Method and system for predicting sensitive information leakage based on digital archives

Abstract

The application provides a sensitive information leakage prediction method and system based on digital archives, and relates to the field of digital archive management. The method comprises the following steps: determining a pointing entity from a preset digital archive library, constructing a relationship edge set according to the entity, entity relationship and pointing entity; determining the initial weight of the entity according to the common occurrence frequency of the entity and the pointing entity, the number of connection edges of the entity, the number of connection edges of the pointing entity and the cosine similarity; determining the current weight corresponding to the entity according to the initial weight of the entity, the time decay factor and the context correlation degree, determining the current content sensitivity corresponding to the current digital archive, inputting the current content sensitivity corresponding to the current digital archive, the propagation path risk value and the carrier vulnerability value into a preset sensitive information leakage prediction model, and obtaining the sensitive information leakage risk degree. The application can dynamically adapt to the change of archive security level and the semantic association scene, and improve the real-time performance and accuracy of the prediction.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of digital archives management, and in particular to a sensitive information leakage prediction method and system based on digital archives. BACKGROUND

[0002] With the advent of the information age, digital archives have become an important form of information storage and management in various industries. However, in the full life cycle management of digital archives, the risk of sensitive information leakage is increasingly prominent. Traditional sensitive information leakage prediction methods mainly use keyword matching technology. Although this method is simple and easy to implement, its accuracy and comprehensiveness are not satisfactory when faced with digital archives with rich semantics and complex structure. In addition, traditional static weight models often cannot accurately reflect the dynamic changes of archive classification when evaluating sensitive information. For example, the expiration of the storage period of an archive may trigger a change in classification, but a static weight model cannot adjust the weight in a timely manner to adapt to such changes.

[0003] Furthermore, existing technologies in evaluating sensitive information leakage risk often only focus on the sensitivity of the archive content itself, while ignoring the path risk and vulnerability of the carrier in the process of information dissemination. In practical applications, the dissemination path of information and the security status of the carrier have an important influence on the leakage risk and must be considered comprehensively. The influence of the time dimension on information sensitivity is also ignored by existing technologies. The value and sensitivity of an archive often change over time, for example, certain sensitive information has very high value within a certain time period, but its value may gradually decrease over time. However, existing technologies often cannot accurately evaluate the leakage risk of archives at different time points, resulting in a lack of scientific basis for the development of sensitive information protection strategies.

[0004] In summary, existing technologies have many shortcomings in the prediction of sensitive information leakage in the full life cycle management of digital archives, and a more comprehensive, accurate, and adaptable method is needed to solve these problems. However, there is currently no technical solution that can solve the above technical problems, and there is no sensitive information leakage prediction method and system based on digital archives. SUMMARY

[0005] The present application provides a sensitive information leakage prediction method and system based on digital archives, which can predict the risk of sensitive information leakage in the full life cycle management of digital archives and accurately reflect the real-time state of archive sensitive information.

[0006] In a first aspect, the present application provides a sensitive information leakage prediction method based on digital archives, comprising:

[0007] For each entity in the archive information corresponding to the current digital archive, a pointing entity associated with the entity is determined from a preset digital archive library according to a preset data association rule, and a relationship edge set is constructed according to the entity, an entity relationship and the pointing entity;

[0008] The cosine similarity of the entity and the pointing entity is calculated, and the initialization weight of the entity is determined according to the number of common occurrences of the entity and the pointing entity, the number of connection edges of the entity, the number of connection edges of the pointing entity and the cosine similarity;

[0009] The current weight corresponding to the entity is determined according to the initialization weight of the entity, a time decay factor and a context association degree, all entities in the archive information are traversed, and the current content sensitivity corresponding to the current digital archive is determined according to each current weight corresponding to all entities and each preset leakage influence factor, and the time decay factor is determined according to the historical effective time of the current archive information and the current acquisition time;

[0010] The current content sensitivity, a propagation path risk value and a carrier vulnerability value corresponding to the current digital archive are input into a preset sensitive information leakage prediction model, and a sensitive information leakage risk degree output by the preset sensitive information leakage prediction model is obtained.

[0011] According to the sensitive information leakage prediction method based on the digital archive provided by the application, the entity includes an archive entity, a personnel entity and a device entity, before determining the pointing entity associated with the entity from the preset digital archive library according to the preset data association rule, the method further comprises:

[0012] The preset digital archive library is constructed and updated in real time;

[0013] Archive information corresponding to the current digital archive is acquired, entity extraction is performed on the archive information, and the archive entity, the personnel entity and the device entity are acquired;

[0014] Each entity includes an ID attribute, a security level, a storage period and a storage location.

[0015] According to the sensitive information leakage prediction method based on the digital archive provided by the application, the entity relationship includes a membership relationship, an access relationship and a derivative relationship, and the pointing entity associated with the entity is determined from the preset digital archive library according to the preset data association rule, which comprises:

[0016] In the case that the target field matches the first preset field in the archive information, the membership relationship between the target field and the first preset field is determined;

[0017] In the case that there is an operation record of the target field in the access log of the archive information, the access relationship between the access personnel and the target field is determined;

[0018] In the case that there is a target field associated with a second preset field in the archive information, the derivative relationship between the target field and the second preset field is determined.

[0019] According to the present application, the initialization weight of the entity is determined according to the number of common occurrences of the entity and the pointing entity, the number of connection edges of the entity, the number of connection edges of the pointing entity, and the cosine similarity, which comprises:

[0020] The number of connection edges of the entity and the number of connection edges of the pointing entity are determined according to the relationship edge set, and the connection edge product value is determined according to the product of the number of connection edges of the entity and the number of connection edges of the pointing entity;

[0021] The connection edge square value is obtained by taking the square root of the connection edge product value, the weight quotient value is determined according to the quotient value of the number of common occurrences and the connection edge square value, and the initialization weight of the entity is determined according to the weight quotient value and the cosine similarity.

[0022] According to the present application, the method for predicting sensitive information leakage based on digital archives further comprises:

[0023] The decay rate parameter is determined according to the security level of the current archive information, the time difference value is determined according to the historical effective time and the current acquisition time of the current archive information, and the time decay factor corresponding to the entity is determined according to the decay rate parameter and the time difference value;

[0024] All neighbor nodes corresponding to the entity are determined, the cosine similarity between the entity and any neighbor node is calculated, and the context correlation degree is determined according to the sum of all cosine similarities and the number of shortest path edges between two nodes.

[0025] According to the present application, the method for predicting sensitive information leakage based on digital archives further comprises:

[0026] ;

[0027] The current weight corresponding to the entity is determined according to the initialization weight of the entity, the time decay factor and the context correlation degree, The time decay factor is determined according to the security level of the current archive information, contextual relevance, initial weight adjustment coefficient, initial weight of the entity.

[0028] The method for predicting sensitive information leakage based on a digital archive according to the present application determines the current content sensitivity corresponding to the current digital archive according to each current weight corresponding to each entity and each preset leakage influence factor, which comprises:

[0029] For any entity, a preset leakage influence factor corresponding to the entity is determined from a preset relationship between the security level and the leakage influence factor according to the security level of the entity.

[0030] The weighted value of the entity is determined according to the current weight corresponding to the entity and the preset leakage influence factor.

[0031] The weighted value of each entity is determined by traversing all entities, and the current content sensitivity corresponding to the current digital archive is obtained by summing each weighted value corresponding to all entities.

[0032] The method for predicting sensitive information leakage based on a digital archive according to the present application further comprises the following steps before inputting the current content sensitivity corresponding to the current digital archive, the propagation path risk value and the carrier vulnerability value into the preset sensitive information leakage prediction model:

[0033] The node importance value is obtained by calculating the node importance using the PageRank algorithm, the propagation path quotient value is determined according to the node importance value and the diameter of the knowledge graph, the propagation path parameter value is determined according to the path entropy and the complexity suppression coefficient, and the propagation path risk value is determined according to the propagation path quotient value and the propagation path parameter value.

[0034] The verification results of the current digital archive within a preset time period are counted, the weighted value of the number of passes is determined according to the number of passes within different time periods and the analysis weight corresponding to different time periods, the weighted value of the total number of attempts is determined according to the total number of attempts within different time periods and the analysis weight corresponding to different time periods, the verification pass rate is determined according to the weighted value of the number of passes and the weighted value of the total number of attempts, and the carrier vulnerability value is determined according to the verification pass rate.

[0035] The analysis weight corresponding to different time periods is determined according to the number of days from different time periods in the preset time period to the current time.

[0036] The method for predicting sensitive information leakage based on a digital archive according to the present application further comprises the following steps after obtaining the sensitive information leakage risk degree output by the preset sensitive information leakage prediction model:

[0037] In a case where the sensitive information leakage risk degree is greater than the preset risk value, a warning instruction is generated, and the warning instruction is used to instruct secondary encryption processing on the archive information corresponding to the current digital archive.

[0038] In a second aspect, a sensitive information leakage prediction system based on a digital archive is provided, and includes:

[0039] A construction unit is configured to, for each entity in archive information corresponding to a current digital archive, determine a pointing entity associated with the entity from a preset digital archive library according to a preset data association rule, and construct a relationship edge set according to the entity, an entity relationship, and the pointing entity.

[0040] A calculation unit is configured to calculate a cosine similarity of the entity and the pointing entity, and determine an initialization weight of the entity according to a common occurrence frequency of the entity and the pointing entity, a number of connection edges of the entity, a number of connection edges of the pointing entity, and the cosine similarity.

[0041] A determination unit is configured to determine a current weight corresponding to the entity according to the initialization weight of the entity, a time decay factor, and a context association degree, traverse all entities in the archive information, and determine a current content sensitivity of the current digital archive according to each current weight corresponding to all entities and each preset leakage influence factor, wherein the time decay factor is determined according to a historical effective time of current archive information and a current acquisition time.

[0042] An output unit is configured to input the current content sensitivity of the current digital archive, a propagation path risk value, and a carrier vulnerability value into a preset sensitive information leakage prediction model, and obtain a sensitive information leakage risk degree output by the preset sensitive information leakage prediction model.

[0043] The present application realizes comprehensive quantitative evaluation of sensitive information leakage risk by fusing three-dimensional indicators of content sensitivity, propagation path risk, and carrier vulnerability, breaks through the limitations of traditional single-dimensional analysis, especially introduces a time decay factor and a context association degree, so that weight calculation can dynamically adapt to archive classification level changes and semantic association scenarios, improves the real-time performance and accuracy of evaluation, outputs a risk degree through a preset leakage prediction model, provides a scientific basis for formulating a protection strategy in advance, and reduces potential leakage losses; the three-dimensional risks of content, path, and carrier are included in a unified evaluation framework, the one-sidedness problem of traditional methods is solved, weight dynamic adjustment and three-dimensional scene modeling technology enable risk evaluation to adapt to the classification level and content changes in the whole life cycle of the archive, compared with the prior art, the present application has significant advantages in evaluation dimensions, dynamic adaptability, and response decision support, and provides a new generation of technical solutions for digital archive security management. BRIEF DESCRIPTION OF DRAWINGS

[0044] In order to more clearly illustrate the technical solutions in the present application or the prior art, the drawings needed to be used in the embodiments or prior art description will be briefly introduced. Obviously, the drawings in the following description are some embodiments of the present application, and other drawings can be obtained by those skilled in the art without any creative effort on the basis of these drawings.

[0045] Figure 1 is a flowchart of the sensitive information leakage prediction method based on digital archives provided by the present application;

[0046] Figure 2 is a structural diagram of the sensitive information leakage prediction system based on digital archives provided by the present application;

[0047] Figure 3 is a structural diagram of the electronic device provided by the present application. DETAILED DESCRIPTION

[0048] In order to make the objects, technical solutions and advantages of the present application clearer, the technical solutions in the present application will be described clearly and completely in combination with the drawings in the present application. Obviously, the described embodiments are some embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without any creative effort belong to the protection scope of the present application.

[0049] Figure 1 is a flowchart of the sensitive information leakage prediction method based on digital archives provided by the present application, and the sensitive information leakage prediction method based on digital archives comprises:

[0050] Step 101, for each entity in the archive information corresponding to the current digital archive, determining a pointing entity associated with the entity from a preset digital archive library according to a preset data association rule, and constructing a relationship edge set according to the entity, an entity relationship and the pointing entity;

[0051] Step 102, calculating the cosine similarity of the entity and the pointing entity, and determining the initialization weight of the entity according to the common occurrence frequency of the entity and the pointing entity, the number of connection edges of the entity, the number of connection edges of the pointing entity and the cosine similarity;

[0052] Step 103: Determine the current weight of the entity based on its initial weight, time decay factor, and contextual relevance. Traverse all entities in the archive information and determine the current content sensitivity of the current digital archive based on each current weight of all entities and each preset leakage impact factor. The time decay factor is determined based on the historical effective time and current acquisition time of the current archive information.

[0053] Step 104: Input the current content sensitivity, propagation path risk value and carrier vulnerability value corresponding to the current digital file into the preset sensitive information leakage prediction model to obtain the degree of sensitive information leakage risk output by the preset sensitive information leakage prediction model.

[0054] In step 101, a set of relational edges needs to be constructed first. Specifically, entity extraction and data preparation are performed on the current digital archive information. The archive information can be text, metadata, or access logs, etc. Entities are extracted using NLP technology. Optionally, the entities include archive entities, personnel entities, and equipment entities. Before determining the pointing entities associated with the entities from the preset digital archive database according to preset data association rules, the method further includes:

[0055] Construct the preset digital archive and update the preset digital archive in real time;

[0056] Obtain the archive information corresponding to the current digital archive, perform entity extraction on the archive information, and obtain the archive entity, the personnel entity, and the equipment entity;

[0057] Each entity includes an ID attribute, a confidentiality level, a retention period, and a storage location. The confidentiality level can be confidential, secret, or ordinary. Optionally, the present invention can also vectorize the entity description, for example, by converting the entity into a 768-dimensional semantic vector.

[0058] Optionally, the archive entity can be a content entity such as a file or title, the personnel entity can be a person entity such as a creator or visitor, and the device entity can be a device entity such as a storage server IP or a terminal device ID. In this invention, the extracted entities are stored in a preset digital archive in real time, which can form a dynamically updated knowledge graph.

[0059] Furthermore, V={v i |v i ∈(archive entity∪personnel entity∪equipment entity)}, where v i Includes the following attributes: (ID, security level, retention period, storage location).

[0060] Further, the entity relationship includes a subordination relationship, an access relationship, and a derivative relationship. Determining the pointed entity associated with the entity from the preset digital archive according to the preset data association rule includes:

[0061] When there is a target field in the file information that matches the first preset field, determining the subordination relationship between the target field and the first preset field;

[0062] When there is an operation record of the target field in the access log of the file information, determining the access relationship between the access person and the target field;

[0063] When there is a target field in the file information associated with the second preset field, determining the derivative relationship between the target field and the second preset field.

[0064] Optionally, in the association rule matching and pointed entity determination, the present invention presets a data association rule and establishes three types of relationships according to the field matching logic: E = {e ij ∣e ij =⟨v i ,r,v j >}, r ∈ {subordination, access, derivative}.

[0065] In an optional embodiment, basic entities are extracted from the attribute information of the digital file, such as the file entity: "2023 Annual Financial Report" (type: financial statement, responsible person: Finance Department A), the personnel entity: "Auditor Zhang San" (department: internal audit department, rank: P8), the equipment entity: "Server Cluster-01" (location: East China Data Center, IP: 10.10.1.1). According to the field matching logic, when specific fields are matched, <financial report, subordination, Finance Department>, <Auditor Zhang San, access, financial report>, <Financial Report V1, derivative, Financial Report V2>, etc. Another example is <XX project, subordination, R & D center>, <Engineer Wang, access, XX project>, <Security Terminal T001, derivative, XX project>.

[0066] In step 102, semantic vectors of the entity can be generated first to determine the vectorized representation of the entity and the pointed entity , where , where is the description text of entity i, is the aggregated vector output by the BERT model.

[0067] Calculate the cosine similarity between the entity and the pointed entity . The following formula can be referred to:

[0068] ;

[0069] Further, the initialization weight of the entity is determined according to the number of co-occurrences of the entity and the pointing entity, the number of connection edges of the entity, the number of connection edges of the pointing entity, and the cosine similarity, including:

[0070] The number of connection edges of the entity is determined according to the relationship edge set And the number of connection edges of the pointing entity The connection edge product value is determined according to the product of the number of connection edges of the entity and the number of connection edges of the pointing entity ;

[0071] The square value of the connection edge is obtained by taking the square root of the connection edge product value The weight quotient value is determined according to the quotient value of the number of co-occurrences And the square value of the connection edge The initialization weight of the entity is determined according to the weight quotient value and the cosine similarity .

[0072] Specifically, reference can be made to the following formula:

[0073] .

[0074] Further, the number of co-occurrences of the entity and the pointing entity is co-occurrence frequency, that is, the number of co-occurrences of the entity in the same document / operation is counted, according to steps 101 and 102, the present application can obtain the formal representation of the knowledge graph: , wherein, is a node set, is an edge set.

[0075] In step 103, before determining the current weight corresponding to the entity according to the initialization weight of the entity, the time decay factor and the context correlation degree, the method further comprises:

[0076] The decay rate parameter is determined according to the security level of the current archive information, the time difference value is determined according to the historical effective time and the current acquisition time of the current archive information, and the time decay factor corresponding to the entity is determined according to the decay rate parameter and the time difference value;

[0077] All neighbor nodes corresponding to the entity are determined, the cosine similarity between the entity and any neighbor node is calculated, and the context correlation degree is determined according to the sum of all cosine similarities and the number of shortest path edges between the two nodes.

[0078] Optionally, the application can determine the decay rate parameter according to the security level of the current archive information, for example, when the security level is confidential, the decay rate parameter k can be 0.05, and when the security level is secret, the decay rate parameter k can be 0.03, the application constructs a time decay curve, embodies the characteristics of non-linear decay of sensitivity with time, the sensitivity remains high at the initial stage, and the sensitivity rapidly decreases near the storage period, and the sensitivity is zero after the period, the time difference is determined according to the historical effective time of the current archive information and the current acquisition time, and the time decay factor corresponding to the entity is determined according to the decay rate parameter and the time difference, comprising:

[0079] ;

[0080] Wherein, is the time decay factor corresponding to the entity, is the historical effective time of the current archive information, is the current acquisition time.

[0081] In an optional embodiment, the confidential archive effective time (t0=2020-01-01), the current time t=2023-06-01 (interval 3.5 years≈1278 days), if the security level is confidential, the calculation is: α (1278) =1 / (1+e^{-0.05×1278})≈0.82.

[0082] Optionally, the application determines all neighbor nodes corresponding to the entity, calculates the cosine similarity between the entity and any neighbor node, and determines the context correlation degree according to the sum of all cosine similarities and the shortest path edge number between the two nodes, comprising:

[0083] The application obtains the first-order neighbor set of each node, for example, the neighbors of the node "project" include the research and development department, the chief engineer and the security server, uses the cosine similarity to measure the semantic association between entities, for example, calculates the vector similarity between "project" and "research and development department", and calculates the similarity between "project" and "security server", applies distance decay to indirect association, for example, "project" to "research and development department" (path length=1): no penalty; and "project" to "access control system" (path length=3): weight decay, more specifically, the context correlation degree can be determined by the following formula:

[0084] ;

[0085] Wherein, is the context correlation degree, is any entity node in the set, is the direct neighbor set of the node , is a cosine similarity calculation, is a vectorized representation of entity i, is a vectorized representation of entity L, is the number of edges of the shortest path between two nodes.

[0086] Optionally, for example, the similarity of the neighbor node: the research and development center is 0.92, the similarity of the total worker A is 0.85, and the similarity of the test station B is 0.76, then the average similarity is: (0.92+0.85+0.76) / 3=0.84, the path length of the target node is 2, then .

[0087] Optionally, the current weight corresponding to the entity is determined according to the initial weight of the entity, a time decay factor, and a context correlation degree, including:

[0088] ;

[0089] is the current weight corresponding to the entity, is a time decay factor, is a context correlation degree, is an initial weight adjustment coefficient, is the initial weight of the entity.

[0090] Optionally, the application can also add a constraint condition, for example, when the current acquisition time t is greater than the sum of the historical effective time t0 of the current archive information and the storage period, then is 0.

[0091] The application first couples time decay and semantic association, introduces a path length penalty term in the correlation degree calculation, solves the problem of ignoring indirect association in traditional methods, makes the weight of long path association exponentially decay, immediately cuts off the weight when exceeding the storage period, and avoids the risk of misjudgment of expired archives.

[0092] Optionally, the current content sensitivity corresponding to the current digital archive is determined according to each current weight corresponding to all entities and each preset leakage influence factor, including:

[0093] For any entity, according to the security level of the entity, a preset leakage influence factor corresponding to the entity is determined from a preset relationship between the security level and the leakage influence factor;

[0094] The weighted value of the entity is determined according to the current weight corresponding to the entity and the preset leakage influence factor;

[0095] The weighted values of each entity are determined, and the current content sensitivity corresponding to the current digital archive is obtained by summing up each weighted value corresponding to all entities.

[0096] Optionally, the current content sensitivity corresponding to the current digital archive can be calculated according to the following formula:

[0097] ;

[0098] wherein, is the current content sensitivity, is a normalization coefficient, is a preset leakage influence factor, is the number of entities, is the current weight corresponding to the entity, wherein the preset leakage influence factor is associated with the security level of the entity, and specifically, is determined from a preset relationship between the security level and the leakage influence factor according to the security level of the entity, for example, the leakage influence factor of an entity with a confidential security level can be 1, the leakage influence factor of an entity with a secret security level can be 0.5, the leakage influence factor of an entity with an ordinary security level can be 0.3, and so on.

[0099] Optionally, before inputting the current content sensitivity corresponding to the current digital archive, the propagation path risk value, and the carrier vulnerability value into the preset sensitive information leakage prediction model, the method further comprises:

[0100] calculating the node importance using the PageRank algorithm to obtain a node importance value, determining a propagation path quotient value according to the node importance value and the diameter of the knowledge graph, determining a propagation path parameter value according to the path entropy and the complexity suppression coefficient, and determining the propagation path risk value according to the propagation path quotient value and the propagation path parameter value;

[0101] counting the verification results of the current digital archive within a preset time period, determining a pass number weighted value according to the pass numbers in different time periods and the analysis weights corresponding to the different time periods, determining a total attempt number weighted value according to the total attempt numbers in different time periods and the analysis weights corresponding to the different time periods, determining a verification pass rate according to the pass number weighted value and the total attempt number weighted value, and determining the carrier vulnerability value according to the verification pass rate;

[0102] The analysis weights corresponding to the different time periods are determined according to the number of days from the different time periods in the preset time period to the current time.

[0103] Optionally, the node importance is calculated using the PageRank algorithm, and the nodes linked by important nodes have more influence, and the calculation of the propagation path risk value can refer to the following formula:

[0104] ;

[0105] wherein, is a propagation path risk value, is a node importance value, is a knowledge graph diameter, is a complexity inhibition coefficient, is a path entropy.

[0106] Optionally, the analysis weight corresponding to the different time periods is determined according to the number of days from the different time periods in the preset time period to the current time:

[0107] ;

[0108] wherein, is the analysis weight corresponding to the different time periods, is the number of days from the different time periods in the preset time period to the current time.

[0109] Optionally, the carrier vulnerability value can refer to the following formula:

[0110] ;

[0111] wherein, is a carrier vulnerability value, is the total number of different time periods, is a different time period, is the number of passes in the different time period, is the total number of attempts in the different time period.

[0112] In an optional embodiment, assuming that the digital archive of the present application is an engine design drawing, it is known to contain 3 confidential entities (I = 1.0) and 5 ordinary entities (I = 0.3), wherein the dynamic weight matrix Wt = [2.1, 1.8, 1.5, 0.4, 0.3, 0.2, 0.1], the propagation path is: design drawing → R&D center (PR = 8.2) → test station (PR = 6.5), recent 7-day access: number of attempts = 42, number of passes = 35, at this time, the calculation process of the content sensitivity can be S = (2.1 x 1.0) + (1.8 x 1.0) + (1.5 x 1.0) + (0.4 x 0.3) + (0.3 x 0.3) + (0.2 x 0.3) + (0.1 x 0.3) = 5.58, the propagation path risk , the pass rate = 35 / 42 ≈ 0.83, the carrier vulnerability V = 1-0.83 = 0.17, and then the risk vector R = (5.58, 0.31, 0.17) composed of the current content sensitivity, the propagation path risk value and the carrier vulnerability value corresponding to the current digital archive is obtained.

[0113] In an optional embodiment, the application can also obtain the propagation path risk value by other means, such as directly using the number of connections (degree) of the node and the node type to evaluate the propagation risk, using the degree of the current node, that is, the number of connection edges, divided by the maximum degree of all nodes in the knowledge graph, and combining the node type weight to obtain the propagation path risk value, or evaluating the risk through the shortest path length from the node to the sensitive entity, if the shortest path from the node to the core sensitive entity (such as a top secret file) is ≤2 hops, the risk value is set to 1.0, and the risk value is attenuated by 0.2 for each additional 1 hop (such as 3 hops risk = 0.8); the application can also obtain the carrier vulnerability value by other means, such as counting the number of accesses to the carrier within a unit of time, the higher the frequency, the higher the vulnerability, or directly checking the password policy strength of the storage carrier and calling the ready-made password strength library for quick scoring. By introducing node degree, path length, access frequency, password strength, and other simplified technical means, the application significantly improves the flexibility and applicability of the scheme while ensuring the core innovation. These methods can be used alone or combined with the original scheme to meet the performance, accuracy, and compliance requirements in different scenarios.

[0114] In step 104, the application trains the initial leakage prediction model according to the historical content sensitivity, the historical propagation path risk value, and the historical carrier vulnerability value, and the historical sensitive information leakage risk degree, to obtain a preset sensitive information leakage prediction model, so that inputting the current content sensitivity, the propagation path risk value, and the carrier vulnerability value corresponding to the current digital file into the preset sensitive information leakage prediction model can obtain the sensitive information leakage risk degree output by the preset sensitive information leakage prediction model.

[0115] In other embodiments, other formulas such as weighted algorithms can also be used, and after obtaining the sensitive information leakage risk degree output by the preset sensitive information leakage prediction model, the method further includes:

[0116] In the case where the sensitive information leakage risk degree is greater than the preset risk value, a warning instruction is generated, and the warning instruction is used to instruct secondary encryption processing of the file information corresponding to the current digital file.

[0117] Optionally, the preset risk value threshold can be determined according to historical data training and business scene dynamic adjustment, for example, the initial value is set by the mean value of the risk degree of historical leakage cases, which can be 0.7, and the threshold value is periodically updated by a sliding window algorithm based on recent risk data and industry compliance requirements, when the sensitive information leakage risk degree output by the preset sensitive information leakage prediction model meets the condition that the sensitive information leakage risk degree is greater than the preset risk value threshold, a warning is triggered, and the secondary encryption can be symmetric encryption or asymmetric encryption.

[0118] The application realizes comprehensive quantitative evaluation of sensitive information leakage risk by fusing three-dimensional index of content sensitivity, propagation path risk and carrier vulnerability, breaks through the limitation of traditional single-dimensional analysis, especially introduces time decay factor and context correlation degree, so that the weight calculation can dynamically adapt to the change of file classification level and semantic association scene, improves the real-time and accuracy of evaluation, and provides a scientific basis for formulating protection strategies in advance through the preset leakage prediction model output risk degree, reduces the potential leakage loss; the three-dimensional risk of content, path and carrier is included in the unified evaluation framework, the one-sidedness problem of traditional method is solved, the weight dynamic adjustment and three-dimensional scene modeling technology make the risk evaluation adapt to the change of file classification level and content in the whole life cycle, compared with the prior art, the application has significant advantages in evaluation dimension, dynamic adaptability and response decision support, and provides a new generation of technical solutions for digital archive security management.

[0119] Figure 2 It is the structure schematic view of the sensitive information leakage prediction system based on digital archives provided by the application, the sensitive information leakage prediction system based on digital archives includes a construction unit 1, the construction unit 1 is used for determining the pointing entity associated with each entity in the current digital archive corresponding archive information from the preset digital archive library according to the preset data association rule, and constructing a relationship edge set according to the entity, the entity relationship and the pointing entity, the working principle of the construction unit 1 can refer to the preceding step 101, and details are not repeated here.

[0120] The sensitive information leakage prediction system based on digital archives also includes a calculation unit 2, the calculation unit 2 is used for calculating the cosine similarity of the entity and the pointing entity, determining the initialization weight of the entity according to the common occurrence frequency of the entity and the pointing entity, the number of connection edges of the entity, the number of connection edges of the pointing entity and the cosine similarity, the working principle of the calculation unit 2 can refer to the preceding step 102, and details are not repeated here.

[0121] The digital archive-based sensitive information leakage prediction system further comprises a determination unit 3 configured to determine a current weight corresponding to the entity according to the initial weight of the entity, a time decay factor and a context correlation degree, traverse all entities in the archive information, and determine a current content sensitivity corresponding to the current digital archive according to each current weight corresponding to all entities and each preset leakage influence factor, wherein the time decay factor is determined according to a historical effective time of the current archive information and a current acquisition time, and the working principle of the determination unit 3 can refer to the foregoing step 103, which is not described here in detail.

[0122] The digital archive-based sensitive information leakage prediction system further comprises an output unit 4 configured to input the current content sensitivity corresponding to the current digital archive, a propagation path risk value and a carrier vulnerability value into a preset sensitive information leakage prediction model, and obtain a sensitive information leakage risk degree output by the preset sensitive information leakage prediction model, and the working principle of the output unit 4 can refer to the foregoing step 104, which is not described here in detail.

[0123] The application realizes comprehensive quantitative evaluation of sensitive information leakage risk by fusing three-dimensional indicators of content sensitivity, propagation path risk and carrier vulnerability, breaks through the limitation of traditional single-dimensional analysis, especially introduces a time decay factor and a context correlation degree, so that weight calculation can dynamically adapt to archive classification level changes and semantic correlation scenarios, and the real-time performance and accuracy of evaluation are improved, the risk degree is output through a preset leakage prediction model, a scientific basis is provided for formulating a protection strategy in advance, potential leakage loss is reduced, three-dimensional risks of content, path and carrier are included in a unified evaluation framework, the one-sidedness problem of traditional methods is solved, weight dynamic adjustment and three-dimensional scene modeling technology enable risk evaluation to adapt to classification level and content changes in the whole life cycle of the archive, compared with the prior art, the application has significant advantages in evaluation dimension, dynamic adaptability and response decision support, and provides a new generation of technical solutions for digital archive security management.

[0124] Figure 3 It is a structural schematic diagram of an electronic device provided by the application. Figure 3As shown, the electronic device can include a processor 110, a communications interface 120, a memory 130, and a communications bus 140, wherein the processor 110, the communications interface 120, and the memory 130 complete mutual communication through the communications bus 140. The processor 110 can invoke a logical instruction in the memory 130 to execute a sensitive information leakage prediction method based on a digital archive, which includes: for each entity in archive information corresponding to a current digital archive, determining a pointing entity associated with the entity from a preset digital archive library according to a preset data association rule, and constructing a relationship edge set according to the entity, an entity relationship, and the pointing entity; calculating a cosine similarity of the entity and the pointing entity, determining an initialization weight of the entity according to a common occurrence frequency of the entity and the pointing entity, a connection edge number of the entity, a connection edge number of the pointing entity, and the cosine similarity; determining a current weight corresponding to the entity according to the initialization weight of the entity, a time decay factor, and a context correlation degree, traversing all entities in the archive information, and determining a current content sensitivity corresponding to the current digital archive according to each current weight corresponding to all entities and each preset leakage influence factor; the time decay factor is determined according to a historical effective time of the current archive information and a current acquisition time; inputting the current content sensitivity corresponding to the current digital archive, a propagation path risk value, and a carrier vulnerability value to a preset sensitive information leakage prediction model to obtain a sensitive information leakage risk degree output by the preset sensitive information leakage prediction model.

[0125] In addition, the logical instruction in the memory 130 described above can be implemented in the form of a software function unit and sold or used as an independent product, and can be stored in a computer-readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or part of the technical solutions can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a plurality of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in various embodiments of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0126] In another aspect, the present application also provides a computer program product, which comprises a computer program, the computer program being stored in a non-transitory computer readable storage medium, and the computer program being executable by a processor to cause a computer to execute a sensitive information leakage prediction method based on a digital archive, the method comprising: for each entity in archive information corresponding to a current digital archive, determining a pointing entity associated with the entity from a preset digital archive library according to a preset data association rule, and constructing a relationship edge set according to the entity, an entity relationship, and the pointing entity; calculating a cosine similarity between the entity and the pointing entity, determining an initial weight of the entity according to a common occurrence frequency of the entity and the pointing entity, a number of connection edges of the entity, a number of connection edges of the pointing entity, and the cosine similarity; determining a current weight corresponding to the entity according to the initial weight of the entity, a time decay factor, and a context correlation degree, traversing all entities in the archive information, and determining a current content sensitivity corresponding to the current digital archive according to each current weight corresponding to each entity and each preset leakage influence factor, the time decay factor being determined according to a historical effective time of the current archive information and a current acquisition time; inputting the current content sensitivity corresponding to the current digital archive, a propagation path risk value, and a carrier vulnerability value into a preset sensitive information leakage prediction model, and obtaining a sensitive information leakage risk degree output by the preset sensitive information leakage prediction model.

[0127] In yet another aspect, the present application also provides a non-transitory computer readable storage medium having stored thereon a computer program, which, when executed by a processor, implements a method for predicting sensitive information leakage based on a digital archive, the method comprising: for each entity in archive information corresponding to a current digital archive, determining a pointing entity associated with the entity from a preset digital archive library according to a preset data association rule, and constructing a relationship edge set according to the entity, an entity relationship, and the pointing entity; calculating a cosine similarity of the entity and the pointing entity, determining an initial weight of the entity according to a number of common occurrences of the entity and the pointing entity, a number of connection edges of the entity, a number of connection edges of the pointing entity, and the cosine similarity; determining a current weight corresponding to the entity according to the initial weight of the entity, a time decay factor, and a context correlation degree, traversing all entities in the archive information, and determining a current content sensitivity of the current digital archive according to each current weight corresponding to all entities and each preset leakage influence factor, the time decay factor being determined according to a historical effective time of the current archive information and a current acquisition time; inputting the current content sensitivity of the current digital archive, a propagation path risk value, and a carrier vulnerability value into a preset sensitive information leakage prediction model to obtain a sensitive information leakage risk degree output by the preset sensitive information leakage prediction model.

[0128] The device embodiments described above are merely illustrative, wherein the units described as separate components can or can not be physically separate, and the components displayed as units can or can not be physical units, i.e., can be located in one place, or can be distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the embodiment scheme according to actual needs. Those skilled in the art can understand and implement without creative labor.

[0129] From the above description of the embodiments, those skilled in the art can clearly understand that the embodiments can be realized by means of software plus necessary universal hardware platforms, and of course can also be realized by hardware. Based on such understanding, the above technical solutions, essentially or in other words, the part that contributes to the prior art, can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the methods described in each embodiment or some parts of the embodiments.

[0130] It should be pointed out finally that the above embodiments are only used to illustrate the technical solutions of the present application, but not to limit the same; and although the present application has been described in detail with reference to the foregoing embodiments, it should be appreciated by those skilled in the art that the technical solutions recorded in the foregoing embodiments can be modified, or some technical features thereof can be replaced equivalently; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for predicting the leakage of sensitive information based on digital archives, characterized in that, include: For each entity in the current digital archive corresponding to the archive information, determine the pointing entity associated with the entity from the preset digital archive database according to the preset data association rules, and construct a set of relationship edges based on the entity, entity relationship and pointing entity; Calculate the cosine similarity between the entity and the pointing entity, and determine the initial weight of the entity based on the number of times the entity and the pointing entity co-occur, the number of connecting edges of the entity, the number of connecting edges of the pointing entity, and the cosine similarity. The current weight of the entity is determined based on the initial weight, time decay factor and contextual relevance of the entity. All entities in the archive information are traversed. The current content sensitivity of the current digital archive is determined based on each current weight of each entity and each preset leakage impact factor. The time decay factor is determined based on the historical effective time and current acquisition time of the current archive information. Input the current content sensitivity, propagation path risk value, and carrier vulnerability value corresponding to the current digital file into the preset sensitive information leakage prediction model to obtain the degree of sensitive information leakage risk output by the preset sensitive information leakage prediction model; Before inputting the current content sensitivity, propagation path risk value, and carrier vulnerability value corresponding to the current digital file into the preset sensitive information leakage prediction model, the method further includes: The importance of nodes is calculated using the PageRank algorithm to obtain node importance values. Based on the node importance values ​​and the diameter of the knowledge graph, the propagation path quotient is determined. Based on the path entropy and the complexity suppression coefficient, the propagation path parameter values ​​are determined. Based on the propagation path quotient and the propagation path parameter values, the propagation path risk value is determined. The verification results of the current digital archive within a preset time period are statistically analyzed. The weighted value of the number of passes is determined based on the number of passes in different time periods and the analysis weights corresponding to different time periods. The weighted value of the total number of attempts is determined based on the total number of attempts in different time periods and the analysis weights corresponding to different time periods. The verification pass rate is determined based on the weighted value of the number of passes and the weighted value of the total number of attempts. The vulnerability value of the carrier is determined based on the verification pass rate. The analysis weights corresponding to the different time periods are determined based on the number of days between the different time periods in the preset duration and the current time.

2. The method for predicting the leakage of sensitive information based on digital archives according to claim 1, characterized in that, The entities include archive entities, personnel entities, and equipment entities. Before determining the associated pointing entity from a preset digital archive database according to preset data association rules, the method further includes: Construct the preset digital archive and update the preset digital archive in real time; Obtain the archive information corresponding to the current digital archive, perform entity extraction on the archive information, and obtain the archive entity, the personnel entity, and the equipment entity; Each entity includes an ID attribute, a confidentiality level, a retention period, and a storage location.

3. The method for predicting the leakage of sensitive information based on digital archives according to claim 1, characterized in that, The entity relationships include membership, access, and derivative relationships. The step of determining the associated entity from a preset digital archive based on preset data association rules includes: If a target field in the file information matches a first preset field, the membership relationship between the target field and the first preset field is determined. If an operation record for the target field exists in the access log of the archive information, determine the access relationship between the visitor and the target field; If a target field is associated with a second preset field in the file information, the derivation relationship between the target field and the second preset field is determined.

4. The method for predicting the leakage of sensitive information based on digital archives according to claim 1, characterized in that, The step of determining the initial weight of the entity based on the number of times the entity and the pointing entity co-occur together, the number of connecting edges of the entity, the number of connecting edges of the pointing entity, and the cosine similarity includes: The number of connecting edges of the entity and the number of connecting edges pointing to the entity are determined based on the set of relational edges, and the connecting edge product value is determined based on the product of the number of connecting edges of the entity and the number of connecting edges pointing to the entity. The square root of the product value of the connecting edges is taken to obtain the squared value of the connecting edges. The weight quotient is determined based on the quotient of the number of common occurrences and the squared value of the connecting edges. The initial weight of the entity is determined based on the weight quotient and the cosine similarity.

5. The method for predicting the leakage of sensitive information based on digital archives according to claim 1, characterized in that, Before determining the current weight of the entity based on its initial weight, time decay factor, and contextual relevance, the method further includes: The decay rate parameter is determined based on the confidentiality level of the current archive information, the time difference is determined based on the historical effective time and the current acquisition time of the current archive information, and the time decay factor corresponding to the entity is determined based on the decay rate parameter and the time difference. Determine all neighboring nodes corresponding to the entity, calculate the cosine similarity between the entity and any neighboring node, and determine the contextual association degree based on the sum of all cosine similarities and the number of edges of the shortest path between the two nodes.

6. The method for predicting the leakage of sensitive information based on digital archives according to claim 1, characterized in that, The step of determining the current weight of an entity based on its initial weight, time decay factor, and contextual relevance includes: ； The current weight corresponding to the entity. The time decay factor, For contextual relevance, This is the initial weight adjustment coefficient. Initialize the weights for the entity.

7. The method for predicting the leakage of sensitive information based on digital archives according to claim 1, characterized in that, The step of determining the current content sensitivity of the current digital file based on each current weight corresponding to all entities and each preset leakage impact factor includes: For any entity, based on the entity's confidentiality level, a preset leakage impact factor corresponding to the entity is determined from the preset relationship between confidentiality level and leakage impact factor; The weighted value of the entity is determined based on the current weight of the entity and the preset leakage impact factor; Iterate through all entities, determine the weighted value for each entity, and sum the weighted values ​​for each entity to obtain the current content sensitivity corresponding to the current digital file.

8. The method for predicting the leakage of sensitive information based on digital archives according to claim 1, characterized in that, After obtaining the level of sensitive information leakage risk output by the preset sensitive information leakage prediction model, the method further includes: If the risk of leakage of the sensitive information exceeds a preset risk value, an early warning instruction is generated. The early warning instruction is used to instruct the file information corresponding to the current digital file to be encrypted again.

9. A sensitive information leakage prediction system based on digital archives, characterized in that, include: The construction unit is used to determine the pointing entity associated with each entity in the archive information corresponding to the current digital archive from the preset digital archive database according to the preset data association rules, and construct a set of relationship edges based on the entity, entity relationship and pointing entity; The calculation unit is used to calculate the cosine similarity between the entity and the pointing entity, and to determine the initial weight of the entity based on the number of times the entity and the pointing entity co-occur, the number of connecting edges of the entity, the number of connecting edges of the pointing entity, and the cosine similarity. The determining unit is used to determine the current weight of the entity based on the initial weight of the entity, the time decay factor and the context association degree, traverse all entities in the archive information, and determine the current content sensitivity of the current digital archive based on each current weight of all entities and each preset leakage impact factor. The time decay factor is determined based on the historical effective time and the current acquisition time of the current archive information. The output unit is used to input the current content sensitivity, propagation path risk value and carrier vulnerability value corresponding to the current digital file into the preset sensitive information leakage prediction model, and obtain the sensitive information leakage risk level output by the preset sensitive information leakage prediction model. Before inputting the current content sensitivity, propagation path risk value, and carrier vulnerability value corresponding to the current digital file into the preset sensitive information leakage prediction model, the system further includes: The importance of nodes is calculated using the PageRank algorithm to obtain node importance values. Based on the node importance values ​​and the diameter of the knowledge graph, the propagation path quotient is determined. Based on the path entropy and the complexity suppression coefficient, the propagation path parameter values ​​are determined. Based on the propagation path quotient and the propagation path parameter values, the propagation path risk value is determined. The verification results of the current digital archive within a preset time period are statistically analyzed. The weighted value of the number of passes is determined based on the number of passes in different time periods and the analysis weights corresponding to different time periods. The weighted value of the total number of attempts is determined based on the total number of attempts in different time periods and the analysis weights corresponding to different time periods. The verification pass rate is determined based on the weighted value of the number of passes and the weighted value of the total number of attempts. The vulnerability value of the carrier is determined based on the verification pass rate. The analysis weights corresponding to the different time periods are determined based on the number of days between the different time periods in the preset duration and the current time.

Images