Privacy protection and access control method and system based on unstructured metadata

Abstract

This invention provides a privacy protection and access control method and system based on unstructured metadata, relating to the field of data processing technology. The method includes acquiring time-series metadata from multiple data source nodes, calculating sensitivity features and scores, and classifying sensitivity levels; allocating differential privacy budgets for processing according to sensitivity levels; setting tiered access permissions and anonymizing visitor information; analyzing access behavior characteristics and setting differential privacy thresholds for abnormal access detection. This invention achieves refined tiered protection for time-series sensitive data, improving privacy protection efficiency while ensuring data availability.

Description

Technical Field

[0001] This invention relates to data processing technology, and more particularly to a method and system for privacy protection and access control based on unstructured metadata. Background Technology

[0002] With the advent of the big data era, the collection, storage, and analysis of massive amounts of unstructured metadata have become crucial assets for various industries. This time-series metadata often contains both sensitive and non-sensitive information, providing data value while also posing serious privacy risks. Particularly in fields such as healthcare, finance, and intelligent transportation, time-series metadata contains personal privacy information; unprotected use could lead to user privacy breaches and even legal risks.

[0003] Currently, privacy protection for unstructured time-series metadata mainly employs traditional methods such as data anonymization and encrypted storage. However, these methods have significant drawbacks. On the one hand, traditional privacy protection technologies often use a uniform standard to process all data, ignoring the differences in sensitivity among different data types. This leads to insufficient protection for highly sensitive data or excessive protection for less sensitive data, failing to achieve refined privacy protection. On the other hand, existing technologies typically separate privacy protection from access control, lacking a linkage mechanism between the two. This makes it difficult for the system to dynamically adjust access policies based on data sensitivity, increasing system management complexity and security risks. Furthermore, existing privacy protection solutions lack effective access behavior monitoring and tracing mechanisms, failing to promptly detect and prevent abnormal access behavior, making it difficult to address internal threats and privacy data misuse, thus reducing the overall level of data security.

[0004] Therefore, there is an urgent need for a technical solution that can provide refined privacy protection for unstructured time-series metadata and organically combine privacy protection with access control, so as to balance the relationship between data privacy protection and data availability, and maximize data value while ensuring data security. Summary of the Invention

[0005] This invention provides a privacy protection and access control method and system based on unstructured metadata, which can solve the problems in the prior art.

[0006] A first aspect of this invention provides a privacy protection and access control method based on unstructured metadata, comprising:

[0007] Obtain time-series metadata to be processed from multiple data source nodes, including time-sensitive data and non-sensitive data;

[0008] The sensitivity characteristics of the time-series metadata to be processed are calculated at each data source node, a sensitivity score is calculated based on the sensitivity characteristics, and the time-series sensitive data is classified into time-series sensitivity levels according to the sensitivity scores.

[0009] Differential privacy budgets are allocated to time-sensitive data of different levels according to the time-sensitivity level. Differential privacy processing is performed on the time-sensitive data using the differential privacy budgets to protect data privacy while maintaining data availability, thereby generating time-series data with differential privacy protection.

[0010] Based on the time sensitivity level, hierarchical access permissions are set for the time series data after differential privacy protection. Access requests are verified, and the access information of verified visitors is de-identified using a differential privacy algorithm corresponding to the differential privacy budget to generate de-identified access records.

[0011] Based on the anonymized access records, the access behavior characteristics are analyzed, and different differential privacy thresholds are set in conjunction with the time-series sensitivity level. When the access behavior characteristics exceed the corresponding differential privacy threshold, it is determined to be abnormal access behavior, and an access tracing report is generated.

[0012] The sensitivity characteristics of the time-series metadata to be processed are calculated at each data source node. A sensitivity score is calculated based on the sensitivity characteristics. The time-series sensitive data is then classified into time-series sensitivity levels according to the sensitivity scores, including:

[0013] The sensitivity characteristics of the time-series metadata to be processed are calculated at each data source node. The sensitivity characteristics include time-series fluctuation characteristics and data association characteristics.

[0014] A sensitivity assessment adversarial network is constructed, comprising a generator and a discriminator. The generator performs adaptive sampling based on the distribution characteristics of the temporal fluctuation features and the data association features to generate multi-scale perturbation samples. The discriminator uses a dynamically weighted attention mechanism to evaluate the sensitivity stability of the multi-scale perturbation samples under different perturbation levels, and feeds the evaluation results back to the generator to guide the generation process of perturbation samples.

[0015] An adversarial loss function is constructed based on the multi-scale perturbation samples output by the generator and the sensitivity stability evaluation results of the discriminator. The sampling strategy of the generator and the evaluation weight of the discriminator are updated by iteratively optimizing the adversarial loss function, so that the sensitivity evaluation adversarial network has the ability to defend against adversarial attacks.

[0016] The optimized sensitivity assessment adversarial network is used to robustly evaluate the sensitivity features to obtain sensitivity assessment results. Based on the sensitivity assessment results, a sensitivity score is calculated, and the time-series metadata to be processed is classified into time-series sensitivity levels according to the sensitivity score.

[0017] The generator adaptively samples multi-scale perturbation samples based on the distribution characteristics of the temporal fluctuation features and the data association features. The discriminator then uses a dynamically weighted attention mechanism to evaluate the sensitivity stability of the multi-scale perturbation samples under different perturbation levels, including:

[0018] A conditional variational autoencoder is constructed based on the time series fluctuation characteristics and the data association characteristics. The conditional variational autoencoder includes a posterior distribution network and a prior distribution network. The mean parameter and variance parameter are generated based on the posterior distribution network and the prior distribution network, respectively.

[0019] The mean parameter and the variance parameter are input into the generator. Based on the generator, a multi-scale perturbation vector is generated through reparameterization technology. Based on the reparameterization technology, the mean parameter and the variance parameter are mapped to the latent space. The perturbation sample is determined by the multi-scale perturbation vector and the random sampling vector of the standard normal distribution.

[0020] A hierarchical attention network for the discriminator is constructed. The perturbation sample is input into the hierarchical attention network. The hierarchical attention network is used to perform multi-level feature transformation on the perturbation sample to generate multi-level feature representation. Attention weights are calculated based on the multi-level feature representation. A feature reconstruction vector is determined jointly by the attention weights and the multi-level feature representation. The sensitivity stability of the perturbation sample under different perturbation levels is evaluated based on the feature reconstruction vector.

[0021] Differential privacy budgets are allocated to time-sensitive data of different levels based on the time-sensitivity level. Differential privacy processing is then performed on the time-sensitive data using the differential privacy budgets to protect data privacy while maintaining data availability. The resulting differentially privacy-protected time-series data includes:

[0022] The initial allocation coefficients of the differential privacy budget are calculated based on the time sensitivity level. The initial allocation coefficients are then input into the dynamic budget allocation function, which calculates the differential privacy budget for each time-sensitive data based on the initial allocation coefficients and the total privacy budget.

[0023] The scale parameter of Laplace noise is determined based on the differential privacy budget. Laplace noise is generated based on the scale parameter. The Laplace noise is added to the time-sensitive data to generate noisy time-series data. The data availability index between the noisy time-series data and the original time-sensitive data is calculated. The adjustment direction and adjustment magnitude of the budget allocation are calculated based on the data availability index and the privacy protection level.

[0024] The initial allocation coefficients are updated according to the adjustment direction and the adjustment magnitude. The updated allocation coefficients are then re-input into the dynamic budget allocation function to generate a new differential privacy budget. The noise addition and data availability calculation processes are repeated using the new differential privacy budget until the data availability index reaches a preset threshold. Finally, the time-series data after differential privacy protection is output.

[0025] Based on the time-series sensitivity level, hierarchical access permissions are set for the differentially privacy-protected time-series data. Access requests are verified, and the access information of verified visitors is anonymized using a differential privacy algorithm corresponding to the differential privacy budget. The resulting anonymized access records include:

[0026] Based on the time-sensitivity level, a corresponding hierarchical access permission threshold is set, which is used to limit the minimum permission requirements for the visitor; the visitor's identity information, access time, and access operation type are extracted from the access request, and the visitor's identity information is compared with the hierarchical access permission threshold;

[0027] When the visitor's identity information meets the hierarchical access permission threshold, the visitor trust coefficient is calculated based on the access level of the visitor's identity information, the historical access behavior corresponding to the access time, and the access frequency of the access operation type.

[0028] Based on the visitor trust coefficient, a differential privacy algorithm matching the differential privacy budget is selected. The differential privacy algorithm is then used to desensitize sensitive fields in the visitor identity information, generating desensitized visitor information.

[0029] The access record is composed of the anonymized visitor information, the access time, the time-series sensitivity level, the differential privacy budget, and the access operation type; noise of a corresponding intensity to the differential privacy budget is added to the sensitive fields in the access record to generate the anonymized access record.

[0030] Based on the visitor trust coefficient, a differential privacy algorithm matching the differential privacy budget is selected. This differential privacy algorithm is then used to de-identify sensitive fields in the visitor's identity information, generating de-identified visitor information including:

[0031] A differential privacy algorithm pool is constructed, which contains multiple differential privacy algorithms, and the sensitive fields in the visitor's identity information are divided into identity identifier fields, location information fields, behavioral feature fields and attribute information fields;

[0032] Calculate the algorithm matching degree of each differential privacy algorithm for different types of sensitive fields, and allocate the differential privacy budget according to the sensitive field type based on the visitor trust coefficient to obtain a local budget;

[0033] Based on the algorithm matching degree and the local budget, the optimal differential privacy algorithm is selected from the differential privacy algorithm pool. The sensitive fields in the visitor identity information are grouped according to type to obtain a sensitive field sequence. The sensitive field sequence is then input into the optimal differential privacy algorithm.

[0034] Differential privacy processing is performed on the sensitive field sequence based on the local budget to generate initial de-identified data. The data utility evaluation score of the initial de-identified data is calculated. The algorithm parameters of the optimal differential privacy algorithm are adjusted according to the data utility evaluation score. The sensitive field sequence is reprocessed using the adjusted optimal differential privacy algorithm to generate de-identified visitor information.

[0035] Based on the anonymized access records, access behavior characteristics are analyzed. Different differential privacy thresholds are set in conjunction with the time-series sensitivity level. When the access behavior characteristics exceed the corresponding differential privacy threshold, it is determined to be abnormal access behavior, and an access tracing report is generated, including:

[0036] The access time distribution, access frequency, access duration, and access resource type are extracted from the anonymized access records. The access time distribution, access frequency, access duration, and access resource type are combined to generate access behavior features.

[0037] Based on the access behavior characteristics, access behavior patterns are analyzed, and a baseline threshold is determined according to the access behavior patterns and the time sensitivity level. The baseline threshold is multiplied by the adjustment coefficient of the time sensitivity level to obtain the differential privacy threshold.

[0038] The access behavior features are input into the feature analysis module, and feature weight coefficients for the access time distribution, access frequency, access duration, and access resource type are calculated based on the feature analysis module. The differential privacy threshold is multiplied by the feature weight coefficients to obtain the differential privacy threshold corresponding to each access behavior feature.

[0039] Calculate the deviation values ​​of the access time distribution, access frequency, access duration, and access resource type from the preset normal resource access mode; compare the deviation values ​​with their corresponding differential privacy thresholds respectively; when any deviation value exceeds the corresponding differential privacy threshold, the current access behavior is determined to be abnormal access behavior.

[0040] Record the detection time of the abnormal access behavior, and combine the detection time, the access behavior characteristics, the deviation value, and the differential privacy threshold to form an access tracing report.

[0041] A second aspect of the present invention provides a privacy protection and access control system based on unstructured metadata, comprising:

[0042] The first unit is used to acquire time-series metadata to be processed from multiple data source nodes, including time-sensitive data and non-sensitive data.

[0043] The second unit is used to calculate the sensitivity characteristics of the time-series metadata to be processed at each of the data source nodes, calculate the sensitivity score based on the sensitivity characteristics, and classify the time-series sensitive data into time-series sensitivity levels according to the sensitivity score;

[0044] The third unit is used to allocate differential privacy budgets to time-sensitive data of different levels according to the time-sensitivity level, and to perform differential privacy processing on the time-sensitive data using the differential privacy budgets, so as to maintain data availability while protecting data privacy and generate time-series data with differential privacy protection.

[0045] The fourth unit is used to set hierarchical access permissions for the differentially privacy-protected time-series data according to the time-series sensitivity level, verify the access requests, and use a differential privacy algorithm corresponding to the differential privacy budget to de-identify the verified visitor information and generate de-identified access records.

[0046] The fifth unit is used to analyze access behavior characteristics based on the anonymized access records, and set different differential privacy thresholds in combination with the time sensitivity level. When the access behavior characteristics exceed the corresponding differential privacy threshold, they are determined to be abnormal access behavior, and an access tracing report is generated.

[0047] A third aspect of the present invention provides an electronic device, comprising:

[0048] processor;

[0049] Memory used to store processor-executable instructions;

[0050] The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0051] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0052] The beneficial effects of this application are as follows:

[0053] The method of this invention achieves a precise match between the strength of privacy protection and the sensitivity of data by assigning differentiated privacy protection strategies to time-series data with different sensitivity levels. While ensuring sufficient protection for highly sensitive data, it avoids over-protection of low-sensitivity data and improves the overall usability of data.

[0054] The method of this invention establishes a hierarchical access control mechanism based on sensitivity levels, and combines differential privacy technology to de-identify visitor information, which not only ensures the security of data access, but also ensures the traceability of access behavior, effectively balancing the relationship between data openness and sharing and privacy protection.

[0055] The method of this invention can detect abnormal access patterns for data of different sensitivities in a timely manner by dynamically monitoring access behavior and setting differentiated privacy thresholds, forming a complete access tracing chain, which significantly improves the privacy and security protection capabilities and abnormal behavior identification capabilities of unstructured time-series metadata in a multi-source environment. Attached Figure Description

[0056] Figure 1 This is a flowchart illustrating the privacy protection and access control method based on unstructured metadata according to an embodiment of the present invention.

[0057] Figure 2 This is a flowchart of the differential privacy budget allocation and processing method based on time sensitivity level according to an embodiment of the present invention;

[0058] Figure 3 This is a flowchart of a hierarchical access control and differential privacy processing method based on time sensitivity levels according to an embodiment of the present invention;

[0059] Figure 4 This is a bar chart illustrating the abnormal access behavior characteristics based on the time-sensitivity level in an embodiment of the present invention. Detailed Implementation

[0060] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0061] The technical solution of the present invention will be described in detail below with reference to specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0062] Figure 1 This is a flowchart illustrating the privacy protection and access control method based on unstructured metadata according to an embodiment of the present invention. Figure 1 As shown, the method includes:

[0063] Obtain time-series metadata to be processed from multiple data source nodes, including time-sensitive data and non-sensitive data;

[0064] The sensitivity characteristics of the time-series metadata to be processed are calculated at each data source node, a sensitivity score is calculated based on the sensitivity characteristics, and the time-series sensitive data is classified into time-series sensitivity levels according to the sensitivity scores.

[0065] Differential privacy budgets are allocated to time-sensitive data of different levels according to the time-sensitivity level. Differential privacy processing is performed on the time-sensitive data using the differential privacy budgets to protect data privacy while maintaining data availability, thereby generating time-series data with differential privacy protection.

[0066] Based on the time sensitivity level, hierarchical access permissions are set for the time series data after differential privacy protection. Access requests are verified, and the access information of verified visitors is de-identified using a differential privacy algorithm corresponding to the differential privacy budget to generate de-identified access records.

[0067] Based on the anonymized access records, the access behavior characteristics are analyzed, and different differential privacy thresholds are set in conjunction with the time-series sensitivity level. When the access behavior characteristics exceed the corresponding differential privacy threshold, it is determined to be abnormal access behavior, and an access tracing report is generated.

[0068] In one optional implementation, the sensitivity characteristics of the time-series metadata to be processed are calculated at each of the data source nodes, a sensitivity score is calculated based on the sensitivity characteristics, and the time-series sensitive data is classified into time-series sensitivity levels according to the sensitivity scores, including:

[0069] The sensitivity characteristics of the time-series metadata to be processed are calculated at each data source node. The sensitivity characteristics include time-series fluctuation characteristics and data association characteristics.

[0070] A sensitivity assessment adversarial network is constructed, comprising a generator and a discriminator. The generator performs adaptive sampling based on the distribution characteristics of the temporal fluctuation features and the data association features to generate multi-scale perturbation samples. The discriminator uses a dynamically weighted attention mechanism to evaluate the sensitivity stability of the multi-scale perturbation samples under different perturbation levels, and feeds the evaluation results back to the generator to guide the generation process of perturbation samples.

[0071] An adversarial loss function is constructed based on the multi-scale perturbation samples output by the generator and the sensitivity stability evaluation results of the discriminator. The sampling strategy of the generator and the evaluation weight of the discriminator are updated by iteratively optimizing the adversarial loss function, so that the sensitivity evaluation adversarial network has the ability to defend against adversarial attacks.

[0072] The optimized sensitivity assessment adversarial network is used to robustly evaluate the sensitivity features to obtain sensitivity assessment results. Based on the sensitivity assessment results, a sensitivity score is calculated, and the time-series metadata to be processed is classified into time-series sensitivity levels according to the sensitivity score.

[0073] Sensitivity features of the time-series metadata to be processed are calculated at each data source node. Sensitivity features include time-series volatility features and data correlation features. Time-series volatility features can be extracted using the sliding window method. Statistical indicators such as volatility, kurtosis and skewness are calculated for each time window.

[0074] For example, for electricity consumption data, a 24-hour sliding window can be set, and the ratio of the standard deviation to the mean of the data within the window can be calculated as volatility. Simultaneously, the peak value and asymmetry of the data distribution can be analyzed. Data correlation characteristics are obtained by calculating the correlation matrix between time-series data and other relevant data sources, including the Pearson correlation coefficient and mutual information value, reflecting the strength of linear and nonlinear relationships between the data.

[0075] The core of this method is the construction of a sensitivity assessment adversarial network, which consists of two main components: a generator and a discriminator. The generator employs a deep neural network architecture, containing multiple fully connected layers and residual connections. Its inputs are time-series fluctuation features and data correlation features, and its output is multi-scale perturbation samples. In practical applications, the generator adaptively adjusts its sampling strategy based on different feature distribution characteristics, increasing sampling density in high-fluctuation regions and decreasing sampling frequency in stable regions. For example, for financial transaction data, the generator will generate more diverse perturbation samples for data during peak trading periods, including small perturbations (±2% of the original value), medium perturbations (±5%), and large perturbations (±10%), forming a multi-scale perturbation sample set.

[0076] The discriminator also employs a deep neural network structure, but introduces a dynamically weighted attention mechanism. This mechanism assigns different weights to perturbation samples at different scales through a soft attention layer. The discriminator evaluates the sensitivity stability of each perturbation sample under different perturbation levels. Stability indicators include the difference in data distribution before and after perturbation and the magnitude of changes in key statistical features. In health monitoring data scenarios, the discriminator focuses on the impact of fluctuations in physiological indicators on the risk of sensitive information leakage, giving higher weight to the risk of activity pattern recognition caused by minor perturbations in heart rate data. The discriminator's evaluation results are fed back to the generator through a backpropagation mechanism, guiding the adjustment of sampling strategies in subsequent perturbation sample generation processes.

[0077] Based on the interaction between the generator and discriminator, an adversarial loss function is constructed for network optimization. The adversarial loss function consists of three parts: generator loss, discriminator loss, and stability loss. The generator loss encourages the generation of more challenging perturbation samples; the discriminator loss prompts the discriminator to accurately identify changes in sensitivity; and the stability loss ensures that the model maintains consistent evaluation under different levels of perturbation.

[0078] In the actual optimization process, an alternating training strategy was adopted. In each round, the generator parameters were fixed first and then the discriminator parameters were updated, and then the discriminator parameters were fixed and the generator parameters were updated. The number of iterations was set to 100 rounds. After optimization, the sensitivity evaluation adversarial network can identify subtle changes in data patterns and maintain its defensive capabilities against adversarial attacks.

[0079] For smart home energy consumption data, the optimized sensitivity assessment adversarial network can identify that even with the addition of 5% random noise, the risk of leakage of user lifestyle information still exists. A comprehensive sensitivity score is calculated by comparing the sensitivity assessment results of the original data and data with different levels of perturbation. The sensitivity score is calculated using a weighted average method, with a weight of 0.6 for time-series fluctuation features and a weight of 0.4 for data association features. The score ranges from 0 to 100, with higher values ​​indicating higher sensitivity.

[0080] Based on sensitivity scores, the time-series metadata to be processed is divided into four sensitivity levels: low sensitivity (0-25 points), medium sensitivity (26-50 points), high sensitivity (51-75 points), and extremely high sensitivity (76-100 points). In the industrial production monitoring data example, the equipment operating status data scored 35 points, belonging to the medium sensitivity level; while the production formula parameter data scored 82 points, and was classified as extremely high sensitivity. Different strategies are adopted for the subsequent storage, transmission, and access control of data of different sensitivity levels. High-sensitivity data adopts stricter encryption and access restriction measures to ensure data security while taking into account system efficiency.

[0081] Practical applications of this method demonstrate that the sensitivity assessment adversarial network can accurately identify sensitive patterns in time-series data, maintaining assessment accuracy even under intentional interference. Compared to traditional rule-based sensitivity assessment methods, this method exhibits better adaptability and robustness in dynamically changing data environments, improving sensitivity classification accuracy by approximately 15%, with a particularly significant advantage in multi-source heterogeneous time-series data scenarios.

[0082] In one optional implementation, the generator adaptively samples based on the distribution characteristics of the temporal fluctuation features and the data association features to generate multi-scale perturbation samples, and the discriminator uses a dynamically weighted attention mechanism to evaluate the sensitivity stability of the multi-scale perturbation samples under different perturbation levels, including:

[0083] A conditional variational autoencoder is constructed based on the time series fluctuation characteristics and the data association characteristics. The conditional variational autoencoder includes a posterior distribution network and a prior distribution network. The mean parameter and variance parameter are generated based on the posterior distribution network and the prior distribution network, respectively.

[0084] The mean parameter and the variance parameter are input into the generator. Based on the generator, a multi-scale perturbation vector is generated through reparameterization technology. Based on the reparameterization technology, the mean parameter and the variance parameter are mapped to the latent space. The perturbation sample is determined by the multi-scale perturbation vector and the random sampling vector of the standard normal distribution.

[0085] A hierarchical attention network for the discriminator is constructed. The perturbation sample is input into the hierarchical attention network. The hierarchical attention network is used to perform multi-level feature transformation on the perturbation sample to generate multi-level feature representation. Attention weights are calculated based on the multi-level feature representation. A feature reconstruction vector is determined jointly by the attention weights and the multi-level feature representation. The sensitivity stability of the perturbation sample under different perturbation levels is evaluated based on the feature reconstruction vector.

[0086] When constructing a conditional variational autoencoder, it is necessary to fully utilize temporal fluctuation features and data association features. Temporal fluctuation features include four aspects: amplitude variation, periodicity, trend, and abrupt change, which are extracted using the sliding window method. For the temporal data of a certain temperature sensor [23.5,24.1,24.3,23.8,23.2,22.9,23.4,23.7], an amplitude variation feature [0.9,1.4,1.1,0.9,0.8] is extracted using a sliding window of length 5, and the periodicity feature is calculated using the autocorrelation function [0.85,0.62,0.31,-0.12]. Data association features include spatiotemporal correlation, attribute correlation, and semantic correlation, which are represented by a correlation matrix. For example, the attribute correlation between temperature and humidity is -0.75, indicating a strong negative correlation.

[0087] The Conditional Variational Autoencoder (CVA) consists of a posterior distribution network and a prior distribution network. The posterior distribution network employs a three-layer neural network structure. The number of nodes in the input layer is the sum of the original data dimension and the conditional feature dimension. For example, for 10-dimensional original data and 5-dimensional conditional features, the input layer has 15 nodes. The hidden layer has 128 nodes, using the ReLU activation function. The output layer is divided into two parts, outputting the mean and variance parameters respectively. The number of nodes in each part is equal to the latent space dimension. For example, if the latent space dimension is set to 32, the output layer has 64 nodes. The prior distribution network takes only the conditional features as input. Its structure is similar to the posterior distribution network, but the number of nodes in the input layer is only equal to the conditional feature dimension.

[0088] In the specific implementation, for temperature time-series data, the extracted time-series fluctuation feature dimension is 12, the data association feature dimension is 8, the original data dimension is 24, the input dimension of the posterior distribution network is 44, and the input dimension of the prior distribution network is 20. Through forward propagation calculation, the posterior distribution network outputs the mean parameter μ. posterior =[0.12,-0.35,0.42...-0.18] and variance parameter σ 2 posterior =[0.08,0.12,0.05...0.09], the mean parameter μ of the prior distribution network output. prior =[0.08,-0.22,0.31...-0.15] and variance parameter σ 2 prior =[0.10,0.15,0.08...0.11].

[0089] The mean and variance parameters are input into the generator, and a reparameterization technique is used to generate multi-scale perturbation vectors. This reparameterization technique maps the mean and variance parameters to the latent space through a linear transformation. Specifically, a random sampling vector ε from a standard normal distribution is taken, and z = μ + σ × ε is calculated, where μ is the mean parameter and σ is the square root of the variance parameter. For different perturbation scales, a perturbation factor α is set, and different levels of perturbation are generated by adjusting the value of α, and z is calculated. disturbed =μ+α×σ×ε.

[0090] In practical applications, the perturbation factor α is set to [0.5, 1.0, 1.5, 2.0], representing slight, moderate, strong, and severe perturbations, respectively. For a random sampling vector ε = [-0.62, 0.84, -0.15...0.37] from a standard normal distribution, the generated multi-scale perturbation vectors are z... 0.5 =[0.08,-0.30,0.40...-0.12],z 1.0 =[0.05,-0.26,0.38...-0.07],z 1.5 =[0.01,-0.22,0.36...-0.01] and z 2.0 =[-0.03,-0.17,0.34...0.04].

[0091] The generation of perturbation samples is based on multi-scale perturbation vectors and a decoder network. The decoder network adopts a three-layer neural network structure. The number of nodes in the input layer is the sum of the latent space dimension and the conditional feature dimension. For example, if the latent space dimension is 32 and the conditional feature dimension is 20, then the number of nodes in the input layer is 52. The number of nodes in the hidden layer is 128, using the ReLU activation function. The number of nodes in the output layer is the original data dimension. For perturbation vectors with four different perturbation scales, four sets of perturbation samples are generated by the decoder network.

[0092] For example, for temperature time series data, the original data is [23.5,24.1,24.3,23.8,23.2,22.9,23.4,23.7], and the four sets of perturbation samples generated are [23.6,24.0,24.2,23.7,23.3,23.0,23.3,23.6], [23.8,23.9,24.0,23.6,23.4,23.1,23.2,23.5], [24.0,23.7,23.8,23.4,23.6,23.3,23.0,23.3] and [24.3,23.5,23.5,23.2,23.8,23.5,22.8,23.0].

[0093] When constructing the hierarchical attention network for the discriminator, a multi-layer convolutional structure is used to extract features at different scales. The hierarchical attention network contains three convolutional layers, with kernel sizes of 3, 5, and 7, respectively, to extract local, medium-range, and global features. Each convolutional layer is followed by a max-pooling layer and a batch normalization layer. For example, for a temperature time series data of length 24, feature maps F1, F2, and F3 are obtained after passing through three convolutional layers, with dimensions of [16,8], [16,4], and [16,2], respectively, where 16 represents the number of convolutional kernels.

[0094] When calculating attention weights based on multi-layer feature representations, a self-attention mechanism is introduced. An attention score si is calculated for each feature representation Fi. This is achieved by performing a dot product operation between the feature vector and the learnable attention vector a, followed by normalization using the softmax function to obtain the attention weight wi. For example, for a three-layer feature representation, the calculated attention weights are w1=0.45, w2=0.35, and w3=0.20, indicating that local features have the highest importance, while global features have the lowest importance.

[0095] The feature reconstruction vector is obtained by weighted fusion of multiple feature representations. The calculation method is to multiply each feature representation by its corresponding attention weight and then sum them, i.e., R = w1×F1 + w2×F2 + w3×F3. For four groups of samples with different degrees of perturbation, their feature reconstruction vectors R1, R2, R3 and R4 are calculated respectively.

[0096] When evaluating the sensitivity stability of perturbed samples, the similarity between the reconstructed feature vector and the original data feature vector is calculated. The similarity is calculated using cosine similarity, with a value range of [-1, 1]. The closer the similarity is to 1, the higher the similarity. For the four groups of perturbed samples, the calculated similarities are sim1=0.95, sim2=0.87, sim3=0.73 and sim4=0.58, respectively.

[0097] The sensitivity stability score is calculated based on the similarity change rate, which represents the proportion of change in similarity between adjacent perturbation scales. The calculation method is (simi - simi + 1) / simi. In this example, the three similarity change rates are rate1 = (0.95 - 0.87) / 0.95 = 0.084, rate2 = (0.87 - 0.73) / 0.87 = 0.161, and rate3 = (0.73 - 0.58) / 0.73 = 0.205. The sensitivity stability score is the average of the similarity change rates, i.e., stability = (0.084 + 0.161 + 0.205) / 3 = 0.15. A lower score indicates greater data stability under different perturbation levels.

[0098] The above methods enable the generation of multi-scale perturbation samples and sensitivity stability assessment based on generators and discriminators, providing an effective technical solution for privacy protection and stability analysis of time-series sensitive data.

[0099] In one optional implementation, differential privacy budgets are allocated to time-sensitive data of different levels according to the time-sensitivity level. Differential privacy processing is then performed on the time-sensitive data using the differential privacy budgets to maintain data availability while protecting data privacy, generating differentially privacy-protected time-series data including:

[0100] The initial allocation coefficients of the differential privacy budget are calculated based on the time sensitivity level. The initial allocation coefficients are then input into the dynamic budget allocation function, which calculates the differential privacy budget for each time-sensitive data based on the initial allocation coefficients and the total privacy budget.

[0101] The scale parameter of Laplace noise is determined based on the differential privacy budget. Laplace noise is generated based on the scale parameter. The Laplace noise is added to the time-sensitive data to generate noisy time-series data. The data availability index between the noisy time-series data and the original time-sensitive data is calculated. The adjustment direction and adjustment magnitude of the budget allocation are calculated based on the data availability index and the privacy protection level.

[0102] The initial allocation coefficients are updated according to the adjustment direction and the adjustment magnitude. The updated allocation coefficients are then re-input into the dynamic budget allocation function to generate a new differential privacy budget. The noise addition and data availability calculation processes are repeated using the new differential privacy budget until the data availability index reaches a preset threshold. Finally, the time-series data after differential privacy protection is output.

[0103] like Figure 2 As shown, the method includes:

[0104] The sensitivity level classification of time-sensitive data adopts a multi-dimensional feature assessment method, which considers four dimensions: data disclosure risk, data value, timeliness, and related impact. Each dimension is scored from 0 to 10. The disclosure risk assessment considers the degree of privacy damage caused by data leakage; the data value assessment considers the commercial and application value of the data; the timeliness assessment considers the time sensitivity of the data; and the related impact assessment considers the sensitivity-enhancing effect of combining the data with other data.

[0105] For a certain time series dataset, the scores for the four dimensions are 9, 7, 8, and 6, respectively. The weighted average yields a total score of 8, corresponding to an extremely high sensitivity level. Based on the total score, the sensitivity is divided into four levels: extremely high sensitivity (8-10 points), high sensitivity (6-8 points), moderate sensitivity (4-6 points), and low sensitivity (0-4 points).

[0106] The initial allocation coefficients were determined using a sensitivity-to-budget correspondence method. Extremely sensitive data, due to the strongest privacy protection requirements, received the largest coefficient, set at 0.4; highly sensitive data received the next highest coefficient, set at 0.3; moderately sensitive and low-sensitive data received coefficients of 0.2 and 0.1, respectively. These coefficients represent the proportion of each sensitivity level in the total budget. The initial coefficient settings also need to consider the data size and distribution, and be fine-tuned using a weighting adjustment formula.

[0107] For example, if highly sensitive data accounts for 50% in a certain application scenario, the weight is adjusted to 0.4 × 1.1 = 0.44; if low-sensitivity data accounts for only 5%, the weight is adjusted to 0.1 × 0.9 = 0.09. The adjusted initial allocation coefficients are [0.44, 0.27, 0.2, 0.09], ensuring that the sum is still 1.

[0108] The dynamic budget allocation function employs a hierarchical incremental allocation method. This function takes the initial allocation coefficients and the total privacy budget as inputs and calculates the differential privacy budget for each sensitivity level. For initial allocation coefficients of [0.44, 0.27, 0.2, 0.09], and a total budget of ε = 5.0, the differential privacy budget for extremely sensitive data is 5.0 × 0.44 = 2.2; for highly sensitive data, it is 5.0 × 0.27 = 1.35; for moderately sensitive data, it is 5.0 × 0.2 = 1.0; and for low-sensitivity data, it is 5.0 × 0.09 = 0.45.

[0109] After budget allocation, the budget for each data item needs to be further refined, allocating the budget for each sensitivity level to the data items within that level. For example, the extremely high sensitivity level contains 10 data items, each receiving a budget of 2.2 / 10=0.22; the low sensitivity level contains 5 data items, each receiving a budget of 0.45 / 5=0.09.

[0110] Laplace noise generation employs the inverse function transformation method. This method first generates uniformly distributed random numbers, and then obtains Laplace distributed random numbers through an inverse function transformation. Specific steps are as follows: Generate a uniformly distributed random number u in the interval (0,1); calculate v = u - 0.5; determine the sign of v s = sign(v); calculate the noise value noise = -s × b × ln(1 - 2 × |v|), where b is the scale parameter. For example, for a scale parameter b = 5.0, generating a random number u = 0.2, calculating v = 0.2 - 0.5 = -0.3, determining s = -1, the noise value is -(-1) × 5.0 × ln(1 - 2 × |-0.3|) = 5.0 × ln(1 - 0.6) = 5.0 × ln(0.4) = -4.6. Multiple noise values ​​[-4.6, 2.3, -7.9, 3.5] are generated using this method and added to the time-series data.

[0111] The scaling parameter is calculated using the sensitivity ratio method, where the scaling parameter b equals the global sensitivity ΔF divided by the differential privacy budget ε. Global sensitivity represents the maximum difference between any two adjacent datasets, and for time-series data, it can be determined through historical variation magnitude or value range analysis.

[0112] For example, if the global sensitivity of heart rate time-series data is 15 beats / minute and the differential privacy budget is 2.2, then the scaling parameter b = 15 / 2.2 = 6.82. If the global sensitivity of temperature time-series data is 5 degrees and the differential privacy budget is 1.35, then the scaling parameter b = 5 / 1.35 = 3.70. For time-series data with different characteristics, their global sensitivity and scaling parameters need to be calculated separately.

[0113] The noise addition process employs a direct superposition method, directly adding the generated Laplace noise to the original time-sensitive data to obtain noisy time-series data. For example, the original heart rate time-series data is [75,78,82,80,76], and after adding noise with a scale parameter of 6.82 [-4.6,2.3,-7.9,3.5,1.2], the resulting data is noisy [70.4,80.3,74.1,83.5,77.2]. The original temperature time-series data is [36.5,36.8,37.2,37.0,36.7], and after adding noise with a scale parameter of 3.70 [-2.5,1.3,-4.2,1.8,0.6], the resulting data is noisy [34.0,38.1,33.0,38.8,37.3].

[0114] Data availability metrics are calculated using a multi-metric comprehensive evaluation method. This method combines three metrics: mean squared error (MSE), signal-to-noise ratio (SNR), and time correlation preservation (TCP) to comprehensively evaluate data availability. The MSE calculation formula is the sum of the squares of the differences between the original data and the noisy data, divided by the data volume. For heart rate data, MSE = (75-70.4) 2+(78-80.3) 2 +(82-74.1) 2 +(80-83.5) 2 +(76-77.2) 2 ) / 5=23.41. SNR is calculated as the ratio of the original data variance to the noise variance, SNR=6.7 / 16.89=0.40. TCP is calculated by the similarity of the autocorrelation function between the original time series data and the noise data, TCP=0.65. The weighted average of each indicator is used to obtain the comprehensive availability score. For heart rate data, it is 0.4×(1-23.41 / 100)+0.3×0.40+0.3×0.65=0.4×0.7659+0.3×0.40+0.3×0.65=0.306+0.12+0.195=0.621.

[0115] The direction and magnitude of budget allocation adjustments are calculated using a goal-oriented feedback method. This method dynamically adjusts the allocation coefficients based on the gap between the current availability score and the target threshold. If the availability score is lower than the target threshold, budget allocation for highly sensitive data is reduced, while budget allocation for less sensitive data is increased, and vice versa. The adjustment magnitude is proportional to the gap.

[0116] For example, if the heart rate data availability score is 0.621, the target threshold is 0.7, the difference is 0.079, and the adjustment factor is 0.079 / 0.7 = 0.113. Applying this to the initial allocation factor [0.44, 0.27, 0.2, 0.09], the adjusted factor is [0.44×(1-0.113), 0.27×(1-0.056), 0.2×(1+0.056), 0.09×(1+0.113)] = [0.39, 0.255, 0.211, 0.1]. The adjustment magnitude decreases for different sensitivity levels to ensure the adjusted sum remains 1.

[0117] After budget reallocation, using the updated allocation coefficients [0.39, 0.255, 0.211, 0.1] and a total budget ε = 5.0, the budgets for each level were recalculated as [1.95, 1.275, 1.055, 0.5]. The scaling parameter for heart rate data changed from 15 / 2.2 = 6.82 to 15 / 1.95 = 7.69, resulting in increased noise; the scaling parameter for temperature data changed from 5 / 1.35 = 3.70 to 5 / 1.275 = 3.92, resulting in a slight increase in noise. New Laplace noise was generated for the heart rate data [-5.2, 2.6, -8.9, 4.0, 1.4]. After adding it to the original data, the result was [69.8, 80.6, 73.1, 84.0, 77.4]. The new MSE was 28.02, the SNR decreased to 0.34, the TCP decreased to 0.62, and the overall availability score decreased to 0.584.

[0118] As the usability score decreased, moving further away from the target threshold, the adjustment direction needed to be reversed. The second adjustment allocation coefficients were [0.44×(1+0.05),0.27×(1+0.025),0.2×(1-0.025),0.09×(1-0.05)]=[0.462,0.277,0.195,0.0855]. The budgets for each level were recalculated as [2.31,1.385,0.975,0.4275]. The scaling parameter for the heart rate data became 15 / 2.31=6.49, reducing noise. New Laplace noise was generated and added to the original data, resulting in a comprehensive usability score of 0.673, close to the target threshold of 0.7.

[0119] The iteration optimization continued, and the allocation coefficients were adjusted for the third time to [0.462×(1+0.02),0.277×(1+0.01),0.195×(1-0.01),0.0855×(1-0.02)]=[0.471,0.28,0.193,0.0838]. The budget and scale parameters for each level were recalculated, noise-processed data was generated, and the overall usability score was calculated to be 0.705, exceeding the target threshold of 0.7, at which point the iteration terminated.

[0120] The final differentially private time-series data is output, which protects both privacy and availability. For heart rate data, the final differentially private data output is [71.3,79.8,75.6,82.1,76.5], and for temperature data, the final differentially private data output is [35.2,37.5,34.8,37.9,36.9].

[0121] The above method enables dynamic allocation of differential privacy budgets based on time-series sensitivity levels, effectively solving the problems of inflexible budget allocation and difficulty in balancing data availability and privacy protection in traditional differential privacy methods, and providing a practical technical solution for privacy protection of time-series sensitive data.

[0122] In one optional implementation, hierarchical access permissions are set for the differentially privacy-protected time-series data according to the time-series sensitivity level, access requests are verified, and the information of verified visitors is de-identified using a differential privacy algorithm corresponding to the differential privacy budget, generating de-identified access records including:

[0123] Based on the time-sensitivity level, a corresponding hierarchical access permission threshold is set, which is used to limit the minimum permission requirements for the visitor; the visitor's identity information, access time, and access operation type are extracted from the access request, and the visitor's identity information is compared with the hierarchical access permission threshold;

[0124] When the visitor's identity information meets the hierarchical access permission threshold, the visitor trust coefficient is calculated based on the access level of the visitor's identity information, the historical access behavior corresponding to the access time, and the access frequency of the access operation type.

[0125] Based on the visitor trust coefficient, a differential privacy algorithm matching the differential privacy budget is selected. The differential privacy algorithm is then used to desensitize sensitive fields in the visitor identity information, generating desensitized visitor information.

[0126] The access record is composed of the anonymized visitor information, the access time, the time-series sensitivity level, the differential privacy budget, and the access operation type; noise of a corresponding intensity to the differential privacy budget is added to the sensitive fields in the access record to generate the anonymized access record.

[0127] like Figure 3 As shown, the method includes:

[0128] Based on the time-series sensitivity level, corresponding hierarchical access permission thresholds are set. For example, the system can divide time-series sensitivity into three levels: high, medium, and low, corresponding to permission threshold values ​​of 9, 6, and 3, respectively. These thresholds are used to limit the minimum permission requirements for visitors, ensuring that only users with sufficient permissions can access data of the corresponding sensitivity level. When the system receives an access request, it extracts the visitor's identity information (such as user ID, department number, job level), access time (timestamp accurate to the second), and access operation type (query, modify, download, etc.) from the request. The system compares the permission values ​​in the visitor's identity information with the set hierarchical access permission thresholds to determine whether the access conditions are met.

[0129] When a visitor's permission value is greater than or equal to the permission threshold for the corresponding time-series sensitivity level, the system considers the visitor to meet the initial access conditions. For example, a user with a permission value of 7 can access low-sensitivity (threshold 3) and medium-sensitivity (threshold 6) data, but cannot access high-sensitivity (threshold 9) data. After meeting the initial conditions, the system further calculates the visitor's trust coefficient based on the visitor's permission level, historical access behavior, and the frequency of access operation types.

[0130] The specific method for calculating a visitor's trust score is as follows: The system retrieves the visitor's access records over the past 30 days, calculates the access frequency in different time periods (such as working hours and non-working hours), and compares the current access time with historical access patterns. Simultaneously, the system analyzes the historical frequency of access operation types to determine if the current operation conforms to the user's regular behavior patterns. Based on these factors, the system generates a trust score between 0 and 1. For example, a user with a permission level of 8 who performs a query operation during working hours, and whose operation matches their historical access pattern, is assigned a trust score of 0.85; while the same user performing a large number of download operations at uncommon times only receives a trust score of 0.4.

[0131] Based on the calculated visitor trust coefficient, the system selects a differential privacy algorithm that matches the differential privacy budget. The system maintains an algorithm library containing various differential privacy algorithms, including Laplace and exponential mechanisms, each with a different level of privacy protection. For example, when the visitor trust coefficient is 0.85, the system selects the Laplace mechanism with a privacy budget ε=0.5; while when the trust coefficient drops to 0.4, the system selects an algorithm with a stricter privacy budget ε=0.1. The system uses the selected differential privacy algorithm to anonymize sensitive fields in the visitor's identity information (such as real name, contact information, and precise location), generating anonymized visitor information.

[0132] In a specific case, the original visitor information included "Technician A, Technical Department, Office Area, Device ID-12345". After anonymization, it became "Technician, Technical Department, Office Area, Device ID-****", retaining necessary information while hiding sensitive personal information. The system combines the anonymized visitor information, access time (e.g., "2023-10-15 14:30:25"), time-series sensitivity level (e.g., "Medium Sensitive"), differential privacy budget (e.g., "ε=0.5"), and access operation type (e.g., "Data Query") to form a complete access record.

[0133] To further enhance privacy protection, the system adds noise of a corresponding strength to the differential privacy budget to sensitive fields in access records. For example, for access time, the system adds random noise following a Laplace distribution to the original timestamp, making the time record "2023-10-15 14:32:10"; for access location information, noise is added to transform precise locations into ambiguous region identifiers. The degree of noise addition is determined by the differential privacy budget; the smaller the budget value, the greater the added noise and the higher the level of privacy protection.

[0134] Through the above processing, the system ultimately generates anonymized access records, protecting visitor privacy while retaining sufficient information for data access management and auditing. This differential privacy-based hierarchical access control mechanism effectively balances the needs of data availability and privacy protection, making it suitable for sensitive data scenarios containing time-series information, such as medical and health data, financial transaction records, and location trajectories. In practical applications, the system adjusts the criteria for classifying time-series sensitivity levels, setting access permission thresholds, and configuring the parameters of the differential privacy algorithm according to the compliance requirements and specific business needs of different industries to ensure the effectiveness and relevance of data protection.

[0135] In one optional implementation, a differential privacy algorithm matching the differential privacy budget is selected based on the visitor trust coefficient. The differential privacy algorithm is then used to de-identify sensitive fields in the visitor's identity information, generating de-identified visitor information including:

[0136] A differential privacy algorithm pool is constructed, which contains multiple differential privacy algorithms, and the sensitive fields in the visitor's identity information are divided into identity identifier fields, location information fields, behavioral feature fields and attribute information fields;

[0137] Calculate the algorithm matching degree of each differential privacy algorithm for different types of sensitive fields, and allocate the differential privacy budget according to the sensitive field type based on the visitor trust coefficient to obtain a local budget;

[0138] Based on the algorithm matching degree and the local budget, the optimal differential privacy algorithm is selected from the differential privacy algorithm pool. The sensitive fields in the visitor identity information are grouped according to type to obtain a sensitive field sequence. The sensitive field sequence is then input into the optimal differential privacy algorithm.

[0139] Differential privacy processing is performed on the sensitive field sequence based on the local budget to generate initial de-identified data. The data utility evaluation score of the initial de-identified data is calculated. The algorithm parameters of the optimal differential privacy algorithm are adjusted according to the data utility evaluation score. The sensitive field sequence is reprocessed using the adjusted optimal differential privacy algorithm to generate de-identified visitor information.

[0140] An algorithm pool containing various differential privacy algorithms is constructed, including Laplace's algorithm, exponential algorithm, Gaussian algorithm, random response algorithm, and K-anonymity algorithm. Each algorithm has different characteristics and is suitable for different types of data processing needs. Laplace's algorithm is suitable for numerical data, protecting data privacy by adding random noise following a Laplace distribution. Exponential algorithm is suitable for non-numerical queries, selecting the output result based on a utility function. Gaussian algorithm is suitable for continuous data, protecting privacy by adding random noise following a Gaussian distribution. Random response algorithm is suitable for Boolean data, achieving privacy protection by probabilistically flipping data values. K-anonymity algorithm is suitable for categorical data, protecting privacy by ensuring that each record is indistinguishable from at least K-1 other records.

[0141] Sensitive fields in visitor identity information are divided into four categories: identity fields, location information fields, behavioral characteristic fields, and attribute information fields. Identity fields include information that directly identifies an individual, such as name, user ID, and device number; location information fields include spatial location-related information such as home address, workplace, and frequently used activity areas; behavioral characteristic fields include behavioral pattern information such as consumption habits, browsing history, and social activities; and attribute information fields include personal attribute information such as age, gender, occupation, and education level.

[0142] For each differential privacy algorithm, its matching degree with various sensitive fields is calculated. The matching degree reflects the applicability of the algorithm to specific types of data processing and is derived through historical application effects and data feature analysis. Specifically, the calculation method involves scoring the algorithm's performance in processing various sensitive fields in historical applications, combining the correlation between the field data type characteristics and the algorithm's characteristics, and generating a matching degree score between 0 and 1.

[0143] For example, for highly structured data such as user IDs, the K-anonymity mechanism has a matching degree of 0.85, while the Laplace mechanism has a matching degree of 0.45; however, for location coordinate data, the Gaussian mechanism has a matching degree of 0.92, while the random response mechanism has a matching degree of only 0.25. For browsing history data in the behavioral feature field, the exponential mechanism has a matching degree of 0.78, while the K-anonymity mechanism has a matching degree of 0.65; for age data in the attribute information field, the Laplace mechanism has a matching degree of 0.81, while the Gaussian mechanism has a matching degree of 0.79.

[0144] Based on the visitor trust coefficient, the differential privacy budget is allocated to local budgets according to the sensitive field types. The visitor trust coefficient is a value between 0 and 1, which is determined based on the visitor's historical behavior, authentication strength, and security level. The higher the trust coefficient, the smaller the allocated differential privacy budget and the lower the data protection strength; conversely, the lower the trust coefficient, the larger the allocated budget and the higher the protection strength.

[0145] For example, when the visitor trust level is 0.8, the total budget of 1.5 can be allocated according to the following proportions: 30% for the identity identification field, 25% for the location information field, 25% for the behavioral characteristics field, and 20% for the attribute information field. The resulting local budgets are 0.45, 0.375, 0.375, and 0.3, respectively. When the trust level is 0.3, the allocation ratio can be adjusted to 40%, 30%, 20%, and 10%, increasing the total budget to 3.0. The resulting local budgets are 1.2, 0.9, 0.6, and 0.3, respectively.

[0146] Based on algorithm fit and local budget, the optimal differential privacy algorithm is selected from the differential privacy algorithm pool. The selection process employs a weighted scoring mechanism, combining algorithm fit and local budget to calculate a comprehensive score, and selecting the algorithm with the highest score as the optimal algorithm. Specifically, the algorithm fit is multiplied by a weight of 0.7, and the local budget fitness is multiplied by a weight of 0.3; the two are then added together to obtain the comprehensive score. Local budget fitness refers to the algorithm's performance under a given budget, determined by the degree of matching between the algorithm's characteristics and the budget size.

[0147] For example, for the identity field, when the local budget is 0.45, the K-anonymity algorithm has a matching degree of 0.85, a local budget fitness of 0.75, and a comprehensive score of 0.85×0.7+0.75×0.3=0.82, which is higher than other algorithms, so the K-anonymity algorithm is chosen; for the location information field, when the local budget is 0.375, the Gaussian algorithm has a matching degree of 0.92, a local budget fitness of 0.80, and a comprehensive score of 0.92×0.7+0.80×0.3=0.884, making it the optimal choice.

[0148] Sensitive fields in the visitor's identity information are grouped by type to obtain a sensitive field sequence. For example, "User A", "USER20240815000001", and "DEV87654321" are grouped into the identity field group; "Province, City, District" and "Longitude xx.xx, Latitude yy.yy" are grouped into the location information field group; "Friday night consumption" and "likes sports apps" are grouped into the behavioral feature field group; and "35 years old", "Male", and "Engineer" are grouped into the attribute information field group. For each field group, further structured processing is performed to form a sequence. For example, the identity field group can be represented as ["User A", "USER20240815000001", "DEV87654321"], and the location information field group can be represented as ["Province, City, District", {"Longitude": xx.xx, "Latitude": yy.yy}].

[0149] For each set of sensitive field sequences, differential privacy processing is performed based on the corresponding local budget to generate initial de-identified data. For example, after applying K-anonymity and a local budget of 0.45 to the identity field group, "User A" becomes "User*", "USER20240815000001" becomes "USER20240001", and "DEV87654321" becomes "DEV8321". After applying Gaussian mechanism and a local budget of 0.375 to the location information field group, the precise location "longitude xx.xx, latitude yy.yy" is blurred into a range representation of "longitude xx.x±0.1, latitude yy.y±0.1".

[0150] After applying the exponential mechanism and a local budget of 0.375 to the behavioral characteristic field group, "Friday night consumption" becomes "Weekend consumption", and "likes sports apps" becomes "likes health apps". After applying the Laplace mechanism and a local budget of 0.3 to the attribute information field group, "35 years old" becomes "30-40 years old", "male" remains unchanged, and "engineer" becomes "technician".

[0151] A data utility assessment is performed on the initial anonymized data, and a data utility assessment score is calculated. The data utility assessment is based on three aspects: information retention rate, data usability, and query accuracy. Information retention rate refers to the degree to which valid information in the original data is retained after anonymization, calculated by comparing the information entropy of the data before and after anonymization. Data usability refers to the ability of the anonymized data to support data analysis and processing, determined by assessing data integrity and consistency. Query accuracy refers to the accuracy of query operations using the anonymized data, determined by testing the error rate of query results. Each aspect is scored from 0 to 10, and the weighted average of the three scores yields the final data utility assessment score.

[0152] For example, for the initial anonymized data of the identity field, the information retention rate score is 7 (weight 0.3), the data availability score is 8 (weight 0.4), and the query accuracy score is 6 (weight 0.3), resulting in a weighted average utility evaluation score of 7.1. For the initial anonymized data of the location information field, the information retention rate is 6, the data availability score is 7, and the query accuracy score is 5, resulting in a weighted average score of 6.1.

[0153] Based on the data utility evaluation score, adjust the algorithm parameters of the optimal differential privacy algorithm. When the utility evaluation score is lower than a preset threshold, the algorithm parameters need to be adjusted to improve data utility. For K-anonymity, the K value can be adjusted; for Laplace and Gaussian mechanisms, the noise parameter can be adjusted; for exponential mechanisms, the utility function parameter can be adjusted; and for random response mechanisms, the flip probability can be adjusted.

[0154] For example, when the utility evaluation score of the K-anonymity mechanism is 5, which is lower than the preset threshold of 7, the K value can be adjusted from 5 to 3 to reduce the anonymization intensity; when the utility evaluation score of the Gaussian mechanism is 6.1, which is lower than the preset threshold of 7, the noise parameter can be adjusted from 0.5 to 0.3 to reduce the amount of added noise. The specific adjustment range is determined based on the difference between the utility evaluation score and the threshold; the larger the difference, the larger the adjustment range.

[0155] The sensitive field sequence is reprocessed using the adjusted optimal differential privacy algorithm to generate the final anonymized visitor information. For example, the K-anonymity mechanism with adjusted parameters processes the identity field: "User A" becomes "User A*", retaining more information; "USER20240815000001" becomes "USER20241501", retaining the beginning and end information; "DEV87654321" becomes "DEV87**321", remaining unchanged.

[0156] The Gaussian mechanism, with adjusted parameters, processes location information, narrowing the location range to "longitude xx.xx±0.05, latitude yy.yy±0.05", thus improving location accuracy. For the exponential mechanism, which processes behavioral feature fields, "consumption every Friday night" is changed to "consumption on Friday," preserving more precise time information. Similarly, the Laplace mechanism, with adjusted parameters, processes attribute information fields, changing "35 years old" to "33-37 years old," further narrowing the age range and improving accuracy.

[0157] Through the above steps, differential privacy algorithm selection and sensitive field de-identification based on visitor trust were achieved, which maintains data availability while protecting data privacy and provides an effective method for access control and data protection.

[0158] In one optional implementation, based on the anonymized access records, access behavior characteristics are analyzed, and different differential privacy thresholds are set in conjunction with the time-series sensitivity level. When the access behavior characteristics exceed the corresponding differential privacy threshold, it is determined to be abnormal access behavior, and an access tracing report is generated, including:

[0159] The access time distribution, access frequency, access duration, and access resource type are extracted from the anonymized access records. The access time distribution, access frequency, access duration, and access resource type are combined to generate access behavior features.

[0160] Based on the access behavior characteristics, access behavior patterns are analyzed, and a baseline threshold is determined according to the access behavior patterns and the time sensitivity level. The baseline threshold is multiplied by the adjustment coefficient of the time sensitivity level to obtain the differential privacy threshold.

[0161] The access behavior features are input into the feature analysis module, and feature weight coefficients for the access time distribution, access frequency, access duration, and access resource type are calculated based on the feature analysis module. The differential privacy threshold is multiplied by the feature weight coefficients to obtain the differential privacy threshold corresponding to each access behavior feature.

[0162] Calculate the deviation values ​​of the access time distribution, access frequency, access duration, and access resource type from the preset normal resource access mode; compare the deviation values ​​with their corresponding differential privacy thresholds respectively; when any deviation value exceeds the corresponding differential privacy threshold, the current access behavior is determined to be abnormal access behavior.

[0163] Record the detection time of the abnormal access behavior, and combine the detection time, the access behavior characteristics, the deviation value, and the differential privacy threshold to form an access tracing report.

[0164] Multi-dimensional access behavior features are extracted from the anonymized access records. These features include access time distribution, access frequency, access duration, and accessed resource type. Taking a data center as an example, for user A's access records, the system's extracted access time distribution shows that the user mainly accesses the system between 9:00 and 18:00 on weekdays, with an average access frequency of 5 times per day. The duration of a single access is usually between 15 and 30 minutes, and the main resource type accessed is the customer management database. The system combines these features to form user A's access behavior feature vector.

[0165] Based on the extracted access behavior features, the system further analyzes the user's access behavior patterns. For user A, the system identifies their typical access behavior pattern as "frequent short-term access to the customer management database during working hours." Combining this with the resource's time-series sensitivity level (assumed to be level 3, i.e., medium sensitivity), the system determines a baseline threshold of 0.6. The correspondence between time-series sensitivity levels and adjustment coefficients is set as follows: level 1 (low sensitivity) corresponds to 1.5, level 2 to 1.2, level 3 to 1.0, level 4 to 0.8, and level 5 (high sensitivity) to 0.5. Therefore, for the level 3 sensitive resource accessed by user A, the system multiplies the baseline threshold of 0.6 by the adjustment coefficient of 1.0 to obtain a differential privacy threshold of 0.6.

[0166] To more precisely measure the importance of different features, the system calculates the weight coefficients of each feature through the feature analysis module. In this example, the feature analysis module, trained based on historical data, yields the following weight coefficients for each feature: access time distribution 0.35, access frequency 0.25, access duration 0.20, and accessed resource type 0.20. The system multiplies the differential privacy threshold of 0.6 by the weight coefficients of each feature, resulting in the following differential privacy thresholds for each feature: access time distribution 0.21, access frequency 0.15, access duration 0.12, and accessed resource type 0.12.

[0167] The system continuously monitors users' actual access behavior and calculates the deviation values ​​from the preset normal resource access pattern. On a certain day, the system detected that user A accessed the customer management database outside of working hours (23:30) for a duration of 120 minutes, which is significantly different from their normal access pattern. The deviation values ​​calculated by the system are: access time distribution 0.45 (exceeding the corresponding threshold of 0.21), access frequency 0.10 (not exceeding the corresponding threshold of 0.15), access duration 0.40 (exceeding the corresponding threshold of 0.12), and accessed resource type 0.05 (not exceeding the corresponding threshold of 0.12). Since the deviation values ​​of access time distribution and access duration both exceed the corresponding differential privacy thresholds, the system classifies this access behavior as abnormal access behavior.

[0168] Upon detecting abnormal access behavior, the system immediately records the detection time (e.g., 2023-06-15 23:35:12) and compiles an access tracing report consisting of the detection time, the characteristics of the abnormal access behavior (long-term access outside of working hours), the deviation values ​​for each dimension (0.45, 0.10, 0.40, 0.05), and the corresponding differential privacy thresholds (0.21, 0.15, 0.12, 0.12). This report can be used by security managers for further investigation and processing.

[0169] Using the above method, the system can dynamically adjust the detection threshold based on the time-series sensitivity of resources, applying stricter detection standards to highly sensitive resources. Simultaneously, it considers the comprehensive impact of multi-dimensional access characteristics, effectively identifying potential abnormal access behavior. This method not only improves the accuracy of anomaly detection but also protects the privacy of normal user access through a differential privacy mechanism, reducing the false alarm rate. Practice shows that this method is particularly effective in sensitive data-intensive scenarios such as finance and healthcare, enabling timely detection and prevention of unauthorized access and data leakage risks.

[0170] Figure 4This is a bar chart illustrating the abnormal access behavior feature analysis based on time-series sensitivity levels, as presented in an embodiment of the present invention. The chart displays core analytical data from an abnormal access behavior detection system. White bars represent the deviation of actual access behavior from a normal baseline, filled bars with diagonal lines represent security threshold boundaries set through differential privacy mechanisms, and filled bars with dots represent the importance weight coefficients of different access feature dimensions. From the data performance, in the access time distribution dimension, the actual deviation reaches 0.33, significantly higher than the differential privacy threshold of 0.15, and has a feature weight coefficient of 0.25, indicating that this dimension is most sensitive to anomaly detection. The actual deviation in the access frequency dimension is 0.07, lower than the differential privacy threshold of 0.11, and with a feature weight coefficient of 0.18, it indicates that the current access frequency is within the normal range. The access duration dimension shows an actual deviation of 0.29, significantly exceeding the threshold of 0.09, and combined with a feature weight of 0.15, it indicates a potential anomaly. The actual deviation in the access resource type dimension is only 0.04, far lower than the threshold of 0.09, and has a feature weight of 0.15, indicating that the resource access pattern is relatively stable. Through comprehensive analysis across these four dimensions, the system can effectively identify abnormal patterns in access behavior, particularly in terms of time distribution and duration, providing an important basis for subsequent adjustments to access control strategies.

[0171] A second aspect of the present invention provides a privacy protection and access control system based on unstructured metadata, comprising:

[0172] The first unit is used to acquire time-series metadata to be processed from multiple data source nodes, including time-sensitive data and non-sensitive data.

[0173] The second unit is used to calculate the sensitivity characteristics of the time-series metadata to be processed at each of the data source nodes, calculate the sensitivity score based on the sensitivity characteristics, and classify the time-series sensitive data into sensitivity levels according to the sensitivity score;

[0174] The third unit is used to allocate differential privacy budgets to time-sensitive data of different levels according to the time-sensitivity level, and to perform differential privacy processing on the time-sensitive data using the differential privacy budgets, so as to maintain data availability while protecting data privacy and generate time-series data with differential privacy protection.

[0175] The fourth unit is used to set hierarchical access permissions for the differentially privacy-protected time-series data according to the time-series sensitivity level, verify the access requests, and use a differential privacy algorithm corresponding to the differential privacy budget to de-identify the verified visitor information and generate de-identified access records.

[0176] The fifth unit is used to analyze access behavior characteristics based on the anonymized access records, and set different differential privacy thresholds in combination with the time sensitivity level. When the access behavior characteristics exceed the corresponding differential privacy threshold, they are determined to be abnormal access behavior, and an access tracing report is generated.

[0177] A third aspect of the present invention provides an electronic device, comprising:

[0178] processor;

[0179] Memory used to store processor-executable instructions;

[0180] The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0181] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0182] This invention can be a method, apparatus, system, and / or computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for performing various aspects of the invention.

[0183] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A privacy protection and access control method based on unstructured metadata, characterized in that, include: Obtain time-series metadata to be processed from multiple data source nodes, including time-sensitive data and non-sensitive data; The sensitivity characteristics of the time-series metadata to be processed are calculated at each data source node, a sensitivity score is calculated based on the sensitivity characteristics, and the time-series sensitive data is classified into time-series sensitivity levels according to the sensitivity scores. Differential privacy budgets are allocated to time-sensitive data of different sensitivity levels based on the aforementioned time-sensitivity levels. Differential privacy processing is then performed on the time-sensitive data using these budgets to protect data privacy while maintaining data availability, generating differentially privacy-protected time-series data, including: The initial allocation coefficients of the differential privacy budget are calculated based on the time sensitivity level. The initial allocation coefficients are then input into the dynamic budget allocation function, which calculates the differential privacy budget for each time-sensitive data based on the initial allocation coefficients and the total privacy budget. The scale parameter of the Laplace noise is determined based on the differential privacy budget, the Laplace noise is generated based on the scale parameter, and the Laplace noise is added to the time-sensitive data to generate noisy time-series data. Calculate the data availability index between the noisy time-series data and the original time-series sensitive data, and calculate the adjustment direction and magnitude of the budget allocation based on the data availability index and the privacy protection level; The initial allocation coefficients are updated according to the adjustment direction and the adjustment magnitude. The updated allocation coefficients are then re-input into the dynamic budget allocation function to generate a new differential privacy budget. The noise addition and data availability calculation process is repeated using the new differential privacy budget until the data availability index reaches a preset index threshold. The time series data after differential privacy protection is then output. Based on the time sensitivity level, hierarchical access permissions are set for the time series data after differential privacy protection. Access requests are verified, and the access information of verified visitors is de-identified using a differential privacy algorithm corresponding to the differential privacy budget to generate de-identified access records. Based on the anonymized access records, the access behavior characteristics are analyzed, and different differential privacy thresholds are set in conjunction with the time-series sensitivity level. When the access behavior characteristics exceed the corresponding differential privacy threshold, it is determined to be abnormal access behavior, and an access tracing report is generated.

2. The method according to claim 1, characterized in that, The sensitivity characteristics of the time-series metadata to be processed are calculated at each data source node. A sensitivity score is calculated based on the sensitivity characteristics. The time-series sensitive data is then classified into time-series sensitivity levels according to the sensitivity scores, including: The sensitivity characteristics of the time-series metadata to be processed are calculated at each data source node. The sensitivity characteristics include time-series fluctuation characteristics and data association characteristics. A sensitivity assessment adversarial network is constructed, comprising a generator and a discriminator. The generator performs adaptive sampling based on the distribution characteristics of the temporal fluctuation features and the data association features to generate multi-scale perturbation samples. The discriminator uses a dynamically weighted attention mechanism to evaluate the sensitivity stability of the multi-scale perturbation samples under different perturbation levels, and feeds the evaluation results back to the generator to guide the generation process of perturbation samples. An adversarial loss function is constructed based on the multi-scale perturbation samples output by the generator and the sensitivity stability evaluation results of the discriminator. The sampling strategy of the generator and the evaluation weight of the discriminator are updated by iteratively optimizing the adversarial loss function, so that the sensitivity evaluation adversarial network has the ability to defend against adversarial attacks. The optimized sensitivity assessment adversarial network is used to robustly evaluate the sensitivity features to obtain sensitivity assessment results. Based on the sensitivity assessment results, a sensitivity score is calculated, and the time-series metadata to be processed is classified into time-series sensitivity levels according to the sensitivity score.

3. The method according to claim 2, characterized in that, The generator adaptively samples multi-scale perturbation samples based on the distribution characteristics of the temporal fluctuation features and the data association features. The discriminator then uses a dynamically weighted attention mechanism to evaluate the sensitivity stability of the multi-scale perturbation samples under different perturbation levels, including: A conditional variational autoencoder is constructed based on the time series fluctuation characteristics and the data association characteristics. The conditional variational autoencoder includes a posterior distribution network and a prior distribution network. The mean parameter and variance parameter are generated based on the posterior distribution network and the prior distribution network, respectively. The mean parameter and the variance parameter are input into the generator. Based on the generator, a multi-scale perturbation vector is generated through reparameterization technology. Based on the reparameterization technology, the mean parameter and the variance parameter are mapped to the latent space. The perturbation sample is determined by the multi-scale perturbation vector and the random sampling vector of the standard normal distribution. A hierarchical attention network for the discriminator is constructed. The perturbation sample is input into the hierarchical attention network. The hierarchical attention network is used to perform multi-level feature transformation on the perturbation sample to generate multi-level feature representation. Attention weights are calculated based on the multi-level feature representation. A feature reconstruction vector is determined jointly by the attention weights and the multi-level feature representation. The sensitivity stability of the perturbation sample under different perturbation levels is evaluated based on the feature reconstruction vector.

4. The method according to claim 1, characterized in that, Based on the time-series sensitivity level, hierarchical access permissions are set for the differentially privacy-protected time-series data. Access requests are verified, and the access information of verified visitors is anonymized using a differential privacy algorithm corresponding to the differential privacy budget. The resulting anonymized access records include: Based on the time-sensitivity level, a corresponding hierarchical access permission threshold is set, which is used to limit the minimum permission requirements for the visitor; the visitor's identity information, access time, and access operation type are extracted from the access request, and the visitor's identity information is compared with the hierarchical access permission threshold; When the visitor's identity information meets the hierarchical access permission threshold, the visitor trust coefficient is calculated based on the access level of the visitor's identity information, the historical access behavior corresponding to the access time, and the access frequency of the access operation type. Based on the visitor trust coefficient, a differential privacy algorithm matching the differential privacy budget is selected. The differential privacy algorithm is then used to desensitize sensitive fields in the visitor identity information, generating desensitized visitor information. The access record is composed of the anonymized visitor information, the access time, the time-series sensitivity level, the differential privacy budget, and the access operation type; noise of a corresponding intensity to the differential privacy budget is added to the sensitive fields in the access record to generate the anonymized access record.

5. The method according to claim 4, characterized in that, Based on the visitor trust coefficient, a differential privacy algorithm matching the differential privacy budget is selected. This differential privacy algorithm is then used to de-identify sensitive fields in the visitor's identity information, generating de-identified visitor information including: A differential privacy algorithm pool is constructed, which contains multiple differential privacy algorithms, and the sensitive fields in the visitor's identity information are divided into identity identifier fields, location information fields, behavioral feature fields and attribute information fields; Calculate the algorithm matching degree of each differential privacy algorithm for different types of sensitive fields, and allocate the differential privacy budget according to the sensitive field type based on the visitor trust coefficient to obtain a local budget; Based on the algorithm matching degree and the local budget, the optimal differential privacy algorithm is selected from the differential privacy algorithm pool. The sensitive fields in the visitor identity information are grouped according to type to obtain a sensitive field sequence. The sensitive field sequence is then input into the optimal differential privacy algorithm. Differential privacy processing is performed on the sensitive field sequence based on the local budget to generate initial de-identified data. The data utility evaluation score of the initial de-identified data is calculated. The algorithm parameters of the optimal differential privacy algorithm are adjusted according to the data utility evaluation score. The sensitive field sequence is reprocessed using the adjusted optimal differential privacy algorithm to generate de-identified visitor information.

6. The method according to claim 1, characterized in that, Based on the anonymized access records, access behavior characteristics are analyzed. Different differential privacy thresholds are set in conjunction with the time-series sensitivity level. When the access behavior characteristics exceed the corresponding differential privacy threshold, it is determined to be abnormal access behavior, and an access tracing report is generated, including: The access time distribution, access frequency, access duration, and access resource type are extracted from the anonymized access records. The access time distribution, access frequency, access duration, and access resource type are combined to generate access behavior features. Based on the access behavior characteristics, access behavior patterns are analyzed, and a baseline threshold is determined according to the access behavior patterns and the time sensitivity level. The baseline threshold is multiplied by the adjustment coefficient of the time sensitivity level to obtain the differential privacy threshold. The access behavior features are input into the feature analysis module, and feature weight coefficients for the access time distribution, access frequency, access duration, and access resource type are calculated based on the feature analysis module. The differential privacy threshold is multiplied by the feature weight coefficients to obtain the differential privacy threshold corresponding to each access behavior feature. Calculate the deviation values ​​of the access time distribution, access frequency, access duration, and access resource type from the preset normal resource access mode; compare the deviation values ​​with their corresponding differential privacy thresholds respectively; when any deviation value exceeds the corresponding differential privacy threshold, the current access behavior is determined to be abnormal access behavior. Record the detection time of the abnormal access behavior, and combine the detection time, the access behavior characteristics, the deviation value, and the differential privacy threshold to form an access tracing report.

7. A privacy protection and access control system based on unstructured metadata, used to implement the method of any one of claims 1-6, characterized in that, include: The first unit is used to acquire time-series metadata to be processed from multiple data source nodes, including time-sensitive data and non-sensitive data. The second unit is used to calculate the sensitivity characteristics of the time-series metadata to be processed at each of the data source nodes, calculate the sensitivity score based on the sensitivity characteristics, and classify the time-series sensitive data into time-series sensitivity levels according to the sensitivity score; The third unit is used to allocate differential privacy budgets to time-sensitive data of different levels according to the time-sensitivity level, and to perform differential privacy processing on the time-sensitive data using the differential privacy budgets, so as to maintain data availability while protecting data privacy and generate time-series data with differential privacy protection. The fourth unit is used to set hierarchical access permissions for the differentially privacy-protected time-series data according to the time-series sensitivity level, verify the access requests, and use a differential privacy algorithm corresponding to the differential privacy budget to de-identify the verified visitor information and generate de-identified access records. The fifth unit is used to analyze access behavior characteristics based on the anonymized access records, and set different differential privacy thresholds in combination with the time sensitivity level. When the access behavior characteristics exceed the corresponding differential privacy threshold, they are determined to be abnormal access behavior, and an access tracing report is generated.

8. An electronic device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having computer program instructions stored thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1 to 6.

Images