A data anonymization method, electronic device and medium

Abstract

This invention discloses a data anonymization method, electronic device, and computer-readable medium, relating to the field of data protection technology. The method includes: acquiring raw data; performing privacy processing on the raw data using multiple pre-defined privacy processing parameters to obtain privacy-processed data, and sending the privacy processing parameters to a management platform with administrative authority; extracting risk features from the privacy-processed data to obtain risk feature representation data, and sending relevant parameters of the risk feature representation data to the management platform; performing anonymization processing on the raw data based on the risk feature representation data, and outputting anonymized data. The anonymized data can be reversed using the privacy processing parameters and relevant parameters of the risk feature representation data stored in the management platform to obtain the original data. This invention has the advantages and characteristics of balancing data privacy protection and risk identification, and providing controllable and reversible anonymization of the de-anonymized data.

Description

Technical Field

[0001] This invention relates to the field of data protection technology, and in particular to a data desensitization method, electronic device, and medium. Background Art

[0002] Financial institutions need to protect user data privacy while conducting in-depth analysis to identify potential risks. Privacy protection requires limiting the processing and analysis of user data, while risk identification necessitates comprehensive and in-depth analysis of user data.

[0003] Current data privacy protection technologies (such as data at rest masking, K-anonymity, traditional differential privacy, and federated learning) can protect user data to varying degrees, but their data usability and usability are poor, resulting in low risk identification capabilities. Summary of the Invention

[0004] This invention aims to address, to a certain extent, one of the technical problems in related technologies. To this end, this invention provides a data anonymization method, an electronic device for performing the data anonymization method, and a computer-readable medium, which has the advantages of balancing data privacy protection and risk identification.

[0005] To achieve the above objectives, as a first aspect of the present invention, a data desensitization method is provided, wherein the data desensitization method includes:

[0006] Obtain the raw data;

[0007] The original data is processed using multiple predefined privacy processing parameters to obtain privacy-processed data, and the privacy processing parameters are sent to a management platform with management authority.

[0008] Extract risk features from the privacy-processing data to obtain risk feature representation data of the privacy-processing data, and send the relevant parameters of the risk feature representation data to the management platform;

[0009] The original data is anonymized based on the risk feature representation data, and the anonymized data is output. The anonymized data can be reversed using the privacy processing parameters and relevant parameters of the risk feature representation data stored in the management platform to obtain the original data.

[0010] Optionally, the step of de-identifying the original data based on the risk feature representation data and outputting the de-identified data includes:

[0011] The risk level and desensitization rules are determined based on the data complexity of the data represented by the risk characteristics; wherein, the desensitization rules correspond one-to-one with the risk levels;

[0012] Using the risk level as a guiding condition, the original data is desensitized according to the desensitization rules corresponding to the risk level to obtain desensitized data;

[0013] The desensitization quality score is determined based on the information entropy of the desensitized data and the information entropy of the original data.

[0014] If the desensitization quality score is greater than or equal to the preset desensitization quality threshold, the desensitized data is output.

[0015] Optionally, the privacy processing parameters include an initial privacy budget parameter, an adjusted privacy budget parameter, and a noise parameter, wherein the initial privacy budget parameter corresponds one-to-one with the sensitivity level of the original data;

[0016] The process of performing privacy processing on the original data using multiple predefined privacy processing parameters to obtain privacy-processed data includes:

[0017] The adjusted privacy budget parameters are determined based on the sensitivity level and the corresponding initial privacy budget parameters.

[0018] The noise parameters are determined based on the sensitivity level.

[0019] The original data is noise-added using the noise parameter, the adjusted privacy budget parameter, and the sensitivity level to obtain privacy-processed data.

[0020] Optionally, the noise parameters include noise type, and determining the noise parameters based on the sensitivity level includes:

[0021] When the sensitivity level is high, the noise type includes Laplace noise;

[0022] When the sensitivity level is medium, the noise type includes Laplace noise or Gaussian noise;

[0023] When the sensitivity level is low, the noise type includes Gaussian noise.

[0024] Optionally, the step of adding noise to the original data using the noise parameter, the adjusted privacy budget parameter, and the sensitivity level to obtain privacy-processed data includes:

[0025] When the noise parameter is Laplace noise, the adjusted privacy budget parameter and the sensitivity level are input into the Laplace noise function, and the Laplace noise function is added to the original data to obtain the privacy-processed data after Laplace noise addition.

[0026] When the noise parameter is Gaussian noise, the adjusted privacy budget parameter, the sensitivity level, and the calibration constant are input into the Gaussian noise function, and the Gaussian noise function is added to the original data to obtain the privacy-processed data after Gaussian noise addition.

[0027] Optionally, the noise parameters further include the amplitude of the noise type and the standard deviation of the noise type, and the data anonymization method further includes:

[0028] The noise range ratio is determined based on the standard deviation of the noise type and a preset data range;

[0029] The noise accuracy ratio is determined based on the standard deviation of the noise type and the preset data accuracy.

[0030] The amplitude of the noise type is adjusted according to the noise range ratio and the noise precision ratio so that the noise range ratio is within a preset range factor and the noise precision ratio is within a preset precision factor.

[0031] Optionally, the risk feature representation data includes a fused risk feature vector and a risk prediction value. Extracting risk features from the privacy-processing data to obtain the risk feature representation data of the privacy-processing data includes:

[0032] The privacy-processing data is preprocessed according to preset standardized processing rules to obtain standard privacy-processing data;

[0033] The standard privacy-processing data is input into feature engineering to obtain multi-dimensional enhanced features;

[0034] The multi-dimensional enhanced features are input into the traditional risk feature model and the deep learning risk feature model respectively to obtain traditional risk features and potential risk features;

[0035] The traditional risk features and the potential risk features are fused to generate a fused risk feature vector and a risk prediction value.

[0036] Optionally, the step of fusing the traditional risk features and the potential risk features to generate a fused risk feature vector and a risk prediction value further includes:

[0037] The feature quality score of the fusion risk feature is determined according to the preset feature evaluation rules;

[0038] If the feature quality score is less than or equal to a preset feature quality threshold, the feature quality score is input into the feature engineering process to guide the feature engineering process to re-extract the target.

[0039] Multi-dimensional enhanced features corresponding to quasi-privacy-processed data;

[0040] If the feature quality score is greater than the preset feature quality threshold, the fused risk feature vector and risk prediction value are output.

[0041] As a second aspect of the present invention, an electronic device is provided, comprising:

[0042] one or more processors;

[0043] A memory having stored one or more computer programs that, when executed by one or more processors, cause the one or more processors to implement the data desensitization method provided according to the first aspect of the invention.

[0044] Furthermore, as a third aspect of the present invention, a computer-readable medium is provided having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the data desensitization method provided in the first aspect of the present invention.

[0045] The data anonymization method provided by this invention applies different levels of privacy processing to the original data according to different privacy processing parameters, then extracts the risk features of the privacy-processed data, and uses these risk features as conditions for precise anonymization of the original data. Throughout the anonymization process, the privacy of the original data is protected, while also ensuring the targeted identification of potentially risky data without excessive data usage. Furthermore, the entire data anonymization method synchronously sends the operation parameters and feature data of each processing step to a management platform with administrative permissions. The anonymized data can then be reverse-anonymized based on the privacy processing parameters and risk feature representation parameters stored on the management platform, restoring the original data. This data anonymization method combines tiered anonymization processing with dynamic risk assessment, satisfying data privacy protection requirements while maximizing the preservation of data's analytical value. Simultaneously, a robust operation log mechanism provides reliable guarantees for data recovery and auditing, making it particularly suitable for scenarios requiring a balance between data security and business analysis.

[0046] These features and advantages of the present invention will be disclosed in detail in the following specific embodiments and accompanying drawings. The preferred embodiments or means of the present invention will be shown in detail in conjunction with the accompanying drawings, but are not intended to limit the technical solutions of the present invention. In addition, each of these features, elements and components appearing in the following text and drawings is a plurality of, and different symbols or numbers are used for convenience of representation, but all represent parts with the same or similar construction or function. Attached Figure Description

[0047] The present invention will be further described below with reference to the accompanying drawings:

[0048] Figure 1A flowchart of a data desensitization method provided by the present invention;

[0049] Figure 2 A flowchart illustrating one embodiment of step S140 of the data desensitization method provided by the present invention;

[0050] Figure 3 A flowchart illustrating another embodiment of step S120 of the data desensitization method provided by the present invention;

[0051] Figure 4 A flowchart illustrating another embodiment of step S122 of the data desensitization method provided by the present invention;

[0052] Figure 5 A flowchart illustrating another embodiment of step S123 of the data desensitization method provided by the present invention;

[0053] Figure 6 A flowchart illustrating another embodiment of step S120 of the data desensitization method provided by the present invention;

[0054] Figure 7 A flowchart illustrating another embodiment of step S130 of the data desensitization method provided by the present invention;

[0055] Figure 8 A flowchart illustrating another embodiment of step S134 of the data desensitization method provided by the present invention;

[0056] Figure 9 This is a system framework diagram corresponding to the data desensitization method provided by the present invention;

[0057] Figure 10 A flowchart of the layered differential privacy module provided in the system framework diagram of this invention;

[0058] Figure 11 The flowchart of the risk feature extraction and representation learning module in the system framework diagram provided by this invention;

[0059] Figure 12 The flowchart of the risk analysis and privacy protection balance module provided by this invention;

[0060] Figure 13 A module diagram of an electronic device provided by the present invention;

[0061] Figure 14 This invention provides a schematic diagram of a computer-readable medium.

[0062] Explanation of reference numerals in the attached figures

[0063] Among them, 101 is the processor; 102 is the memory; 103 is the I / O interface; and 104 is the bus. Detailed Implementation

[0064] Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described are intended to explain the present invention and should not be construed as limiting the invention.

[0065] The terms "an embodiment," "example," or "trademark" used in this specification refer to a particular feature, structure, or characteristic described in connection with the embodiment itself that may be included in at least one embodiment disclosed in this invention. The phrase "in an embodiment" appearing in various places throughout the specification does not necessarily refer to the same embodiment.

[0066] Currently, existing data privacy protection technologies typically employ uniform privacy parameters to mechanically protect data. This leads to the overprotection of some data that has practical value but is weakly related to user privacy, further resulting in a decline in risk identification capabilities. Alternatively, the strength of privacy protection may be reduced in order to improve the accuracy of risk identification. In addition, most of the de-identification operations performed by existing data privacy protection technologies are irreversible, which cannot meet the compliance requirements for restoring the original data in authorized scenarios.

[0067] In view of this, in order to resolve the technical contradiction between data privacy protection and risk identification, and the problem that de-identified data cannot be restored to the original data, as a first aspect of the present invention, a data de-identification method is provided, such as... Figure 1 As shown, the data anonymization method includes:

[0068] In step S110, the raw data is obtained;

[0069] In step S120, the original data is processed using multiple set privacy processing parameters to obtain privacy-processed data, and the privacy processing parameters are sent to the management platform, which has management authority.

[0070] In step S130, risk features are extracted from the privacy processing data to obtain risk feature representation data of the privacy processing data, and the relevant parameters of the risk feature representation data are sent to the management platform.

[0071] In step S140, the original data is de-identified based on the risk feature representation data, and the de-identified data is output. The de-identified data can be reversed using the privacy processing parameters and relevant parameters of the risk feature representation data stored in the management platform to obtain the original data.

[0072] The data anonymization method provided by this invention applies different levels of privacy processing to the original data according to different privacy processing parameters, then extracts the risk features of the privacy-processed data, and uses these risk features as conditions for precise anonymization of the original data. Throughout the anonymization process, the privacy of the original data is protected, while also ensuring the targeted identification of potentially risky data without excessive data usage. Furthermore, the entire data anonymization method synchronously sends the operation parameters and feature data of each processing step to a management platform with administrative permissions. The anonymized data can then be reverse-anonymized based on the privacy processing parameters and risk feature representation parameters stored on the management platform, restoring the original data. This data anonymization method combines tiered anonymization processing with dynamic risk assessment, satisfying data privacy protection requirements while maximizing the preservation of data's analytical value. Simultaneously, a robust operation log mechanism provides reliable guarantees for data recovery and auditing, making it particularly suitable for scenarios requiring a balance between data security and business analysis.

[0073] The above-described desensitization process is described in detail as an optional implementation of step S140, such as... Figure 2 As shown, the step of de-identifying the original data based on the risk feature representation data and outputting the de-identified data includes:

[0074] In step S141, the risk level and de-identification rules are determined based on the data complexity of the risk feature representation data; wherein, the de-identification rules correspond one-to-one with the risk level.

[0075] In step S142, the risk level is used as a guiding condition, and the original data is de-identified according to the de-identification rules corresponding to the risk level to obtain de-identified data;

[0076] In step S143, the desensitization quality score is determined based on the information entropy of the desensitized data and the information entropy of the original data;

[0077] In step S144, if the desensitization quality fraction is greater than or equal to a preset desensitization quality threshold, the desensitized data is output.

[0078] Steps S141-S144 above illustrate the execution flow of the de-identification operation on the original data. Before the de-identification operation, the risk level and de-identification rules can be determined based on the data complexity of the risk feature representation data. The calculation of data complexity can be carried out from dimensions such as the number of features representing the risk feature data (the more features, the higher the data complexity; the fewer features, the lower the data complexity) and the data distribution of the risk feature representation data (the data distribution is determined by calculating the entropy value; the higher the entropy, the more complex the data distribution; the lower the entropy, the simpler the data distribution). In practical applications, the calculation methods include, but are not limited to, the complexity of the number of features and the complexity of the data distribution, and need to be flexibly adjusted in combination with computing resources, computing time complexity, and the accuracy of data complexity. The de-identification rules correspond to the risk level. For high-risk data, key-based symmetric encryption de-identification, format-preserving encryption mechanisms, reversible tokenization, and differential privacy-enhanced partial-preservation de-identification can be used; for medium-risk data, differential privacy-enhanced partial-preservation de-identification can be used; for low-risk data, general encryption algorithms can be used. It should be noted that the above de-identification rules for different risk levels can be flexibly adjusted or other de-identification rules can be used in practical applications. However, after using the desensitization rules to desensitize the data, it is necessary to evaluate the desensitization effect (such as calculating the change in information entropy of the data before and after desensitization in step S143) and output desensitized data that meets the desensitization quality requirements.

[0079] Any reverse data masking operations related to the aforementioned data masking must be performed with explicit authorization. Authorization can be granted by a management platform with administrative privileges to ensure the high privacy of the reverse data masking operations, thereby further enhancing the security of both data masking and reverse data masking.

[0080] Similarly, to specifically protect the original data and reduce the over-protection or under-protection issues that occur in traditional data protection methods, this invention provides a hierarchical differential privacy protection mechanism to determine privacy processing parameters. These parameters include an initial privacy budget parameter, an adjusted privacy budget parameter, and a noise parameter. The initial privacy budget parameter corresponds one-to-one with the sensitivity level of the original data. As one implementation of step S120, for example... Figure 3 As shown, the process of performing privacy processing on the original data using multiple set privacy processing parameters to obtain privacy-processed data includes:

[0081] In step S121, the adjusted privacy budget parameter is determined based on the sensitivity level and the corresponding initial privacy budget parameter;

[0082] In step S122, noise parameters are determined based on the sensitivity level;

[0083] In step S123, the original data is noise-added using the noise parameter, the adjusted privacy budget parameter, and the sensitivity level to obtain privacy-processed data.

[0084] First, the raw data is classified, and then the sensitivity level is determined based on the classification results. Different privacy processing parameters are used for data with different sensitivity levels. Finally, the raw data is processed specifically according to the privacy processing parameters. It is worth noting that, as a classification method, raw data can be divided into categories such as personal identity information (e.g., name, ID number, contact information), financial transaction information (e.g., account balance, transaction records, credit limit), behavioral characteristic information (e.g., consumption habits, location information, device information), and derivative risk information (e.g., credit score, risk level, probability of default, etc.). Similarly, a sensitivity level can be determined according to the following formula (1):

[0085] (1)

[0086] In the above formula (1), This is a data identifiability indicator used to measure whether data can uniquely identify an individual; its value ranges from [0,1]. This is a data sensitivity indicator used to measure the potential harm caused by data breaches, with a value range of [0,1]. This is a data timeliness indicator used to measure the effective duration of data, with a value range of [0,1]. This is a data correlation index used to measure the degree of correlation between data and other data, with a value range of [0,1]. This is a regulatory requirement indicator used to measure the protection requirements of data under regulations, with a value range of [0,1].

[0087] to For the corresponding weights, and satisfying S represents the sensitivity score, used to determine the sensitivity level. S ≥ 0.7 indicates high-sensitivity data, requiring the strictest privacy protection; 0.3 ≤ S < 0.7 indicates medium-sensitivity data, requiring moderate privacy protection; and S < 0.3 indicates low-sensitivity data, requiring basic privacy protection. It's important to note that the weights used to determine the sensitivity level based on the sensitivity score can be automatically adjusted according to external changes, and the sensitivity level can be dynamically adjusted based on data usage frequency and context. Data sensitivity needs to be reassessed periodically to adapt to data changes. Furthermore, machine learning algorithms can be used to analyze historical data usage patterns to predict sensitivity trends.

[0088] After the original data is divided into three levels—high-sensitivity, medium-sensitivity, and low-sensitivity—through the above classification operation, different initial privacy budget parameters are assigned to different sensitivity levels. The correspondence between the initial privacy budget parameters and the sensitivity levels is given by formula (2):

[0089] (2)

[0090] In formula (2), These correspond to highly sensitive data, moderately sensitive data, and low sensitive data, respectively. Set the initial privacy budget parameter; for highly sensitive data, set a smaller initial privacy budget parameter. For moderately sensitive data, set a moderate initial privacy budget parameter. For low-sensitivity data, set a larger initial privacy budget parameter. Furthermore, the initial privacy budget parameters can be set jointly based on sensitivity level, data type, and use case.

[0091] After setting the initial privacy budget parameters, dynamic adjustments are needed based on the sensitivity level to obtain the adjusted privacy budget parameters. For highly sensitive fields, a conservative adjustment is performed according to formula (3):

[0092] (3)

[0093] in, Initial privacy budget parameters for highly sensitive fields, For data distribution characteristic factors, For correlation factors between fields, The adjusted privacy budget parameters are for highly sensitive fields; a conservative adjustment is made according to formula (3), which allows for fine-tuning based on data characteristics while ensuring strict privacy protection. For moderately sensitive fields, a balanced adjustment is made according to formula (4):

[0094] (4)

[0095] in, For the initial privacy budget parameters corresponding to sensitive fields, For business importance factors, For data distribution characteristic factors, The adjusted privacy budget parameters are for medium-sensitivity fields; a balanced adjustment is made according to formula (4) to achieve a balance between privacy protection, business needs, and data availability. For low-sensitivity fields, a lenient adjustment is made according to formula (5):

[0096] (5)

[0097] in, For the initial privacy budget parameters corresponding to low-sensitivity fields, For risk tolerance factor, The adjusted privacy budget parameters are for low-sensitivity fields; a lenient adjustment is made according to formula (5), which can prioritize the availability of data based on the acceptable level of risk.

[0098] To ensure accurate privacy protection of the original data, it is necessary to first determine the type of noise before injecting it into the original data. As one implementation method for step S122, for example... Figure 4 As shown, the noise parameters include noise type, and determining the noise parameters based on the sensitivity level includes:

[0099] In step S122a, when the sensitivity level is high sensitivity, the noise type includes Laplace noise;

[0100] In step S122b, when the sensitivity level is medium sensitivity, the noise type includes Laplace noise or Gaussian noise;

[0101] In step S122c, when the sensitivity level is low, the noise type includes Gaussian noise.

[0102] After determining the type of noise to be injected based on the sensitivity level, the original data is noise-added using the noise parameters, the adjusted privacy budget parameters, and the sensitivity level to obtain privacy-processed data. This is an optional implementation of step S123, such as... Figure 5 As shown, it includes:

[0103] In step S123a, when the noise parameter is Laplace noise, the adjusted privacy budget parameter and the sensitivity level are input to the Laplace noise function, and the Laplace noise function is added to the original data to obtain the privacy-processed data after Laplace noise addition.

[0104] In step S123b, when the noise parameter is Gaussian noise, the adjusted privacy budget parameter, the sensitivity level, and the calibration constant are input into the Gaussian noise function, and the Gaussian noise function is added to the original data to obtain the privacy-processed data after Gaussian noise addition.

[0105] The noise injection process requires detailed explanation as follows: Laplace noise injection and Gaussian noise injection are shown in equations (6) and (7), respectively:

[0106] (6)

[0107] (7)

[0108] In formulas (6) and (7), S is the sensitivity, ε is the adjusted privacy budget parameter, c is the calibration constant, and X is the original data. This is the privacy-processed data after noise has been added.

[0109] To further protect the original data, the noise parameters also include the amplitude of the noise type and the standard deviation of the noise type, such as... Figure 6 As shown, the data anonymization method further includes:

[0110] In step S122a, the noise range ratio is determined based on the standard deviation of the noise type and the preset data range;

[0111] In step S122b, the noise accuracy ratio is determined based on the standard deviation of the noise type and the preset data accuracy.

[0112] In step S122c, the amplitude of the noise type is adjusted according to the noise range ratio and the noise precision ratio, so that the noise range ratio is within a preset range factor and the noise precision ratio is within a preset precision factor.

[0113] Special notes are needed regarding the range factor and precision factor. The range factor ensures that the noise amplitude is appropriate for the data range. Its calculation methods include, but are not limited to, the relative noise ratio method: Noise Ratio = Noise Standard Deviation / Data Range. When the noise ratio is <0.01, the noise may be too low, resulting in insufficient privacy protection; when 0.01 ≤ Noise Ratio ≤ 0.1, it is generally considered appropriate; when the noise ratio is >0.1, the noise may be too high, impairing data usability. It is generally recommended that the noise ratio be controlled between 0.01 and 0.1, depending on privacy requirements. The precision factor ensures that noise does not excessively affect data precision. Its calculation methods include, but are not limited to, the precision threshold comparison method: Precision Impact Ratio = Noise Standard Deviation / Data Precision Requirement. When the precision impact ratio is <0.5, the noise does not significantly affect precision; when 0.5 ≤ Precision Impact Ratio <1, the noise is close to the boundary affecting precision; when the precision impact ratio is ≥1, the noise has excessively affected precision.

[0114] The completion of noise injection marks the completion of the hierarchical differential privacy protection mechanism, and outputs privacy-processed data for subsequent operations. This privacy-processed data has the same data format as the original data. During the implementation of hierarchical differential, privacy parameters, noise types, and other information are recorded and sent to the management platform.

[0115] Extracting risk feature information from privacy-processing data requires the use of parallel traditional risk feature models and deep learning risk feature models. As an optional implementation method for step S130, such as... Figure 7 As shown, the risk feature representation data includes a fused risk feature vector and a risk prediction value. The step of extracting risk features from the privacy-processing data to obtain the risk feature representation data of the privacy-processing data includes:

[0116] In step S131, the privacy processing data is preprocessed according to preset standardized processing rules to obtain standard privacy processing data;

[0117] In step S132, the standard privacy processing data is input into feature engineering to obtain multi-dimensional enhanced features;

[0118] In step S133, the multi-dimensional enhanced features are input into the traditional risk feature model and the deep learning risk feature model respectively to obtain traditional risk features and potential risk features;

[0119] In step S134, the traditional risk features and the potential risk features are fused to generate a fused risk feature vector and a risk prediction value.

[0120] To better extract risk feature information, the standardization processing rules in step S131 include, but are not limited to, missing value imputation, outlier handling, and data format unification, to prepare data for subsequent feature processing. The preprocessed data enters step S132 for multi-dimensional feature transformation and enhancement. Feature engineering includes, but is not limited to, one or more combined operations such as temporal feature extraction, relational feature construction, interaction feature generation, categorical feature encoding, and feature binning. The output of feature engineering is simultaneously fed into both the traditional risk feature model and the deep learning risk feature model. In step S133, the traditional risk feature model and the deep learning risk feature model, as parallel models, simultaneously acquire the output of feature engineering. The traditional risk feature model extracts highly interpretable features, including but not limited to principal component analysis, independent component analysis, and linear discriminant analysis. The deep learning risk feature model extracts highly abstract and compact latent feature representations to capture nonlinear patterns and higher-order relationships in the data. The deep learning risk feature model includes, but is not limited to, variational autoencoder construction, latent space regularization, adversarial training enhancement, attention mechanism integration, and representation compression and noise reduction operations. Step S134 fuses traditional features and deep learning features to generate a comprehensive risk feature vector. The fusion methods include, but are not limited to, weighted fusion, stacked fusion, attention fusion, multi-view consistency learning, heterogeneous graph fusion, etc.

[0121] To improve the accuracy of risk prediction, a quality assessment of the risk feature vector is required before using the fused risk feature vector for risk identification and prediction. As one implementation of step S134, such as... Figure 8As shown, the step of fusing the traditional risk features and the potential risk features to generate a fused risk feature vector and a risk prediction value further includes:

[0122] In step S134a, the feature quality score of the fusion risk feature is determined according to the preset feature evaluation rules;

[0123] In step S134b, if the feature quality score is less than or equal to a preset feature quality threshold, the feature quality score is input to the feature engineering to guide the feature engineering to re-extract the multi-dimensional enhanced features corresponding to the standard privacy processing data.

[0124] In step S134c, if the feature quality score is greater than the preset feature quality threshold, the fused risk feature vector and risk prediction value are output.

[0125] It is necessary to provide a detailed explanation of the quality assessment rules, which include, but are not limited to, information gain assessment, stability testing, multicollinearity detection, robustness testing, and interpretability assessment.

[0126] Furthermore, the multiple processing steps of the data desensitization method provided by the present invention can be integrated into multiple modules, and the relationship between the multiple modules also constitutes the system corresponding to the data desensitization method provided by the present invention. Figure 9A system diagram of the data anonymization method provided by this invention is given. In this system, the original customer data is first sent to the data classification and sensitivity assessment module, which classifies and identifies the sensitivity level according to a preset sensitivity level determination method, and outputs the sensitivity classification result (customer data with sensitivity labels). The customer data with sensitivity labels is then input to the hierarchical differential privacy framework module. This module applies differential privacy protection algorithms of corresponding strength according to different sensitivity levels, and outputs differential privacy-processed data. The differential privacy-processed data does not contain customer privacy information and can be accessed and used normally. The differential privacy-processed data is then input to the risk feature extraction and representation learning module. This module extracts and represents the risk features from the differential privacy framework module. Key risk features are extracted from the privacy-processed data and feature representations are generated. The resulting risk feature representations, also free of customer privacy information, are accessible and usable. Both the risk feature representations and the original data are input into a controllable and reversible desensitization module. The original data can be desensitized according to its sensitivity level, and the risk feature representations can also be used as a guiding condition to desensitize the original data, outputting desensitized data. It is important to note that all operations involving the desensitization of sensitive customer information, as well as reverse desensitization operations, can only be executed under the authorization of the security authorization and control module. Every operation during execution is recorded to ensure the compliance, traceability, and data security of the desensitization process. The desensitized data and its risk feature prediction accuracy are input into a risk analysis and privacy protection balance module to evaluate the risk identification capability and privacy protection level under the current parameter settings. Optimization feedback parameters are then output to the hierarchical differential privacy framework module and the risk feature extraction and representation learning module to adjust the differential privacy parameters and feature representation parameters respectively, achieving a dynamic balance between risk identification capability and privacy protection level. The security audit module monitors the entire processing flow, records the operation logs of each module, ensures that all data processing activities in the system are traceable and auditable, and generates compliance audit reports. This module adopts a distributed log collection architecture, capturing operation events of each functional module in real time, including but not limited to user login / logout behavior, data access requests, de-identification operations, permission changes, and system configuration modifications. The collected audit data is tamper-proofed and stored in a dedicated security audit database, with a data integrity verification mechanism applied to ensure the authenticity and integrity of the log data. This module can automatically generate multi-dimensional audit reports, including data processing compliance reports, privacy protection assessment reports, and security incident analysis reports, supporting visualization and export functions. All audit records are retained for periods in accordance with relevant regulations and strict access controls are implemented to ensure the security and confidentiality of the audit data itself. Figure 9One embodiment of this approach involves financial institutions achieving a balance between customer data privacy protection and risk identification capabilities through the following steps: The system receives raw customer data containing personal identification information, transaction records, and behavioral characteristics. The data is then categorized into high, medium, and low sensitivity levels via a data classification and sensitivity assessment module. For high-sensitivity data (such as ID numbers and bank accounts), the system employs strict differential privacy parameters; for medium-sensitivity data (such as age ranges and occupational categories), it uses moderately strong privacy protection parameters; and for low-sensitivity data (such as consumption preferences and transaction frequency), it uses lenient privacy protection parameters. The processed data undergoes risk feature extraction via a deep autoencoder network, retaining over 95% of the risk prediction capability while simultaneously achieving data dimensionality reduction. Subsequently, the system employs a controllable and reversible de-identification mechanism based on homomorphic encryption to ensure that the original information can be restored through a distributed key management system in authorized scenarios (such as regulatory inspections and judicial investigations). The de-identified data and feature prediction accuracy information are then fed into a risk analysis and privacy protection balancing module, which dynamically adjusts the differential privacy parameters using a multi-objective optimization algorithm. Ultimately, this achieves a maximized balance between customer privacy data protection and risk identification capabilities. The detailed flowcharts of the hierarchical differential privacy module, risk feature extraction and representation learning module, and risk analysis and privacy protection balance module in the system diagram are as follows: Figure 10 , 11 12.

[0127] As a second aspect of the present invention, an electronic device is provided, such as... Figure 13 As shown, it includes:

[0128] One or more processors 101;

[0129] The memory 102 stores one or more computer programs that, when executed by the one or more processors 101, cause the one or more processors 101 to implement the data desensitization method provided according to the first aspect of the present invention.

[0130] The tool may also include one or more I / O interfaces 103 connected between the processor 101 and the memory 102, configured to enable information interaction between the processor 101 and the memory 102.

[0131] The processor 101 is a device with data processing capabilities, including but not limited to a central processing unit 101 (CPU); the first memory 102 is a device with data storage capabilities, including but not limited to random access memory 102 (RAM, more specifically SDRAM, DDR, etc.), read-only memory 102 (ROM), electrically erasable programmable read-only memory 102 (EEPROM), and flash memory (FLASH); the I / O interface 103 (read-write interface) is connected between the processor 101 and the memory 102, enabling information interaction between the processor 101 and the memory 102, including but not limited to a data bus 104 (Bus).

[0132] In some embodiments, the processor 101, memory 102, and I / O interface 103 are interconnected via bus 104, and thus connected to other components of the computing device.

[0133] Furthermore, as a third aspect of the present invention, a computer-readable medium is also provided having a computer program stored thereon, such as... Figure 14 As shown, when the computer program is executed by the processor, it implements the data desensitization method provided in the first aspect of the present invention.

[0134] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. Accordingly, the computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can implement the methods of any of the above embodiments. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0135] The above are merely specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Those skilled in the art should understand that the present invention includes, but is not limited to, the contents described in the accompanying drawings and the specific embodiments above. Any modifications that do not depart from the functional and structural principles of the present invention will be included within the scope of the claims.

Claims

1. A data anonymization method, characterized in that, The data anonymization method includes: Obtain the raw data; The original data is processed using multiple predefined privacy processing parameters to obtain privacy-processed data, and the privacy processing parameters are sent to a management platform with management authority. Risk features are extracted from the privacy-processing data to obtain risk feature representation data of the privacy-processing data, and the relevant parameters of the risk feature representation data are sent to the management platform; wherein, the risk feature representation data includes a fused risk feature vector and a risk prediction value; The original data is anonymized based on the risk feature representation data, and the anonymized data is output. The anonymized data can be reversed using the privacy processing parameters and relevant parameters of the risk feature representation data stored in the management platform to obtain the original data.

2. The data anonymization method according to claim 1, characterized in that, The process of de-identifying the original data based on the risk characteristic representation data and outputting the de-identified data includes: The risk level and desensitization rules are determined based on the data complexity of the data represented by the risk characteristics; wherein, the desensitization rules correspond one-to-one with the risk levels; Using the risk level as a guiding condition, the original data is desensitized according to the desensitization rules corresponding to the risk level to obtain desensitized data; The desensitization quality score is determined based on the information entropy of the desensitized data and the information entropy of the original data. If the desensitization quality score is greater than or equal to the preset desensitization quality threshold, the desensitized data is output.

3. The data anonymization method according to claim 1, characterized in that, The privacy processing parameters include an initial privacy budget parameter, an adjusted privacy budget parameter, and a noise parameter. The initial privacy budget parameter corresponds one-to-one with the sensitivity level of the original data. The process of performing privacy processing on the original data using multiple predefined privacy processing parameters to obtain privacy-processed data includes: The adjusted privacy budget parameters are determined based on the sensitivity level and the corresponding initial privacy budget parameters. The noise parameters are determined based on the sensitivity level. The original data is noise-added using the noise parameter, the adjusted privacy budget parameter, and the sensitivity level to obtain privacy-processed data.

4. The data anonymization method according to claim 3, characterized in that, The noise parameters include the noise type, and determining the noise parameters based on the sensitivity level includes: When the sensitivity level is high, the noise type includes Laplace noise; When the sensitivity level is medium, the noise type includes Laplace noise or Gaussian noise; When the sensitivity level is low, the noise type includes Gaussian noise.

5. The data anonymization method according to claim 3, characterized in that, The step of adding noise to the original data using the noise parameter, the adjusted privacy budget parameter, and the sensitivity level to obtain privacy-processed data includes: When the noise parameter is Laplace noise, the adjusted privacy budget parameter and the sensitivity level are input into the Laplace noise function, and the Laplace noise function is added to the original data to obtain the privacy-processed data after Laplace noise addition. When the noise parameter is Gaussian noise, the adjusted privacy budget parameter, the sensitivity level, and the calibration constant are input into the Gaussian noise function, and the Gaussian noise function is added to the original data to obtain the privacy-processed data after Gaussian noise addition.

6. The data desensitization method according to any one of claims 3 to 5, characterized in that, The noise parameters also include the amplitude of the noise type and the standard deviation of the noise type, and the data anonymization method further includes: The noise range ratio is determined based on the standard deviation of the noise type and a preset data range; The noise accuracy ratio is determined based on the standard deviation of the noise type and the preset data accuracy. The amplitude of the noise type is adjusted according to the noise range ratio and the noise precision ratio so that the noise range ratio is within a preset range factor and the noise precision ratio is within a preset precision factor.

7. The data anonymization method according to claim 1, characterized in that, The step of extracting risk features from the privacy-processing data to obtain risk feature representation data of the privacy-processing data includes: The privacy-processing data is preprocessed according to preset standardized processing rules to obtain standard privacy-processing data; The standard privacy-processing data is input into feature engineering to obtain multi-dimensional enhanced features; The multi-dimensional enhanced features are input into the traditional risk feature model and the deep learning risk feature model respectively to obtain traditional risk features and potential risk features; The traditional risk features and the potential risk features are fused to generate a fused risk feature vector and a risk prediction value.

8. The data desensitization method according to claim 7, characterized in that, The step of fusing the traditional risk features and the potential risk features to generate a fused risk feature vector and a risk prediction value further includes: The feature quality score of the fusion risk feature is determined according to the preset feature evaluation rules; If the feature quality score is less than or equal to a preset feature quality threshold, the feature quality score is input into the feature engineering to guide the feature engineering to re-extract the multi-dimensional enhanced features corresponding to the standard privacy processing data; If the feature quality score is greater than the preset feature quality threshold, the fused risk feature vector and risk prediction value are output.

9. An electronic device, characterized in that, include: one or more processors; A memory having stored one or more computer programs thereon, which, when executed by one or more processors, cause the one or more processors to implement the data desensitization method according to any one of claims 1 to 8.

10. A computer-readable medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the data desensitization method according to any one of claims 1 to 8.

Images