Data association method and device and computer equipment

Abstract

The invention relates to the technical field of network technology and data security, in particular to a data association method and device and computer equipment. The method comprises the following steps: acquiring a forward data set output by a forward node in a current time window according to each acquired access request; obtaining a backward node corresponding to the forward node and a backward data set output for the forward data set; determining a similarity information entropy between each candidate forward data in the forward data set and each candidate backward data in the backward data set according to the similarity between each candidate forward data in the forward data set and each candidate backward data in the backward data set; and determining a data association relationship between each candidate forward data in the forward data set and each candidate backward data in the backward data set according to the similarity information entropy between each candidate forward data in the forward data set and each candidate backward data in the backward data set.

Description

Technical Field

[0001] The present application relates to the fields of network technology and data security technology, and in particular to a data association method, device and computer equipment. Background Art

[0002] In the classic three-tier architecture of browser-application-database, users access the application layer through their own accounts, enjoying a personalized and service-oriented convenient experience. However, in the interaction between the application layer and the database layer, due to security, management, and performance considerations, applications usually use a unified database account to access the database. Although this design simplifies the management of database connections, it also blurs the direct connection between user operations and database operations to a certain extent. Therefore, in the audit log of the database, the execution record of each Structured Query Language (SQL) statement can often only be traced back to the application layer, and cannot be further refined to a specific user, which poses a challenge to data security and compliance.

[0003] As microservice architecture becomes increasingly popular, system architecture becomes more complex and distributed. Microservices interact with each other through various protocols, and the call chain between services becomes lengthy and difficult to track. This complexity not only increases the difficulty of system operation and maintenance, but also greatly increases the difficulty of tracing the source of sensitive data after leakage. Once a data leakage incident occurs, how to quickly and accurately locate the source of the leakage, track the flow of data, and identify the responsible user has become a major problem facing the security team.

[0004] Traditional link association methods, such as those based on timestamps, Internet Protocol (IP) addresses, and similarity, are often inadequate in high-concurrency scenarios. Since a large number of user requests occur simultaneously, the repetitiveness of timestamps and IP addresses increases, and similarity may be difficult to distinguish due to the similarity of business logic, resulting in a significant decrease in association accuracy. Summary of the invention

[0005] Based on this, it is necessary to provide a data association method, device and computer equipment that can improve the accuracy of data association in response to the above technical problems.

[0006] In a first aspect, the present application provides a data association method, the method comprising:

[0007] Obtaining a forward data set output by the forward node according to each access request obtained within the current time window; and,

[0008] Obtain a backward node corresponding to a forward node, and output a backward data set for the forward data set; wherein the forward data set includes at least one candidate forward data, and the backward data set includes at least one candidate backward data;

[0009] Determine the similarity information entropy between each candidate forward data in the forward data set and each candidate backward data in the backward data set according to the similarity between each candidate forward data in the forward data set and each candidate backward data in the backward data set;

[0010] According to the similarity information entropy between each candidate forward data in the forward data set and each candidate backward data in the backward data set, the data association relationship between each candidate forward data in the forward data set and each candidate backward data in the backward data set is determined.

[0011] In one embodiment, obtaining a forward data set output by a forward node according to each access request obtained within a current time window includes:

[0012] When it is detected that target sensitive data exists in each access request initiated to the forward node within the current time window, a forward data set output by the forward node according to each access request within the current time window is obtained.

[0013] In one of the embodiments, the forward data set includes at least one candidate forward data carrying forward sensitive data; the backward data set includes at least one candidate backward data carrying backward sensitive data;

[0014] Correspondingly, according to the similarity between each candidate forward data in the forward data set and each candidate backward data in the backward data set, the similarity information entropy between each candidate forward data in the forward data set and each candidate backward data in the backward data set is determined, including:

[0015] According to the similarity between the forward sensitive data in each candidate forward data in the forward data set and the backward sensitive data in each candidate backward data in the backward data set, the similarity information entropy between each candidate forward data in the forward data set and each candidate backward data in the backward data set is determined.

[0016] In one embodiment, determining the similarity information entropy between each candidate forward data in the forward data set and each candidate backward data in the backward data set according to the similarity between the forward sensitive data in each candidate forward data in the forward data set and the backward sensitive data in each candidate backward data in the backward data set includes:

[0017] For each candidate forward data and each candidate backward data, determining the similarity between the candidate forward data and the candidate backward data;

[0018] Determine the sum of similarities between the candidate forward data and the backward sensitive data in each candidate backward data in the backward data set, and use the sum of similarities as the parameter similarity;

[0019] The similarity information entropy between the candidate forward data and the candidate backward data is determined according to the ratio between the similarity between the candidate forward data and the candidate backward data and the parameter similarity.

[0020] In one embodiment, determining the data association relationship between each candidate forward data in the forward data set and each candidate backward data in the backward data set according to the similarity information entropy between each candidate forward data in the forward data set and each candidate backward data in the backward data set includes:

[0021] Obtaining similarity information entropy between each candidate forward data and each historical backward data from the graph database; wherein each historical backward data is generated by the backward node according to at least one historical forward data initiated by the forward node within the historical time window, and each historical forward data includes at least one candidate forward data;

[0022] According to the similarity information entropy between each candidate forward data and each candidate backward data, and the similarity information entropy between each candidate forward data and each historical backward data, the data association relationship between each candidate forward data in the forward data set and each candidate backward data in the backward data set is determined.

[0023] In one embodiment, determining the data association relationship between each candidate forward data in the forward data set and each candidate backward data in the backward data set according to the similarity information entropy between each candidate forward data and each candidate backward data, and the similarity information entropy between each candidate forward data and each historical backward data, includes:

[0024] Selecting target forward data to be associated from each candidate forward data;

[0025] According to the data association relationship between each candidate forward data and each historical backward data stored in the graph database, determine the historical backward data that has a data association relationship with the target forward data, and use the determined historical backward data as the backward associated data of the target forward data;

[0026] According to the similarity information entropy between the target forward data and each candidate backward data, and the similarity information entropy between the target forward data and the backward associated data, the target backward data having a data association relationship with the target forward data in the current time window is selected from each candidate backward data and the backward associated data;

[0027] Update the graph database according to the association between the target forward data and the target backward data;

[0028] Eliminating the target forward data from the forward data set to obtain a new forward data set, and eliminating the target backward data from the backward data set to obtain a new backward data set, and returning to perform an operation of selecting the target forward data to be associated from each candidate forward data based on the new forward data set and the new backward data set.

[0029] In one embodiment, according to the similarity information entropy between the target forward data and each candidate backward data, and the similarity information entropy between the target forward data and the backward associated data, the target backward data having a data association relationship with the target forward data in the current time window is selected from each candidate backward data and the backward associated data, including:

[0030] Select the minimum backward similarity information entropy from the similarity information entropy between the target forward data and each candidate backward data, and the similarity information entropy between the target forward data and the backward associated data;

[0031] According to the candidate backward data or backward associated data corresponding to the backward minimum similarity information entropy, the target backward data having a data association relationship with the target forward data within the current time window is determined.

[0032] In one embodiment, determining target backward data having a data association relationship with the target forward data in the current time window according to the candidate backward data or the backward associated data corresponding to the backward minimum similarity information entropy includes:

[0033] The candidate backward data or the backward associated data corresponding to the backward minimum similarity information entropy is used as the backward data to be associated corresponding to the target forward data in the current time window;

[0034] From the graph database, obtain the forward associated data that has a data association relationship with the backward data to be associated within the historical time window, and the similarity information entropy between the backward data to be associated and the forward associated data; the forward associated data is the data generated by the forward node within the historical time window;

[0035] According to the similarity information entropy between the backward data to be associated and each candidate forward data, and the similarity information entropy between the backward data to be associated and the forward associated data, determine the forward data to be associated that has a data association relationship with the backward data to be associated from each candidate forward data and the forward associated data;

[0036] According to the consistency between the forward data to be associated and the target forward data, the backward data to be associated is used as the target backward data having a data association relationship with the target forward data within the current time window.

[0037] In one embodiment, according to the similarity information entropy between the backward data to be associated and each candidate forward data, and the similarity information entropy between the backward data to be associated and the forward associated data, determining the forward data to be associated that has a data association relationship with the backward data to be associated from each candidate forward data and the forward associated data, includes:

[0038] Select the minimum forward similarity information entropy from the similarity information entropy between the backward data to be associated and each candidate forward data, and the similarity information entropy between the backward data to be associated and the forward associated data;

[0039] The candidate forward data or the forward associated data corresponding to the forward minimum similarity information entropy is used as the forward data to be associated that has a data association relationship with the backward data to be associated.

[0040] In one embodiment, according to the consistency between the forward data to be associated and the target forward data, taking the backward data to be associated as the target backward data having a data association relationship with the target forward data in the current time window includes:

[0041] When the forward data to be associated is consistent with the target forward data, the backward data to be associated is used as the target backward data having a data association relationship with the target forward data within the current time window;

[0042] When the forward data to be associated is inconsistent with the target forward data, if the similarity information entropy between the forward data to be associated and the backward data to be associated is greater than the similarity information entropy between the backward data to be associated and the target forward data, the backward data to be associated is regarded as the target backward data that has a data association relationship with the target forward data within the current time window.

[0043] In one embodiment, before obtaining the similarity information entropy between each candidate forward data and each historical backward data from the graph database, the method further includes:

[0044] For each candidate forward data, according to the similarity between the candidate forward data and each candidate backward data, the candidate backward data with the highest similarity is selected from the backward data set as the backward data to be updated;

[0045] According to the similarity between the candidate forward data and each candidate backward data, determine the set similarity information entropy between the candidate forward data and the backward data set, and use the set similarity information entropy as the similarity information entropy between the candidate forward data and the backward data to be updated;

[0046] The graph database is updated by using the data association relationship between the candidate forward data and the backward data to be updated, as well as the similarity information entropy between the candidate forward data and the backward data to be updated.

[0047] In one embodiment, the graph database is updated using the data association relationship between the candidate forward data and the backward data to be updated, and the similarity information entropy between the candidate forward data and the backward data to be updated, including:

[0048] When there are no candidate forward data and backward data to be updated in the graph database, a data association relationship between the candidate forward data and the backward data to be updated, and similarity information entropy between the candidate forward data and the backward data to be updated are added to the graph database;

[0049] When there are candidate forward data and backward data to be updated in the graph database, if it is determined that the existing similarity information entropy between the candidate forward data and the backward data to be updated in the graph database is greater than the set similarity information entropy, the existing similarity information entropy between the candidate forward data and the backward data to be updated is updated according to the set similarity information entropy.

[0050] In a second aspect, the present application further provides a data association device, the device comprising:

[0051] an acquisition module, used to acquire a forward data set output by a forward node according to each access request acquired within a current time window; and

[0052] Obtain a backward node corresponding to a forward node, and output a backward data set for the forward data set; wherein the forward data set includes at least one candidate forward data, and the backward data set includes at least one candidate backward data;

[0053] A similarity information entropy calculation module is used to determine the similarity information entropy between each candidate forward data in the forward data set and each candidate backward data in the backward data set according to the similarity between each candidate forward data in the forward data set and each candidate backward data in the backward data set;

[0054] The data association module is used to determine the data association relationship between each candidate forward data in the forward data set and each candidate backward data in the backward data set according to the similarity information entropy between each candidate forward data in the forward data set and each candidate backward data in the backward data set.

[0055] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0056] Obtaining a forward data set output by the forward node according to each access request obtained within the current time window; and,

[0057] Obtain a backward node corresponding to a forward node, and output a backward data set for the forward data set; wherein the forward data set includes at least one candidate forward data, and the backward data set includes at least one candidate backward data;

[0058] Determine the similarity information entropy between each candidate forward data in the forward data set and each candidate backward data in the backward data set according to the similarity between each candidate forward data in the forward data set and each candidate backward data in the backward data set;

[0059] According to the similarity information entropy between each candidate forward data in the forward data set and each candidate backward data in the backward data set, the data association relationship between each candidate forward data in the forward data set and each candidate backward data in the backward data set is determined.

[0060] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the following steps are implemented:

[0061] Obtaining a forward data set output by the forward node according to each access request obtained within the current time window; and,

[0062] Obtain a backward node corresponding to a forward node, and output a backward data set for the forward data set; wherein the forward data set includes at least one candidate forward data, and the backward data set includes at least one candidate backward data;

[0063] Determine the similarity information entropy between each candidate forward data in the forward data set and each candidate backward data in the backward data set according to the similarity between each candidate forward data in the forward data set and each candidate backward data in the backward data set;

[0064] According to the similarity information entropy between each candidate forward data in the forward data set and each candidate backward data in the backward data set, the data association relationship between each candidate forward data in the forward data set and each candidate backward data in the backward data set is determined.

[0065] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0066] Obtaining a forward data set output by the forward node according to each access request obtained within the current time window; and,

[0067] Obtain a backward node corresponding to a forward node, and output a backward data set for the forward data set; wherein the forward data set includes at least one candidate forward data, and the backward data set includes at least one candidate backward data;

[0068] Determine the similarity information entropy between each candidate forward data in the forward data set and each candidate backward data in the backward data set according to the similarity between each candidate forward data in the forward data set and each candidate backward data in the backward data set;

[0069] According to the similarity information entropy between each candidate forward data in the forward data set and each candidate backward data in the backward data set, the data association relationship between each candidate forward data in the forward data set and each candidate backward data in the backward data set is determined.

[0070] The above-mentioned data association method, device and computer equipment, the present application quantifies the association uncertainty between each candidate forward data in the forward data set and each candidate backward data in the backward data set by calculating the similarity information entropy between them, and the similarity information entropy can reflect the uniformity of data distribution. If the similarity distribution between the candidate backward data is relatively uniform, the information entropy is large; conversely, if the similarity of some candidate data is significantly higher than that of other data, the information entropy is small. This feature helps to describe the similarity relationship between data in more detail and provide strong support for subsequent data analysis. This association method based on information entropy can more comprehensively consider the complex relationship between data, effectively distinguish similar data that is difficult to distinguish by traditional methods due to business logic similarity, thereby improving the accuracy of link association. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0072] Figure 1 is an application environment diagram of a data association method in an embodiment;

[0073] Figure 2 is a flow chart of a data association method in one embodiment;

[0074] Figure 3 A schematic flow chart of a step of determining similarity information entropy between each candidate forward data in a forward data set and each candidate backward data in a backward data set in one embodiment;

[0075] Figure 4 A schematic diagram of a flow chart of the steps of updating a graph database in one embodiment;

[0076] Figure 5A schematic flow chart of a step of determining a data association relationship between each candidate forward data in a forward data set and each candidate backward data in a backward data set in one embodiment;

[0077] Figure 6 A schematic flow chart of a step of determining a data association relationship between each candidate forward data in a forward data set and each candidate backward data in a backward data set in another embodiment;

[0078] Figure 7 A schematic flow chart of a step of determining target backward data having a data association relationship with target forward data within a current time window in one embodiment;

[0079] Figure 8 is a structural block diagram of a data association device in one embodiment;

[0080] Fig. 9 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0081] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0082] The data association method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. The application environment includes an analysis node 102, a forward node 104, and a backward node 106 corresponding to the forward node 104; the backward node 106 corresponding to the forward node 104 refers to the backward node 106 receiving the output data of the forward node 104 and processing the output data; the analysis node 102 in this embodiment is used to perform correlation analysis on the output data of the forward node 104 and the output data of the backward node 106 to achieve data traceability.

[0083] In an exemplary embodiment, Figure 2 As shown, a data association method is provided, which is applied to Figure 1 The analysis node 102 in FIG. 1 is used as an example to illustrate the invention, including:

[0084] S201, obtaining a forward data set output by a forward node according to each access request obtained within a current time window, and obtaining a backward data set output by a backward node corresponding to the forward node for the forward data set.

[0085] It can be understood that the number of each access request is the concurrency received by the forward node in the current time window.

[0086] The forward data set A includes at least one candidate forward data.

[0087] Optionally, each candidate forward data in the forward data set A refers to each piece of data output by the forward node in response to each access request within the current time window, and the number of each candidate forward data may be the same as or different from the number of each access request.

[0088] The backward data set B includes at least one candidate backward data.

[0089] Optionally, each candidate backward data in the backward data set B refers to each piece of data output by the backward node in response to each candidate forward data within the current time window, and the number of each candidate backward data may be the same as or different from the number of each candidate forward data.

[0090] In the data tracing scenario, the purpose of data tracing is to find other data flows associated with the target field in the current data flow. In this embodiment, the target field can be sensitive data, and accordingly, each candidate forward data is data containing forward sensitive data, and each candidate backward data is data containing backward sensitive data; there may be differences between the forward sensitive data and the backward sensitive data, and the difference comes from the data processing process of the forward node in response to the access request, which is different from the data processing process of the backward node in response to the candidate forward data.

[0091] S202, determining the similarity information entropy between each candidate forward data in the forward data set and each candidate backward data in the backward data set according to the similarity between each candidate forward data in the forward data set and each candidate backward data in the backward data set.

[0092] Optionally, a plurality of methods may be used to determine the similarity between each candidate forward data in the forward data set A and each candidate backward data in the backward data set B. The specific selection depends on the nature of the data, the definition of similarity, and the requirements of the application. Specifically, the following methods may be used:

[0093] (1) Field matching method: For structured data, the values ​​of the same fields in two data records can be directly compared. If the field values ​​are exactly the same, the similarity is 1 (or 100%); if they are different, the similarity is 0 (or a certain similarity score is given based on partial matching). Multiple fields can be weighted and summed to obtain a comprehensive similarity.

[0094] (2) String similarity algorithms: For text data, string similarity algorithms can be used, such as Levenshtein distance, Jaro-Winkler similarity, etc. These algorithms consider operations such as edit distance, character replacement, insertion, and deletion between strings to evaluate the similarity of the strings.

[0095] (3) Vector space model: The data is represented as vectors, and then the cosine similarity, Euclidean distance, etc. between vectors are calculated. This method is suitable for high-dimensional data, such as text, image, or audio feature representation.

[0096] (4) Semantic similarity: For data containing semantic information, such as entities in text or knowledge graphs, semantic similarity calculation methods can be used.

[0097] It can be understood that, for each candidate forward data and each candidate backward data, the candidate forward data and the candidate backward data not only include the similarity between the candidate forward data and the candidate backward data, but also include the uncertainty of the similarity value between the candidate forward data and the candidate backward data.

[0098] It is understandable that the calculation formula of information entropy is a core concept in information theory, which is used to measure the uncertainty of information or the average amount of information. Its standard form is as follows (1):

[0099]

[0100] Among them, H(X) represents the information entropy of random variable X, X is a discrete random variable, representing the set of all possible outputs; xi is the i-th possible value of X; P(xi) is the probability that X takes the value xi; b is the base of the logarithm, usually 2 (binary), e (natural logarithm) or 10 (decimal). In information theory, 2 is often used as the base, and the unit of information entropy is bit.

[0101] In this embodiment, the probability value P(i, j) is used as P(xi) in formula (1) to calculate the similarity information entropy E between the candidate forward data i and the candidate backward data j. i，j Specifically, P(i, j) is calculated using the following formula (2):

[0102]

[0103] Among them, S(i, j) is the similarity between candidate forward data i and candidate backward data j, k represents the kth candidate backward data in the backward data set B, Represents the sum of all candidate backward data in the backward data set B.

[0104] It can be understood that the method of calculating information entropy based on the above formula (1) and formula (2) not only considers the similarity S(i, j) between the forward data i and the single backward data j, but also comprehensively considers the similarity between the forward data i and all candidate backward data through normalization processing, thereby being able to more comprehensively and accurately evaluate the overall similarity between the forward data i and the backward data set B.

[0105] Specifically, similarity information entropy can reflect the uniformity of data distribution. If the similarity distribution between candidate backward data is relatively uniform, the information entropy is large; conversely, if the similarity of some candidate data is significantly higher than that of other data, the information entropy is small. This feature helps to describe the similarity relationship between data in more detail and provides strong support for subsequent data analysis.

[0106] S203, determining a data association relationship between each candidate forward data in the forward data set and each candidate backward data in the backward data set according to the similarity information entropy between each candidate forward data in the forward data set and each candidate backward data in the backward data set.

[0107] Optionally, for each candidate forward data in the forward data set A, the similarity information entropy between the candidate forward data and each candidate backward data is compared to obtain the candidate backward data with the smallest similarity information entropy as the candidate backward data having a data association relationship with the candidate forward data, and then, the candidate forward data is eliminated from the forward data set A, and the candidate backward data having a data association relationship is eliminated from the backward data set B; based on the forward data set A after elimination and the backward data set B after elimination, the process of comparing the similarity information entropy between each candidate forward data in the forward data set A and each candidate backward data is performed.

[0108] In the above process, if there is at least one candidate backward data with the smallest similarity information entropy corresponding to any candidate forward data (the candidate backward data with the smallest similarity information entropy means that the similarities of each candidate backward data are equal and smallest), then all the candidate backward data with the smallest similarity information entropy corresponding to the candidate forward data will be eliminated; correspondingly, if there is at least one candidate forward data with the smallest similarity information entropy corresponding to any candidate backward data (the candidate forward data with the smallest similarity information entropy means that the similarities of each candidate forward data are equal and smallest), then all the candidate forward data with the smallest similarity information entropy corresponding to the candidate backward data will be eliminated.

[0109] The above elimination process is performed until all candidate forward data in the forward data set A are eliminated or the backward data sets corresponding to the candidate forward data in the forward data set A are empty, thereby obtaining candidate backward data with associated relationships corresponding to each candidate forward data; wherein each eliminated candidate forward data corresponds to candidate backward data with associated relationships; and each candidate forward data that has not been eliminated and whose corresponding backward data set is empty is a candidate forward data with no associated relationships.

[0110] In the above data association method, the present application quantifies the association uncertainty between each candidate forward data in the forward data set and each candidate backward data in the backward data set by calculating the similarity information entropy between them. The similarity information entropy can reflect the uniformity of data distribution. If the similarity distribution between the candidate backward data is relatively uniform, the information entropy is large; conversely, if the similarity of some candidate data is significantly higher than that of other data, the information entropy is small. This feature helps to describe the similarity relationship between data in more detail and provide strong support for subsequent data analysis. This association method based on information entropy can more comprehensively consider the complex relationship between data, effectively distinguish similar data that is difficult to distinguish by traditional methods due to business logic similarity, thereby improving the accuracy of link association.

[0111] In an exemplary embodiment, a forward data set output by a forward node according to each access request obtained within a current time window is obtained, including: upon detecting that target sensitive data exists in each access request initiated to the forward node within the current time window, obtaining a forward data set output by the forward node according to each access request within the current time window.

[0112] It is understood that there is a network that contains multiple nodes, at least one of which is a "forward node". Time is divided and a "time window" is used as the basic unit for managing or monitoring data. In this, there are access requests initiated to the forward node, and these requests may contain various data. All access requests initiated to the forward node in the current time window are monitored. Check whether these access requests contain "target sensitive data". The target sensitive data may be specific personal information, confidential information, or any type of data that requires special protection.

[0113] When the target sensitive data is detected in the access request within the current time window, the subsequent data collection operation will be triggered. Get the data set output by the forward node based on all access requests within the current time window. This data set may include responses, processing results, or any data generated and output by the forward node. The acquisition of this data set is based on the conditions mentioned above - that is, the target sensitive data exists in the access request. This means that this data is only collected under specific circumstances (that is, when sensitive data is detected). This mechanism may be used for a variety of purposes, such as security monitoring, compliance checking, data leakage prevention, etc.

[0114] In this embodiment, referring to the above S201, the forward data set A includes at least one candidate forward data carrying forward sensitive data; the backward data set B includes at least one candidate backward data carrying backward sensitive data.

[0115] Correspondingly, according to the similarity between each candidate forward data in the forward data set A and each candidate backward data in the backward data set B, the similarity information entropy between each candidate forward data in the forward data set A and each candidate backward data in the backward data set B is determined, including:

[0116] According to the similarity between the forward sensitive data in each candidate forward data in the forward data set A and the backward sensitive data in each candidate backward data in the backward data set B, the similarity information entropy between each candidate forward data in the forward data set A and each candidate backward data in the backward data set B is determined.

[0117] Optionally, determining the similarity between the forward sensitive data in each candidate forward data in the forward data set A and the backward sensitive data in each candidate backward data in the backward data set B is consistent with the method of determining the similarity between each candidate forward data in the forward data set A and each candidate backward data in the backward data set B in the above S202.

[0118] On this basis, in the above S202, the similarity S(i, j) between the candidate forward data i and the candidate backward data j is actually the similarity between the forward sensitive data in the candidate forward data i and the backward sensitive data in the candidate backward data j.

[0119] Further, such as Figure 3 As shown, according to the similarity between the forward sensitive data in each candidate forward data in the forward data set and the backward sensitive data in each candidate backward data in the backward data set, the similarity information entropy between each candidate forward data in the forward data set and each candidate backward data in the backward data set is determined, including:

[0120] S301 : for each candidate forward data and each candidate backward data, determine the similarity between the candidate forward data and the candidate backward data.

[0121] Optionally, refer to the similarity S(i, j) between the candidate forward data i and the candidate backward data j in S202 above.

[0122] S302, determining the sum of similarities between the candidate forward data and the backward sensitive data in each candidate backward data in the backward data set B, and taking the sum of similarities as the parameter similarity corresponding to the candidate forward data.

[0123] Specifically, the parameters in the above formula (2) are That is, it is the sum of the similarities between the candidate forward data i and the backward sensitive data in each candidate backward data in the backward data set B. The sum of the similarities is taken as the parameter similarity corresponding to the candidate forward data i.

[0124] S303, determining the similarity information entropy between the candidate forward data and the candidate backward data according to the ratio between the similarity between the candidate forward data and the candidate backward data and the parameter similarity.

[0125] Specifically, referring to the above formula (1) and formula (2), the formula (3) for calculating the similarity information entropy between the candidate forward data i and the candidate backward data j is obtained, which is:

[0126] E i,j =-p(i,j)log2p(i,j) (3)

[0127] Among them, E i，j is the similarity information entropy between the candidate forward data and the candidate backward data; the number of candidate backward data in the backward data set B is set to L, and the candidate backward data j is the jth candidate backward data in the backward data set B.

[0128] In an exemplary embodiment, Figure 4 As shown, the method also includes:

[0129] S401 , for each candidate forward data, according to the similarity between the candidate forward data and each candidate backward data, select the candidate backward data with the highest similarity from the backward data set as the backward data to be updated.

[0130] Exemplarily, for candidate forward data i, candidate backward data with the highest similarity is selected from the backward data set B to update the backward data q.

[0131] S402, determining the set similarity information entropy between the candidate forward data and the backward data set according to the similarity between the candidate forward data and each candidate backward data, and using the set similarity information entropy as the similarity information entropy between the candidate forward data and the backward data to be updated.

[0132] Optionally, according to the similarity between the candidate forward data and each candidate backward data, the set similarity information entropy between the candidate forward data and the backward data set B is determined using the following formula (4):

[0133] E i =-Σ j p(i, j)log2p(i, j) (4)

[0134] Among them, E i is the set similarity information entropy between the candidate forward data i and the backward data set B.

[0135] S403, updating the graph database using the data association relationship between the candidate forward data and the backward data to be updated, and the similarity information entropy between the candidate forward data and the backward data to be updated.

[0136] In one implementable manner, when there are no candidate forward data and backward data to be updated in the graph database, a data association relationship between the candidate forward data and the backward data to be updated, as well as similarity information entropy between the candidate forward data and the backward data to be updated are added to the graph database.

[0137] Exemplarily, if the node (i, q) does not exist in the graph database, the data association relationship between the candidate forward data i and the backward data q to be updated is added to the graph database as the existence of data association, and the set similarity information entropy in the above formula (4) is used as the similarity information entropy between the candidate forward data and the backward data to be updated.

[0138] In another possible implementation, when there are candidate forward data and backward data to be updated in the graph database, if it is determined that the existing similarity information entropy between the candidate forward data and the backward data to be updated in the graph database is greater than the set similarity information entropy, then the existing similarity information entropy between the candidate forward data and the backward data to be updated is updated according to the set similarity information entropy.

[0139] Exemplarily, if a node (i, q) already exists in the graph database, and the existing similarity information entropy between the candidate forward data i and the backward data q to be updated is greater than the set similarity information entropy, the set similarity information entropy will replace the existing similarity information entropy between the candidate forward data i and the backward data q to be updated to achieve an update of the graph database.

[0140] In this embodiment, while adopting a more optimized similarity information entropy, the method of associating data based on the similarity between data is still retained, so that the data association method of this embodiment can combine the association effects of different methods to improve the accuracy of data association.

[0141] In an exemplary embodiment, Figure 5 As shown, according to the similarity information entropy between each candidate forward data in the forward data set and each candidate backward data in the backward data set, the data association relationship between each candidate forward data in the forward data set and each candidate backward data in the backward data set is determined, including:

[0142] S501, obtaining the similarity information entropy between each candidate forward data and each historical backward data from the graph database.

[0143] Among them, each historical backward data is generated by the backward node according to at least one historical forward data initiated by the forward node within the historical time window, and each historical forward data includes at least one candidate forward data.

[0144] It is understandable that the access requests initiated by users in different time windows are different. Accordingly, the historical forward data generated by the forward node in the historical time window may be different from the candidate forward data generated by the forward node in the current time window. Therefore, each candidate forward data may not appear in the historical time window, or may not appear in each historical time window.

[0145] This embodiment mainly focuses on the above-mentioned situation. For each candidate forward data, the historical time window in which the candidate forward data exists is focused on; each candidate forward data may appear in a different historical time window.

[0146] Correspondingly, each historical backward data may be the historical backward data that has been associated with each candidate forward data within the historical time window, or each historical backward data may include the historical backward data that has been associated with each candidate forward data within the historical time window and the historical backward data that has not been associated. This embodiment focuses on the first case above, that is, each historical backward data refers to the historical backward data that has been associated with each candidate forward data within the historical time window.

[0147] S502, determining the data association relationship between each candidate forward data in the forward data set and each candidate backward data in the backward data set based on the similarity information entropy between each candidate forward data and each candidate backward data, and the similarity information entropy between each candidate forward data and each historical backward data.

[0148] It can be understood that based on the similarity information entropy between each candidate forward data and each candidate backward data, as well as the similarity information entropy between each candidate forward data and each historical backward data, the data association relationship between each candidate forward data in the forward data set A and each candidate backward data in the backward data set B is determined. The purpose is to perform the link association this time by combining the data association relationship in the historical time window. This method can solve the problem of inaccurate association when the forward nodes and backward nodes in a small window only rely on the similarity size of sensitive data in one window for link association in a high concurrency scenario when there are multiple similar sensitive data on the front and back nodes.

[0149] Optional, such as Figure 6 As shown, according to the similarity information entropy between each candidate forward data and each candidate backward data, and the similarity information entropy between each candidate forward data and each historical backward data, the data association relationship between each candidate forward data in the forward data set and each candidate backward data in the backward data set is determined, including:

[0150] S601, selecting target forward data to be associated from each candidate forward data.

[0151] Optionally, among the candidate forward data, any one of the candidate forward data to be associated is selected as the target forward data, for example, the above-mentioned candidate forward data i to be associated is selected as the target forward data i.

[0152] S602, based on the data association relationship between each candidate forward data and each historical backward data stored in the graph database, determine the historical backward data that has a data association relationship with the target forward data, and use the determined historical backward data as the backward associated data of the forward data.

[0153] Optionally, if the target forward data i also exists in the historical time window, the data association relationship between the target forward data i and each historical backward data stored in the graph database is determined, the backward associated data that has a data association relationship with the target forward data is determined to be at least one, and each backward associated data that has a data association relationship with the target forward data is combined into an associated backward set Ci corresponding to the target forward data.

[0154] S603, based on the similarity information entropy between the target forward data and each candidate backward data, and the similarity information entropy between the target forward data and the backward associated data, select the target backward data that has a data association relationship with the target forward data within the current time window from each candidate backward data and the backward associated data.

[0155] Optionally, determine the intersection between the backward data set B and the associated backward set Ci corresponding to the target forward data, that is, B∩Ci;

[0156] Furthermore, based on the similarity information entropy between the target forward data and each candidate backward data existing in B∩Ci, as well as the similarity information entropy between the target forward data and the backward associated data existing in B∩Ci, the target backward data having a data association relationship with the target forward data within the current time window is selected from B∩Ci.

[0157] S604: Update the graph database according to the association relationship between the target forward data and the target backward data.

[0158] Specifically, when it is determined that there is a data association relationship between the target forward data and the target backward data, the association relationship between the target forward data and the target backward data is updated in the graph database.

[0159] S605, removing the target forward data from the forward data set to obtain a new forward data set, and removing the target backward data from the backward data set to obtain a new backward data set, and returning to execute S601 according to the new forward data set and the new backward data set.

[0160] Optionally, after this association is completed, S601-S605 are executed in a loop until all candidate forward data in the forward data set A are eliminated or the backward data sets corresponding to the candidate forward data in the forward data set A are empty, thereby obtaining candidate backward data with an associated relationship corresponding to each candidate forward data; wherein, each eliminated candidate forward data corresponds to candidate backward data with an associated relationship; and each candidate forward data that is not eliminated and whose corresponding backward data set is empty is a candidate forward data with no associated relationship.

[0161] It can be understood that the target forward data is removed from the forward data set to obtain a new forward data set, and the target backward data is removed from the backward data set to obtain a new backward data set, so that the associated candidate forward data or candidate backward data will not interfere with other candidate forward data or candidate backward data to be associated.

[0162] Furthermore, according to the similarity information entropy between the target forward data and each candidate backward data, and the similarity information entropy between the target forward data and the backward associated data, the target backward data having a data association relationship with the target forward data in the current time window is selected from each candidate backward data and the backward associated data, including: selecting the backward minimum similarity information entropy from the similarity information entropy between the target forward data and each candidate backward data, and the similarity information entropy between the target forward data and the backward associated data; and determining the target backward data having a data association relationship with the target forward data in the current time window according to the candidate backward data or the backward associated data corresponding to the backward minimum similarity information entropy.

[0163] Optionally, select the backward minimum similarity information entropy from B∩Ci.

[0164] In one implementable manner, the candidate backward data or the backward associated data corresponding to the backward minimum similarity information entropy may be directly used as the target backward data having a data association relationship with the target forward data within the current time window.

[0165] In another possible implementation, the candidate backward data or backward associated data corresponding to the backward minimum similarity information entropy is verified. If the verification passes, the candidate backward data or backward associated data corresponding to the backward minimum similarity information entropy is used as the target backward data that has a data association relationship with the target forward data within the current time window.

[0166] Exemplarily, the above verification process includes: Figure 7 As shown, according to the candidate backward data or the backward associated data corresponding to the backward minimum similarity information entropy, the target backward data having a data association relationship with the target forward data in the current time window is determined, including:

[0167] S701, taking the candidate backward data or the backward associated data corresponding to the backward minimum similarity information entropy as the backward data to be associated corresponding to the target forward data in the current time window.

[0168] Optionally, the candidate backward data or the backward associated data corresponding to the backward minimum similarity information entropy is used as the backward data t to be associated corresponding to the target forward data in the current time window.

[0169] S702, obtaining from the graph database the forward associated data that has a data association relationship with the backward data to be associated within the historical time window, and the similarity information entropy between the backward data to be associated and the forward associated data.

[0170] Optionally, if the backward data t to be associated also exists in the historical time window, then the data association relationship between the backward data t to be associated and each historical forward data stored in the graph database is determined, the forward associated data that has a data association relationship with the backward data to be associated is determined, and the number of forward associated data that has a data association relationship with the backward data to be associated is determined to be at least one, and each forward associated data that has a data association relationship with the backward data to be associated is formed into an associated t-way set Dt corresponding to the backward data to be associated, and the similarity information entropy between the backward data to be associated and the forward associated data is obtained from the graph database.

[0171] S703, based on the similarity information entropy between the backward data to be associated and each candidate forward data, and the similarity information entropy between the backward data to be associated and the forward associated data, determine the forward data to be associated that has a data association relationship with the backward data to be associated from each candidate forward data and the forward associated data.

[0172] Optionally, the forward minimum similarity information entropy is selected from the similarity information entropies between the backward data to be associated and each candidate forward data, and the similarity information entropy between the backward data to be associated and the forward associated data; and the candidate forward data or the forward associated data corresponding to the forward minimum similarity information entropy is used as the forward data to be associated that has a data association relationship with the backward data to be associated.

[0173] Optionally, determine the intersection between the forward data set A and the associated t-way set Dt corresponding to the backward data to be associated, that is, A∩Dt; further, based on the similarity information entropy between the backward data to be associated and each candidate forward data existing in A∩Dt, and the similarity information entropy between the backward data to be associated and the forward associated data existing in A∩Dt, select the forward data to be associated that has a data association relationship with the backward data to be associated from A∩Dt.

[0174] Exemplarily, the forward minimum similarity information entropy is selected from A∩Dt, and the candidate forward data or forward associated data corresponding to the forward minimum similarity information entropy is used as the forward data s to be associated that has a data association relationship with the backward data to be associated.

[0175] S704: according to the consistency between the forward data to be associated and the target forward data, the backward data to be associated is used as the target backward data having a data association relationship with the target forward data within the current time window.

[0176] Optionally, it is verified whether the forward data to be associated s and the target forward data i are the same data, so as to obtain the consistency between the forward data to be associated and the target forward data.

[0177] Further, according to the consistency between the forward data to be associated and the target forward data, the backward data to be associated is used as the target backward data having a data association relationship with the target forward data within the current time window, including:

[0178] In one achievable manner, when the forward data to be associated is consistent with the target forward data, the backward data to be associated is used as the target backward data having a data association relationship with the target forward data within the current time window.

[0179] It can be understood that if the forward data s to be associated and the target forward data i are actually the same data, the backward data to be associated is determined to have passed the verification, and the backward data to be associated is used as the target backward data having a data association relationship with the target forward data within the current time window.

[0180] In another possible implementation, when the forward data to be associated is inconsistent with the target forward data, if the similarity information entropy between the forward data to be associated and the backward data to be associated is greater than the similarity information entropy between the backward data to be associated and the target forward data, the backward data to be associated is used as the target backward data that has a data association relationship with the target forward data within the current time window.

[0181] It can be understood that if the forward data to be associated s and the target forward data i are not the same data, the similarity information entropy between the forward data to be associated and the backward data to be associated is compared with the similarity information entropy between the backward data to be associated and the target forward data;

[0182] If the similarity information entropy between the forward data s to be associated and the backward data t to be associated is greater than the similarity information entropy between the backward data t to be associated and the target forward data i, it means that the similarity information entropy between the backward data t to be associated and the target forward data i is more accurate. At this time, it is still determined that the backward data t to be associated has passed the verification, and the backward data t to be associated is used as the target backward data that has a data association relationship with the target forward data in the current time window.

[0183] Furthermore, if the forward data s to be associated and the target forward data i are not the same data, and if the similarity information entropy between the forward data s to be associated and the backward data t to be associated is less than or equal to the similarity information entropy between the backward data t to be associated and the target forward data i, then it means that the similarity information entropy between the forward data s to be associated and the backward data t to be associated is more accurate. At this time, it is still determined that the backward data t to be associated has not passed the verification, that is, the backward data t to be associated is not the target backward data that has a data association relationship with the target forward data i in the current time window.

[0184] In this case, the target backward data and the target forward data are judged not to be a data pair with data association, while the backward data to be associated t and the forward data to be associated s are a data pair with data association relationship. Therefore, in the graph database, the association relationship between the backward data to be associated t and the forward data to be associated s is added as a data association relationship.

[0185] Correspondingly, if the forward data s to be associated is data in the forward data set A, the forward data s to be associated is removed from the forward data set A; if the backward data t to be associated is data in the backward data set B, the backward data t to be associated is removed from the backward data set B. As for the target forward data i, it can be determined as data without an associated relationship according to the situation, or it can be re-used as candidate forward data to be associated.

[0186] In an exemplary embodiment, the above process is a data tracing process for the current time window. The above data tracing process can be performed on the previous time window and the next time window adjacent to the current time window to obtain the tracing results of the serial data and form a full-link association record. For the successfully associated link, when security incidents such as data leakage occur, the database leakage point can be queried based on the leaked sensitive information, and the leaker can be traced back through the link.

[0187] This embodiment creatively combines the forward node and multiple backward nodes in a small window into a random variable, calculates the information entropy of the random variable based on the similarity of sensitive data, and uses it to characterize the degree of uncertainty of the link association between the forward and backward nodes; proposes a new link association method based on graph calculation and historical information entropy comparison, which can take advantage of the generally low information entropy (low link association uncertainty) in low-traffic scenarios to prioritize link association, and solve the problem of low link association accuracy caused by simply using a traditional data similarity comparison in high-traffic and high-concurrency scenarios where the information entropy is high (high link association uncertainty).

[0188] The data association method in this embodiment can be applied to data tracing scenarios based on link association. It has low computational complexity and high speed, and can solve the problem of poor tracing accuracy in traditional high-traffic and high-concurrency scenarios. This embodiment can be used to build a database audit system to implement a three-layer audit of user-application-database associations; it can also be used to build a full-link data tracing system to establish accurate link records of user access to sensitive enterprise data based on information entropy, conduct risk management and data leakage tracing, and improve the security level of enterprise data.

[0189] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0190] Based on the same inventive concept, the embodiment of the present application also provides a data association device for implementing the data association method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more data association device embodiments provided below can refer to the limitations on the data association method above, and will not be repeated here.

[0191] In an exemplary embodiment, Figure 8 As shown, a data association device is provided, comprising: an acquisition module 11, a similarity information entropy calculation module 12 and a data association module 13, wherein:

[0192] An acquisition module 11 is used to acquire a forward data set output by a forward node according to each access request acquired within a current time window; and

[0193] Obtain a backward node corresponding to a forward node, and output a backward data set for the forward data set; wherein the forward data set includes at least one candidate forward data, and the backward data set includes at least one candidate backward data;

[0194] A similarity information entropy calculation module 12 is used to determine the similarity information entropy between each candidate forward data in the forward data set and each candidate backward data in the backward data set according to the similarity between each candidate forward data in the forward data set and each candidate backward data in the backward data set;

[0195] The data association module 13 is used to determine the data association relationship between each candidate forward data in the forward data set and each candidate backward data in the backward data set according to the similarity information entropy between each candidate forward data in the forward data set and each candidate backward data in the backward data set.

[0196] Each module in the above data association device can be implemented in whole or in part by software, hardware or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0197] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Fig. 9 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a data association method is implemented.

[0198] Those skilled in the art will understand that Fig. 9 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0199] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0200] Obtaining a forward data set output by the forward node according to each access request obtained within the current time window; and,

[0201] Obtain a backward node corresponding to a forward node, and output a backward data set for the forward data set; wherein the forward data set includes at least one candidate forward data, and the backward data set includes at least one candidate backward data;

[0202] Determine the similarity information entropy between each candidate forward data in the forward data set and each candidate backward data in the backward data set according to the similarity between each candidate forward data in the forward data set and each candidate backward data in the backward data set;

[0203] According to the similarity information entropy between each candidate forward data in the forward data set and each candidate backward data in the backward data set, the data association relationship between each candidate forward data in the forward data set and each candidate backward data in the backward data set is determined.

[0204] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0205] Obtaining a forward data set output by the forward node according to each access request obtained within the current time window; and,

[0206] Obtain a backward node corresponding to a forward node, and output a backward data set for the forward data set; wherein the forward data set includes at least one candidate forward data, and the backward data set includes at least one candidate backward data;

[0207] Determine the similarity information entropy between each candidate forward data in the forward data set and each candidate backward data in the backward data set according to the similarity between each candidate forward data in the forward data set and each candidate backward data in the backward data set;

[0208] According to the similarity information entropy between each candidate forward data in the forward data set and each candidate backward data in the backward data set, the data association relationship between each candidate forward data in the forward data set and each candidate backward data in the backward data set is determined.

[0209] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0210] Obtaining a forward data set output by the forward node according to each access request obtained within the current time window; and,

[0211] Obtain a backward node corresponding to a forward node, and output a backward data set for the forward data set; wherein the forward data set includes at least one candidate forward data, and the backward data set includes at least one candidate backward data;

[0212] Determine the similarity information entropy between each candidate forward data in the forward data set and each candidate backward data in the backward data set according to the similarity between each candidate forward data in the forward data set and each candidate backward data in the backward data set;

[0213] According to the similarity information entropy between each candidate forward data in the forward data set and each candidate backward data in the backward data set, the data association relationship between each candidate forward data in the forward data set and each candidate backward data in the backward data set is determined.

[0214] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0215] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0216] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A data association method, characterized in that: The method comprises: Obtaining a forward data set output by the forward node according to each access request obtained within the current time window; and, Obtaining a backward node corresponding to the forward node, and outputting a backward data set for the forward data set; wherein the forward data set includes at least one candidate forward data, and the backward data set includes at least one candidate backward data; Determining, according to the similarity between each candidate forward data in the forward data set and each candidate backward data in the backward data set, the similarity information entropy between each candidate forward data in the forward data set and each candidate backward data in the backward data set; According to the similarity information entropy between each candidate forward data in the forward data set and each candidate backward data in the backward data set, a data association relationship between each candidate forward data in the forward data set and each candidate backward data in the backward data set is determined.

2. The method according to claim 1, characterized in that The obtaining of the forward data set output by the forward node according to each access request obtained within the current time window includes: When it is detected that target sensitive data exists in each access request initiated to the forward node within the current time window, a forward data set output by the forward node according to each access request within the current time window is obtained.

3. The method according to claim 2, characterized in that The forward data set includes at least one candidate forward data carrying forward sensitive data; the backward data set includes at least one candidate backward data carrying backward sensitive data; Correspondingly, determining the similarity information entropy between each candidate forward data in the forward data set and each candidate backward data in the backward data set according to the similarity between each candidate forward data in the forward data set and each candidate backward data in the backward data set includes: According to the similarity between the forward sensitive data in each candidate forward data in the forward data set and the backward sensitive data in each candidate backward data in the backward data set, the similarity information entropy between each candidate forward data in the forward data set and each candidate backward data in the backward data set is determined.

4. The method according to claim 3, characterized in that The determining, according to the similarity between the forward sensitive data in each candidate forward data in the forward data set and the backward sensitive data in each candidate backward data in the backward data set, the similarity information entropy between each candidate forward data in the forward data set and each candidate backward data in the backward data set comprises: For each candidate forward data and each candidate backward data, determining a similarity between the candidate forward data and the candidate backward data; Determine the sum of similarities between the candidate forward data and the backward sensitive data in each candidate backward data in the backward data set, and use the sum of similarities as parameter similarity; The similarity information entropy between the candidate forward data and the candidate backward data is determined according to the ratio between the similarity between the candidate forward data and the candidate backward data and the parameter similarity.

5. The method according to any one of claims 1 to 4, characterized in that: The determining, according to the similarity information entropy between each candidate forward data in the forward data set and each candidate backward data in the backward data set, a data association relationship between each candidate forward data in the forward data set and each candidate backward data in the backward data set, comprises: Obtaining, from the graph database, similarity information entropy between each candidate forward data and each historical backward data; wherein each historical backward data is generated by the backward node according to at least one historical forward data initiated by the forward node within a historical time window, and each historical forward data includes at least one candidate forward data; According to the similarity information entropy between each candidate forward data and each candidate backward data, and the similarity information entropy between each candidate forward data and each historical backward data, the data association relationship between each candidate forward data in the forward data set and each candidate backward data in the backward data set is determined.

6. The method according to claim 5, characterized in that The determining, according to the similarity information entropy between each candidate forward data and each candidate backward data, and the similarity information entropy between each candidate forward data and each historical backward data, the data association relationship between each candidate forward data in the forward data set and each candidate backward data in the backward data set comprises: Selecting target forward data to be associated from each candidate forward data; According to the data association relationship between each candidate forward data and each historical backward data stored in the graph database, determine the historical backward data that has a data association relationship with the target forward data, and use the determined historical backward data as the backward associated data of the target forward data; According to the similarity information entropy between the target forward data and each candidate backward data, and the similarity information entropy between the target forward data and the backward associated data, select the target backward data having a data association relationship with the target forward data in the current time window from each candidate backward data and the backward associated data; updating the graph database according to the association relationship between the target forward data and the target backward data; The target forward data is removed from the forward data set to obtain a new forward data set, and the target backward data is removed from the backward data set to obtain a new backward data set, and based on the new forward data set and the new backward data set, the operation of selecting the target forward data to be associated from each candidate forward data is returned.

7. The method according to claim 6, characterized in that The selecting, from each candidate backward data and the backward associated data, target backward data having a data association relationship with the target forward data within the current time window according to the similarity information entropy between the target forward data and each candidate backward data, and the similarity information entropy between the target forward data and the backward associated data, comprises: Selecting the minimum backward similarity information entropy from the similarity information entropy between the target forward data and each candidate backward data, and the similarity information entropy between the target forward data and the backward associated data; According to the candidate backward data or backward associated data corresponding to the backward minimum similarity information entropy, target backward data having a data association relationship with the target forward data within the current time window is determined.

8. The method according to claim 7, characterized in that The determining, according to the candidate backward data or the backward associated data corresponding to the backward minimum similarity information entropy, the target backward data having a data association relationship with the target forward data within the current time window, comprises: The candidate backward data or the backward associated data corresponding to the backward minimum similarity information entropy is used as the backward data to be associated corresponding to the target forward data in the current time window; Acquire, from the graph database, forward associated data having a data association relationship with the backward data to be associated within the historical time window, and similarity information entropy between the backward data to be associated and the forward associated data; the forward associated data is data generated by the forward node within the historical time window; According to the similarity information entropy between the backward data to be associated and each candidate forward data, and the similarity information entropy between the backward data to be associated and the forward associated data, determine the forward data to be associated that has a data association relationship with the backward data to be associated from each candidate forward data and the forward associated data; According to the consistency between the forward data to be associated and the target forward data, the backward data to be associated is used as the target backward data having a data association relationship with the target forward data within the current time window.

9. The method according to claim 8, characterized in that The determining, based on the similarity information entropy between the backward data to be associated and each candidate forward data, and the similarity information entropy between the backward data to be associated and the forward associated data, from each candidate forward data and the forward associated data, the forward data to be associated that has a data association relationship with the backward data to be associated, comprises: Selecting the minimum forward similarity information entropy from the similarity information entropy between the backward data to be associated and each candidate forward data, and the similarity information entropy between the backward data to be associated and the forward associated data; The candidate forward data or the forward associated data corresponding to the forward minimum similarity information entropy is used as the forward data to be associated that has a data association relationship with the backward data to be associated.

10. The method according to claim 8, characterized in that The step of taking the backward data to be associated as target backward data having a data association relationship with the target forward data within the current time window according to the consistency between the forward data to be associated and the target forward data includes: In a case where the forward data to be associated is consistent with the target forward data, the backward data to be associated is used as the target backward data having a data association relationship with the target forward data within the current time window; In the case that the forward data to be associated is inconsistent with the target forward data, if the similarity information entropy between the forward data to be associated and the backward data to be associated is greater than the similarity information entropy between the backward data to be associated and the target forward data, the backward data to be associated is used as the target backward data that has a data association relationship with the target forward data within the current time window.

11. The method according to claim 6, characterized in that Before obtaining the similarity information entropy between each candidate forward data and each historical backward data from the graph database, the method further includes: For each candidate forward data, according to the similarity between the candidate forward data and each candidate backward data, select the candidate backward data with the highest similarity from the backward data set as the backward data to be updated; Determine the set similarity information entropy between the candidate forward data and the set of backward data according to the similarity between the candidate forward data and each candidate backward data, and use the set similarity information entropy as the similarity information entropy between the candidate forward data and the backward data to be updated; The graph database is updated by using the data association relationship between the candidate forward data and the backward data to be updated, and the similarity information entropy between the candidate forward data and the backward data to be updated.

12. The method according to claim 11, characterized in that The updating of the graph database by using the data association relationship between the candidate forward data and the backward data to be updated, and the similarity information entropy between the candidate forward data and the backward data to be updated, comprises: In the case that the candidate forward data and the backward data to be updated do not exist in the graph database, adding a data association relationship between the candidate forward data and the backward data to be updated, and a similarity information entropy between the candidate forward data and the backward data to be updated in the graph database; In the case that the candidate forward data and the backward data to be updated exist in the graph database, if it is determined that the existing similarity information entropy between the candidate forward data and the backward data to be updated in the graph database is greater than the set similarity information entropy, then the existing similarity information entropy between the candidate forward data and the backward data to be updated is updated according to the set similarity information entropy.

13. A data association device, characterized in that: The device comprises: an acquisition module, used to acquire a forward data set output by a forward node according to each access request acquired within a current time window; and Obtaining a backward node corresponding to the forward node, and outputting a backward data set for the forward data set; wherein the forward data set includes at least one candidate forward data, and the backward data set includes at least one candidate backward data; A similarity information entropy calculation module, used to determine the similarity information entropy between each candidate forward data in the forward data set and each candidate backward data in the backward data set according to the similarity between each candidate forward data in the forward data set and each candidate backward data in the backward data set; The data association module is used to determine the data association relationship between each candidate forward data in the forward data set and each candidate backward data in the backward data set according to the similarity information entropy between each candidate forward data in the forward data set and each candidate backward data in the backward data set.

14. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 12 are implemented.

15. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 12 are implemented.

16. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 12 are implemented.

Images