Behavior marking and traceability system and method for database sensitive data outsourcing

Abstract

The application discloses a database sensitive data sending behavior marking and traceability tracking system and method, and the system comprises six units, i.e., a data feature perception and acquisition unit, a behavior feature extraction unit of an optimized bat algorithm and the like. The data sending parameters are acquired through the data feature perception and acquisition unit, the behavior features are extracted through the optimized bat algorithm, the state transition is analyzed by improving the Markov chain model, the data marking code is generated, the traceability index is constructed, and the tracking feedback is performed. The method comprises six steps, i.e., data acquisition, feature extraction, state analysis, code generation, index construction and tracking feedback. Through the cooperation of the units of the system and the specific method, the application realizes accurate marking and efficient traceability tracking of the database sensitive data sending behavior, and provides a reliable technical means for data security protection.

Description

Technical Field

[0001] This invention relates to the field of fire alarms, fire sensor hardware and algorithms, and particularly to a system and method for behavioral tagging and source tracing of sensitive database data leaks. Background Technology

[0002] With the acceleration of digitalization, the exchange and external transmission of sensitive database data are becoming increasingly frequent. This data contains important information such as personal privacy and trade secrets. Once illegally transmitted, it can lead to serious consequences such as data breaches, economic losses, and legal disputes. Therefore, building an effective system for marking and tracing the external transmission of sensitive database data has become crucial to ensuring data security, but existing technologies have many shortcomings.

[0003] Traditional methods have significant limitations in extracting features of sensitive data outflow behavior. Existing technologies mostly rely on fixed rules or simple statistical methods, making it difficult to accurately identify complex and ever-changing outflow behavior patterns. Faced with complex situations such as abnormal fluctuations in data transmission traffic, special combinations of data field types, and periodic changes in the frequency of data outflow, traditional methods cannot comprehensively and accurately extract effective features. This results in a lack of reliable data support for subsequent analysis, an inability to detect potential risks of sensitive data outflow in a timely manner, and difficulty in effectively preventing data leakage.

[0004] In the source tracing and tracking phase, the shortcomings of existing systems are also quite prominent. Existing source tracing and tracking technologies lack systematicity and consistency, data tagging and encoding are not precise enough, index construction is inefficient and updates are not timely, making it impossible to quickly and accurately locate the source of data and trace the flow of data when sensitive data leakage occurs. This not only fails to meet the real-time and accuracy requirements of data security protection, but also makes it difficult to effectively investigate and handle data leakage incidents, and cannot provide strong protection for data security. Summary of the Invention

[0005] In order to overcome the shortcomings and deficiencies of existing technologies, this invention provides a system and method for marking and tracing the behavior of sensitive database data being leaked.

[0006] The technical solution adopted in this invention is a behavior marking and tracing system for sensitive database data outflow, including a data feature perception and acquisition unit, a behavior feature extraction unit for the optimized bat algorithm, an improved Markov chain state transition analysis unit, a data mark encoding generation unit, a tracing information storage and index construction unit, and a tracing instruction execution and feedback unit.

[0007] The data feature perception and acquisition unit is used to perceive in real time the data transmission traffic, data field type, and data transmission frequency during the process of sending sensitive data out of the database, and transmits the acquired data to the behavior feature extraction unit of the optimized bat algorithm.

[0008] The optimized bat algorithm behavior feature extraction unit receives data transmitted by the data feature perception and acquisition unit, uses the optimized bat algorithm to extract features from the data, and transmits the extracted behavior feature data to the improved Markov chain state transition analysis unit.

[0009] The improved Markov chain state transition analysis unit receives behavioral feature data, performs state transition analysis through the improved Markov chain model, and transmits the analysis results to the data tag encoding generation unit.

[0010] The data tag encoding generation unit generates the corresponding data tag encoding based on the received analysis results, and transmits the data tag encoding to the traceability information storage and index construction unit;

[0011] The traceability information storage and indexing construction unit stores the data tag encoding and constructs an index. The tracking instruction execution and feedback unit executes the tracking instruction and feeds back the tracking result based on the index information of the traceability information storage and indexing construction unit. The units achieve orderly data transmission and interaction through data transmission interfaces and communication protocols.

[0012] Furthermore, in the behavioral feature extraction unit of the optimized bat algorithm, the optimized bat algorithm uses the following model formula for data feature extraction:

[0013] F new =F min +(F max -F min )×r1

[0014] Among them, F new F represents the frequency of newly generated features, used to characterize the frequency of occurrence of extracted sensitive data exogenous behavioral features; min The minimum feature frequency threshold is set as a preset value, based on the outflow of historical sensitive data as the feature frequency statistical setting; F max The maximum feature frequency threshold is preset and is also set based on historical data; r1 is a random number in the interval [0, 1], used to introduce randomness to optimize feature extraction.

[0015] Furthermore, in the behavioral feature extraction unit of the optimized bat algorithm, the optimized bat algorithm also uses the following formula to update the feature position:

[0016]

[0017] in, This represents the updated feature position of the i-th bat individual at time t+1, corresponding to the position of the sensitive data outflow behavior feature in the data space; Let be the characteristic position of the i-th bat individual at time t; It is the velocity of the i-th bat individual at time t, reflecting the rate of feature position update; Let be the velocity of the i-th bat individual at time t-1; F represents the globally optimal feature position at time t, determined by the outward behavioral features of all currently extracted sensitive data; new These are the newly generated feature frequencies.

[0018] Furthermore, in the improved Markov chain state transition analysis unit, the improved Markov chain model adopts the following state transition probability formula:

[0019]

[0020] Among them, P ij (n, n+1) represents the probability that a state i is in time n and transitions to state j at time n+1, used to analyze the likelihood of sensitive data outflow behavior transitioning from one state to another; ω ij (n) is the weight for transitioning from state i to state j at time n. This weight is calculated based on the data transmission flow and data transmission frequency parameters during the sensitive data transmission process. N is the total number of states set by the system, which is pre-defined according to different modes of sensitive data transmission behavior.

[0021] Furthermore, in the improved Markov chain state transition analysis unit, the improved Markov chain model also adopts the following state update formula:

[0022]

[0023] Where S(n+1) represents the state of the system at time n+1, reflecting the overall state of the sensitive data outflow behavior at that time; P i (n) is the probability of being in state i at time n, which is derived from the statistical analysis of the outward behavior state of historical sensitive data.

[0024] Furthermore, the data tag encoding generation unit, based on the analysis results of the improved Markov chain state transition analysis unit and combined with various parameters of the sensitive data in the database, adopts the following encoding generation formula:

[0025] C = H(D, F, S)

[0026] Wherein, C represents the generated data tag code, used to uniquely identify sensitive data outgoing behavior; D represents the specific content of sensitive data collected by the data feature perception and acquisition unit, including data field type and data value; F represents the behavioral feature data extracted by the behavior feature extraction unit of the optimized bat algorithm; S represents the state information obtained by the improved Markov chain state transition analysis unit; and H is a hash function that generates a unique and corresponding data tag code by performing hash operations on the sensitive data content, behavioral feature data, and state information.

[0027] Furthermore, the data tag encoding generation unit also uses the following verification formula when generating data tag codes:

[0028] V = G(C, D, F, S)

[0029] Wherein, V represents the generated data tag code verification value, used to verify the accuracy of the data tag code; C is the data tag code defined in claim 6; D, F, and S are the corresponding data features, behavioral features, and state information in claim 6, respectively; G is the verification function, which generates the verification value by performing calculations on the data tag code and related data features, behavioral features, and state information.

[0030] Furthermore, when constructing the index, the traceability information storage and index construction unit uses the following index construction formula:

[0031] I = Index(C, T, L)

[0032] Where I represents the constructed traceability information index, used to quickly locate and query information related to sensitive data external behavior; C is the data tag encoding generated by the data tag encoding generation unit; T is the timestamp of the sensitive data external behavior, accurately recording the time of the external behavior; L is the location information of the sensitive data external behavior, including the network IP address; and Index is the index construction function, which constructs a traceability information index with query performance by processing the data tag encoding, timestamp, and location information.

[0033] Furthermore, the traceability information storage and index construction unit uses the following index update formula when updating the index:

[0034] I new =Update(I,ΔC,ΔT,ΔL)

[0035] Among them, I newThis represents the updated traceability information index; I represents the traceability information index before the update; ΔC represents the change in the newly generated data tag code; ΔT represents the change in the timestamp of the new sensitive data external behavior; ΔL represents the change in the location information of the new sensitive data external behavior; and Update is the index update function, which dynamically updates the original index based on the changes in the newly generated data tag code, timestamp, and location information.

[0036] The method for identifying and tracing the source of sensitive database data leaks includes the following steps:

[0037] The first step is to use the data feature perception and acquisition unit to perceive in real time the data transmission traffic, data field type, and data transmission frequency during the process of sensitive data being sent out of the database, and then transmit the acquired data to the behavior feature extraction unit of the optimized bat algorithm.

[0038] The second step is to optimize the behavior feature extraction unit of the bat algorithm. After receiving the data, the optimized bat algorithm is used to extract features from the data and the extracted behavior feature data is transmitted to the improved Markov chain state transition analysis unit.

[0039] The third step involves improving the Markov chain state transition analysis unit to receive behavioral feature data, performing state transition analysis through the improved Markov chain model, and transmitting the analysis results to the data tag encoding generation unit.

[0040] The fourth step is for the data tag encoding generation unit to generate corresponding data tag codes based on the received analysis results and various parameters of the sensitive data in the database, and then transmit the data tag codes to the traceability information storage and index construction unit.

[0041] The fifth step involves the traceability information storage and index building unit storing the data tag encoding and building an index;

[0042] The sixth step is for the tracking instruction execution and feedback unit to execute the tracking instructions and provide feedback on the tracking results based on the index information of the traceability information storage and index construction unit.

[0043] Beneficial Effects: This invention proposes a behavioral tagging and source tracing system and method for sensitive data outflow from databases. In terms of sensitive data outflow behavioral feature extraction, the data feature perception and acquisition unit acquires key parameters such as data transmission traffic and field types in real time. The optimized Bat Algorithm behavioral feature extraction unit performs in-depth data mining. Compared to traditional fixed rules and simple statistical methods, it can accurately capture complex and ever-changing behavioral patterns during data outflow. Whether it's abnormal traffic fluctuations or special field combinations, it can comprehensively and accurately extract effective features, providing reliable data support for subsequent analysis. In the source tracing stage, the improved Markov chain state transition analysis unit performs state transition analysis on behavioral feature data. The data tagging and encoding generation unit combines the analysis results with data parameters to generate accurate codes. The source information storage and indexing unit builds an efficient index based on this and updates it dynamically. Compared to existing source tracing technologies that lack systematicity, have inaccurate coding, and inefficient indexing, this system and method can quickly and accurately locate the data source and trace the data flow when sensitive data outflow events occur, achieving efficient investigation and handling of data leakage events. This greatly improves the real-time performance and accuracy of data security protection, effectively ensuring the security and traceability of sensitive database data outflow. Attached Figure Description

[0044] Figure 1 This is a system unit composition diagram of the present invention;

[0045] Figure 2 This is a flowchart of the method steps of the present invention. Detailed Implementation

[0046] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of this application can be combined with each other. The application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0047] like Figure 1 As shown, the system and method for marking and tracing the behavior of sensitive database data being leaked includes a data feature perception and acquisition unit, a behavior feature extraction unit for the optimized bat algorithm, an improved Markov chain state transition analysis unit, a data tag encoding generation unit, a traceability information storage and index construction unit, and a tracking instruction execution and feedback unit.

[0048] The data feature perception and acquisition unit is used to perceive various parameters such as data transmission traffic, data field type, and data transmission frequency during the process of sending sensitive data out of the database in real time, and transmits the acquired data to the behavior feature extraction unit of the optimized bat algorithm.

[0049] Specifically, the data feature perception and acquisition unit is deployed at the database system boundary, monitoring outbound data traffic in real time through a protocol parsing engine. It supports mainstream database protocols such as MySQL and Oracle, and can identify over 200 sensitive data types (such as credit card numbers and medical records). Employing deep packet inspection technology, it can capture and parse data packets within 100 microseconds, achieving byte-level accuracy in traffic monitoring. For example, in an application at a financial institution, this unit successfully identified 5,000 abnormal data requests per second, promptly preventing the risk of customer information leakage. In terms of technical parameters, the system supports millions of concurrent connections, a data acquisition throughput of 10GB / s, and a false alarm rate of less than 0.001%, ensuring full monitoring of sensitive data flows in complex network environments.

[0050] The optimized bat algorithm behavior feature extraction unit receives data transmitted by the data feature perception and acquisition unit, uses the optimized bat algorithm to extract features from the data, and transmits the extracted behavior feature data to the improved Markov chain state transition analysis unit.

[0051] Specifically, the optimized Bat Algorithm's behavioral feature extraction unit employs an improved Bat Algorithm to extract multi-dimensional features from the collected data. Through an adaptive search strategy, the feature space is divided into 512 dimensions, each corresponding to different data behavior features (such as access time distribution and operation sequence patterns). In a practical application on an e-commerce platform, the system successfully identified SQL injection attacks disguised as legitimate data exports by analyzing user behavior patterns, achieving an accuracy rate of 99.2%. The algorithm introduces a dynamic weighting mechanism, assigning higher weight to recent behaviors, thus improving the system's response speed to new attack patterns by 30%. In terms of technical parameters, the feature extraction latency is controlled within 50 milliseconds, supporting the processing of 100,000 data records per second, effectively addressing the real-time analysis needs of high-concurrency scenarios.

[0052] The improved Markov chain state transition analysis unit receives behavioral feature data, performs state transition analysis through the improved Markov chain model, and transmits the analysis results to the data tag encoding generation unit.

[0053] Specifically, the improved Markov chain state transition analysis unit constructs a Markov chain model containing 256 state nodes, each node corresponding to a data outflow state (such as normal query, batch export, or abnormal transmission). By analyzing the state transition probability matrix, the system can predict data flow trends within the next three steps. In a medical database, the system successfully intercepted an attempt to transfer patient genetic data to an overseas server by monitoring state transitions along the data access path. The model introduces a time window mechanism, assigning different weights to state transitions in different time periods, improving the accuracy of abnormal behavior detection to 97.8%. In terms of technical parameters, the state update frequency is 100 times / second, supporting dynamic expansion to 1024 state nodes, meeting the behavioral modeling needs of complex business scenarios.

[0054] The data tag encoding generation unit generates the corresponding data tag encoding based on the received analysis results, and transmits the data tag encoding to the traceability information storage and index construction unit;

[0055] Specifically, the data tag encoding generation unit generates unique data tag codes based on the results of prior analysis, using the SHA-256 hash algorithm combined with timestamps and random numbers to generate a 128-bit code. The encoding structure includes five functional sections: data type identifier (16 bits), risk level (8 bits), timestamp (32 bits), source IP address mapping (32 bits), and checksum (40 bits). In a certain government system, this encoding system successfully tracked an incident of internal personnel illegally sending sensitive documents to external parties, taking only 3 minutes from the discovery of the anomaly to locating the responsible party. In terms of technical parameters, the encoding generation speed reaches 100,000 records per second, and the collision probability is less than 10^-32, ensuring uniqueness and security in large-scale data environments.

[0056] The traceability information storage and indexing construction unit stores the data tag encoding and constructs an index. The tracking instruction execution and feedback unit executes the tracking instruction and feeds back the tracking result based on the index information of the traceability information storage and indexing construction unit. The units achieve orderly data transmission and interaction through data transmission interfaces and communication protocols.

[0057] Specifically, the traceability information storage and indexing unit uses a distributed graph database to store traceability information, supporting petabyte-level data storage and millisecond-level query response. The index structure is optimized based on a B+ tree and employs a three-level partitioning strategy (by time, risk level, and data type), improving query efficiency by 40%. In an application by a multinational corporation, the system successfully stored over 5 billion data access records and located an abnormal data outflow event from 3 years ago within 100 milliseconds. In terms of technical parameters, the system supports 1000 concurrent query requests, and the data persistence rate reaches 99.999%, ensuring the integrity and availability of historical traceability information.

[0058] Specifically, the tracking command execution and feedback unit executes tracking commands through a probe cluster deployed at the network boundary, supporting multi-path backtracking and traffic mirroring analysis. When suspicious data outflow is detected, the system can initiate an emergency response process within one second, including blocking connections, recording session information, and generating a security audit report. In a securities trading system, this unit successfully intercepted an APT attack targeting trading data and identified the attack source IP and attack path through traffic backtracking analysis. In terms of technical parameters, the command response latency is less than 500 milliseconds, supporting rapid retrieval of TB-level historical traffic data, ensuring rapid location and handling of security incidents in emergency situations. All units interact through standardized RESTful API interfaces, ensuring the overall collaborative efficiency of the system.

[0059] Preferably, in the behavior feature extraction unit of the optimized bat algorithm, the optimized bat algorithm uses the following model formula for data feature extraction:

[0060] F new =F min +(F max -F min )×r1

[0061] Among them, F new F represents the frequency of newly generated features, used to characterize the frequency of occurrence of extracted sensitive data exogenous behavioral features; min The minimum feature frequency threshold is set as a preset value, based on the outflow of historical sensitive data as the feature frequency statistical setting; F max The maximum feature frequency threshold is preset and is also set based on historical data; r1 is a random number in the interval [0, 1], used to introduce randomness to optimize feature extraction. This formula processes parameters such as data field type and data transmission frequency during the sensitive data transmission process to obtain more accurate behavioral feature data.

[0062] Specifically, the behavioral feature extraction unit of the optimized bat algorithm calculates new feature frequencies using a specific formula. This formula uses preset minimum and maximum feature frequency thresholds as boundary constraints, combined with randomly generated values ​​within a fixed interval, to process parameters such as data field types and data transmission frequency during the process of sensitive data transmission from the database. Its core lies in introducing uncertainty through random numbers, dynamically adjusting feature frequencies within a preset threshold range. This allows the algorithm to break through conventional patterns during data processing and uncover potential, less obvious features in data transmission behavior. This calculation method enhances the algorithm's adaptability to complex data environments, avoids getting trapped in local optima, and thus accurately extracts more representative behavioral feature data from massive database parameters, providing more reliable input for subsequent analysis.

[0063] Preferably, in the behavioral feature extraction unit of the optimized bat algorithm, the optimized bat algorithm further uses the following formula to update the feature position:

[0064]

[0065] in, This represents the updated feature position of the i-th bat individual at time t+1, corresponding to the position of the sensitive data outflow behavior feature in the data space; Let be the characteristic position of the i-th bat individual at time t; It is the velocity of the i-th bat individual at time t, reflecting the rate of feature position update; Let be the velocity of the i-th bat individual at time t-1; F represents the globally optimal feature position at time t, determined by the outward behavioral features of all currently extracted sensitive data; new This represents the newly generated feature frequency. By combining these two formulas, dynamic updating and optimized extraction of feature locations from sensitive data outflows can be achieved.

[0066] Specifically, the optimized feature location update formula of the bat algorithm dynamically locates the outward behavioral features of sensitive data in the data space by iteratively calculating the position and speed of individual bats. The speed update of an individual bat in the formula depends on its speed at the previous moment, the difference between its current position and the global optimal position, and the frequency of newly generated features. This update mechanism allows the algorithm to dynamically adjust its search direction and step size based on the distribution of outward behavioral features in the current data. The global optimal position guides the algorithm towards a better solution, while the feature frequency affects the search step size, improving search efficiency while maintaining search accuracy. Through continuous iterative updates, the algorithm can more accurately capture the position of behavioral features in the data space, thereby achieving precise extraction and localization of outward behavioral features of sensitive data.

[0067] Preferably, in the improved Markov chain state transition analysis unit, the improved Markov chain model adopts the following state transition probability formula:

[0068]

[0069] Among them, P ij (n, n+1) represents the probability that a state i is in time n and transitions to state j at time n+1, used to analyze the likelihood of sensitive data outflow behavior transitioning from one state to another; ω ij(n) is the weight for the transition from state i to state j at time n. This weight is calculated based on parameters such as data transmission volume and data transmission frequency during the sensitive data outflow process. N is the total number of states set by the system, which is pre-defined according to different patterns of sensitive data outflow behavior. This formula is used to quantitatively analyze the state transitions of sensitive data outflow behavior, providing a basis for subsequent processing.

[0070] Specifically, the improved Markov chain state transition analysis unit calculates state transition probabilities using a specific formula. This formula is based on the weights of transitions from one state to another, combined with the total number of states set by the system, and derives the state transition probabilities through normalization. The weights in the formula are determined by parameters such as data transmission volume and data transmission frequency during the sensitive data outflow process. This calculation method quantifies the likelihood of sensitive data outflow behavior transitioning between different states, transforming complex data outflow behavior patterns into measurable probability values. These probability values ​​provide a quantitative basis for the system to judge the development trend of data outflow behavior, enabling the system to more scientifically assess the risk level of data outflow behavior and promptly detect abnormal state transitions.

[0071] Preferably, in the improved Markov chain state transition analysis unit, the improved Markov chain model also adopts the following state update formula:

[0072]

[0073] Where S(n+1) represents the state of the system at time n+1, reflecting the overall state of the sensitive data outflow behavior at that time; P i (n) represents the probability of being in state i at time n, derived from statistics of historical sensitive data outward behavior states. This formula combines the state transition probability with the probability of each state at the current time to achieve dynamic updating and analysis of the sensitive data outward behavior state.

[0074] Specifically, the improved state update formula for the Markov chain state transition analysis unit calculates the system state at the next moment by combining the probabilities of each state at the current moment with the state transition probabilities. The formula comprehensively considers historical state probabilities and current state transition trends, enabling the system to dynamically reflect the overall state of sensitive data outflow behavior at different times. This calculation method avoids the limitations of relying solely on current data for judgment, fully utilizing historical data information to provide a more comprehensive and accurate update and prediction of the state of data outflow behavior. By continuously updating the state, the system can promptly capture the changing trends of data outflow behavior, providing more precise state information for subsequent data labeling and tracing.

[0075] Preferably, the data tag encoding generation unit, based on the analysis results of the improved Markov chain state transition analysis unit and combined with various parameters of the sensitive data in the database, adopts the following encoding generation formula:

[0076] C = H(D, F, S)

[0077] Wherein, C represents the generated data tag code, used to uniquely identify sensitive data outgoing behavior; D represents the specific content of sensitive data collected by the data feature perception and acquisition unit, including data field type, data value, etc.; F represents the behavioral feature data extracted by the behavior feature extraction unit of the optimized bat algorithm; S represents the state information obtained by the state transition analysis unit of the improved Markov chain. H is a hash function, which generates a unique and corresponding data tag code by hashing the sensitive data content, behavioral feature data, and state information.

[0078] Specifically, the encoding generation formula of the data tag encoding generation unit integrates the specific content of sensitive data, behavioral feature data, and state information through a hash function to generate a unique data tag code. The formula takes as input the data content acquired by the data feature perception and acquisition unit, the behavioral feature data extracted by the optimized bat algorithm behavioral feature extraction unit, and the state information obtained by the improved Markov chain state transition analysis unit. Through hash function operations, multi-dimensional information is compressed and mapped into a fixed-length code. This encoding method ensures that each sensitive data outflow behavior has a unique corresponding code. The code contains key behavior-related information, facilitating rapid location and association of specific sensitive data outflow behaviors during subsequent tracing, thus achieving effective tagging and management of data outflow behaviors.

[0079] Preferably, the data tag encoding generation unit also uses the following verification formula when generating data tag codes:

[0080] V = G(C, D, F, S)

[0081] Wherein, V represents the generated data tag code verification value, used to verify the accuracy of the data tag code; C is the data tag code defined in claim 6; D, F, and S are the corresponding data features, behavioral features, and state information in claim 6, respectively; G is a verification function that generates a verification value by performing calculations on the data tag code and related data features, behavioral features, and state information to ensure the consistency between the data tag code and the actual sensitive data external behavior.

[0082] Specifically, the verification formula of the data tag encoding generation unit calculates a verification value by performing operations on the generated data tag encoding and related data features, behavioral features, and state information using a specific function. This formula verifies the consistency between the encoding and the original data information. By using both the encoding and the original data information as input, the resulting verification value can be compared with pre-set rules or standards. If the verification value meets expectations, it indicates that the encoding accurately reflects the actual sensitive data leakage behavior; if it does not meet expectations, it suggests that the encoding may contain errors or have been tampered with. This verification mechanism ensures the accuracy of the data tag encoding, guaranteeing that the query and analysis results based on the encoding are reliable during traceability and enhancing the security and credibility of the entire system.

[0083] Preferably, the traceability information storage and index building unit uses the following index building formula when building the index:

[0084] I = Index(C, T, L)

[0085] Where I represents the constructed traceability information index, used to quickly locate and query information related to sensitive data outflows; C is the data tag encoding generated by the data tag encoding generation unit; T is the timestamp of the sensitive data outflow, accurately recording the time of the outflow; and L is the location information of the sensitive data outflow, including network IP addresses, etc. Index is an index building function that processes data tag encoding, timestamps, and location information to construct a traceability information index with high query performance.

[0086] Specifically, the index building formula of the traceability information storage and index building unit processes data tag codes, timestamps, and location information through a specific index building function to construct a traceability information index. The formula uses data tag codes as unique identifiers for actions, timestamps to record the temporal order of data outflow behavior, and location information to determine the network location where the behavior occurred. These key information elements are integrated and organized through the index building function. This index building method enables the system to quickly locate the corresponding traceability information record based on different query requirements, such as queries by time, by location, or by code for precise searching. By constructing an efficient index structure, the query efficiency for massive amounts of traceability information is greatly improved, providing strong support for rapidly tracking sensitive data outflow behavior.

[0087] Preferably, the traceability information storage and index construction unit uses the following index update formula when updating the index:

[0088] I new =Update(I,ΔC,ΔT,ΔL)

[0089] Among them, Inew This represents the updated traceability information index; I represents the original traceability information index; ΔC represents the change in the newly generated data tag code; ΔT represents the change in the timestamp of the new sensitive data outgoing behavior; and ΔL represents the change in the location information of the new sensitive data outgoing behavior. `Update` is the index update function, which dynamically updates the original index based on the changes in the newly generated data tag code, timestamp, and location information to ensure the timeliness and accuracy of the index.

[0090] Specifically, the index update formula of the traceability information storage and index construction unit dynamically updates the original index through the index update function, based on the changes in newly generated data tag codes, timestamps, and location information. The formula can detect changes in data outflow behavior in real time. When new data outflow behavior occurs or existing behavioral information changes, it calculates the changes and passes them as input to the index update function. The index update function adjusts and optimizes the original index structure based on these changes, ensuring that the index always remains consistent with the actual sensitive data outflow behavior information. This dynamic update mechanism guarantees the timeliness and accuracy of the index, maintaining high query performance even in database environments with frequent data changes, and ensuring the continuous and effective operation of the traceability function.

[0091] like Figure 2 As shown, the method for identifying and tracing the source of sensitive database data leaks includes the following steps:

[0092] The first step is to use the data feature perception and acquisition unit to perceive various parameters such as data transmission traffic, data field type, and data transmission frequency during the process of sensitive data being sent out of the database in real time, and then transmit the acquired data to the behavior feature extraction unit of the optimized bat algorithm.

[0093] The second step is to optimize the behavior feature extraction unit of the bat algorithm. After receiving the data, the optimized bat algorithm is used to extract features from the data and the extracted behavior feature data is transmitted to the improved Markov chain state transition analysis unit.

[0094] The third step involves improving the Markov chain state transition analysis unit to receive behavioral feature data, performing state transition analysis through the improved Markov chain model, and transmitting the analysis results to the data tag encoding generation unit.

[0095] The fourth step is for the data tag encoding generation unit to generate corresponding data tag codes based on the received analysis results and various parameters of the sensitive data in the database, and then transmit the data tag codes to the traceability information storage and index construction unit.

[0096] The fifth step involves the traceability information storage and index building unit storing the data tag encoding and building an index;

[0097] The sixth step involves the tracking instruction execution and feedback unit executing tracking instructions and providing feedback on the tracking results based on the index information from the traceability information storage and index construction unit. Through data transmission and processing between each step, the marking and traceability of sensitive data leaks from the database are achieved.

[0098] This system and method achieve a breakthrough in the extraction of behavioral features related to the outflow of sensitive data. Existing technologies rely on fixed rules and simple statistics, making it difficult to identify complex behavioral patterns. This system, however, uses a data feature perception and acquisition unit to acquire multi-dimensional parameters such as data transmission traffic and field types in real time. Based on this, the optimized Bat Algorithm behavioral feature extraction unit simulates the echolocation principle of bats to perform in-depth data mining, accurately capturing complex and ever-changing behavioral patterns during data outflow. Whether it's abnormal fluctuations in data traffic or special combinations of field types, it can comprehensively and accurately extract effective features, avoiding the omission of potential risky behaviors and providing reliable data support for subsequent analysis, completely changing the situation of inaccurate feature extraction in traditional methods.

[0099] In terms of source tracing, this system also demonstrates significant advantages. Existing source tracing technologies suffer from systemic deficiencies, inaccurate coding, and low indexing efficiency, making it difficult to quickly locate the data source and trace the flow. This system improves upon existing technologies by using a Markov chain state transition analysis unit to perform in-depth analysis of behavioral feature data, determining the state transitions of data outflow behavior; a data tag coding generation unit combines analysis results with data parameters to generate accurate and unique data tag codes; and a source information storage and indexing unit constructs an efficient index structure and dynamically updates it, ensuring fast and accurate data queries. The tracking instruction execution and feedback unit interacts with network devices and security systems based on index information to achieve precise tracking of data flow and provide timely feedback. This interconnected design enables the system to quickly locate the data source and clearly trace the data flow when sensitive data outflow events occur, greatly improving the efficiency and accuracy of source tracing and effectively overcoming the shortcomings of existing technologies.

[0100] Furthermore, the various units of this system and method work collaboratively to form a complete closed loop for data security protection. From data feature collection to behavioral feature extraction, and then to state analysis, tagging and encoding, index construction, and tracking feedback, each step is closely linked and works in concert. Compared to existing technologies where each step is relatively independent and lacks effective collaboration, this system can more efficiently handle sensitive data outflow events, promptly detect risks and take countermeasures, comprehensively improve the security and reliability of sensitive data outflow management in the database, and provide strong protection for the security of sensitive data in the database.

[0101] In the description of this invention, it should be noted that, unless otherwise explicitly specified and limited, the terms "set," "install," "connect," "link," and "fix" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal communication between two components. Those skilled in the art will understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0102] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various equivalent changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A behavioral tagging and provenance tracking system for the export of database sensitive data, characterized in that, It includes a data feature perception and acquisition unit, an optimized bat algorithm behavior feature extraction unit, an improved Markov chain state transition analysis unit, a data tag encoding generation unit, a traceability information storage and index construction unit, and a tracking instruction execution and feedback unit; The data feature perception and acquisition unit is used to perceive in real time the data transmission traffic, data field type, and data transmission frequency during the process of sending sensitive data out of the database, and transmits the acquired data to the behavior feature extraction unit of the optimized bat algorithm. The optimized bat algorithm behavior feature extraction unit receives data transmitted by the data feature perception and acquisition unit, uses the optimized bat algorithm to extract features from the data, and transmits the extracted behavior feature data to the improved Markov chain state transition analysis unit. The improved Markov chain state transition analysis unit receives behavioral feature data, performs state transition analysis through the improved Markov chain model, and transmits the analysis results to the data tag encoding generation unit. The data tag encoding generation unit generates the corresponding data tag encoding based on the received analysis results, and transmits the data tag encoding to the traceability information storage and index construction unit; The traceability information storage and index construction unit stores the data tag encoding and constructs an index. The tracking instruction execution and feedback unit executes the tracking instruction and feeds back the tracking result based on the index information of the traceability information storage and index construction unit. The units achieve orderly data transmission and interaction through data transmission interfaces and communication protocols. In the behavioral feature extraction unit of the optimized bat algorithm, the optimized bat algorithm uses the following model formula for data feature extraction: wherein, represents a newly generated feature frequency, used to characterize the frequency of occurrence of the extracted sensitive data exfiltration behavior feature; is a preset minimum feature frequency threshold, set according to historical sensitive data exfiltration behavior feature frequency statistics; is a preset maximum feature frequency threshold, also set according to historical data; is a random number within the interval is a random number within the interval In the behavioral feature extraction unit of the optimized bat algorithm, the optimized bat algorithm also uses the following formula to update the feature position: in, Indicates the first Individual bats The updated feature position corresponds to the position of the sensitive data outflow behavior feature in the data space. For the first Individual bats The characteristic location of a given moment; It is the first Individual bats The speed at any given moment reflects the rate at which feature positions are updated; For the first Individual bats The speed of time; express The global optimal feature position at any given time is determined by all the sensitive data outflow behavior features that have been extracted so far; For the newly generated feature frequencies; In the improved Markov chain state transition analysis unit, the improved Markov chain model adopts the following state transition probability formula: in, Indicates in Always in a state of readiness ,exist Shifting to a new state The probability is used to analyze the likelihood of sensitive data outflow behavior transitioning from one state to another; Is From the state of mind Transition to state The weight is calculated based on the data transmission traffic and data transmission frequency parameters during the sensitive data outgoing process; The total number of states set for the system is pre-defined based on different patterns of sensitive data leakage behavior. In the improved Markov chain state transition analysis unit, the improved Markov chain model also adopts the following state update formula: wherein, denotes the state of the system at the time instant, for reflecting the overall state of the sensitive data sending behavior at the time instant; is the probability of being in the state at the time instant, derived from the historical sensitive data sending behavior state statistics.

2. The behavioral labeling and provenance tracking system for database sensitive data exportation of claim 1, wherein, The data tag encoding generation unit, based on the analysis results of the improved Markov chain state transition analysis unit and combined with various parameters of the sensitive data in the database, adopts the following encoding generation formula: wherein, represents the generated data tag code for uniquely identifying the sensitive data export behavior; is the specific content of the sensitive data collected by the data feature perception and collection unit, including data field type and data value; is the behavior feature data extracted by the behavior feature extraction unit of the optimized bat algorithm; is the state information obtained by the improved Markov chain state transition analysis unit, is a hash function that generates a data tag code with uniqueness and correspondence by hashing the sensitive data content, behavior feature data, and state information.

3. The behavioral labeling and provenance tracking system for database sensitive data exportation of claim 2, wherein, The data tag encoding generation unit also uses the following verification formula when generating data tag codes: wherein, represents a generated data tag encoding check value for verifying the accuracy of the data tag encoding; is a check function that generates a check value by operating on the data tag encoding and related data features, behavior features, and state information.

4. The database sensitive data outflow behavior marking and tracing system according to claim 1, characterized in that, When constructing the index, the traceability information storage and index construction unit uses the following index construction formula: wherein, represents the constructed traceability information index, which is used for fast positioning and querying of relevant information of sensitive data export behavior; the data tag code generated by the data tag code generation unit; is the timestamp of the occurrence of the sensitive data export behavior, which accurately records the time of the export behavior; is the location information of the occurrence of the sensitive data export behavior, including the network IP address, and Index is an index construction function that constructs a traceability information index with query performance by processing the data tag code, timestamp and location information.

5. The behavioral labeling and provenance tracking system for database sensitive data exportation of claim 4, wherein, The traceability information storage and index construction unit uses the following index update formula when updating the index: wherein, denotes the updated traceability information index; is the traceability information index before updating; is the newly generated data tag code change amount; is the new sensitive data external behavior timestamp change amount; is the new sensitive data external behavior location information change amount, and Update is an index updating function, which dynamically updates the original index according to the change of the newly generated data tag code, timestamp and location information.

6. A method for marking and tracing the behavior of database sensitive data export, characterized in that, This method, applied to the database sensitive data outflow behavior marking and tracing system of claim 1, includes the following steps: The first step is to use the data feature perception and acquisition unit to perceive in real time the data transmission traffic, data field type, and data transmission frequency during the process of sensitive data being sent out of the database, and then transmit the acquired data to the behavior feature extraction unit of the optimized bat algorithm. The second step is to optimize the behavior feature extraction unit of the bat algorithm. After receiving the data, the optimized bat algorithm is used to extract features from the data and the extracted behavior feature data is transmitted to the improved Markov chain state transition analysis unit. The third step involves improving the Markov chain state transition analysis unit to receive behavioral feature data, performing state transition analysis through the improved Markov chain model, and transmitting the analysis results to the data tag encoding generation unit. The fourth step is for the data tag encoding generation unit to generate corresponding data tag codes based on the received analysis results and various parameters of the sensitive data in the database, and then transmit the data tag codes to the traceability information storage and index construction unit. The fifth step involves the traceability information storage and index building unit storing the data tag encoding and building an index; The sixth step is for the tracking instruction execution and feedback unit to execute the tracking instructions and provide feedback on the tracking results based on the index information of the traceability information storage and index construction unit.

Images