Sensitive data security supervision method and system and medium

Abstract

The invention provides a sensitive data security supervision method and system and a medium, and belongs to the technical field of data security supervision, and the method comprises the steps: constructing a sensitive data management memory which is used for storing sensitive data of a user and an online site application data set; extracting sensitive data features of all sensitive data of the user; constructing a main station URL list of the high-risk information public website, crawling and analyzing to obtain public website data and extended URLs, and performing identification detection based on sensitive data features to obtain an identification result; constructing a suspected leakage database; and calling a sensitive data management memory and a suspected leakage database, screening out the suspected leakage database by adopting data feature similarity matching and category matching according to sensitive data individual types and URL similarity constraints, and determining a suspected leakage data group to be supervised and processed. According to the method, the disclosure and sharing conditions of the sensitive data of the current user can be accurately managed, an illegally shared public data source is tracked and positioned, and intervention processing is carried out in time.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security compliance supervision, in particular to a sensitive data security supervision method, system and medium. BACKGROUND

[0002] In today's highly interconnected digital age, users generally handle personal affairs, online shopping and business activities on the Internet through multi-platform terminal devices. In this process, the system often requires users to authorize access to personal contact information and other related data stored in the device, or users need to manually enter information through a smart terminal. Such data often contains highly sensitive personal privacy content, including but not limited to: real name, email address, phone number, date of birth, gender characteristics, entity mailing address, and other core identity information. In the management of user sensitive data, it is usually divided into two parts: one part is the authorized access website that allows sensitive data storage, and the management method is whether to continue storing sensitive data, and when the website is no longer used, it needs to be deleted. The other part is the unauthorized network that is not allowed to store or disclose, whether the user's sensitive data information has been shared by a third party, especially illegally shared, which needs to be tracked in a timely and accurate manner.

[0003] Due to the leakage and third-party sharing of user sensitive personal information, the prior art lacks a sensitive information supervision method, and lacks a processing method for leaked or illegally disclosed sensitive data, which needs to judge the public data source (may be a shared party illegally shared) of the sensitive data in real time, and track and delete it in a timely manner. SUMMARY

[0004] To solve the above problems, the present application provides a sensitive data security supervision method, which can accurately manage the public and sharing of current user sensitive data, and track and locate the public data source of illegal sharing for timely intervention.

[0005] To achieve the above purpose, the present application provides the following technical solutions.

[0006] A sensitive data security supervision method, comprising the following steps: Constructing a sensitive data management storage for storing user sensitive data online site application data set; wherein the sensitive data online site application data set includes a plurality of public data groups, each public data group includes a main station URL of an online site, a corresponding published sensitive data set and authorization information; Extracting sensitive data features of all user sensitive data; Build a list of URLs for high-risk information disclosure websites, crawl the URL list in sequence, parse the list to obtain public website data and extended URLs, and perform identification and detection based on sensitive data features to obtain identification results; Constructing a suspected leak database; the suspected leak database includes multiple suspected leak data groups, each of which includes a main site URL and / or an extended URL with suspected sensitive data features in the identification results, and multiple suspected sensitive data obtained by identification; The sensitive data management storage and suspected leakage database are called, and according to the individual type of sensitive data and URL similarity constraints, data feature similarity matching and category matching are used to screen out the suspected leakage database to determine the suspected leakage data group to be supervised and processed.

[0007] Preferably, the construction of the sensitive data management memory comprises the following steps: Determine the storage model for sensitive data online site application datasets and public data groups: ; ; Where: Applying datasets for complete sensitive data online sites; For the i Public datasets, i =1,2,..., n ; The main URL of the online site; For this site j Items of public data, j =1,2,..., m ; A relational database is used to build a sensitive data management storage, and the table structure is defined as follows: Table SiteDataset: stores site URLs and their IDs, with the main site URL as the primary key; Table PublicData: stores public data fields and is associated with SiteDataset; The main site URL of the currently authorized online site and the corresponding publicly disclosed sensitive data set are entered into the sensitive data management memory.

[0008] Preferably, the process of constructing a list of URLs of websites that disclose high-risk information, crawling the URL list in sequence, parsing to obtain public website data and extended URLs, and performing identification and detection based on sensitive data features includes the following steps: Characterize the text data in all sensitive data of users, perform pattern recognition and extraction on digital strings and character strings, and obtain sensitive data features; Build a URL list of high-risk information disclosure websites; The crawler framework is used for data crawling for each high-risk information disclosure website in the URL list in turn to obtain a suspected sensitive data set and an extended URL of the disclosure website; According to the sensitive data features, risk identification and detection are performed on the crawled suspected sensitive data, and a trained SVM is used to obtain an identification result of whether similar sensitive data features are generated based on the feature vector of the crawled suspected sensitive data.

[0009] Preferably, the suspected leakage database is constructed, including the following steps: The sensitive data features of the plurality of host URLs or the extended URLs generating the suspected sensitive data features are identified and extracted by using a regular expression or a pre-trained natural language processing model; The extracted URL and the suspected sensitive data are sorted into a data set, and a suspected leakage database is constructed for storage.

[0010] Preferably, the suspected leakage database further includes verification of the suspected sensitive data, verification of the extracted features by using a data matching technology, verification of the extracted data by using a known sensitive data mode, and reduction of the suspected sensitive data in the suspected leakage database.

[0011] Preferably, according to the sensitive data individual type and the URL similarity constraint, the suspected leakage database is screened out by using data feature similarity matching and category matching, including the following steps: The sensitive data management storage and the suspected leakage database are called; The similarity Sim between the URL in each suspected leakage data group of the suspected leakage database and the URL of the sensitive data online site application data set in the sensitive data management storage is calculated in turn by using the edit distance URL : ; In the formula: is the edit distance, is the length of the two URLs, and ; When Sim URL is greater than a set threshold value, and according to the authorization period of the authorization information, the URL is a suspected legally authorized disclosure website, and is marked; The sensitive data individual type constraint is determined by obtaining the sensitive data authorization type corresponding to each URL in the sensitive data management storage; The various types of sensitive data of the marked suspected legitimate authorized public website are matched with the various types of sensitive data in the corresponding URL of the sensitive data management storage, the suspected legitimate authorized public website which does not exceed the authorized range is determined according to the sensitive data individual type constraint, and the suspected leakage database is deleted, so as to obtain a suspected leakage data group to be supervised and processed for subsequent supervision processing.

[0012] Preferably, the sensitive data of the user includes a real name, an email address, a phone number, a date of birth, a gender feature, and a physical mailing address.

[0013] The application further provides a sensitive data security supervision system, which comprises: a processor; a memory having a computer program stored thereon and executable on the processor; When the computer program is executed by the processor, the steps of the sensitive data security supervision method are implemented.

[0014] The application further provides a computer readable storage medium having a data processing program stored thereon, wherein the data processing program is executed by a processor to implement the steps of the sensitive data security supervision method.

[0015] The application has the following advantages: The application provides a sensitive data security supervision method, which associates and stores the sensitive data of a user with the URL of an authorized online site, can know the disclosure of the current sensitive information, and can be effectively managed. In the method, the authorized information and the authorized content are controlled to determine whether the sensitive information is within the authorized time limit, and the sensitive information outside the authorized time limit is processed in time. The method constructs a URL similarity constraint, quickly locates the website that produces sensitive data leakage through website data crawling, similarity matching, and category matching, and determines the evidence of illegal collection of sensitive data by the unauthorized online site. Meanwhile, the method constructs a sensitive data individual type constraint to determine whether the authorized online site illegally collects other sensitive information and processes it in time. The method can effectively track the disclosure of sensitive data, determine the illegal sharing, and better control the disclosure of the authorized and unauthorized websites, and provides a basis for subsequent tracking and deletion of sensitive data. BRIEF DESCRIPTION OF DRAWINGS

[0016] Figure 1 is a method flowchart of an embodiment of the application; Figure 2 is a leakage data tracking and searching step flowchart of an embodiment of the application; Figure 3is a leakage database screening step flow chart of the embodiment of the present application. DETAILED DESCRIPTION

[0017] In order to make the purpose, technical scheme and advantages of the present application more clear and explicit, the present application will be further described in detail below in combination with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application.

[0018] Embodiment 1 In today's digital era, the core of user privacy concerns focuses on two key areas: one is the disposal right of personal information at the end of the data life cycle, and the second is the transparency and legality of third-party sharing in the data flow process. These problems are more prominent in the background of frequent technical vulnerabilities and frequent illegal sharing cases, and urgent systemic solutions are needed. For this purpose, the present embodiment proposes a sensitive data security supervision method, as shown in Figure 1 , which includes: S1: Construct a sensitive data management memory for storing user's sensitive data online site application data set; wherein the sensitive data online site application data set includes multiple sets of public data groups, and each set of public data groups includes the main station URL of the online site, the corresponding published sensitive data set and the authorization information.

[0019] S2: Extract the sensitive data features of all user sensitive data.

[0020] S3: Construct a main station URL list of high-risk information public website, sequentially perform data crawling on the URL list, parse to obtain public website data and extended URL, and identify and detect based on the sensitive data features to obtain the identification result.

[0021] S4: Construct a suspected leakage database; the suspected leakage database includes multiple suspected leakage data groups, and each suspected leakage data group includes the main station URL and / or extended URL with suspected sensitive data features in the identification result, and multiple suspected sensitive data obtained by identification.

[0022] S5: Call the sensitive data management memory and the suspected leakage database, and according to the sensitive data individual type and the URL similarity constraint, use data feature similarity matching and category matching to screen out the suspected leakage database, and determine the suspected leakage data group to be supervised and processed.

[0023] In S1, the sensitive data individual type of the user includes identity information, specifically including but not limited to: real name, email address, phone number, date of birth, gender characteristics, entity mailing address, etc. Specifically, when constructing the sensitive data management memory and storing the user's sensitive data online site application data set, the following steps are included: S1.1: Determine the storage model of sensitive data online site application data set and public data group: ; ; wherein: is the complete sensitive data online site application data set; is the first i public data group, i =1,2,..., n ; is the main site URL of the online site; is the first j public data of the site, j =1,2,..., m .

[0024] S1.2: Use a relational database to build a sensitive data management storage, define table structure: table SiteDataset: store site URL and its ID, the main site URL as the primary key; table PublicData: store public data fields and associate with SiteDataset.

[0025] S1.3: Enter the main site URL of the currently authorized online site and the corresponding published sensitive data set into the sensitive data management storage.

[0026] For example, the SiteDataset table:

[0027] PublicData table:

[0028] Further, the user's multiple public data groups stored in the sensitive data management storage can be encrypted, and the public data group used in subsequent management and suspected leakage data group tracking is decrypted data. Encryption can use AES symmetric encryption, etc.

[0029] Further, S2-S3 is for high-risk information disclosure website list, leakage data tracking and retrieval. The specific steps are shown in Figure 2 S3.1: Use Word2Vec to feature the text data in all sensitive data of the user, and use pattern recognition to extract numerical strings and string data, to obtain sensitive data features. The numerical strings and string data here are in the form of phone numbers and email addresses, etc.

[0030] S3.2: Build a URL list of high-risk information disclosure websites. Collect the URL list from historical data or blacklists.​

[0031] Among them, the high-risk information disclosure website includes phishing websites that imitate regular website domain names, pirate resource websites, and false software download websites, and the URL of the non-MIIT recorded website, which can be collected through the public blacklist, website crawler or manual annotation, and only the main station URL list is reserved.

[0032] S3.3: For each high-risk information disclosure website in the URL list, a crawler framework such as Scrapy is used to perform data crawling, and the suspected sensitive data set and the extended URL of the public website are obtained. The crawler framework can be Scrapy, BeautifulSoup, Selenium, etc. Among them, the analysis data includes extracting the suspected sensitive data in the HTML page of the public website, and determining the source of the suspected sensitive data information according to the extended URL. The crawled suspected sensitive data is stored in the database for subsequent processing and analysis.

[0033] S3.4: According to the sensitive data characteristics, the risk identification and detection of the crawled suspected sensitive data are carried out, and the trained SVM is used to obtain the identification result of whether similar sensitive data characteristics are generated based on the feature vector of the crawled suspected sensitive data. Among them, the input features of the SVM model given by the present application are the data text and the extracted feature vector obtained by crawling, and the model output is a similar or non-similar label.

[0034] For example, the following two high-risk website URLs are collected: http: / / example1.com; http: / / example2.com; Crawl and analyze data: use Scrapy to crawl http: / / example1.com and obtain the following information: Name: Zhang San; Email: zhang@example.com; Phone number: 13800001111; Date of birth: 1990-01-01; Address: Beijing Haidian District XX Road.

[0035] Store the extracted related data in the database and use the SVM classifier to identify the data. If the output result contains similar information, there is a suspected sensitive information leakage.

[0036] Further, according to S4, the URL that produces similar sensitive data characteristics and the corresponding suspected leakage data characteristics need to be stored, and the extended URL is also stored in order to avoid missing judgment and subsequent data tracing. Specifically: S4.1: Use regular expressions or pre-trained natural language processing models (such as BERT) to identify and extract sensitive data features from multiple main site URLs or extended URLs that generate suspected sensitive data features.

[0037] S4.2: Organize the extracted URLs and suspected sensitive data into a data set and build a suspected leak database for storage. This storage method is similar to the database storage method, and the detailed steps in S1 are not repeated here.

[0038] S4.3: Further, it also includes verifying suspected sensitive data in the suspected leaked database, using data matching technology to verify the extracted features, verifying the extracted data through known sensitive data patterns (such as common email formats, mobile phone number formats), and deleting suspected sensitive data in the suspected leaked database.

[0039] Finally, based on S5, the present invention further screens the suspected leaked database. The key points of deduplication are the following two points: (1) whether it is a public website authorized by the user and still within the authorization period. (2) whether the authorized public website legally stores the authorized sensitive data individual types, and whether there are unauthorized sensitive data individual types (illegally storing other sensitive information of the user).

[0040] Therefore, the present invention proposes two constraints: (1) URL similarity constraint, used to determine whether the website is a public website authorized by the user and is still within the authorization period.

[0041] (2) Sensitive data individual type constraints, used to determine whether there are unauthorized sensitive data individual types.

[0042] Specifically, such as Figure 3 As shown: S5.1: Access sensitive data management storage and suspected leak databases.

[0043] S5.2: For each URL in the suspected leaked data group in the suspected leaked database, use the edit distance (Levenshtein distance) to calculate the similarity Sim between it and the URL of the sensitive data online site application dataset in the sensitive data management storage. URL : ; Where: is the edit distance, For two URLs, and length.

[0044] When Sim URLIf the URL exceeds the set threshold and is within the authorization period of the authorization information according to the URL, the URL is a suspected legitimate authorized public website, and is marked. Further, string recognition can be performed before similarity matching to perform screening before matching.

[0045] S5.3: Determine the sensitive data individual type constraint by acquiring the sensitive data authorization type corresponding to each URL in the sensitive data management memory.

[0046] S5.4: Perform category matching on each type of sensitive data of the marked suspected legitimate authorized public website and each type of sensitive data in the URL corresponding to the sensitive data management memory, determine the suspected legitimate authorized public website that does not exceed the authorized range according to the sensitive data individual type constraint, and delete it from the suspected leakage database, obtain the suspected leakage data group to be supervised and processed, and perform subsequent supervision and processing.

[0047] The processing mode includes but is not limited to: fixed evidence: save the leakage page and website by screenshot, screen recording or notarization method, record the publishing time and information content; contact the website operator synchronously, send a formal letter through the official website or the record information (such as ICP number), require deleting the information within 48 hours and feedback the processing result. If the website does not respond, it can be complained to the local communication management bureau.

[0048] The present application provides a sensitive data security supervision method, which realizes real-time control and efficient management of sensitive information public state by establishing a dynamic association mechanism of user sensitive data and authorized online site URL. This method particularly strengthens the time dimension control of authorized information, can accurately identify whether the sensitive data is within the effective authorization period, and automatically triggers the processing flow for the data exceeding the authorization time limit, ensuring the whole process controllable of the data life cycle.

[0049] The present application provides a leakage source positioning technology. Based on the URL similarity constraint model, this method quickly locks the website of suspected leaked sensitive data by integrating multi-dimensional data analysis means, including automatic data collection, feature matching and classification verification. For the illegal collection behavior of unauthorized sites, the system can build a complete evidence chain, and clearly determine the specific path and method of collecting sensitive information, providing reliable basis for subsequent disposal.

[0050] The present application provides a data collection range control strategy, which can strictly monitor the collection range of authorized sites by constructing a sensitive data type constraint system. The system compares the data type actually obtained by the site with the authorized range in real time, and immediately starts the processing mechanism once it is found that other sensitive information is collected beyond the range, effectively curbing the behavior of authorized parties abusing data rights, and protecting user information within the agreed range.

[0051] Finally, the method establishes a full-quantity tracking system covering licensed and unlicensed sites, which can monitor the public state changes of sensitive data in real time. For illegal sharing behavior, the system can quickly identify and locate, and at the same time, through the classification management of the two types of sites, a differentiated regulatory strategy is formed. The system provides a solid foundation for subsequent data tracking, deletion operation and compliance review, and ensures that the user's control over sensitive data is continuously guaranteed.

[0052] The above is a sensitive data security supervision method provided by one embodiment of the present embodiment. Based on the same idea, the present embodiment also provides a corresponding sensitive data security supervision system. For specific limitations of the sensitive data security supervision system, please refer to the limitations of the sensitive data security supervision method in the above text, which will not be repeated here. Each module in the above sensitive data security supervision system can be realized by software, hardware and their combinations in whole or in part. The above modules can be embedded in or independent of the processor in the computer device in hardware form, or can be stored in the memory in the computer device in software form, so as to be called and executed by the processor to perform the operations corresponding to the above modules.

[0053] The present embodiment also provides a computer readable storage medium, which stores a computer program. The computer program can be used to execute the sensitive data security supervision method provided above. Figure 1 The present embodiment also provides a computer readable storage medium, which stores a computer program. The computer program can be used to execute the sensitive data security supervision method provided above.

[0054] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer readable storage medium. When the computer program is executed, it can include the processes of the above-mentioned embodiments of the method. In the embodiments provided by the present application, any reference to the memory, storage, database or other medium can include at least one of the non-volatile and volatile memories. The non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory or optical memory, etc. The volatile memory can include random access memory (RAM) or external cache memory. As an illustration but not limitation, the RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0055] The above is only a preferred embodiment of the present application, and is not intended to limit the present application. Any modification, equivalent replacement and improvement made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A sensitive data security supervision method, characterized in that: The following steps are involved: Constructing a sensitive data management memory for storing a user's sensitive data online site application data set, which is updated regularly according to authorization information; wherein the sensitive data online site application data set includes multiple groups of public data groups, each of which includes the main site URL of the online site, the corresponding publicly disclosed sensitive data set, and authorization information; Extract sensitive data features of all user’s sensitive data; Build a list of URLs for high-risk information disclosure websites, crawl the URL list in sequence, parse the list to obtain public website data and extended URLs, and perform identification and detection based on sensitive data features to obtain identification results; Constructing a suspected leak database; the suspected leak database includes multiple suspected leak data groups, each of which includes a main site URL and / or an extended URL with suspected sensitive data features in the identification results, and multiple suspected sensitive data obtained by identification; The sensitive data management storage and suspected leakage database are called, and according to the individual type of sensitive data and URL similarity constraints, data feature similarity matching and category matching are used to screen out the suspected leakage database to determine the suspected leakage data group to be supervised and processed.

2. The sensitive data security supervision method according to claim 1, characterized in that: The construction of the sensitive data management memory includes the following steps: Determine the storage model for sensitive data online site application datasets and public data groups: ； ； Where: Applying datasets for complete sensitive data online sites; For the i Public datasets, i =1,2,..., n ; The main URL of the online site; For this site j Items of public data, j =1,2,..., m ; A relational database is used to build a sensitive data management storage, and the table structure is defined as follows: Table SiteDataset: stores site URLs and their IDs, with the main site URL as the primary key; Table PublicData: stores public data fields and is associated with SiteDataset; The main site URL of the currently authorized online site and the corresponding publicly disclosed sensitive data set are entered into the sensitive data management memory.

3. The sensitive data security supervision method according to claim 1, characterized in that: The process of constructing a list of URLs for high-risk information disclosure websites, crawling the URL list in sequence, parsing to obtain public website data and extended URLs, and performing identification and detection based on sensitive data features includes the following steps: Characterize the text data in all sensitive data of users, perform pattern recognition and extraction on digital strings and character strings, and obtain sensitive data features; Build a URL list of high-risk information disclosure websites; Use a crawler framework to crawl data from each high-risk information disclosure website in the URL list, and obtain the suspected sensitive data set and extended URL of the public website; According to the characteristics of sensitive data, the crawled suspected sensitive data is risk identified and detected. The trained SVM is used to obtain the identification result of whether similar sensitive data characteristics are generated based on the feature vector of the crawled suspected sensitive data.

4. The sensitive data security supervision method according to claim 1, characterized in that: The construction of the suspected leakage database includes the following steps: Use regular expressions or pre-trained natural language processing models to identify and extract sensitive data features from multiple main site URLs or extended URLs that generate suspected sensitive data features; The extracted URLs and suspected sensitive data are organized into a data set, and a suspected leakage database is constructed for storage.

5. The sensitive data security supervision method according to claim 4, characterized in that: It also includes verifying the suspected sensitive data in the suspected leak database, verifying the extracted features using data matching technology, verifying the extracted data through known sensitive data patterns, and deleting the suspected sensitive data in the suspected leak database.

6. The sensitive data security supervision method according to claim 1, characterized in that: The method of screening out suspected leaked databases by using data feature similarity matching and category matching based on sensitive data individual types and URL similarity constraints includes the following steps: Access sensitive data management storage and suspected leak databases; For each URL in the suspected leaked data group of the suspected leaked database, the similarity Sim between the URL and the URL of the sensitive data online site application dataset in the sensitive data management storage is calculated using the edit distance. URL : ； Where: is the edit distance, For two URLs, and length; When Sim URL If the number of URLs exceeds the set threshold and the URL is within the authorization period according to the authorization information, the URL is suspected to be a legally authorized public website and will be marked; Determine the individual type constraint of sensitive data by obtaining the sensitive data authorization type corresponding to each URL in the sensitive data management memory; Perform category matching on various types of sensitive data on marked public websites suspected of being legally authorized and on various types of sensitive data in the corresponding URLs of the sensitive data management storage device. Determine the public websites suspected of being legally authorized that do not exceed the authorization scope based on the individual type constraints of the sensitive data, delete them from the suspected leakage database, obtain the suspected leakage data group to be supervised and processed, and conduct subsequent supervision and processing.

7. The sensitive data security supervision method according to claim 1, characterized in that: The user's sensitive data includes real name, email address, phone number, date of birth, gender characteristics and physical mailing address.

8. A sensitive data security monitoring system, characterized in that: The system comprises: processor; a memory having stored thereon a computer program executable on the processor; Wherein, when the computer program is executed by the processor, the steps of the sensitive data security supervision method as described in any one of claims 1 to 7 are implemented.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a data processing program, which, when executed by a processor, implements the steps of the sensitive data security supervision method according to any one of claims 1 to 7.

Images