Data identification method and computing device

Abstract

The embodiment of the invention provides a data identification method and computing equipment. The method comprises the steps of obtaining a scanning task; the scanning task is used for indicating a to-be-identified data source, a first identification rule group and a second identification rule group; each identification rule of the first identification rule group is used for identifying first attribute information of the data; the first attribute information is a core attribute of the to-be-protected data; each identification rule in the second identification rule group is used for identifying second attribute information of the data; the second attribute information is an attribute required by a user in the to-be-protected data; based on the first identification rule group, identifying part of data in the data source to obtain a first identification result; and under the condition that the data source is determined to be the to-be-protected data source based on the first identification result, identifying all data in the data source based on a second identification rule group to obtain a second identification result. The method at least can improve the efficiency of identifying the to-be-protected data.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of data mining technology, and in particular to a data identification method and computing device. Background Art

[0002] With the rapid development of information technology and the ubiquity of the internet, data has become a vital resource in modern society. Industries across all sectors rely on data to drive business decisions, optimize operational processes, and enhance customer experience. However, with the massive generation and transmission of data, data security issues are becoming increasingly prominent. This is particularly true in sectors such as finance, healthcare, government, and e-commerce, where the leakage of protected data can result in severe economic losses and legal risks.

[0003] Against the backdrop of the rapid development of big data and informatization, data leakage and privacy protection are becoming increasingly prominent. Existing technologies use data recognition systems to identify and protect data to be protected from a large amount of data. However, existing data recognition systems have low recognition efficiency and are unable to promptly identify data to be protected from large amounts of data. Summary of the Invention

[0004] The embodiments of the present application provide a data identification method and a computing device, which can at least improve the efficiency of identifying data to be protected.

[0005] In a first aspect, an embodiment of the present application provides a data identification method, the method comprising: obtaining a scanning task; the scanning task is used to indicate a data source to be identified, as well as a first identification rule group and a second identification rule group; each identification rule in the first identification rule group is used to identify first attribute information of the data, and the first attribute information is a core attribute of the data to be protected; each identification rule in the second identification rule group is used to identify second attribute information of the data, and the second attribute information is an attribute required by a user in the data to be protected; based on the first identification rule group, part of the data in the data source is identified to obtain a first identification result; when the data source is determined to be the data source to be protected based on the first identification result, all the data in the data source is identified based on the second identification rule group to obtain a second identification result.

[0006] An embodiment of the present application provides a data identification method, in which a computing device obtains a scanning task, which is used to indicate a data source to be identified, as well as a first identification rule group and a second identification rule group. Among them, each identification rule of the first identification rule group is used to identify the first attribute information of the data, that is, the core attribute of the data to be protected. The computing device first identifies part of the data in the data source based on the first identification rule group to obtain a first identification result. If the data source is determined to be a data source to be protected based on the first identification result, all the data in the data source are identified based on the second identification rule group to obtain a second identification result that meets the attributes required by the user. It can be seen that compared with the prior art, the data identification method provided by the embodiment of the present application does not directly use all the identification rules to identify all the data in the data source to find the data to be protected, but divides the identification rules into a first identification rule group, first pre-scans the data source through the first identification rule group to determine whether the data source is a data source to be protected. If it is determined to be, the data source is scanned based on the second identification rule group that reflects the user's needs, thereby effectively improving the efficiency of data identification, especially the efficiency of identifying the data to be protected.

[0007] In one possible implementation, the partial data is multiple data in the data source; the first identification result includes the number of data in the partial data that meets the first identification rule group; the method also includes: if the ratio between the number of data that meets the first identification rule group and the number of data in the partial data is greater than a first threshold, determining that the data source is a data source to be protected.

[0008] In another possible implementation, the partial data is any data in the data source; the first identification result includes the number of fields in the partial data that comply with the first identification rule group; and the method further includes: if the ratio of the number of fields in the partial data that comply with the first identification rule group to the total number of fields in the partial data is greater than a second threshold, determining that the data source is a data source to be protected. It should be understood that, considering the consistent format of each data in the database, by obtaining a field of any data for comparison, it is possible to accurately determine whether the data in the data source is data to be protected. This eliminates the need to scan multiple data sets, thereby effectively improving data identification efficiency.

[0009] In another possible implementation, when the scanning task indicates multiple data sources to be identified, the method further includes: when it is determined based on the first identification result that the data source is not a data source to be protected, identifying the next data source to be identified based on the first identification rule group. It can be understood that if the first identification result does not meet the judgment conditions of the data source to be protected, it means that the data of the currently identified data source does not include the data to be protected, or does not include the data type to be protected that the user wants (for example, the user needs data related to personal privacy, and the current data source stores data related to institutional information). In this case, the data source can be skipped and the next data source to be identified can be identified, so as to save the consumption of scanning resources and effectively improve the efficiency of data identification in the scenario of multiple data sources identification.

[0010] In another possible implementation, based on the first identification rule group, part of the data in the data source is identified to obtain a first identification result, including: according to the database type of the data source, converting the first identification rule group into a query statement that conforms to the format specified by the database type; using the query statement to identify part of the data in the data source to obtain the first identification result.

[0011] In another possible implementation, the method further includes: periodically detecting whether the first recognition rule group in the scanning task has been updated; if the first recognition rule group has been updated during the scanning task, converting the updated first recognition rule group into an updated query statement; the updated query statement conforming to the format specified by the database type; and using the updated query statement to identify a portion of the data in the data source. It can be seen that during the execution of the scanning task, the user can adjust the first and second recognition rule groups of the scanning task at any time based on the current scanning situation, thereby increasing the flexibility of data recognition and ensuring more accurate scanning results.

[0012] In another possible implementation, the database type includes at least one of the following: a relational database; a key-value database; an analytical database; or a distributed document database.

[0013] In another possible implementation, the method further includes: displaying the second recognition result in a visual form through a terminal.

[0014] In a second aspect, an embodiment of the present application provides a data identification device, which is used to execute any one of the data identification methods provided in the first aspect above.

[0015] In a third aspect, an embodiment of the present application provides a computing device comprising a processor and a memory; the processor is coupled to the memory; the memory is used to store computer instructions, which are loaded and executed by the processor to enable the computing device to implement the method of the first aspect above.

[0016] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, which includes: computer software instructions; when the computer software instructions are executed in a computing device, the computing device implements the method of the first aspect above.

[0017] In a fifth aspect, an embodiment of the present application provides a computer program product. When the computer program product is run on a computing device, the computing device executes the steps of the related method described in the first aspect above to implement the method of the first aspect above.

[0018] The beneficial effects of the second to fifth aspects mentioned above can be referred to the corresponding description of the first aspect and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 A schematic diagram of an application scenario provided in an embodiment of the present application;

[0020] Figure 2 A schematic diagram of the system architecture of a server provided in an embodiment of the present application;

[0021] Figure 3 A flowchart of a data identification method provided in an embodiment of the present application;

[0022] Figure 4 A flowchart of another data identification method provided in an embodiment of the present application;

[0023] Figure 5 A flowchart of another data identification method provided in an embodiment of the present application;

[0024] Figure 6 A flowchart of another data identification method provided in an embodiment of the present application;

[0025] Figure 7 A flowchart of another data identification method provided in an embodiment of the present application;

[0026] Figure 8 A flowchart of another data identification method provided in an embodiment of the present application;

[0027] Figure 9 A schematic diagram of the composition of a data identification device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0028] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0029] It should be noted that in the embodiments of this application, words such as "exemplarily" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design described in the embodiments of this application as "exemplarily" or "for example" should not be interpreted as being more preferred or advantageous than other embodiments or designs. Rather, the use of words such as "exemplarily" or "for example" is intended to present the relevant concepts in a concrete manner.

[0030] In order to facilitate a clear description of the technical solutions of the embodiments of the present application, in the embodiments of the present application, words such as "first" and "second" are used to distinguish between identical or similar items with basically the same functions and effects. Those skilled in the art can understand that words such as "first" and "second" do not limit the quantity and execution order.

[0031] The following is a brief description of the professional terms involved in the embodiments of this application:

[0032] 1. Data Mining: Data mining is the process of extracting useful information and knowledge from large amounts of data. It combines methods and techniques from multiple disciplines, such as statistics, machine learning, and database technology, to discover patterns and relationships in data to support decision-making.

[0033] 2. Data Identification: Data identification refers to the process of identifying specific types of data or information from a large amount of data using technical means and algorithms. Data identification has a wide range of applications in various fields, including text processing, image recognition, and speech recognition.

[0034] 3. Protected Data: Protected data refers to data that, without authorization, could pose a threat to the privacy, property, and security of individuals, organizations, or nations. This type of data typically requires strict protection measures to prevent leakage, tampering, or misuse.

[0035] 4. Data source: refers to the source or storage location of data. It can be any system, device, file or service that can provide data, such as a database.

[0036] 5. Multi-sourcing: This refers to obtaining data, information, or resources from multiple sources or channels. In practical applications, multi-sourcing can be reflected in data collection, analysis, communication, and other aspects. By integrating multiple data sources, the completeness and accuracy of information can be improved.

[0037] An embodiment of the present application provides a data identification method. When identifying data to be protected in a data source, a portion of the data in the data source is pre-scanned. When it is determined that the data source contains the data source to be protected, all the data is scanned to obtain the data identification results required by the user, thereby effectively improving the identification efficiency of the data to be protected.

[0038] In some embodiments, a computing device obtains a scanning task, which is used to indicate a data source to be identified, as well as a first identification rule group and a second identification rule group. Among them, each identification rule of the first identification rule group is used to identify the first attribute information of the data, that is, the core attribute of the data to be protected. The computing device first identifies part of the data in the data source based on the first identification rule group to obtain a first identification result. If the data source is determined to be a data source to be protected based on the first identification result, all the data in the data source are identified based on the second identification rule group to obtain a second identification result that meets the attributes required by the user. It can be seen that compared with the prior art, the data identification method provided in the embodiment of the present application does not directly use all the identification rules to identify all the data in the data source to find the data to be protected, but divides the identification rules into a first identification rule group, first pre-scans the data source through the first identification rule group, and determines whether the data source is a data source to be protected. If it is determined to be, the data source is scanned based on the second identification rule group that reflects the user's needs, thereby effectively improving the data identification efficiency, especially the identification efficiency of the data to be protected.

[0039] The data source to be protected here refers to a data source in which the amount of data to be protected is greater than a certain threshold.

[0040] Figure 1 A schematic diagram of an application scenario provided by an embodiment of the present application is shown. Figure 1 As shown, the embodiment of the present application can be executed by a computing device 100, which can be a server running a data identification system (data identification system to be protected).

[0041] The computing device 100 can interact with the user-side display device / terminal 110. The display page of the data recognition system can be displayed on the user-side display device 110.

[0042] The display device 110 on the user side may be a device with an interface display function. For example, the display device 110 on the user side may display a display page of the data recognition system through a browser.

[0043] Optionally, the display device 110 on the user side may be a smart phone, a tablet computer, a personal portable computer, etc., which is not limited here.

[0044] As an example, a user can configure a first identification rule group, a second identification rule group, and a data source to be identified through terminal operations, and then create a scan task on a computing device. Furthermore, the computing device executes the scan task, first using the first identification rule group to identify a portion of the data in the data source, obtaining a first identification result. If, based on the first identification result, the data source is determined to be a source to be protected, the second identification rule group is then used to identify all data in the data source, obtaining a second identification result.

[0045] The following uses the computing device as an example to introduce its system architecture. Figure 2 This is a schematic diagram of the server system architecture, such as Figure 2 As shown, the server's hardware includes a processor, an out-of-band controller, an external storage device, and a memory. The software includes an out-of-band management module and an operating system (OS).

[0046] The out-of-band management module runs in the out-of-band controller, and the OS runs on the processor (such as Figure 2 shown).

[0047] The out-of-band management module can be a management unit for non-business modules. For example, the out-of-band management module can remotely maintain and manage the server through a dedicated data channel. The out-of-band management module is completely independent of the server's operating system and can communicate with the basic input and output system (BIOS) and OS through the server's out-of-band management interface.

[0048] Exemplarily, the out-of-band management module may include a management unit for managing the server's operating status, a management system in a management chip, a system management module (SMM), etc. It should be noted that the embodiments of the present application do not limit the specific form of the out-of-band management module, and the above description is merely exemplary.

[0049] Memory, also known as internal memory or main memory, is installed in the memory slots on the server's motherboard. The memory communicates with the memory controller through a memory channel.

[0050] The external memory may be a hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the server, or an external storage device such as a USB flash drive.

[0051] The data identification method provided in the embodiment of the present application can be applied to Figure 2 processor shown.

[0052] It should be noted that the system architecture and application scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Ordinary technicians in this field can know that with the evolution of the system architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0053] Figure 3 The following is a flow chart of a data identification method provided in an embodiment of the present application. For example, the data identification method provided in an embodiment of the present application can be applied to Figure 1 or Figure 2 In the computing device shown, in other words, the method can be executed by the computing device, specifically, the method can be executed by a processor of the computing device.

[0054] like Figure 3 As shown, the data identification method provided in the embodiment of the present application may include the following steps:

[0055] S301: Obtain a scanning task.

[0056] The scanning task indicates the data source to be identified, as well as the first and second identification rule groups. Each identification rule in the first identification rule group is used to identify first attribute information of the data, which is the core attribute of the data to be protected. Each identification rule in the second identification rule group is used to identify second attribute information of the data, which is the attribute required by the user in the data to be protected.

[0057] Hereinafter, the identification rule for identifying the first attribute information of data is referred to as a first identification rule, and the identification rule for identifying the second attribute information of data is referred to as a second identification rule.

[0058] Recognition rules primarily identify specific types of data, such as mobile phone numbers and ID numbers. These rules can be regular expressions, which are patterns used to match strings. For example, the regular expression for matching an 11-digit mobile phone number is "^1[3-9]\d{9}$." Regular expressions provide a flexible and powerful way to search, replace, and manipulate text, making them widely used in data processing, text analysis, programming, and other fields.

[0059] In the embodiment of the present application, the first identification rule group is also referred to as the core rule group. The function of the core rule group is to identify the data source containing the data to be protected. The second identification rule group constitutes the general rule group. The general rule group is mainly configured by the user according to the actual scenario requirements to identify the specific data required by the user. The identification rules in the first identification rule group and the second identification rule group can be partially the same or completely different. Specific examples of the first identification rule group and the second identification rule group are described below and will not be described in detail here.

[0060] For example, a data recognition system is running on a computing device, and the terminal can access the computing device's data recognition system to display the data recognition system interface on the terminal's display. The user can configure the data source to be identified, the first recognition rule group, and the second recognition rule group through operations on the display interface to create a scanning task. Furthermore, the terminal sends the created scanning task to the computing device, which can retrieve the scanning task and execute the following S302.

[0061] For example, consider configuring the data source to be identified in a scanning task. For example, the display interface may display the identifiers (e.g., names, etc.) of multiple data sources pre-configured by the data identification system, and the user may select one or more data sources from the pre-configured data sources as the data source to be identified. Alternatively, the user may configure the access address of the data source to be scanned on the display interface to configure the data source to be identified.

[0062] It should be noted that the data source can specifically be a database. The data source supported by the data identification system of the related art is relatively single, and can only support one type of database (such as only supporting MySQL), or only support one type of data source (such as a relational database). The data identification system provided in the embodiment of the present application can support different database types. The database type includes at least one of the following:

[0063] Relational databases, such as MySQL, Oracle, DM, PostgreSQL, GaussDB, and TIDB;

[0064] Key-value databases, such as Redis;

[0065] Analytical databases, such as CK;

[0066] Distributed document databases, such as ES and MongoDB.

[0067] Taking the configuration of the first recognition rule group and the second recognition rule group in a scanning task as an example, the display interface can display multiple first recognition rules and multiple second recognition rules pre-configured by the data recognition system. Different recognition rules are used to identify different types of data (such as personal information, organizational information, and object information). Users can select the first recognition rule group and the second recognition rule group according to their needs to create a scanning task.

[0068] Optionally, the scanning task may also include parameters such as execution frequency and execution time. By specifying the execution frequency and execution time, the user instructs the computing device how often and when to perform data recognition, thereby achieving automation and reducing the workload of human participation.

[0069] S302: Based on the first recognition rule group, identify part of the data in the data source to obtain a first recognition result.

[0070] The first recognition result may include the number of data that meets the first recognition rule group, the specific content of the data, the identifier (location) of the data, etc. Partial data may be pre-configured, referring to multiple data or any data in the data source, such as the first 500 data in the data source, or the first data in the data source, etc. The user can select and specify partial data according to the actual scenario.

[0071] In one possible implementation, Figure 4 As shown, the above S302 can be specifically implemented as follows:

[0072] S3021. According to the database type of the data source, convert the first identification rule group into a query statement that complies with the format specified by the database type.

[0073] It should be noted that database queries rely on specialized query statements (SQL statements). Since the data recognition system of the present embodiment can support different database types, and the query statement formats specified by different database types are different, when executing a scanning task, the computing device can select different syntaxes to use the first recognition rule set based on the database type of the data source.

[0074] In some embodiments, the database type includes at least one of the following: a relational database; a key-value database; an analytical database; and a distributed document database.

[0075] For example, if the first recognition rule "^1[3-9]\d{9}$" is used to match mobile phone numbers, the query statement converted to the first recognition rule in a MySQL database can be expressed as: SELECT * FROM table name WHERE column name REGEXP'^1[3-9]\\ d{9}$ ', that is, the regular expression is referenced by the "REGEXP" function. If it is an Oracle database, the first recognition rule can be converted into a query statement: SELECT * FROM table name WHERE column name ~ '^1[3-9] \\d{9}$ ', that is, the regular expression is quoted through the "~" symbol.

[0076] S3022: Use a query statement to identify part of the data in the data source to obtain a first identification result.

[0077] After obtaining a query statement that meets the format requirements of the data source, the computing device can use the query statement to perform data identification (data query, data scanning) on the data source to be identified, and obtain a first identification result that meets the first identification rule group.

[0078] It can be seen that by converting the matching rules according to the database type, the data recognition system can access multiple data sources, thereby improving the feasibility of the data recognition system to support multiple sources (referring to obtaining data, information or resources from multiple different sources or channels).

[0079] S303: When the data source is determined to be a data source to be protected based on the first identification result, all data in the data source are identified based on the second identification rule group to obtain a second identification result.

[0080] A data source to be protected refers to a data source in which the amount of data to be protected exceeds a certain threshold. In other words, when most of the data in a data source is data to be protected that is relevant to user needs, the data source can be considered to be a data source to be protected.

[0081] In an embodiment of the present application, if the data source is determined to be a data source to be protected based on the first identification result, the computing device may use a second identification rule set that reflects the user's needs to identify all data in the data source to obtain a second identification result. The second identification result includes the number of data that meets the second identification rule set, the specific content of the data, the identifier (location) of the data, etc.

[0082] Specifically, the first identification result determines whether the data source in the data source contains protected data related to the user's needs. For example, if the user needs to identify personal privacy data, but the current data source stores institutional privacy data, it can be said that the data source does not contain protected data, or does not contain protected data related to the user's needs, and is therefore not a protected data source.

[0083] It should be noted that similarly, the computing device may convert the second identification rule group into a query statement in a format specified by the database type of the data source, and then use the query statement to identify the data source to obtain a second identification result.

[0084] Optionally, after obtaining the second recognition result, the computing device may display the second recognition result in a visual form through the terminal. Specifically, the computing device may process the second recognition result using a visualization tool and then intuitively display it to the user in the form of a chart or report, so that the user can determine the quantity and data type distribution of the data to be protected and then take appropriate protection measures to protect the data.

[0085] The following describes two possible implementations of determining whether data in a data source is to be protected based on the first identification result:

[0086] In one possible implementation, the partial data comprises multiple pieces of data in the data source, and the first identification result comprises the number of pieces of data in the partial data that meet the first identification rule group. The data identification method of this embodiment of the application further comprises: if a ratio between the number of pieces of data that meet the first identification rule group and the number of pieces of data in the partial data is greater than a first threshold, determining that the data source is a data source to be protected.

[0087] Among them, the first threshold can be determined according to the actual scenario, and the embodiment of the present application does not impose any specific limitation on this.

[0088] For example, the computing device may scan the first 500 pieces of data in the data source. If 450 of the pieces of data meet the first identification rule group (for example, all contain mobile phone numbers), and the ratio between the number of pieces of data meeting the first identification rule group and the number of pieces of data is 90% and greater than a first threshold (for example, 80%), then the first identification result is determined to meet the judgment condition for the data source to be protected.

[0089] In another possible implementation, the partial data is any data in the data source. The first identification result includes the number of fields in the partial data that comply with the first identification rule group, and the partial data is any data in the data source. The data identification method of the embodiment of the present application further includes: if the ratio of the number of fields in the partial data that comply with the first identification rule group to the total number of fields in the partial data is greater than a second threshold, then determining that the data source is a data source to be protected.

[0090] The second threshold value may be determined according to the actual scenario, and the embodiment of the present application does not impose any specific limitation on this.

[0091] It is understood that the format of each piece of data in the database is generally the same, including multiple fields. For example, the first piece of data in the data source includes four fields, three of which are related to personal privacy, such as name, ID number, and mobile phone number. If the ratio of the number of fields that meet the first identification rule group to the total number of fields in the data is greater than a second threshold (e.g., 50%), then it can be determined that the first identification result meets the judgment condition of the data source to be protected, that is, every piece of data in the data source is related to personal privacy.

[0092] It should be understood that, given the consistent format of all data in the database, by obtaining and comparing any field of any data, it is possible to accurately determine whether the data in that data source is the data to be protected. This eliminates the need to scan multiple data sets, thereby effectively improving data identification efficiency.

[0093] The data identification method provided in the embodiments of the present application is illustrated below with reference to specific examples.

[0094] In a possible implementation, the first identification rule group is used to identify different types of data according to different objects to which the data to be protected belongs.

[0095] Exemplarily, when the object is an individual, the first identification rule group is used to identify at least one of the following: personal identity information, personal financial information, and personal behavior information.

[0096] Personal identity information may include: name, ID number, passport number, social security number, driver's license number, date of birth, address, telephone number, email address, etc. Personal financial information may include: credit card number, debit card number, bank account number, payment information number, transaction history, etc. Personal behavior information may include: user browsing history, purchase order number, medical record changes, medical diagnosis and treatment records, etc.

[0097] As another example, when the object is an organization, the first identification rule group is used to identify at least one of the following: confidential information of the organization, identity information of the organization, and intellectual property information.

[0098] Confidential information may include: financial statements, contract documents, legal documents, internal communication records, etc. Identity information may include: business license number, tax registration certificate number, organization code, etc. Intellectual property information may include: invention patent numbers, copyrights, trademarks, etc.

[0099] As another example, when the object is an object, the first recognition rule group is used to recognize at least one of the following: network service information, object identification information.

[0100] The network service information may include the following: Internet Protocol (IP) address, Media Access Control (MAC) address, etc. The object identification information may include the following: production number, item code number, etc.

[0101] As can be seen, the first identification rule group primarily determines whether data is protected data by identifying whether the data possesses the core attributes of the protected data. For example, the first identification rule group can identify ID numbers, names, etc. If the majority of data in a data source meets the first identification rule group, it means that the data in this data source is highly likely to involve personal privacy and is protected data. Therefore, the first identification rule group generally covers the most critical and protected data types to prevent leakage, tampering, or abuse.

[0102] The second recognition rule group is used to identify data required by users in specific scenarios and is configured by users of the data recognition system based on specific scenarios, such as identifying specific keywords or personal residential addresses.

[0103] To illustrate with an example, for example, if the user currently needs to query whether data source A involves "personal residential address" as data to be protected, the user configures the second identification rule group to identify "personal residential address". In related technologies, the second identification rule group is generally used to directly scan all the data in each data source to determine whether the data source involves "personal residential address" as data to be protected, but such identification efficiency is low. If the user needs to identify more items, for example, in addition to "personal residential address", it also involves "educational information", etc., if all the data is scanned, the data identification efficiency will be further reduced.

[0104] In the data identification method provided in the embodiment of the present application, the object described by the data of "personal residential address" is an individual. Therefore, the first identification rule group can be used to first determine whether the data source to be identified belongs to a data source involving personal privacy data, that is, to identify part of the data in the data source by name, mobile phone number, ID card number, etc. If the first identification result indicates that most of the data in the data source includes information such as name, mobile phone number, ID card number, etc., it means that the data source is a data source involving data to be protected, and the computing device uses the second identification rule group (that is, the "personal residential address" required by the user) to identify all the data in the data source, and obtains a second identification result that meets the user's needs. If the data source stores data related to an institution or company, the content of "personal residential address" cannot be identified from the data source, then the data source can be skipped and the next data source can be identified.

[0105] For another example, the current user needs to query whether a certain data source involves "annual turnover", which is data related to the organization and needs to be protected. In this case, the user can first use the first identification rule group to determine whether the data source device involves content related to the privacy of the organization, that is, to identify part of the data in the data source through the organization's identity information, organization financial statements, etc. If it is determined that the data source includes data to be protected, the computing device uses the second identification rule group (that is, the "annual turnover" required by the user) to identify all the data in the data source and obtain a second identification result that meets the user's needs.

[0106] In some scenarios, the above scanning task may indicate multiple data sources to be identified, such as Figure 5 As shown, after the above S302, the method further includes:

[0107] S304: When it is determined based on the first identification result that the data source is not the data source to be protected, identify the next data source to be identified based on the first identification rule group.

[0108] It can be understood that if the first identification result does not meet the judgment conditions of the data source to be protected, it means that the data of the currently identified data source does not include the data to be protected, or does not include the data type to be protected that the user wants (for example, the user requires data related to personal privacy, and the current data source stores data related to institutional information). In this case, the data source can be skipped and the next data source to be identified can be identified, so as to save the consumption of scanning resources in the scenario of multi-data source identification and effectively improve the data identification efficiency.

[0109] In one possible implementation, during the execution of a scanning task, the computing device can record the execution status through a log (for example, the start time, execution time, and execution status (normal or abnormal) of the scanning task) to facilitate the user to obtain the operating status of the computing device or analyze operating failures.

[0110] In one possible implementation, if a temporary error (such as a network failure) is detected during the execution of a scan task, the computing device can automatically retry, i.e., wait for a period of time before executing the scan task again. If an error that cannot be automatically recovered occurs during the execution of a scan task (such as the data source address does not exist), the computing device can notify the user via email or SMS, allowing the user to assist in timely error correction.

[0111] The rule base (identification rule group) configured in the data identification system of the related art is generally static and fixed, and cannot be applied to the complex and changeable data formats of different data sources. If the user needs to change the rule base during the execution of the scanning task, it is necessary to manually pause the scanning task, change the rule base, and recreate the scanning task for data identification. The data identification method provided in the embodiment of the present application can automatically detect whether the identification rules in the scanning task have changed. Figure 6 As shown, the method further includes:

[0112] S601: Periodically check whether the first recognition rule group in the scanning task is updated.

[0113] The computing device can provide a user interface for modifying recognition rules through a user-side display device. For example, the user can be provided with multiple configured candidate first recognition rule groups, and the user can select a new first recognition rule group to add to a scan task, or delete existing recognition rules from the scan task. For another example, the user can create a new first recognition rule group through the interface, such as by configuring a name and corresponding regular expression, to add the first recognition rule group to a scan task.

[0114] S602: When the first recognition rule group is updated during the scanning task, the updated first recognition rule group is converted into an updated query statement that complies with a format specified by the database type.

[0115] S603: Use the updated query statement to identify part of the data in the data source.

[0116] With respect to steps S601-S603 above, the computing device can set up a separate thread to determine whether the first identification rule group currently configured in the scanning task has changed compared to the first identification rule group previously obtained. If so, the updated first identification rule group can be converted into a query statement in the format specified by the data source, and data identification can continue to be performed on the data source based on the updated query statement, thereby ensuring the continuity of the scanning task and allowing the user to perform data identification more flexibly.

[0117] It should be noted that the above S601-S603 are described using the first recognition rule group as an example. If the second recognition rule group is updated during the scanning task, the updated second recognition rule group is converted into an updated query statement, and the updated query statement is used to identify all data in the data source.

[0118] It can be seen that during the execution of the scanning task, the user can adjust the first recognition rule group and the second recognition rule group of the scanning task at any time according to the current scanning situation, thereby improving the flexibility of data recognition and ensuring more accurate scanning results.

[0119] Figure 7 A flow chart of another data identification method provided in an embodiment of the present application. Figure 7 As shown, first, 1. A user accesses the data identification system through a terminal. 2. The data source to be identified is entered. 3. Identification rules are configured. 4. A scan task is created. 5. The scan task is executed. 6. The identification results of the data to be protected are displayed (e.g., in the form of a chart).

[0120] Figure 8 A flow chart of another data identification method provided in an embodiment of the present application. Figure 8 As shown, first, 1. Create a scanning task. During the creation of the scanning task, 1.1. Configure one or more data sources to be identified. 1.2. Configure the identification rules (including the first identification rule group and the second identification rule group). Then, 2. Execute the scanning task. During the execution of the scanning task, 3. The rule and data source fusion module (generates corresponding query statements according to different data sources). 4. Use the query statement corresponding to the first identification rule group to query the data source to obtain the first identification result. 5. Determine whether the first identification result meets the judgment condition of the data source to be protected. If not, return to step 4. If so, 6. The rule and data source fusion module uses the query statement corresponding to the second identification rule group to query the data source to obtain the second identification result. 7. Display the identification result. Optionally, 8. When it is detected that the first identification rule group or the second identification rule group is updated, re-execute step 3, that is, the rule and data source fusion module regenerates the query statement.

[0121] In the data identification method provided in the embodiment of the present application, a computing device obtains a scanning task, which is used to indicate the data source to be identified, as well as a first identification rule group and a second identification rule group. Among them, each identification rule in the first identification rule group is used to identify the first attribute information of the data, that is, the core attribute of the data to be protected. The computing device first identifies part of the data in the data source based on the first identification rule group to obtain a first identification result. If the data source is determined to be a data source to be protected based on the first identification result, all the data in the data source are identified based on the second identification rule group to obtain a second identification result that meets the attributes required by the user. It can be seen that compared with the prior art, the data identification method provided in the embodiment of the present application does not directly use all the identification rules to identify all the data in the data source to find the data to be protected, but divides the identification rules into a first identification rule group, first pre-scans the data source through the first identification rule group to determine whether the data source is a data source to be protected. If it is determined to be, it is scanned based on the second identification rule group that reflects the user's needs, thereby effectively improving the efficiency of data identification, especially the efficiency of identifying the data to be protected.

[0122] The data recognition method of the present embodiment supports the dynamic addition and modification of recognition rules. When the computing device detects a change in the recognition rule set in a scanning task, it can regenerate the corresponding scanning statement and continue scanning, ensuring the continuity of the scanning task while allowing users to perform data recognition more flexibly.

[0123] It can be seen that the above mainly introduces the solution provided by the embodiment of the present application from the perspective of the method. In order to achieve the above functions, the embodiment of the present application provides a hardware structure and / or software module corresponding to the execution of each function. Those skilled in the art should easily appreciate that, in combination with the modules and algorithm steps of each example described in the embodiment disclosed herein, the embodiment of the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in a hardware or computer software driven hardware manner depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0124] In an exemplary embodiment, the present application further provides a data identification device. The data identification device may be the aforementioned computing device or a processor in the computing device. The data identification device may include one or more functional modules for implementing the data identification method of the above method embodiment.

[0125] For example, Figure 9 This is a schematic diagram of a data identification device provided in an embodiment of the present application. Figure 9 As shown, the data identification device includes: an acquisition module 901 and a determination module 902. The acquisition module 901 and the determination module 902 are connected to each other.

[0126] The acquisition module 901 is used to obtain a scanning task; the scanning task is used to indicate the data source to be identified, as well as the first identification rule group and the second identification rule group; each identification rule in the first identification rule group is used to identify first attribute information of the data, which is the core attribute of the data to be protected; each identification rule in the second identification rule group is used to identify second attribute information of the data, which is the attribute required by the user in the data to be protected;

[0127] The determination module 902 is configured to identify part of the data in the data source based on the first identification rule group to obtain a first identification result;

[0128] The determination module 902 is configured to, when the data source is determined to be a data source to be protected based on the first identification result, identify all data in the data source based on the second identification rule group to obtain a second identification result.

[0129] For the detailed description of the above optional methods, please refer to the above method embodiments, which will not be repeated here. In addition, the explanation of any data recognition device provided above and the description of its beneficial effects can refer to the above corresponding method embodiments, which will not be repeated here.

[0130] The embodiment of the present application also provides a computer-readable storage medium. All or part of the processes in the above method embodiments can be completed by computer instructions to instruct related hardware. Exemplarily, the related hardware can be a processor of a computing device. The program instructions can be stored in the above computer-readable storage medium. When the program instructions are executed, the processes of the above method embodiments can be implemented. The computer-readable storage medium can be a memory. The above computer-readable storage medium can also be an external storage device, such as a hard disk, a smart memory card (smart media card, SMC), a secure digital (secure digital, SD) card, a flash card (flash card), etc. Further, the above computer-readable storage medium can also include both a memory and an external storage device. The above computer-readable storage medium is used to store the above computer program instructions and other programs and data required for the above data recognition method or page display method.

[0131] An embodiment of the present application further provides a computer program product, which includes a computer program. When the computer program product is run on a computing device, the computing device is enabled to execute any one of the data identification methods provided in the above embodiments.

[0132] Although the present application is described herein in conjunction with various embodiments, in the process of implementing the claimed application, those skilled in the art may understand and implement other variations of the disclosed embodiments by reviewing the drawings, the disclosure, and the appended claims. In the claims, the word "comprising" does not exclude other components or steps, and "one" or "an" does not exclude multiple components. A single processor or other unit may implement several functions listed in the claims. Certain measures are recorded in different dependent claims, but this does not mean that these measures cannot be combined to produce good results.

[0133] Although the present application has been described with reference to specific features and embodiments thereof, it is apparent that various modifications and combinations may be made thereto without departing from the spirit and scope of the present application. Accordingly, this specification and the drawings are merely illustrative of the present application as defined by the appended claims and are deemed to cover any and all modifications, variations, combinations or equivalents within the scope of the present application. Obviously, those skilled in the art may make various modifications and variations to the present application without departing from the spirit and scope of the present application. Thus, the present application is intended to include such modifications and variations as fall within the scope of the claims of the present application and their equivalents.

[0134] The above are only specific embodiments of the present application, but the scope of protection of the present application is not limited thereto. Any changes or replacements within the technical scope disclosed in this application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A data identification method, characterized in that: The method comprises: Obtain a scanning task; the scanning task is used to indicate a data source to be identified, as well as a first identification rule group and a second identification rule group; each identification rule in the first identification rule group is used to identify first attribute information of the data, where the first attribute information is a core attribute of the data to be protected; each identification rule in the second identification rule group is used to identify second attribute information of the data, where the second attribute information is a user-required attribute of the data to be protected; Identify part of the data in the data source based on the first identification rule group to obtain a first identification result; In the case where the data source is determined to be a data source to be protected based on the first identification result, all data in the data source are identified based on the second identification rule group to obtain a second identification result.

2. The method according to claim 1, characterized in that The partial data is a plurality of pieces of data in the data source; the first recognition result includes the number of pieces of data in the partial data that meet the first recognition rule group; the method further includes: If the ratio between the amount of data that meets the first identification rule group and the amount of data in the partial data is greater than a first threshold, the data source is determined to be a data source to be protected.

3. The method according to claim 1, characterized in that The partial data is any data in the data source; the first recognition result includes the number of fields in the partial data that meet the first recognition rule group; the method further includes: If the ratio of the number of fields in the partial data that meet the first identification rule group to the total number of fields in the partial data is greater than a second threshold, the data source is determined to be a data source to be protected.

4. The method according to any one of claims 1 to 3, characterized in that In the case where the scanning task indicates a plurality of data sources to be identified, the method further includes: If it is determined based on the first identification result that the data source is not a data source to be protected, the next data source to be identified is identified based on the first identification rule group.

5. The method according to any one of claims 1 to 4, characterized in that Based on the first identification rule group, a portion of the data in the data source is identified to obtain a first identification result, including: According to the database type of the data source, converting the first identification rule group into a query statement in a format that complies with the format specified by the database type; The query statement is used to identify part of the data in the data source to obtain the first identification result.

6. The method according to claim 5, characterized in that The method further comprises: Periodically detecting whether the first recognition rule group in the scanning task is updated; When the first recognition rule group is updated during the scanning task, converting the updated first recognition rule group into an updated query statement; the updated query statement complies with the format specified by the database type; The updated query statement is used to identify part of the data in the data source.

7. The method according to claim 5, characterized in that The database type includes at least one of the following: Relational database; Key-value database; Analytical database; Distributed document database.

8. The method according to any one of claims 1 to 7, characterized in that The method further comprises: The second recognition result is displayed in a visual form through the terminal.

9. A computing device, characterized in that The computing device includes a processor and a memory; the processor is coupled to the memory; The memory is used to store computer instructions; The computer instructions are loaded and executed by the processor to enable the computing device to implement the method according to any one of claims 1 to 8.

Images