Data security management method and device based on natural language conversion technology

Abstract

The embodiment of the application discloses a data security management method and equipment based on natural language conversion technology, relates to the technical field of data security, and comprises the following steps: a preset model is used to convert natural language into an SQL statement, and a target data request information approved is converted into an SQL statement; according to the SQL statement, corresponding to the data request information, the data to be processed is queried in the database, and the data to be processed is exported to a data security management and control platform; the data to be processed is classified by a preset classification and grading model, and the sensitivity level of the data to be processed is obtained; according to the sensitivity level and a preset multi-level data protection strategy, the target protection strategy of the data to be processed is determined, and the data security management and control platform is controlled to perform security protection on the data to be processed according to the target protection strategy. The data query and data acquisition efficiency are improved, and the risk of human data leakage is avoided.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a data security management method and device based on natural language conversion technology. Background Art

[0002] As the value of data is gradually explored and valued, data has become a target for illegal acquisition by some people. In scenarios such as back-end operations and maintenance, front-end business access, and terminal file office, data is prone to various internal and external data leakage risks during storage, processing, processing, circulation, and distribution.

[0003] The current means of data security management and control is to achieve data security management capabilities through terminal anti-leakage technology, but in actual use, terminal anti-leakage technology has limitations. For example, automated queries cannot be implemented during the query stage, and it is impossible to control whether the user's query requirements are reasonable or whether the query scope is compliant. The personnel responsible for querying the data are also risk points for data leakage; for example, in the process of user query and data extraction, there is a lack of automatic classification and grading capabilities for data, especially the inability to achieve automatic classification and grading of unstructured data. At the same time, there is a lack of refined management and control capabilities based on classification and grading and post-audit capabilities for the entire process of data acquisition and use. It is impossible to control and trace user operation behaviors and implement them to relevant responsible persons. Summary of the Invention

[0004] In view of this, the present invention provides a data security management method and device based on natural language conversion technology to solve the problems of limitations of existing data security management.

[0005] In a first aspect, an embodiment of the present invention provides a data security management method based on natural language conversion technology, the method comprising:

[0006] The preset model is used to convert natural language into SQL statements, and the approved target data request information into SQL statements, including:

[0007] Extract features from the approved target data request information using a feature extraction algorithm in a preset model to obtain natural language features, where the natural language features include contextual features, semantic features, and grammatical features;

[0008] Generate an SQL statement corresponding to the target data request information by using an SQL statement generation algorithm in the preset model according to the context feature, the semantic feature, and the grammatical feature;

[0009] Querying the database for the data to be processed corresponding to the target data request information according to the SQL statement, and exporting the data to be processed to the data security management and control platform;

[0010] Classify and grade the data to be processed using a preset classification and grading model to obtain a sensitivity level of the data to be processed;

[0011] The target protection strategy for the data to be processed is determined based on the sensitivity level and the preset multi-level data protection strategy, and the data to be processed is securely protected according to the target protection strategy through the data security management and control platform.

[0012] Optionally, before the step of converting the natural language into SQL statements using a preset model and converting the approved target data request information into SQL statements, the method further includes:

[0013] When there is a data request information for data query and / or data reading, obtaining the identity information of the user who initiated the data request information and the required data content of the data required by the data request information;

[0014] Determine the queryable data content corresponding to the identity identification information based on the identity identification information and the preset permission information;

[0015] If the queryable data content matches the required data content, the data request information is used as the approved target data request information;

[0016] If the queryable data content does not match the required data content, generating an approval request based on the identity identification information and the required data content, sending the approval request to a preset client, and obtaining feedback information on the approval request through the preset client;

[0017] When the feedback information is used to indicate that the approval request is passed, the data request information is used as target data request information that has passed the approval.

[0018] Optionally, the method further includes:

[0019] Building a data set based on the target data request information and an SQL statement corresponding to the target data request information;

[0020] Based on the computing power resource pool, the preset model is trained using the data set.

[0021] Optionally, the step of training the preset model using the data set based on the computing resource pool includes:

[0022] Integrate the computing power resources of each computing device in the computing system where the preset model is located to obtain a computing power resource pool;

[0023] When a training task for training the preset model is obtained, the preset model is trained using the data set based on the idle computing power of the computing resource pool to complete the training task.

[0024] Optionally, the step of classifying and grading the data to be processed by using a preset classification and grading model to obtain a sensitivity level of the data to be processed includes:

[0025] Using the NLP-based classification and grading model as the preset classification and grading model, and extracting labels from the data to be processed using an unsupervised learning algorithm in the NLP-based classification and grading model to obtain data labels for the data to be processed;

[0026] The data labels of the data to be processed are identified and determined by a supervised learning algorithm in a classification and grading model based on NLP to obtain the sensitivity level of the data to be processed.

[0027] Optionally, the step of determining a target protection strategy for the data to be processed based on the sensitivity level and a preset multi-level data protection strategy, and performing security protection on the data to be processed according to the target protection strategy through the data security management and control platform includes:

[0028] Determining a target protection strategy for the data to be processed based on the sensitivity level and the preset multi-level data protection strategy;

[0029] Performing data protection processing on the data to be processed according to the target protection strategy through the data security management and control platform to complete security protection of the data to be processed, including:

[0030] Setting a functional component bound to the data to be processed according to the target protection strategy through the data security management and control platform to perform data protection processing on the data to be processed, and the functional component is used to control the number of views and / or browsing duration of the data to be processed;

[0031] and / or, obtaining operation information performed on the data to be processed, and generating watermark information based on the operation information and the identity identification information of the user who initiated the data request information, and setting a dark watermark for the data to be processed based on the watermark information according to the target protection strategy through the data security management and control platform, so as to complete the watermarking of the data to be processed;

[0032] and / or, identifying data to be encrypted within the data to be processed, and encrypting the data to be encrypted within the data to be processed according to the target protection policy settings through the data security management and control platform, so as to complete encryption processing of the data to be processed;

[0033] and / or, identifying sensitive data in the data to be processed, and performing synonymous replacement / masking on the sensitive data in the data to be processed according to the target protection policy settings through the data security management and control platform to complete desensitization processing of the data to be processed;

[0034] The data protection processing includes at least one of data desensitization processing, data encryption processing, setting the number of browsing times and / or browsing time for the data to be processed, and setting a watermark for the data to be processed.

[0035] Optionally, the method further includes:

[0036] When a data download instruction for downloading the data to be processed is obtained, approving the data to be processed based on a preset approval matrix;

[0037] If approved, the data to be processed after security protection is completed will be downloaded in response to the data download instruction;

[0038] If the approval is not passed, the system stops responding to the data download instruction.

[0039] Optionally, the method further includes:

[0040] When data in the database is read and / or queried, log information of each management system corresponding to the database is obtained;

[0041] Performing audit processing on actions corresponding to the log information according to the log information includes:

[0042] Matching the preset rules with the content data of the log information to determine whether the content data complies with the preset rules to complete the audit processing of the action corresponding to the log information;

[0043] And / or, log information of different management systems is correlated and analyzed to complete audit processing of actions corresponding to the log information.

[0044] In a second aspect, an embodiment of the present invention provides a data security management device based on natural language conversion technology, characterized in that the device includes:

[0045] a conversion module configured to convert the approved target data request information into an SQL statement using a preset model, the preset model being configured to convert natural language into an SQL statement, including: extracting features from the approved target data request information using a feature extraction algorithm in the preset model to obtain natural language features, the natural language features including contextual features, semantic features, and grammatical features; and generating an SQL statement corresponding to the target data request information using an SQL statement generation algorithm in the preset model based on the contextual features, the semantic features, and the grammatical features;

[0046] A query module is used to query the database for the data to be processed corresponding to the target data request information according to the SQL statement, and export the data to be processed to the data security management and control platform;

[0047] A classification and grading module is used to classify and grade the data to be processed using a preset classification and grading model to obtain a sensitivity level of the data to be processed;

[0048] The protection module is used to determine the target protection strategy of the data to be processed based on the sensitivity level and the preset multi-level data protection strategy, and control the data security management and control platform to perform security protection on the data to be processed according to the target protection strategy.

[0049] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising:

[0050] One or more processors;

[0051] a storage device for storing one or more programs;

[0052] When the one or more programs are executed by the one or more processors, the one or more processors implement the data security management method based on natural language conversion technology as described in any embodiment of the present invention.

[0053] In a fourth aspect, an embodiment of the present invention further provides a storage medium comprising computer-executable instructions, which, when executed by a computer processor, are used to execute a data security management method based on natural language conversion technology as described in any embodiment of the present invention.

[0054] The technical scheme of the embodiment of the present application is that a preset model is used to convert natural language into an SQL statement, and convert a target data request information that has passed examination and approval into an SQL statement; the SQL statement is used to query corresponding to-be-processed data of the data request information in a database, and the to-be-processed data is exported to a data security management and control platform; a preset classification and grading model is used to classify and grade the to-be-processed data, and a sensitive level of the to-be-processed data is obtained; a target protection strategy of the to-be-processed data is determined according to the sensitive level and a preset multi-level data protection strategy, and the data security management and control platform is used to perform security protection on the to-be-processed data according to the target protection strategy, so that data query and data acquisition efficiency is improved, and human data leakage risk is avoided. The to-be-processed data is exported to the data security management and control platform, so that security management / control of the to-be-processed data is facilitated, and the to-be-processed data is classified and graded, so that different sensitive degrees of data can be flexibly and specifically protected. BRIEF DESCRIPTION OF DRAWINGS

[0055] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0056] Among them:

[0057] Figure 1 is a flowchart of a data security management method based on a natural language conversion technology in an embodiment of the present application;

[0058] Figure 2 is a structural schematic diagram of a data security management device based on a natural language conversion technology in an embodiment of the present application;

[0059] Figure 3 is a structural schematic diagram of an electronic device provided by an embodiment of the present application;

[0060] Figure 4 is a structural schematic diagram of a computer readable storage provided by an embodiment of the present application. DETAILED DESCRIPTION

[0061] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0062] An embodiment of the present invention provides a data security management method based on natural language conversion technology. The method uses a preset model to convert natural language into SQL statements, and converts approved target data request information into SQL statements. The method comprises: extracting features from the approved target data request information using a feature extraction algorithm in the preset model to obtain natural language features, wherein the natural language features include contextual features, semantic features, and grammatical features; generating an SQL statement corresponding to the target data request information using an SQL statement generation algorithm in the preset model based on the contextual features, semantic features, and grammatical features; querying a database for pending data corresponding to the data request information based on the SQL statement, and exporting the pending data to a data security management and control platform; classifying and grading the pending data using a preset classification and grading model to obtain a sensitivity level of the pending data; determining a target protection strategy for the pending data based on the sensitivity level and a preset multi-level data protection strategy, and performing security protection on the pending data using the data security management and control platform according to the target protection strategy. Natural language requirements such as data request information are converted into SQL statements using the preset model, thereby improving data query and data acquisition efficiency and avoiding the risk of human-induced data leakage. The data to be processed is exported to the data security management and control platform to facilitate the security management / control of the data to be processed. The data to be processed is classified and graded, and targeted security protection can be flexibly carried out for data of different sensitivity levels.

[0063] In one embodiment, the present invention provides a data security management method based on natural language conversion technology. The data security management method based on natural language conversion technology in the embodiment of the present invention can be executed by a data security management device based on natural language conversion technology. The data security management device based on natural language conversion technology can be implemented by software and / or hardware.

[0064] like Figure 1 As shown, the data security management method based on natural language conversion technology in an embodiment of the present invention specifically includes the following steps:

[0065] S110. Converting the approved target data request information into an SQL statement using a preset model, the preset model being used to convert natural language into an SQL statement, including: extracting features from the approved target data request information using a feature extraction algorithm in the preset model to obtain natural language features, the natural language features including context features, semantic features, and grammatical features; and generating an SQL statement corresponding to the target data request information using an SQL statement generation algorithm in the preset model based on the context features, the semantic features, and the grammatical features;

[0066] In one possible implementation, the step of converting the approved target data request information into an SQL statement using a preset model, wherein the preset model is used to convert the natural language into an SQL statement, includes:

[0067] Extract features from the approved target data request information using a feature extraction algorithm in a preset model to obtain natural language features, where the natural language features include contextual features, semantic features, and grammatical features;

[0068] An SQL statement corresponding to the target data request information is generated according to the context feature, the semantic feature and the grammatical feature through an SQL statement generation algorithm in a preset model.

[0069] Exemplarily, the preset model, taking the T5 model as an example, combines synthetic data with original annotated data to perform supervised fine-tuning on the T5 model. This balances data generation efficiency (reducing manual annotation costs) with T5's instruction fine-tuning adaptability, making it suitable for rapid model iteration. Specifically, the original annotated data is parsed to generate labeled data, which refers to a data pair consisting of a "natural language description and an executable SQL script." Based on the original annotated data, the synthetic data is generated using data generation techniques, including but not limited to synonym replacement: using a synonym dictionary to replace words in the text while preserving the meaning of the sentence. Vocabulary replacement: replacing existing vocabulary with synonyms or related vocabulary to increase diversity. Word insertion / deletion: randomly inserting or deleting words in a sentence to simulate different expressions. Syntax transformation: changing the grammatical structure of a sentence, such as changing from passive voice to active voice. Furthermore, transformations are performed on SQL, including but not limited to SQL statement reconstruction: changing the expression of an SQL query, such as using different aggregate functions or condition combinations. Adding / deleting conditions: adding or removing conditions from a query to generate a new query. Rewriting SQL statements: Using different SQL syntax structures to express the same meaning. Labeled data is generated through synthetic sample generation. The specific process of synthesizing samples includes but is not limited to: Hybrid generation: Combining natural language descriptions and SQL queries from multiple samples to form new pairs. Template filling: Using a preset template, different vocabulary is added to the template to generate new samples. Rule-driven generation: Generate new samples based on predefined rules, such as changing table names or field names in SQL queries.

[0070] The labeled data is used as a data set for training the T5 model. Before training the T5 model using the data set, the data set is subjected to noise removal processing to delete irrelevant or invalid data records, such as duplicate records or obviously erroneous data; missing values ​​in the data set are processed to fill or delete records containing missing values, and interpolation, deletion, etc. can be used; the data set is subjected to standardized data format processing to unify data formats, such as dates, currency units, etc., to ensure data consistency; punctuation marks in the data set are removed to delete or replace punctuation marks in the text to reduce interference factors; the text in the data set is converted to upper and lower case to unify the case of the text, usually converted to lower case to reduce vocabulary diversity; the data set is subjected to stop word removal processing to remove common words in natural language, such as "的", "是", "在", etc., to reduce redundant information, and text segmentation is performed on the data set to divide sentences into single words or tags.

[0071] Exemplarily, the step of extracting features from the approved target data request information using a feature extraction algorithm in a preset model to obtain natural language features, wherein the natural language features include context features, semantic features, and grammatical features, specifically including: a process of extracting context features, a process of extracting semantic features, and a process of extracting grammatical features;

[0072] Among them, the process of context feature extraction is: identifying keywords, that is, identifying key words in the sentence through word segmentation technology, such as table names, field names, aggregate functions, etc.; extracting context information: analyzing the context information in the sentence, that is, identifying the relationship between keywords, such as conjunctions, sequence words, indicator words, etc.; context window, that is, building a context window for each keyword to capture the surrounding vocabulary information to better understand its contextual meaning; entity recognition, that is, using named entity recognition (NER) technology to identify entity names in the sentence, such as table names, field names, etc.

[0073] The process of grammatical feature extraction is as follows: sentence structure analysis, that is, using dependency parsing or constituency parsing technology to extract the grammatical structure of the sentence; part-of-speech tagging, that is, marking the part of speech (such as noun, verb, adjective, etc.) for each word in the sentence to help understand the role of the word in the sentence; grammatical pattern matching, that is, identifying specific grammatical patterns in the sentence, such as passive voice, comparative degree, etc.; grammatical error detection, that is, checking the grammatical errors in the sentence and trying to correct or prompt errors.

[0074] The process of semantic feature extraction is as follows: semantic role labeling, that is, identifying the predicates and their arguments in the sentence, namely the actions (predicates) and participants (arguments), to help understand the core meaning of the sentence; semantic similarity calculation, that is, using word vectors (such as Word2Vec, GloVe) or context-sensitive embeddings (such as BERT, RoBERTa) to calculate the semantic similarity between words; logical form conversion, that is, converting natural language descriptions into logical forms (such as first-order logic) to facilitate subsequent SQL query generation; semantic relationship analysis, that is, analyzing the semantic relationships between words in the sentence, such as causal relationships, parallel relationships, transitional relationships, etc.

[0075] Exemplarily, a syntax check, a security check, and a performance check are performed on the generated SQL statement corresponding to the target data request information, wherein the syntax check specifically includes: syntax verification, i.e., checking whether the SQL script complies with the SQL standard syntax, including the correct use of keywords, the integrity of the syntax structure, etc.; syntax tree construction, i.e., using an abstract syntax tree (AST) to represent the structure of the SQL statement to ensure that all syntax elements are correctly parsed; error location and reporting, i.e., when a syntax error is found, accurately pointing out the location of the error and providing detailed error information to facilitate debugging; version compatibility check, i.e., ensuring that the SQL script can be correctly executed in different database management systems (DBMS).

[0076] The security check specifically includes: SQL injection defense, that is, detecting whether the SQL script has the risk of SQL injection, such as generating SQL statements by string splicing; input validation, that is, ensuring that all inputs are properly validated to prevent security issues caused by malicious input; permission checking, that is, checking whether the operations involved in the SQL script exceed the user's authority; sensitive data protection, that is, ensuring that the SQL script does not expose or leak sensitive data, such as user names and passwords.

[0077] The performance check specifically includes: index usage check, that is, evaluating whether the SQL query fully utilizes the existing indexes to speed up the query; query optimization, that is, analyzing the execution plan of the SQL query, identifying possible performance bottlenecks, and proposing improvement suggestions; statistical information utilization, that is, ensuring that the SQL query reasonably utilizes the database's statistical information for optimization; avoiding full table scans, that is, detecting whether full table scans can be avoided and a more efficient query strategy can be used instead.

[0078] S120: Query the database for data to be processed corresponding to the target data request information according to the SQL statement, and export the data to be processed to the data security management and control platform;

[0079] For example, when the data to be processed is exported to the data security management and control platform, the data to be processed is encrypted and then stored in the data security management and control platform. Specifically, the data storage encryption is performed using a transparent encryption method based on the national secret algorithm SM4, that is, before the data is stored, the data is encrypted through an encryption layer to achieve data encryption on the disk and ensure the confidentiality of the data.

[0080] S130: Classify and grade the data to be processed using a preset classification and grading model to obtain a sensitivity level of the data to be processed;

[0081] In a possible implementation, the step of classifying and grading the data to be processed using a preset classification and grading model to obtain a sensitivity level of the data to be processed includes:

[0082] Using the NLP-based classification and grading model as the preset classification and grading model, and extracting labels from the data to be processed using an unsupervised learning algorithm in the NLP-based classification and grading model to obtain data labels for the data to be processed;

[0083] The data labels of the data to be processed are identified and determined by a supervised learning algorithm in a classification and grading model based on NLP to obtain the sensitivity level of the data to be processed.

[0084] For example, after the data is stored in the data security management and control platform, the file content is actively scanned, and sensitive data in the document is automatically discovered based on the characteristics of the sensitive data label, and the file sensitivity level is classified and graded.

[0085] Specifically, the system uses keywords and regular expressions to scan file data content, identifying the characteristics of the data being processed and fully ensuring compliance. By setting over 80 data feature rules, it can automatically identify 90% of personal information. Scanning for sensitive document content supports xls(x), doc(x), ppt(x), PDF, csv, text files, and compressed files (without passwords) of these types.

[0086] Among them, the keyword matching process can be understood as: taking name, country, province, and city as representatives, when the data can be accurately matched to the corresponding keywords, the data characteristics are determined. Therefore, by establishing a supporting data dictionary, such as the names of the hundred families, countries, province names, city names, etc. It supports adding sensitive controls by directly matching keywords, and can support adding sensitive keywords in the OR and AND methods. For example, if "customer information OR ID number OR mobile phone number" is added to the sensitive keywords, then if a user uploads a file to the data security management and control platform, the system will perform a sensitive scan on the document according to the sensitive scanning policy. If any of the words customer information, ID number, and mobile phone number appear in the file, the corresponding sensitive attribute will be added to the document. When the user operates the document, the system will control the document permissions according to the management policy issued for the sensitive label.

[0087] The process of regular expression matching can be understood as follows: taking mobile phone numbers, ID numbers, and license numbers as examples, these data types have fixed lengths, fixed formats, and fixed data ranges. Regular expression configuration and parsing are used to determine data characteristics. Sensitive rules for regular expression matching can be used to wildcard sensitive information such as names, ID numbers, and mobile phone numbers. For example, the regular expression for the ID number matching rule can be defined as: (?<=\D{1}|\s|^)(1[1-5]|2[1-3]|3[1-7]|4[1-6]|5[0-4]|6[1-5])[0-9]{15}([0-9]|X|x)(?=\D{1}|\s|$)

[0088] The ID card number can be identified through the regular expression of the above ID card number matching rule, thereby adding sensitive attributes to the document so that the system can follow up on the sensitive attributes of the document to control document permissions.

[0089] For example, for unstructured data flow scenarios, an NLP-based unstructured data classification and grading model is adopted, and a combination of unsupervised learning and supervised learning is used to realize the recognition of unstructured data.

[0090] Specifically, when faced with long texts of unstructured data, they need to be converted into short texts for the sake of model accuracy and processing efficiency. Therefore, the unstructured data is parsed and important text information is extracted as a topic summary.

[0091] Secondly, unstructured data has no label information and is huge in quantity, making manual labeling difficult. Therefore, it is considered to give priority to using unsupervised learning methods for label extraction. In this process, the unsupervised learning model is used to predict the results and gradually accumulate label data. When the label data accumulates to a certain amount, the supervised learning model is used to further optimize the algorithm. By comprehensively applying multiple NLP technologies, a classification and grading model with greater scalability and higher accuracy is constructed, wherein the unsupervised learning model can be understood as an algorithm model constructed based on an unsupervised learning algorithm, and the supervised learning model can be understood as an algorithm model constructed based on a supervised learning algorithm.

[0092] The specific method of unsupervised learning is:

[0093] The contrastive learning model extracts text vectors from unstructured data, calculates similarity between text vectors, and classifies data with high similarity into the same classification data, that is, data with the same label;

[0094] Perform part-of-speech analysis and keyword matching on unstructured data, and classify the successfully matched data into corresponding label data;

[0095] Multiple unsupervised learning models are integrated to obtain comprehensive labeled data results.

[0096] The specific method of supervised learning is:

[0097] The text retrieval algorithm model gives the label data that is most similar to the current unstructured data, and uses these label data as the basis for classifying the current unstructured data;

[0098] Perform text classification on the current unstructured data based on the label data to obtain fine-grained classification results;

[0099] Multiple supervised learning models are integrated to obtain multi-level classification results.

[0100] Exemplarily, (global) and sensitive scanning policies may be defined, where the definition of sensitive scanning policies includes document sensitivity levels, sensitivity rules, number of sensitive data items, and the like.

[0101] For example, based on the established sensitivity rules and scanning strategies, the system identifies sensitive content and defines sensitivity levels for stored personal documents. The sensitivity levels can be set to extremely sensitive, sensitive, relatively sensitive, low sensitivity, and other file sensitivity levels.

[0102] For example, based on the identification of the document content, the document can be classified according to the data content, and the classification can be set as: user identity related data, user service content data, user service derived data, and enterprise operation management data.

[0103] S140. Determine a target protection strategy for the data to be processed based on the sensitivity level and the preset multi-level data protection strategy, and perform security protection on the data to be processed according to the target protection strategy through the data security management and control platform.

[0104] In one possible implementation, the step of determining a target protection strategy for the data to be processed based on the sensitivity level and a preset multi-level data protection strategy, and performing security protection on the data to be processed according to the target protection strategy through the data security management and control platform includes:

[0105] Determining a target protection strategy for the data to be processed based on the sensitivity level and the preset multi-level data protection strategy;

[0106] Performing data protection processing on the data to be processed according to the target protection strategy through the data security management and control platform to complete security protection of the data to be processed, including:

[0107] Setting a functional component bound to the data to be processed according to the target protection strategy through the data security management and control platform to perform data protection processing on the data to be processed, and the functional component is used to control the number of views and / or browsing duration of the data to be processed;

[0108] and / or, obtaining operation information performed on the data to be processed, and generating watermark information based on the operation information and the identity identification information of the user who initiated the data request information, and setting a dark watermark for the data to be processed based on the watermark information according to the target protection strategy through the data security management and control platform, so as to complete the watermarking of the data to be processed;

[0109] and / or, identifying the data to be encrypted within the data to be processed, and encrypting the data to be encrypted within the data to be processed according to the target protection policy settings through the data security management and control platform to complete encryption processing of the data to be processed;

[0110] and / or, identifying sensitive data in the data to be processed, and performing synonymous replacement / masking on the sensitive data in the data to be processed according to the target protection policy settings through the data security management and control platform to complete desensitization processing of the data to be processed;

[0111] The data protection processing includes at least one of data desensitization processing, data encryption processing, setting the number of browsing times and / or browsing time for the data to be processed, and setting a watermark for the data to be processed.

[0112] For example, the sensitive data desensitization function module of the data security management and control platform is called to scan the file content for sensitive keywords. After the scan discovers sensitive information, the scanned specified content is desensitized, supporting synonym replacement, data masking, etc.

[0113] The data security management and control platform leverages its capabilities to provide watermarking technology embedded in file carriers, allowing sensitive content in files to be watermarked. This means adding a watermark to the page displaying the data being processed. The watermark content can be configured based on pre-set watermark policies, including content, font, transparency, and tilt.

[0114] At the same time, the data security management and control platform can also be leveraged to provide dark watermarking (invisible watermarking) technology embedded in the frequency domain layer, ensuring the robustness of the watermark. By generating a watermark layer and loading it onto the frequency domain layer of the file, it does not affect the normal opening, reading, and writing of the file, and is also difficult to delete. Furthermore, the watermark information is generated based on the operation information and the identity of the user who initiated the data request information, allowing for precise tracing of the source in the event of a data leak.

[0115] In one possible implementation, before the step of converting the natural language into SQL statements using a preset model, and converting the approved target data request information into SQL statements, the method further includes:

[0116] When there is a data request information for data query and / or data reading, obtaining the identity information of the user who initiated the data request information and the required data content of the data required by the data request information;

[0117] Determine the queryable data content corresponding to the identity identification information based on the identity identification information and the preset permission information;

[0118] If the queryable data content matches the required data content, the data request information is used as the approved target data request information;

[0119] If the queryable data content does not match the required data content, generating an approval request based on the identity identification information and the required data content, sending the approval request to a preset client, and obtaining feedback information on the approval request through the preset client;

[0120] When the feedback information is used to indicate that the approval request is passed, the data request information is used as target data request information that has passed the approval.

[0121] For example, data request information for data query and / or data access can be understood as a work order application. Users initiate data query and / or data access requests through the work order system, select the business system to be queried, and describe the data query and / or data access request in detail (e.g., counting the number of users with base station CGIs 123456789 and 112345678 between 10:30 AM on December 27, 2024, and 2:50 PM on December 29, 2024). The request is then approved in the work order system. If the approval result is "approved," the work order request information is sent to the pre-set model. Initiating request approval through the online work order system effectively rationalizes and standardizes data query and / or data access requests, avoiding the risk of data leakage caused by illegal data acquisition.

[0122] Exemplarily, the preset permission information includes different identity identification information and the accessible data content corresponding to the different identity identification information. For example, if the data content corresponding to the identity identification information a of worker A is X and Y, if A initiates a request to extract data X and Y, the request is automatically determined to be supported (approved). If A initiates a request to extract data Z, the request is automatically rejected. If worker A continues to initiate a query request for data with data content Z after the request is rejected, the query request initiated by worker A for data with data content Z is sent to the preset client as an approval request, and feedback information regarding the approval request is obtained through the preset client. The preset permission information can improve approval efficiency and accuracy, that is, compliant data requests do not require manual approval.

[0123] In a possible implementation, the method further includes:

[0124] Building a data set based on the target data request information and an SQL statement corresponding to the target data request information;

[0125] Based on the computing power resource pool, the preset model is trained using the data set.

[0126] Exemplarily, continuous training of the preset model is helpful to ensure the accuracy of the output results of the preset model.

[0127] In one possible implementation, the step of training the preset model using the data set based on the computing resource pool, wherein the preset model is used to convert natural language into SQL statements, includes:

[0128] Integrate the computing power resources of each computing device in the computing system where the preset model is located to obtain a computing power resource pool;

[0129] When a training task for training the preset model is obtained, the preset model is trained using the data set based on the idle computing power of the computing resource pool to complete the training task.

[0130] For example, the model training process often requires a lot of computing power support, and the preset model is often used during the day (working hours). If the preset model is trained during the day (working hours), it will affect user use. Therefore, based on the change data of the idle resource data in the computing power resource pool and the working rules of the preset model, the target time period is selected to train the preset model.

[0131] For example, the GPU resources of multiple machines are integrated into a large resource pool (computing power resource pool), and resources are intelligently allocated according to actual task requirements. "Large tasks" call multiple GPUs for parallel computing across machines, and "small tasks" are run whenever there is time, eliminating idle resources. For example, model training tasks are regarded as large tasks, and model inference tasks are regarded as small tasks. The computing power of the computing power resource pool is dynamically allocated according to the task volume of model training tasks and the task volume of model inference tasks.

[0132] In a possible implementation, the method further includes:

[0133] When data in the database is read and / or queried, log information of each management system corresponding to the database is obtained;

[0134] Auditing an action corresponding to the log information according to the log information includes:

[0135] Matching the preset rules with the content data of the log information to determine whether the content data complies with the preset rules, thereby completing audit processing of the action corresponding to the log information;

[0136] And / or, log information of different management systems is correlated and analyzed to complete audit processing of actions corresponding to the log information.

[0137] The audit includes but is not limited to: operation log audit, exception audit and bypass audit.

[0138] For example, the full-link log records of all operations such as uploading, accessing, browsing, sharing, downloading, and exporting the data to be processed are provided to the log audit platform. On the log audit platform, the transmission operation trajectory of sensitive data documents can be queried and traced for evidence collection based on the association of documents as objects or users as objects.

[0139] Operation log audit: The system records all user export, preview, edit, share, download and other logs. Through the strong connection between people and data, it realizes the traceability audit capability of "identification by number" and "tracing numbers by people".

[0140] Abnormal audit: Analyze and count behaviors such as high-frequency access, high user download volume, high traffic volume, and external network access.

[0141] Bypass audit: By correlating and analyzing the logs of the work order system, 4A system, and data security management and control platform, it is possible to audit the bypass of the work order system and the anti-bypass behavior of the 4A system.

[0142] Exemplarily, when the preset rule specifies a data path, for example, specifying that data is transmitted from a first address (IP1) to a second address (IP2), it is identified whether the data sending address in the content data of the log information is the first address (IP1), and whether the data receiving address in the content data of the log information is the second address (IP2), thereby implementing audit processing for the action corresponding to the log information.

[0143] Exemplarily, the log information of different management systems is correlated and analyzed, that is, when there is target log information representing the reading of the data N to be processed in any management system, it is queried in other management systems whether there is log information corresponding to the target log information, and then audit processing is performed on the actions corresponding to the log information.

[0144] In a possible implementation, the method further includes:

[0145] When a data download instruction for downloading the data to be processed is obtained, approving the data to be processed based on a preset approval matrix;

[0146] If approved, the data to be processed after security protection is completed will be downloaded in response to the data download instruction;

[0147] If the approval is not passed, the system stops responding to the data download instruction.

[0148] Exemplarily, when faced with a download request (data download instruction), the data to be processed is approved according to a preset approval matrix to further prevent data leakage and improve data security.

[0149] Second, as Figure 2 As shown, an embodiment of the present invention provides a data security management device based on natural language conversion technology, characterized in that the device includes:

[0150] The conversion module 201 is configured to convert the approved target data request information into an SQL statement using a preset model, wherein the preset model is configured to convert natural language into an SQL statement, including: extracting features from the approved target data request information using a feature extraction algorithm in the preset model to obtain natural language features, wherein the natural language features include context features, semantic features, and grammatical features; and generating an SQL statement corresponding to the target data request information using an SQL statement generation algorithm in the preset model based on the context features, the semantic features, and the grammatical features.

[0151] A query module 202 is configured to query the database for data to be processed corresponding to the target data request information according to the SQL statement, and export the data to be processed to the data security management and control platform;

[0152] The classification and grading module 203 is configured to classify and grade the data to be processed using a preset classification and grading model to obtain a sensitivity level of the data to be processed;

[0153] The protection module 204 is used to determine the target protection strategy of the data to be processed according to the sensitivity level and the preset multi-level data protection strategy, and to perform security protection on the data to be processed according to the target protection strategy through the data security management and control platform.

[0154] It is worth noting that the various modules included in the above-mentioned device are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be realized; in addition, the specific names of the various functional modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the embodiments of the present invention.

[0155] Another embodiment of the present invention provides an electronic device. Figure 3 A block diagram of an exemplary electronic device 50 suitable for implementing exemplary embodiments of the present invention is shown. Figure 3 The electronic device 50 shown is only an example and should not limit the functionality and scope of use of the embodiments of the present invention.

[0156] like Figure 3 As shown, electronic device 50 is a general-purpose computing device. Components of electronic device 50 may include, but are not limited to, one or more processors or processing units 501, system memory 502, and a bus 503 connecting various system components (including system memory 502 and processing unit 501).

[0157] Bus 503 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor, or a local bus using any of a variety of bus architectures. Examples of these architectures include, but are not limited to, the Industry Standard Architecture (ISA) bus, the Micro Channel Architecture (MAC) bus, the Enhanced ISA bus, the Video Electronics Standards Association (VESA) local bus, and the Peripheral Component Interconnect (PCI) bus.

[0158] The electronic device 50 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by the electronic device 50, including volatile and non-volatile media, removable and non-removable media.

[0159] System memory 502 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 504 and / or cache memory 505. Electronic device 50 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, storage system 506 may be used to read and write non-removable, non-volatile magnetic media ( Figure 3 Not shown, usually called a "hard drive"). Although Figure 3 Although not shown, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk"), as well as an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to bus 503 via one or more data media interfaces. Memory 502 may include at least one program product having a set (e.g., at least one) of program modules configured to perform the functions of various embodiments of the present invention.

[0160] A program / utility 508 having a set (at least one) of program modules 507 may be stored, for example, in memory 502. Such program modules 507 include, but are not limited to, an operating system, one or more application programs, other program modules, and program data, each of which, or some combination thereof, may include an implementation of a network environment. Program modules 507 generally implement the functions and / or methodologies of the embodiments described herein.

[0161] The electronic device 50 may also communicate with one or more external devices 509 (e.g., keyboard, pointing device, display 510, etc.), and may also communicate with one or more devices that enable a user to interact with the electronic device 50, and / or any device that enables the electronic device 50 to communicate with one or more other computing devices (e.g., network card, modem, etc.). Such communication may be performed through an input / output (I / O) interface 511. Furthermore, the electronic device 50 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) through a network adapter 512. As shown, the network adapter 512 communicates with other modules of the electronic device 50 via the bus 503. It should be understood that although Figure 3 Not shown, other hardware and / or software modules may be used in conjunction with the electronic device 50, including but not limited to microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0162] The processing unit 501 executes various functional applications and data processing by running the programs stored in the system memory 502, such as implementing the data security management method based on natural language conversion technology provided by an embodiment of the present invention.

[0163] In another embodiment of the present invention, Figure 4 As shown, a storage medium 400 including a computer program 411 is further provided. When executed by a computer processor, the computer program 411 is used to perform a data security management method based on natural language conversion technology. The method includes: using a preset model, the preset model is used to convert natural language into SQL statements, and converting approved target data request information into SQL statements, including:

[0164] Extract features from the approved target data request information using a feature extraction algorithm in a preset model to obtain natural language features, where the natural language features include contextual features, semantic features, and grammatical features;

[0165] Generate an SQL statement corresponding to the target data request information by using an SQL statement generation algorithm in the preset model according to the context feature, the semantic feature, and the grammatical feature;

[0166] Querying the database for the data to be processed corresponding to the target data request information according to the SQL statement, and exporting the data to be processed to the data security management and control platform;

[0167] Classify and grade the data to be processed using a preset classification and grading model to obtain a sensitivity level of the data to be processed;

[0168] The target protection strategy for the data to be processed is determined based on the sensitivity level and the preset multi-level data protection strategy, and the data to be processed is securely protected according to the target protection strategy through the data security management and control platform.

[0169] The computer storage media of the embodiments of the present invention may employ any combination of one or more computer-readable media. The computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: an electrical connection having one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In this document, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0170] A computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0171] Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0172] Computer program code for performing the operations of embodiments of the present invention may be written in one or more programming languages, or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0173] The above disclosure is merely a preferred embodiment of the present invention and certainly cannot be used to limit the scope of the present invention. Therefore, equivalent changes made according to the claims of the present invention are still within the scope of the present invention.

Claims

1. A data security management method based on natural language conversion technology, characterized in that: include: When there is a data request information for data query and / or data reading, obtaining the identity information of the user who initiated the data request information and the required data content of the data required by the data request information; Determine the queryable data content corresponding to the identity identification information based on the identity identification information and the preset permission information; If the queryable data content matches the required data content, the data request information is used as the approved target data request information; If the queryable data content does not match the required data content, generating an approval request based on the identity identification information and the required data content, sending the approval request to a preset client, and obtaining feedback information on the approval request through the preset client; When the feedback information is used to indicate that the approval request is passed, the data request information is used as the target data request information that has passed the approval; The preset model is used to convert natural language into SQL statements, and the approved target data request information into SQL statements, including: Extract features from the approved target data request information using a feature extraction algorithm in a preset model to obtain natural language features, where the natural language features include contextual features, semantic features, and grammatical features; Integrate the computing power resources of each computing device in the computing system where the preset model is located to obtain a computing power resource pool; When obtaining a training task for training the preset model, a target time period is selected based on the change data of the idle resource data in the computing resource pool and the working law of the preset model. During the target time period, the preset model is trained using the data set based on the idle computing power of the computing resource pool to complete the training task; generating an SQL statement corresponding to the target data request information using an SQL statement generation algorithm in the preset model according to the contextual features, the semantic features, and the grammatical features, and performing a syntax check, a security check, and a performance check on the generated SQL statement corresponding to the target data request information; When the preset model is a T5 model, the synthesized data is combined with the original annotated data to perform supervised training on the T5 model. Specifically, the original annotated data is combined and parsed to obtain labeled data, where the labeled data refers to a <natural language description, executable SQL script> data pair. Based on the original annotated data, the synthesized data is generated using data generation techniques, including but not limited to synonym replacement, vocabulary replacement, vocabulary insertion / deletion, grammar transformation, SQL statement reconstruction, adding / deleting conditions, rewriting SQL statements, hybrid generation, template filling, and rule-driven generation; Querying the database for data to be processed corresponding to the target data request information according to the SQL statement, and exporting the data to be processed to the data security management and control platform; when exporting the data to be processed to the data security management and control platform, encrypting the data to be processed and then storing it in the data security management and control platform; Classify and grade the data to be processed using a preset classification and grading model to obtain a sensitivity level of the data to be processed; The step of classifying and grading the data to be processed by using a preset classification and grading model to obtain the sensitivity level of the data to be processed includes: For unstructured data flow scenarios, the NLP-based classification and grading model is used as the preset classification and grading model, and the unsupervised learning algorithm in the NLP-based classification and grading model is used to extract labels from the data to be processed to obtain data labels for the data to be processed; Identify and determine the data labels of the data to be processed using a supervised learning algorithm in an NLP-based classification and grading model to obtain a sensitivity level of the data to be processed; Determine the target protection strategy for the data to be processed according to the sensitivity level and the preset multi-level data protection strategy, and perform security protection on the data to be processed according to the target protection strategy through the data security management and control platform; When data in the database is read and / or queried, log information of each management system corresponding to the database is obtained; Performing audit processing on actions corresponding to the log information according to the log information includes: Matching the preset rules with the content data of the log information to determine whether the content data complies with the preset rules, thereby completing audit processing of the action corresponding to the log information; And / or, according to the association of documents or users, log information of different management systems is analyzed in association to complete the audit processing of actions corresponding to the log information; The audit includes but is not limited to: operation log audit, exception audit and bypass audit plan; When a data download instruction for downloading the data to be processed is obtained, approving the data to be processed based on a preset approval matrix; If approved, the data to be processed after security protection is completed will be downloaded in response to the data download instruction; If the approval is not passed, the system stops responding to the data download instruction.

2. The data security management method based on natural language conversion technology according to claim 1 is characterized in that: The method further comprises: Building a data set based on the target data request information and an SQL statement corresponding to the target data request information; Based on the computing power resource pool, the preset model is trained using the data set.

3. The data security management method based on natural language conversion technology according to claim 1 is characterized in that: The step of determining a target protection strategy for the data to be processed according to the sensitivity level and the preset multi-level data protection strategy, and performing security protection on the data to be processed according to the target protection strategy through the data security management and control platform includes: Determining a target protection strategy for the data to be processed based on the sensitivity level and the preset multi-level data protection strategy; Performing data protection processing on the data to be processed according to the target protection strategy through the data security management and control platform to complete security protection of the data to be processed, including: Setting a functional component bound to the data to be processed according to the target protection strategy through the data security management and control platform to perform data protection processing on the data to be processed, wherein the functional component is used to control the number of views and / or the browsing duration of the data to be processed; and / or, obtaining operation information performed on the data to be processed, and generating watermark information based on the operation information and the identity identification information of the user who initiated the data request information, and setting a dark watermark for the data to be processed based on the watermark information according to the target protection strategy through the data security management and control platform, so as to complete setting a watermark for the data to be processed; and / or, identifying data to be encrypted within the data to be processed, and encrypting the data to be encrypted within the data to be processed according to the target protection policy settings through the data security management and control platform, so as to complete encryption processing of the data to be processed; and / or, identifying sensitive data in the data to be processed, and performing synonymous replacement / masking on the sensitive data in the data to be processed according to the target protection policy settings through the data security management and control platform to complete desensitization processing of the data to be processed; The data protection processing includes at least one of data desensitization processing, data encryption processing, setting the number of browsing times and / or browsing time for the data to be processed, and setting a watermark for the data to be processed.

4. A storage medium containing computer-executable instructions, characterized in that: When executed by a computer processor, the computer executable instructions are used to execute the data security management method based on natural language conversion technology as described in any one of claims 1 to 3.

Images