Intelligent safety management and control system for data desensitization and risk assessment

Abstract

The invention discloses an intelligent safety management and control system for data desensitization and risk assessment, relates to the technical field of data analysis, and aims to automatically identify and classify sensitive data by introducing artificial intelligence and big data analysis technologies, dynamically assess safety risks in data use and transmission processes in combination with an intelligent risk assessment model, and improve the safety of data desensitization and risk assessment. Comprising a data acquisition module, a feature extraction module, a risk assessment module, a dynamic early warning module, a rule optimization module and a data desensitization processing module, the processing process of sensitive data can be monitored, managed and controlled in real time, it is ensured that regular denial of service attacks are prevented, the data security and compliance are effectively improved, and through accurate risk assessment and dynamic adjustment of a desensitization strategy, the security and compliance of the sensitive data are improved. According to the method, the efficiency and accuracy of the data processing flow are optimized, the safety risk is remarkably reduced, and the system stability is improved.

Description

Technical Field

[0001] The present invention relates to the field of data analysis technology, and in particular to an intelligent security management and control system for data desensitization and risk assessment. Background Art

[0002] Intelligent security management for data desensitization and risk assessment involves the automated identification, classification, and desensitization of sensitive data through the use of artificial intelligence (AI) and big data analytics. Combined with intelligent risk assessment models, it dynamically assesses security risks during data use and transmission, enabling intelligent monitoring and policy control throughout the entire process. This improves the efficiency and accuracy of data security management and ensures compliance and security for enterprises or organizations throughout their data processing. Regular expressions are a common technique for identifying sensitive data. However, improperly designed regular expressions, particularly when processing large amounts of text, maliciously constructed input, or highly concurrent log streams, can easily trigger regular expression denial of service (ReDoS) attacks. These attacks, through complex or malformed input, trigger exponential backtracking in the regular expression engine, rapidly exhausting system resources (such as the CPU) and ultimately causing scanning services to stall or crash. If exploited by attackers, these vulnerabilities could not only disrupt the sensitive data detection process but also potentially paralyze the entire security protection system, posing serious business and security risks. Summary of the Invention

[0003] The purpose of the present invention is to provide an intelligent security management and control system for data desensitization and risk assessment to address the shortcomings of the background technology.

[0004] In order to achieve the above-mentioned object, the present invention provides the following technical solutions: an intelligent security management and control system for data desensitization and risk assessment, comprising a data acquisition module, a feature extraction module, a risk assessment module, a dynamic early warning module, a rule optimization module and a data desensitization processing module; The data collection module is used to collect text data and regular expressions used in the target data source containing sensitive information, and mark whether regular denial of service exceptions are caused in the historical data; The feature extraction module is used to extract the grammatical structure features of regular expressions, including nested depth outliers; and to extract disturbance features of input data, including special character density outliers; The risk assessment module is used to input the extracted regular expression features and input perturbation features into a pre-trained risk assessment model and output the probability value of the corresponding combination triggering a ReDoS attack; A dynamic warning module, configured to determine whether there is a ReDoS risk based on the output of the risk assessment module and issue a warning signal if the risk is higher than a set threshold; A rule optimization module is used to automatically replace or adjust the regular expression after triggering an early warning to reduce the complexity of regular backtracking; The data desensitization processing module is used to execute the desensitization strategy after identifying sensitive information through regular expressions and risk assessment models, and dynamically adjust the desensitization intensity and method in combination with the risk assessment model.

[0005] Preferably, the data collection module includes: collecting data from multiple data sources, including database systems, file systems, log systems and Web application logs; regularly or in real time collecting original input data containing sensitive information and usage environment context through sampling strategies, and the sampling strategies include timed sampling, exception-triggered sampling and sampling by user role.

[0006] Preferably, the data collection module includes: collecting input samples used in the regular expression matching process, recording the original input string, matching results, matching time and running time, and accurately locating the matching position, monitoring whether excessive backtracking occurs, including abnormal increase in CPU usage, execution timeout and engine crash.

[0007] Preferably, the method for obtaining the nesting depth outlier is as follows: there are n regular expressions, and the nesting depth of each expression is , where i=1,2,...,n; calculate the mean of the nesting depth : ; Where, the standard deviation of the nesting depth : ; Calculate the Z-Score value of each sample as the nested depth outlier value, the expression is: ; Set the threshold th; if > th, then mark the i-th expression as an expression with abnormal nesting depth.

[0008] Preferably, the method for obtaining the special character density outlier is as follows: extract the special character density of the text sample, where the special character density is defined as the ratio of all special characters in the text to the total number of characters. For each sample, calculate its special character density. : ;in, For samples The number of special characters in the ; Set a neighbor number k, which means that each sample will consider its nearest k neighbors in terms of distance. For each sample , calculate the distance with all other samples, select the smallest k distances, and get the k-distance: for each sample , first calculate the reachable distance between the sample and its k neighbors , the reachable distance is defined as: ;in, It is a sample The k distance, It is a sample and Calculate the distance between samples The local reachable density LRD is: ;in, It is a sample The k nearest neighbors of Calculation sample The ratio of the local reachability density of to the local reachability density of its neighbors is the local reachability density, which is calculated as follows: ;in, It is a sample The local reachable density of It is a sample The local reachable density, select the threshold LOFthreshold to determine the abnormality, if >LOFthreshold, the sample is considered For an abnormal point, its special character density is taken as the special character density abnormal value.

[0009] Preferably, the risk assessment module is used to input the extracted regular expression features and input perturbation features into a pre-trained risk assessment model, and output the probability value of the corresponding combination triggering a ReDoS attack: The nested depth outliers and special character density outliers are converted into comprehensive feature vectors. The comprehensive feature vectors are used as input to the machine learning model. The machine learning model uses the ReDoS attack risk probability value label predicted by each set of comprehensive feature vectors as the prediction target. The training goal is to minimize the sum of the prediction errors for all ReDoS attack risk probability value labels. The machine learning model is trained until the sum of the prediction errors reaches convergence. The model training is stopped and the ReDoS attack risk probability value is determined based on the model output results. The machine learning model is a random forest model.

[0010] Preferably, in the dynamic warning module, when the ReDoS attack risk probability value exceeds a set threshold, a warning signal is issued, indicating that the risk of a ReDoS attack is high, and security protection measures are triggered according to the warning information; when the ReDoS attack risk probability value does not exceed the set threshold, no warning signal is issued, indicating that the risk of a ReDoS attack is low.

[0011] Preferably, in the data desensitization processing module, the desensitization intensity and method are dynamically adjusted based on the risk assessment results of the sensitive data. When the risk is low, a mask or replacement strategy is used, and when the risk is high, an encryption or complete replacement strategy is adopted.

[0012] In the above technical solution, the technical effects and advantages provided by the present invention are: 1. This invention combines artificial intelligence, big data analysis technologies, and intelligent risk assessment models to achieve automatic identification, classification, desensitization, and dynamic security management of sensitive data. This system performs real-time security assessment and desensitization of sensitive data, preventing ReDoS (Regular Denial of Service) attacks while ensuring the security and compliance of data processing. By integrating modules such as data collection, feature extraction, risk assessment, dynamic early warning, and rule optimization, combined with machine learning and real-time data analysis, the system significantly improves the efficiency and accuracy of data security management, ensuring stability and business continuity for enterprises or organizations during data processing.

[0013] 2. Through the intelligent management and control system of the present invention, the present invention can effectively identify potential ReDoS attack risks and dynamically adjust the desensitization strategy based on real-time risk assessment, thereby improving the accuracy and strength of data desensitization. The system's optimization and dynamic adjustment of regular expressions make it more efficient when processing large-scale text, malicious input, or highly concurrent log streams, avoiding excessive consumption of system resources. Ultimately, the present invention can improve data security while reducing the security threats and system performance bottlenecks caused by ReDoS attacks, ensuring that sensitive information is effectively protected. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments described in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0015] Figure 1 This is a mind map of the system modules of the present invention. DETAILED DESCRIPTION

[0016] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0017] For examples, see Figure 1 As shown, the intelligent security management and control system for data desensitization and risk assessment described in this embodiment includes a data acquisition module, a feature extraction module, a risk assessment module, a dynamic warning module, a rule optimization module and a data desensitization processing module; The data collection module is used to collect text data and regular expressions used in the target data source containing sensitive information, and mark whether regular denial of service exceptions are caused in the historical data; The feature extraction module is used to extract the grammatical structure features of regular expressions, including nested depth outliers; and to extract disturbance features of input data, including special character density outliers; The risk assessment module is used to input the extracted regular expression features and input perturbation features into a pre-trained risk assessment model and output the probability value of the corresponding combination triggering a ReDoS attack; A dynamic warning module, configured to determine whether there is a ReDoS risk based on the output of the risk assessment module and issue a warning signal if the risk is higher than a set threshold; A rule optimization module is used to automatically replace or adjust the regular expression after triggering an early warning to reduce the complexity of regular backtracking; The data desensitization processing module is used to execute the desensitization strategy after identifying sensitive information through regular expressions and risk assessment models, and dynamically adjust the desensitization intensity and method in combination with the risk assessment model.

[0018] The data acquisition module is used to provide the system with the raw data support required for risk assessment and model training. Its functions include but are not limited to target data source access, regular expression parsing, input sample recording, and ReDoS (regular denial of service) trigger annotation.

[0019] Supports the collection of actual data and rules from multiple data sources, including but not limited to: Database systems (such as MySQL, PostgreSQL, MongoDB, etc.); File systems (such as local directories, S3, NAS, etc.); Logging systems (such as ELK Stack, Splunk, and Kafka log streams); Web application logs, API gateway logs, etc. Use sampling strategies (such as timed sampling, exception-triggered sampling, and sampling by user role) to collect raw input data containing sensitive information and usage environment context regularly or in real time.

[0020] Automatically identify and collect regular expressions used in sensitive information detection, format verification, data desensitization, and other operations; Create a unique identifier (RegEx-ID) for each regular expression and associate it with metadata such as the module it belongs to, usage frequency, and execution context; Record the initial definition, version changes, number of calls, run history, and application scenarios (such as email detection and ID number recognition) of the expression; Collect input samples used in the regular expression matching process, including the original input string, matching results, matching time, running time, etc. Supports automatic segmentation of large text blocks (such as log entries, file contents, and form submission data) and precise location of matching positions; Record the execution path of each regular expression match, the engine processing steps, and whether excessive backtracking occurs (such as abnormally high CPU usage, execution timeout, engine crash, etc.).

[0021] Introduce a monitoring mechanism to capture the following exceptions related to regular operation in real time: The regular execution time exceeds the threshold (e.g., more than 500ms); Regular expression matching causes the CPU usage of the process to reach full load on a single core; Matching thread crashes, blocks, OOM errors, etc. Based on the above abnormal behavior, generate annotations for each "regular expression + input data" combination: Normal (0): No obvious performance issues; Suspicious (1): There is high resource usage but no crash; High risk (2): This could clearly trigger a ReDoS attack or cause the system to become unavailable.

[0022] This annotation serves as a supervised learning sample label for machine learning model training.

[0023] All collected data is formatted uniformly and stored in the feature database. The fields include: Summary of regular expression content and structure; Input sample content summary and length characteristics; Match context and run results; System resource consumption (time, CPU, memory); ReDoS trigger annotation; Input data that is too long or contains sensitive text is desensitized or summarized and compressed to ensure the compliance and controllability of training sample data.

[0024] Through the above design, the data collection module not only provides rich, real, and high-quality data for ReDoS risk modeling, but also provides interpretable support for regular expression optimization and dynamic security policies, significantly enhancing the stability and sustainability of the system in complex text processing scenarios.

[0025] The feature extraction module is used to perform static and dynamic feature analysis on the collected regular expressions and their corresponding input samples to support the subsequent machine learning model's assessment of ReDoS (regular denial of service) attack risks. Its main functions include regular grammar structure feature extraction, input perturbation feature analysis, and outlier detection.

[0026] For each regular expression, the module performs static analysis on its internal grammatical structure and extracts the following structural indicators: Nesting Depth Calculate the nesting levels of parentheses, quantifiers, and backtracking groups (such as capturing and non-capturing groups); Identify expressions exceeding a set threshold (e.g., >5 layers) as abnormal features with high structural complexity; Example feature names: nesting_depth_max, nesting_depth_avg.

[0027] Quantifier Density: Count the number and density of quantifiers in expressions such as *, +, {n,}, ?; Extract continuously nested quantifier structures, such as (.+)+ and (a|b|c)*+, as typical high-risk structures; Example feature names: quantifier_count, greedy_pattern_ratio.

[0028] Alternation Count: Count the usage frequency and average branch length of the "|" operator; The more complex the branch structure is, the more matching paths there are, and the heavier the computational burden on the regular expression engine is. Example feature names: alternation_count, alternation_depth_avg.

[0029] Backtracking Path Estimation: Construct finite state automata or directed graphs based on regular structures and estimate the theoretical maximum number of paths; When the number of paths exceeds the set threshold, it is marked as a high-risk structure; Example feature names: estimated_paths, backtrack_explosiveness_score.

[0030] The method for obtaining nested depth anomaly values ​​is as follows: suppose there are n regular expressions, and the nested depth of each expression is , where i=1,2,...,n; Calculate the mean of nesting depth (Average nesting level): ; Where, the standard deviation of the nesting depth (Volatility): ; Calculate the Z-Score value of each sample as the nested depth outlier (standardized outlier), the expression is: ; Set the threshold th (usually 2 or 3); if >th, the i-th expression is marked as an abnormal nested depth expression; the larger the abnormality, the more complex its structure is, and the higher the risk of potentially triggering a ReDoS attack.

[0031] Input data perturbation feature extraction: Perform semantic and structural perturbation analysis on the input data during regular matching to extract the following highly relevant features: Special Character Density; Count the proportion of regular metacharacters such as “.*+?|^$()[]{}\” in the input text; High-density special character input can easily trigger backtracking logic and cause ReDoS; Example feature names: special_char_ratio, meta_char_density; String length characteristics: Record the total length of the input string, the longest continuous repeated substring, the longest nested pattern, etc. Very long repetitive structures may cause regular expression processing time to increase exponentially; Example feature names: input_length, longest_repeated_substring; Disturbance Score: Based on the statistical average input feature value of the rule base, the deviation is calculated in combination with the current sample; Automatically label data with significant deviations as “abnormal disturbance input”; Example feature names: input_outlier_score, anomaly_deviation.

[0032] The method for obtaining the special character density outlier is to extract the special character density of the text sample. The special character density is defined as the ratio of all special characters (such as symbols, punctuation marks, numbers, etc.) in the total number of characters in the text. For each sample (such as text data), calculate its special character density. : ;in, For samples The number of special characters in .

[0033] Calculate the distance from a sample to its k nearest neighbors, called k-distance. Set a number of neighbors k (usually 5 or 10), which means that each sample will consider its k nearest neighbors in terms of distance. For each sample , calculate the distance with all other samples, select the smallest k distances, and get the k-distance: for each sample , first calculate the reachable distance between the sample and its k neighbors , the reachable distance is defined as: ;in, It is a sample The k distance, It is a sample and Then, calculate the distance between samples The local reachable density LRD is: ;in, It is a sample The k nearest neighbors of .

[0034] The local outlier factor LOF is used to measure the sample Is it an outlier? It is a sample The ratio of the local reachability density of to the local reachability density of its neighbors is calculated as follows: ;in, It is a sample The local reachable density of It is a sample The local reachable density. Usually a threshold LOFthreshold is selected to determine the anomaly. >LOFthreshold, the sample is considered For an abnormal point, its special character density is taken as the special character density abnormal value.

[0035] The risk assessment module is used to input the extracted regular expression features and input perturbation features into the pre-trained risk assessment model and output the probability value of the corresponding combination triggering a ReDoS attack: The nested depth outliers and special character density outliers are converted into comprehensive feature vectors. The comprehensive feature vectors are used as input to the machine learning model. The machine learning model uses the ReDoS attack risk probability value label predicted by each set of comprehensive feature vectors as the prediction target. The training goal is to minimize the sum of the prediction errors for all ReDoS attack risk probability value labels. The machine learning model is trained until the sum of the prediction errors reaches convergence. The model training is stopped and the ReDoS attack risk probability value is determined based on the model output results. The machine learning model is a random forest model.

[0036] When the ReDoS attack risk probability value exceeds the set threshold (such as 0.8), an early warning signal is issued, indicating that the risk of a ReDoS attack is high, and security protection measures are triggered based on the early warning information. When the ReDoS attack risk probability value does not exceed the set threshold (such as 0.8), no early warning signal is issued, indicating that the risk of a ReDoS attack is low.

[0037] The main function of the rule optimization module is to automatically adjust or replace regular expressions after the risk assessment module triggers an early warning, optimize its matching efficiency, reduce backtracking complexity, and prevent ReDoS (regular denial of service) attacks.

[0038] Input features: Regular expression features (such as nesting depth, quantifier density, number of branches, etc.). Input data features (such as special character density, length, repeated characters, etc.). Warning information output by the risk assessment module (such as ReDoS risk probability).

[0039] When the output of the risk assessment module exceeds a set threshold (for example, a ReDoS attack risk probability > 0.8), the rule optimization module kicks in and begins optimizing the relevant regular expressions. Certain regular expressions are marked as high-risk (e.g., with an excessively high Z-Score or LOF value).

[0040] The rule optimization module adopts the following optimization strategies based on the type of triggering warning: Remove unnecessary nesting: Simplify complex nested structures. For example, convert ((a|b|c)|d) to (a|b|c|d) to avoid unnecessary nested brackets.

[0041] Merge duplicate branches: If there are multiple similar branches in a regular expression, you can try to merge them. For example, optimize (a|b|c)* to [abc]* to reduce the complexity of duplicate branches.

[0042] Remove redundant quantifiers: Optimize the quantifiers in regular expressions and remove redundant ones. For example, (a|b){1,} can be optimized to (a|b)+, eliminating unnecessary duplicate matches.

[0043] Greedy quantifiers in regular expressions (such as * and +) can cause excessive backtracking in some cases, especially in long text or complex matches. You can adjust greedy quantifiers to lazy quantifiers (such as *? and +?), or use delimiters to limit the scope of the match.

[0044] For quantifiers (such as {n,m}), the maximum value can be appropriately reduced based on the actual data. For example, if a regular expression is used to match a user-entered mobile phone number, it can be limited to matching 10 digits to avoid meaningless long text matching.

[0045] By reordering the matching order in regular expressions, unnecessary backtracking is reduced. For example, when using multiple branches, the branches with higher probability are matched first to avoid entering complex paths during backtracking.

[0046] Capturing groups (()) often increase backtracking complexity, especially in complex regular expressions. If you don't need to return the matched substring, you can use non-capturing groups ((?:)) instead of capturing groups to reduce unnecessary backtracking.

[0047] Where possible, prefer non-greedy matching (such as *?, +?, etc.) to greedy matching (such as *, +, etc.) to reduce the complexity of backtracking. Non-greedy matching can stop when the first match is encountered, thus avoiding a large number of unnecessary matching attempts.

[0048] In some cases, complex regular expressions can be replaced by other more efficient algorithms or data structures. For example, state machines (such as DFA, NFA) or hash tables can be used to replace some highly complex regular expressions, especially when matching fixed-format data.

[0049] The optimized regular expression must ensure that it still matches the target data. The rule optimization module needs to undergo regression testing to ensure that the optimized regular expression significantly improves performance without affecting matching accuracy.

[0050] Through automated performance benchmark testing, we evaluate indicators such as the backtracking depth, matching efficiency, and CPU usage of regular expressions before and after optimization to ensure that the optimization is effective.

[0051] The optimized regular expression will be returned to the risk assessment module for further evaluation. If the optimized regular expression still has potential risks, it can be further optimized.

[0052] The core function of the data desensitization processing module is to identify sensitive information based on regular expressions and risk assessment models, execute desensitization strategies, and dynamically adjust the intensity and method of desensitization according to real-time risk assessment results.

[0053] Scan data using predefined regular expression patterns to identify fields or data items containing sensitive information, such as ID card numbers, bank card numbers, and mobile phone numbers.

[0054] The sensitivity of these data items is further analyzed using a risk assessment model. The model evaluates the risk of leakage for each sensitive data item and outputs a risk score, typically ranging from 0 to 1, with higher scores indicating a greater risk of leakage.

[0055] After sensitive information is identified by regular expressions and risk assessment models, the desensitization processing module selects an appropriate desensitization strategy based on the identified data items and risk assessment results.

[0056] Common desensitization strategies: Masking: Masking sensitive data with specific characters (such as "*"), usually used to partially hide data when displaying it.

[0057] Substitution: Replace sensitive information with irrelevant, random data. For example, replace the bank card number "1234-5678-9012-3456" with "---".

[0058] Generalization: Reducing precise data to a certain range or category. For example, generalizing "2025-04-25" to "2025".

[0059] Encryption: Sensitive data is stored in encrypted form and can only be decrypted by authorized users.

[0060] Tokenization: Replacing sensitive data with a random “token” that has no direct relationship to its original data, but can be mapped back to the original data in a controlled environment.

[0061] Adjust the intensity of desensitization based on the risk assessment results: Low risk (score 0-0.3): Masking intensity: A mild masking strategy is used for low-risk sensitive data, such as masking some fields (such as "1234---3456") to hide only part of the information while maintaining partial usability. For example, for a low-risk mobile phone number, only four digits might be masked, displaying "138****1234."

[0062] Medium risk (score 0.3-0.7): Masking strength: Use stronger masking measures, such as generalization or partial substitution. For medium-risk data, some fields may be replaced instead of displaying the actual data. Example strategy: For a credit card number, "--****-3456" could be used instead of the actual card number, while retaining the last four digits.

[0063] High Risk (score 0.7-1): Redaction Strength: Utilize the strongest redaction methods, such as complete replacement, encryption, or complete substitution with redaction tags. This data is no longer identifiable, and only authorized systems or users can access the original data. Example: For high-risk personal identification numbers, completely replace them with "---" or encrypt them.

[0064] Choose the most appropriate desensitization method based on different types of sensitive information: ID card number: Usually uses substitution or encryption method, completely replaced or encrypted storage.

[0065] Bank account information: Use generalization and masking strategies to display partial information while hiding sensitive parts.

[0066] Email addresses: can be masked by using a mask (e.g. ****@example.com).

[0067] Dynamically adjust the triggering conditions for desensitization strategies: Every time data is accessed or modified, a risk assessment of the data sensitivity is performed in real time to determine whether the desensitization intensity needs to be adjusted.

[0068] Dynamically adjust the redaction strength based on different user roles (e.g., administrator, ordinary user). For example, more detailed information can be displayed for users with advanced permissions.

[0069] Determine whether to increase the redaction strength based on the context of data access (such as access time, access device, access location, etc.). For example, if sensitive data is accessed from an external network, redaction strength will be increased.

[0070] Desensitized data is output based on real-time desensitization policies. For example, a user's bank card number might be displayed as "--****-3456." Detailed logs are recorded for each desensitization operation, including triggering conditions, data changes before and after desensitization, risk scores, and policy adjustments, for subsequent security audits and compliance checks.

[0071] The above formulas are all dimensionless and numerical calculations. The formulas are obtained by collecting a large amount of data and performing software simulation to obtain the most recent real situation. The preset parameters in the formulas are set by technicians in this field according to actual conditions.

[0072] The above is only a specific implementation method of the present application, but the scope of protection of the present application is not limited thereto. Any technician familiar with this technical field can easily think of changes or replacements within the technical scope disclosed in this application, which should be covered by the scope of protection of the present application.

Claims

1. An intelligent security management and control system for data desensitization and risk assessment, characterized by: It includes data acquisition module, feature extraction module, risk assessment module, dynamic warning module, rule optimization module and data desensitization processing module; The data collection module is used to collect text data and regular expressions used in the target data source containing sensitive information, and mark whether regular denial of service exceptions are caused in the historical data; The feature extraction module is used to extract the grammatical structure features of regular expressions, including nested depth outliers; and to extract disturbance features of input data, including special character density outliers; The risk assessment module is used to input the extracted regular expression features and input perturbation features into a pre-trained risk assessment model and output the probability value of the corresponding combination triggering a ReDoS attack; A dynamic warning module, configured to determine whether there is a ReDoS risk based on the output of the risk assessment module and issue a warning signal if the risk is higher than a set threshold; A rule optimization module is used to automatically replace or adjust the regular expression after triggering an early warning to reduce the complexity of regular backtracking; The data desensitization processing module is used to execute the desensitization strategy after identifying sensitive information through regular expressions and risk assessment models, and dynamically adjust the desensitization intensity and method in combination with the risk assessment model.

2. The intelligent security management and control system for data desensitization and risk assessment according to claim 1 is characterized by: The data collection module includes: collecting data from multiple data sources, including database systems, file systems, log systems and Web application logs; regularly or in real time collecting original input data containing sensitive information and usage environment context through sampling strategies, and the sampling strategies include timed sampling, exception-triggered sampling and sampling by user role.

3. The intelligent security management and control system for data desensitization and risk assessment according to claim 2 is characterized by: The data collection module includes: collecting input samples used in the regular expression matching process, recording the original input string, matching results, matching time and running time, accurately locating the matching position, and monitoring whether excessive backtracking occurs, including abnormal increase in CPU usage, execution timeout and engine crash.

4. The intelligent security management and control system for data desensitization and risk assessment according to claim 1 is characterized by: The method for obtaining nested depth anomaly values ​​is as follows: suppose there are n regular expressions, and the nested depth of each expression is , where i=1,2,...,n; calculate the mean of the nesting depth : ; Where, the standard deviation of the nesting depth : ; Calculate the Z-Score value of each sample as the nested depth outlier value, the expression is: ; Set the threshold th; if >th, the i-th expression is marked as an expression with abnormal nesting depth.

5. The intelligent security management and control system for data desensitization and risk assessment according to claim 4 is characterized by: The method for obtaining the special character density outlier is as follows: extract the special character density of the text sample. The special character density is defined as the ratio of all special characters in the text to the total number of characters. For each sample, calculate its special character density. : ;in, For samples The number of special characters in ; Set a neighbor number k, which means that each sample will consider its nearest k neighbors in terms of distance. For each sample , calculate the distance with all other samples, select the smallest k distances, and get the k-distance: for each sample , first calculate the reachable distance between the sample and its k neighbors , the reachable distance is defined as: ;in, It is a sample The k distance, It is a sample and Calculate the distance between samples The local reachable density LRD is: ;in, It is a sample The k nearest neighbors of Calculation sample The ratio of the local reachability density of to the local reachability density of its neighbors is the local reachability density, which is calculated as follows: ;in, It is a sample The local reachable density of It is a sample The local reachable density, select the threshold LOFthreshold to determine the abnormality, if >LOFthreshold, the sample is considered For an abnormal point, its special character density is taken as the special character density abnormal value.

6. The intelligent security management and control system for data desensitization and risk assessment according to claim 5 is characterized by: The risk assessment module is used to input the extracted regular expression features and input perturbation features into the pre-trained risk assessment model and output the probability value of the corresponding combination triggering a ReDoS attack: The nested depth outliers and special character density outliers are converted into comprehensive feature vectors. The comprehensive feature vectors are used as input to the machine learning model. The machine learning model uses the ReDoS attack risk probability value label predicted by each set of comprehensive feature vectors as the prediction target. The training goal is to minimize the sum of the prediction errors for all ReDoS attack risk probability value labels. The machine learning model is trained until the sum of the prediction errors reaches convergence. The model training is stopped and the ReDoS attack risk probability value is determined based on the model output results. The machine learning model is a random forest model.

7. The intelligent security management and control system for data desensitization and risk assessment according to claim 6 is characterized by: In the dynamic warning module, when the ReDoS attack risk probability value exceeds the set threshold, a warning signal is issued, indicating that the risk of a ReDoS attack is high, and security protection measures are triggered based on the warning information. When the ReDoS attack risk probability value does not exceed the set threshold, no warning signal is issued, indicating that the risk of a ReDoS attack is low.

8. The intelligent security management and control system for data desensitization and risk assessment according to claim 7 is characterized by: In the data desensitization processing module, the desensitization intensity and method are dynamically adjusted based on the risk assessment results of sensitive data. When the risk is low, masking or replacement strategies are used, while when the risk is high, encryption or complete replacement strategies are adopted.

Images