Data anonymization adjustment method and system based on dynamic correlation risk analysis

Abstract

The application discloses a data anonymization adjustment method and system based on dynamic correlation risk analysis. The method comprises the following steps: acquiring all original data of correlation occurring within a preset period between two types of systems constituting a cross-domain scene; extracting first and second domain features with time correlation and space correlation from all original data; obtaining a time matching rate of the two types of features based on a time window overlap frequency; obtaining the space correlation of the two types of features based on an external map knowledge base; obtaining the semantic correlation of the two types of features; weighting and fusing the three types of correlations to obtain a correlation edge weight, and determining a path risk level formed by the two types of features according to the weight; dynamically calling a corresponding anonymization strategy according to the path risk level, and executing the strategy on the corresponding data. The method can effectively solve the problem of leakage risk caused by cross-domain correlation of weak anonymization data sets, and realize the balance between dynamic risk perception and self-adaptive anonymization level.

Description

Technical Field

[0001] The present disclosure relates to the technical field of data privacy protection, and in particular to a data anonymization adjustment method and system based on dynamic correlation risk analysis. Background Art

[0002] In today's data processing and privacy protection fields, traditional data anonymization technologies have significant limitations. Traditional methods, such as k-anonymity and differential privacy, are designed to focus solely on single datasets and fail to account for the risks of cross-domain data correlation. For example, transaction times and medical records may have temporal and spatial matching, but these traditional methods are unable to identify such potential correlation risks, making it difficult to effectively prevent the leakage of sensitive information through cross-domain data correlation.

[0003] At the same time, existing solutions lack dynamic adaptability. Faced with new public datasets and the expansion of external knowledge bases, these solutions lack corresponding response mechanisms and are unable to promptly address dynamically changing risks. For example, the issue of geolocation accuracy in a specific case study clearly demonstrates the lag of current data privacy protection solutions in the face of dynamic risks, and their inability to quickly adjust to ensure data security when risks change.

[0004] In addition, existing technologies also face the problem of imbalance between utility and privacy; although excessive anonymization processing protects privacy to a certain extent, it undermines the availability of data, for example, it may cause distortion in medical time series analysis; and if weak anonymization processing is used, it cannot effectively resist association reasoning attacks, making it difficult to ensure the privacy of data. Summary of the Invention

[0005] In view of this, the embodiments of the present disclosure provide a data anonymization adjustment method and system based on dynamic association risk analysis, which can solve the problems existing in the prior art such as the risk of leakage of weakly anonymized data sets caused by cross-domain association.

[0006] In a first aspect, an embodiment of the present disclosure provides a data anonymization adjustment method based on dynamic correlation risk analysis, comprising:

[0007] Obtain all raw data associated with the first type system and the second type system within a preset period; wherein the first type system and the second type system are two types of systems constituting a cross-domain scenario;

[0008] Extracting two types of cross-domain scene information from all the original data, the two types of cross-domain scene information including first domain features and second domain features having temporal correlation and spatial correlation;

[0009] obtain a time matching rate of the first domain feature and the second domain feature based on a time window overlap frequency;

[0010] obtain spatial correlation of the first domain feature and the second domain feature based on an external map knowledge base;

[0011] obtain semantic correlation of corresponding texts of the first domain feature and the second domain feature;

[0012] perform weighted fusion on the time matching rate, the spatial correlation, and the semantic correlation to obtain an associated edge weight of the first domain feature and the second domain feature;

[0013] determine a path risk level formed by the first domain feature and the second domain feature according to the associated edge weight;

[0014] dynamically call a corresponding anonymization strategy according to the path risk level, and perform the anonymization strategy on data corresponding to the first domain feature and the second domain feature.

[0015] In a second aspect, the embodiments of the present disclosure further provide a data anonymization adjustment system based on dynamic association risk analysis, comprising:

[0016] an original data acquisition module configured to acquire all original data associated in a preset period by a first system and a second system; wherein the first system and the second system are two systems constituting a cross-domain scenario;

[0017] a domain feature acquisition module configured to extract two types of cross-domain scenario information from the all original data, the two types of cross-domain scenario information comprising a first domain feature and a second domain feature having time correlation and spatial correlation;

[0018] a time matching rate acquisition module configured to obtain a time matching rate of the first domain feature and the second domain feature based on a time window overlap frequency;

[0019] a spatial correlation acquisition module configured to obtain spatial correlation of the first domain feature and the second domain feature based on an external map knowledge base;

[0020] a semantic correlation acquisition module configured to obtain semantic correlation of corresponding texts of the first domain feature and the second domain feature;

[0021] a fusion module configured to perform weighted fusion on the time matching rate, the spatial correlation, and the semantic correlation to obtain an associated edge weight of the first domain feature and the second domain feature;

[0022] a path risk level obtaining module configured to determine a path risk level formed by the first domain feature and the second domain feature according to the association edge weight;

[0023] a dynamic anonymization module configured to dynamically invoke a corresponding anonymization strategy according to the path risk level, and execute the anonymization strategy on data corresponding to the first domain feature and the second domain feature.

[0024] In a third aspect, the embodiments of the present disclosure further provide a computer device, which adopts the following technical solution:

[0025] The computer device comprises:

[0026] at least one processor; and

[0027] a memory connected to the at least one processor in communication; wherein

[0028] the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the data anonymization adjustment method based on dynamic association risk analysis.

[0029] In a fourth aspect, the embodiments of the present disclosure further provide a computer readable storage medium storing computer instructions for causing a computer to execute the data anonymization adjustment method based on dynamic association risk analysis.

[0030] In a fifth aspect, the embodiments of the present disclosure further provide a computer program product comprising computer programs / instructions, which, when executed by a processor, implement the steps of the method according to any one of the preceding aspects.

[0031] The data anonymization adjustment method based on dynamic correlation risk analysis disclosed in the application obtains all original data of correlation between a first type of system and a second type of system constituting a cross-domain scenario within a preset period; extracts two types of cross-domain scenario information from all original data, the two types of cross-domain scenario information including first domain features and second domain features having time correlation and spatial correlation; obtains a time matching rate of the first domain features and the second domain features based on a time window overlap frequency; obtains spatial correlation of the first domain features and the second domain features based on an external map knowledge base; and obtains semantic correlation of texts corresponding to the first domain features and the second domain features, comprehensively considers correlation in multiple aspects such as time, space and semantics, and can more accurately find a data correlation mode and potential risks between cross-domain systems to provide more powerful support for data analysis and decision-making; the time matching rate, the spatial correlation and the semantic correlation are weighted and fused to obtain an edge weight of correlation of the first domain features and the second domain features; a path risk level formed by the first domain features and the second domain features is determined according to the edge weight of correlation; and a corresponding anonymization strategy is dynamically called according to the path risk level, and the data corresponding to the first domain features and the second domain features are executed with the anonymization strategy, which can adopt a corresponding anonymization strategy for data of different risk levels, effectively protect the privacy and sensitive information of related data, reduce the risk of data leakage, and effectively avoid the influence of excessive anonymization on data usability by using a dynamic anonymization strategy, so that the data can still be used for valuable analysis and research. The method has strong adaptability and flexibility and can cope with different business scenarios and security requirements.

[0032] The above description is only a summary of the technical solutions of the present disclosure. In order to more clearly understand the technical means of the present disclosure, the contents of the specification can be implemented, and in order for the above and other purposes, features and advantages of the present disclosure to be more apparent and easy to understand, the following preferred embodiments are described in detail below, and the accompanying drawings are described as follows. BRIEF DESCRIPTION OF DRAWINGS

[0033] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the following will briefly introduce the drawings needed to be used in the embodiments. Obviously, the drawings in the following description are only some embodiments of the present disclosure, and those skilled in the art can obtain other drawings according to these drawings without creating any creative labor.

[0034] Figure 1 The flowchart of the data anonymization adjustment method based on dynamic correlation risk analysis provided by the embodiments of the present disclosure.

[0035] Figure 2 The flowchart of the method for obtaining the time matching rate of the first domain features and the second domain features provided by the embodiments of the present disclosure.

[0036] Figure 3 A flowchart of a method for obtaining spatial correlation of first domain features and second domain features is provided for the embodiments of the present disclosure.

[0037] Figure 4 A flowchart of a method for obtaining semantic correlation of first domain features and second domain features of corresponding text is provided for the embodiments of the present disclosure.

[0038] Figure 5 A structural diagram of a computer device is provided for the embodiments of the present disclosure. DETAILED DESCRIPTION

[0039] The embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings.

[0040] Reference Figure 1 The first aspect of the present application discloses a data anonymization adjustment method based on dynamic correlation risk analysis, which is used for anonymization adjustment of cross-domain risk data. The method specifically includes:

[0041] S100, all original data associated in a preset period is obtained from a first type of system and a second type of system; wherein the first type of system and the second type of system are two types of systems constituting a cross-domain scenario.

[0042] Among them, all original data includes structured data and / or unstructured data.

[0043] Obtaining comprehensive original data is the basis for subsequent analysis, ensuring the completeness and accuracy of the analysis. Only by mastering enough associated data can the data correlation pattern and potential risks between the two systems be more accurately discovered.

[0044] In this embodiment, the first type of system is a medical system, and the second type of system is a financial system. Assuming that the preset period is one month (from June 1, 2025 to June 30, 2025), the original data associated in this period can be extracted from the target medical system and the target financial system through system interface and data extraction tool. For example, when a patient uses financial payment to pay for medical treatment in a medical institution, associated records will be left in both systems. Extract all these records, including the patient's basic information, treatment time, treatment department, payment amount, payment time, etc.

[0045] S200, two types of cross-domain scenario information are extracted from all original data, including first domain features and second domain features with time correlation and spatial correlation.

[0046] Extracting domain features with time correlation and spatial correlation can reduce data redundancy, focus on information related to analysis, and provide more targeted data for subsequent correlation analysis.

[0047] The first domain feature is preferably medical information, and the second domain feature is preferably financial transaction information. Further, information related to medical treatment, such as medical treatment date, medical treatment location, disease diagnosis, etc., can be filtered from the extracted raw data as the first domain feature; information related to financial transactions, such as transaction date, transaction location, transaction amount, etc., can be filtered as the second domain feature. For example, a patient visits A hospital on June 10, and at the same time, uses a bank card to make a payment at the hospital's payment counter. These medical treatment information and financial transaction information are extracted separately.

[0048] S300, obtaining a time matching rate of the first domain feature and the second domain feature based on the time window overlap frequency.

[0049] The time matching rate can quantify the degree of correlation between the two domain features in time. A high time matching rate may indicate that there is a strong correlation between the two domains, which can help discover potential abnormal correlations or rules and provide important basis for risk assessment.

[0050] S400, obtaining spatial correlation of the first domain feature and the second domain feature based on an external map knowledge base.

[0051] The spatial correlation can further verify the correlation between the two domain features. In actual situations, medical treatment and financial transactions usually occur at the same location or nearby locations. If the spatial correlation does not conform to common sense, there may be data anomalies or potential risks.

[0052] S500, obtaining semantic correlation of the first domain feature and the second domain feature corresponding to the text.

[0053] The semantic correlation can reveal the internal relationship between the two domain features from the text level. By analyzing the semantics, some hidden correlation information can be discovered, improving the accuracy of risk assessment.

[0054] S600, weighting and fusing the time matching rate, spatial correlation, and semantic correlation to obtain an association edge weight of the first domain feature and the second domain feature.

[0055] Weighting and fusing can consider the influence of multiple factors on the correlation degree of the two domain features, and obtain a more comprehensive and accurate association edge weight. By adjusting the weight, the importance of different factors can be highlighted according to actual needs.

[0056] S700, determining a path risk level formed by the first domain feature and the second domain feature according to the association edge weight.

[0057] The path risk level determination can classify and manage different associated paths, so as to take corresponding measures.

[0058] S800, dynamically calling a corresponding anonymization strategy according to the path risk level, and executing the anonymization strategy on data corresponding to the first domain feature and the second domain feature.

[0059] The dynamic calling of the anonymization strategy can take appropriate protection measures according to different risk levels, which not only ensures the security of the data, but also preserves the usability of the data to a certain extent. It avoids excessive anonymization that leads to loss of data analysis value, or insufficient anonymization that leads to data leakage risk.

[0060] The data anonymization adjustment method based on dynamic correlation risk analysis disclosed in the present application obtains all original data associated in a preset period of time of a first type of system and a second type of system constituting a cross-domain scenario; extracts two types of cross-domain scenario information from all original data, the two types of cross-domain scenario information including first domain features and second domain features having time correlation and spatial correlation; obtains a time matching rate of the first domain features and the second domain features based on a time window overlap frequency; obtains spatial correlation of the first domain features and the second domain features based on an external map knowledge base; obtains semantic correlation of texts corresponding to the first domain features and the second domain features, and comprehensively considers the correlation of time, space and semantics, which can more accurately find the data correlation mode and potential risk between cross-domain systems, and provide stronger support for data analysis and decision-making; weights and fuses the time matching rate, the spatial correlation and the semantic correlation to obtain an associated edge weight of the first domain features and the second domain features; determines a path risk level of the first domain features and the second domain features formed according to the associated edge weight; dynamically calls a corresponding anonymization strategy according to the path risk level, and executes the anonymization strategy on data corresponding to the first domain features and the second domain features. The method can adopt corresponding anonymization strategies for data of different risk levels, effectively protect the privacy and sensitive information of related data, reduce the risk of data leakage, and effectively avoid the influence of excessive anonymization on data usability by using a dynamic anonymization strategy, so that the data can still be used for valuable analysis and research. The method has strong adaptability and flexibility, and can cope with different business scenarios and security requirements.

[0061] Reference Figure 2 For the method of S300 "obtaining a time matching rate of the first domain features and the second domain features based on a time window overlap frequency", that is, the method for obtaining the time matching rate of the first domain features and the second domain features, specifically includes:

[0062] S310, determine the total time window as the sum of the earliest time and the latest time contained in all the raw data.

[0063] The determination of the total time window provides a unified time range for subsequent calculations, allowing us to perform feature matching analysis within a clear time period and avoiding uncertainty in data range.

[0064] Suppose we have raw data about two domains, such as the medical system and the financial system. In the medical system, the earliest patient visit record time is March 1, 2025 08:00, and the latest record time is March 31, 2025 23:59. In the financial system, the earliest transaction record time is also March 1, 2025 09:00 (assuming the financial system's business hours start at 9:00), and the latest record time is also March 31, 2025 17:00 (end of workday). Considering the data of both systems, we determine the total time range from March 1, 2025 08:00 to March 31, 2025 23:59. The total duration is 30 days 15 hours 59 minutes, which is approximately 735.98 hours in hours, and the total time window is approximately 736 hours.

[0065] S320, determine the preset sub-time window according to the total time window.

[0066] Specifically, the preset sub-time window divides the total time window into smaller time periods, allowing us to check the time matching between features within a local range, improving the accuracy and efficiency of matching.

[0067] Preferably, the preset sub-time window can be a ±1 hour window, which means that for any time point, we take it as the center and expand 1 hour forward and backward, forming a 2-hour sub-time window. For example, if an event occurs on January 5, 2025 12:00, the corresponding preset sub-time window is January 5, 2025 11:00 to 13:00.

[0068] In this embodiment, the preset sub-time window and the total time window are measured in hours, and the ratio of the preset sub-time window to the total time window is preferably in the range of 0.001-0.1. In our above example, the total time window is 736 hours, and the preset sub-time window is 2 hours, with a ratio of 2 / 736 ≈ 0.0027, which is within a reasonable range. Such a ratio can ensure the detection of possible time associations while avoiding inaccurate matching due to excessively large sub-windows.

[0069] S330, obtain the occurrence time difference corresponding to the first domain feature and the second domain feature in the same preset sub-time window, and record that the first domain feature and the second domain feature match once when the occurrence time difference is not greater than the preset time length.

[0070] By setting the preset time length to determine whether the features match, the meaningful time association between the features can be more accurately captured, and events that may have no actual association although in the same sub-time window but with a long time interval can be filtered out, thereby improving the effectiveness of matching.

[0071] Specifically, assuming that a patient in a medical system is sent to an emergency room due to a heart attack on March 22, 2025, 11:15, and the stock of a medical-related enterprise in a financial system abnormally fluctuates on March 22, 2025, 11:30, the two events are in the same preset sub-time window (10:15-12:15). The occurrence time difference is 15 minutes. The preset time length is set to 30 minutes, and since 15 minutes is not greater than 30 minutes, it is recorded that the medical system feature and the financial system feature match once.

[0072] The setting of the preset time length requires setting in combination with the characteristics of the two cross-domain systems. In the medical-financial scenario, from a medical perspective, a patient's sudden illness may affect the stock performance of related medical enterprises in a short period of time. Referring to the reaction speed of the financial market to events and the time of medical events propagating to the financial market, the preset time length can be set to between 0.5 hours and 1 hour.

[0073] S340, obtain all the times of matching of the first domain feature and the second domain feature in the total time window, and record the target matching times.

[0074] The target matching times intuitively reflect the frequency of matching of the two system features in time, and are an important basis for calculating the time matching rate, providing specific data support for subsequent analysis of the time association between the two systems.

[0075] For example, the medical system features (such as patient visits, etc.) and the financial system features (such as stock fluctuations, financial transactions, etc.) in the total time window from March 1, 2025, 08:00 to March 31, 2025, 23:59 are traversed one by one, and the matching rules are determined. After statistics, in the 736 hours, the medical system features and the financial system features match 30 times, and the target matching times are 30.

[0076] S350, obtain the time matching rate of the first domain feature and the second domain feature according to the target matching times and the total time window.

[0077] The time matching rate is : wherein, is the number of target matches, is the total time window.

[0078] The time matching rate quantitatively shows the degree of association between the characteristics of the medical system and the financial system in time. Through this indicator, we can evaluate whether there is a significant time connection between the two systems, providing decision-making reference for medical industry investment, financial risk assessment, etc.

[0079] The disclosed method for obtaining the time matching rate of the first domain feature and the second domain feature in S310-S350 can effectively analyze the time association between the characteristics of the medical system and the financial system in two seemingly unrelated fields, discover potential cross-domain relationships, such as whether the outbreak of certain diseases will cause changes in the financial status of related medical enterprises; the quantitative time matching rate can provide valuable information for medical industry investors, financial institutions, and medical policy makers. Investors can adjust their investment strategies based on the time matching rate, financial institutions can assess the risk of medical-related financial products, and medical policy makers can predict the impact of medical events on the financial market. This analysis method has certain flexibility and scalability, and can be applied to different time ranges and data sizes, and can also adjust the preset sub-time window and preset duration as needed to adapt to different analysis needs.

[0080] Referring to Figure 3 For the method of S400 "obtaining the spatial association of the first domain feature and the second domain feature based on an external map knowledge base", i.e., the method for obtaining the spatial association of the first domain feature and the second domain feature, it specifically includes:

[0081] S410, calling an external map knowledge base to determine the latitude and longitude information of the actual occurrence place corresponding to the first domain feature, denoted as first location information.

[0082] S420, calling an external map knowledge base to determine the latitude and longitude information of the actual occurrence place corresponding to the second domain feature, denoted as second location information.

[0083] Converting specific address information into latitude and longitude information provides a unified and standard data format for subsequent accurate calculation of geographic distance. Latitude and longitude is a global universal geographic coordinate system that can accurately locate any point on Earth, avoiding calculation errors caused by non-standard address descriptions or differences in address systems in different regions.

[0084] S430, obtaining the geographic distance corresponding to the first domain feature and the second domain feature according to the Haversine formula, the first location information, and the second location information.

[0085] wherein, the geographic distance is :

[0086] ;

[0087] .

[0088] where, is the latitude of the first location, is the latitude of the second location, is the difference in latitude between the first and second locations (in radians), is the difference in longitude between the first and second locations (in radians), is the Earth's radius (usually taken as 6371 kilometers (or 3958.8 miles).

[0089] The Haversine formula takes into account the spherical nature of the Earth and can accurately calculate the actual distance between any two points on the Earth. In geographic spatial analysis, accurate distance calculation is the basis for judging the spatial relationship between locations, providing reliable data support for subsequent evaluation of spatial relevance.

[0090] S440, according to the geographical distance to obtain the first domain feature and the second domain feature corresponding to the spatial relevance.

[0091] where the spatial relevance is : ; is the geographical distance, is the attenuation coefficient, which can be flexibly set according to actual needs.

[0092] By quantifying the spatial relevance between medical system and financial system features through geographical distance, abstract spatial relationships are converted into specific indicators, which helps to intuitively compare the relationships between different medical and financial locations and discover the interaction rules of the two systems in space. For practitioners in the medical and financial industries, this quantitative spatial relevance analysis can provide a strong basis for their decisions, for example, hospitals seeking financial support can prioritize financial institutions that are close and have strong relevance, and financial institutions investing in the medical industry can focus on medical units that are close.

[0093] The first field feature and the second field feature are obtained by the method of S410-S440, which realizes the spatial correlation analysis between the medical system and the financial system, breaks the barriers between industries, and finds some potential cross-domain links by analyzing the spatial relationship of the event occurrence place in the two systems. For example, whether geographical proximity will promote the interaction between medical innovation and financial investment, providing a new perspective for further research on the medical-finance ecosystem; accurate spatial correlation analysis results can provide accurate decision support for medical enterprises, financial institutions and relevant regulatory departments. Medical enterprises can reasonably plan financing channels and cooperation objects according to the spatial correlation with financial institutions; financial institutions can assess investment risks and potential returns based on the distance and spatial correlation degree with medical institutions, and optimize investment strategies; regulatory departments can develop more effective policies and regulatory measures based on the spatial distribution and correlation of the two systems. The analysis method based on geographic data reveals the spatial relationship between the medical system and the financial system. This analysis helps to promote the spatial cooperation of the two industries, promote the rational allocation of medical resources and financial resources, and improve the medical service level and financial service efficiency of the whole society.

[0094] With reference to Figure 4 For the method of S500, "obtaining the semantic correlation of the text corresponding to the first field feature and the second field feature", the semantic correlation of the text corresponding to the first field feature and the second field feature is obtained, which specifically includes:

[0095] S510, obtaining the first associated text of the first field feature in the first type of system.

[0096] By explicitly obtaining the text content related to the medical information, a specific data basis is provided for subsequent semantic analysis, and complete medical information contains rich medical semantics, which can fully reflect the relevant situation of the medical event, and is helpful for accurate analysis of the semantic features of the medical field.

[0097] Specifically, in the medical system, the first field feature is a medical information, and the medical information may include the basic information of the patient, the symptom description, the diagnosis result, the treatment plan and the like. For example, a medical information is "patient Zhang San, male, 55 years old, admitted to hospital due to cough and fever for three days, diagnosed as upper respiratory tract infection, and given antibiotic treatment", and the whole medical information is the first associated text.

[0098] S520, using the BERT model to extract the semantic vector of the text field in the first associated text, denoted as the first semantic vector.

[0099] The first associated text "Patient Zhang San, male, 55 years old, admitted to hospital due to cough and fever for three days, diagnosed as upper respiratory tract infection, given antibiotic treatment" is input into the BERT model. The BERT model processes the text, converts each word or phrase in the text into a corresponding semantic vector, and finally extracts the semantic vector of the entire text field. This vector is represented as a multi-dimensional array and contains the semantic features of the medical information, denoted as the first semantic vector.

[0100] S530, obtaining a second associated text of the second field feature in the second type of system.

[0101] The complete text related to the transaction information is obtained, so that the transaction event in the financial system has a specific semantic description. These texts contain key information of the transaction, providing data support for analyzing semantic features in the financial field, and facilitating semantic association analysis with medical information.

[0102] Specifically, in the target financial system, the second field feature is a transaction information. The transaction information may include transaction time, transaction amount, transaction object, transaction purpose, etc. For example, a transaction information is "On June 24, 2025, Zhang San paid 500 yuan of medical expenses to a hospital", which is the second associated text.

[0103] S540, using the BERT model to extract the semantic vector of the text field in the second associated text, denoted as the second semantic vector.

[0104] The second associated text "On June 24, 2025, Zhang San paid 500 yuan of medical expenses to a hospital" is input into the BERT model. The BERT model processes the text, converts the words and phrases in the text into semantic vectors, and extracts the semantic vector of the entire text field, denoted as the second semantic vector.

[0105] S550, using the cosine similarity formula to calculate the vector similarity between the first semantic vector and the second semantic vector.

[0106] where the vector similarity is : . A is the first semantic vector, is the second semantic vector, is the norm of the first semantic vector, is the norm of the second semantic vector.

[0107] The first semantic vector and the second semantic vector have been obtained, and the cosine similarity formula is used to calculate the vector similarity between them. The cosine similarity measures the similarity between two vectors by calculating the cosine of the angle between them, with a value range of -1 to 1. The closer the value is to 1, the more similar the two vectors are.

[0108] S560, obtaining semantic relevance of the text corresponding to the first domain feature and the second domain feature according to the vector similarity.

[0109] The semantic relevance is : , The vector similarity.

[0110] The semantic relevance of the text corresponding to the first domain feature and the second domain feature is quantified by the vector similarity, which converts the abstract semantic relationship into a specific index, which helps to quickly filter out information pairs with strong semantic relevance in a large amount of medical information and transaction information, and discover potential links between the medical system and the financial system, providing a basis for further data analysis and decision-making.

[0111] The method for obtaining semantic relevance of the text corresponding to the first domain feature and the second domain feature disclosed in S510-S560 can analyze the semantic relevance of different types of information in the medical system and the financial system, breaking the boundaries between different fields. By analyzing the semantic relationship between medical information and transaction information, potential links between medical behavior and financial transactions can be discovered, such as the association between the payment of medical expenses and the type of disease. Accurate semantic relevance analysis helps to extract valuable information from a large amount of medical and financial data. For example, it can discover the payment patterns of certain diseases or the financial transaction habits of patients under certain conditions. This information can provide in-depth insights for medical service providers, financial institutions and regulatory authorities, supporting them to make more informed decisions; for the medical industry, understanding the semantic relevance of medical information and transaction information can help hospitals optimize their billing strategies and manage medical insurance reimbursement; for the financial industry, it can assess the risks and potential of medical-related transactions and develop financial products more suitable for medical scenarios. At the same time, regulatory authorities can strengthen supervision of the medical and financial markets based on these association information to protect patient rights and market stability.

[0112] For the method of S600 "weighting and fusing the time matching rate, spatial relevance, and semantic relevance to obtain the association edge weight of the first domain feature and the second domain feature", it specifically includes:

[0113] S610, determining key risk factors in the data scene according to the data scene corresponding to the first type of system and the second type of system;

[0114] S620, dynamically determining the time matching weight, spatial correlation weight, and semantic correlation weight according to the key risk factors;

[0115] S630, the time matching weight, the space correlation weight and the semantic correlation weight are weighted and summed according to the time matching rate, the space correlation and the semantic correlation to obtain the correlation edge weight of the first field feature and the second field feature.

[0116] The correlation edge weight is : ; wherein, , is the time matching weight, is the space correlation weight, is the semantic correlation weight, is the time correlation, is the space correlation, is the semantic correlation.

[0117] Further, for the medical data scene, the time matching of the visit time and the medication record time is a key leakage path, so the time correlation is more important in the data anonymization of this scene. For the social media data scene, the semantic analysis of the text content (such as "tumor hospital check-in") is the main risk source, so the semantic correlation is more important in the data anonymization of this scene. For the financial transaction scene, the proximity of the transaction location and the sensitive place (such as the hospital) is the core risk, so the space correlation is more important in the data anonymization of this scene. Based on the core risk factors in each scene, different values are given to the time matching weight ( ), the space correlation weight ( ) and the semantic correlation weight ( ), as follows: 1) medical data scene: set the time matching weight = 0.5, the space correlation weight = 0.2, and the semantic correlation weight = 0.3. 2) Social media data scene: set the time matching weight = 0.2, the space correlation weight = 0.3, and the semantic correlation weight = 0.5. 3) Financial transaction scene: set the time matching weight = 0.3, the space correlation weight = 0.5, and the semantic correlation weight = 0.2.

[0118] For the method of S700 "determining the path risk level formed by the first field feature and the second field feature according to the correlation edge weight", in the first embodiment, the method specifically includes:

[0119] A100, obtaining a third field feature in a three-party system having a location correlation with the first field feature and the second field feature.

[0120] In the formula, the third field feature is social media association information, and the third field feature is preferably place association text information corresponding to a place associated with the financial transaction information.

[0121] The third field feature of the social media system can enrich the information dimension. The information in the social media often contains real-time feedback and potential risk signals of the public. By obtaining social media information associated with the first and second field features, potential factors that may affect medical treatment and financial transactions can be mined, providing a more comprehensive basis for subsequent risk assessment.

[0122] A200, based on all the first field features, the second field features, and the third field features, a directed weighted graph is constructed, the edges in the directed weighted graph are the association edges between adjacent two features, and the nodes are each feature.

[0123] The directed weighted graph can intuitively represent the association relationship and association strength between different field features. Through the association edge weight, the association degree between different features can be quantified, providing a clear structure and data basis for subsequent path risk calculation. It visualizes complex information relationships, facilitating the analysis and understanding of the interaction between different field features.

[0124] A300, based on the directed weighted graph, each association path containing the first field feature, the second field feature, and the third field feature is determined, and the association total weight of each association path is obtained.

[0125] In the constructed directed weighted graph, find the association path containing the medical treatment information, the financial transaction information, and the social media association information. For example, an association path is: medical treatment information → financial transaction information → social media association information. The association total weight of this path is calculated by multiplying the weights of the association edges on the path. Assuming that the association edge weight from the medical treatment information to the financial transaction information is 0.8, and the association edge weight from the financial transaction information to the social media association information is 0.7, then the association total weight of this association path is 0.8 x 0.7 = 0.56.

[0126] Determining the association path and the association total weight can quantify and integrate the association relationship between different field features. By calculating the association total weight, the comprehensive association degree between different features on a path can be measured, which helps to filter out paths with strong association and provides key quantitative indicators for subsequent risk assessment.

[0127] A400, according to the path sensitivity formula, the path sensitivity corresponding to each association path is determined.

[0128] wherein the first The path sensitivity corresponding to the path of the first : wherein, The node sensitivity corresponding to the path of the first The node sensitivity corresponding to the path of the first The total association weight corresponding to the path of the first The total association weight corresponding to the path of the first

[0129] The path sensitivity comprehensively considers the importance of the node and the association strength of the path. Through the node sensitivity, the influence of certain key information nodes on the path risk can be highlighted. Through the total association weight, the close degree of the association between different features on the path can be reflected. The path sensitivity can more accurately evaluate the risk degree contained in an associated path, and provide a more reasonable basis for determining the path risk level.

[0130] A500, according to the sensitivity preset range, determines the path risk level corresponding to the path sensitivity.

[0131] The sensitivity preset range can include: when the path sensitivity is 0-0.7, it is determined that the path risk level corresponding to the path sensitivity is low risk, and when the path sensitivity is greater than 0.7, it is determined that the path risk level corresponding to the path sensitivity is high risk.

[0132] The path sensitivity is converted into a specific risk level, so that the risk assessment result is more intuitive and easy to understand. Different risk levels can provide clear reference for decision makers, so that they can take corresponding measures according to the risk level, such as focusing on monitoring and intervening on high-risk paths, and performing routine management on low-risk paths.

[0133] The scheme integrates information in the fields of medical treatment, finance and social media, and can comprehensively evaluate the path risk formed between features in different fields. By considering the association relationship between information in different fields, potential risks that cannot be detected in a single field can be found, and an effective method for cross-field risk management is provided. Through the calculation of the directed weighted graph and the path sensitivity, the complex information association and risk degree are quantified, which makes the risk assessment more objective and accurate. The directed weighted graph visualizes the information relationship, which facilitates managers to intuitively understand the association and risk distribution between different information. According to the path risk level, decision makers can develop targeted risk management strategies. For high-risk paths, measures can be taken to control and prevent risks in time. For low-risk paths, resources can be reasonably allocated for routine management, which helps to improve the efficiency and effectiveness of risk management and ensure the stable operation of the system.

[0134] For the method S700 "determining the path risk level formed by the first domain feature and the second domain feature according to the associated edge weight", in a second embodiment, the method specifically comprises:

[0135] B100, determining the path sensitivity corresponding to each pair of first domain feature and second domain feature according to the path sensitivity formula.

[0136] Wherein, the path sensitivity corresponding to the first domain feature and the second domain feature is The path sensitivity corresponding to the first domain feature and the second domain feature is : Wherein, The path sensitivity corresponding to the first domain feature and the second domain feature is The node sensitivity corresponding to the first domain feature and the second domain feature is The node sensitivity corresponding to the first domain feature and the second domain feature is The associated edge weight corresponding to the first domain feature and the second domain feature is

[0137] B200, determining the path risk level corresponding to the path sensitivity according to the sensitivity preset range.

[0138] The scheme provides a simple and efficient method to evaluate the path risk between the first domain feature and the second domain feature. Through simple formula calculation and risk level division, a large number of feature combinations can be quickly processed, saving evaluation time and cost. The embodiment can perform correlation analysis on features in different domains (such as medical information and financial transaction information) to discover potential risk relationships between different domains, which helps to break down the barriers between domains and realize cross-domain risk management and decision support. The path risk level provides a clear basis for decision-making for decision-makers. Whether in the medical industry, the financial industry or the regulatory department, appropriate measures can be taken according to the risk level to optimize resource allocation, reduce potential risks and ensure the safe and stable operation of the system.

[0139] For the method S800 "dynamically calling the corresponding anonymization strategy according to the path risk level, and executing the anonymization strategy on the data corresponding to the first domain feature and the second domain feature", specifically comprising:

[0140] A100, when the path risk level is high risk, the first anonymization strategy is called.

[0141] When the path risk level is high risk, it means that the leakage of these data may cause serious harm to patients or related subjects. The first anonymization strategy with strong anonymization can maximize the protection of data privacy and security and reduce the risk brought by data leakage.

[0142] A200, respectively acquiring the first associated text of the first domain feature in the first type of system and the second associated text of the second domain feature in the second type of system.

[0143] The associated text contains more detailed information related to the first domain feature and the second domain feature. Obtaining these associated texts can comprehensively understand the context and background of the data, which helps to accurately extract key fields subsequently, avoids missing important information that may need to be anonymized, and thus improves the effect of anonymization.

[0144] A300, respectively extracts key fields in the first associated text and the second associated text.

[0145] Extracting key fields can focus on the most critical and sensitive part of the data, avoiding unnecessary processing of the entire associated text, which can improve the efficiency of anonymization, while ensuring that only information that needs to be protected is anonymized, reducing the impact on data usability.

[0146] A400, anonymizing all key fields based on the first anonymization strategy.

[0147] By anonymizing the key fields, sensitive information in the data can be effectively protected, reducing the risk of privacy leakage. In high-risk situations, this strong anonymization process can ensure that even if the data is illegally obtained, attackers will have difficulty identifying individual identities from the anonymized data, thereby protecting the rights and interests of data subjects.

[0148] The method disclosed in A100-A400 dynamically calls anonymization strategies according to the path risk level, which can flexibly adjust the strength of anonymization according to the actual risk situation. In high-risk situations, strong anonymization strategies are used, and in low-risk situations, other anonymization strategies are used to achieve dynamic anonymization adjustment, while balancing privacy protection and data usability. By obtaining associated texts and extracting key fields, sensitive information in the data can be comprehensively identified and protected, not only anonymizing the first domain feature and the second domain feature itself, but also processing related detailed information, improving the integrity of data protection. In today's strict privacy regulation environment, this scheme helps enterprises and institutions meet regulatory requirements and avoid legal risks due to data leakage. By effectively anonymizing sensitive data, the privacy rights and interests of data subjects can be protected, and user trust in data processing can be enhanced.

[0149] Further, for the method of A400 "anonymizing all key fields based on the first anonymization strategy", specifically includes:

[0150] A410, determining the actual type of the key field.

[0151] Accurate determination of the actual type of the key field is the basis for subsequent targeted anonymization processing. Different types of fields have different characteristics and sensitivity levels. Only by determining the field type can appropriate anonymization methods be used to ensure the effectiveness and reasonableness of the anonymization process.

[0152] A420, when the actual type is time type, the precise time information corresponding to the key field is generalized to a wide time interval.

[0153] In this embodiment, the processing method of generalizing time is used, that is, the precise time information is generalized to a wider time interval, such as converting the precise time "2023-05-10 14:30" to "May 2023". In this way, the accuracy of the time information is reduced, making it difficult for attackers to associate and identify personal information based on the precise time.

[0154] Time information often serves as an important clue for linking and identifying personal information. By generalizing precise time information to a wide time interval, the accuracy of the time information is reduced, making it difficult for attackers to use precise time to associate other data to identify personal identity. At the same time, the general range of time is preserved to some extent, and the time attribute of the data is not completely lost, ensuring the usability of the data in certain scenarios.

[0155] A430, when the actual type is location type, the precise geographic information corresponding to the key field is generalized to a wide geographic interval, and the GPS accuracy of the wide geographic interval is lower than that of the precise geographic information.

[0156] In this embodiment, the method of blurring the location is used, specifically, the precision of the GPS coordinates after the decimal point can be reduced from 3 to 1, which will expand the positioning error from about 10 meters to 1 kilometer. In this way, although the general geographic location information is still retained, the specific location of the individual cannot be accurately determined, thereby protecting the location privacy of the individual.

[0157] Precise geographic information can directly locate the specific location of an individual, which can easily lead to the leakage of personal location privacy. By generalizing precise geographic information to a wide geographic interval, the general geographic location information is retained while the positioning error range is increased, making it difficult for attackers to accurately determine the specific location of the individual, effectively protecting the location privacy of the individual. Moreover, the wide geographic interval can still provide a certain reference for geographic location, meeting the application requirements of some applications that do not require high location accuracy.

[0158] A440, when the actual type is numerical type, Laplace noise is added to the numerical field corresponding to the key field.

[0159] The key field of the numerical type can contain sensitive information such as financial transaction amount, personal physical indicators, etc. Adding Laplace noise can slightly disturb the numerical value without changing the overall distribution characteristics of the data. Even if the data is obtained, it is difficult for the attacker to accurately infer the original sensitive information from the disturbed numerical value, thereby protecting the privacy of the data. At the same time, the numerical value after adding noise still has certain statistical significance and will not cause too much impact on some analysis and calculation based on the numerical value.

[0160] The method disclosed in A410-A440 adopts different anonymization methods for different types of key fields, which can be targeted according to the characteristics and sensitivity of the fields, and realizes more refined privacy protection. Compared with the uniform anonymization method, this method can better protect privacy while minimizing the impact on data usability; by anonymizing and adjusting various sensitive key fields such as time, location and numerical value, the accuracy and sensitivity of the information that can be used to identify individual identity in the data are comprehensively reduced, greatly enhancing the security of the data and reducing the risk of data leakage; under strict privacy regulations, this scheme helps enterprises and institutions meet compliance requirements, while preserving data usability as much as possible on the basis of protecting privacy, so that the data can still be used for analysis, statistics and other business activities to a certain extent after anonymization, achieving a balance between privacy protection and business needs.

[0161] Further, for the method of S800, "dynamically calling the corresponding anonymization strategy according to the path risk level, and executing the anonymization strategy on the data corresponding to the first domain feature and the second domain feature", specifically includes: when the path risk level is low risk, the original data can be retained, or a second anonymization strategy is called for light processing.

[0162] Among them, "calling the second anonymization strategy for light processing" includes, for example, the age field, directly converting the specific age value to an age segment, such as converting the specific age to a range of "20-30 years old", which can protect personal privacy to a certain extent and retain the general information of the data, meeting the analysis needs of some data precision requirements.

[0163] In the medical system, the medical information contains that "Li Si" had an "appendicitis operation" in "XX Hospital" on "June 20, 2025", and records the detailed symptoms and diagnosis results, etc. In the financial system, the transaction information shows that "Li Si" paid "5000 yuan" for the operation cost to "XX Hospital" on "June 20, 2025". After risk assessment of the association path of the two groups of information, it is found that due to the large amount of medical treatment in the hospital and the relatively weak relevance of transaction records, the risk level of this path is determined as low risk. Accurate determination of the risk level of the path is the basis for subsequent selection of appropriate anonymization strategies. Only after the risk level is determined, can appropriate measures be taken according to the actual situation to avoid over-protection or insufficient protection; in the medical and financial data scenarios, different risk levels correspond to different privacy protection needs, and reasonable determination of the risk level helps to balance privacy protection and data utilization.

[0164] If a medical research team is conducting a study on the treatment effect and cost of appendicitis operation in a specific time period, accurate medical information and transaction information are needed to analyze the operation cost, recovery condition, etc. At this time, since the research requires high data accuracy, and the risk assessment is low risk, the original data can be retained, i.e. "Li Si" "XX Hospital" "appendicitis operation" in "June 20, 2025" in the medical system and "Li Si" "XX Hospital" "5000 yuan" on "June 20, 2025" in the financial system, etc. Retaining the original data can meet the needs of business scenarios that require high data accuracy, and ensure the normal development of business. In the field of medical research, accurate data is crucial to draw accurate research conclusions, and retaining the original data can provide reliable basis for research.

[0165] For calling the second anonymization strategy for light processing, specific embodiments include: the time information processing can include, for the time "June 20, 2025" in the medical information and transaction information, generalizing it to "June 2025", which reduces the accuracy of the time to a certain extent, but still retains the approximate time range. The patient identity processing can include: replacing the patient name "Li Si" with "Patient L", which hides the real identity of the patient, but can still distinguish different patients. The transaction amount processing can include: converting the transaction amount "5000 yuan" to the amount interval "4000-6000 yuan", which blurs the specific amount, but retains the approximate range of the transaction amount. The location information processing can include: generalizing "XX Hospital" to "a hospital in the city", which reduces the accuracy of the location information. Calling the second anonymization strategy for light processing can protect personal privacy to a certain extent while retaining the approximate information of the data, and is suitable for analysis scenarios with low data precision requirements. In some macro medical data statistics and analysis, lightly anonymized data is sufficient to meet the analysis needs, and can effectively reduce the risk of patient privacy leakage.

[0166] In this embodiment, the processing mode is dynamically selected according to the path risk level, which can flexibly cope with different risk situations. In the medical and financial data correlation scenario, different combinations of medical information and transaction information may have different risks. In low-risk situations, both the original data can be retained to meet high-precision needs such as scientific research, and light anonymization processing can be performed to enhance privacy protection, achieving a dynamic balance between privacy protection and business needs. For low-risk data, even if light anonymization processing is performed, the approximate information of the data can still be retained, so that the data can still be used for some analysis and statistical work that does not require high precision. For example, analyzing the medical income scale of different hospitals, the disease treatment trend in a certain time period, etc. This protects privacy while improving data usability, avoiding the situation where data cannot be used due to excessive protection. In the medical and financial fields, data privacy protection is subject to strict regulatory supervision. This scheme helps enterprises and institutions meet compliance requirements, reduces legal risks that may arise from data leakage by appropriately processing low-risk data, safeguards the privacy rights and interests of patients, and enhances user trust in data processing by medical and financial institutions.

[0167] In this embodiment, the first type of system and the second type of system can be a medical system and a financial system, respectively, or can be a financial system and a social media system, respectively, or can be a medical system and a social media system, etc. Other cross-domain correlation scenario systems.

[0168] Embodiment one: medical-financial cross-domain scenario data anonymization scenario.

[0169] Scenario background: In order to conduct disease research, a hospital needs to anonymize patient medical records, while preventing attackers from re-identifying patient identities by correlating financial transaction data, as there may be some correlation between medical records and financial transaction data. If not handled properly, patient privacy information may be exposed through such correlation.

[0170] 1) Input data; medical data contains patient's visit time (accurate to minutes), GPS coordinates of visit location (accurate to three decimal places), and diagnosis result (lung cancer). These information has certain sensitivity for identifying patient identity. Financial data contains transaction time (accurate to minutes), GPS coordinates of transaction location (accurate to three decimal places), and transaction amount (2000 yuan). These financial transaction data may be correlated with medical data, such as patients may make related consumption nearby after visiting.

[0171] 2) Processing process; correlation risk identification, specifically, the path "visit time → transaction location" is found, that is, it is found that there is a strong correlation path between visit time and transaction location, and the corresponding edge weight is 0.955, and the sensitivity is 2.02. If it is determined that the path risk level formed by the first field feature and the second field feature is high risk, the visit time can be generalized to "May 2023", and the GPS can be downgraded to "31.2°N, 121.4°E". After such data anonymization adjustment, the attack success rate is reduced from 72% of traditional methods to 2%, effectively resisting attacks by attackers using data correlation to identify identities, greatly improving the security and privacy of data.

[0172] Example two: financial-social cross-domain correlation scenario. Scenario description: A bank needs to anonymize credit card transaction data to support consumption trend analysis, and needs to prevent re-identifying users by correlating social media check-in data.

[0173] 1) Input data; financial data includes: transaction time 2023-08-15 19:30, transaction location 31.2304°N, 121.4737°E (cafe), and transaction amount 58 yuan. Social data includes: check-in time 2023-08-15 19:45, check-in location 31.2305°N, 121.4736°E, and text content: "coffee time after weekend overtime # office life".

[0174] 2) After correlation risk identification, the path "transaction location → check-in location → text content" is obtained, and the corresponding edge weight is 0.942, and the sensitivity is 2.02.

[0175] If it is determined that the path risk level formed by the first domain feature, the second domain feature, and the third domain feature is high risk, the transaction location can be downgraded to "31.2°N, 121.4°E", and the text is replaced with "drinks consumption during break time". After such data anonymization adjustment, the attack success rate is reduced from 22% in the traditional method to 0.33%.

[0176] In the prior art, traditional data anonymization techniques (such as k-anonymity and differential privacy) only focus on a single data set and cannot identify the correlation risk between cross-domain data. The data anonymization adjustment method based on dynamic correlation risk analysis disclosed in the present application obtains the original data of the first type of system and the second type of system, extracts the first domain feature and the second domain feature with time and spatial correlation, and calculates the correlation edge weight by comprehensively considering the time matching rate, spatial correlation, and semantic correlation, and then determines the path risk level. This enables the scheme to accurately identify the potential correlation risk between cross-domain data, for example, it can find the possible spatio-temporal matching relationship between medical treatment records and financial transaction records, effectively preventing sensitive information from being leaked through cross-domain data correlation.

[0177] Existing solutions lack a response mechanism when facing dynamic changes such as the addition of new public data sets and the expansion of external knowledge bases. The data anonymization adjustment method based on dynamic correlation risk analysis disclosed in the present application is based on dynamic correlation risk analysis, which can calculate the correlation edge weight and path risk level according to real-time data and external knowledge bases (such as external map knowledge bases). When new public data sets or external knowledge bases are expanded, the scheme can timely re-evaluate the correlation risk between data and dynamically adjust the anonymization strategy, avoiding dynamic risks such as the geographic location precision problem in the specific case, and ensuring that adjustments can be made quickly to protect data security when the risk changes.

[0178] The prior art has the problems of over-anonymization destroying data usability and weak anonymization failing to protect privacy. The data anonymization adjustment method based on dynamic correlation risk analysis disclosed in the present application dynamically calls corresponding anonymization strategies according to the path risk level. For low-risk paths, mild anonymization processing can be used to protect some privacy and retain data usability, avoiding the problem of data distortion caused by over-anonymization; for high-risk paths, stronger anonymization strategies are used to effectively resist correlation reasoning attacks and protect data privacy, thereby achieving a balance between utility and privacy.

[0179] The data anonymization adjustment method based on dynamic correlation risk analysis disclosed in the application can accurately identify the correlation risks between cross-domain data and dynamically adjust the anonymization strategy, which can effectively prevent sensitive information from being leaked through cross-domain data correlation, greatly improve the security and privacy protection level of data, and provide more reliable protection for medical data, financial data, and data in other fields in cross-domain scenarios, thereby reducing the risks and losses caused by data leakage. The method can adjust the anonymization strategy in a timely manner according to the dynamically changing risks, has strong dynamic adaptability and flexibility, and can respond quickly when facing newly added public data sets, external knowledge base expansion, and other dynamic risks, thereby ensuring that the data is always in a safe state, which makes the scheme have better practicability and stability in complex and variable real environments. Under the premise of protecting data privacy, the anonymization strategy is reasonably adjusted to avoid the damage of excessive anonymization to data usability. The data usability is retained, so that the data can still be used for various analysis and business applications, such as medical time series analysis and financial risk assessment, which helps to fully utilize the business value of data and promote data-driven decision-making and innovation. The scheme is suitable for two types of systems constituting a cross-domain scenario and has wide versatility, and can be used for data anonymization adjustment regardless of the association between systems in different industries or the association between different types of systems in the same industry. In addition, the framework and method of the scheme are extensible and can be further improved and optimized according to actual needs, such as adding more correlation factors or adjusting the weight calculation method.

[0180] In a second aspect, the application discloses a data anonymization adjustment system based on dynamic correlation risk analysis, which is used to execute the data anonymization adjustment method based on dynamic correlation risk analysis disclosed in the first aspect of the application. The system specifically comprises:

[0181] An original data acquisition module is configured to acquire all original data associated in a preset period of time by a first system and a second system; wherein the first system and the second system are two types of systems constituting a cross-domain scenario.

[0182] A domain feature acquisition module is configured to extract two types of cross-domain scenario information from all original data, wherein the two types of cross-domain scenario information include first domain features and second domain features having time correlation and spatial correlation.

[0183] A time matching rate acquisition module is configured to obtain a time matching rate of the first domain features and the second domain features based on a time window overlap frequency.

[0184] A spatial correlation acquisition module is configured to obtain spatial correlation of the first domain features and the second domain features based on an external map knowledge base.

[0185] The semantic correlation obtaining module is configured to obtain semantic correlation of the text corresponding to the first domain feature and the second domain feature.

[0186] The fusion module is configured to perform weighted fusion on the time matching rate, the spatial correlation and the semantic correlation to obtain an association edge weight of the first domain feature and the second domain feature.

[0187] The path risk level obtaining module is configured to determine a path risk level formed by the first domain feature and the second domain feature according to the association edge weight.

[0188] The dynamic anonymization module is configured to dynamically invoke a corresponding anonymization strategy according to the path risk level, and perform the anonymization strategy on data corresponding to the first domain feature and the second domain feature.

[0189] The computer device according to the embodiments of the present disclosure includes a memory and a processor. The memory is configured to store non-transitory computer readable instructions. Specifically, the memory can include one or more computer program products, which can include various forms of computer readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may, for example, include random access memory (RAM) and / or cache memory, etc. The non-volatile memory may, for example, include read only memory (ROM), hard disk, flash memory, etc.

[0190] The processor can be a central processing unit (CPU) or other forms of processing units with data processing and / or instruction execution capabilities, and can control other components in the computer device to perform desired functions. In one embodiment of the present disclosure, the processor is configured to run the computer readable instructions stored in the memory, so that the computer device performs all or part of the steps of the method for adjusting data anonymization based on dynamic association risk analysis according to the embodiments of the present disclosure.

[0191] Those skilled in the art should understand that, in order to solve the technical problem of how to obtain a good user experience effect, the present embodiment can also include well-known structures such as communication buses, interfaces, etc., which should also be included in the protection scope of the present disclosure.

[0192] As Figure 5 A structural schematic diagram of a computer device according to an embodiment of the present disclosure is provided. It shows a structural schematic diagram suitable for implementing the computer device in the embodiments of the present disclosure. Figure 5 The computer device shown is only an example, and should not impose any limitation on the functions and use range of the embodiments of the present disclosure.

[0193] As Figure 5As shown, the computer device can include a processor (e.g., a central processing unit, a graphics processing unit, etc.) that can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) or loaded into a random access memory (RAM) from a storage device. Various programs and data required for the operation of the computer device are also stored in the RAM. The processor, the ROM, and the RAM are connected to each other through a bus. An input / output (I / O) interface is also connected to the bus.

[0194] Generally, the following devices can be connected to the I / O interface: input devices including, for example, sensors or visual information collection devices; output devices including, for example, display screens; storage devices including, for example, magnetic tapes, hard disks, etc.; and communication devices. The communication devices can allow the computer device to communicate wirelessly or wired with other devices (such as edge computing devices) to exchange data. Although Figure 5 The computer device is shown with various devices, but it should be understood that not all of the shown devices are required to be implemented or possessed. More or fewer devices can alternatively be implemented or possessed.

[0195] In particular, according to embodiments of the present disclosure, the processes described above with reference to the flowcharts can be implemented as a computer software program. For example, embodiments of the present disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network through the communication device, or installed from the storage device, or installed from the ROM. When the computer program is executed by the processor, all or part of the steps of the method of adjusting data anonymization based on dynamic correlation risk analysis according to embodiments of the present disclosure are performed.

[0196] Detailed descriptions of the embodiments can refer to the corresponding descriptions in the foregoing embodiments, which will not be repeated here.

[0197] The computer-readable storage medium according to embodiments of the present disclosure has non-transitory computer-readable instructions stored thereon. When the non-transitory computer-readable instructions are run by a processor, all or part of the steps of the method of adjusting data anonymization based on dynamic correlation risk analysis according to embodiments of the present disclosure are performed.

[0198] The computer-readable storage medium described above includes, but is not limited to, optical storage media (e.g., CD-ROM and DVD), magneto-optical storage media (e.g., MO), magnetic storage media (e.g., magnetic tape or a mobile hard disk), media with built-in rewritable non-volatile memory (e.g., a memory card), and media with built-in ROM (e.g., a ROM cartridge).

[0199] The detailed description of the embodiments hereinabove with reference to the drawings are applicable to this example. Repetition is omitted here.

[0200] The above has described the basic principles of the present disclosure in combination with specific examples, but it needs to be pointed out that the advantages, benefits, effects and the like mentioned in the present disclosure are only examples and not limitations, and these advantages, benefits, effects and the like cannot be considered as necessary for each embodiment of the present disclosure. In addition, the above specific details of the disclosure are only for the purpose of example and for the purpose of understanding, and not for limitation, and the above details do not limit the present disclosure to be necessarily implemented with the above specific details.

[0201] In the present disclosure, the relationship terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between the entities or operations, and the block diagrams of the devices, apparatuses, equipment, systems involved in the present disclosure are only illustrative examples and are not intended to require or imply the connection, arrangement, configuration as shown in the block diagram. As those skilled in the art will recognize, these devices, apparatuses, equipment, systems can be connected, arranged, configured in any manner. Words such as "include", "contain", "have" and the like are open-ended words, which mean "including but not limited to", and can be used interchangeably. The words "or" and "and" used herein mean the word "and / or", and can be used interchangeably unless the context clearly indicates otherwise. The word "such as" used herein means the phrase "such as but not limited to", and can be used interchangeably.

[0202] In addition, as used herein, "or" used in a list of items, prefaced by "at least one of", indicates a disjunctive list such that, for example, a list of "at least one of A, B, or C" means A or B or C or AB or AC or BC or ABC (i.e., A and B and C). In addition, the phrase "example of" does not mean that the described example is preferred or better than other examples.

[0203] It also needs to be pointed out that in the systems and methods of the present disclosure, each component or each step can be decomposed and / or recombined. These decompositions and / or recombinations should be considered as equivalent solutions of the present disclosure.

[0204] Various changes, modifications, and alterations to the techniques described herein can be made without departing from the teachings of the attached claims. Moreover, the scope of the claims of the present disclosure is not limited to the particular aspects described herein. Rather, the scope of the claims of the present disclosure includes all alternatives, modifications, and equivalents falling within the scope of the claims of the present disclosure. Accordingly, the attached claims are incorporated into this Detailed Description by reference.

[0205] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the generic principles defined herein can be applied to other aspects without departing from the scope of the disclosure. Thus, the present disclosure is not intended to be limited to the aspects shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

[0206] The above description has been presented for the purpose of illustration and description. Furthermore, this description is not intended to limit the embodiments of the present disclosure to the forms disclosed herein. Although various example aspects and embodiments have been discussed above, those of ordinary skill in the art will appreciate a variety of modifications, alternatives, permutations, and equivalents thereof. Accordingly, the disclosure is intended to embrace all such alterations, modifications, and permutations of the aspects described herein, including other aspects falling within the scope of the appended claims.

Claims

1. A data anonymization adjustment method based on dynamic correlation risk analysis, characterized in that: include: Obtain all raw data associated with the first type system and the second type system within a preset period; wherein the first type system and the second type system are two types of systems constituting a cross-domain scenario; Extracting two types of cross-domain scene information from all the original data, the two types of cross-domain scene information including first domain features and second domain features having temporal correlation and spatial correlation; Obtaining a time matching rate between the first domain feature and the second domain feature based on a time window overlapping frequency; Acquire the spatial correlation between the first domain feature and the second domain feature based on an external map knowledge base; Obtaining semantic relevance between texts corresponding to the first domain feature and the second domain feature; Performing weighted fusion on the time matching rate, the spatial correlation, and the semantic correlation to obtain an association edge weight between the first domain feature and the second domain feature; Determining a path risk level formed by the first domain feature and the second domain feature according to the associated edge weight; Dynamically calling a corresponding anonymization strategy according to the path risk level, and executing the anonymization strategy on the data corresponding to the first domain feature and the second domain feature; Determining a path risk level formed by the first domain feature and the second domain feature according to the associated edge weight includes: Acquire a third domain feature in a tripartite system that has a location association with the first domain feature and the second domain feature; Based on all the first domain features, the second domain features, and the third domain features, a directed weighted graph is constructed, where an edge in the directed weighted graph represents an associated edge weight between two adjacent features, and a node represents each feature; Based on the directed weighted graph, determining each association path including the first domain feature, the second domain feature, and the third domain feature, and obtaining a total association weight of each association path, where the total association weight is the product of the weights of each association edge on the path; Determining the path sensitivity corresponding to each associated path according to a path sensitivity formula; No. The path sensitivity corresponding to the associated path is : ,in, For the The node sensitivity corresponding to the associated path, For the The total association weight corresponding to the association paths; Determining a path risk level corresponding to the path sensitivity according to a preset sensitivity range; The method of dynamically calling a corresponding anonymization strategy according to the path risk level and executing the anonymization strategy on the data corresponding to the first domain feature and the second domain feature includes: when the path risk level is high risk, calling the first anonymization strategy; obtaining the first associated text of the first domain feature in the first type of system and the second associated text of the second domain feature in the second type of system respectively; extracting the key fields in the first associated text and the second associated text respectively; and performing anonymization adjustment on all the key fields based on the first anonymization strategy.

2. The data anonymization adjustment method based on dynamic correlation risk analysis according to claim 1 is characterized in that: The obtaining of a time matching rate between the first domain feature and the second domain feature based on the time window overlapping frequency includes: Determine the total time between the earliest time and the latest time included in all the acquired raw data, and record it as the total time window; Determining a preset sub-time window according to the total time window; Obtaining the occurrence time difference between the first domain feature and the second domain feature within the same preset sub-time window; when the occurrence time difference is not greater than a preset time length, it is recorded as a match between the first domain feature and the second domain feature; Obtain all the times that the first domain feature and the second domain feature generate matches within the total time window, and record them as target matching times; Obtaining a time matching rate between the first domain feature and the second domain feature according to the target matching times and the total time window; The time matching rate is : ,in, is the number of target matches, is the total time window.

3. The data anonymization adjustment method based on dynamic correlation risk analysis according to claim 2 is characterized in that: The acquiring the spatial correlation between the first domain feature and the second domain feature based on the external map knowledge base includes: Calling an external map knowledge base to determine the latitude and longitude information of the actual occurrence location corresponding to the first domain feature, and recording it as the first location information; Calling an external map knowledge base to determine the latitude and longitude information of the actual location corresponding to the second domain feature, and recording it as the second location information; Obtaining a geographical distance between the first domain feature and the second domain feature according to the Haversine formula, the first location information, and the second location information; Obtaining the spatial correlation between the first domain feature and the second domain feature according to the geographical distance; The spatial correlation is : ;in, is the geographical distance, is the attenuation coefficient.

4. The data anonymization adjustment method based on dynamic correlation risk analysis according to claim 3 is characterized in that: The obtaining of the semantic relevance of the text corresponding to the first domain feature and the second domain feature includes: Obtaining a first associated text of the first domain feature in the first type of system; Extracting a semantic vector of the text field in the first associated text using the BERT model, recorded as a first semantic vector; Obtaining a second associated text of the second domain feature in the second type of system; Extracting a semantic vector of the text field in the second associated text using the BERT model, recorded as a second semantic vector; Calculating the vector similarity between the first semantic vector and the second semantic vector using a cosine similarity formula; Obtaining semantic relevance of texts corresponding to the first domain feature and the second domain feature according to the vector similarity; The semantic relevance is : , is the vector similarity.

5. The data anonymization adjustment method based on dynamic correlation risk analysis according to claim 4 is characterized in that: The weighted fusion of the time matching rate, the spatial correlation, and the semantic correlation to obtain the correlation edge weight between the first domain feature and the second domain feature includes: Determine key risk factors in the data scenarios according to the data scenarios corresponding to the first and second types of systems; Dynamically determine the time matching weight, spatial association weight, and semantic association weight based on the key risk factors; Performing weighted summation of the time matching rate, the spatial correlation, and the semantic correlation according to the time matching weight, the spatial correlation weight, and the semantic correlation weight to obtain an association edge weight between the first domain feature and the second domain feature; The associated edge weight is : ; in, , is the time matching weight, is the spatial association weight, is the semantic association weight, For time correlation, For spatial correlation, For semantic relevance.

6. The data anonymization adjustment method based on dynamic correlation risk analysis according to claim 1 is characterized in that: The anonymizing adjustment of all the key fields based on the first anonymization strategy includes: Determine the actual type of the key field; When the actual type is a time type, generalizing the precise time information corresponding to the key field into a broad time interval; When the actual type is a location type, generalizing the precise geographic information corresponding to the key field into a broad geographic interval, wherein the GPS accuracy of the broad geographic interval is lower than the GPS accuracy of the precise geographic information; When the actual type is a numerical type, Laplace noise is added to the numerical field corresponding to the key field.

7. A data anonymization adjustment system based on dynamic correlation risk analysis, characterized in that: include: A raw data acquisition module, configured to acquire all raw data associated with the first and second types of systems within a preset period; wherein the first and second types of systems are two types of systems constituting a cross-domain scenario; A domain feature acquisition module, configured to extract two types of cross-domain scene information from all the raw data, wherein the two types of cross-domain scene information include a first domain feature and a second domain feature having temporal correlation and spatial correlation; a time matching rate acquisition module, configured to obtain a time matching rate between the first domain feature and the second domain feature based on a time window overlapping frequency; A spatial correlation acquisition module, configured to acquire the spatial correlation between the first domain feature and the second domain feature based on an external map knowledge base; A semantic relevance acquisition module, configured to acquire the semantic relevance of texts corresponding to the first domain feature and the second domain feature; a fusion module, configured to perform weighted fusion on the time matching rate, the spatial correlation, and the semantic correlation to obtain an association edge weight between the first domain feature and the second domain feature; a path risk level acquisition module, configured to determine a path risk level formed by the first domain feature and the second domain feature according to the associated edge weight; a dynamic anonymization module, configured to dynamically call a corresponding anonymization strategy according to the path risk level, and execute the anonymization strategy on the data corresponding to the first domain feature and the second domain feature; Determining a path risk level formed by the first domain feature and the second domain feature according to the associated edge weight includes: Acquire a third domain feature in a tripartite system that has a location association with the first domain feature and the second domain feature; Based on all the first domain features, the second domain features, and the third domain features, a directed weighted graph is constructed, where an edge in the directed weighted graph represents an associated edge weight between two adjacent features, and a node represents each feature; Based on the directed weighted graph, determining each association path including the first domain feature, the second domain feature, and the third domain feature, and obtaining a total association weight of each association path, where the total association weight is the product of the weights of each association edge on the path; Determining the path sensitivity corresponding to each associated path according to a path sensitivity formula; No. The path sensitivity corresponding to the associated path is : ,in, For the The node sensitivity corresponding to the associated path, For the The total association weight corresponding to the association paths; Determining a path risk level corresponding to the path sensitivity according to a preset sensitivity range; The method of dynamically calling a corresponding anonymization strategy according to the path risk level and executing the anonymization strategy on the data corresponding to the first domain feature and the second domain feature includes: when the path risk level is high risk, calling the first anonymization strategy; obtaining the first associated text of the first domain feature in the first type of system and the second associated text of the second domain feature in the second type of system respectively; extracting the key fields in the first associated text and the second associated text respectively; and performing anonymization adjustment on all the key fields based on the first anonymization strategy.

8. A computer device, characterized in that: The computer device comprises: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the data anonymization adjustment method based on dynamic correlation risk analysis described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, which are used to enable a computer to execute the data anonymization adjustment method based on dynamic correlation risk analysis according to any one of claims 1 to 6.

10. A computer program product comprising computer instructions, characterized in that When the computer instructions are executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images