Intelligent security management and control system for data desensitization and risk assessment

Abstract

The application discloses an intelligent security management and control system for data desensitization and risk assessment, relates to the technical field of data analysis, and automatically identifies and classifies sensitive data by introducing artificial intelligence and big data analysis technology, dynamically evaluates security risks in the process of data use and transmission in combination with an intelligent risk assessment model, and comprises data collection, feature extraction, risk assessment, dynamic early warning, rule optimization and data desensitization processing modules, can realize real-time monitoring and control of the processing process of sensitive data, ensures that data security and compliance are effectively improved while preventing regular denial-of-service attacks, and dynamically adjusts the accuracy of risk assessment and desensitization strategies, thereby optimizing the efficiency and accuracy of the data processing process, significantly reducing security risks and improving system stability.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data analysis, in particular to an intelligent security management and control system for data desensitization and risk assessment. BACKGROUND

[0002] The intelligent security management and control of data desensitization and risk assessment refers to introducing artificial intelligence, big data analysis and other technical means to automatically identify, classify and desensitize sensitive data, dynamically assess the security risks in the process of data use and transmission by combining intelligent risk assessment models, and realize intelligent monitoring and strategy control in the whole process, so as to improve the efficiency and accuracy of data security management, and guarantee the compliance and security of enterprises or organizations in the process of data processing. In the process of sensitive data identification, using regular expression for pattern matching is a common technical means, but if the regular expression is designed improperly, especially when dealing with large-scale text, malicious input or high-concurrency log stream, it is easy to cause regular denial of service attack (ReDoS). The attack induces the regular engine to perform exponential backtracking by manufacturing complex or deformed input, which causes the system resources (such as CPU) to be quickly exhausted, eventually causing the scanning service to lag or crash. Once such problems are exploited by attackers, not only will the sensitive data detection process be interrupted, but also the entire security protection system may be paralyzed, causing serious business and security risks. SUMMARY

[0003] The purpose of the present application is to provide an intelligent security management and control system for data desensitization and risk assessment to solve the problems in the background art.

[0004] In order to achieve the above purpose, the present application provides the following technical scheme: an intelligent security management and control system for data desensitization and risk assessment, comprising a data acquisition module, a feature extraction module, a risk assessment module, a dynamic early warning module, a rule optimization module and a data desensitization processing module;

[0005] The data acquisition module is used to acquire text data in the target data source containing sensitive information and the regular expression used, and mark whether the regular denial of service exception is caused in the historical data;

[0006] The feature extraction module is used to extract the syntax structure features of the regular expression, including nested depth abnormal value; and extract the disturbance features of the input data, including special character density abnormal value;

[0007] The risk assessment module is used to input the extracted regular expression features and input disturbance features into a pre-trained risk assessment model, and output the probability value of causing ReDoS attack corresponding to the combination;

[0008] a dynamic early warning module, configured to determine whether there is a ReDoS risk according to the output of the risk assessment module, and issue a warning signal if the risk is higher than a set threshold;

[0009] a rule optimization module, configured to automatically replace or adjust the regular expression after triggering the warning to reduce the regular backtracking complexity;

[0010] a data desensitization processing module, configured to execute a desensitization strategy after identifying sensitive information through the regular expression and the risk assessment model, and dynamically adjust the desensitization strength and manner in combination with the risk assessment model.

[0011] Preferably, the data collection module comprises: collecting data from various data sources, including database systems, file systems, log systems and web application logs; collecting original input data containing sensitive information and use environment context through a sampling strategy, including timing sampling, exception triggering sampling and user role sampling.

[0012] Preferably, the data collection module comprises: collecting input samples used in the regular expression matching process, recording original input strings, matching results, matching time and running time, and accurately positioning the matching position, monitoring whether over-retrace phenomenon occurs, including CPU occupancy abnormally rising, execution timeout and engine crash.

[0013] Preferably, the method for obtaining the nested depth abnormal value is: there are n regular expressions, and the nested depth of each expression is denoted as , wherein i = 1, 2, …, n; the mean value of the nested depth is calculated as : ; in the formula, the standard deviation of the nested depth is : ; the Z-Score value of each sample is calculated as the nested depth abnormal value, and the expression is: ; a threshold value th is set; if > th, the i-th expression is marked as a nested depth abnormal expression.

[0014] Preferably, the method for obtaining the special character density abnormal value is: the special character density of the text sample is extracted, and the special character density is defined as the proportion of all special characters in the total number of characters; for each sample, the special character density is calculated as : ; wherein is the number of special characters in the sample ; a neighbor number k is set, representing that each sample will consider its nearest k neighbors in distance; for each sample Calculate the distance with all other samples, and select the k smallest distances to obtain the k-distance: for each sample First, calculate the reachability distance between the sample and its k neighbors. The reachable distance is defined as: ;in, It is a sample The distance of k, It is a sample and Calculate the distance between samples Locally accessible density (LRD): ;in, It is a sample k nearest neighbors;

[0015] Calculate samples The local accessibility density is the ratio of the local accessibility density of a point to the local accessibility density of its neighbors. The specific formula for calculation is as follows: ;in, It is a sample Locally achievable density, It is a sample The locally reachable density is used to determine anomalies by selecting a threshold, LOFthreshold. If the value is greater than LOFthreshold, then the sample is considered to be... If a point is an anomaly, its special character density is treated as an anomaly value for special character density.

[0016] Preferably, the risk assessment module is used to input the extracted regular expression features and input perturbation features into a pre-trained risk assessment model, and output the probability value of the corresponding combination triggering a ReDoS attack:

[0017] Nested depth outliers and special character density outliers are converted into comprehensive feature vectors. These comprehensive feature vectors are then used as input to a machine learning model. The machine learning model uses the prediction of ReDoS attack risk probability value labels for each set of comprehensive feature vectors as its prediction objective and minimizes the sum of prediction errors for all ReDoS attack risk probability value labels as its training objective. The machine learning model is trained until the sum of prediction errors converges, at which point the model training stops. The ReDoS attack risk probability value is determined based on the model output. The machine learning model is a random forest model.

[0018] Preferably, in the dynamic early warning module, when the probability value of a ReDoS attack risk exceeds a set threshold, an early warning signal is issued, indicating a high risk of a ReDoS attack, and security protection measures are triggered based on the early warning information; when the probability value of a ReDoS attack risk does not exceed the set threshold, no early warning signal is issued, indicating a low risk of a ReDoS attack.

[0019] Preferably, in the data desensitization processing module, the desensitization strength and mode are dynamically adjusted based on the risk assessment result of sensitive data, and when the risk is low, a masking or replacement strategy is used, while when the risk is high, an encryption or complete replacement strategy is adopted.

[0020] In the above technical solution, the present application provides technical effects and advantages:

[0021] 1. The present application realizes automatic identification, classification, desensitization processing and dynamic security control of sensitive data by combining artificial intelligence, big data analysis technology and intelligent risk assessment model. The system can perform real-time security assessment and desensitization processing on sensitive data, prevent ReDoS (Regular Denial of Service) attacks, and ensure the security and compliance of the data processing process. The system combines machine learning and real-time data analysis through data collection, feature extraction, risk assessment, dynamic early warning, rule optimization and other modules, significantly improves the efficiency and accuracy of data security management, and ensures the stability and business continuity of enterprises or organizations in the data processing process.

[0022] 2. The intelligent control system of the present application can effectively identify potential ReDoS attack risks and dynamically adjust the desensitization strategy according to real-time risk assessment, thereby improving the accuracy and strength of data desensitization. The optimization and dynamic adjustment of the regular expression by the system make it more efficient in processing large-scale text, malicious input or high-concurrency log stream, avoiding excessive consumption of system resources. Ultimately, the present application can improve data security while reducing security threats and system performance bottlenecks caused by ReDoS attacks, ensuring effective protection of sensitive information. BRIEF DESCRIPTION OF DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed in the embodiments will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments described in the present application, and other drawings can also be obtained by those skilled in the art based on these drawings.

[0024] Figure 1 The system module mind map of the present application. DETAILED DESCRIPTION

[0025] In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of protection of the present application.

[0026] Embodiments, please refer to Figure 1 The intelligent security management and control system for data desensitization and risk assessment described in the embodiments includes a data acquisition module, a feature extraction module, a risk assessment module, a dynamic early warning module, a rule optimization module, and a data desensitization processing module.

[0027] The data acquisition module is used to acquire text data in a target data source containing sensitive information and regular expressions used, and mark whether a regular denial of service exception is caused in historical data.

[0028] The feature extraction module is used to extract the syntax structure features of regular expressions, including nested depth abnormal values, and extract disturbance features of input data, including special character density abnormal values.

[0029] The risk assessment module is used to input the extracted regular expression features and input disturbance features into a pre-trained risk assessment model, and output probability values of corresponding combinations causing ReDoS attacks.

[0030] The dynamic early warning module is used to determine whether there is a ReDoS risk according to the output result of the risk assessment module, and if the risk is higher than a set threshold, an early warning signal is sent.

[0031] The rule optimization module is used to automatically replace or adjust the regular expression after triggering the early warning, so as to reduce the regular backtracking complexity.

[0032] The data desensitization processing module is used to execute a desensitization strategy after identifying sensitive information through regular expressions and a risk assessment model, and dynamically adjust the desensitization strength and mode in combination with the risk assessment model.

[0033] The data acquisition module is used to provide original data support required for risk assessment and model training of the system, and its functions include but are not limited to target data source access, regular expression analysis, input sample recording, and ReDoS (regular denial of service) trigger marking.

[0034] Data and rules actually used in multiple data sources are supported, including but not limited to:

[0035] Database systems (e.g., MySQL, PostgreSQL, MongoDB, etc.);

[0036] File systems (e.g., local directories, S3, NAS, etc.);

[0037] Log systems (e.g., ELK Stack, Splunk, Kafka log streams);

[0038] Web application logs, API gateway logs, etc.;

[0039] Periodically or in real-time collect raw input data containing sensitive information and usage environment context through sampling strategies (e.g., timed sampling, exception-triggered sampling, sampling by user role).

[0040] Automatically identify and collect regular expressions used in sensitive information detection, format verification, data desensitization, etc.

[0041] Establish a unique identifier (RegEx-ID) for each regular expression and associate it with metadata such as module, usage frequency, execution context, etc.

[0042] Record the initial definition, version changes, call frequency, running history, application scenarios (e.g., email detection, ID number recognition, etc.) of the expression;

[0043] Collect input samples used in the matching process of regular expressions, including original input strings, matching results, matching time, running time, etc.

[0044] Support automatic segmentation of large text blocks (e.g., log entries, file content, form submission data) and precise positioning of matching positions;

[0045] Record the execution path, engine processing steps of each regular matching, and whether there is excessive backtracking phenomenon (e.g., CPU usage abnormally high, execution timeout, engine crash, etc.).

[0046] Introduce monitoring mechanisms to capture the following exceptions related to regular expression running in real-time:

[0047] Regular execution time exceeds threshold (e.g., more than 500ms);

[0048] Regular matching causes process CPU usage up to single-core full load;

[0049] Matching thread crashes, blocks, OOM errors, etc.

[0050] Based on the above abnormal behaviors, generate annotations for each "regular expression + input data" combination:

[0051] Normal (0): No obvious performance problems;

[0052] Suspicious (1): There is high resource consumption but no crash;

[0053] High risk (2): Clearly triggers ReDoS attacks or renders the system unusable.

[0054] This annotation serves as a label for supervised learning samples, used for training machine learning models.

[0055] All collected data is formatted and stored in a feature database, including the following fields:

[0056] Summary of regular expression content and structure;

[0057] Input sample content summary and length features;

[0058] Match the context with the execution result;

[0059] System resource consumption (time, CPU, memory);

[0060] ReDoS trigger flag;

[0061] Input data that is too long or contains sensitive original text is anonymized or compressed to ensure the compliance and controllability of training sample data.

[0062] Through the above design, the data acquisition module not only provides rich, authentic, and high-quality data for ReDoS risk modeling, but also provides interpretability support for regular expression optimization and dynamic security strategies, significantly enhancing the stability and sustainability of the system in complex text processing scenarios.

[0063] The feature extraction module is used to perform static and dynamic feature analysis on the collected regular expressions and their corresponding input samples to support the subsequent machine learning model's assessment of ReDoS (regular expression denial of service) attack risks. Its main functions include regular expression syntax structure feature extraction, input perturbation feature analysis, and outlier detection.

[0064] For each regular expression, the module performs static analysis on its internal syntax structure and extracts the following structural metrics:

[0065] Nesting Depth;

[0066] Calculate the nesting level of parentheses, quantifiers, and backtracking groups (such as capturing and non-capturing groups);

[0067] Expressions exceeding a set threshold (e.g., >5 layers) are identified as anomalous features with high structural complexity.

[0068] Example feature names: nesting_depth_max, nesting_depth_avg.

[0069] Quantifier Density:

[0070] The number and density of quantifiers such as *, +, {n,},? in the statistical expression;

[0071] Extracting continuously nested quantifier structures such as (.+)+, (a|b|c)*+, as typical high-risk structures;

[0072] Feature name examples: quantifier_count, greedy_pattern_ratio.

[0073] Alternation Count:

[0074] Statistical frequency and average branch length of the “|” operator;

[0075] The more complex the branch structure, the more matching paths, and the heavier the regular engine calculation burden;

[0076] Feature name examples: alternation_count, alternation_depth_avg.

[0077] Backtracking Path Estimation:

[0078] Based on the regular structure, build a finite state automaton or directed graph to estimate the theoretical maximum path number;

[0079] Mark as a high-risk structure when the path number exceeds the set threshold;

[0080] Feature name examples: estimated_paths, backtrack_explosiveness_score.

[0081] The method for obtaining the nested depth outlier is: there are n regular expressions, and the nested depth of each expression is denoted as , where i = 1, 2,..., n;

[0082] Calculate the mean of the nested depth (Average nesting layer number): ; In the formula, the standard deviation of the nested depth (Volatility): ; Calculate the Z-Score value of each sample as the nested depth outlier (standardized abnormality), the expression is: ; Set the threshold value th (usually 2 or 3); if If the i-th expression is greater than the threshold, mark the i-th expression as a nested depth abnormal expression; the greater the abnormality, the more complex the structure, and the higher the risk of triggering a ReDoS attack.

[0083] Input data disturbance feature extraction:

[0084] Perform semantic and structural disturbance analysis on input data during regular matching to extract the following high-correlation features:

[0085] Special character density (Special Character Density);

[0086] Count the proportion of regular meta characters such as ".*+?|^$()[]{}\ " in the input text;

[0087] High-density special character input can easily trigger backtracking logic and cause ReDoS;

[0088] Feature name examples: special_char_ratio, meta_char_density;

[0089] String length features:

[0090] Record the total length of the input string, the longest repeated substring, and the longest nested pattern, etc.

[0091] Excessive repetition of structure can cause the processing time of regular expressions to rise exponentially;

[0092] Feature name examples: input_length, longest_repeated_substring;

[0093] Disturbance score:

[0094] Based on the rule base statistics average input feature value, combined with the current sample to calculate the deviation degree;

[0095] Data with significant deviation is automatically labeled as "abnormal disturbance input";

[0096] Feature name examples: input_outlier_score, anomaly_deviation.

[0097] The method for obtaining the special character density abnormal value is: extract the special character density of the text sample, and the special character density is defined as the proportion of all special characters (such as symbols, punctuation, numbers, etc.) in the total character number in the text. For each sample (for example, text data), calculate its special character density : ; wherein, For the sample The number of special characters in the sample.

[0098] The distance of a sample to its k nearest neighbors is calculated, called k-distance. Set a number of neighbors k (usually choose k to be 5 or 10), which means each sample will consider its k nearest neighbors in distance. For each sample , calculate the distance to all the rest of the samples, select the smallest k distances among them, get the k-distance: for each sample , first calculate the reachable distance of the sample to its k neighbors The reachable distance is defined as: ; where, is the k-distance of sample , is the distance between sample and . Then, calculate the local reachable density LRD of sample : ; where, is the k nearest neighbors of sample .

[0099] The local outlier factor LOF is used to measure whether a sample is an outlier. It is the ratio of the local reachable density of sample to the local reachable density of its neighbors, and the specific formula is: ; where, is the local reachable density of sample , is the local reachable density of sample . Usually, a threshold LOFthreshold is selected to determine the anomaly, if > LOFthreshold, then the sample is considered to be an outlier, and the special character density of the sample is taken as the special character density anomaly value.

[0100] The risk assessment module is used to input the extracted regular expression features and the input perturbation features into the pre-trained risk assessment model, and output the probability value of the corresponding combination causing ReDoS attack:

[0101] The nested depth abnormal value and the special character density abnormal value are converted into a comprehensive feature vector, the comprehensive feature vector is taken as an input of a machine learning model, the machine learning model takes each set of comprehensive feature vectors as a prediction target to predict ReDoS attack risk probability value labels, takes minimizing a sum of prediction errors of all ReDoS attack risk probability value labels as a training target, and trains the machine learning model until the sum of prediction errors converges, and stops model training, and determines a ReDoS attack risk probability value according to a model output result, wherein the machine learning model is a random forest model.

[0102] When the ReDoS attack risk probability value exceeds a set threshold (such as 0.8), a warning signal is sent out, prompting that the risk of ReDoS attack is high, and a security protection measure is triggered according to the warning information; when the ReDoS attack risk probability value does not exceed the set threshold (such as 0.8), no warning signal is sent out, indicating that the risk of ReDoS attack is low.

[0103] The main function of the rule optimization module is to automatically adjust or replace the regular expression after the risk assessment module triggers a warning, optimize the matching efficiency, and reduce the backtracking complexity to prevent ReDoS (regular denial of service) attacks.

[0104] Input features: features of regular expressions (such as nested depth, quantifier density, branch number, etc.). Features of input data (such as special character density, length, repeated characters, etc.). Warning information output by the risk assessment module (such as ReDoS risk probability).

[0105] When the output value of the risk assessment module exceeds a set threshold (for example, the risk probability value of ReDoS attack > 0.8), the rule optimization module is started to optimize the related regular expression. A specific regular expression is marked as a high-risk expression (such as a Z-Score value that is too high or a LOF value that is too large).

[0106] The rule optimization module adopts the following optimization strategies according to the type of triggering a warning:

[0107] Remove unnecessary nesting: Simplify complex nested structures. For example, convert ((a|b|c)|d) to (a|b|c|d) to avoid unnecessary parentheses nesting.

[0108] Merge duplicate branches: If there are multiple similar branches in the regular expression, try to merge them. For example, (a|b|c)* can be optimized to [abc]* to reduce the complexity of repeated branches.

[0109] Remove redundant quantifiers: Optimize the quantifiers in the regular expression and remove redundant quantifiers. For example, (a|b){1,} can be optimized to (a|b)+ to remove unnecessary repeated matching.

[0110] In some cases, greedy quantifiers (like * and +) in regular expressions can cause excessive backtracking, especially in long texts or complex matches. You can adjust greedy quantifiers to be lazy (like *? and +?) or use delimiters to limit the scope of matches.

[0111] For quantifiers (like {n,m}), you can appropriately reduce the maximum value based on the actual data. For example, if the regular expression is used to match user-entered mobile numbers, you can limit it to match 10 digits to avoid matching long texts that are meaningless.

[0112] By reordering the matching order in regular expressions, you can reduce unnecessary backtracking. For example, when using multiple branches, match the branch with higher probability first to avoid entering complex paths during backtracking.

[0113] Capture groups (()) often increase the complexity of backtracking, especially in complex regular expressions. If you don't need to return the matched substring, you can use non-capture groups ((?:)) instead of capture groups to reduce unnecessary backtracking.

[0114] Whenever possible, prefer non-greedy matching (like *?, +?, etc.) over greedy matching (like *, +, etc.) to reduce the complexity of backtracking. Non-greedy matching can stop as soon as the first matching item is encountered, thus avoiding a large number of unnecessary matching attempts.

[0115] In some cases, you can replace complex regular expressions with other more efficient algorithms or data structures. For example, use state machines (like DFA, NFA) or hash tables to replace some high-complexity regular matches, especially when matching fixed-format data.

[0116] Optimized regular expressions need to ensure that they can still match target data. The rule optimization module needs to perform regression testing to ensure that the optimized regular expressions have significantly improved performance while not affecting matching accuracy.

[0117] Through automated performance benchmarking, evaluate the backtracking depth, matching efficiency, CPU occupancy, and other indicators of regular expressions before and after optimization to ensure that the optimization is effective.

[0118] Optimized regular expressions are returned to the risk assessment module for further evaluation. If the optimized regular expressions still have potential risks, they can be further optimized.

[0119] The core function of the data de-sensitization processing module is to identify sensitive information based on regular expressions and risk assessment models, execute de-sensitization strategies, and dynamically adjust the strength and method of de-sensitization based on real-time risk assessment results.

[0120] The data is scanned by predefined regular expression patterns to identify fields or data items containing sensitive information. For example, ID numbers, bank card numbers, mobile phone numbers, etc.

[0121] Further analysis of the sensitivity of these data items is carried out through a risk assessment model. The model assesses the risk of each sensitive data item being leaked and outputs a risk score, usually ranging from 0 to 1, with a higher score indicating a greater risk of leakage.

[0122] When sensitive information is identified by regular expressions and risk assessment models, the desensitization processing module selects appropriate desensitization strategies based on the identified data items and risk assessment results.

[0123] Common desensitization strategies:

[0124] Masking: Cover sensitive data with specific characters (such as "*"), usually used for partial hiding when displaying data.

[0125] Substitution: Replace sensitive information with irrelevant, random data. For example, replace the bank card number "1234-5678-9012-3456" with "---".

[0126] Generalization: Reduce precise data to a certain range or category. For example, generalize "2025-04-25" to "2025".

[0127] Encryption: Store sensitive data in encrypted form, only authorized users can decrypt it.

[0128] Tokenization: Replace sensitive data with a random "token" that has no direct relationship with the original data, and the token can be mapped back to the original data in a controlled environment.

[0129] Adjust the desensitization intensity according to the risk assessment results:

[0130] Low risk (score 0-0.3): Desensitization intensity: For low-risk sensitive data, use light desensitization strategies, such as masking part of the field (such as "1234---3456"), only hide part of the information, to maintain part of the availability. Strategy example: For a low-risk mobile phone number, only mask 4 digits, i.e. show "138****1234".

[0131] Medium risk (score 0.3-0.7): Desensitization strength: Use stronger desensitization measures such as generalization or partial replacement. For medium-risk data, some fields may be replaced without showing real data. Strategy example: For a credit card number, replace the real card number with “--****-3456”, but still keep the last four digits.

[0132] High risk (score 0.7-1): Desensitization strength: Take the strongest desensitization way, such as complete replacement, encryption or completely replaced by desensitization mark. These data will no longer be identifiable, and only authorized systems or users can access the original data. Strategy example: For high-risk personal identity card number, use complete replacement “---” or encryption.

[0133] According to different types of sensitive information, choose the most suitable desensitization way:

[0134] Identity card number: usually use replacement or encryption, completely replace or encrypt storage.

[0135] Bank account information: use generalization and masking strategy, show part of the information and hide the sensitive part.

[0136] Email address: can be desensitized by masking (for example: ****@example.com).

[0137] Trigger conditions for dynamically adjusting desensitization strategy:

[0138] Risk assessment of data sensitivity in real time every time data access or modification, and decide whether to adjust the desensitization strength.

[0139] According to different user roles (such as administrator, ordinary user), dynamically adjust the desensitization strength. For example, for users with high-level permissions, more detailed information can be displayed.

[0140] According to the context of data access (such as data access time, access device, access location, etc.), decide whether to enhance the desensitization strength. For example, if sensitive data is accessed from an external network, the desensitization strength is enhanced.

[0141] According to the real-time desensitization strategy, output the desensitized data. For example, for a user's bank card number, it shows “--****-3456”. Record the detailed log of each desensitization operation, including trigger condition, data change before and after desensitization, risk score and strategy adjustment, etc. Information for subsequent security audit and compliance check.

[0142] The above formulas are dimensionless to calculate their numerical values. The formula is obtained by collecting a large amount of data to simulate the latest real situation. The preset parameters in the formula are set by the technicians in the field according to the actual situation.

[0143] The above descriptions are only specific embodiments of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art can easily think of changes or replacements within the technical range disclosed by the present application, which should be covered in the protection scope of the present application.

Claims

1. An intelligent security management and control system for data desensitization and risk assessment, characterized in that: The system comprises a data collection module, a feature extraction module, a risk assessment module, a dynamic early warning module, a rule optimization module, and a data desensitization processing module. The data collection module is configured to collect text data in a target data source containing sensitive information and a regular expression used, and mark whether a regular denial-of-service (ReDoS) exception is triggered in historical data. The feature extraction module is configured to extract syntax structure features of the regular expression, including nested depth abnormal values, and extract disturbance features of the input data, including special character density abnormal values. The risk assessment module is configured to input the extracted regular expression features and input disturbance features into a pre-trained risk assessment model to output a probability value of triggering a ReDoS attack corresponding to the combination. Specifically, the nested depth abnormal values and the special character density abnormal values are converted into a comprehensive feature vector, the comprehensive feature vector is taken as an input of a machine learning model, the machine learning model takes a ReDoS attack risk probability value label predicted from each comprehensive feature vector as a prediction target, minimizes a sum of prediction errors of all ReDoS attack risk probability value labels as a training target, trains the machine learning model until the sum of prediction errors converges, and stops the model training, and determines a ReDoS attack risk probability value according to a model output result, wherein the machine learning model is a random forest model. The dynamic early warning module is configured to determine whether there is a ReDoS risk according to an output result of the risk assessment module, and if the risk is higher than a set threshold, an early warning signal is sent. The rule optimization module is configured to automatically replace or adjust the regular expression after triggering the early warning to reduce regular backtracking complexity. The data desensitization processing module is configured to execute a desensitization strategy and dynamically adjust desensitization strength and mode in combination with the risk assessment model after identifying sensitive information through the regular expression and the risk assessment model. 2.The intelligent security management and control system for data de-sensitization and risk assessment of claim 1, wherein: The data collection module comprises collecting data from various data sources, including database systems, file systems, log systems, and Web application logs, and collecting original input data containing sensitive information and usage environment context through a sampling strategy, including timed sampling, abnormal trigger sampling, and user role sampling. 3.The intelligent security management and control system for data de-sensitization and risk assessment of claim 2, wherein: The data collection module comprises collecting input samples used in the regular expression matching process, recording original input strings, matching results, matching time, and running time consumption, and accurately positioning the matching position to monitor whether over-retrace phenomenon occurs, including abnormal increase of CPU occupancy, execution timeout, and engine crash. 4.The intelligent security management and control system for data de-sensitization and risk assessment of claim 1, wherein: The method for obtaining the abnormal value of the nesting depth is: there are n regular expressions, and the nesting depth of each expression is denoted as , wherein i=1, 2,..., n; the mean value of the nesting depth is calculated : ; wherein the standard deviation of the nesting depth is : ; the Z-Score value of each sample is calculated as the abnormal value of the nesting depth, and the expression is: ; a threshold value th is set; if , the i-th expression is marked as the abnormal expression of the nesting depth. 5.The intelligent security management and control system for data de-sensitization and risk assessment of claim 4, wherein: The method for obtaining the special character density abnormal value is: extracting the special character density of the text sample, the special character density is defined as the proportion of all special characters in the total number of characters, for each sample, the special character density is calculated : ; wherein is the number of special characters in the sample ; Set a number of neighbors k, representing each sample will consider its nearest k neighbors in distance, for each sample , compute the distance to all the rest of the samples, select the smallest k distances among them, get the k-distance: for each sample , first compute the reachable distance of the sample to its k neighbors , the reachable distance is defined as: ; where, is the k-distance of sample , is the distance between sample and , compute the local reachable density LRD of sample : ; where, is the k nearest neighbors of sample ; The local reachable density of the sample is the ratio of the local reachable density of the sample to the local reachable density of its neighbors, i.e., the local outlier factor, and the specific calculation formula is: wherein, is the local reachable density of the sample is the local reachable density of the sample , a threshold value LOFthreshold is selected to determine the anomaly, if > LOFthreshold, the sample is considered as an outlier point, and the special character density thereof is taken as a special character density anomaly value. 6.The intelligent security management and control system for data de-sensitization and risk assessment of claim 1, wherein: In the dynamic early warning module, when the ReDoS attack risk probability value exceeds the set threshold, an early warning signal is sent to prompt that the risk of ReDoS attack is high, and security protection measures are triggered according to the early warning information; when the ReDoS attack risk probability value does not exceed the set threshold, no early warning signal is sent, indicating that the risk of ReDoS attack is low. 7.The intelligent security management and control system for data de-sensitization and risk assessment of claim 6, wherein: In the data desensitization processing module, the desensitization strength and mode are dynamically adjusted based on the risk assessment result of sensitive data, a masking or replacement strategy is used when the risk is low, and an encryption or complete replacement strategy is used when the risk is high.

Images