A multi-strategy data desensitization method

Abstract

The present invention provides a multi-strategy data desensitization method, which belongs to the field of data processing technology, and specifically includes: step 1, obtaining a file to be desensitized and selecting parameters; step 2, dynamically grading each attribute based on information entropy and k-means clustering to obtain a security level for each attribute; step 3, performing a multi-factor privacy leakage risk assessment based on the selected parameters and the security level of each attribute to obtain a privacy leakage risk coefficient; step 4, based on a hybrid execution framework of static and dynamic desensitization, desensitizing the file to be desensitized according to the privacy leakage risk coefficient to generate a desensitized file; step 5, evaluating the desensitized file based on a privacy and utility dual evaluation model, and returning to step 4 if the evaluation result does not meet the preset conditions until the preset conditions are met; step 6, outputting the desensitized file and the final evaluation result to the client. Through the scheme of the present invention, desensitization efficiency and security are improved.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of data processing technology, and in particular to a multi-strategy data desensitization method. Background Art

[0002] With the increasing frequency of data security issues and growing awareness of personal privacy protection, a multitude of data desensitization service providers have emerged on the market, offering customized solutions to meet diverse client needs. However, existing data desensitization solutions suffer from two major flaws: 1. Rigid policies: 82% of commercial desensitization systems utilize static rule bases, which are unable to adapt to changing business scenarios and privacy preferences; 2. Lack of evaluation: The lack of a desensitization quality assessment system for specific scenarios such as machine learning and collaborative analysis makes it difficult to quantify the balance between privacy protection and data value.

[0003] It can be seen that there is an urgent need for a multi-strategy data desensitization method with better desensitization efficiency and security. Summary of the Invention

[0004] In view of this, an embodiment of the present invention provides a multi-strategy data desensitization method, which at least partially solves the problems of poor desensitization efficiency and security in the prior art.

[0005] An embodiment of the present invention provides a multi-strategy data desensitization method, including:

[0006] Step 1: Obtain the file to be desensitized and select parameters, wherein the parameters include the total amount of data in the file to be desensitized, the number of selected records, the total amount of attribute types, and the number of selected attributes;

[0007] Step 2: Dynamically rank each attribute based on information entropy and k-means clustering to obtain the security level of each attribute;

[0008] Step 3: Perform a multi-factor privacy leakage risk assessment based on the selected parameters and the security level of each attribute to obtain a privacy leakage risk coefficient;

[0009] Step 4: Based on the hybrid execution framework of static and dynamic desensitization, desensitize the files to be desensitized according to the privacy leakage risk coefficient to generate desensitized files;

[0010] Step 5: Evaluate the desensitized file based on the privacy and utility dual evaluation model. If the evaluation result does not meet the preset conditions, return to step 4 until the preset conditions are met.

[0011] Step 6: Output the desensitized file and the final evaluation results to the client.

[0012] According to a specific implementation of the embodiment of the present invention, step 1 specifically includes:

[0013] Step 1.1: Obtain the files to be desensitized uploaded by the user, select the number of records, application scenarios, and desensitization method;

[0014] Step 1.2: Set the total amount of data in the file to be desensitized to , the number of selected records is , total amount of attribute types , select from attributes.

[0015] According to a specific implementation of the embodiment of the present invention, step 2 specifically includes:

[0016] Step 2.1: After performing one-hot encoding on each attribute, calculate the mutual information between each attribute and normalize it to form the attribute correlation matrix. The mutual information is expressed as

[0017]

[0018] in, and is the marginal entropy, and is the conditional entropy, For attributes and The joint entropy of

[0019] The normalized expression is

[0020]

[0021] in, is mutual information;

[0022] The expression of the attribute correlation matrix is:

[0023]

[0024] in, Indicates the attribute fields and The attribute fields are combined with the entropy normalized value, that is, the correlation coefficient;

[0025] In step 2.2, the attributes are clustered using K-means according to the attribute correlation matrix, and the silhouette coefficient is used to find the optimal number of clusters. The security level of each attribute is obtained based on the cluster and correlation coefficient, as well as the security level of the attribute data label.

[0026] According to a specific implementation of the embodiment of the present invention, step 3 specifically includes:

[0027] Step 3.1: The ratio between the total amount of data N in the file to be desensitized and the number of selected records n is used as the record selection weight. ;

[0028] Step 3.2: The ratio between the total number of attribute types M and the number of selected attributes m is used as the field selection quantity weight. ;

[0029] Step 3.3, get the record Attributes and supported Application scenario, the security level of each attribute is recorded as , get the privacy level mark established for the application scenario and record it as , No. The first field The operational risk weight corresponding to the operation is recorded as , with attributes as row vectors and application scenarios as column vectors, we establish The first operational risk matrix ;

[0030] Step 3.4, select the The first attribute field Operational risk weight corresponding to the operation , build the second operational risk matrix for this scenario , and use the unmentioned requirements Fill in the second operational risk matrix The rows are summed and normalized to obtain the field operation risk weight ;

[0031] Step 3.5, suppose that among the m selected attributes, there are Continuous data, categorical data, calculate the first distance between two continuous data

[0032]

[0033] in, is the distance length of the numerical domain, Represents continuous data;

[0034] Step 3.6, calculate the second distance between the two data in the classification data

[0035]

[0036]

[0037] in, is the number of attribute value types contained in the attribute set, Represents discrete records;

[0038] Step 3.7, for the selected n records, Continuous data, categorical data and Class global combination records, calculate the total distance between records

[0039] ;

[0040] Step 3.8, calculate the relevance weight of the record based on the total distance ;

[0041] ;

[0042] Step 3.9: Calculate the privacy leakage risk coefficient based on the record selection quantity weight, field selection quantity weight, field operation risk weight, and record relevance weight.

[0043] .

[0044] According to a specific implementation of the embodiment of the present invention, step 4 specifically includes:

[0045] Step 4.1: mask, hash, and asymmetric encrypt the continuous data in the file to be desensitized in the static desensitization layer of the hybrid execution framework of static and dynamic desensitization.

[0046] Step 4.2: Based on k-anonymity, differential privacy, and generative adversarial networks, the classified data in the to-be-desensitized file is desensitized in the dynamic desensitization layer of the hybrid execution framework of static and dynamic desensitization.

[0047] Step 4.3, the outputs of the static desensitization layer and the dynamic desensitization layer are converted into a desensitization file.

[0048] According to a specific implementation of the embodiment of the present invention, step 5 specifically includes:

[0049] Step 5.1, use decision tree classifier, polynomial regression and multi-layer perceptron to evaluate the utility between the desensitized file and the file to be desensitized;

[0050] Step 5.2: Evaluate the privacy of the desensitized file and the file to be desensitized based on the minimum distance quantile value and the nearest neighbor ratio, and generate an evaluation result;

[0051] Step 5.3: If the evaluation result does not meet the preset conditions, return to step 4 until it meets the preset conditions.

[0052] The multi-strategy data desensitization scheme in the embodiment of the present invention includes: step 1, obtaining the file to be desensitized and selecting parameters, wherein the parameters include the total amount of data in the file to be desensitized, the number of selected records, the total amount of attribute types and the number of selected attributes; step 2, dynamically grading each attribute based on information entropy and k-means clustering to obtain the security level of each attribute; step 3, performing a multi-factor privacy leakage risk assessment based on the selected parameters and the security level of each attribute to obtain a privacy leakage risk coefficient; step 4, based on a hybrid execution framework of static and dynamic desensitization, desensitizing the file to be desensitized according to the privacy leakage risk coefficient to generate a desensitized file; step 5, evaluating the desensitized file based on a dual evaluation model of privacy and utility, and if the evaluation result does not meet the preset conditions, returning to step 4 until the preset conditions are met; step 6, outputting the desensitized file and the final evaluation result to the client.

[0053] The beneficial effects of the embodiments of the present invention are: through the scheme of the present invention, the combined fields are dynamically graded with the help of information entropy and k-means clustering algorithm, the privacy leakage risk of the data to be released is evaluated by considering the number of records, attribute fields, and usage scenarios, and the desensitization parameters are dynamically selected according to the desensitization strategy. At the same time, the static desensitization technology is combined to automatically identify and desensitize the aligning identifiers, and the utility and privacy evaluation of the desensitized data are performed, thereby helping data publishers to achieve more accurate and intelligent data desensitization and improve desensitization efficiency and security. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0055] Figure 1 A schematic diagram of a multi-strategy data desensitization method according to an embodiment of the present invention;

[0056] Figure 2 A schematic diagram of a specific implementation process of a multi-strategy data desensitization method provided by an embodiment of the present invention;

[0057] Figure 3 A schematic diagram of attribute field categories provided by an embodiment of the present invention;

[0058] Figure 4 A schematic diagram of a privacy leakage risk coefficient assessment process provided by an embodiment of the present invention;

[0059] Figure 5 A schematic diagram of a data desensitization strategy selection provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0060] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0061] The following describes the embodiments of the present invention through specific examples. Those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that, in the absence of conflict, the following embodiments and features in the embodiments can be combined with each other. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0062] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein can be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on the present invention, those skilled in the art will appreciate that an aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects described herein can be used to implement an apparatus and / or practice a method. In addition, other structures and / or functionalities other than one or more of the aspects described herein can be used to implement this apparatus and / or practice this method.

[0063] It should also be noted that the illustrations provided in the following embodiments are merely schematic illustrations of the basic concept of the present invention. The illustrations only show components related to the present invention and are not drawn according to the number, shape, and size of components in actual implementation. In actual implementation, the type, quantity, and proportion of each component may be changed arbitrarily, and the component layout may also be more complex.

[0064] Additionally, in the following description, specific details are provided to provide a thorough understanding of the examples. However, one skilled in the art will appreciate that the aspects described can be practiced without these specific details.

[0065] An embodiment of the present invention provides a multi-strategy data desensitization method, which can be applied to the information protection process in Internet scenarios.

[0066] See also Figure 1 , is a flow chart of a multi-strategy data desensitization method provided by an embodiment of the present invention. Figure 1 and Figure 2 As shown, the method mainly includes the following steps:

[0067] Step 1: Obtain the file to be desensitized and select parameters, wherein the parameters include the total amount of data in the file to be desensitized, the number of selected records, the total amount of attribute types, and the number of selected attributes;

[0068] In specific implementation, the specific process of uploading files and selecting parameters can be as follows:

[0069] Step 1.1: Upload a desensitized file in the following formats: .txt, .csv, .excel, etc., and select the number of records, application scenario, and desensitization method.

[0070] In the specific implementation, on the main interface of multi-strategy data intelligent desensitization, the user clicks to select a file to upload. This example uses the Adult dataset; the system automatically obtains the file header information and returns to the desensitization interface. The user selects the fields to be desensitized, the number of records, the application scenario, and the desensitization method according to their needs, and clicks the "Start Desensitization Processing" button to enter the dynamic grading stage. The parameter selection is shown in the following table:

[0071] Table 1

[0072]

[0073] Step 1.2, data preprocessing. Set the total number of user data to be desensitized to , the number of selected records is ; Attribute fields have a total of species, select from attribute fields, such as Figure 3 shown.

[0074] The Adult dataset contains 45,223 data items, from which 10,000 data items are selected. There are 15 attribute fields, 12 of which are selected, and 3 additional static masking fields are added (dynamic grading is not required).

[0075] Step 2: Dynamically rank each attribute based on information entropy and k-means clustering to obtain the security level of each attribute;

[0076] In specific implementation, the specific process of dynamic grading of combined attributes based on information entropy and k-means clustering is as follows:

[0077] Step 2.1: Calculate the similarity matrix between attributes. Based on the different attribute types, perform one-hot encoding on discrete attributes and calculate the mutual information between each pair of variables. The calculation formula is shown in 1:

[0078] (1)

[0079] in, and is the marginal entropy, and is the conditional entropy, and yes and The information entropy between attributes is normalized. The value range is limited to The calculation formula is shown in 2:

[0080] (2)

[0081] in, is mutual information, and yes and The entropy of . Get the attribute correlation matrix .

[0082] (3)

[0083] in, Indicates the attribute fields and The normalized value of the joint entropy of the attribute fields is the correlation coefficient.

[0084] Step 1.2, K-means clustering. Perform K-means clustering on the attributes and use the silhouette coefficient to find the optimal number of clusters. Finally, the security level of the attribute data label is determined based on the cluster and correlation coefficient. , get the security level of the attribute The specific calculation process is as follows:

[0085] In each cluster, obtain the data label security level of the attribute 、 and the correlation coefficient , the calculation formula of the relevant security level of each two attributes is shown in 4:

[0086] (4)

[0087] For each attribute, we sum For example, using the similarity matrix to cluster the attribute field, the clustering result is [0 0 0 0 0 0 4 2 4 3 5 4 0 1 0] the original security level of the attribute field After the combination is graded, .

[0088] Step 3: Perform a multi-factor privacy leakage risk assessment based on the selected parameters and the security level of each attribute to obtain a privacy leakage risk coefficient;

[0089] In the specific implementation, in this step, the use requirements and relevance of the data are analyzed to determine the privacy protection score of the data selected by the user. The demand analysis consists of two parts. The first part is to analyze the number of records and the proportion of the number of attributes of the data selected by the user, collectively referred to as quantity analysis; the second part is to analyze the application scenarios and construct an operational risk matrix. The correlation analysis also consists of two parts. The first part is to analyze the attribute correlation and use mutual information to redefine the security level of the attribute for the construction of the operational risk matrix. Record correlation takes into account that the data requested by the user contains continuous data and discrete data, and different distance functions are used to calculate the correlation. For example Figure 4 As shown:

[0090] Step 3.1: Requirements Analysis

[0091] ①Quantity analysis: record the selected quantity weight : The total number of records is , the number of request records is , and define the ratio of the two as , This is the record selection quantity weight. Field selection quantity weight : Attribute fields have species, select from The attribute fields are returned in the query, and the ratio of the two is defined as , That is, select the quantity weight for the field.

[0092] ②Scenario Analysis: Data Operation: Support Application scenarios, user selection application scenarios.

[0093] Operational Risk Matrix : Get the record Attribute fields and supported Get the attribute-related security level, recorded as ; Get the privacy level tag established for the usage scenario, recorded as . Use the field as the row vector and the application scenario as the column vector to establish Operational Risk Matrix , No. The first field The operational risk weight corresponding to the operation is recorded as , Operational Risk Matrix Then record it as:

[0094] (5)

[0095] Operational risk weight vector :According to data usage requirements, select The first attribute field Operational risk weight corresponding to the operation , build the operational risk matrix for this scenario , fill in the unrelated requirements with 0, and get:

[0096] (6)

[0097] right The rows of are summed and normalized to obtain the vector , This is the operational risk weight vector of the field.

[0098] In specific implementation, .

[0099] Step 3.2, Correlation Analysis

[0100] Suppose among the selected m attributes, there are Continuous data, categorical data, calculate the first distance between two continuous data

[0101] (7)

[0102] in, is the distance length of the numerical domain, Represents continuous data;

[0103] Step 3.6, calculate the second distance between the two data in the classification data

[0104] (8)

[0105] (9)

[0106] in, is the number of attribute value types contained in the attribute set, Represents discrete records

[0107] For the selected n records, Continuous data, categorical data, and Class global combination record, distance between records The calculation method is:

[0108] (10)

[0109] Among them, the label and represent continuous and categorical data, respectively.

[0110] The similarity between records is recorded as , This is the relevance weight coefficient of the record.

[0111] In specific implementation, , .

[0112] Step 3.3: Privacy Leakage Risk Assessment

[0113] Assess data privacy risks. By performing demand and relevance analysis on the data to be released, the privacy risk S of the data is assessed. If the score exceeds the set threshold, it means the data sensitivity is low and the data can be returned directly. If the score is below the threshold, the data privacy risk is high and further desensitization is required.

[0114] The overall privacy leakage risk factor is:

[0115] (11)

[0116] In specific implementation, According to the privacy leakage coefficient, configure relevant parameters for subsequent dynamic desensitization, as shown in the following table:

[0117] Table 2

[0118]

[0119] Step 4: Based on the hybrid execution framework of static and dynamic desensitization, desensitize the files to be desensitized according to the privacy leakage risk coefficient to generate desensitized files;

[0120] When implementing it specifically, Figure 5 As shown, a hybrid execution framework based on static encryption and dynamic desensitization is proposed. This paper proposes a hybrid execution framework based on deep coupling of static and dynamic desensitization. The static desensitization layer uses asymmetric RSA encryption and hash transformation to ensure the privacy and security of display identifiers. The dynamic desensitization layer uses k-anonymity, differential privacy, and adversarial generative networks to protect data in real-time queries. This hybrid strategy forms a multi-layered defense against background and knowledge attacks.

[0121] Step 4.1: Static desensitization

[0122] (1) Masking: Part of the original data is uniformly replaced with common characters, so that only part of the sensitive data remains public.

[0123] (2) Hash transformation: It converts the original data (such as passwords, ID numbers, etc.) into a hash value of fixed length through a hash algorithm. Even if the hash value is leaked, the original data cannot be restored.

[0124] (3) Asymmetric encryption RSA: A set of large prime numbers is combined with other parameters to generate public and private keys. The public key is used to encrypt data, and the private key is used to decrypt data, thus achieving secure transmission of information.

[0125] In the specific implementation, the present invention automatically identifies the patient's mobile phone number field and uses " " is masked and the rest is kept public in the form of " "; the SHA256 algorithm is used to automatically identify the ID card number field and perform hash transformation to protect personal identity; asymmetric encryption is used to automatically identify the hospitalization ID number and perform asymmetric encryption to protect privacy. The specific desensitization results are shown in Table 3.

[0126] Table 3

[0127]

[0128] Step 4.2: Dynamic Desensitization

[0129] (1) :exist In the framework of k-1 dataset, each record in the dataset has the same key attributes (such as age, gender, zip code, etc.) as k-1 other records.

[0130] In this specific implementation, the 2-anonymous data of part of the Adult dataset is shown in Table 4:

[0131] Table 4

[0132]

[0133] (2) Differential privacy: Even if an attacker knows all records except one, he cannot infer any sensitive information of the records.

[0134] In the specific implementation, the differential privacy of the Adult dataset is shown in Table 5:

[0135] Table 5

[0136]

[0137] (3) Data synthesis: Simulate statistical patterns and relationships in real data without directly pointing to any “real” person, thus resisting re-identification attacks.

[0138] In the specific implementation, the Adult dataset is desensitized by the adversarial generative network as shown in Table 6:

[0139] Table 6

[0140]

[0141] Step 5: Evaluate the desensitized file based on the privacy and utility dual evaluation model. If the evaluation result does not meet the preset conditions, return to step 4 until the preset conditions are met.

[0142] The specific implementation process of evaluating the desensitization results based on the privacy-utility dual evaluation model is as follows:

[0143] Step 5.1: Multi-dimensional utility evaluation

[0144] To evaluate the machine learning performance of synthetic data, this paper uses decision tree classifiers, polynomial regression, and multilayer perceptrons to evaluate both raw and synthetic data. The specific process is as follows: The model is trained using both raw and desensitized data, and the accuracy, AUC, and F1 score differences between the raw and desensitized data are compared.

[0145] In the specific implementation, the difference between the original data and the desensitized data indicators for the desensitized data utility evaluation is shown in Table 7:

[0146] Table 7

[0147]

[0148] Step 5.2: Privacy Leakage Risk Quantification Model

[0149] The present invention proposes a privacy leakage quantification model based on the minimum distance quantile value (Distance to Closest Rank, DCR) and the nearest neighbor ratio (NNDR) to achieve visual early warning of attack risks.

[0150] DCR (original data and desensitized data): The 5% percentile of the minimum distance between the original data and the desensitized data. The smaller the value, the closer some of the synthesized data are to the real data, and the higher the risk of leakage.

[0151] DCR (between raw data): The 5% quantile of the minimum distance within the raw data, reflecting the density of the raw data itself. A small value indicates that the raw data has dense clusters and is vulnerable to attacks.

[0152] DCR (Densitized Data Interval): The 5% percentile value of the minimum distance within the desensitized data, reflecting the density of the desensitized data itself. A small value indicates that the desensitized data has dense clusters and is vulnerable to attacks.

[0153] NNDR (real data and desensitized data): The 5% quantile of the nearest neighbor ratio between the original data and the desensitized data, which measures the similarity of local structures across data sets. A value close to 1 indicates a high risk of structural duplication.

[0154] NNDR (between real data): The 5% quantile of the nearest neighbor ratio within the original data, reflecting the uniqueness of the local structure. A low value indicates the existence of repeated patterns and is easy to infer.

[0155] NNDR (densified data between): The 5% quantile of the nearest neighbor ratio within the densified data, reflecting the uniqueness of the local structure. A low value indicates the presence of repeated patterns, which are easy to infer. In specific implementation, the privacy assessment of densified data is shown in Table 8:

[0156] Table 8

[0157]

[0158] Step 6: Output the desensitized file and the final evaluation results to the client.

[0159] In practice, after data desensitization is complete, the system returns the processed data and data effect evaluation results to the user for data publication and sharing. At this stage, users receive a protected dataset, ensuring that no sensitive information is leaked. This helps promote data sharing and utilization while protecting personal privacy and data security.

[0160] The multi-strategy data desensitization method provided in this embodiment dynamically rates combined fields by means of information entropy and the k-means clustering algorithm, evaluates the privacy leakage risk of the data to be released by considering the number of records, attribute fields, and usage scenarios, dynamically selects desensitization parameters according to the desensitization strategy, and automatically identifies and desensitizes align identifiers in combination with static desensitization technology, and performs utility and privacy evaluations on desensitized data, thereby helping data publishers achieve more accurate and intelligent data desensitization and improving desensitization efficiency and security.

[0161] This invention addresses the limitations of traditional data desensitization technology and makes significant improvements in privacy protection, flexibility, intelligence, and policy diversity. It specifically solves the following key issues:

[0162] 1. Solve the privacy leakage problem of combined attributes

[0163] Traditional technologies rely solely on static classification and grading of single attributes, ignoring the sensitivity of multiple attribute combinations. This leads to privacy risks even after data is released. This invention uses information entropy and k-means clustering to dynamically grade combined attributes, avoiding privacy leaks caused by attribute correlations.

[0164] 2. Balancing user needs and data utility

[0165] Traditional desensitization processes are fixed by the system configuration, preventing data publishers from flexibly selecting the data features to retain or the desensitization strategy to be used based on actual scenarios. This results in reduced data utility and insufficient flexibility. This invention allows data publishers to independently select the data fields and desensitization strategies to be published through an interactive interface, balancing data availability and privacy requirements.

[0166] 3. Addressing the lack of automation in risk assessment and desensitization decision-making

[0167] Traditional methods rely on manual experience to determine whether a dataset requires desensitization and select parameters, which is inefficient and prone to errors. This invention implements intelligent dynamic data desensitization: based on dynamic factors such as data labels, usage scenarios, and record size, it automatically calculates privacy risk scores, and uses thresholds to determine the necessity of desensitization and the noise level, enabling accurate decision-making.

[0168] 4. Solve the problems of single desensitization strategy and scenario adaptability

[0169] Existing technologies typically support only a limited number of desensitization methods (such as static encryption or dynamic masking), making them difficult to address in complex scenarios (such as dynamic desensitization for real-time queries and static encryption for long-term storage). This paper integrates six desensitization methods (three static and three dynamic) to cover diverse scenarios: static desensitization for stored data (such as asymmetric encryption for long-term security); dynamic desensitization for real-time interactions (such as K-anonymity for query privacy and generative adversarial networks for synthetic data generation).

[0170] Through the above-mentioned improvements, the present invention provides a more refined and intelligent solution to the contradiction between data sharing and privacy protection, which meets the dual needs of data security and value release in the digital age.

[0171] Specifically, compared with the prior art, the improved effects of the present invention are embodied in:

[0172] 1. Dynamic Grading of Multi-Attribute Combinations: Before constructing a multi-strategy intelligent dynamic desensitization system, we dynamically update the security level of combined attributes based on traditional static classification and grading of single attributes. This is because even if a single attribute is not sensitive on its own, its sensitivity increases significantly when combined. Dynamic grading of multi-attribute combinations enhances data privacy protection.

[0173] 2. Personalized Desensitized Data Selection: Data publishers upload a desensitized data table to be published. The system automatically reads the attribute fields and returns them to the user interface via a multiple-selection drop-down form. Data publishers select the data characteristics and desensitization strategy to be published based on their personal preferences. The data is desensitized and the desensitized data table is ultimately returned to the user.

[0174] 3. Intelligent dynamic data desensitization: The desensitization system can integrate factors such as data labels, usage scenarios, number of records, and number of features to conduct privacy risk assessments on the data to be released. It also uses thresholds to determine whether the dataset needs to be desensitized and selects an appropriate noise scale to enhance data availability.

[0175] 4. Support for multi-strategy data desensitization: The desensitization system uses six desensitization methods, including three static desensitization methods: masking, hash transformation, and asymmetric encryption; and three dynamic desensitization methods: k-anonymity, differential privacy, and generative adversarial networks. Multi-strategy support meets the needs of complex scenarios such as finance, medical care, and cloud computing.

[0176] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware or a combination thereof.

[0177] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A multi-strategy data desensitization method, characterized in that: include: Step 1: Obtain the file to be desensitized and select parameters, wherein the parameters include the total amount of data in the file to be desensitized, the number of selected records, the total amount of attribute types, and the number of selected attributes; Step 2: Dynamically rank each attribute based on information entropy and k-means clustering to obtain the security level of each attribute; Step 3: Perform a multi-factor privacy leakage risk assessment based on the selected parameters and the security level of each attribute to obtain a privacy leakage risk coefficient; The step 3 specifically includes: Step 3.1: The ratio between the total amount of data N in the file to be desensitized and the number of selected records n is used as the record selection weight. ; Step 3.2: The ratio between the total number of attribute types M and the number of selected attributes m is used as the field selection quantity weight. ; Step 3.3, get the record Attributes and supported Application scenario, the security level of each attribute is recorded as , get the privacy level mark established for the application scenario and record it as , No. The first field The operational risk weight corresponding to the operation is recorded as , with attributes as row vectors and application scenarios as column vectors, we establish The first operational risk matrix ; Step 3.4, select the The first attribute field Operational risk weight corresponding to the operation , build the second operational risk matrix for this scenario , and use the unmentioned requirements Fill in the second operational risk matrix The rows are summed and normalized to obtain the field operation risk weight ; Step 3.5, suppose that among the m selected attributes, there are Continuous data, categorical data, calculate the first distance between each pair of continuous data: in, is the distance length of the numerical domain, Represents continuous data; Step 3.6, calculate the second distance between each pair of data in the classification data: in, is the number of attribute value types contained in the attribute set, Represents discrete records; Step 3.7, for the selected n records, Continuous data, categorical data and Class global combines records and calculates the total distance between records: ； Step 3.8, calculate the relevance weight of the record based on the total distance : ； Step 3.9: Calculate the privacy leakage risk coefficient based on the record selection quantity weight, field selection quantity weight, field operation risk weight, and record relevance weight: ； Step 4: Based on the hybrid execution framework of static and dynamic desensitization, desensitize the files to be desensitized according to the privacy leakage risk coefficient to generate desensitized files; Step 5: Evaluate the desensitized file based on the privacy and utility dual evaluation model. If the evaluation result does not meet the preset conditions, return to step 4 until the preset conditions are met. Step 6: Output the desensitized file and the final evaluation results to the client.

2. The method according to claim 1, characterized in that The step 1 specifically includes: Step 1.1: Obtain the files to be desensitized uploaded by the user, select the number of records, application scenarios, and desensitization method; Step 1.2: Set the total amount of data in the file to be desensitized to , the number of selected records is , total amount of attribute types , select from attributes.

3. The method according to claim 2, characterized in that The step 2 specifically includes: In step 2.1, after performing one-hot encoding on each attribute, the mutual information between each attribute is calculated and normalized to form an attribute correlation matrix. The mutual information is expressed as: in, and is the marginal entropy, and is the conditional entropy, For attributes and The joint entropy of The normalized expression is: in, is mutual information; The expression of the attribute correlation matrix is: in, Indicates the attribute fields and The attribute fields are combined with the entropy normalized value, that is, the correlation coefficient; In step 2.2, the attributes are clustered using K-means according to the attribute correlation matrix, and the silhouette coefficient is used to find the optimal number of clusters. The security level of each attribute is obtained based on the cluster and correlation coefficient, as well as the security level of the attribute data label.

4. The method according to claim 3, characterized in that The step 4 specifically includes: Step 4.1: mask, hash, and asymmetric encrypt the continuous data in the file to be desensitized in the static desensitization layer of the hybrid execution framework of static and dynamic desensitization. Step 4.2: Based on k-anonymity, differential privacy, and generative adversarial networks, the classified data in the to-be-desensitized file is desensitized in the dynamic desensitization layer of the hybrid execution framework of static and dynamic desensitization. Step 4.3, the outputs of the static desensitization layer and the dynamic desensitization layer are converted into a desensitization file.

5. The method according to claim 4, characterized in that The step 5 specifically includes: Step 5.1, use decision tree classifier, polynomial regression and multi-layer perceptron to evaluate the utility between the desensitized file and the file to be desensitized; Step 5.2: Evaluate the privacy of the desensitized file and the file to be desensitized based on the minimum distance quantile value and the nearest neighbor ratio, and generate an evaluation result; Step 5.3: If the evaluation result does not meet the preset conditions, return to step 4 until it meets the preset conditions.

Images