A computer data hierarchical protection method and dynamic protection system

Abstract

The present invention belongs to the technical field of computer data protection, and specifically relates to a hierarchical computer data protection method and dynamic protection system. This invention implements dynamic adjustment of data protection levels by grading and scoring the data to be protected and combining it with the dynamic risks of the computer network environment. It also ensures the pertinence and effectiveness of data protection by identifying sensitive information in the data to be protected and performing more detailed data grading based on semantic risk values. It also comprehensively considers multiple risk parameters of the computer network environment and calculates dynamic risk scores to reflect the security status of the network environment in real time. It intelligently adjusts the data protection level based on the grading and dynamic risk scores, achieving dynamic optimization of the data protection strategy. Furthermore, by integrating the operator's historical behavior records with the current session context, it enables refined management of access rights, further enhancing the security of data access.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer data protection, and in particular relates to a computer data hierarchical protection method and a dynamic protection system. Background Art

[0002] With the continuous development of information technology, the amount of data in computer networks has increased dramatically, and data security has become an urgent problem that needs to be solved. The data protection method has gradually shifted from static, fixed protection strategies to dynamic, adaptive protection strategies. Dynamic protection strategies can flexibly adjust the protection level and access rights of data according to the importance and sensitivity of the data and the real-time security status of the network environment. This can not only improve the pertinence and effectiveness of data protection, but also better adapt to the ever-changing network environment and security threats.

[0003] In the prior art, although there are some strategies for dynamic protection of computer data, there are often problems such as insufficient fine-grained division of protection levels, insufficient response to environmental changes, or insufficient flexibility in the authority management of operators. For example, some dynamic protection strategies may only divide protection levels based on the basic attributes of the data (such as data type, source, etc.), but ignore the differences in sensitivity and importance of data in actual application scenarios, resulting in the protection level division being too general and unable to meet the need to provide differentiated protection for data of different levels. This will undoubtedly limit the effectiveness of data protection and fail to fully meet actual security needs. Based on this, the present invention proposes a computer data hierarchical protection method to solve the above problems. Summary of the Invention

[0004] The purpose of the present invention is to provide a computer data hierarchical protection method and dynamic protection system, which can perform refined protection level division according to the actual sensitivity and importance of the data, and at the same time dynamically adjust the protection level and access rights of the data in combination with the real-time security status of the network environment to improve the pertinence and effectiveness of data protection.

[0005] The technical solutions adopted by the present invention are as follows:

[0006] A hierarchical protection method for computer data, comprising:

[0007] Collect the structured features and unstructured semantic content of the data to be protected, as well as the security status information of the current computer network environment;

[0008] Based on the structured features and unstructured semantic content, the data to be protected is evaluated hierarchically to generate the initial protection level of the data to be protected;

[0009] Quantify the security status information and record it as environmental risk parameters, and then determine the dynamic risk score of the computer network environment based on the environmental risk parameters;

[0010] The initial protection level is compensated and corrected according to the dynamic risk score value, and the corrected initial protection level is output as the data protection level of the data to be protected;

[0011] The operator's historical operation behavior records are integrated with the current session context to adjust the operator's access rights and determine the scope of data the operator is allowed to access based on the access rights and data protection level.

[0012] In a preferred embodiment, when collecting the structured features and unstructured semantic content of the data to be protected, the structured features are extracted from database fields, file metadata, and network protocol messages based on predefined data format rules. The structured features include data classification labels, encryption status identifiers, and access control policy version information. The unstructured text content is parsed through semantic analysis to generate a multi-dimensional feature description including entity recognition results, semantic sensitivity classification, and contextual association relationships.

[0013] When collecting security status information of the current computer network environment, deploy an environment-aware probe cluster to capture network traffic, abnormal login behavior, and external attack events in real time.

[0014] In a preferred embodiment, the step of performing a hierarchical assessment of the data to be protected based on the structured features and the unstructured semantic content to generate an initial protection level for the data to be protected includes:

[0015] Obtain the encryption level of the data to be protected, compare the encryption level with the preset basic security score table, and output it as the basic score of the data to be protected;

[0016] Collect sensitive information from the data to be protected and calculate the semantic risk value based on the frequency of occurrence and contextual relevance of the sensitive information;

[0017] Normalize the basic score and semantic risk value, and then perform weighted fusion on the normalized basic score and semantic risk value to obtain the hierarchical score of the data to be protected;

[0018] Compare the grading scores with the preset initial level determination table to match the initial protection level of the data to be protected.

[0019] In a preferred embodiment, the step of collecting sensitive information from the data to be protected and calculating the semantic risk value based on the frequency of occurrence and contextual relevance of the sensitive information includes:

[0020] Obtain the frequency of occurrence of sensitive information and record it as the first characteristic parameter;

[0021] Predefine a contextual keyword library related to sensitive information, perform semantic matching on the data to be protected based on the contextual keyword library, determine the semantic relevance between the keyword and the sensitive information, and record it as a second feature parameter;

[0022] Performing a product operation on the first characteristic parameter and the second characteristic parameter to obtain a comprehensive risk coefficient of the sensitive information;

[0023] The comprehensive risk coefficients of multiple sensitive information are accumulated to obtain the semantic risk value of the data to be protected.

[0024] In a preferred embodiment, the steps of quantifying the security status information and recording it as environmental risk parameters, and then determining the dynamic risk score of the computer network environment based on the environmental risk parameters, include:

[0025] Collect network traffic anomaly rates, abnormal login behavior frequencies, and the number of external attack events, and record them as independent environmental risk parameters;

[0026] Assign different basic weights to each environmental risk parameter;

[0027] The change gradient of the network traffic anomaly rate is calculated through a sliding time window. When the change gradient of the network traffic anomaly rate exceeds the preset control threshold, a correction factor is introduced to dynamically control the basic weight of the network traffic anomaly rate.

[0028] Dynamically adjust the basic weight of abnormal login behavior frequency through the preset weight adjustment mapping table;

[0029] Dynamically adjust the basic weight of the number of external attack events through the attack interval of external attack events;

[0030] The basic weights of network traffic anomaly rate, abnormal login behavior frequency, and external attack event number after dynamic adjustment are normalized to obtain the dynamic weights of each environmental risk parameter;

[0031] Multiply each environmental risk parameter with its corresponding dynamic weight to obtain a weighted environmental risk parameter value;

[0032] The weighted environmental risk parameter values are accumulated to obtain a dynamic risk score value of the computer network environment, wherein the larger the dynamic risk score value, the higher the security risk of the computer network environment.

[0033] In a preferred solution, the step of compensating and correcting the initial protection level according to the dynamic risk score value and outputting the corrected initial protection level as the data protection level of the data to be protected includes:

[0034] Obtaining a dynamic risk score value and comparing the dynamic risk score value with a preset critical threshold;

[0035] When the dynamic risk score is lower than the critical threshold, the compensation coefficient of the initial protection level is calculated according to the benchmark model;

[0036] When the dynamic risk score value is higher than or equal to the critical threshold, the compensation coefficient of the initial protection level is calculated using the accelerated mode;

[0037] The compensation coefficient is multiplied by the grading score corresponding to the initial protection level to obtain the corrected initial protection level, which is recorded as the data protection level of the data to be protected.

[0038] In a preferred solution, the step of fusing the operator's historical operation behavior records with the current session context and adjusting the operator's access rights includes:

[0039] Obtain the operator's historical operation behavior records, and extract the permission usage compliance rate and abnormal operation frequency from the historical operation behavior records;

[0040] Calculate the operator's historical behavior credibility score based on the permission usage compliance rate and abnormal operation frequency;

[0041] Obtain the current session context parameters and determine whether there are sensitive operations or cross-level access requests in the current session context parameters;

[0042] If there are sensitive operations or cross-level access requests in the current session context parameters, the frequency of sensitive operations and cross-level access requests is counted and recorded as the current behavior feature parameters. Otherwise, the current behavior feature parameters are set to zero.

[0043] Perform weighted fusion of historical behavior credibility scores and current behavior characteristic parameters to output a dynamic trust level;

[0044] When the dynamic trust level is lower than the preset trust threshold, the operator's access rights are restricted, allowing only low-risk operations or access to low-sensitivity data;

[0045] When the dynamic trust level is higher than or equal to the preset trust threshold, the operator's current access rights remain unchanged.

[0046] In a preferred embodiment, the step of determining the scope of data that the operator is allowed to access based on the access rights and the data protection level includes:

[0047] Establish a multi-level data set based on the data protection level of the data to be protected, each data set contains data resources of the corresponding data protection level;

[0048] Obtain the operator's access rights and compare them with the access rights of each data set in the multi-level data set to match the data set to which the operator has access rights;

[0049] Data resources related to the operator's current task are filtered out from the matched data set to form the data range allowed to be accessed.

[0050] The present invention also provides a computer data dynamic protection system applicable to the above-mentioned computer data hierarchical protection method, comprising:

[0051] Data collection module, used to collect security status information of the data to be protected and the computer network environment;

[0052] Sensitive information identification module, used to identify sensitive information from the data to be protected and calculate the semantic risk value based on the frequency of occurrence and contextual relevance of the sensitive information;

[0053] The risk score calculation module is used to perform a basic score on the protected data and obtain a hierarchical score based on the semantic risk value. At the same time, the security status information is quantified to obtain environmental risk parameters, and the dynamic risk score value of the computer network environment is determined based on the environmental risk parameters.

[0054] The level determination module is used to compare the hierarchical score with the preset initial level determination table to match the initial protection level of the data to be protected, and to compensate and correct the initial protection level based on the dynamic risk score value to obtain the corrected data protection level;

[0055] The rights management module is used to integrate the operator's historical operation behavior records with the current session context, adjust the operator's access rights, and determine the scope of data the operator is allowed to access based on the access rights and data protection level;

[0056] The security protection execution module is used to intercept or release the operator's access request based on the data range allowed to be accessed.

[0057] And, an electronic device, comprising:

[0058] at least one processor;

[0059] and a memory communicatively coupled to the at least one processor;

[0060] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the above-mentioned computer data hierarchical protection method.

[0061] The technical effects achieved by the present invention are:

[0062] The present invention implements dynamic adjustment of data protection levels by grading and scoring the data to be protected and combining it with the dynamic risks of the computer network environment. This not only improves the flexibility and accuracy of data protection, but also effectively responds to complex and changeable network environment threats. By identifying sensitive information in the data to be protected and performing more detailed data grading in combination with semantic risk values, the pertinence and effectiveness of data protection are ensured. At the same time, multiple risk parameters of the computer network environment are comprehensively considered. Through the calculation of dynamic risk scoring values, the security status of the network environment is reflected in real time. According to the graded scoring and dynamic risk scoring values, the data protection level is intelligently adjusted to achieve dynamic optimization of the data protection strategy. In addition, by integrating the operator's historical behavior records and the current session context, fine management of access rights is achieved, further enhancing the security of data access. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 It is a schematic flow chart of the method of the present invention;

[0064] Figure 2 It is a schematic diagram of the system modules of the present invention;

[0065] Figure 3 It is a schematic structural diagram of an electronic device of the present invention. DETAILED DESCRIPTION

[0066] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0067] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0068] Secondly, the term "one embodiment" or "embodiment" herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in a preferred embodiment" appearing in various places throughout this specification does not necessarily refer to the same embodiment, nor does it constitute a separate or selective embodiment that is mutually exclusive of other embodiments.

[0069] See also Figure 1 As shown, the present invention provides a computer data hierarchical protection method, comprising:

[0070] S1. Collect the structured features and unstructured semantic content of the data to be protected, as well as the security status information of the current computer network environment;

[0071] In step S1, with the rapid development of information technology, data security issues in computer networks are becoming increasingly prominent. To ensure data security, in this embodiment, when collecting data to be protected, not only are the structured features and unstructured semantic content of the data to be protected comprehensively collected, but also the security status information of the current computer network environment is collected to ensure the comprehensiveness and accuracy of the data. Specifically, when collecting the structured features and unstructured semantic content of the data to be protected, based on predefined data format rules, structured features are extracted from database fields, file metadata, and network protocol messages. The structured features include data classification labels, encryption status identifiers, and access control policy version information. The unstructured text content is parsed through semantic analysis to generate a multi-dimensional feature description including entity recognition results, semantic sensitivity classification, and contextual association relationships.

[0072] When collecting security status information of the current computer network environment, deploy an environment-aware probe cluster to capture network traffic, abnormal login behavior, and external attack events in real time;

[0073] Specifically, in the process of collecting the structured features and unstructured semantic content of the data to be protected, we first extract structured feature information from the field information of the database, the metadata of the file, and the message content of the network protocol according to the pre-defined data format rules. The structured features not only cover the classification labels of the data to facilitate subsequent data management and classification processing, but also include the identifier of the encryption status to identify whether the data has been encrypted, and the version information of the access control policy to ensure that the access control policy of the data is the latest and effective. At the same time, the unstructured text content is parsed through advanced semantic analysis technology to generate a multi-dimensional feature description. The description not only includes the results of entity recognition, which helps identify key entity information in the text so as to evaluate the sensitivity of the text content, but also includes contextual associations to ensure that the context of the text can be taken into account when understanding the text content. In terms of collecting security status information of the current computer network environment, by deploying a cluster of environment-aware probes, all-round monitoring of the network environment can be achieved. The probes can capture traffic data in the network in real time, monitor whether there are abnormal login behaviors, and promptly detect and record external attack events. In this way, the security status of the network environment can be grasped, potential security threats can be discovered in a timely manner, and data support can be provided for subsequent security protection measures.

[0074] S2. Based on the structured features and unstructured semantic content, perform a hierarchical assessment of the data to be protected and generate an initial protection level for the data to be protected;

[0075] In step S2, after the structured features and unstructured semantic content are collected, a hierarchical assessment is performed on the data to be protected based on the collected structured features and unstructured semantic content, and an initial protection level of the data to be protected is generated, providing a basis for subsequent processing. The step of performing a hierarchical assessment on the data to be protected based on the structured features and unstructured semantic content and generating an initial protection level of the data to be protected includes:

[0076] Obtain the encryption level of the data to be protected, compare the encryption level with the preset basic security score table, and output it as the basic score of the data to be protected;

[0077] Collect sensitive information from the data to be protected and calculate the semantic risk value based on the frequency of occurrence and contextual relevance of the sensitive information;

[0078] Normalize the basic score and semantic risk value, and then perform weighted fusion on the normalized basic score and semantic risk value to obtain the hierarchical score of the data to be protected;

[0079] Compare the grading scores with the preset initial level determination table to match the initial protection level of the data to be protected;

[0080] Specifically, when performing a hierarchical assessment of the data to be protected based on its structured features and unstructured semantic content, the current encryption level information of the data to be protected will be obtained first, and this encryption level will be compared with the pre-set basic security score table. Through this comparison process, the basic score of the data to be protected can be output. Then, the sensitive information in the data to be protected will be collected. Not only will the sensitive information itself be focused on, but also the corresponding semantic risk value will be comprehensively calculated based on the frequency of occurrence of the sensitive information and its relevance in the context. This aims to more accurately assess the risk level of the data from a semantic level. In order to ensure the assessment To ensure the fairness and comparability of the results, the basic score and semantic risk value will be normalized to eliminate the influence of different dimensions. The normalization method can be to map the basic score and semantic risk value to the same score range respectively, or it can be achieved through other standardized processing methods, which are not explicitly restricted here. In addition, after the normalization process is completed, the normalized basic score and semantic risk value will be weighted and fused according to the preset weights to finally obtain a comprehensive grading score for the data to be protected. Finally, the grading score will be compared with the preset initial level determination table, and the initial protection level of the data to be protected will be determined through the matching process.

[0081] Secondly, the steps of collecting sensitive information from the data to be protected and calculating the semantic risk value based on the frequency of occurrence and contextual relevance of the sensitive information include:

[0082] Obtain the frequency of occurrence of sensitive information and record it as the first characteristic parameter;

[0083] Predefine a contextual keyword library related to sensitive information, perform semantic matching on the data to be protected based on the contextual keyword library, determine the semantic relevance between the keyword and the sensitive information, and record it as a second feature parameter;

[0084] Performing a product operation on the first characteristic parameter and the second characteristic parameter to obtain a comprehensive risk coefficient of the sensitive information;

[0085] Accumulate the comprehensive risk coefficients of multiple sensitive information to obtain the semantic risk value of the data to be protected;

[0086] In this embodiment, when calculating the semantic risk value, the data to be protected is first scanned comprehensively to identify and extract the sensitive information therein. The frequency of occurrence of the sensitive information is then counted and the frequency of occurrence data of the sensitive information is recorded as the first characteristic parameter as one of the basic indicators for subsequent risk assessment. Then, based on a pre-defined contextual keyword library closely related to the sensitive information, a corresponding semantic matching analysis is performed on the data to be protected, aiming to determine the semantic relevance between each keyword and the sensitive information, and the semantic relevance is recorded as the second characteristic parameter. The calculation formula for the second characteristic parameter of the semantic relevance is: Where s j Indicates the semantic relevance of the jth sensitive information, Match(k i ,S,C) represents keyword k i The number of co-occurrences with sensitive information S in context C, Count(C) represents the total number of keywords in the context, and C represents the contextual content of the data to be protected. The first feature parameter is then multiplied by the second feature parameter to obtain the comprehensive risk coefficient of each sensitive information. Finally, the comprehensive risk coefficients of all sensitive information are accumulated to obtain the overall semantic risk value of the data to be protected.

[0087] S3. Quantify the security status information and record it as environmental risk parameters, and then determine the dynamic risk score value of the computer network environment based on the environmental risk parameters;

[0088] In step S3, after the security status information of the computer network environment is collected, the collected security status information is quantified and converted into specific environmental risk parameters. A dynamic risk score value of the computer network environment is determined based on the environmental risk parameters to more accurately reflect the security status of the current network environment. The steps of quantifying the security status information, recording it as environmental risk parameters, and then determining the dynamic risk score value of the computer network environment based on the environmental risk parameters include:

[0089] Collect network traffic anomaly rates, abnormal login behavior frequencies, and the number of external attack events, and record them as independent environmental risk parameters;

[0090] Assign different basic weights to each environmental risk parameter;

[0091] The change gradient of the network traffic anomaly rate is calculated through a sliding time window. When the change gradient of the network traffic anomaly rate exceeds the preset control threshold, a correction factor is introduced to dynamically control the basic weight of the network traffic anomaly rate.

[0092] Dynamically adjust the basic weight of abnormal login behavior frequency through the preset weight adjustment mapping table;

[0093] Dynamically adjust the basic weight of the number of external attack events through the attack interval of external attack events;

[0094] The basic weights of network traffic anomaly rate, abnormal login behavior frequency, and external attack event number after dynamic adjustment are normalized to obtain the dynamic weights of each environmental risk parameter;

[0095] Multiply each environmental risk parameter with its corresponding dynamic weight to obtain a weighted environmental risk parameter value;

[0096] The weighted environmental risk parameter values are accumulated to obtain a dynamic risk score value of the computer network environment, wherein the larger the dynamic risk score value, the higher the security risk of the computer network environment;

[0097] Specifically, we first need to collect the network traffic anomaly rate, the frequency of abnormal login behavior, and the number of external attack events, and record them as independent and meaningful environmental risk parameters. Secondly, we will assign different basic weights to each environmental risk parameter to ensure that the importance of each parameter in the risk assessment is reasonably reflected. Then, by setting a sliding time window, we calculate the change gradient of the network traffic anomaly rate ( Where, ΔR t Represents the gradient of network traffic anomaly rate, R t Indicates the traffic anomaly rate of the current time window, R t-Δt represents the traffic anomaly rate of the previous time window adjacent to the current time window, and Δt represents the time window length). When the change gradient of the network traffic anomaly rate exceeds the preset control threshold, a correction factor will be introduced to dynamically control the basic weight of the network traffic anomaly rate (α′=α0·(1+κ·ΔR t), where α′ represents the dynamic weight after dynamic regulation of the network traffic anomaly rate, α0 represents the basic weight of the network traffic anomaly rate, and κ represents the correction factor, which is a preset constant and generally takes 0.1 to 0.3) to adapt to actual risk changes. In addition, for the weight adjustment process of abnormal login frequency, the preset weight regulation mapping table is used to dynamically adjust the basic weight of the abnormal login behavior frequency to ensure that the weight matches the actual risk situation. When determining the weight of the number of external attack events, the basic weight of the number of external attack events is dynamically regulated according to the attack interval time of the external attack event ( In the formula, χ′ represents the dynamic weight of the number of external attack events after dynamic regulation, χ0 represents the basic weight of the number of external attack events, a represents the time attenuation coefficient, and τ represents the attack interval of the external attack event) to reflect the impact of attack frequency on risk. Then, the basic weights of the network traffic anomaly rate, abnormal login behavior frequency, and external attack event number after dynamic regulation are normalized to obtain the dynamic weights of each environmental risk parameter to ensure the rationality and comparability of the weight values. Finally, each environmental risk parameter is multiplied with its corresponding dynamic weight to obtain the weighted environmental risk parameter value. The weighted environmental risk parameter values are then accumulated to output the dynamic risk score value of the computer network environment.

[0098] S4. Compensate and correct the initial protection level based on the dynamic risk score, and output the corrected initial protection level as the data protection level of the data to be protected;

[0099] In step S4, after the dynamic risk score value is output, the initial protection level can be compensated and corrected based on the dynamic risk score value to ensure the dynamic and adaptable nature of the protection level, and the corrected initial protection level is output as the data protection level of the data to be protected. The step of compensating and correcting the initial protection level based on the dynamic risk score value and outputting the corrected initial protection level as the data protection level of the data to be protected includes:

[0100] Obtaining a dynamic risk score value and comparing the dynamic risk score value with a preset critical threshold;

[0101] When the dynamic risk score is lower than the critical threshold, the compensation coefficient of the initial protection level is calculated according to the benchmark model;

[0102] When the dynamic risk score value is higher than or equal to the critical threshold, the compensation coefficient of the initial protection level is calculated using the accelerated mode;

[0103] Multiply the compensation coefficient by the graded score corresponding to the initial protection level to obtain a revised initial protection level, and record it as the data protection level of the data to be protected;

[0104] Specifically, when compensating and correcting the initial protection level based on the dynamic risk score, the current dynamic risk score is first obtained and compared with the pre-set critical threshold. When the dynamic risk score is lower than the critical threshold, the compensation coefficient of the initial protection level is calculated according to the pre-set benchmark mode to ensure the rationality and gradualness of the compensation coefficient. When the dynamic risk score is higher than or equal to the critical threshold, the compensation coefficient of the initial protection level is calculated in an accelerated mode, using an accelerated growth method to determine the compensation coefficient of the initial protection level to cope with higher risk levels. The compensation coefficient is determined as follows:

[0105]

[0106] In the formula, c′ represents the compensation coefficient of the initial protection level, c0 represents the baseline compensation coefficient, f represents the dynamic risk score value, and f max represents the upper limit of compensation, f y represents the upper limit of the dynamic risk score value, r0 represents the power law growth factor, and r′ represents the exponential growth factor. Through segmented calculation, it ensures that the compensation coefficient can be flexibly adjusted according to the changes in the dynamic risk score value;

[0107] The calculated compensation coefficient is then accurately multiplied by the grading score corresponding to the initial protection level to obtain the revised initial protection level. Finally, the revised initial protection level is formally recorded and output as the data protection level of the data to be protected, so that subsequent data protection measures can be effectively implemented and adjusted accordingly.

[0108] S5. Integrate the operator's historical operation behavior records with the current session context, adjust the operator's access rights, and determine the scope of data the operator is allowed to access based on the access rights and data protection level;

[0109] In step S5, after determining the data protection level of the data to be protected, the operator's historical operation behavior records and the current session context are further integrated to dynamically adjust the operator's access rights. Based on the access rights and the data protection level, the scope of data that the operator is allowed to access is accurately determined, thereby achieving refined management and protection of data. The step of integrating the operator's historical operation behavior records with the current session context to adjust the operator's access rights includes:

[0110] Obtain the operator's historical operation behavior records, and extract the permission usage compliance rate and abnormal operation frequency from the historical operation behavior records;

[0111] Calculate the operator's historical behavior credibility score based on the permission usage compliance rate and abnormal operation frequency;

[0112] Obtain the current session context parameters and determine whether there are sensitive operations or cross-level access requests in the current session context parameters;

[0113] If there are sensitive operations or cross-level access requests in the current session context parameters, the frequency of sensitive operations and cross-level access requests is counted and recorded as the current behavior feature parameters. Otherwise, the current behavior feature parameters are set to zero.

[0114] Perform weighted fusion of historical behavior credibility scores and current behavior characteristic parameters to output a dynamic trust level;

[0115] When the dynamic trust level is lower than the preset trust threshold, the operator's access rights are restricted, allowing only low-risk operations or access to low-sensitivity data;

[0116] When the dynamic trust level is higher than or equal to the preset trust threshold, the operator's current access rights remain unchanged;

[0117] Specifically, when determining the access rights of an operator, it is first necessary to obtain the operator's historical operation behavior records. The historical operation behavior records record all the operation behaviors of the operator in the previous use process, and then determine the permission use compliance rate and abnormal operation frequency based on the historical operation behavior records. The permission use compliance rate reflects the degree to which the operator complies with the permission regulations in previous operations, which is generally the proportion of the number of compliant operations in the total number of operations, while the abnormal operation frequency reveals the proportion of the number of abnormal operations performed by the operator in the total number of operations in the past. Based on this, the permission use compliance rate and the abnormal operation frequency are weighted summed to calculate the operator's historical behavior credibility score, so as to provide a basis for subsequent permission adjustments. Subsequently, it is necessary to obtain the context parameters of the current session to determine whether there are sensitive operations or cross-level access requests in the current session. If such operations or requests exist, their frequency of occurrence will be counted and recorded as the current behavior characteristics. Characteristic parameters. On the contrary, if no sensitive operation or cross-level access request is found in the current session, the current behavior characteristic parameters are set to zero, and then the historical behavior credibility score is weighted and fused with the current behavior characteristic parameters to obtain a comprehensive score. The comprehensive score is then compared with the preset trust level assessment table to output the operator's dynamic trust level. Finally, the dynamic trust level is compared with the preset trust threshold to decide whether to adjust the operator's access rights. When the dynamic trust level is lower than the preset trust threshold, the operator's access rights will be restricted, and only low-risk operations or low-sensitive data will be allowed to be performed to reduce potential security risks. In actual applications, the operator's access rights can also be reduced step by step until their historical behavior credibility score and current behavior characteristic parameters meet the security standards. When the dynamic trust level is higher than or equal to the preset trust threshold, the operator's current access rights remain unchanged to ensure that they can perform various tasks normally.

[0118] In a preferred embodiment, the step of determining the scope of data that the operator is allowed to access based on the access rights and the data protection level includes:

[0119] Establish a multi-level data set based on the data protection level of the data to be protected, each data set contains data resources of the corresponding data protection level;

[0120] Obtain the operator's access rights and compare them with the access rights of each data set in the multi-level data set to match the data set to which the operator has access rights;

[0121] Filtering data resources related to the operator's current task from the matched data set to form the data range allowed for access;

[0122] Specifically, when determining the data scope that the operator is allowed to access, first, a multi-level data set is constructed based on the specific data protection level of the data to be protected, where each data set contains data resources within the corresponding data protection level, ensuring that the data is orderly classified and stored according to the protection level. Then, based on the operator's specific access rights, the access rights set for each data set in the multi-level data set are compared one by one, so as to match the data set that the operator actually has access rights. Finally, based on the matched data set, the data resources directly related to the operator's current task are further screened out, and finally the specific data scope that the operator is allowed to access is formed to ensure the legality and security of data access.

[0123] See also Figure 2 A computer data dynamic protection system, applicable to the above-mentioned computer data hierarchical protection method, comprises:

[0124] Data collection module, used to collect security status information of the data to be protected and the computer network environment;

[0125] Sensitive information identification module, used to identify sensitive information from the data to be protected and calculate the semantic risk value based on the frequency of occurrence and contextual relevance of the sensitive information;

[0126] The risk score calculation module is used to perform a basic score on the protected data and obtain a hierarchical score based on the semantic risk value. At the same time, the security status information is quantified to obtain environmental risk parameters, and the dynamic risk score value of the computer network environment is determined based on the environmental risk parameters.

[0127] The level determination module is used to compare the hierarchical score with the preset initial level determination table to match the initial protection level of the data to be protected, and to compensate and correct the initial protection level based on the dynamic risk score value to obtain the corrected data protection level;

[0128] The rights management module is used to integrate the operator's historical operation behavior records with the current session context, adjust the operator's access rights, and determine the scope of data the operator is allowed to access based on the access rights and data protection level;

[0129] The security protection execution module is used to intercept or release the operator's access request based on the data range allowed to be accessed.

[0130] Among the above, the main function of the data acquisition module is to comprehensively collect the data to be protected, and at the same time collect the security status information of the computer network environment to ensure the integrity of the data and real-time monitoring of the environment. The core task of the sensitive information identification module is to deeply analyze the data to be protected, identify the sensitive information therein, and calculate the semantic risk value reflecting the potential risk of the data based on the frequency of occurrence of sensitive information and its relevance in the context. The risk score calculation module first performs a basic score on the data to be protected, and then combines the semantic risk value calculated previously to comprehensively derive a comprehensive hierarchical score. In addition, it also quantifies the security status information, generates environmental risk parameters, and determines the dynamic risk score value of the computer network environment based on the environmental risk parameters. The level determination module carefully compares the graded scores with the preset initial level determination table to accurately match the initial protection level of the data to be protected. On this basis, the initial protection level is compensated and corrected as necessary according to the dynamic risk score value to obtain a more accurate corrected data protection level. The authority management module flexibly adjusts the operator's access rights by integrating the operator's historical operation behavior records with the context information of the current session, and determines the data scope that the operator is allowed to access based on the access rights and data protection level. The function of the security protection execution module is to effectively intercept or release the operator's access request based on the determined range of allowed access data to ensure that data security is effectively protected.

[0131] See also Figure 3 , an electronic device, the electronic device comprising:

[0132] at least one processor;

[0133] and a memory communicatively coupled to the at least one processor;

[0134] The memory stores a computer program that can be executed by at least one processor, and the computer program is executed by at least one processor so that the at least one processor can execute the above-mentioned computer data hierarchical protection method.

[0135] The processor of the above-mentioned electronic device can be a device with data processing capabilities such as a central processing unit (CPU), a microprocessor (MCU), a digital signal processor (DSP) or a field programmable gate array (FPGA), and the memory can be a random access memory (RAM), a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM) or a flash memory, etc. The electronic device can also include necessary components such as an arithmetic unit, an input device, an output device, a network interface, and a power supply. The arithmetic unit is used to perform various arithmetic and logical operations to ensure the smooth execution of the computer data hierarchical protection method. The input device, such as a keyboard, a mouse or a touch screen, is used to receive instructions and input information from the operator. The output device, such as a display, a printer, etc., is used to display processing results and feedback information. The network interface is used to realize communication connection between the electronic device and other devices or networks to facilitate data transmission and sharing. The power supply provides a stable power supply for the electronic device to ensure its continuous operation.

[0136] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, apparatus, article, or method comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, apparatus, article, or method. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, apparatus, article, or method comprising the element.

[0137] The foregoing is merely a preferred embodiment of the present invention. It should be noted that those skilled in the art may make various improvements and modifications without departing from the principles of the present invention, and such improvements and modifications are also within the scope of protection of the present invention. Structures, devices, and operating methods not specifically described or explained herein shall, unless otherwise specified or limited, be implemented in accordance with conventional means in the art.

Claims

1. A computer data hierarchical protection method, characterized by: include: Collect the structured features and unstructured semantic content of the data to be protected, as well as the security status information of the current computer network environment; Based on the structured features and unstructured semantic content, the data to be protected is evaluated hierarchically to generate the initial protection level of the data to be protected; Quantify the security status information and record it as environmental risk parameters, and then determine the dynamic risk score of the computer network environment based on the environmental risk parameters; The initial protection level is compensated and corrected according to the dynamic risk score value, and the corrected initial protection level is output as the data protection level of the data to be protected; Integrate the operator's historical operation behavior records with the current session context, adjust the operator's access rights, and determine the scope of data the operator is allowed to access based on the access rights and data protection level; The step of performing a hierarchical assessment of the data to be protected based on the structured features and the unstructured semantic content to generate an initial protection level for the data to be protected includes: Obtain the encryption level of the data to be protected, compare the encryption level with the preset basic security score table, and output it as the basic score of the data to be protected; Collect sensitive information from the data to be protected and calculate the semantic risk value based on the frequency of occurrence and contextual relevance of the sensitive information; Normalize the basic score and semantic risk value, and then perform weighted fusion on the normalized basic score and semantic risk value to obtain the hierarchical score of the data to be protected; Compare the grading scores with the preset initial level determination table to match the initial protection level of the data to be protected; The step of integrating the operator's historical operation behavior records with the current session context and adjusting the operator's access rights includes: Obtain the operator's historical operation behavior records, and extract the permission usage compliance rate and abnormal operation frequency from the historical operation behavior records; Calculate the operator's historical behavior credibility score based on the permission usage compliance rate and abnormal operation frequency; Obtain the current session context parameters and determine whether there are sensitive operations or cross-level access requests in the current session context parameters; If there are sensitive operations or cross-level access requests in the current session context parameters, the frequency of sensitive operations and cross-level access requests is counted and recorded as the current behavior feature parameters. Otherwise, the current behavior feature parameters are set to zero. Perform weighted fusion of historical behavior credibility scores and current behavior characteristic parameters to output a dynamic trust level; When the dynamic trust level is lower than the preset trust threshold, the operator's access rights are restricted, allowing only low-risk operations or access to low-sensitivity data; When the dynamic trust level is higher than or equal to the preset trust threshold, the operator's current access rights remain unchanged.

2. A computer data hierarchical protection method according to claim 1, characterized in that: When collecting the structured features and unstructured semantic content of the data to be protected, the system extracts structured features from database fields, file metadata, and network protocol messages based on predefined data format rules. The structured features include data classification labels, encryption status identifiers, and access control policy version information. The unstructured text content is parsed through semantic analysis to generate a multi-dimensional feature description including entity recognition results, semantic sensitivity classification, and contextual association relationships. When collecting security status information of the current computer network environment, deploy an environment-aware probe cluster to capture network traffic, abnormal login behavior, and external attack events in real time.

3. The computer data hierarchical protection method according to claim 1, characterized in that: The step of collecting sensitive information from the data to be protected and calculating the semantic risk value based on the frequency of occurrence and contextual relevance of the sensitive information includes: Obtain the frequency of occurrence of sensitive information and record it as the first characteristic parameter; Predefine a contextual keyword library related to sensitive information, perform semantic matching on the data to be protected based on the contextual keyword library, determine the semantic relevance between the keyword and the sensitive information, and record it as a second feature parameter; Performing a product operation on the first characteristic parameter and the second characteristic parameter to obtain a comprehensive risk coefficient of the sensitive information; The comprehensive risk coefficients of multiple sensitive information are accumulated to obtain the semantic risk value of the data to be protected.

4. The computer data hierarchical protection method according to claim 1, characterized in that: The steps of quantifying the security status information and recording it as environmental risk parameters, and then determining the dynamic risk score of the computer network environment based on the environmental risk parameters, include: Collect network traffic anomaly rates, abnormal login behavior frequencies, and the number of external attack events, and record them as independent environmental risk parameters; Assign different basic weights to each environmental risk parameter; The change gradient of the network traffic anomaly rate is calculated through a sliding time window. When the change gradient of the network traffic anomaly rate exceeds the preset control threshold, a correction factor is introduced to dynamically control the basic weight of the network traffic anomaly rate. Dynamically adjust the basic weight of abnormal login behavior frequency through the preset weight adjustment mapping table; Dynamically adjust the basic weight of the number of external attack events through the attack interval of external attack events; The basic weights of network traffic anomaly rate, abnormal login behavior frequency, and external attack event number after dynamic adjustment are normalized to obtain the dynamic weights of each environmental risk parameter; Multiply each environmental risk parameter with its corresponding dynamic weight to obtain a weighted environmental risk parameter value; The weighted environmental risk parameter values are accumulated to obtain a dynamic risk score value of the computer network environment, wherein the larger the dynamic risk score value, the higher the security risk of the computer network environment.

5. A computer data hierarchical protection method according to claim 4, characterized in that: The step of compensating and correcting the initial protection level according to the dynamic risk score value, and outputting the corrected initial protection level as the data protection level of the data to be protected, includes: Obtaining a dynamic risk score value and comparing the dynamic risk score value with a preset critical threshold; When the dynamic risk score is lower than the critical threshold, the compensation coefficient of the initial protection level is calculated according to the benchmark model; When the dynamic risk score value is higher than or equal to the critical threshold, the compensation coefficient of the initial protection level is calculated using the accelerated mode; The compensation coefficient is multiplied by the grading score corresponding to the initial protection level to obtain the corrected initial protection level, which is recorded as the data protection level of the data to be protected.

6. A computer data hierarchical protection method according to claim 1, characterized in that: The step of determining the data scope that the operator is allowed to access based on the access rights and the data protection level includes: Establish a multi-level data set based on the data protection level of the data to be protected, each data set contains data resources of the corresponding data protection level; Obtain the operator's access rights and compare them with the access rights of each data set in the multi-level data set to match the data set to which the operator has access rights; Data resources related to the operator's current task are filtered out from the matched data set to form the data range allowed to be accessed.

7. A computer data dynamic protection system, characterized by: A computer data hierarchical protection method applicable to any one of claims 1 to 6, comprising: Data collection module, used to collect security status information of the data to be protected and the computer network environment; Sensitive information identification module, used to identify sensitive information from the data to be protected and calculate the semantic risk value based on the frequency of occurrence and contextual relevance of the sensitive information; The risk score calculation module is used to perform a basic score on the protected data and obtain a hierarchical score based on the semantic risk value. At the same time, the security status information is quantified to obtain environmental risk parameters, and the dynamic risk score value of the computer network environment is determined based on the environmental risk parameters. The level determination module is used to compare the hierarchical score with the preset initial level determination table to match the initial protection level of the data to be protected, and to compensate and correct the initial protection level based on the dynamic risk score value to obtain the corrected data protection level; The rights management module is used to integrate the operator's historical operation behavior records with the current session context, adjust the operator's access rights, and determine the scope of data the operator is allowed to access based on the access rights and data protection level; The security protection execution module is used to intercept or release the operator's access request based on the data range allowed to be accessed.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively coupled to the at least one processor; The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the computer data hierarchical protection method according to any one of claims 1 to 6.

Images