk investigation mechanism means: Obtain the first data access frequency values corresponding to the permission levels of each user role in the access data of the current file, and obtain the second data access frequency values corresponding to the permission levels of each user role of each file in the similar group set. Obtain the average value and standard deviation of the second data access frequency values corresponding to the same user role permission level through all files within a preset unit time in the similar group set. Adopt the 3σ principle to set a standard value interval for each user role permission level based on the average value and standard deviation. Compare the first data access frequency value corresponding to the same user role permission level with the standard value interval. If the first data access frequency value corresponding to the same user role permission level falls within the standard value interval, generate a security signal. If the first data access frequency value corresponding to the same user role permission level does not fall within the standard value interval, generate a risk signal. When there is a risk signal, trigger the information exposure risk investigation mechanism.

6. The archival management method based on data analysis according to claim 5, characterized in that The determination of the horizontal correlation risk level refers to: Count the total number of occurrences of risk signals, and use the total number as the risk level value of horizontal correlation.

7. An archive management system based on data analysis, which is used to implement an archive management method based on data analysis as described in any one of claims 1-6, characterized in that, Including: A data acquisition module for acquiring the document attribute data of the file; A vector construction module for generating a document attribute vector based on the document attribute data; A clustering analysis module for performing clustering operations to find a set of similar groups with similar attributes to the current file from all files; A comparison and analysis module for comparing the access data of the current file with the average access data of the similar group set to determine whether to trigger the information exposure risk investigation mechanism, and perform the determination of the horizontal correlation risk level when the information exposure risk investigation mechanism is triggered; A file analysis module for performing content analysis and access analysis on the current file respectively; A fuzzy inference module for generating the dynamic desensitization level of the current file according to the determination result of the horizontal correlation risk level, the content analysis result and the access analysis result, and applying it to the current file in real time.

Images