A Privacy Data Security Protection Method and System Based on Clustering Processing

Abstract

This invention discloses a method and system for privacy data security protection based on clustering. The method includes login information acquisition, login pattern unit generation, differentiation of regular login pattern groups, merging of regular login pattern groups, risk level determination of edge login patterns, and privacy protection. This invention belongs to the field of data protection, specifically referring to a method and system for privacy data security protection based on clustering. This solution, based on the correlation analysis of login records, aggregates similar records through nearest neighbor sets to reduce exposure risk; merges redundant units by combining similarity scores to reduce unnecessary privacy data interaction; divides pattern units based on behavioral similarity thresholds to avoid oversensitivity to edge logins; merges regular login units by feature space overlap and behavioral correlation, and corrects periodic habits based on behavioral correlation to reduce the frequency of privacy data exposure during interaction; and improves privacy protection effectiveness by hierarchically processing edge login patterns.

Description

Technical Field

[0001] This invention relates to the field of data protection technology, specifically to a method and system for protecting privacy data security based on clustering processing. Background Technology

[0002] Privacy data security protection methods employ access control and anonymization technologies, combined with risk monitoring and compliance procedures, to safeguard privacy boundaries while ensuring the reasonable use of data. However, common privacy data security protection methods suffer from several drawbacks. Firstly, rigid anomaly detection leads to normal behavior being misjudged as abnormal. Secondly, high redundancy results in accumulated privacy risks, ultimately leading to poor privacy protection capabilities. Thirdly, redundant privacy data exchange increases the risk of privacy exposure. Fourthly, coarse risk level assessment results in an imbalance between privacy protection and security measures, further contributing to ineffective privacy protection. Summary of the Invention

[0003] To address the above issues and overcome the shortcomings of existing technologies, this invention provides a privacy data security protection method and system based on clustering. Addressing the problems of rigid anomaly detection in general privacy data security protection methods, which lead to normal behavior being misjudged as abnormal, high redundancy, and accumulated privacy risks, resulting in poor privacy protection capabilities, this solution is based on the correlation analysis of login records. It aggregates similar records through nearest neighbor sets, reducing direct dependence on original privacy data and lowering exposure risks. It merges redundant units by combining similarity scores, avoiding repeated storage of similar patterns and reducing unnecessary privacy data interaction. It divides pattern units based on behavioral similarity thresholds, which are dynamically calculated based on the fluctuation range of pattern units and a proportional coefficient, adapting to the behavioral differences of different users and avoiding oversensitivity to edge logins. It iteratively updates the patterns... This solution centralizes and merges redundant units to reduce the repeated collection and processing of user privacy data during maintenance, thereby reducing the frequency of privacy data exposure and improving privacy protection capabilities. Addressing the issues of redundant privacy data interaction in general privacy data security protection methods, which increase the risk of privacy exposure, and the problem of coarse risk level assessment leading to an imbalance between privacy protection and security protection, resulting in poor privacy protection effectiveness, this solution merges regular login units through feature space overlap and behavioral correlation. It captures periodic habits based on behavioral correlation correction, avoiding the segmentation of normal patterns due to time-varying differences and reducing the frequency of privacy data exposure during interaction. By classifying edge login patterns and quantifying risk distance, it redistributes low-risk logins and triggers warnings for high-risk logins, accurately identifying high-risk logins and achieving effective protection while safeguarding privacy, thus improving the overall privacy protection effect.

[0004] The technical solution adopted by this invention is as follows: The privacy data security protection method based on clustering processing provided by this invention includes the following steps:

[0005] Step S1: Obtain login information;

[0006] Step S2: Login mode unit generation;

[0007] Step S3: Differentiate between regular login mode groups;

[0008] Step S4: Combine and merge regular login modes;

[0009] Step S5: Risk level assessment of edge login mode;

[0010] Step S6: Privacy Protection.

[0011] Furthermore, in step S1, the login information acquisition involves preprocessing the login information to obtain login records.

[0012] Further, in step S2, the login pattern unit generation is achieved by adaptively capturing the natural associations of login records through login behavior association analysis, generating login pattern units representing potential normal login patterns; the association parameters of the login records are expressed as follows: ; ;in, It is the degree of behavioral correlation; and X is the login record; X is the set of login records. It is the Euclidean distance; It is a threshold for behavioral similarity; It is an adjustment factor; selecting cluster centers. , represented as: ; Generate login mode unit, represented as: Update the login mode unit center C, represented as: Continuously update the login mode unit center and login mode unit until convergence; among them, It is a login mode unit; It is the nearest neighbor set, where r is the distance threshold used to determine nearest neighbors; the behavioral similarity is calculated and expressed as: ;in, This refers to the fluctuation range of the login mode; and redundancy filtering is performed on two adjacent units. and Calculate the combined score of center similarity and fluctuation overlap. , represented as: ;like , If it is the merging threshold, then they are merged into one unit; where, These are the balancing weighting coefficients; and It is the center of two adjacent units; It refers to the total number of login records; the merged center and fluctuation range Recalculated, expressed as follows: ; .

[0013] Further, in step S3, the distinction between the regular login mode groups is achieved by dividing the login mode units into a regular login mode group and an edge login mode group based on a behavior similarity threshold; the regular login mode group... The definition is expressed as: Edge login mode group The definition is expressed as: Behavioral similarity threshold The calculation is expressed as: ;in, SR is a set of login patterns; SR is an array of login pattern units sorted in ascending order by the range of behavior fluctuations; [·] is the index value symbol of the array; It is the proportionality coefficient; It rounds down to the nearest integer.

[0014] Further, in step S4, the combination of regular login modes merges regular login units through the overlap of mode feature spaces and the correlation of login behavior to form a complete group of normal user login modes; the direct feature space overlap of the regular login mode group is expressed as: if ,but and Two regular login units have direct feature space overlap; the feature space overlap of a regular login pattern group is represented as follows: if there exists a sequence of regular login units, and consecutive regular login units in the sequence have direct feature space overlap, then the regular login units at the beginning and end of the sequence have feature space overlap; merging and correction based on login behavior association are performed to calculate regular units. and The average login time is expressed as: ; Perform time period correlation determination; if the conditions are met... ,in, and These are conventional units. and Average workday marker; This is a weekday marker; if the login occurs on a weekday, then... ,otherwise ; and It is the average standardized login time; It is a standardized login time; It is the time period deviation threshold; If the threshold is a periodic difference, it is determined to be a time-period correlation. If the login records share the same device, they are merged, as shown below: ;in, and These are two regular login mode groups to be merged; It is the merged complete regular login mode group.

[0015] Further, in step S5, the risk level determination of the edge login mode is to classify the risk level of the edge login mode according to whether it contains associated records of the regular mode: low risk and high risk. High-risk login triggers an alert; edge logins that contain associated records of the regular mode are considered low risk; unassigned login records in the edge login unit It will be assigned to the pattern group containing the nearest regular pattern association record. , represented as: ; It is the set of all records associated with the regular pattern; for edge logins that do not contain records associated with the regular pattern, the risk is further assessed, and the edge login unit is first assigned to the nearest regular login unit. Then calculate the risk distance between the edge login unit and the nearest regular login unit. ,like If it is, then it is marked as high risk.

[0016] Furthermore, in step S6, the privacy protection involves triggering an alert for high-risk logins and recording an alert log; the alert provides security protection while protecting privacy.

[0017] The privacy data security protection system based on clustering processing provided by the present invention includes a login information acquisition module, a login mode unit generation module, a regular login mode group differentiation module, a regular login mode combination and merging module, an edge login mode risk level determination module, and a privacy protection module.

[0018] The login information acquisition module preprocesses the login information to obtain login records;

[0019] The login mode unit generation module generates login mode units by calculating the behavioral correlation of login records, selecting cluster centers, and performing redundancy filtering and merging.

[0020] The regular login mode group differentiation module divides the login mode unit into regular and edge login mode groups based on the behavior similarity threshold.

[0021] The conventional login mode combination module merges conventional login mode units by overlapping mode feature spaces and login behavior associations.

[0022] The edge login mode risk level determination module classifies the edge login mode into risk levels, redistributes low-risk modes, and determines high-risk modes based on risk distance.

[0023] The privacy protection module triggers an alert for high-risk logins.

[0024] The beneficial effects achieved by the present invention using the above solution are as follows:

[0025] (1) In response to the problem that general privacy data security protection methods have rigid anomaly detection, which leads to normal behavior being misjudged as abnormal, high redundancy, accumulation of privacy risks, and thus poor privacy protection capabilities, this solution is based on the correlation analysis of login records. It aggregates similar records through nearest neighbor sets to reduce direct dependence on original privacy data and reduce exposure risks. It merges redundant units by combining similarity scores to avoid repeated storage of similar patterns and reduce unnecessary privacy data interaction. It divides pattern units based on behavior similarity thresholds. The behavior similarity thresholds are dynamically calculated based on the fluctuation range of pattern units and the proportional coefficient to adapt to the behavioral differences of different users and avoid oversensitivity to edge logins. It iteratively updates the pattern center and merges redundant units to reduce the repeated collection and processing of user privacy data during maintenance. In this way, the frequency of privacy data exposure is reduced and privacy protection capabilities are improved.

[0026] (2) To address the issues of redundant privacy data interaction in general privacy data protection methods, which increases the risk of privacy exposure, and the problem of crude risk level judgment leading to an imbalance between privacy protection and security protection, resulting in poor privacy protection, this solution merges regular login units by overlapping feature spaces and behavioral correlations, and captures periodic habits based on behavioral correlation corrections to avoid segmenting normal patterns due to time differences and reduce the frequency of privacy data exposure during interaction; it also processes edge login patterns in a graded manner, and redistributes low-risk data and triggers warnings for high-risk data by quantifying risk distance; it accurately identifies high-risk logins and achieves effective protection while protecting privacy; thereby improving the privacy protection effect. Attached Figure Description

[0027] Figure 1 This is a flowchart illustrating the privacy data security protection method based on clustering processing provided by the present invention.

[0028] Figure 2 This is a schematic diagram of a privacy data security protection system based on clustering processing provided by the present invention.

[0029] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used together with the embodiments of the invention to explain the invention and do not constitute a limitation thereof. Detailed Implementation

[0030] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0031] In the description of this invention, it should be understood that the terms "upper", "lower", "front", "rear", "left", "right", "top", "bottom", "inner", "outer", etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the system or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.

[0032] Example 1, see Figure 1 The present invention provides a privacy data security protection method based on clustering processing, which includes the following steps:

[0033] Step S1: Obtain login information; preprocess the login information to obtain login records;

[0034] Step S2: Login pattern unit generation; Login pattern units are generated by calculating the behavioral correlation of login records, selecting cluster centers, and performing redundancy filtering and merging.

[0035] Step S3: Differentiate between regular login mode groups; divide login mode units into regular and marginal login mode groups based on behavioral similarity thresholds;

[0036] Step S4: Combine and merge regular login patterns; merge regular login pattern units by overlapping pattern feature spaces and login behavior associations;

[0037] Step S5: Risk level determination of edge login mode; Divide the risk level of edge login mode, redistribute low risk, and determine high risk based on risk distance;

[0038] Step S6: Privacy protection; trigger alerts for high-risk logins.

[0039] Example 2, see Figure 1 This embodiment is based on the above embodiment. In step S1, the login information acquisition involves preprocessing the login information to obtain login records. The login information includes login time, login time period, IP address, device model, whether the login was successful, operation duration, and login frequency. The preprocessing includes: login time standardization. , represented as: The login period is determined by whether it is a working day, recorded as 1 or 0 respectively; IP address anonymization is achieved through IP-geographic coordinate mapping and desensitization and standardization processing, mapping the IP to latitude and longitude, converting it to the original coordinates through the IP database, and then blurring the coordinates, represented as follows: Standardized representation is ; ;in, and These are fuzzy latitude and longitude coordinates, respectively. It is the original latitude; and These are standardized latitude and longitude coordinates, respectively; the device identifier hash H is represented as: , It is a cryptographic hash function; I is the original device identifier string; the first 8 bits of the hash string are converted to a decimal integer. Normalize to [0,1]; calculate login frequency. , represented as: Standardization of operation time , represented as: And standardized to [0,1].

[0040] Example 3, see Figure 1 This embodiment is based on the above embodiment. In step S2, the login mode unit is generated by adaptively capturing the natural associations of login records through login behavior association analysis to generate login mode units representing potential normal login modes; the association parameters of the login records are expressed as follows: ; ;in, It is the degree of behavioral correlation; and X is the login record; X is the set of login records. It is the Euclidean distance; It is a threshold for behavioral similarity; It is an adjustment factor; selecting cluster centers. , represented as: ; Generate login mode unit, represented as: Update the login mode unit center C, represented as: The login mode unit center and login mode unit are continuously updated until convergence. A center fluctuation threshold is set. Convergence is complete when the change in the login mode center in two iterations is lower than the center fluctuation threshold. It is a login mode unit; It is the nearest neighbor set, where r is the distance threshold used to determine nearest neighbors; the behavioral similarity is calculated and expressed as: ;in, This refers to the fluctuation range of the login mode; and redundancy filtering is performed on two adjacent units. and Calculate the combined score of center similarity and fluctuation overlap. , represented as: ;like , If it is the merging threshold, then they are merged into one unit; where, These are the balancing weighting coefficients; and It is the center of two adjacent units; It refers to the total number of login records; the merged center and fluctuation range Recalculated, expressed as follows: ; ; Filter out redundant units generated by local dense logins to avoid redundant units interfering with regular group division; Each login record participates in the generation of login pattern units in vector form, and each login pattern unit includes multiple login records. The cluster center is the login information selected based on the association parameters.

[0041] Example 4, see Figure 1 This embodiment is based on the above embodiment. In step S3, the regular login mode group is divided into a regular login mode group and an edge login mode group by using a behavior similarity threshold. The regular login mode group represents stable normal login behavior, while the edge login mode group represents edge login or potentially abnormal login. Since the login time deviation of commonly used devices is small and their geographical coordinates are fixed, the characteristic fluctuation range of the regular login mode is small, and the corresponding behavior fluctuation range of the login mode unit is also small. However, abnormal logins such as edge logins or logins from other locations that occasionally use backup devices have a large characteristic fluctuation range, and the corresponding behavior fluctuation range of the login mode unit is also large. Distinguishing between the regular and edge login mode groups by using a behavior similarity threshold can focus on stable normal login modes and reduce the interference of edge logins on the judgment of normal modes. The definition is expressed as: Edge login mode group The definition is expressed as: Behavioral similarity threshold The calculation is expressed as: ;in, SR is a set of login patterns; SR is an array of login pattern units sorted in ascending order by the range of behavior fluctuations; [·] is the index value symbol of the array; It is the proportionality coefficient; It rounds down; the regular login mode group clarifies the stable and normal login mode of users, providing a clear benchmark for anomaly identification. Login behaviors that deviate from the regular login mode group are more likely to be abnormal; the behavior similarity threshold is dynamically calculated through proportion, which can adapt to the login stability characteristics of different users. For users with regular login behavior, the proportion of their regular login mode group is higher; for users with irregular login behavior, the proportion of their regular login mode group is lower.

[0042] By performing the above operations, this solution addresses the problems of rigid anomaly detection in general privacy data security protection methods, which leads to normal behavior being misjudged as abnormal, high redundancy, and accumulated privacy risks, ultimately resulting in poor privacy protection capabilities. Based on the correlation analysis of login records, this solution aggregates similar records through nearest neighbor sets, reducing direct dependence on original privacy data and lowering exposure risks. It merges redundant units by combining similarity scores, avoiding repeated storage of similar patterns and reducing unnecessary privacy data interaction. It divides pattern units based on behavioral similarity thresholds, which are dynamically calculated based on the fluctuation range and proportional coefficient of pattern units, adapting to the behavioral differences of different users and avoiding oversensitivity to edge logins. By iteratively updating the pattern center and merging redundant units, it reduces the repeated collection and processing of user privacy data during maintenance, thereby reducing the frequency of privacy data exposure and improving privacy protection capabilities.

[0043] Example 5, see Figure 1 This embodiment is based on the above embodiment. In step S4, the combination of regular login modes merges regular login units by overlapping mode feature spaces and login behavior associations to form a complete user normal login mode group. This avoids missegmentation of normal modes due to small fluctuations in login features. For example, frequent device + weekday login and frequent device + weekend login are merged into the same normal mode group. The normal login mode of the same user may have multiple sub-modes, such as weekday daytime login vs. weekend nighttime login. For the same device, they should be merged into a complete normal cluster. If sub-modes may be segmented only by overlapping mode feature spaces, login behavior associations need to be added to ensure the integrity of the merge. The direct feature space overlap of the regular login mode group is represented as: if ,but and Two regular login units have direct feature space overlap; the feature space overlap of a regular login pattern group is represented as follows: if there exists a sequence of regular login units, and consecutive regular login units in the sequence have direct feature space overlap, then the regular login units at the beginning and end of the sequence have feature space overlap; merging and correction based on login behavior association are performed to calculate regular units. and The average login time is expressed as: ; Perform time period correlation determination; if the conditions are met... ,in, and These are conventional units. and Average workday marker; This is a weekday marker; if the login occurs on a weekday, then... ,otherwise ; and It is the average standardized login time; It is a standardized login time; It is the time period deviation threshold; If the threshold is a periodic difference, it is determined to be a time-period correlation. If the login records share the same device, they are merged, as shown below: ;in, and These are two regular login mode groups to be merged; It is a complete group of regular login patterns after merging; it captures users' periodic login habits from weekdays to weekends, avoiding the segmentation of normal patterns due to non-overlapping time periods; by merging the overlapping feature spaces of patterns, it can ensure that normal sub-patterns with overlapping feature fluctuation ranges are identified as the same group; by correcting the correlation of login behavior, it can avoid the missegmentation of normal patterns due to changes in users' login habits, thus improving the completeness of normal pattern recognition.

[0044] Example 6, see Figure 1 This embodiment is based on the above embodiment. In step S5, the risk level determination of the edge login mode is to classify the risk level of the edge login mode according to whether it contains the associated records of the regular mode: low risk and high risk. High-risk login triggers an alert; this avoids excessive alerts for normal edge logins while accurately capturing high-risk logins; edge logins that contain the associated records of the regular mode are considered low risk; and login records not assigned in the edge login unit. It will be assigned to the pattern group containing the nearest regular pattern association record. , represented as: ; It is the collection of all records associated with the regular pattern; for edge logins that do not contain records associated with the regular pattern, the risk needs to be further assessed, and the edge login unit should first be assigned to the nearest regular login unit. Then calculate the risk distance between the edge login unit and the nearest regular login unit. ,like If a login fails, it is marked as high-risk. By redistributing low-risk logins, false alarms for normal edge logins are avoided, thus improving the user experience. The high-risk determination is based on a quantitative threshold of the maximum fluctuation in the normal mode, avoiding subjective judgment and ensuring accurate identification of genuine abnormal logins.

[0045] By performing the above operations, this solution addresses the problems of redundant privacy data interaction, increased privacy exposure risks, and poor privacy protection effectiveness caused by the general privacy data security protection methods, which suffer from coarse risk level judgment and an imbalance between privacy protection and security protection. This solution merges regular login units by combining feature space overlap and behavioral correlation, and captures periodic habits based on behavioral correlation correction to avoid segmenting normal patterns due to time-varying differences, thus reducing the frequency of privacy data exposure during interaction. Furthermore, it categorizes edge login patterns, quantifies risk distance, redistributes low-risk data, and triggers warnings for high-risk data; accurately identifies high-risk logins, achieving effective protection while safeguarding privacy; and ultimately improving the effectiveness of privacy protection.

[0046] Example 7, see Figure 1 This embodiment is based on the above embodiment. In step S6, privacy protection is to trigger an alert for high-risk login and record an alert log, which only contains anonymized features and does not record the original privacy data. The alert must achieve security protection under the premise of protecting privacy: it does not disclose the user's original login information and only triggers the alert based on the risk level of the anonymized features. The log only retains risk features including geographical deviation and device unfamiliarity to avoid the risk of privacy data storage.

[0047] Example 8, see Figure 2 Based on the above embodiments, the privacy data security protection system based on clustering processing provided by the present invention includes a login information acquisition module, a login mode unit generation module, a regular login mode group differentiation module, a regular login mode combination and merging module, an edge login mode risk level determination module, and a privacy protection module.

[0048] The login information acquisition module preprocesses the login information to obtain login records;

[0049] The login mode unit generation module generates login mode units by calculating the behavioral correlation of login records, selecting cluster centers, and performing redundancy filtering and merging.

[0050] The regular login mode group differentiation module divides the login mode unit into regular and edge login mode groups based on the behavior similarity threshold.

[0051] The conventional login mode combination module merges conventional login mode units by overlapping mode feature spaces and login behavior associations.

[0052] The edge login mode risk level determination module classifies the edge login mode into risk levels, redistributes low-risk modes, and determines high-risk modes based on risk distance.

[0053] The privacy protection module triggers an alert for high-risk logins.

[0054] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0055] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention.

[0056] The present invention and its embodiments have been described above. This description is not restrictive, and the accompanying drawings are only one embodiment of the present invention; the actual structure is not limited thereto. In conclusion, if those skilled in the art are inspired by this description and design similar structures and embodiments without departing from the spirit of the invention, such designs should fall within the protection scope of the present invention.

Claims

1. A privacy data security protection method based on clustering processing, characterized in that: The method includes the following steps: Step S1: Obtain login information; preprocess the login information to obtain login records; Step S2: Login pattern unit generation; Login pattern units are generated by calculating the behavioral correlation of login records, selecting cluster centers, and performing redundancy filtering and merging. Step S3: Differentiate between regular login mode groups; divide login mode units into regular and marginal login mode groups based on behavioral similarity thresholds; Step S4: Combine and merge regular login patterns; merge regular login pattern units by overlapping pattern feature spaces and login behavior associations; Step S5: Risk level determination of edge login mode; Divide the risk level of edge login mode, redistribute low risk, and determine high risk based on risk distance; Step S6: Privacy protection; trigger alerts for high-risk logins; In step S2, the login pattern unit generation is achieved by adaptively capturing the natural associations of login records through login behavior association analysis, generating login pattern units representing potential normal login patterns; the association parameters of the login records are expressed as follows: ; ;in, It is the degree of behavioral correlation; and X is the login record; X is the set of login records. It is the Euclidean distance; It is a threshold for behavioral similarity; It is an adjustment factor; selecting cluster centers. , represented as: ; Generate login mode unit, represented as: Update the login mode unit center C, represented as: Continuously update the login mode unit center and login mode unit until convergence; among them, It is a login mode unit; It is the nearest neighbor set, where r is the distance threshold used to determine nearest neighbors; the behavioral similarity is calculated and expressed as: ;in, This refers to the fluctuation range of the login mode; and redundancy filtering is performed on two adjacent units. and Calculate the combined score of center similarity and fluctuation overlap. , represented as: ;like , If it is the merging threshold, then they are merged into one unit; where, These are the balancing weighting coefficients; and It is the center of two adjacent units; It refers to the total number of login records; the merged center and fluctuation range Recalculated, and expressed as follows: ; .

2. The privacy data security protection method based on clustering processing according to claim 1, characterized in that: In step S3, the distinction between the regular login mode groups is achieved by dividing login mode units into regular login mode groups and edge login mode groups based on a behavior similarity threshold; the regular login mode group... The definition is expressed as: Edge login mode group The definition is expressed as: Behavioral similarity threshold The calculation is expressed as: ;in, SR is a set of login patterns; SR is an array of login pattern units sorted in ascending order by the range of behavior fluctuations; [·] is the index symbol for the array; It is the proportionality coefficient; It rounds down to the nearest integer.

3. The privacy data security protection method based on clustering processing according to claim 2, characterized in that: In step S4, the normal login mode combination and merging of normal login units are achieved by overlapping mode feature spaces and login behavior associations to form a complete user normal login mode group; The direct feature space overlap of the regular login pattern group is represented as follows: If ,but and The two conventional login units have directly overlapping feature spaces; The feature space overlap of the regular login pattern group is represented as follows: if a regular login unit sequence exists, and consecutive regular login units in the sequence have direct feature space overlap, then the regular login units at the beginning and end of the sequence have overlapping feature spaces; merging and correction based on login behavior association are performed to calculate the regular units. and The average login time is expressed as: ; ; Perform time period correlation determination, if the conditions are met. ,in, and These are conventional units. and Average workday marker; This is a weekday marker; if the login occurs on a weekday, then... ,otherwise ; and It is the average standardized login time; It is a standardized login time; It is the time period deviation threshold; If the threshold is a periodic difference, it is determined to be a time-period correlation. If the login records share the same device, they are merged, as shown below: ;in, and These are two regular login mode groups to be merged; It is the merged complete regular login mode group.

4. The privacy data security protection method based on clustering processing according to claim 3, characterized in that: In step S5, the risk level determination of the edge login mode is to classify the risk level of the edge login mode according to whether it contains the associated records of the regular mode: low risk, high risk, and high risk login triggers an early warning; Edge logins that include records associated with regular patterns are considered low-risk. Unassigned login records in the edge login unit It will be assigned to the pattern group containing the nearest regular pattern association record. , is represented as: ; It is the set of all records associated with the regular pattern; for edge logins that do not contain records associated with the regular pattern, the risk is further assessed, and the edge login unit is first assigned to the nearest regular login unit. Then calculate the risk distance between the edge login unit and the nearest regular login unit. ,like If it is, then it is marked as high risk.

5. The privacy data security protection method based on clustering processing according to claim 4, characterized in that: In step S6, the privacy protection triggers an alert for high-risk logins and records an alert log; the alert provides security protection while protecting privacy.

6. A privacy data security protection system based on clustering processing, used to implement the privacy data security protection method based on clustering processing as described in any one of claims 1-5, characterized in that: It includes a login information acquisition module, a login mode unit generation module, a regular login mode group differentiation module, a regular login mode combination and merging module, an edge login mode risk level determination module, and a privacy protection module; The login information acquisition module preprocesses the login information and extracts feature vectors; The login mode unit generation module generates login mode units by calculating the behavioral correlation of login records, selecting cluster centers, and performing redundancy filtering and merging. The regular login mode group differentiation module divides the login mode unit into regular and edge login mode groups based on the behavior similarity threshold. The conventional login mode combination module merges conventional login mode units by overlapping mode feature spaces and login behavior associations. The edge login mode risk level determination module classifies the edge login mode into risk levels, redistributes low-risk modes, and determines high-risk modes based on risk distance. The privacy protection module triggers an alert for high-risk logins.

Images