A sensitive data security supervision method, system and medium

Abstract

The application provides a sensitive data security supervision method, system and medium, and belongs to the technical field of data security supervision, and comprises the following steps: constructing a sensitive data management memory for storing sensitive data of a user and an online site application data set; extracting sensitive data features of all sensitive data of the user; constructing a main station URL list of a high-risk information public website, crawling and analyzing public website data and extended URLs, and identifying and detecting the public website data based on the sensitive data features to obtain an identification result; constructing a suspected leakage database; calling the sensitive data management memory and the suspected leakage database, adopting data feature similarity matching and category matching to screen out the suspected leakage database according to sensitive data individual types and URL similarity constraints, and determining a suspected leakage data group to be supervised and processed. The method can accurately manage the publicity and sharing of the sensitive data of the current user, track and locate illegal shared public data sources, and timely intervene.

Description

Technical Field

[0001] This invention relates to the field of data security compliance supervision technology, specifically to methods, systems and media for the supervision of sensitive data security. Background Technology

[0002] In today's highly interconnected digital age, users commonly use multiple platform devices to handle personal affairs, conduct online shopping, and engage in business activities online. During this process, systems often require users to authorize access to their personal contact information and other related data stored on their devices, or require users to manually enter information through smart terminals. This data often contains highly sensitive personal privacy information, specifically including, but not limited to: real name, email address, phone number, date of birth, gender characteristics, physical mailing address, and other core identity information. The management of sensitive user data is typically divided into two parts: one part consists of authorized websites that are permitted to store sensitive data, which require management regarding whether to continue storing sensitive data and to monitor deletion when the storage expires or the website is no longer in use; the other part consists of unauthorized networks that are not permitted to store or disclose sensitive data, requiring timely and accurate tracking to ensure that the user's sensitive data has been shared with third parties, especially illegally.

[0003] Because users' sensitive personal information is subject to leakage and sharing with third parties, existing technologies lack methods for monitoring sensitive information and for processing leaked or illegally disclosed sensitive data. It is necessary to determine in real time the public data source of sensitive data (which may be the sharing party that is illegally sharing it) and to track and delete it in a timely manner. Summary of the Invention

[0004] To address the aforementioned issues, this invention provides a method for monitoring the security of sensitive data. This method can accurately manage the public and shared status of current user sensitive data, track and locate illegally shared public data sources, and intervene in a timely manner.

[0005] To achieve the above objectives, the present invention provides the following technical solution.

[0006] A method for monitoring the security of sensitive data includes the following steps:

[0007] A sensitive data management storage device is constructed to store users' sensitive data online site application datasets; wherein, the sensitive data online site application datasets include multiple sets of public data groups, each of which includes the main URL of the online site, the corresponding set of publicly disclosed sensitive data, and authorization information;

[0008] Extract sensitive data features from all sensitive user data;

[0009] Construct a list of main URLs for high-risk information disclosure websites, crawl the URL list sequentially, parse the disclosed website data and extended URLs, and perform identification and detection based on sensitive data characteristics to obtain identification results;

[0010] Construct a suspected data leak database; the suspected data leak database includes multiple suspected data leak groups, each of which includes the main site URL and / or extended URL that have suspected sensitive data characteristics in the identification results, as well as multiple suspected sensitive data obtained from the identification;

[0011] The system calls upon the sensitive data management storage and suspected leak database. Based on the individual sensitive data types and URL similarity constraints, it uses data feature similarity matching and category matching to screen out suspected leak databases and determine the suspected leak data group to be subject to regulatory processing.

[0012] Preferably, the construction of the sensitive data management storage includes the following steps:

[0013] Determine the storage model for sensitive data application datasets and public data groups on online sites:

[0014] ;

[0015] ;

[0016] In the formula: Apply datasets to complete online sites containing sensitive data; For the first i A public data set, i =1,2,..., n ; This refers to the main URL of the online site. For the site's first j Public data, j =1,2,..., m ;

[0017] A relational database is used to build a sensitive data management storage, and the table structure is defined as follows: Table SiteDataset: stores site URLs and their IDs, with the main site URL as the primary key; Table PublicData: stores public data fields and is associated with SiteDataset.

[0018] Enter the main site URLs of currently authorized online sites and the corresponding publicly disclosed sensitive data sets into the sensitive data management storage.

[0019] Preferably, the process of constructing a list of main website URLs for high-risk information disclosure websites, sequentially crawling the URL list, parsing to obtain public website data and extended URLs, and identifying and detecting based on sensitive data characteristics includes the following steps:

[0020] Characterize the text data in all sensitive user data, and perform pattern recognition extraction on numeric strings and string data to obtain sensitive data features;

[0021] Compile a list of URLs for websites that disclose high-risk information;

[0022] For each high-risk information website in the URL list, a web crawler framework is used to crawl data in turn to obtain the suspected sensitive data set and extended URLs of the public websites;

[0023] Based on the characteristics of sensitive data, the crawled suspected sensitive data is risk-identified and detected. The trained SVM is used to obtain the identification result of whether similar sensitive data characteristics are generated based on the feature vector of the crawled suspected sensitive data.

[0024] Preferably, the construction of the suspected leak database includes the following steps:

[0025] The sensitive data features of multiple main site URLs or extended URLs that generate suspected sensitive data features are identified and extracted using regular expressions or pre-trained natural language processing models.

[0026] The extracted URLs and suspected sensitive data are compiled into a data set and stored in a suspected leak database.

[0027] Preferably, the method further includes verifying the suspected sensitive data in the suspected leak database, using data matching technology to verify the extracted features, verifying the extracted data through known sensitive data patterns, and deleting the suspected sensitive data in the suspected leak database.

[0028] Preferably, the step of filtering suspected leaked databases based on sensitive data individual types and URL similarity constraints, using data feature similarity matching and category matching, includes the following steps:

[0029] Access to sensitive data management storage and suspected leaked databases;

[0030] For each URL in the suspected leaked data group of the suspected leaked database, the similarity between it and the URL of the sensitive data online site application dataset in the sensitive data management storage is calculated sequentially using edit distance. URL :

[0031] ;

[0032] In the formula: To edit distance, There are two URLs. and Length;

[0033] When Sim URL If the URL exceeds the set threshold and is within the authorization period specified in the authorization information, then the URL is considered a potentially legitimate publicly accessible website and is marked accordingly.

[0034] By obtaining the sensitive data authorization type corresponding to each URL in the sensitive data management storage, the individual type constraints of sensitive data are determined;

[0035] The system performs category matching on various sensitive data of marked suspected legitimately authorized public websites and the corresponding sensitive data in the sensitive data management and storage URLs. Based on the individual type constraints of sensitive data, it identifies suspected legitimately authorized public websites that do not exceed the scope of authorization and removes them from the suspected leakage database. This yields a group of suspected leakage data awaiting regulatory processing for subsequent regulatory handling.

[0036] Preferably, the user's sensitive data includes their real name, email address, phone number, date of birth, gender, and physical mailing address.

[0037] The present invention also provides a sensitive data security monitoring system, the system comprising:

[0038] processor;

[0039] A memory on which computer programs that can run on the processor are stored;

[0040] The steps of the sensitive data security monitoring method are implemented when the computer program is executed by the processor.

[0041] The present invention also provides a computer-readable storage medium storing a data processing program, which, when executed by a processor, implements the steps of the sensitive data security monitoring method.

[0042] The beneficial effects of this invention are:

[0043] This invention proposes a method for sensitive data security supervision. This method associates and stores users' sensitive data with the URLs of authorized online sites, enabling it to understand the current public disclosure status of sensitive information and manage it effectively. Specifically, this method controls authorized information and content, determining whether sensitive information is within the authorized time limit and promptly processing sensitive information outside the authorization period. The method constructs URL similarity constraints, quickly locating websites that have leaked sensitive data through website data crawling, similarity matching, and category matching, thus identifying evidence of unauthorized online sites illegally collecting sensitive data. Simultaneously, the method constructs sensitive data individual type constraints to determine whether authorized online sites are illegally collecting other sensitive information and to handle such cases promptly. This method effectively tracks the public disclosure status of sensitive data, identifies illegal sharing, and provides better control over the public disclosure status of both authorized and unauthorized websites, laying the foundation for subsequent tracking and deletion of sensitive data. Attached Figure Description

[0044] Figure 1 This is a flowchart of a method according to an embodiment of the present invention;

[0045] Figure 2 This is a flowchart of the leaked data tracking and retrieval steps according to an embodiment of the present invention;

[0046] Figure 3 This is a flowchart of the leak database screening steps in an embodiment of the present invention. Detailed Implementation

[0047] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0048] Example 1

[0049] In today's digital age, user privacy concerns focus on two key areas: the right to dispose of personal information at the end of its data lifecycle, and the transparency and legality of third-party sharing during data transfer. These issues are becoming increasingly prominent against the backdrop of frequent technical vulnerabilities and cases of illegal sharing, urgently requiring systematic solutions. Therefore, this embodiment proposes a method for sensitive data security supervision, with specific steps as follows: Figure 1 As shown, it includes:

[0050] S1: Construct a sensitive data management storage device to store users' sensitive data online site application datasets; wherein, the sensitive data online site application datasets include multiple sets of public data groups, each set of public data groups includes the main URL of the online site, the corresponding set of publicly disclosed sensitive data, and authorization information.

[0051] S2: Extract sensitive data features from all sensitive data of the user.

[0052] S3: Construct a list of main URLs for high-risk information disclosure websites, crawl the URL list sequentially, parse the disclosed website data and extended URLs, and perform identification and detection based on sensitive data characteristics to obtain identification results.

[0053] S4: Construct a suspected leak database; the suspected leak database includes multiple suspected leak data groups, each of which includes the main site URL and / or extended URL that have suspected sensitive data characteristics in the identification results, as well as multiple suspected sensitive data obtained from the identification.

[0054] S5: Invoke the sensitive data management storage and suspected leak database. Based on the individual sensitive data type and URL similarity constraints, use data feature similarity matching and category matching to screen out suspected leak databases and determine the suspected leak data group to be monitored and processed.

[0055] In S1, the individual types of sensitive user data include identity information, specifically covering, but not limited to: real name, email address, phone number, date of birth, gender characteristics, physical mailing address, etc. Specifically, when constructing a sensitive data management storage device and storing user sensitive data for online site applications, the following steps are included:

[0056] S1.1: Determine the storage model for sensitive data online site application datasets and public data groups:

[0057] ;

[0058] ;

[0059] In the formula: Apply datasets to complete online sites containing sensitive data; For the first i A public data set, i =1,2,..., n ; This refers to the main URL of the online site. For the site's first j Public data, j =1,2,..., m .

[0060] S1.2: Use a relational database to build a sensitive data management storage, and define the table structure: Table SiteDataset: stores site URLs and their IDs, with the main site URL as the primary key; Table PublicData: stores public data fields and is associated with SiteDataset.

[0061] S1.3: Enter the main site URLs of the currently authorized online sites and the corresponding publicly disclosed sensitive data sets into the sensitive data management storage.

[0062] For example: SiteDataset table:

[0063]

[0064] PublicData table:

[0065]

[0066] Furthermore, the sensitive data management storage device can encrypt multiple sets of publicly available user data. The publicly available data used for subsequent management and tracking of suspected leaked data sets will be the decrypted data. Encryption can employ methods such as AES symmetric encryption.

[0067] Furthermore, S2-S3 involves tracking and retrieving leaked data from a list of websites that publicly disclose high-risk information. Specific steps are as follows: Figure 2 As shown:

[0068] S3.1: Use Word2Vec to characterize the text data in all sensitive user data, and perform pattern recognition extraction on numeric strings and string data to obtain sensitive data features. The numeric strings and string data here are in the form of phone numbers and email addresses, etc.

[0069] S3.2: Construct a list of URLs for high-risk information disclosure websites. Collect the URL list from historical data or blacklists.

[0070] Among them, high-risk information disclosure websites include phishing websites that imitate legitimate websites and forge domain names, pirated resource websites, and fake software download websites, etc., which are not registered with the Ministry of Industry and Information Technology. These can be collected through public blacklists, website crawlers, or manual labeling, and only the main site URL list is retained.

[0071] S3.3: For each high-risk publicly available website in the URL list, use a web crawling framework such as Scrapy to crawl data and obtain the set of suspected sensitive data and extended URLs. The crawling framework can be Scrapy, BeautifulSoup, Selenium, etc. Data parsing includes extracting suspected sensitive data from the HTML pages of the publicly available websites and determining the source of the suspected sensitive data information based on the extended URLs. The crawled suspected sensitive data is stored in a database for subsequent processing and analysis.

[0072] S3.4: Based on the characteristics of sensitive data, risk identification and detection are performed on the crawled suspected sensitive data. A trained SVM is used, based on the feature vectors of the crawled suspected sensitive data, to obtain an identification result indicating whether similar sensitive data features have been generated. The input features of the SVM model given in this invention are the crawled data text and the extracted feature vectors; the model output is a similarity or dissimilarity label.

[0073] For example, the following two high-risk website URLs were collected:

[0074] http: / / example1.com;

[0075] http: / / example2.com;

[0076] Scraping and parsing data: Using Scrapy to crawl http: / / example1.com, the following information was obtained:

[0077] Name: Zhang San; Email: zhang@example.com; Phone number: 13800001111; Date of birth: 1990-01-01; Address: XX Road, Haidian District, Beijing.

[0078] Relevant data will be extracted and stored in a database, and an SVM classifier will be used to identify the data. If similar information appears in the output, there is a suspected leakage of sensitive information.

[0079] Furthermore, according to S4, URLs that generate similar sensitive data characteristics and their corresponding suspected leaked data characteristics need to be stored. To avoid missed detections and facilitate subsequent data tracing, extended URLs should also be stored. Specifically:

[0080] S4.1: Use regular expressions or pre-trained natural language processing models (such as BERT) to identify and extract sensitive data features from multiple main site URLs or extended URLs that generate suspected sensitive data features.

[0081] S4.2: Organize the extracted URLs and suspected sensitive data into a dataset and build a suspected leak database for storage. The storage method is the same as the database storage method, similar to the detailed steps in S1, and will not be repeated here.

[0082] S4.3: Furthermore, it also includes the verification of suspected sensitive data in the suspected leaked database, using data matching technology to verify the extracted features, verifying the extracted data through known sensitive data patterns (such as common email formats and mobile phone number formats), and deleting suspected sensitive data in the suspected leaked database.

[0083] Finally, based on S5, the present invention further filters the suspected leaked database. The key points of deduplication are as follows: (1) whether it is a public website authorized by the user and still within the authorization period. (2) whether the authorized public website legally stores the sensitive data individual types authorized to it, and whether there are unauthorized sensitive data individual types (illegally storing other sensitive information of the user).

[0084] Therefore, this invention proposes two constraints:

[0085] (1) URL similarity constraint, used to determine whether it is a public website authorized by the user and still within the authorization period.

[0086] (2) Sensitive data individual type constraints, used to determine whether there are unauthorized sensitive data individual types.

[0087] Specifically, such as Figure 3 As shown:

[0088] S5.1: Access sensitive data management storage and suspected leaked databases.

[0089] S5.2: For each URL in the suspected leaked data group of the suspected leaked database, calculate its similarity to the URLs of the sensitive data online site application dataset in the sensitive data management storage using edit distance (Levenshtein distance). URL :

[0090] ;

[0091] In the formula: To edit distance, There are two URLs. and The length.

[0092] When Sim URLIf the URL exceeds a set threshold and is within the authorization period specified in the authorization information, then the URL is considered a potentially legitimate publicly accessible website and is marked. Furthermore, string recognition can be performed before similarity matching to conduct a preliminary screening.

[0093] S5.3: Determine the individual type constraints of sensitive data by obtaining the sensitive data authorization type corresponding to each URL in the sensitive data management storage.

[0094] S5.4: Perform category matching on various sensitive data of marked suspected legitimately authorized public websites and the corresponding sensitive data in the URL of the sensitive data management storage. Based on the individual type constraints of sensitive data, identify suspected legitimately authorized public websites that do not exceed the authorization scope and delete them from the suspected leakage database to obtain a group of suspected leakage data to be supervised and processed.

[0095] The handling methods include, but are not limited to: securing evidence: preserving the leaked pages and URLs through screenshots, screen recordings, or notarization, and recording the publication time and information content; simultaneously contacting the website operator and sending a formal letter through their official website or registration information (such as ICP number), requesting the removal of the information within 48 hours and feedback on the handling results. If the website does not respond, a complaint can be filed with its local communications administration bureau.

[0096] This invention proposes a method for sensitive data security supervision. By establishing a dynamic association mechanism between user sensitive data and authorized online site URLs, it enables real-time monitoring and efficient management of the public status of sensitive information. This method particularly strengthens the time-dimensional control of authorized information, accurately identifying whether sensitive data is within its valid authorization period and automatically triggering processing procedures for data exceeding the authorization time limit, ensuring full controllability throughout the data lifecycle.

[0097] This invention provides a technology for locating the source of data leaks. Based on a URL similarity constraint model, this method integrates multi-dimensional data analysis techniques, including automated data collection, feature matching, and classification verification, to quickly pinpoint websites suspected of leaking sensitive data. For unauthorized sites engaging in illegal data collection, the system can construct a complete chain of evidence, clearly identifying the specific paths and methods used to illegally collect sensitive information, providing a reliable basis for subsequent actions.

[0098] This invention proposes a data collection scope control strategy. By constructing a sensitive data type constraint system, this method can strictly monitor the collection scope of authorized sites. The system compares the actual data types acquired by the site with the authorized scope in real time. Once it detects that other sensitive information has been collected beyond the authorized scope, a processing mechanism is immediately activated, effectively curbing the abuse of data permissions by the authorizing party and ensuring that user information is used only within the agreed scope.

[0099] Finally, this method establishes a comprehensive tracking system covering both authorized and unauthorized sites, enabling real-time monitoring of changes in the public status of sensitive data. The system can quickly identify and locate unauthorized sharing activities, and through differentiated management of the two types of sites, it formulates differentiated regulatory strategies. This system provides a solid foundation for subsequent data tracking, deletion operations, and compliance reviews, ensuring that users' control over sensitive data is continuously protected.

[0100] The above is one embodiment of the sensitive data security monitoring method provided in this example. Based on the same idea, this example also provides a corresponding sensitive data security monitoring system. Specific limitations of the sensitive data security monitoring system can be found in the limitations of the sensitive data security monitoring method described above, and will not be repeated here. Each module in the above sensitive data security monitoring system can be implemented entirely or partially through software, hardware, or a combination thereof. Each module can be embedded in or independent of the processor in a computer device in hardware form, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0101] This embodiment also provides a computer-readable storage medium storing a computer program that can be used to execute the above-described... Figure 1 The provided methods for monitoring the security of sensitive data.

[0102] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, or optical storage, etc. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0103] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A sensitive data security monitoring method, characterized by, The method comprises the following steps: constructing a sensitive data management memory for storing a user's sensitive data online site application dataset, which is updated in time according to authorization information; wherein the sensitive data online site application dataset comprises a plurality of public data groups, and each public data group comprises a main site URL of an online site, a corresponding published sensitive data set and authorization information; extracting sensitive data features of all sensitive data of the user; constructing a main site URL list of a high-risk information public website, sequentially performing data crawling on the URL list, obtaining public website data and extended URLs through analysis, and performing identification detection based on the sensitive data features to obtain an identification result; constructing a suspected leakage database; the suspected leakage database comprises a plurality of suspected leakage data groups, and each suspected leakage data group comprises a main site URL and / or an extended URL with suspected sensitive data features in the identification result, and a plurality of suspected sensitive data obtained through identification; calling the sensitive data management memory and the suspected leakage database, performing screening on the suspected leakage database by using data feature similarity matching and category matching according to sensitive data individual type and URL similarity constraints, and determining suspected leakage data groups to be supervised and processed; the screening on the suspected leakage database by using data feature similarity matching and category matching according to sensitive data individual type and URL similarity constraints comprises the following steps: calling the sensitive data management memory and the suspected leakage database; For each suspected data leakage group in the suspected data leakage database, the similarity between the URL of each suspected data leakage group and the URL of the sensitive data online site application dataset in the sensitive data management storage is calculated in turn using the edit distance Sim URL : ； wherein: is the edit distance, are two URLs, and the length of When determining sensitive data individual type constraints by obtaining sensitive data authorization types corresponding to each URL in the sensitive data management memory; URL If the URL exceeds the set threshold value and is within the authorization period of the authorization information according to the URL, the URL is a suspected legitimate authorized public website and is marked. performing category matching on various sensitive data of the marked suspected legally authorized public website and various sensitive data in the corresponding URL of the sensitive data management memory, determining suspected legally authorized public websites that do not exceed the authorized range according to the sensitive data individual type constraints, and deleting the suspected legally authorized public websites from the suspected leakage database to obtain suspected leakage data groups to be supervised and processed for subsequent supervision and processing. the construction of the sensitive data management memory comprises the following steps:

2. The sensitive data security monitoring method of claim 1, wherein, determining a storage model of the sensitive data online site application dataset and the public data group: constructing the sensitive data management memory by using a relational database, and defining a table structure: a table SiteDataset is used for storing site URLs and their IDs, and a main site URL is used as a primary key; a table PublicData is used for storing public data fields and is associated with the SiteDataset; ； ； wherein: is the complete sensitive data online site application dataset; is the first i public data group, i = 1,2,..., n ; is the main site URL of the online site; is the first j public data of the site, j = 1,2,..., m ; recording the main site URL of the currently authorized online site and the corresponding published sensitive data set in the sensitive data management memory. the construction of the main site URL list of the high-risk information public website, the sequential data crawling on the URL list, the obtaining of public website data and extended URLs through analysis, and the identification detection based on the sensitive data features comprise the following steps:

3. The sensitive data security monitoring method of claim 1, wherein, performing featureization on text data in all sensitive data of the user, performing pattern recognition extraction on digital string and string data, and obtaining sensitive data features; constructing a URL list of the high-risk information public website; ​ The crawler framework is used to obtain the suspected sensitive data set and the extended URL of the public website in sequence. According to the sensitive data characteristics, the risk identification and detection of the crawled suspected sensitive data are performed, the trained SVM is used, and the identification result of whether similar sensitive data characteristics are generated is obtained based on the feature vector of the crawled suspected sensitive data.

4. The sensitive data security monitoring method of claim 1, wherein, The construction of the suspected leakage database includes the following steps: The sensitive data characteristics of the plurality of main station URLs or the extended URLs of the suspected sensitive data characteristics are identified and extracted by using a regular expression or a pre-trained natural language processing model. The extracted URL and the suspected sensitive data are arranged into a data set, and a suspected leakage database is constructed for storage.

5. The sensitive data security monitoring method of claim 4, wherein, The verification of the suspected sensitive data in the suspected leakage database is also included, the extracted features are verified by using a data matching technology, the extracted data are verified by using known sensitive data patterns, and the suspected sensitive data in the suspected leakage database are pruned.

6. The sensitive data security monitoring method of claim 1, wherein, The sensitive data of the user includes a real name, an email address, a phone number, a birth date, a gender characteristic, and an entity mailing address.

7. A sensitive data security monitoring system, characterized by, The system includes: a processor; a memory having a computer program stored thereon and executable on the processor; wherein the computer program is executed by the processor to implement the steps of the sensitive data security supervision method according to any one of claims 1 to 6.

8. A computer-readable storage medium, characterized in that, The data processing program is stored on the computer readable storage medium, and the data processing program is executed by the processor to implement the steps of the sensitive data security supervision method according to any one of claims 1 to 6.

Images