A distributed data dynamic weaving method

Abstract

The present invention belongs to the technical field of dynamic data weaving, and discloses a distributed data dynamic weaving method; the method comprises: constructing a cloud domain sub-graph, an edge domain sub-graph and a terminal domain sub-graph based on the historical operation data of the distributed data environment; constructing a cross-domain fusion graph based on the cloud domain sub-graph, the edge domain sub-graph and the terminal domain sub-graph; dynamically weaving the real-time device behavior data and the real-time device feature data of the distributed data environment to construct user portraits, behavior portraits and data access portraits; dynamically weaving the user portraits, behavior portraits and data access portraits based on the cross-domain fusion graph to obtain the corresponding minimum correlation sub-graph; fusing and dynamically weaving the minimum correlation sub-graphs corresponding to the user portraits, behavior portraits and data access portraits to form a cross-platform strategy blueprint; the dynamic weaving mechanism of the present application realizes intelligent weaving operations at the structural level and the semantic level.

Description

Technical Field

[0001] The present invention relates to the technical field of dynamic data weaving, and more particularly, to a distributed dynamic data weaving method. Background Art

[0002] With the rapid development of cloud computing, edge computing, and intelligent terminals, data security governance has become cross-platform, distributed, and multi-source heterogeneous. To achieve unified modeling of user access behavior, data asset usage paths, and security policy deployment status, data dynamic weaving technology has been gradually introduced into security policy generation and access control systems to build a policy graph structure with semantic association capabilities. In existing technologies, historical data and access logs are usually constructed as graph nodes and edge relationships through preset rules. When access occurs, fixed paths are extracted from the graph to generate corresponding policy templates or security instructions to achieve graph-driven security decisions.

[0003] However, existing graph-driven policy generation methods generally rely on static rules and predefined path templates, which present numerous limitations in real-world multi-platform, dynamic access scenarios. For one thing, existing methods struggle to effectively integrate the structural semantics of profiles from distributed, heterogeneous data, resulting in an incomplete representation of policy context. Furthermore, when the graph structure suffers from missing anchor points, inconsistent profiles, or interrupted paths, existing methods lack the ability to intelligently complete the path and are unable to dynamically reconstruct the policy path based on the context, thus impacting policy accuracy and coverage.

[0004] Therefore, there is an urgent need for a data dynamic weaving method that supports semantic fusion, path completion, and adaptive construction of policy context to improve the intelligence and real-time performance of the cross-platform security policy generation system. Summary of the Invention

[0005] In order to overcome the above-mentioned defects of the prior art and achieve the above-mentioned purpose, the present invention provides the following technical solution: a distributed data dynamic weaving method, comprising:

[0006] Based on the historical operation data of the distributed data environment, cloud domain sub-graphs, edge domain sub-graphs, and terminal domain sub-graphs are constructed respectively;

[0007] A cross-domain fusion graph is constructed based on the cloud domain sub-graph, edge domain sub-graph, and terminal domain sub-graph;

[0008] Dynamically weave real-time device behavior data and real-time device feature data based on a distributed data environment to construct user profiles, behavior profiles, and data access profiles;

[0009] Dynamically weave user portraits, behavior portraits, and data access portraits based on the cross-domain fusion graph to obtain the corresponding minimum correlation subgraph;

[0010] The minimum correlation subgraphs corresponding to user portraits, behavior portraits, and data access portraits are fused and dynamically woven to form a cross-platform strategy blueprint.

[0011] Furthermore, the method for constructing the user portrait, behavior portrait, and data access portrait includes:

[0012] Perform structural cleaning and semantic normalization on real-time device behavior data and real-time device feature data. Use regular expressions to extract field names and corresponding field values ​​from real-time device behavior data and real-time device feature data. Convert synonymous but inconsistently named field names across different platforms or systems to standard field names using a preset field comparison mapping table. This creates initial key-value pairs with standard field names as keys and field values ​​as values, and constructs an initial key-value pair set.

[0013] Extracting initial key-value pairs related to user identity, role permissions, and historical behavior preferences from the initial key-value pair set to form a user candidate key-value pair set, and forming a user portrait structure based on the user candidate key-value pair set; extracting initial key-value pairs involved in access operation behaviors from the initial key-value pair set to form a behavior candidate key-value pair set, and constructing a behavior portrait structure based on the behavior candidate key-value pair set; extracting initial key-value pairs of data resource information involved in data access from the initial key-value pair set to form a data access portrait structure;

[0014] Output the user portrait structure as a user portrait; output the behavior portrait structure as a behavior portrait; output the data access portrait structure as a data access portrait.

[0015] Furthermore, the method for forming a user portrait structure based on the user candidate key-value pair set includes:

[0016] Calculate key similarity for any two keys in the user candidate key-value pair set, construct the initial key-value pairs corresponding to key similarity greater than the preset key similarity threshold into a similar key-value pair set, calculate value similarity for any two values ​​in the similar key-value pair set, and regard the values ​​with value similarity greater than the preset value similarity threshold as the same value;

[0017] The comprehensive similarity is calculated based on the key similarity and value similarity. The initial key-value pairs corresponding to the comprehensive similarity greater than the preset comprehensive similarity are attributed to the same user and constructed into a user portrait structure.

[0018] Furthermore, a method for constructing a behavior profile structure based on the behavior candidate key-value pair set includes:

[0019] Arrange the behavior candidate key-value pair set in ascending order according to timestamps to obtain a behavior time series key-value pair set. Slide and extract adjacent behavior operation key-value pairs in the behavior time series key-value pair set in sequence using a preset sliding window length as a unit to form a behavior operation key-value pair set.

[0020] Each behavior operation key-value pair in the behavior operation key-value pair set is normalized into a feature vector, and the corresponding cosine similarity is calculated, which is recorded as the behavior feature similarity; the time decay score is calculated based on the sliding window length; the behavior continuity measurement score is calculated based on the behavior feature similarity and the time decay score, and the behavior operation key-value pairs corresponding to the behavior continuity measurement score greater than the preset behavior continuity measurement score threshold are constructed into a behavior portrait structure.

[0021] Furthermore, the method of dynamically integrating and weaving the minimum associated subgraphs corresponding to the user profile, behavior profile, and data access profile to form a cross-platform strategy blueprint includes:

[0022] Perform semantic comparison on the entity nodes in the minimum associated subgraphs of user portraits, behavior portraits, and data access portraits. If the semantics are the same, perform entity node merging. If there are relationship edges of the same direction and type, perform edge merging. Entity node merging and edge merging form a preliminary fusion graph. Entity nodes that fail to participate in the merging process form a fusion dynamic weaving set.

[0023] Based on the pre-built lineage reasoning rule library, the fusion dynamic weaving set is matched with rules, and the draft of the fusion graph is dynamically weaved according to the rule matching results to generate a cross-platform strategy blueprint; the lineage reasoning rule library includes reasoning relationship rules, starting node types and target node types.

[0024] Furthermore, the method of performing rule matching on the fusion dynamic weaving set based on the pre-built lineage reasoning rule library and dynamically weaving the fusion graph draft according to the rule matching result to generate a cross-platform strategy blueprint includes:

[0025] For each entity node to be processed in the fusion dynamic weaving set, all applicable reasoning relationship rules are retrieved in the lineage reasoning rule library according to the node type and attribute information of the entity node to be processed, and the entity node to be processed and the reasoning relationship rules corresponding to the entity node to be processed, the starting node type and the target node type are organized into a structure to be evaluated, forming a set of structures to be evaluated;

[0026] Input each of the structures to be evaluated in the set of structures to be evaluated and the minimum associated subgraph corresponding to the entity node to be processed into the path confidence evaluation model, and output the corresponding path confidence score;

[0027] For each structure to be evaluated, the target entity node pointed to by the inference path with the highest path confidence score is selected as the completion connection object, and the completion connection object is connected to the draft fusion graph through the inference edge, thus completing the semantic path completion and graph structure closed loop;

[0028] When all pending entity nodes in the fusion dynamic weaving set are processed, a cross-platform strategy blueprint is obtained.

[0029] Furthermore, methods for dynamically weaving the cross-domain fusion graph, user portrait, behavior portrait, and data access portrait to obtain the corresponding minimum correlation subgraph include:

[0030] Inputting user profiles, behavior profiles, and data access profiles into a rating setting model to obtain a behavior risk level and a field sensitivity level; the behavior risk level includes low, medium, and high; the field sensitivity level includes low, medium, and high;

[0031] Match the behavior risk level and field sensitivity level with the pre-built traversal depth mapping table to obtain the traversal depth;

[0032] Map the fields in the user profile, behavior profile, and data access profile to the cross-domain fusion graph, and obtain corresponding matching diagnosis results; the matching diagnosis results include matching success and matching failure;

[0033] Based on the cross-domain fusion graph and matching diagnosis results, the minimum correlation subgraph corresponding to the user portrait, behavior portrait and data access portrait is constructed.

[0034] Furthermore, the method for obtaining matching diagnosis results corresponding to the user profile, behavior profile, and data access profile includes:

[0035] Determine whether all entity nodes in the user portrait are matched with the corresponding entity nodes in the cross-domain fusion graph. If the judgment result is yes, set the matching diagnosis result of the user portrait to a successful match; if the judgment result is no, set the matching diagnosis result of the user portrait to a failed match;

[0036] Determine whether all entity nodes in the behavior profile are matched with the corresponding entity nodes in the cross-domain fusion graph. If the judgment result is yes, set the matching diagnosis result of the behavior profile to a successful match; if the judgment result is no, set the matching diagnosis result of the behavior profile to a failed match;

[0037] Determine whether all entity nodes in the data access portrait are matched with the corresponding entity nodes in the cross-domain fusion graph. If the judgment result is yes, the matching diagnosis result of the data access portrait is set to a successful match. If the judgment result is no, the matching diagnosis result of the data access portrait is set to a failed match.

[0038] Furthermore, the method for constructing the minimum correlation subgraph corresponding to the user profile, behavior profile, and data access profile based on the cross-domain fusion graph and matching diagnosis results includes:

[0039] Use the traversal depth as the limit for the number of searches;

[0040] If the matching diagnosis result of the user portrait is a successful match, any entity node in the user portrait is selected as the starting point of the user portrait. The entity node corresponding to the starting point of the user portrait in the cross-domain fusion graph is used as the starting point of the user portrait traversal. A breadth-first search is performed on the cross-domain fusion graph based on the starting point of the user portrait traversal. When the search number reaches the limited search number, the breadth-first search is stopped to obtain the minimum associated subgraph of the user portrait.

[0041] If the matching diagnosis result of the behavior profile is a successful match, an entity node is selected from the behavior profile as the starting point of the behavior profile. The entity node corresponding to the behavior profile starting point in the cross-domain fusion graph is used as the behavior profile traversal starting point. A breadth-first search is performed on the cross-domain fusion graph based on the behavior profile traversal starting point. When the search number reaches the limited search number, the breadth-first search is stopped to obtain the minimum associated subgraph of the behavior profile.

[0042] If the matching diagnosis result of the data access portrait is a successful match, select any entity node from the data access portrait as the starting point of the data access portrait, and use the entity node corresponding to the starting point of the data access portrait in the cross-domain fusion graph as the starting point of the data access portrait traversal. Perform a breadth-first search on the cross-domain fusion graph based on the starting point of the data access portrait traversal. When the search times reach the limited search times, stop the breadth-first search and obtain the minimum associated subgraph of the data access portrait.

[0043] If the matching diagnosis result of any of the user portraits, behavior portraits, and data access portraits is a matching failure, the corresponding dynamic weaving completion processing strategy is executed for the portrait type that fails to match, and the corresponding minimum correlation subgraph is generated.

[0044] Furthermore, a method for executing a corresponding dynamic knitting completion processing strategy for the portrait type that fails to match and generating a corresponding minimum correlation subgraph includes:

[0045] The entity nodes in the portrait that failed to match the cross-domain fusion graph that cannot be directly matched with the cross-domain fusion graph are mapped and matched with the preset semantic generalization mapping rule table; if the mapping match is successful, the entity node is mapped to the upper-level semantic entity node corresponding to the entity node; if the mapping match fails, the entity nodes in the portrait that cannot be directly matched with the cross-domain fusion graph are subjected to semantic similarity calculation with the entity node set of the cross-domain fusion graph, and the entity nodes whose semantic similarity is greater than the preset semantic similarity threshold are constructed into a candidate entity node set;

[0046] For each candidate entity node in the candidate entity node set, a depth-first search operation with a limited number of searches is performed in the cross-domain fusion graph with the candidate entity node as the starting point. Whenever the search path reaches the limited number of searches or the current path is traversed, it goes back to the starting point to continue exploring other search paths until all search paths with the candidate entity node as the starting point are searched. All search paths are constructed into a search path set, and the search paths in the search path set are respectively input into the path semantic weight evaluation model to obtain the corresponding path semantic weight scores. The search paths with path semantic weight scores greater than the preset path semantic weight score threshold are constructed into a candidate path set, and the candidate path set is constructed into a candidate association subgraph. The duplicate nodes and edges in the candidate association subgraph are merged, and the candidate paths in the candidate association subgraph that are only connected to the candidate entity node and have a degree of 1 are deleted to obtain the corresponding minimum association subgraph.

[0047] Furthermore, the method for constructing the cross-domain fusion graph includes:

[0048] Extract core entity nodes with mappable features from the cloud domain subgraph, edge domain subgraph, and terminal domain subgraph to form a set of candidate entity pairs; the mappable features include identical field names, consistent synchronization task identifiers, or inheritance relationships between data paths;

[0049] Analyze the semantic relationship between core entity nodes based on the candidate entity pair set, determine the cross-platform mapping relationship of each candidate entity pair in the candidate entity pair set based on the field structure, processing path, and access context, construct the corresponding cross-domain mapping edge in the cross-domain fusion graph, and construct a cross-domain mapping edge set;

[0050] Constructing a cross-domain edge hopping path table based on the cross-domain mapping edge set, wherein the cross-domain edge hopping path table is used to record the mapping paths of each core entity node in different platforms;

[0051] Based on the cloud domain sub-graph, edge domain sub-graph, terminal domain sub-graph and cross-domain hopping path table, a cross-domain fusion graph is constructed through the graph gateway service.

[0052] Furthermore, the method for constructing the cloud domain sub-graph, the edge domain sub-graph, and the terminal domain sub-graph includes:

[0053] Analyze the historical operation data of the distributed data environment and construct cloud core entity nodes, edge core entity nodes and terminal core entity nodes respectively;

[0054] Based on the business and data relationships between cloud core entity nodes, a cloud-related edge set of the cloud platform is constructed; based on the business and data relationships between edge core entity nodes, an edge-related edge set of edge nodes is constructed; based on the business and data relationships between terminal core entity nodes, a terminal-related edge set of terminal devices is constructed;

[0055] A cloud domain subgraph is constructed based on the cloud relationship edge set and cloud core entity nodes; an edge domain subgraph is constructed based on the edge relationship edge set and edge core entity nodes; and a terminal domain subgraph is constructed based on the terminal relationship edge set and terminal core entity nodes.

[0056] Compared with the prior art, the technical effects and advantages of the distributed data dynamic weaving method of the present invention are as follows:

[0057] This application achieves unified graph modeling of multi-platform historical data assets, field structures, processing behaviors, access events, and security policies by constructing cloud domain sub-graphs, edge domain sub-graphs, and terminal domain sub-graphs in a multi-domain distributed environment, forming a basic knowledge graph with a hierarchical structure, attribute labels, and contextual semantics. On this basis, a dynamic weaving method that integrates portrait-driven and semantic reasoning mechanisms is proposed. This method can perform minimum sub-graph cropping and dynamic policy path generation operations for cross-domain fusion graphs based on entity nodes, access characteristics, and sensitivity level information extracted from user portraits, behavior portraits, and data access portraits.

[0058] Specifically, this application constructs a draft of the fusion graph through semantic merging and structural comparison, and then introduces a fusion dynamic weaving set for entity nodes that have not been successfully merged. Combined with the preset lineage reasoning rule library and path confidence assessment model, rule-driven reasoning and scoring screening are performed on the potential semantic path, dynamically completing the connection of structural breakpoints and the closed-loop construction of the policy path. This dynamic weaving mechanism can intelligently initiate structural-level completion and semantic-level expansion operations when the graph structure is incomplete, the portrait anchor is missing, or the policy path is interrupted, significantly improving the graph's adaptive policy generation capabilities in complex access behaviors, multi-platform deployments, and portrait uncertainty scenarios. Ultimately, the system can automatically build a cross-platform policy blueprint based on the woven fusion graph, realizing a closed-loop expression of user-behavior-data-policy.

[0059] Compared to existing policy generation methods that rely on static rules, fixed paths, and manual configuration, the dynamic weaving mechanism proposed in this application offers the advantages of strong real-time performance, good interpretability, and flexible and adjustable policy chains. This overcomes the limitations of traditional user identification based on static identity matching, enabling dynamic perception and intelligent recognition of the same user identity across different nodes in a distributed environment. This significantly enhances the system's practical capabilities and engineering value in application scenarios such as zero-trust access control, cross-platform security governance, and multi-domain collaborative protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 This is a schematic diagram of a distributed data dynamic knitting system according to embodiment 1 of the present invention;

[0061] Figure 2 This is a flow chart of a distributed data dynamic weaving method according to embodiment 2 of the present invention;

[0062] Figure 3 A flowchart of the method for forming a cross-platform strategy blueprint;

[0063] Figure 4 Flowchart of the construction method of cross-domain fusion graph;

[0064] Figure 5 This is an overall architecture diagram of a distributed data dynamic knitting system according to embodiment 1 of the present invention;

[0065] Figure 6 Dynamically weave the full-link business graph. DETAILED DESCRIPTION

[0066] The technical solutions in the embodiments of the present invention will be described in detail, clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention. It should be noted that the specific embodiments described below are only used to better illustrate and describe the technical solutions of the present invention, and are intended to enable those skilled in the art to better understand and implement the present invention, and should not be construed as limiting the scope of protection of the present invention. Without departing from the spirit and essence of the present invention, those skilled in the art may modify, adjust or make equivalent replacements based on the contents disclosed in the present invention, and these should all be regarded as the scope of protection of the present invention.

[0067] Example 1:

[0068] See also Figure 1 As shown, this embodiment discloses a distributed data dynamic weaving system, including a first building module, a second building module, a portrait building module, a sub-graph weaving module and a fusion weaving module. Each module realizes data transmission through wired and / or wireless connections.

[0069] The first construction module constructs the cloud domain sub-graph, edge domain sub-graph and terminal domain sub-graph based on the historical operation data of the distributed data environment.

[0070] In a preferred embodiment of the present invention, the distributed data environment may include, but is not limited to, a cloud platform, edge nodes, terminal devices, and the historical operation data generated by each of them. The historical operation data of the cloud platform includes database structure information, object storage metadata, API access logs, security rule call logs, and job scheduling records; the historical operation data of the edge node includes edge cache file structure, edge container logs, edge stream processing task records, and MQTT communication logs; the historical operation data of the terminal device includes terminal local configuration, data collection logs, local operating system call chains, and application access behavior.

[0071] The method for constructing the cloud domain sub-graph, the edge domain sub-graph, and the terminal domain sub-graph includes:

[0072] The historical operation data of the distributed data environment is parsed and cloud core entity nodes, edge core entity nodes and terminal core entity nodes are constructed respectively; the cloud core entity nodes include cloud data asset nodes, cloud field nodes, cloud processing nodes, cloud behavior event nodes, cloud risk label nodes and cloud security policy nodes; the edge core entity nodes include edge data asset nodes, edge field nodes, edge processing nodes, edge behavior event nodes, edge risk label nodes and edge security policy nodes; the terminal core entity nodes include terminal data asset nodes, terminal field nodes, terminal processing nodes, terminal behavior event nodes, terminal risk label nodes and terminal security policy nodes;

[0073] Based on the business and data relationships between cloud core entity nodes, a cloud-related edge set of the cloud platform is constructed; based on the business and data relationships between edge core entity nodes, an edge-related edge set of edge nodes is constructed; based on the business and data relationships between terminal core entity nodes, a terminal-related edge set of terminal devices is constructed;

[0074] A cloud domain subgraph is constructed based on the cloud relationship edge set and cloud core entity nodes; an edge domain subgraph is constructed based on the edge relationship edge set and edge core entity nodes; and a terminal domain subgraph is constructed based on the terminal relationship edge set and terminal core entity nodes.

[0075] It should be noted that the cloud-side relationship edge set, edge-side relationship edge set, and terminal relationship edge set all contain corresponding field-belonging-to-data-asset edges, field-derived edges, accessed edges, risk-binding edges, and policy-protected edges. The field-belonging-to-data-asset edge is used to associate a field node with the data asset node to which it belongs; the field-derived edge is used to describe the derivative relationship between field nodes caused by processing tasks; the accessed edge is used to connect a data asset node with the behavior event node it generates; the risk-binding edge is used to establish a binding relationship between a field node and a risk label node; and the policy-protected edge is used to perform policy binding between a field or behavior event node and a security policy node.

[0076] In a preferred embodiment of the present invention, the cloud data asset node exemplarily represents structured and unstructured data resources deployed on a cloud service platform (such as a public cloud, private cloud, or hybrid cloud), including cloud database instances such as RDS, DynamoDB, Cloud SQL, cloud object storage buckets, cloud function output files, data snapshots, and archived files. The cloud field node represents the structural information and sensitive attributes of each field in the cloud data asset, including table structure fields (field name, data type, whether it is a primary key, whether it is indexed), and encryption status (such as PII, PCI, and GDPR labels). The cloud processing node represents data processing tasks or service operation flows executed on the cloud platform, including cloud ETL tasks, cloud functions, data synchronization tasks, API gateway forwarding, and CDN edge processing. The cloud behavior event node represents historical operation events that interact with cloud data assets, including console access logs, IAM credential usage logs, and data query, upload, download, and delete API operation events. The cloud risk label node represents the sensitivity level or compliance attribute label assessed for cloud fields or behavior operations, including risk levels (low, medium, and high), compliance labels, and domain labels (financial, medical, and geographic information). The cloud security policy node represents the configured security control policy that matches the cloud field or operation behavior, including field-level desensitization policies such as masking, replacement, encryption, and data access permission policies such as dynamic speed limit, blocking, log auditing, access control rules, etc.

[0077] In a preferred embodiment of the present invention, exemplarily, the edge data asset node represents the local storage resources and cache data units deployed on the edge computing node, including the local cache database of the edge device (such as SQLite, Redis), the intermediate result data in the edge file system or the persistent snapshot edge AI model cache and data preprocessing result storage. The edge field node represents the field information in the edge data asset, including the key value fields of the cache structure, the local table structure fields and their types, the data acquisition sensor field name, the device identification and the timestamp field. The edge processing node represents the data processing or data pipeline tasks performed on the edge node, including edge inference processing, real-time aggregation, data trimming and message queue processing tasks. The edge behavior event node represents the record of the edge node's operation on the data asset or interface, including the edge gateway API call record, MQTT message exchange log, file system access event and abnormal alarm event. The edge risk label node represents the privacy or physical risk information carried by the edge field or behavior, including whether the locally collected data contains biometric identification and location tracking information. The edge security policy node represents a policy module deployed on the edge node, including edge computing-level data desensitization, field filtering policy, local access control, firewall rules, and lightweight security agent behavior.

[0078] In a preferred embodiment of the present invention, exemplarily, the terminal data asset node represents the local data resources existing in the user terminal device, including the local database of the mobile application, the terminal browser cache, the user configuration file and the log file. The terminal field node represents the key fields in the terminal local data, including user identification, device identification, account information and behavioral preferences. The terminal processing node represents the computing tasks or data processing logic executed on the terminal, including local data encryption, compression, obfuscation, user data pre-filling, form automatic completion and model cache update tasks. The terminal behavior event node represents the data access behavior triggered locally by the user or device, including local data reading and writing, form input, application behavior log, data submission request, SDK operation call and crash reporting event. The terminal risk label node represents the privacy, fraud and unauthorized risks that may be brought about by terminal-side data or operations, including location tracking, fingerprint collection, account authentication operation identification and non-compliant plug-in use risk label. The terminal security policy node represents the security rules or policy behaviors that are effective locally on the terminal, including local storage encryption, temporary data clearing, identity obfuscation policy and privacy API access control.

[0079] The second construction module constructs a cross-domain fusion graph based on the cloud domain sub-graph, edge domain sub-graph and terminal domain sub-graph.

[0080] like Figure 4 As shown, the method for constructing the cross-domain fusion graph includes:

[0081] Extract core entity nodes with mappable features from the cloud domain subgraph, edge domain subgraph, and terminal domain subgraph to form a set of candidate entity pairs; the mappable features include identical field names, consistent synchronization task identifiers, inheritance relationships between data paths, or matching primary key hash values;

[0082] Analyze the semantic relationship between core entity nodes based on the candidate entity pair set, determine the cross-platform mapping relationship of each candidate entity pair in the candidate entity pair set according to the field structure, processing path and access context, construct the corresponding cross-domain mapping edge in the cross-domain fusion graph, and construct a cross-domain mapping edge set; specifically, when two core entity nodes are semantically equivalent in different platforms, establish an equivalence relationship edge; when a core entity node is a processing result or derived field in another platform, establish a derived relationship edge; when data assets are synchronized, cached or replicated between platforms, establish a replication relationship edge;

[0083] Constructing a cross-domain edge hopping path table based on the cross-domain mapping edge set, wherein the cross-domain edge hopping path table is used to record the mapping paths of each core entity node in different platforms;

[0084] Based on the cloud domain sub-graph, edge domain sub-graph, terminal domain sub-graph and cross-domain hopping path table, a cross-domain fusion graph is constructed through the graph gateway service.

[0085] The process of constructing a cross-domain hopping edge path table based on a cross-domain mapping edge set includes: traversing the established cross-domain mapping edge set, identifying semantically equivalent, derived entity pairs or replicated entity pairs on different platforms, and extracting the global entity identifiers of the source entity and target entity connected by each set of cross-domain mapping edges and their platform information; using the global entity identifier as the index item, recording the entity corresponding path of the global entity identifier in the cloud, edge and terminal platforms, including the mapping relationship type (such as equivalence, derivation or replication), the number of path hops and the establishment time; organizing all cross-platform entity corresponding paths into standard structured entries and uniformly writing them into the cross-domain hopping edge path table; realizing centralized management of the semantic associations and jumpable paths of core entity nodes in a multi-platform environment, and providing a path resolution basis for subsequent graph query, policy tailoring and dynamic weaving.

[0086] It should be noted that by constructing multiple types of cross-domain mapping edges such as equivalence, derivation, and replication, it is possible to accurately describe the data transmission links and processing paths between terminals, edges, and cloud platforms, ensuring that entity nodes with semantic consistency in different domains can be uniformly identified, scheduled, and traced, breaking through the bottleneck of the traditional graph model's expressive power in platform fragmentation scenarios. By constructing a cross-domain hop path table, the system can quickly locate the semantic path position and upstream and downstream relationships of any core entity node in multiple platforms during policy execution or profiling, thereby supporting path clipping and dynamic generation of graph fragments for behavior chains, triggering the most relevant policy chain with minimal overhead, and significantly improving response efficiency and execution controllability. The cross-domain fusion graph has complete path reasoning capabilities, policy clipping capabilities, entity traceability capabilities, and execution visualization capabilities, providing a structured, standardized, and real-time available graph foundation for dynamic data weaving and secure linkage control in a cloud-edge-end heterogeneous environment. Since the existing technology still lacks a cross-domain fusion graph structure with dynamic edge jumping mechanism and policy tailoring support, this application has significant creativity and substantial technological progress in terms of entity modeling methods, path organization methods and policy linkage mechanisms.

[0087] The portrait construction module dynamically weaves real-time device behavior data and real-time device feature data based on the distributed data environment to construct user portraits, behavior portraits and data access portraits.

[0088] The real-time device behavior data includes API call records, database operation logs, field access details, data submission behavior, data synchronization operations, control command execution trajectories, terminal application interaction logs, file read and write records, and job execution events; the real-time device feature data includes device type, system version, network source, IP address, geographic location, device health status, access network type, container image information, and security agent status.

[0089] The method for constructing the user portrait, behavior portrait, and data access portrait includes:

[0090] Performing structural cleaning and semantic normalization on real-time device behavior data and real-time device feature data to obtain an initial set of key-value pairs. This includes: extracting field names and corresponding field values ​​from the real-time device behavior data and real-time device feature data using regular expressions; performing field naming normalization on the field names, i.e., converting synonymous but inconsistently named field names (e.g., "uid," "userId," "user_id," etc.) across different platforms or systems into standard field names using a preset field reference mapping table, forming initial key-value pairs with the standard field name as the key and the field value as the value, and constructing an initial set of key-value pairs.

[0091] Extract initial key-value pairs related to user identity, role permissions, and historical behavior preferences from the initial key-value pair set to construct a user candidate key-value pair set; calculate key similarity for any two keys in the user candidate key-value pair set, construct the initial key-value pairs corresponding to key similarity greater than a preset key similarity threshold into a similar key-value pair set, calculate value similarity for any two values ​​in the similar key-value pair set, and regard values ​​with value similarity greater than a preset value similarity threshold as the same value; calculate a comprehensive similarity based on key similarity and value similarity, attribute the initial key-value pairs corresponding to comprehensive similarity greater than the preset comprehensive similarity to the same user, and construct a user portrait structure;

[0092] Extracting the initial key-value pairs involved in the access operation behavior from the initial key-value pair set to construct a behavior candidate key-value pair set, and constructing a behavior profile structure based on the behavior candidate key-value pair set; the access operation behavior includes a behavior timestamp, an operation instruction type, a target resource identifier, an access method, and a device fingerprint;

[0093] Extracting the initial key-value pairs of data resource information involved in data access from the initial key-value pair set to form a data access profile structure;

[0094] Output the user portrait structure as a user portrait; output the behavior portrait structure as a behavior portrait; output the data access portrait structure as a data access portrait.

[0095] It should be noted that the key similarity and value similarity can be converted into corresponding word vectors through Word2Vec, and the cosine similarity between the word vectors is calculated. The cosine similarity is recorded as the corresponding key similarity or value similarity. Cosine similarity is a commonly used calculation method in this field and will not be described here. The range of key similarity and value similarity is , 0 means completely unrelated, and 1 means completely consistent naming or semantic equivalence. Exemplarily, the key similarity threshold and the value similarity threshold can be set to 0.8.

[0096] The calculation method of the comprehensive similarity is:

[0097] ;

[0098] in, is the comprehensive similarity, is the key similarity, is the value similarity, is the weight coefficient, and its value range is , for example, in this application, Set to 0.4.

[0099] Methods for constructing a behavior profile structure based on a set of behavior candidate key-value pairs include:

[0100] Arrange the behavior candidate key-value pair set in ascending order according to timestamps to obtain a behavior time series key-value pair set. Slide and extract adjacent behavior operation key-value pairs in the behavior time series key-value pair set in units of a preset sliding window length (e.g., a sliding window length of 5 minutes) to form a behavior operation key-value pair set.

[0101] Each action key-value pair in the action key-value pair set is normalized into a feature vector, and the corresponding cosine similarity is calculated, recorded as the action feature similarity. A time decay score is calculated based on the sliding window length. A action continuity measure score is calculated based on the action feature similarity and the time decay score. Action key-value pairs corresponding to action continuity measures with a score greater than a preset action continuity measure score threshold are constructed into a action profile structure. For example, the action continuity measure score threshold can be set to 0.95.

[0102] The behavior operation key-value pair set is represented as:

[0103] ;

[0104] in, Represents a set of key-value pairs for behavioral operations. represents two adjacent candidate behavior key-value pairs, and N is the number of behavior time series key-value pairs in the behavior time series key-value pair set.

[0105] The time decay score calculation method includes:

[0106] ;

[0107] in, is the time decay score, e is a natural constant, Convert the sliding window length to seconds, is the time window decay coefficient, typically set to half the sliding window length. The time decay scoring formula is a simplified form of the Gaussian time decay function. Its derivation and use aims to establish a nonlinear penalty mechanism for the time interval between two candidate action key-value pairs, so that events further in time contribute less to similarity.

[0108] The continuity measure score is calculated as follows:

[0109] ;

[0110] in, is the continuous measurement score, is the weight coefficient, and its value range is , for example, in this application, Set to 0.7, is the behavioral feature similarity.

[0111] An example of the field mapping table is shown in Table 1:

[0112] Table 1 Field mapping table

[0113] Field Name Standard field names Field meaning description Platform example appears uid, userID, user_id user_id User unique identifier Cloud API logs, mobile app logs act_type, operation, op_type action_type Operation behavior type Edge container event logs, cloud console event logs src_ip, source_ip, ip_addr source_ip IP address of the request initiator All platform network access logs device, dev_type device_type Device Type Mobile terminals, browser clients, IoT edge nodes os_ver, sysVer os_version Operating system version number Mobile device system logs and terminal logs

[0114] It should be noted that the construction of user profiles, behavior profiles, and data access profiles in this application can achieve multi-dimensional semantic characterization of the subject characteristics, operation behavior characteristics, and data target characteristics of access requests, thereby providing structured, interpretable, and real-time adaptive input basis for subsequent key processes such as graph path cutting, policy generation, and risk assessment. It has the following technical advantages and functions:

[0115] User profiles describe key information such as the identity, account type, permission role, and historical risk level of the initiator of an access request. This helps the system quickly locate the policy boundaries and access permission models associated with that user during the dynamic graph weaving process, and serves as a precondition for applying risk-sensitive policies. User profiles enable differentiated policy matching for different user categories, including internal personnel and external collaborators, and ordinary users and administrators, effectively improving the precision and flexibility of access control.

[0116] Behavioral profiling captures behavioral characteristics of the access process, including operation type, triggering method, behavior timing, and whether it is abnormal. It provides operational intent assessment and behavioral risk warning capabilities. Behavioral profiling can be used to dynamically identify high-risk behavioral events along the access path, such as frequent access to sensitive fields within a short period of time and large-scale exports via automated scripts. By integrating with corresponding behavioral event nodes in the knowledge graph, it enables risk annotation and dynamic weighting adjustments along the graph path, supporting behavior-driven strategy generation.

[0117] Data access profiling focuses on the characteristics of the data resources requested by users, including field names, data asset ownership, field sensitivity levels, compliance tags, and access scopes. Data access profiling enables rapid semantic alignment of access behaviors with sensitive field nodes and risk tag nodes in the graph, enabling precise mapping of access scopes and field classifications. This drives the policy module to select appropriate protection measures, such as desensitization, blocking, and log auditing, enhancing the contextual adaptability of data security policies.

[0118] In summary, by constructing user portraits, behavior portraits, and data access portraits, we not only achieve refined semantic modeling of access behavior, but also provide three key semantic inputs for the dynamic weaving of the graph: the cutting starting point, cutting range, and cutting rules. This allows the dynamic weaving process of the graph to be more focused on the real risk context. At the same time, the portrait results can be used as semantic support input for the policy decision-making module, enabling dynamic policy generation, policy combination, and priority selection driven by portraits. This significantly enhances the dynamic nature, intelligence, and explanatory power of the policy system, and improves the accuracy and effectiveness of the data security response of this application in complex multi-domain environments.

[0119] The subgraph weaving module dynamically weaves user portraits, behavior portraits, and data access portraits based on the cross-domain fusion graph to obtain the corresponding minimum correlation subgraph.

[0120] Methods for dynamically weaving the cross-domain fusion graph, user portrait, behavior portrait, and data access portrait to obtain the corresponding minimum correlation subgraph include:

[0121] Inputting user profiles, behavior profiles, and data access profiles into a rating setting model to obtain a behavior risk level and a field sensitivity level; the behavior risk level includes low, medium, and high; the field sensitivity level includes low, medium, and high;

[0122] Match the behavior risk level and field sensitivity level with the pre-built traversal depth mapping table to obtain the traversal depth;

[0123] Map the fields in the user profile, behavior profile, and data access profile to the cross-domain fusion graph, and obtain corresponding matching diagnosis results; the matching diagnosis results include matching success and matching failure;

[0124] Based on the cross-domain fusion graph and matching diagnosis results, the minimum correlation subgraph corresponding to the user portrait, behavior portrait and data access portrait is constructed.

[0125] The training method of the level setting model includes:

[0126] Pre-constructing a grade setting data set, wherein the grade setting data set includes Y groups of grade setting data and the behavioral risk levels and field sensitivity levels corresponding to the Y groups of grade setting data, where Y is a positive integer; dividing the grade setting data set into a training set and a validation set, wherein the training set is used for learning grade setting model parameters, and the validation set is used for real-time monitoring of the generalization performance and overfitting degree of the grade setting model;

[0127] A deep neural network with a multi-layer perceptron as the core is used as the level setting model. The level setting data is input into the deep neural network after standardization and vectorization processing. The deep neural network consists of an input layer, a hidden layer and an output layer. Each hidden layer uses a nonlinear activation function to extract features, and the output layer uses a Softmax activation function to obtain the probability distribution corresponding to each behavioral risk level and field sensitivity level. Finally, the behavioral risk level and field sensitivity level corresponding to the maximum probability are taken as the prediction results of the level setting model. During the training process, the cross-entropy loss function is used as the optimization target, and a gradient descent optimization algorithm is used to update the network weights, and an early stopping strategy is set: when the prediction accuracy on the validation set reaches or exceeds the preset threshold, the level setting model is determined to have converged and the training is terminated.

[0128] The method for obtaining matching diagnosis results corresponding to the user profile, behavior profile, and data access profile includes:

[0129] Determine whether all entity nodes in the user portrait can be matched with the corresponding entity nodes in the cross-domain fusion graph. If the judgment result is yes, set the matching diagnosis result of the user portrait to a successful match; if the judgment result is no, set the matching diagnosis result of the user portrait to a failed match;

[0130] Determine whether all entity nodes in the behavior profile can be matched with the corresponding entity nodes in the cross-domain fusion graph. If the judgment result is yes, set the matching diagnosis result of the behavior profile to a successful match; if the judgment result is no, set the matching diagnosis result of the behavior profile to a failed match;

[0131] Determine whether all entity nodes in the data access portrait can be matched with the corresponding entity nodes in the cross-domain fusion graph. If the judgment result is yes, the matching diagnosis result of the data access portrait is set to a successful match. If the judgment result is no, the matching diagnosis result of the data access portrait is set to a failed match.

[0132] Methods for constructing the minimum correlation subgraph corresponding to user profiles, behavior profiles, and data access profiles based on the cross-domain fusion graph and matching diagnosis results include:

[0133] Use the traversal depth as the limit for the number of searches;

[0134] If the matching diagnosis result of the user portrait is a successful match, select any entity node from the user portrait as the starting point of the user portrait, and use the entity node corresponding to the starting point of the user portrait in the cross-domain fusion graph as the starting point of the user portrait traversal. Perform a breadth-first search on the cross-domain fusion graph based on the starting point of the user portrait traversal. When the number of searches reaches the limited number of searches, stop the breadth-first search and obtain the minimum associated subgraph of the user portrait. The breadth-first search operation corresponding to the user portrait is as follows: use the starting point of the user portrait traversal as the root node of the graph search, and perform hierarchical expansion along the entity relationship edges in the cross-domain fusion graph in turn. During the expansion process, retain the nodes and edges that have a path-reachable relationship with the starting point of the user portrait traversal; when the search depth is equal to the limited number of searches, terminate the breadth-first search expansion process corresponding to the user portrait.

[0135] If the matching diagnosis result of the behavior portrait is a successful match, select an entity node from the behavior portrait as the starting point of the behavior portrait, and use the entity node corresponding to the starting point of the behavior portrait in the cross-domain fusion graph as the starting point of the behavior portrait traversal. Perform a breadth-first search on the cross-domain fusion graph based on the starting point of the behavior portrait traversal. When the number of searches reaches the limited number of searches, stop the breadth-first search and obtain the minimum associated subgraph of the behavior portrait. The breadth-first search operation corresponding to the behavior portrait is as follows: use the starting point of the behavior portrait traversal as the root node of the graph search, and perform hierarchical expansion along the entity relationship edges in the cross-domain fusion graph in turn. During the expansion process, retain the nodes and edges that have a path-reachable relationship with the starting point of the behavior portrait traversal; when the search depth is equal to the limited number of searches, terminate the breadth-first search expansion process corresponding to the behavior portrait.

[0136] If the matching diagnosis result of the data access portrait is a successful match, select any entity node from the data access portrait as the starting point of the data access portrait, and use the entity node corresponding to the starting point of the data access portrait in the cross-domain fusion graph as the starting point of the data access portrait traversal. Perform a breadth-first search on the cross-domain fusion graph based on the starting point of the data access portrait traversal. When the number of searches reaches the limited number of searches, stop the breadth-first search and obtain the minimum associated subgraph of the data access portrait. The breadth-first search operation corresponding to the data access portrait is as follows: use the starting point of the data access portrait traversal as the root node of the graph search, and perform hierarchical expansion along the entity relationship edges in the cross-domain fusion graph in turn. During the expansion process, retain the nodes and edges that have a path-reachable relationship with the starting point of the data access portrait traversal; when the search depth is equal to the limited number of searches, terminate the breadth-first search expansion process corresponding to the data access portrait.

[0137] If the matching diagnosis result of any of the user portraits, behavior portraits, and data access portraits is a matching failure, the corresponding dynamic weaving completion processing strategy is executed for the portrait type that fails to match, and the corresponding minimum correlation subgraph is generated.

[0138] The corresponding dynamic knitting completion processing strategy is executed for the image type that fails to match, and the method of generating the corresponding minimum correlation subgraph includes:

[0139] Map and match the entity nodes in the failed portraits that cannot be directly matched with the cross-domain fusion graph with the preset semantic generalization mapping rule table;

[0140] If the mapping match is successful, the entity node is mapped to the parent semantic entity node corresponding to the entity node;

[0141] If the mapping fails, the entity nodes in the portrait that cannot be directly matched with the cross-domain fusion graph are subjected to semantic similarity calculation with the entity node set of the cross-domain fusion graph, and the entity nodes with semantic similarity greater than the preset semantic similarity threshold are constructed into a candidate entity node set;

[0142] For each candidate entity node in the candidate entity node set, a depth-first search operation with a limited number of searches is performed in the cross-domain fusion graph with the candidate entity node as the starting point. Whenever the search path reaches the limited number of searches or the current path is traversed, it goes back to the starting point to continue exploring other search paths until all search paths with the candidate entity node as the starting point are searched. All search paths are constructed into a search path set, and the search paths in the search path set are respectively input into the path semantic weight evaluation model to obtain the corresponding path semantic weight scores. The search paths with path semantic weight scores greater than the preset path semantic weight score threshold are constructed into a candidate path set, and the candidate path set is constructed into a candidate association subgraph. The repeated nodes and edges in the candidate association subgraph are merged, and the candidate paths in the candidate association subgraph that are only connected to the candidate entity node and have a degree of 1 are deleted to obtain the corresponding minimum association subgraph.

[0143] The training method of the path semantic weight evaluation model includes:

[0144] Pre-constructing a path semantic weight evaluation dataset, wherein the path semantic weight evaluation dataset includes W groups of path semantic weight evaluation data and path semantic weight scores corresponding to the W groups of path semantic weight evaluation data, where W is a positive integer; dividing the path semantic weight evaluation dataset into a training set and a validation set, wherein the training set is used for learning the parameters of the path semantic weight evaluation model, and the validation set is used for real-time monitoring of the generalization performance and overfitting degree of the path semantic weight evaluation model;

[0145] A deep neural network with a multi-layer perceptron as the core is used as the path semantic weight evaluation model. The path semantic weight evaluation data is standardized and vectorized and then input into the deep neural network. The deep neural network consists of an input layer, a hidden layer, and an output layer. Each hidden layer uses a nonlinear activation function to extract features, and the output layer uses a softmax activation function to obtain the probability distribution corresponding to each path semantic weight score. Finally, the path semantic weight score corresponding to the maximum probability is taken as the prediction result of the path semantic weight evaluation model. During the training process, the cross-entropy loss function is used as the optimization target, and a gradient descent optimization algorithm is used to update the network weights. An early stopping strategy is set: when the prediction accuracy on the validation set reaches or exceeds the preset threshold, the path semantic weight evaluation model is determined to have converged and training is terminated.

[0146] It's important to note that in real-world applications, due to the diverse sources of portrait fields and the incompleteness of graph entities, portrait fields often fail to directly match entity nodes in the knowledge graph. Traditional strategy graph construction methods often simply skip these "anchor-missing" scenarios, use default template strategies, or forcibly establish low-confidence path connections. This leads to incomplete graph semantics, insufficient strategy adaptation, and even misjudgment of strategy paths.

[0147] In order to solve the above problems, the present invention proposes a graph completion dynamic weaving strategy that integrates "semantic generalization mapping, similarity candidate screening, graph path search and semantic path scoring". In the case of portrait anchor point matching failure, it can still be guided by semantics and constrained by structure to construct a minimum associated subgraph with reasonable semantics, complete context and compact structure, providing high-quality input context for the strategy graph. Compared with the existing technology, the present application does not simply perform graph path search or policy template replacement, but combines multiple levels of graph semantic understanding, anchor point completion, path evaluation and structure optimization into one. By constructing a complete processing chain of "portrait completion, candidate path generation, path semantic scoring, and subgraph structure clipping", it is possible to automatically restore the strategy context and complete the dynamic weaving of the strategy graph under the condition of portrait matching failure.

[0148] The method for calculating the semantic similarity includes:

[0149] ;

[0150] in, is the semantic similarity, It is the vector representation corresponding to the entity nodes in the portrait that cannot be directly matched with the cross-domain fusion graph. To represent the vector corresponding to the entity node of the cross-domain fusion graph, Word2Vec can be used to convert the entity node into a vector. and Represents the modulus corresponding to the vector. The value range of the semantic similarity is The closer the semantic similarity value is to 1, the higher the similarity between the entity nodes. The semantic similarity threshold is set by those skilled in the art. In this application, the semantic similarity threshold is exemplarily set to 0.7.

[0151] An example of traversing the depth map is shown in Table 2:

[0152] Table 2 Traversal depth map

[0153] Behavioral risk level Field sensitivity level Traversal Depth illustrate Low Low 1 The operational risk and field sensitivity are low, and only directly adjacent nodes are traversed Low middle 2 Add one hop to cover the field derivation path Low high 3 The field is highly sensitive and traverses three hops middle Any 3 The operation has certain risks and traverses three hops. high Any 4 High-risk operations must include user upstream and downstream links and policy nodes

[0154] An example of a semantic generalization mapping rule table is shown in Table 3:

[0155] Table 3 Semantic generalization mapping rules

[0156] Entity Node Mapping target entity type (superordinate concept) Mapping target field name illustrate user_email User Entity user_id User email cannot be uniquely identified → use user_id instead user_phone User Entity user_group_id No specific user → infer the user group action_label Operational behavior action_type Behavior tag not registered → mapped to standard behavior category read_sensitive_field Behavioral events READ Generalize the labeled behavior to the standard READ operation ip_address Network Entity subnet_id Unable to locate the node to which the IP belongs → generalize to a subnet device_serial_number End Entity device_type Unregistered terminal → mapped to terminal type

[0157] The fusion weaving module dynamically weaves the minimum associated subgraphs corresponding to user portraits, behavior portraits, and data access portraits to form a cross-platform strategy blueprint.

[0158] like Figure 3 As shown in FIG, the method for dynamically integrating and weaving the minimum associated subgraphs corresponding to user profiles, behavior profiles, and data access profiles to form a cross-platform strategy blueprint includes:

[0159] Perform semantic comparison on the entity nodes in the minimum associated subgraphs of user portraits, behavior portraits, and data access portraits. If the semantics are the same, perform entity node merging. If there are relationship edges of the same direction and type, perform edge merging. Entity node merging and edge merging form a preliminary fusion graph. Entity nodes that fail to participate in the merging process form a fusion dynamic weaving set.

[0160] Based on a pre-built lineage reasoning rule library, the fusion dynamic weaving set is matched, and the draft fusion graph is dynamically weaved based on the rule matching results to generate a cross-platform strategy blueprint. The lineage reasoning rule library includes inference relationship rules, starting node types, and target node types; the lineage reasoning rule library is used to define the potential semantic connections between different types of entity nodes.

[0161] The method for generating a cross-platform strategy blueprint includes: performing rule matching on the fusion dynamic weaving set based on the pre-built lineage reasoning rule library, and dynamically weaving the fusion graph draft according to the rule matching results.

[0162] For each entity node to be processed in the fusion dynamic weaving set, all applicable reasoning relationship rules are retrieved in the lineage reasoning rule library according to the node type and attribute information of the entity node to be processed, and the entity node to be processed and the reasoning relationship rules corresponding to the entity node to be processed, the starting node type and the target node type are organized into a structure to be evaluated, forming a set of structures to be evaluated;

[0163] The minimum associated subgraph corresponding to each structure to be evaluated and the entity node to be processed in the set of structures to be evaluated is input into the path confidence evaluation model, and the corresponding path confidence score is output; the path confidence score is used to quantify the comprehensive rationality of the reasoning path in terms of structural integrity, semantic consistency and logical connectivity; for example, in this application, the range of the path confidence score is ,The larger the path confidence score is, the higher the comprehensive rationality is.

[0164] For each structure to be evaluated, the target entity node pointed to by the inference path with the highest path confidence score is selected as the completion connection object, and the completion connection object is connected to the draft fusion graph through the inference edge, thus completing the semantic path completion and graph structure closed loop;

[0165] When all pending entity nodes in the fusion dynamic weaving set are processed, a cross-platform strategy blueprint is obtained.

[0166] The training method of the path confidence assessment model includes:

[0167] Pre-constructing a path confidence assessment dataset, wherein the path confidence assessment dataset includes R groups of path confidence assessment data and path confidence scores corresponding to the R groups of path confidence assessment data, where R is a positive integer; dividing the path confidence assessment dataset into a training set and a validation set, wherein the training set is used for learning the parameters of the path confidence assessment model, and the validation set is used for real-time monitoring of the generalization performance and overfitting degree of the path confidence assessment model;

[0168] A deep neural network with a multi-layer perceptron as its core is used as the path confidence assessment model. The path confidence assessment data is standardized and vectorized and then input into the deep neural network. The deep neural network consists of an input layer, a hidden layer, and an output layer. Each hidden layer uses a nonlinear activation function to extract high-order features. The output layer uses a softmax activation function to obtain the probability distribution corresponding to each path confidence score. Finally, the path confidence score corresponding to the maximum probability is taken as the prediction result of the path confidence assessment model. During the training process, the cross-entropy loss function is used as the optimization target, and a gradient descent optimization algorithm is used to update the network weights. An early stopping strategy is set: when the prediction accuracy on the validation set reaches or exceeds the preset threshold, the path confidence assessment model is determined to have converged and training is terminated.

[0169] It should be noted that Figure 5 This is the overall architecture diagram of a distributed data dynamic weaving system in this application, showing the full-process system structure from building a knowledge graph with historical data from multiple platforms, to portrait-driven path cutting and dynamic weaving, and finally generating a cross-platform strategy blueprint. Figure 6 In order to dynamically weave the full-link business graph, the entire application is composed of a data input layer and a core processing layer. The dynamically weaved full-link business graph shows the full-process functional structure and hierarchical distribution of the system of this application from multi-source data collection, sub-graph construction, to graph fusion, dynamic weaving and strategy blueprint generation.

[0170] It is further explained that after the cross-platform policy blueprint is constructed, the same user distributed under different nodes can be further identified by using the fused semantic entity nodes and mapping edges in the cross-platform policy blueprint. Specifically, by analyzing the consistency features in the synonymous attribute key values, cross-platform behavior paths and data access paths of the user portrait in the fusion graph, it is possible to determine whether multiple user identifiers in multiple platforms or terminals have semantic associations with the same subject identity. It can break through the limitations of traditional user identification based on static identifier matching and realize dynamic perception and intelligent identification of the same user identity under different nodes in a distributed environment. Compared with the static comparison method that relies on device identification or account information in the prior art, the present invention introduces semantic fusion, path mining and rule reasoning mechanisms to support dynamic modeling of cross-domain behavior trajectories of users without explicit identity indication fields, with stronger adaptability and accuracy, and significantly improves the ability of multi-source behavior collaborative analysis and unified security policy scheduling.

[0171] In this implementation, to achieve dynamic fusion of semantic context and path closure between different portrait subgraphs, a dynamic strategy blueprint weaving method driven by lineage inference rules is proposed. The core idea is to first semantically merge the minimally connected subgraphs generated by user, behavior, and data access profiles, unifying the semantically consistent entity nodes and relationship edges within the structure to form a preliminary fused graph. Isolated nodes and broken paths that fail to match during the merging process are not discarded or statically completed. Instead, they are constructed into a fused dynamic weaving set, representing reasonable semantic fragments and preserving their potential for further inclusion in the strategy path. Subsequently, a pre-built lineage inference rule library is introduced. Through rule matching and type mapping, the system identifies semantic relationships that can be established between nodes in the fused dynamic weaving set and potential target entities in the graph. The broken points are then connected in the form of inference paths to achieve structural repair. Furthermore, to prevent misconnections caused by low-quality inference paths, the system incorporates a path confidence assessment model to score and screen candidate paths, retaining only those with the highest semantic consistency and structural rationality for inclusion in the fused graph. This fusion mechanism of "merging as the main method, reasoning as the auxiliary method, and confidence control" not only improves the semantic integrity and interpretability of the policy map in cross-platform scenarios, but also has the ability to dynamically adapt to portrait differences, robustly complete structural gaps, and self-evolve policy paths. It significantly enhances the intelligence level and practical implementation capabilities of this application in the process of generating complex security policies.

[0172] An example of the blood relationship inference rule base is shown in Table 4:

[0173] Table 4 Bloodline inference rule base

[0174] Inference relation rules Starting node type Target node type illustrate Field Derivation Field Field Field is generated by processing another field Field Renaming Field Field Field name changes Data processing behavior Action Field Behavior Generation Field User belongs to the organization User OrgUnit (Organization Node) The user belongs to an organization node Role Access Field Role Field Role has field access permissions Data copy FieldAsset FieldAsset Indicates that data is copied to other platforms User access history behavior User Action User behavior association Device and user binding Device User Display device associated users Behavior Action Field Action Field Behavior operation field path

[0175] The node types and their semantic interpretations are shown in Table 5:

[0176] Table 5 Node types and their semantic interpretations

[0177] Node Type Belonging portrait Meaning and Use Field Data access profile Represents a field element in a data structure, such as "user email" or "transaction number," which can be used as the target of an operation or the source of a derived field. FieldAsset Data access profile Represents a field instance from a platform perspective, including platform information, version information, or operating environment information, such as "cloud mailbox field" and "edge platform mailbox field" User User portrait Indicates the user who initiates access requests or behavioral operations in the system. It may be an end user, service account, etc., and is often associated with a role, organization, or behavioral path. Role User portrait Represents a permission role or logical permission set in access control, such as "system administrator" and "auditor", used to infer access scope or access authorization Action behavioral profiling Indicates the operation performed by the user or device, such as "download", "encrypt", "view records", etc., used to identify the operation object and security policy triggering event Device User portrait or behavior portrait Represents the terminal device, running container, virtual machine, or edge node used by the user, often used to infer the running environment, deployment location, or data replication path Organization Node (OrgUnit) User portrait Indicates the organizational structure node to which the user belongs, such as department, tenant, team, etc., and is often used to infer ownership relationships, access boundaries, and permission isolation strategies.

[0178] Example 2:

[0179] See also Figure 2 As shown, this embodiment provides a distributed data dynamic weaving method, including:

[0180] Based on the historical operation data of the distributed data environment, cloud domain sub-graphs, edge domain sub-graphs, and terminal domain sub-graphs are constructed respectively;

[0181] A cross-domain fusion graph is constructed based on the cloud domain sub-graph, edge domain sub-graph, and terminal domain sub-graph;

[0182] Dynamically weave real-time device behavior data and real-time device feature data based on a distributed data environment to construct user profiles, behavior profiles, and data access profiles;

[0183] Dynamically weave user portraits, behavior portraits, and data access portraits based on the cross-domain fusion graph to obtain the corresponding minimum correlation subgraph;

[0184] The minimum correlation subgraphs corresponding to user portraits, behavior portraits, and data access portraits are fused and dynamically woven to form a cross-platform strategy blueprint.

[0185] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

[0186] Finally: The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A distributed data dynamic weaving method, characterized in that: include: Based on the historical operation data of the distributed data environment, cloud domain sub-graphs, edge domain sub-graphs, and terminal domain sub-graphs are constructed respectively; A cross-domain fusion graph is constructed based on the cloud domain sub-graph, edge domain sub-graph, and terminal domain sub-graph; Dynamically weave real-time device behavior data and real-time device feature data based on a distributed data environment to construct user profiles, behavior profiles, and data access profiles; Dynamically weave user portraits, behavior portraits, and data access portraits based on the cross-domain fusion graph to obtain the corresponding minimum correlation subgraph; The minimum correlation subgraphs corresponding to user portraits, behavior portraits, and data access portraits are fused and dynamically woven to form a cross-platform strategy blueprint.

2. A distributed data dynamic weaving method according to claim 1, characterized in that: The method for constructing the user portrait, behavior portrait, and data access portrait includes: Perform structural cleaning and semantic normalization on real-time device behavior data and real-time device feature data. Use regular expressions to extract field names and corresponding field values ​​from real-time device behavior data and real-time device feature data. Convert synonymous but inconsistently named field names across different platforms or systems to standard field names using a preset field comparison mapping table. This creates initial key-value pairs with standard field names as keys and field values ​​as values, and constructs an initial key-value pair set. Extracting initial key-value pairs related to user identity, role permissions, and historical behavior preferences from the initial key-value pair set to form a user candidate key-value pair set, and forming a user portrait structure based on the user candidate key-value pair set; extracting initial key-value pairs involved in access operation behaviors from the initial key-value pair set to form a behavior candidate key-value pair set, and constructing a behavior portrait structure based on the behavior candidate key-value pair set; extracting initial key-value pairs of data resource information involved in data access from the initial key-value pair set to form a data access portrait structure; Output the user portrait structure as a user portrait; output the behavior portrait structure as a behavior portrait; output the data access portrait structure as a data access portrait.

3. A distributed data dynamic weaving method according to claim 2, characterized in that: Methods for forming a user profile structure based on a set of user candidate key-value pairs include: Calculate key similarity for any two keys in the user candidate key-value pair set, construct the initial key-value pairs corresponding to key similarity greater than the preset key similarity threshold into a similar key-value pair set, calculate value similarity for any two values ​​in the similar key-value pair set, and regard the values ​​with value similarity greater than the preset value similarity threshold as the same value; The comprehensive similarity is calculated based on the key similarity and value similarity. The initial key-value pairs corresponding to the comprehensive similarity greater than the preset comprehensive similarity are attributed to the same user and constructed into a user portrait structure.

4. A distributed data dynamic weaving method according to claim 2, characterized in that: Methods for constructing a behavior profile structure based on a set of behavior candidate key-value pairs include: Arrange the behavior candidate key-value pair set in ascending order according to timestamps to obtain a behavior time series key-value pair set. Slide and extract adjacent behavior operation key-value pairs in the behavior time series key-value pair set in sequence using a preset sliding window length as a unit to form a behavior operation key-value pair set. Each behavior operation key-value pair in the behavior operation key-value pair set is normalized into a feature vector, and the corresponding cosine similarity is calculated, which is recorded as the behavior feature similarity; the time decay score is calculated based on the sliding window length; the behavior continuity measurement score is calculated based on the behavior feature similarity and the time decay score, and the behavior operation key-value pairs corresponding to the behavior continuity measurement score greater than the preset behavior continuity measurement score threshold are constructed into a behavior portrait structure.

5. A distributed data dynamic weaving method according to claim 1, characterized in that: Methods for dynamically integrating and weaving the minimum associated subgraphs corresponding to user profiles, behavior profiles, and data access profiles to form a cross-platform strategy blueprint include: Perform semantic comparison on the entity nodes in the minimum associated subgraphs of user portraits, behavior portraits, and data access portraits. If the semantics are the same, perform entity node merging. If there are relationship edges of the same direction and type, perform edge merging. Entity node merging and edge merging form a preliminary fusion graph. Entity nodes that fail to participate in the merging process form a fusion dynamic weaving set. Based on the pre-built lineage reasoning rule library, the fusion dynamic weaving set is matched with rules, and the draft of the fusion graph is dynamically weaved according to the rule matching results to generate a cross-platform strategy blueprint; the lineage reasoning rule library includes reasoning relationship rules, starting node types and target node types.

6. A distributed data dynamic weaving method according to claim 5, characterized in that: The method for generating a cross-platform strategy blueprint includes: performing rule matching on the fusion dynamic weaving set based on the pre-built lineage reasoning rule library, and dynamically weaving the fusion graph draft according to the rule matching results. For each entity node to be processed in the fusion dynamic weaving set, all applicable reasoning relationship rules are retrieved in the lineage reasoning rule library according to the node type and attribute information of the entity node to be processed, and the entity node to be processed and the reasoning relationship rules corresponding to the entity node to be processed, the starting node type and the target node type are organized into a structure to be evaluated, forming a set of structures to be evaluated; Input each of the structures to be evaluated in the set of structures to be evaluated and the minimum associated subgraph corresponding to the entity node to be processed into the path confidence evaluation model, and output the corresponding path confidence score; For each structure to be evaluated, select the target entity node pointed to by the inference path with the highest path confidence score as the completion connection object, and connect the completion connection object to the draft fusion graph through the inference edge; When all pending entity nodes in the fusion dynamic weaving set are processed, a cross-platform strategy blueprint is obtained.

7. A distributed data dynamic weaving method according to claim 1, characterized in that: Methods for dynamically weaving the cross-domain fusion graph, user portrait, behavior portrait, and data access portrait to obtain the corresponding minimum correlation subgraph include: Input user profiles, behavior profiles, and data access profiles into the rating model to obtain the behavior risk level and field sensitivity level; match the behavior risk level and field sensitivity level with the pre-built traversal depth mapping table to obtain the traversal depth; Map the fields in the user profile, behavior profile, and data access profile to the cross-domain fusion graph, and obtain corresponding matching diagnosis results; the matching diagnosis results include matching success and matching failure; Based on the cross-domain fusion graph and matching diagnosis results, the minimum correlation subgraph corresponding to the user portrait, behavior portrait and data access portrait is constructed.

8. A distributed data dynamic knitting method according to claim 7, characterized in that: The method for obtaining matching diagnosis results corresponding to the user profile, behavior profile, and data access profile includes: Determine whether all entity nodes in the user portrait are matched with the corresponding entity nodes in the cross-domain fusion graph. If the judgment result is yes, set the matching diagnosis result of the user portrait to a successful match; if the judgment result is no, set the matching diagnosis result of the user portrait to a failed match; Determine whether all entity nodes in the behavior profile are matched with the corresponding entity nodes in the cross-domain fusion graph. If the judgment result is yes, set the matching diagnosis result of the behavior profile to a successful match; if the judgment result is no, set the matching diagnosis result of the behavior profile to a failed match; Determine whether all entity nodes in the data access portrait are matched with the corresponding entity nodes in the cross-domain fusion graph. If the judgment result is yes, the matching diagnosis result of the data access portrait is set to a successful match. If the judgment result is no, the matching diagnosis result of the data access portrait is set to a failed match.

9. A distributed data dynamic knitting method according to claim 7, characterized in that: Methods for constructing the minimum correlation subgraph corresponding to user profiles, behavior profiles, and data access profiles based on the cross-domain fusion graph and matching diagnosis results include: The traversal depth is used as the limit for the number of searches; if the matching diagnosis result of the user portrait, behavior portrait or data access portrait is a successful match, then one entity node is selected from the corresponding portrait as the portrait starting point, and the entity node corresponding to the portrait starting point in the cross-domain fusion graph is used as the traversal starting point. Based on the traversal starting point, a breadth-first search with a limited number of searches is performed to generate the minimum associated subgraphs corresponding to the user portrait, behavior portrait and data access portrait respectively; If the matching diagnosis result of any portrait is a matching failure, the dynamic weaving completion processing strategy is executed for the portrait type that fails to match, and the corresponding minimum correlation subgraph is generated.

10. A distributed data dynamic weaving method according to claim 9, characterized in that: The dynamic weaving completion processing strategy is executed for the image types that fail to match, and the method of generating the corresponding minimum correlation subgraph includes: If there are entity nodes in the portrait that cannot be directly matched with the cross-domain fusion graph, the entity node will be mapped and matched with the semantic generalization mapping rule table. If the mapping match is successful, it will be mapped to the upper-level semantic entity node. If the mapping match fails, a candidate entity node set will be constructed based on the semantic similarity calculation; a depth-first search with a limited number of searches will be performed on each candidate entity node in the candidate entity node set to construct a search path set, and based on the path semantic weight evaluation model, the paths whose path semantic weight scores exceed the preset path semantic weight score threshold will be screened to form a candidate path set; the candidate path set will be constructed as a candidate association subgraph, the duplicate nodes and edges in the candidate association subgraph will be merged, and the paths that are only connected to the candidate entity nodes and have a degree of 1 will be deleted to generate the corresponding minimum association subgraph.

11. A distributed data dynamic weaving method according to claim 1, characterized in that: The method for constructing the cross-domain fusion graph includes: Extract core entity nodes with mappable features from the cloud domain subgraph, edge domain subgraph, and terminal domain subgraph to form a set of candidate entity pairs; the mappable features include identical field names, consistent synchronization task identifiers, or inheritance relationships between data paths; Analyze the semantic relationship between core entity nodes based on the candidate entity pair set, determine the cross-platform mapping relationship of each candidate entity pair in the candidate entity pair set based on the field structure, processing path, and access context, construct the corresponding cross-domain mapping edge in the cross-domain fusion graph, and construct a cross-domain mapping edge set; Constructing a cross-domain edge hopping path table based on the cross-domain mapping edge set, wherein the cross-domain edge hopping path table is used to record the mapping paths of each core entity node in different platforms; Based on the cloud domain sub-graph, edge domain sub-graph, terminal domain sub-graph and cross-domain hopping path table, a cross-domain fusion graph is constructed through the graph gateway service.

12. A distributed data dynamic weaving method according to claim 1, characterized in that: The method for constructing the cloud domain sub-graph, the edge domain sub-graph, and the terminal domain sub-graph includes: Analyze the historical operation data of the distributed data environment and construct the cloud core entity nodes, edge core entity nodes and terminal core entity nodes respectively; Based on the business and data relationships between cloud core entity nodes, a cloud-related edge set of the cloud platform is constructed; based on the business and data relationships between edge core entity nodes, an edge-related edge set of edge nodes is constructed; based on the business and data relationships between terminal core entity nodes, a terminal-related edge set of terminal devices is constructed; A cloud domain subgraph is constructed based on the cloud relationship edge set and cloud core entity nodes; an edge domain subgraph is constructed based on the edge relationship edge set and edge core entity nodes; and a terminal domain subgraph is constructed based on the terminal relationship edge set and terminal core entity nodes.

Images