Dynamic data desensitization system for employee performance assessment

Abstract

The invention relates to the technical field of data processing, and discloses an employee performance assessment-oriented dynamic data desensitization system, which comprises a field analysis module, a query analysis module, a desensitization strategy module and a desensitization execution module, wherein the field analysis module is used for identifying a risk field combination between fields of object data; the query analysis module is used for calculating the sensitivity of each query party to each field in the risk field combination; a desensitization strategy module synchronously generates a joint desensitization strategy of each query party for the risk field combination based on the sensitivity and desensitization constraint condition of each query party for each field in the risk field combination; and the desensitization execution module is used for executing the joint desensitization strategy and performing joint desensitization of the risk field combination for each query party. According to the method, the desensitization strategy is optimized, and the efficiency and safety of employee performance assessment data management are improved.

Description

Technical Field

[0001] This application relates to the technical field of data processing, and particularly to a dynamic data desensitization system for employee performance appraisal. Background Art

[0002] There are still many deficiencies in the current industry in the management of employee performance appraisal data. Existing technologies have obvious deficiencies in preventing the risk of data association leakage. With the deepening of enterprise data analysis requirements, the association relationships between multiple fields will generate potential information leakage. Most solutions are still limited to the protection of single-field dimensions and fail to establish an effective prevention and control mechanism for the risks of field combinations. Existing data desensitization methods are often not accurate and dynamic enough. Some enterprises adopt simple static desensitization methods, such as uniformly masking all object data or deleting sensitive fields. Although this method can protect data privacy to a certain extent, it reduces the usability of the data and cannot meet the diverse needs of different query parties for data. For example, when a department manager views the performance data of employees in his / her department, he / she may need to understand the general distribution of employee performance, but the statically desensitized data may not provide enough information, affecting the management decision-making efficiency of the department manager. The existing data desensitization strategy formulation process lacks overall optimization considerations. Most enterprises independently calculate the most favorable desensitization strategy for each query party without considering the needs of other query parties, resulting in multiple versions of desensitization strategies for the same risk field combination for different query parties. This not only leads to an increase in storage costs but also requires maintaining multiple sets of desensitization processes, increasing the complexity and operating costs of the system.

[0003] For example, the Chinese patent application with the publication number CN116502265A discloses a data security system based on big data, which relates to the field of data security and includes a monitoring center. The monitoring center is connected to an account management module, a virtual system module, a risk assessment module, and a data security module. The account management module helps employees register accounts, establish mirror virtual machines, and employees log in. The IP address of the employee's computer is verified, and the company website data is mapped to the employee's computer. The risk assessment module evaluates the risk level of the employee's copy operation behavior, and corresponding measures are taken for the employee's computer according to the risk level. If the risk level is level three, the core data is desensitized and a key is set. This technical solution can prevent the data within the company from being leaked, and at the same time, if the desensitized core data is leaked, it cannot be viewed, ensuring the security of the core data. However, it still has the problems raised in the background art of this application: The above patents all have the problems raised in this background art: they fail to establish an effective prevention and control mechanism for the risks of field combinations.

[0004] The information disclosed in this background section is only intended to enhance the overall understanding of the present application and should not be regarded as an admission or any form of suggestion that this information constitutes prior art already known to those of ordinary skill in the art. Summary of the Invention

[0005] The technical problem to be solved by this application is to overcome the defects of the prior art, provide a dynamic data desensitization system for employee performance appraisal, optimize the desensitization strategy, and improve the efficiency and security of employee performance appraisal data management.

[0006] To solve the above technical problems, this application provides the following technical solutions: A dynamic data desensitization system for employee performance appraisal, including a field analysis module, a query analysis module, a desensitization strategy module, and a desensitization execution module; wherein: The field analysis module is used to identify risk field combinations among the fields of object data; The query analysis module is used to calculate the sensitivity of each query party to each field in the risk field combination; the query analysis module is also used to obtain the query constraint permissions of each query party and map the query constraint permissions to the desensitization constraint conditions of each query party for each field; The desensitization strategy module synchronously generates a joint desensitization strategy for each query party for the risk field combination based on the sensitivity of each query party to each field in the risk field combination and the desensitization constraint conditions; The desensitization execution module is used to execute the joint desensitization strategy and perform joint desensitization of the risk field combination for each query party respectively.

[0007] As a preferred solution of the dynamic data desensitization system for employee performance appraisal described in this application, wherein: the field analysis module includes an association combination unit; The association combination unit is configured with an association recognition strategy; the association recognition strategy is used to identify associated field combinations among the fields of object data; specifically including: Obtain an object data set; calculate each marginal probability of each field based on the object data set, as well as each joint marginal probability of any m fields; m is an integer greater than 1; Based on each marginal probability of each field and each joint marginal probability of any m fields, calculate the mutual information value of any m fields as the association value corresponding to the m fields; The association combination unit is also configured with an association threshold; the association recognition strategy further includes: if the association value of any m fields is greater than the association threshold, then the corresponding m fields are association field combinations.

[0008] As a preferred solution of the dynamic data desensitization system for employee performance appraisal described in this application, where: the field analysis module further includes a risk identification unit; The risk identification unit is configured with a risk identification strategy; the risk identification strategy is used to identify risk field combinations in the associated field combinations, specifically including: For any associated field combination, count the number of people in all sub - combinations; among all sub - combinations with non - zero numbers of people, take the number of people in the sub - combination with the smallest number as the anonymity degree of the corresponding associated field combination; The risk identification unit is also configured with an anonymity degree threshold; the risk identification strategy further includes: if the anonymity degree of any associated field combination is less than the anonymity degree threshold, mark the corresponding associated field combination as a risk field combination.

[0009] As a preferred solution of the dynamic data desensitization system for employee performance appraisal described in this application, where: the query analysis module includes a sensitivity unit; The sensitivity unit is used to calculate the sensitivity of each query party to each field in the risk field combination; the query parties include HR, department managers, and senior executives; The sensitivity unit calculates the sensitivity of the query party to each field in the risk field combination as follows: obtain the desensitization operation records of the query party for each field in each risk field combination, and count the proportion of desensitization operation records with a desensitization intensity level of 3 in the desensitization operation records as the sensitivity of the corresponding field; the desensitization intensity levels include level 1, level 2, and level 3, and the larger the value of the desensitization intensity level, the higher the desensitization intensity.

[0010] As a preferred solution of the dynamic data desensitization system for employee performance appraisal described in this application, where: the query analysis module further includes a desensitization constraint unit; The desensitization constraint unit is used to obtain the query constraint permissions of each query party; the query constraint permissions are the permission scopes for the corresponding query parties to view object data; The desensitization constraint unit is also used to map the query constraint permissions to the desensitization constraint conditions of the query party for each field; the desensitization constraint conditions include the constraint conditions for the desensitization intensity level of the corresponding field; The desensitization constraint unit is configured with a mapping rule; the desensitization constraint unit maps the query constraint permissions to the desensitization constraint conditions of the query party for each field based on the mapping rule.

[0011] As a preferred solution of the dynamic data desensitization system for employee performance appraisal described in this application, the following applies: The desensitization strategy module includes a joint optimization unit and a calculation unit; among them, the calculation unit is configured with a revenue calculation algorithm; the joint optimization unit is used to construct a set of joint desensitization strategies; the calculation unit calculates the revenue value of each query party in each joint desensitization strategy based on the revenue calculation algorithm; the joint optimization unit generates the Pareto frontier of the joint desensitization strategy based on the revenue value of each query party, and selects the joint desensitization strategy based on the Pareto frontier.

[0012] The set of joint desensitization strategies includes all joint desensitization strategies; any one joint desensitization strategy includes specifying the desensitization risk level of each field in the risk field combination for each query party. The joint optimization unit obtains the desensitization constraint conditions of each field for the query party, and prunes the set of joint desensitization strategies to eliminate the joint desensitization strategies that do not meet the desensitization constraint conditions.

[0013] As a preferred solution of the dynamic data desensitization system for employee performance appraisal described in this application, the following applies: The calculation unit calculates the revenue value of each query party based on the revenue calculation algorithm, specifically including: Calculate the data availability of each query party after executing the joint desensitization strategy. Calculate the privacy risk value of each query party after executing the joint desensitization strategy. Perform a weighted sum of the data availability and privacy risk value of each query party to obtain the revenue value of each query party, where the weight coefficient of data availability is positive and the weight coefficient of privacy risk value is negative.

[0014] As a preferred solution of the dynamic data desensitization system for employee performance appraisal described in this application, the following applies: The revenue calculation algorithm also includes calculating the data availability of any query party, specifically including: Calculate the data availability of each field and sum them to obtain the data availability of the query party; among them, the method of calculating the data availability of any field includes: calculating the statistical error after field desensitization and normalizing it; the calculation unit is also configured with an error threshold for each query party for each field; divide the normalized value of the statistical error of each field by the error threshold of the corresponding field to obtain the error rate; the data availability of the field is 1 minus the error rate.

[0015] The revenue calculation algorithm also includes calculating the privacy risk value of any query party, specifically including: Calculate the privacy risk value of each field after desensitization and sum them to obtain the privacy risk value of the query party; among them, the privacy risk value of any field is the ratio of the sensitivity of the query party to the field to the desensitization intensity level of the field.

[0016] As an optimal solution of the dynamic data desensitization system for employee performance appraisal described in this application, specifically: The joint optimization unit generates the Pareto front of the joint desensitization strategy based on the benefit values of each query party, specifically including: Generate the benefit value sequence of each joint desensitization strategy; the benefit value sequence includes the benefit values of each query party in the joint desensitization strategy; For any two benefit value sequences P and Q, if each benefit value in P is not less than the corresponding item in Q, and at least one benefit value in P is greater than the corresponding item in Q, then P is the dominant solution of Q, and P is the non-dominated solution; if P has no dominant solution, then P is the non-dominated solution; all joint desensitization strategies corresponding to the non-dominated solutions form the Pareto front of the joint desensitization strategy; The joint optimization unit is also used to obtain the query records of each query party; based on the query records, count the frequency of each query party querying all fields in the risk field combination at the same time, and select the query party with the highest frequency as the dominant query party of the risk field combination; Based on the benefit value sequences of each joint desensitization strategy in the Pareto front, locate the joint desensitization strategy with the largest benefit value of the dominant query party as the joint desensitization strategy selected by the joint optimization unit.

[0017] As an optimal solution of the dynamic data desensitization system for employee performance appraisal described in this application, specifically: The joint optimization unit generates the Pareto front of the joint desensitization strategy based on the benefit values of each query party, specifically including: Generate the benefit value sequence of each joint desensitization strategy; the benefit value sequence includes the benefit values of each query party in the joint desensitization strategy; For any two benefit value sequences P and Q, if each benefit value in P is not less than the corresponding item in Q, and at least one benefit value in P is greater than the corresponding item in Q, then P is the dominant solution of Q, and P is the non-dominated solution; if P has no dominant solution, then P is the non-dominated solution; all joint desensitization strategies corresponding to the non-dominated solutions form the Pareto front of the joint desensitization strategy; The joint optimization unit is also used to obtain the query records of each query party; based on the query records, count the frequency of each query party querying all fields in the risk field combination at the same time, and select the query party with the highest frequency as the dominant query party of the risk field combination; Based on the benefit value sequences of each joint desensitization strategy in the Pareto front, locate the joint desensitization strategy with the largest benefit value of the dominant query party as the joint desensitization strategy selected by the joint optimization unit.

[0018] Compared with the prior art, the beneficial effects achieved by this application are as follows: This application determines the associated field combinations by calculating the mutual information values between fields, and then calculates the anonymity degree to screen out the risk field combinations, which can accurately locate the field combinations that are frequently queried and prone to revealing employee information, providing a basis for subsequent targeted desensitization.

[0019] Calculate the field sensitivity for different query parties, and map the query constraint permissions to desensitization constraint conditions, so that the system can customize the desensitization intensity of each field according to the needs and permissions of each query party, which not only meets the reasonable data usage requirements of the query parties, but also prevents the leakage of sensitive information, improving the flexibility and security of data usage.

[0020] This application adopts the method of joint optimization for multiple query parties. Compared with the traditional independent calculation desensitization strategy, it avoids the situation of generating multiple versions of desensitization strategies for the same risk field combination, reduces the storage cost, simplifies the system complexity, and improves the operation efficiency. Brief Description of the Drawings

[0021] In order to more clearly illustrate the technical solutions of the embodiments of this application, the drawings required for the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of this application. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts. Among them: Figure 1 It is a schematic structural diagram of a dynamic data desensitization system for employee performance appraisal provided by this application; Figure 2 It is a working flow chart of a dynamic data desensitization system for employee performance appraisal provided by this application. Detailed Embodiment

[0022] The technical solutions of this application will be described in detail below through the drawings and specific embodiments. It should be understood that the specific features in the embodiments of this application are a detailed description of the technical solutions of this application, rather than a limitation of the technical solutions of this application. Without conflict, the technical features in the embodiments of this application and the embodiments can be combined with each other.

[0023] This embodiment introduces a dynamic data desensitization system for employee performance appraisal. Referring to Figure 1 , this system includes a field analysis module, a query analysis module, a desensitization strategy module, and a desensitization execution module; referring to Figure 2 , the specific work of each module is as follows.

[0024] The field analysis module is used to identify the risk field combinations between the fields of the object data; The field analysis module includes an association combination unit and a risk identification unit; The associated combination unit is configured with an association recognition strategy; the association recognition strategy is used to recognize the associated field combinations among the fields of the object data; specifically, it includes: Obtain an object data set; calculate each marginal probability of each field and each joint marginal probability of any m fields based on the object data set; m is an integer greater than 1. The object data set includes all fields of all assessment objects, the values of each field, and historical query records; any marginal probability of any field is the occurrence probability of the corresponding value of the field in the historical query records. For example, one value of the field "department" is the sales department, and the corresponding marginal probability is the ratio of the number of times the sales department appears in the historical query records to the number of times the field "department" appears in the historical query records; one value of the field "performance level" is A level, and the joint marginal probability of the field "department" and the field "performance level" is the ratio of the number of times the sales department and A level appear in a historical query record to the number of times the field "department" and the field "performance level" appear in a historical query record.

[0025] Calculate the mutual information value of any m fields based on each marginal probability of each field and each joint marginal probability of any m fields, and use it as the association value of the corresponding m fields; the mutual information value is calculated based on the calculation formula of mutual information in information theory.

[0026] The associated combination unit is also configured with an association threshold; the association recognition strategy further includes: if the association value of any m fields is greater than the association threshold, the corresponding m fields are the associated field combinations. For example, the associated field combination consists of the fields "department" + "performance level", and at this time m = 2.

[0027] In this embodiment, preferably, the fields of some object data include the names, employee numbers, departments, performance levels (A / B / C / D), years of employment, salaries, project group numbers, performance scores (0 - 100 points), and reward and punishment records of the assessment objects.

[0028] The risk recognition unit is configured with a risk recognition strategy; the risk recognition strategy is used to recognize the risk field combinations in the associated field combinations, specifically including: For any combination of associated fields, count the number of people in all sub - combinations; among all sub - combinations with non - zero numbers of people, take the number of people in the sub - combination with the smallest number as the anonymity level of the corresponding combination of associated fields. For example, for the combination of associated fields "department" + "performance level", if the values of "department" include the sales department and the technology department, and the values of "performance level" include level A and level B, then there are 4 combinations of any value of "department" and any value of "performance level", that is, this combination of associated fields has 4 sub - combinations. If among the above - mentioned sub - combinations, the number of people corresponding to "sales department" + "level A" is 8 (that is, among all employees, the number of people with the department being the sales department and the performance level being level A at the same time is 8), the number of people in "technology department" + "level A" is 5, and the number of people in other sub - combinations is 0, then the anonymity level of the combination of associated fields "department" + "performance level" is 5. The anonymity level is a direct measure of the privacy protection strength. The greater the anonymity level, the better the privacy protection, and the more it can ensure that the corresponding combination of associated fields cannot accurately locate individual employees.

[0029] The risk identification unit is also configured with an anonymity - level threshold; the risk identification strategy further includes: if the anonymity level of any combination of associated fields is less than the anonymity - level threshold, then mark the corresponding combination of associated fields as a risk - field combination.

[0030] In this embodiment, through two - round screening, first, combinations of frequently queried fields are screened out through the associated values of multiple fields, and then combinations of fields that are likely to disclose employee information are screened out by calculating the anonymity level. Risk - field combinations that are frequently queried and likely to disclose employee information need to be jointly desensitized.

[0031] The query analysis module is used to calculate the sensitivity of each query party to each field in the risk - field combination; the query analysis module is also used to obtain the query - constraint permissions of each query party and map the query - constraint permissions to the desensitization - constraint conditions of each query party for each field; The query analysis module includes a sensitivity unit and a desensitization - constraint unit; The sensitivity unit is used to calculate the sensitivity of each query party to each field in the risk - field combination; the query parties include HR, department managers, and senior executives; The sensitivity unit calculates the sensitivity of the query party to each field in the risk - field combination as follows: obtain the desensitization operation records of each query party for each field in the risk - field combination, and count the proportion of desensitization operation records with a desensitization intensity level of 3 in the desensitization operation records as the sensitivity of the corresponding field; the desensitization intensity levels include level 1, level 2, and level 3, and the larger the value of the desensitization intensity level, the higher the desensitization intensity.

[0032] Sensitivity is used to quantify the confidentiality tendency of each query party for each field. If a query party frequently selects a desensitization operation with a desensitization intensity level of 3 for a certain field, it indicates that the sensitivity of this field is high, that is, the confidentiality level of this field for the query party is high.

[0033] The desensitization constraint unit is used to obtain the query constraint permissions of each query party; the query constraint permissions are the permission scopes for the corresponding query party to view object data; some preferred query constraint permissions in this embodiment are as follows: for HR, permission to view department-level statistical values (such as average performance) is allowed; permission to view personal detailed data is prohibited; for department managers, permission to view the desensitized performance ranges of the top 50% of employees in their own departments is allowed; cross-department data association is prohibited.

[0034] The desensitization constraint unit is further used to map the query constraint permissions to the desensitization constraint conditions of each field for the query party; the desensitization constraint conditions include the constraint conditions for the desensitization intensity level of the corresponding field. The desensitization constraint unit is configured with mapping rules; based on the mapping rules, the desensitization constraint unit maps the query constraint permissions to the desensitization constraint conditions of each field for the query party. Some preferred mapping rules in this embodiment are as follows: the query constraint permission is to prohibit viewing personal detailed data, and the mapped desensitization constraint condition is that the desensitization intensity levels of the fields "Name" and "Employee ID" are 3, that is, they must be completely desensitized; the query constraint permission is to allow viewing the desensitized performance ranges of the top 50% of employees in their own departments, and the mapped desensitization constraint condition is that the desensitization level of the field "Performance Score" is not greater than 2, that is, a certain degree of desensitization of the performance score is allowed, but the sorting is retained.

[0035] Based on the sensitivity and desensitization constraint conditions of each field in the risk field combination for each query party, the desensitization strategy module synchronously generates a joint desensitization strategy for each query party for the risk field combination. The desensitization strategy module includes a joint optimization unit and a calculation unit; among them, the calculation unit is configured with a revenue calculation algorithm; the joint optimization unit is used to construct a set of joint desensitization strategies; the calculation unit calculates the revenue value of each query party in each joint desensitization strategy based on the revenue calculation algorithm; the joint optimization unit generates the Pareto frontier of the joint desensitization strategy based on the revenue value of each query party, and selects a joint desensitization strategy based on the Pareto frontier. The set of joint desensitization strategies includes all joint desensitization strategies; any one joint desensitization strategy includes specifying the desensitization risk level of each field in the risk field combination for each query party; for example, a joint desensitization strategy for "Department + Performance Score" includes: the desensitization intensity level of HR for the department is 2, and the desensitization intensity level for the performance score is 3; the desensitization intensity level of the department manager for the department is 2, and the desensitization intensity level for the performance score is 2; the desensitization intensity level of the senior executive for the department is 2, and the desensitization intensity level for the performance score is 1. The joint optimization unit obtains the desensitization constraint conditions of each field for the querying party, and prunes the joint desensitization policy set to remove the joint desensitization policies that do not meet the desensitization constraint conditions. For example, one desensitization constraint condition for the department manager is that the desensitization intensity level of the performance score is not greater than 2, and all joint desensitization policies including the department manager's desensitization intensity level of 3 for the performance score are removed.

[0036] The calculation unit calculates the benefit value of each querying party based on the benefit calculation algorithm, specifically including: Calculating the data availability of each querying party after executing the joint desensitization policy; Calculating the privacy risk value of each querying party after executing the joint desensitization policy; Performing a weighted sum of the data availability and the privacy risk value of each querying party to obtain the benefit value of each querying party, where the weight coefficient of the data availability is positive and the weight coefficient of the privacy risk value is negative. The specific weight coefficients are set by those skilled in the art based on actual requirements. The benefit value is used to quantify the satisfaction degree of any joint desensitization policy for each querying party, and its core goal is to balance the data availability after desensitization and prevent the leakage of sensitive information.

[0037] The benefit calculation algorithm further includes calculating the data availability of any querying party, specifically including: Calculating and summing the data availability of each field to obtain the data availability of the querying party; among them, the method of calculating the data availability of any field includes: calculating the statistical error after field desensitization and normalizing it; the calculation unit is also configured with an error threshold for each querying party for each field; dividing the normalized value of the statistical error of each field by the error threshold corresponding to the field to obtain an error rate; the data availability of the field is 1 minus the error rate. The greater the statistical error after desensitization, the higher the degree of data distortion and the worse the availability. For example, for the HR department, the error threshold for performance is 0.8; for senior executives, the error threshold for performance is 0.6; the larger the error threshold, the greater the error allowed to be introduced by the desensitization operation, that is, the lower the requirement for data accuracy. If the normalized value of the statistical error after performance desensitization is 0.2, then for the HR department, the calculated data availability is 0.75; for senior executives, the calculated data availability is 0.67; therefore, the availability of the desensitized field for the HR department is higher, that is, the lower the requirement for data accuracy and the higher the data availability, and at the same time, the higher the statistical error after desensitization, the lower the data availability.

[0038] The preferred method for calculating the statistical error after field desensitization in this embodiment includes: For numerical fields, such as performance scores and salaries, calculate the numerical error rate caused by desensitization as its statistical error. For example, if the average performance score of the original data is 85 points and the expected value of the performance after desensitization is 83 points, then the statistical error of the performance score is the absolute value of (85 minus 83) divided by 85.

[0039] For categorical fields, calculate the Jensen-Shannon divergence (JSD) of the class distributions before and after desensitization as its statistical error. For example, for the department, the original distribution is that the proportion of the number of people in the sales department is 0.3, the proportion of the number of people in the technical department is 0.5, and the proportion of the number of people in the marketing department is 0.2. After desensitizing the department to the large region, the distribution after desensitization is that the proportion of the number of people in the East China region is 0.55 and the proportion of the number of people in the West China region is 0.45. Calculate the JSD between the original distribution and the distribution after desensitization as the statistical error after desensitization of the department.

[0040] For text fields, calculate the ratio of the entropy value of the field after desensitization to the entropy value of the field before desensitization as its statistical error. For example, the original value of the reward and punishment record is "Annual Excellent Employee Award, Quarterly Sales Champion", and the value after desensitization is "Received company awards". Calculate the entropy values of the reward and punishment record before and after desensitization based on the Shannon entropy formula respectively, so as to obtain the statistical error of this field.

[0041] The revenue calculation algorithm further includes calculating the privacy risk value of any query party, specifically including: Calculate the privacy risk value of each field after desensitization and sum them to obtain the privacy risk value of the query party. Among them, the privacy risk value of any field is the ratio of the sensitivity of the query party to the field to the desensitization intensity level of the field. The higher the sensitivity, the higher the requirement for the privacy protection of the relevant field; the higher the desensitization intensity level, the lower the risk of privacy leakage.

[0042] The joint optimization unit generates the Pareto front of the joint desensitization strategy based on the revenue value of each query party, specifically including: Generate the revenue value sequence of each joint desensitization strategy; the revenue value sequence includes the revenue value of each query party in the joint desensitization strategy; For any two revenue value sequences P and Q, if each revenue value in P is not less than the corresponding item in Q, and at least one revenue value in P is greater than the corresponding item in Q, then P is the dominant solution of Q, and P is the non-dominated solution; if P has no dominant solution, then P is the non-dominated solution; the joint desensitization strategies corresponding to all non-dominated solutions form the Pareto front of the joint desensitization strategy.

[0043] The joint optimization unit selects the joint desensitization strategy based on the Pareto front, specifically including: Obtain the query records of each query party; based on the query records, count the frequency of each query party querying all fields in the risk field combination simultaneously, and select the query party with the highest frequency as the dominant query party of the risk field combination. Based on the sequence of benefit values of each joint desensitization strategy in the Pareto frontier, locate the joint desensitization strategy with the largest benefit value for the dominant query party, and use it as the joint desensitization strategy selected by the joint optimization unit.

[0044] In this embodiment, through the joint optimization of multiple query parties, a corresponding joint desensitization strategy is generated for each risk field combination, so as to allocate the desensitization level intensity of each field to each query party at one time.

[0045] The prior art independently calculates the most favorable desensitization strategy for each query party without considering the needs of other query parties. For the same risk field combination, multiple versions of desensitization strategies need to be generated for different query parties, resulting in an exponential increase in storage costs and the need to maintain multiple sets of desensitization processes. Compared with the joint optimization of this embodiment, the system complexity is higher, and the operation efficiency and maintenance cost are high.

[0046] The desensitization execution module is used to execute the joint desensitization strategy and perform the joint desensitization of the risk field combination for each query party respectively.

[0047] The desensitization execution module includes a desensitization algorithm unit and a strategy execution unit; The desensitization algorithm unit is configured with desensitization algorithms corresponding to each desensitization intensity level; the strategy execution unit is used to respond to the execution of the joint desensitization strategy and perform the joint desensitization of the risk field combination for each query party by calling the corresponding desensitization algorithm.

[0048] Some preferred desensitization algorithms in this embodiment and examples of performing joint desensitization of the risk field combination for query parties are as follows: The query party is the department manager, requesting to view the distribution of the length of service of the top 10% employees in the department's performance. The risk field combination involved is "performance score + length of service + department"; based on the joint desensitization strategy, call the desensitization algorithm to perform joint desensitization on this risk field combination, specifically including: performing a desensitization algorithm with a desensitization intensity level of 3 on the performance score, adding Laplace noise to hide the specific value; performing a desensitization algorithm with a desensitization intensity level of 2 on the length of service, generalizing the length of service to "<3 years", "3 - 5 years", ">5 years"; performing a desensitization algorithm with a desensitization intensity level of 1 on the department, keeping its original value because the query party's permission allows querying within the department.

[0049] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0050] The embodiments of the present application have been described above in conjunction with the accompanying drawings. However, the present application is not limited to the above specific embodiments. The above specific embodiments are merely illustrative and not restrictive. Under the inspiration of the present application, those of ordinary skill in the art can also make many forms without departing from the purpose and scope of the present application. All of these are within the protection scope of the present application.

Claims

1. A dynamic data desensitization system for employee performance appraisal, characterized in that: It includes a field analysis module, a query analysis module, a desensitization policy module, and a desensitization execution module; among which: The field analysis module is used to identify the risk field combinations among the fields of the object data; The query analysis module is used to calculate the sensitivity of each query party to each field in the risk field combination; the query analysis module is also used to obtain the query constraint permissions of each query party, and map the query constraint permissions to the desensitization constraint conditions of each query party for each field; The desensitization policy module synchronously generates a combined desensitization policy for each query party for the risk field combination based on the sensitivity and desensitization constraint conditions of each query party to each field in the risk field combination; The desensitization execution module is used to execute the combined desensitization policy and perform combined desensitization of the risk field combination for each query party respectively.

2. The dynamic data desensitization system for employee performance appraisal according to claim 1, wherein: The field analysis module includes an association combination unit; The association combination unit is configured with an association recognition policy; The association recognition policy is used to identify the associated field combinations among the fields of the object data; specifically including: Obtain the object data set; calculate each marginal probability of each field and each joint marginal probability of any m fields based on the object data set; m is an integer greater than 1; Calculate the mutual information value of any m fields based on each marginal probability of each field and each joint marginal probability of any m fields, and use it as the association value of the corresponding m fields; The association combination unit is also configured with an association threshold; the association recognition policy also includes: if the association value of any m fields is greater than the association threshold, the corresponding m fields are the associated field combinations.

3. The dynamic data desensitization system for employee performance appraisal according to claim 2, wherein: The field analysis module also includes a risk identification unit; The risk identification unit is configured with a risk identification policy; The risk identification policy is used to identify the risk field combinations in the associated field combinations, specifically including: For any associated field combination, count the number of people in all sub - combinations; take the number of people in the sub - combination with the least number of people among all sub - combinations with non - zero number of people as the anonymity degree of the corresponding associated field combination; The risk identification unit is also configured with an anonymity degree threshold; the risk identification policy also includes: if the anonymity degree of any associated field combination is less than the anonymity degree threshold, mark the corresponding associated field combination as a risk field combination.

4. The dynamic data desensitization system for employee performance appraisal according to claim 1, characterized in that: The query analysis module includes a sensitivity unit; The sensitivity unit is used to calculate the sensitivity of each query party to each field in the risk field combination; The way the sensitivity unit calculates the sensitivity of the query party to each field in the risk field combination is as follows: obtain the desensitization operation records of the query party for each field in each risk field combination, and count the proportion of desensitization operation records with a desensitization intensity level of 3 in the desensitization operation records as the sensitivity of the corresponding field; The desensitization intensity levels include level 1, level 2, and level 3, and the larger the value of the desensitization intensity level, the higher the desensitization intensity.

5. The dynamic data desensitization system for employee performance appraisal according to claim 4, characterized in that: The query analysis module also includes a desensitization constraint unit; The desensitization constraint unit is used to obtain the query constraint permissions of each query party; the query constraint permissions are the permission range for the corresponding query party to view the object data; The desensitization constraint unit is further configured to map the query constraint permission to the desensitization constraint conditions of each field for the querying party; the desensitization constraint conditions include the constraint conditions for the desensitization intensity level of the corresponding field. The desensitization constraint unit is configured with a mapping rule; based on the mapping rule, the desensitization constraint unit maps the query constraint permission to the desensitization constraint conditions of each field for the querying party.

6. The dynamic data desensitization system for employee performance appraisal according to claim 1, wherein: The desensitization policy module includes a joint optimization unit and a calculation unit; wherein, the calculation unit is configured with a revenue calculation algorithm; the joint optimization unit is used to construct a set of joint desensitization policies; the calculation unit calculates the revenue value of each querying party in each joint desensitization policy based on the revenue calculation algorithm; the joint optimization unit generates the Pareto frontier of the joint desensitization policies based on the revenue values of each querying party, and selects a joint desensitization policy based on the Pareto frontier. The set of joint desensitization policies includes all joint desensitization policies; any one joint desensitization policy includes specifying the desensitization risk level of each field in the risk field combination for each querying party. The joint optimization unit obtains the desensitization constraint conditions of each field for the querying party, and prunes the set of joint desensitization policies to eliminate the joint desensitization policies that do not meet the desensitization constraint conditions.

7. The dynamic data desensitization system for employee performance appraisal according to claim 6, characterized in that: The calculation unit calculates the revenue value of each querying party based on the revenue calculation algorithm, specifically including: Calculating the data availability of each querying party after executing the joint desensitization policy. Calculating the privacy risk value of each querying party after executing the joint desensitization policy. Performing a weighted sum of the data availability and the privacy risk value of each querying party to obtain the revenue value of each querying party, wherein the weight coefficient of the data availability is positive and the weight coefficient of the privacy risk value is negative.

8. The dynamic data desensitization system for employee performance appraisal according to claim 7, wherein: The revenue calculation algorithm further includes calculating the data availability of any querying party, specifically including: Calculating and summing the data availability of each field to obtain the data availability of the querying party; wherein, the method of calculating the data availability of any field includes: calculating the statistical error after field desensitization and normalizing it; the calculation unit is also configured with an error threshold for each querying party for each field; dividing the normalized value of the statistical error of each field by the error threshold of the corresponding field to obtain an error rate; the data availability of the field is 1 minus the error rate. The revenue calculation algorithm further includes calculating the privacy risk value of any querying party, specifically including: Calculating and summing the privacy risk values of each field after desensitization to obtain the privacy risk value of the querying party; wherein, the privacy risk value of any field is the ratio of the sensitivity of the querying party to the field to the desensitization intensity level of the field.

9. The dynamic data desensitization system for employee performance appraisal according to claim 6, characterized in that: The joint optimization unit generates the Pareto frontier of the joint desensitization policies based on the revenue values of each querying party, specifically including: Generating a revenue value sequence for each joint desensitization policy; the revenue value sequence includes the revenue values of each querying party in the joint desensitization policy. For any two sequences of benefit values P and Q, if each benefit value in P is not less than the corresponding item in Q, and at least one benefit value in P is greater than the corresponding item in Q, then P is the dominant solution of Q and P is the non-dominated solution; if P has no dominant solution, then P is the non-dominated solution; the combined desensitization strategies corresponding to all non-dominated solutions constitute the Pareto front of the combined desensitization strategy. The joint optimization unit is further configured to obtain the query records of each query party; based on the query records, count the frequency of each query party querying all fields in the risk field combination simultaneously, and select the query party with the highest frequency as the dominant query party of the risk field combination. Based on the sequence of benefit values of each combined desensitization strategy in the Pareto front, locate the combined desensitization strategy with the largest benefit value of the dominant query party as the combined desensitization strategy selected by the joint optimization unit.

10. The dynamic data desensitization system for employee performance appraisal according to claim 1, characterized in that: The desensitization execution module includes a desensitization algorithm unit and a policy execution unit. The desensitization algorithm unit is configured with desensitization algorithms corresponding to each desensitization intensity level. The policy execution unit is configured to respond to and execute the combined desensitization strategy, and perform combined desensitization of the risk field combination for each query party by calling the corresponding desensitization algorithm.

Images