A platform security intelligent supervision method and system based on data governance

Abstract

The application discloses a kind of platform security intelligent supervision method and system based on data management, comprising the following steps: pre-processing to platform user access path, operation request and data flow log, extract features and generate behavior coding vector;The behavior coding vector is input into the replicator neural network for compression reconstruction, to obtain the reconstructed behavior coding vector and calculate reconstruction error;The behavior coding vector is input into Hopfield network for state evolution, to judge whether it converges to compliance stable state and calculate attraction state deviation;According to reconstruction error and attraction state deviation, generate behavior compliance label;Based on label, coding vector and its features, construct behavior backtracking chain graph;Comprehensive risk score is calculated using node attributes and dependency relationships in the graph;The result is mapped to the visualized supervision interface, to assist platform to realize compliance review and risk identification.

Description

Technical Field

[0001] This invention relates to the field of data security technology, and in particular to a platform security intelligent supervision method and system based on data governance. Background Technology

[0002] With the development of data-driven platform economy, user access paths, operational behaviors, and data flows within platforms are becoming increasingly complex. Security supervision, compliance identification, and risk prevention during platform operation have become crucial aspects of platform governance. Existing data security supervision technologies largely rely on rule-based matching, static auditing, or anomaly detection mechanisms based on statistical thresholds, which struggle to address the potential high-dimensional interaction characteristics and non-linear changes in compliance behavior patterns within dynamic behavioral sequences.

[0003] On the one hand, traditional anomaly detection methods cannot effectively capture the deep-seated consistency between user behavior and platform norms, often ignoring the contextual dependency features of behavior in sequence structure, resulting in a high false positive rate and difficulty in generating behavioral chains with tracking capabilities. On the other hand, existing risk identification methods mostly rely on a single indicator to build a scoring model, failing to fully integrate factors such as behavioral expression bias, multidimensional dependency paths, and evolutionary dynamics, resulting in insufficient accuracy and stability of risk assessment results, making it difficult to meet the real-time response and visualized supervision needs in complex scenarios.

[0004] Therefore, how to provide a platform security intelligent supervision method and system based on data governance is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] One objective of this invention is to propose a platform security intelligent supervision method and system based on data governance. This invention comprehensively utilizes behavioral encoding vector modeling, replicator neural network compression and reconstruction, Hopfield network state evolution, graph structure behavior backtracking and fusion risk modeling technologies to describe in detail the compliance identification and risk scoring process for platform user behavior sequences. It has the advantages of high modeling accuracy, accurate anomaly identification, strong chain tracing and outstanding supervision visualization capabilities.

[0006] According to an embodiment of the present invention, a platform security intelligent supervision method and system based on data governance includes the following steps:

[0007] The user's access path, operation request, and data flow log in the collection platform are preprocessed to extract sequence features and generate behavior encoding vectors.

[0008] The behavior encoding vector is compressed and reconstructed using a replicator neural network, the reconstructed behavior encoding vector is output, and the reconstruction error between the behavior encoding vector and the reconstructed behavior encoding vector is calculated.

[0009] The behavior encoding vector is input into the Hopfield network for state evolution. It is determined whether the behavior encoding vector converges to the stored compliant stable state, and the offset between the current converged state and the attractive state is calculated.

[0010] The reconstruction error and the attraction state offset are input into the judgment module, which generates a behavior compliance label according to the preset fusion rules.

[0011] Based on compliance tags, the corresponding behavior encoding vectors, reconstruction errors, and attractive state offsets are extracted to construct a behavior backtracking chain graph and track the related behavior nodes and temporal dependencies.

[0012] Input the node weights, cumulative reconstruction error values, and offset evolution paths from the behavior backtracking chain into the risk modeling module to calculate the comprehensive risk score.

[0013] Compliance labels, behavioral backtracking graphs, and comprehensive risk scores are jointly mapped to the platform's visual regulatory interface to generate dynamic views.

[0014] Optionally, the preprocessing includes access path standardization, operation request semantic parsing, data flow log structure restoration, and behavior sequence fusion modeling.

[0015] Optionally, the step of calculating the reconstruction error includes:

[0016] The behavior encoding vector is input into the replicator neural network, which then performs a compression and reconstruction operation.

[0017] The behavior encoding vector is converted into a potential expression vector with a lower dimension than the behavior encoding vector by a compressed mapping path. The potential expression vector is used to represent the behavior features of the behavior encoding vector in the compressed feature space.

[0018] The latent representation vector is transformed into a reconstructed behavior encoding vector with the same dimension as the behavior encoding vector through a reconstruction mapping path;

[0019] The difference between the behavior encoding vector and the reconstructed behavior encoding vector is extracted according to the element position to form an error vector;

[0020] The error vector is normalized and quantized to generate the reconstruction error.

[0021] Optionally, the replicator neural network includes a feature encoding module, a path discrimination and guidance module, a path selection module, a reconstruction module, and an error calculation module, comprising:

[0022] The path discrimination and guidance module receives the potential expression vector and extracts a reference vector set from the preset set of historical high-risk behavior feature vectors. It calculates the feature similarity between the potential expression vector and the set and constructs a behavior history risk response function R(z). The risk response function is used to measure the projection response degree of the potential expression vector in the high-risk behavior space.

[0023] The path discrimination and guidance module performs risk adjustment based on the matching scores between multiple preset path guidance vectors and potential expression vectors, combined with the behavioral history risk response function. The matching score function is as follows:

[0024] s j =σ( <z,w j >+λ·R(z));

[0025] Where z is the latent expression vector, w j Let λ be the weight vector of the j-th path in the path discrimination guidance module, σ be the risk adjustment parameter, and s be the nonlinear activation function. j This represents the path matching score.

[0026] Matching scores s for all paths j Compare the paths and select the path number corresponding to the path with the highest score. The corresponding path number is then input into the path selection module as a path identification label.

[0027] The path selection module guides the latent expression vector to the target reconstruction module branch based on the path discrimination label. The reconstruction module performs restoration processing on the latent expression vector to generate a reconstructed behavior encoding vector with the same dimension as the original behavior encoding vector.

[0028] Optionally, the generation of the current convergent state vector and the attracting state offset includes:

[0029] The behavior encoding vector is input into the Hopfield network compliance memory module as the initial state vector;

[0030] The connection weight matrix of the Hopfield network compliance memory module is constructed based on multiple labeled compliance behavior stable state vectors. The connection weight matrix is ​​constructed using a symmetric weight update rule. The multiple compliance stable state vectors are used to characterize the identified compliance stable behavior patterns in the platform's historical behavior sequence.

[0031] Based on the connection weight matrix, the asynchronous iterative state evolution process of the Hopfield network compliance memory module is executed, updating the state of each neuron in the initial state vector in a random order to form a state vector sequence;

[0032] In each iteration, it is determined whether all element differences between the current state vector and the previous state vector are lower than the set convergence threshold. If the condition is met, the current state vector is determined to be a converged state vector, and the evolution of the Hopfield network compliance memory module terminates.

[0033] The vector distance between the converged state vector and all compliant behavior stable state vectors is measured. When the vector distance between any compliant behavior stable state vector and the converged state vector is less than the attraction judgment threshold, the corresponding behavior encoding vector is considered to have converged to the compliant behavior stable state vector, and the corresponding compliant behavior stable state vector is determined as the attraction state vector.

[0034] Calculate the element-wise difference between the convergent state vector and the attracting state vector to generate the attracting state offset.

[0035] Optional, the generation of behavioral compliance labels includes:

[0036] Extract the reconstruction error and attractive state offset corresponding to the target behavior encoding vector, and input the reconstruction error and attractive state offset together into the behavior compliance label generation module;

[0037] The behavior compliance label generation module jointly determines the reconstruction error and the attractive state offset based on preset fusion rules, and outputs the behavior compliance label.

[0038] The preset fusion rules include reconstruction error judgment rules, attraction state offset judgment rules, and label decision logic rules, specifically including:

[0039] Reconstruction error judgment rule: Determine whether the reconstruction error is greater than the reconstruction error threshold. If it is greater, mark it as a reconstruction anomaly.

[0040] Attraction state offset judgment rule: Determine whether the attraction state offset is greater than the offset threshold. If it is greater, mark it as an abnormal deviation from the attraction state.

[0041] Label decision logic rules: Based on the joint judgment results of reconstruction anomalies and deviation from attractive state anomalies, behavior compliance labels are generated through Boolean logic structures. The label categories include compliant behavior, deviation behavior, and abnormal behavior.

[0042] Optionally, the construction of the behavior backtracking graph includes:

[0043] Extract the behavior compliance label, reconstruction error, and attractive state offset corresponding to the target behavior encoding vector, and set the target behavior encoding vector as the starting node of the behavior backtracking chain graph;

[0044] Within a preset time window, historical behavior encoding vectors that overlap with the target behavior encoding vector in access paths, data object interactions, and upstream and downstream operational dependencies are retrieved from the platform behavior logs to construct a candidate behavior encoding vector set.

[0045] Based on the timestamp order, data object reference relationship and operation causal chain of each behavior encoding vector in the candidate behavior encoding vector set, the temporal dependency path between the predecessor behavior encoding vector and the successor behavior encoding vector is identified.

[0046] The identified behavior encoding vectors and their temporal dependency paths are constructed into a directed graph structure. Each node in the graph is defined as a behavior encoding vector, each edge is a dependency connection path in the direction of time progression, and the edge weight represents the temporal dependency strength.

[0047] By attaching the corresponding behavior compliance label, reconstruction error value, and attractive state offset value to each behavior encoding vector node in the directed graph structure, a behavior backtracking chain graph containing attribute annotations is formed.

[0048] Optional, including:

[0049] The behavior vector generation module is used to preprocess user access paths, operation requests, and data flow logs, extract sequence features, and generate behavior encoding vectors.

[0050] The replicator neural network reconstruction module is used to compress and reconstruct the behavior encoding vector, output the reconstructed behavior encoding vector, and generate a reconstruction error based on the difference between the behavior encoding vector and the reconstructed behavior encoding vector.

[0051] The Hopfield network compliance memory module is used to receive behavior encoding vectors as initial state vectors, construct connection weight matrices based on multiple compliant behavior stable state vectors, perform asynchronous iterative state evolution, determine convergent state vectors, and calculate attractive state offsets.

[0052] The behavior compliance label generation module is used to receive reconstruction errors and attractive state offsets, and generate behavior compliance labels according to preset fusion rules.

[0053] The behavior backtracking chain construction module is used to construct a set of candidate behavior encoding vectors based on the overlapping access paths of the target behavior encoding vector and the historical behavior encoding vector, as well as the data object interaction or operation dependency relationship. It also constructs a behavior backtracking chain graph containing temporal dependency paths and marks the behavior compliance label, reconstruction error value and attractive state offset value of each node.

[0054] The risk scoring modeling module is used to receive node weights, cumulative reconstruction error values, and attractive state offset evolution paths from the behavior backtracking chain graph, and generate a comprehensive risk score.

[0055] The visual regulatory interface module is used to receive behavioral compliance tags, behavioral backtracking diagrams, and comprehensive risk scores, and display them together on the platform interface.

[0056] The beneficial effects of this invention are:

[0057] (1) This invention constructs a behavior vector generation module to extract sequence features from platform user access paths, operation requests and data flow logs and generate behavior encoding vectors, thereby realizing a structured expression of user behavior; it introduces a replicator neural network to compress and reconstruct the behavior encoding vectors, and reflects abnormal behavior features through reconstruction errors, thereby enhancing the ability to measure the fidelity of behavior compression features; it combines a Hopfield network to perform state evolution and generate attractive state offsets, thereby realizing the fitting judgment and anomaly identification of platform behavior stability.

[0058] (2) This invention constructs a behavior compliance label generation module by fusing reconstruction error and attraction state offset, and outputs labels such as compliant behavior, deviation behavior and abnormal behavior by using rule fusion judgment strategy, thereby enhancing the interpretability and classification granularity of abnormal behavior; by extracting behavior compliance labels and their corresponding behaviors, a behavior backtracking chain graph is constructed to track the access path, temporal relationship and data dependency of the preceding and following behavior nodes, forming a behavior chain that can be used for causal tracing analysis.

[0059] (3) This invention further integrates the node attributes, evolution paths and structural indicators in the behavior backtracking chain diagram, introduces a risk modeling module, quantifies multi-dimensional risk factors and calculates a comprehensive risk score, thereby realizing dynamic modeling and quantitative assessment of behavior evolution trends and platform security risks; finally, the risk labels and behavior chain diagram are visualized to build a unified regulatory view, which greatly improves the platform's intelligent perception and visual control capabilities for complex behavior patterns and potential risk events. Attached Figure Description

[0060] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0061] Figure 1 This is a flowchart of a platform security intelligent supervision method and system based on data governance proposed in this invention. Detailed Implementation

[0062] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0063] refer to Figure 1A platform security intelligent supervision method and system based on data governance includes the following steps:

[0064] The user's access path, operation request, and data flow log in the collection platform are preprocessed to extract sequence features and generate behavior encoding vectors.

[0065] The behavior encoding vector is compressed and reconstructed using a replicator neural network, the reconstructed behavior encoding vector is output, and the reconstruction error between the behavior encoding vector and the reconstructed behavior encoding vector is calculated.

[0066] The behavior encoding vector is input into the Hopfield network for state evolution. It is determined whether the behavior encoding vector converges to the stored compliant stable state, and the offset between the current converged state and the attractive state is calculated.

[0067] The reconstruction error and the attraction state offset are input into the judgment module, which generates a behavior compliance label according to the preset fusion rules.

[0068] Based on compliance tags, the corresponding behavior encoding vectors, reconstruction errors, and attractive state offsets are extracted to construct a behavior backtracking chain graph and track the related behavior nodes and temporal dependencies.

[0069] Input the node weights, cumulative reconstruction error values, and offset evolution paths from the behavior backtracking chain into the risk modeling module to calculate the comprehensive risk score.

[0070] Compliance labels, behavioral backtracking graphs, and comprehensive risk scores are jointly mapped to the platform's visual regulatory interface to generate dynamic views.

[0071] In this embodiment, the preprocessing includes access path standardization, operation request semantic parsing, data flow log structure restoration, and behavior sequence fusion modeling.

[0072] In this embodiment, the step of calculating the reconstruction error includes:

[0073] The behavior encoding vector is input into the replicator neural network, which then performs a compression and reconstruction operation.

[0074] The behavior encoding vector is converted into a potential expression vector with a lower dimension than the behavior encoding vector by a compressed mapping path. The potential expression vector is used to represent the behavior features of the behavior encoding vector in the compressed feature space.

[0075] The latent expression vector is transformed into a reconstructed behavior encoding vector with the same dimension as the behavior encoding vector through a reconstruction mapping path. The reconstructed behavior encoding vector is used as the output of the replicator neural network and is used to compare the behavior expression consistency with the behavior encoding vector.

[0076] The difference between the behavior encoding vector and the reconstructed behavior encoding vector is extracted according to the element position to form an error vector, which is used to represent the structural fidelity deviation in the behavior compression and reconstruction process.

[0077] The error vector is normalized and quantized to generate a reconstruction error, which serves as a metric for the effectiveness and completeness of the reconstructed representation of the current behavior by the replicator neural network.

[0078] In this embodiment, the replicator neural network includes a feature encoding module, a path discrimination and guidance module, a path selection module, a reconstruction module, and an error calculation module, comprising:

[0079] The path discrimination and guidance module receives the potential expression vector and extracts a reference vector set from the preset set of historical high-risk behavior feature vectors. It calculates the feature similarity between the potential expression vector and the set and constructs a behavior history risk response function R(z). The risk response function is used to measure the projection response degree of the potential expression vector in the high-risk behavior space.

[0080] The path discrimination and guidance module performs risk adjustment based on the matching scores between multiple preset path guidance vectors and potential expression vectors, combined with the behavioral history risk response function. The matching score function is as follows:

[0081] s j =σ( <z,w j >+λ·R(z));

[0082] Where z is the latent expression vector, w j Let λ be the weight vector of the j-th path in the path discrimination guidance module, σ be the risk adjustment parameter, and s be the nonlinear activation function. j This represents the path matching score.

[0083] The path matching score function used in this formula is based on the linear discriminant function and feature inner product mechanism in neural network models, that is, by calculating the latent expression vector z and the path guidance vector w. j inner product <z,w j > to measure the degree of matching, and combined with the bias adjustment method commonly used in logistic regression to construct a score expression. On this basis, the formula innovatively introduces a risk response function R(z) to characterize the projection degree of the potential expression vector in the historical high-risk behavior feature subspace, and realizes the weighted regulation of risk-sensitive path scores through the adjustment factor \lambda to form a risk-enhanced path discrimination model;

[0084] Matching scores s for all paths j Compare the paths and select the path number corresponding to the path with the highest score. The corresponding path number is then input into the path selection module as a path identification label.

[0085] The path selection module guides the latent expression vector to the target reconstruction module branch based on the path discrimination label. The reconstruction module restores the latent expression vector and generates a reconstructed behavior encoding vector with the same dimension as the original behavior encoding vector.

[0086] The calculation of feature similarity between the latent expression vector and the reference vector set includes evaluating the feature similarity between the latent expression vector and the set of historical high-risk behavior feature vectors. First, a reference vector set is constructed from historical data, where each reference vector represents a feature embedding representation of a known high-risk behavior. For the latent expression vector to be evaluated, a matching relationship is calculated sequentially with each reference vector in the reference vector set. This calculation can employ common vector similarity metrics such as cosine similarity or standardized inner product. By calculating the similarity score between the latent expression vector and each reference vector, and then normalizing and aggregating the scores, an overall similarity index is generated to characterize the degree of closeness between the current latent expression vector and the distribution of historical high-risk behaviors.

[0087] In this embodiment, the generation of the current convergence state vector and the attractive state offset includes:

[0088] The behavior encoding vector is input into the Hopfield network compliance memory module as the initial state vector;

[0089] The connection weight matrix of the Hopfield network compliance memory module is constructed based on multiple labeled compliance behavior stable state vectors. The connection weight matrix is ​​constructed using a symmetric weight update rule and is used to define the bidirectional coupling relationship between neurons in the Hopfield network compliance memory module. The multiple compliance stable state vectors are used to characterize the identified compliance stable behavior patterns in the platform's historical behavior sequence.

[0090] Based on the connection weight matrix, the asynchronous iterative state evolution process of the Hopfield network compliance memory module is executed, updating the state of each neuron in the initial state vector in a random order to form a state vector sequence;

[0091] In each iteration, it is determined whether all element differences between the current state vector and the previous state vector are lower than the set convergence threshold. If the condition is met, the current state vector is determined to be a converged state vector, and the evolution of the Hopfield network compliance memory module terminates.

[0092] The vector distance between the converged state vector and all compliant behavior stable state vectors is measured. When the vector distance between any compliant behavior stable state vector and the converged state vector is less than the attraction judgment threshold, the corresponding behavior encoding vector is considered to have converged to the compliant behavior stable state vector, and the corresponding compliant behavior stable state vector is determined as the attraction state vector.

[0093] Calculate the element-level difference between the convergent state vector and the attractive state vector to generate the attractive state offset, which is used to characterize the degree of stability deviation after the evolution of the behavior encoding vector.

[0094] The vector distance metric is used to evaluate the similarity between the converged state vector and each compliant stable state vector in the compliance memory module of the Hopfield network. The specific process is as follows: obtain the element values ​​at corresponding positions in the converged state vector and the target compliant stable state vector respectively, and calculate the Euclidean distance between them. The Euclidean distance is defined as the L2 norm of two equal-dimensional vectors in the feature space, that is, the square root of the square of the difference in all dimensions. When the Euclidean distance is less than the set attraction judgment threshold, it is considered that the current converged state vector has been attracted by the compliant stable state vector and successfully matched.

[0095] The symmetric weight update rule is a typical method for constructing the connection weight matrix of a Hopfield network. Its core idea is to ensure that the connection weights between any two neurons in the network remain numerically consistent in both the positive and negative directions when storing multiple stable state vectors. For any two neurons i and j, their connection weight w... ij It is obtained by multiplying and summing the corresponding components of multiple stable state vectors to be stored, that is, by statistically constructing according to the distribution relationship of all stable state vectors, thus forming a sequence that satisfies w. ij =w ji The symmetric structure of the neuron typically excludes its own feedback connections during weight updates (i.e., let w...). ii =0), to prevent self-excitation behavior during network evolution. The connection matrix constructed by this rule ensures that the energy function of the Hopfield network has stable convergence characteristics, so that the network state evolves towards the preset stable state during iterative updates, ultimately achieving an efficient and stable state memory and retrieval process.

[0096] In this embodiment, the generation of behavioral compliance labels includes:

[0097] Extract the reconstruction error and attractive state offset corresponding to the target behavior encoding vector, and input the reconstruction error and attractive state offset together into the behavior compliance label generation module;

[0098] The behavior compliance label generation module jointly determines the reconstruction error and the attraction state offset based on preset fusion rules, and outputs a behavior compliance label. The behavior compliance label is used to indicate the compliance status of the target behavior encoding vector in the platform's behavior norm system.

[0099] The preset fusion rules include reconstruction error judgment rules, attraction state offset judgment rules, and label decision logic rules, specifically including:

[0100] Reconstruction error judgment rule: Determine whether the reconstruction error is greater than the reconstruction error threshold. If it is greater, mark it as a reconstruction anomaly.

[0101] Attraction state offset judgment rule: Determine whether the attraction state offset is greater than the offset threshold. If it is greater, mark it as an abnormal deviation from the attraction state.

[0102] Label decision logic rules: Based on the joint judgment results of reconstruction anomalies and deviation from attractive state anomalies, behavior compliance labels are generated through Boolean logic structures. The label categories include compliant behavior, deviation behavior, and abnormal behavior.

[0103] In this embodiment, the construction of the behavior backtracking graph includes:

[0104] Extract the behavior compliance label, reconstruction error, and attractive state offset corresponding to the target behavior encoding vector, and set the target behavior encoding vector as the starting node of the behavior backtracking chain graph;

[0105] Within a preset time window, historical behavior encoding vectors that overlap with the target behavior encoding vector in access paths, data object interactions, and upstream and downstream operational dependencies are retrieved from the platform behavior logs to construct a candidate behavior encoding vector set.

[0106] Based on the timestamp order, data object reference relationship and operation causal chain of each behavior encoding vector in the candidate behavior encoding vector set, the temporal dependency path between the predecessor behavior encoding vector and the successor behavior encoding vector is identified.

[0107] The identified behavior encoding vectors and their temporal dependency paths are constructed into a directed graph structure. Each node in the graph is defined as a behavior encoding vector, each edge is a dependency connection path in the direction of time progression, and the edge weight represents the temporal dependency strength.

[0108] By attaching the corresponding behavior compliance label, reconstruction error value, and attractive state offset value to each behavior encoding vector node in the directed graph structure, a behavior backtracking chain graph containing attribute annotations is formed.

[0109] In this embodiment, the calculation of the comprehensive risk score includes:

[0110] Extract the behavior compliance label, node weight value, reconstruction error value and attraction state offset value corresponding to all behavior encoding vector nodes in the behavior backtracking chain graph, and input them into the risk scoring modeling module;

[0111] In the risk scoring modeling module, based on the directed topological structure of the behavior backtracking chain graph, the behavior encoding vector nodes are topologically sorted to generate an ordered node sequence;

[0112] For each row in the ordered node sequence, a local risk factor is calculated based on the reconstruction error value and the attractive state offset value. The local risk factor is then weighted and fused with the node weight value to generate a node-level risk score.

[0113] Along the ordered node sequence, a time-series decay accumulation operation is performed on the node-level risk scores sequentially, wherein the time-series decay coefficient is determined by the edge weights in the behavior backtracking chain graph;

[0114] All accumulated node-level risk scores are integrated at the path level and combined with the total percentage of abnormal behavior nodes marked in the corresponding behavior compliance labels to generate a comprehensive risk score.

[0115] This embodiment includes:

[0116] The behavior vector generation module is used to preprocess user access paths, operation requests, and data flow logs, extract sequence features, and generate behavior encoding vectors.

[0117] The replicator neural network reconstruction module is used to compress and reconstruct the behavior encoding vector, output the reconstructed behavior encoding vector, and generate a reconstruction error based on the difference between the behavior encoding vector and the reconstructed behavior encoding vector.

[0118] The Hopfield network compliance memory module is used to receive behavior encoding vectors as initial state vectors, construct connection weight matrices based on multiple compliant behavior stable state vectors, perform asynchronous iterative state evolution, determine convergent state vectors, and calculate attractive state offsets.

[0119] The behavior compliance label generation module is used to receive reconstruction errors and attractive state offsets, and generate behavior compliance labels according to preset fusion rules.

[0120] The behavior backtracking chain construction module is used to construct a set of candidate behavior encoding vectors based on the overlapping access paths of the target behavior encoding vector and the historical behavior encoding vector, as well as the data object interaction or operation dependency relationship. It also constructs a behavior backtracking chain graph containing temporal dependency paths and marks the behavior compliance label, reconstruction error value and attractive state offset value of each node.

[0121] The risk scoring modeling module is used to receive node weights, cumulative reconstruction error values, and attractive state offset evolution paths from the behavior backtracking chain graph, and generate a comprehensive risk score.

[0122] The visual regulatory interface module is used to receive behavioral compliance tags, behavioral backtracking diagrams, and comprehensive risk scores, and display them together on the platform interface.

[0123] Example 1:

[0124] To verify the feasibility of this invention in practice, it was applied to an integrated government service platform. This platform integrates multiple subsystems such as administrative approval, document retrieval, and fund disbursement, serving ordinary users, enterprise users, and internal staff. The platform's operation is characterized by complex operational paths and frequent data flow, necessitating intelligent and compliant monitoring of user behavior to identify potential unauthorized access, permission circumvention, and unexpected operational chains.

[0125] During platform log processing, the system first uses a behavior vector generation module to parse, filter, and extract features from user operation logs, data flow logs, and API call records generated by the platform, constructing structured sequences and encoding them into behavior encoding vectors. Over 40,000 operation records were processed in one day, successfully extracting approximately 39,000 encoding vectors, each corresponding to a complete user operation event.

[0126] The replicator neural network reconstruction module performs compression mapping and reconstruction operations on the above encoded vectors to extract their latent behavioral expressions. According to the results, approximately 670 vectors have reconstruction errors higher than the preset anomaly detection threshold, and the system classifies them as records of abnormal behavioral expressions. Structurally, these vectors exhibit abnormal request frequencies, cross-system skipping access, or redundant operation paths.

[0127] By introducing a historically calibrated set of stable compliance states through the Hopfield network compliance memory module, state evolution operations are performed on all behavior encoding vectors. The system identified over 500 vectors with significant deviations during state convergence, indicating that their operational paths are semantically or procedurally inconsistent with the compliance samples, exhibiting deviant behavioral characteristics.

[0128] The system combines reconstruction errors and state offsets, and uses a behavior compliance label generation module to determine behavior compliance according to fusion logic. Specific rules output three labels: "abnormal behavior," "deviation behavior," and "compliant behavior," for reconstruction anomalies, deviations, or combinations thereof. The labeling results show that "compliant behavior" accounts for approximately 98.3%, "deviation behavior" for approximately 1.3%, and "abnormal behavior" for approximately 0.4%.

[0129] For all non-compliant behaviors, the system automatically tracks their cause-and-effect paths. Within a set time window, the platform identifies behavioral relationship chains where there are overlapping accesses, data references, and operational dependencies between behavioral encoding vectors. Taking a suspected illegal data download as an example, the system traces back 17 associated behavioral nodes and more than 20 dependency paths, constructing a complete behavioral backtracking chain diagram. The diagram contains 4 abnormal nodes and 6 deviation nodes, while the remaining nodes are compliant nodes.

[0130] After the backtracking graph is constructed, the system embeds the compliance tags, reconstruction errors, and state offsets of each node as attributes into the graph structure, forming an attributed graph, which is then sent to the risk scoring module for evaluation. The risk scoring module outputs a comprehensive risk score for a chain based on the deviation weights, positional importance, and cumulative risk factors across the entire graph. For high-risk paths (e.g., chains with scores greater than 0.8), the system triggers a risk warning signal. Some data output by the system during platform operation is shown below:

[0131] Table 1: Statistical Table of Behavioral Retrospective Chain and Risk Score

[0132]

[0133] Table 1, "Statistics of Behavioral Backtracking Chains and Risk Scores," shows significant differences among the various backtracking chains in terms of structural complexity, distribution of abnormal nodes, and final comprehensive risk scores. Chain BX-001 contains 17 nodes, with abnormal nodes accounting for approximately 23.5% and deviation nodes accounting for approximately 35.3%. Its longest dependency path has 7 paths, indicating strong temporal extension and multi-hop dependencies in the operational sequence. Furthermore, its comprehensive risk score is as high as 0.86, suggesting that the superposition of abnormal and deviation factors in this path significantly increases the overall risk level. Chain BX-002, although having fewer nodes, contains 2 abnormal and 5 deviation nodes, accounting for 58.3%, indicating that although its structure is short, the problems are concentrated. Its score is also close to the high-risk threshold at 0.79, suggesting a concentrated outbreak of risk. Chain BX-003 has the most nodes, with 13 abnormal and deviating nodes, accounting for over 60%, and the longest dependency path reaches 9, exhibiting a typical coexistence of structural complexity and dense problems. Its risk score reaches 0.91, the highest value in the table, indicating its high potential for harm and requiring priority attention. Chain BX-004 has the fewest nodes, with a total of 3 abnormal and deviating nodes. Although the proportion is not low, the chain structure is relatively short and the paths are shallow, resulting in a risk score of 0.65, which is below average. This indicates that while local anomalies exist, they have not yet formed deep-level risk chains. Overall, there is a positive correlation between the risk score and the proportion of abnormal / deviating nodes and the depth of dependency paths, verifying the scientific validity and effectiveness of this invention's risk measurement through backtracking chain modeling and structural attribute integration.

[0134] In summary, this embodiment fully demonstrates the applicability and effectiveness of the present invention in user behavior monitoring scenarios. The system effectively solves the shortcomings of traditional methods in terms of weak behavior understanding, low backtracking efficiency, and inaccurate risk measurement, and has high technical practical value.

[0135] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A platform security intelligent supervision method based on data governance, characterized in that, Include: The user's access path, operation request, and data flow log in the collection platform are preprocessed to extract sequence features and generate behavior encoding vectors. The behavior encoding vector is compressed and reconstructed using a replicator neural network, the reconstructed behavior encoding vector is output, and the reconstruction error between the behavior encoding vector and the reconstructed behavior encoding vector is calculated. The behavior encoding vector is input into the Hopfield network for state evolution. It is determined whether the behavior encoding vector converges to the stored compliant stable state, and the offset between the current converged state and the attractive state is calculated. The behavior encoding vector is input into the Hopfield network compliance memory module as the initial state vector; The connection weight matrix of the Hopfield network compliance memory module is constructed based on multiple labeled compliance behavior stable state vectors. The connection weight matrix is ​​constructed using a symmetric weight update rule. The multiple compliance stable state vectors are used to characterize the identified compliance stable behavior patterns in the platform's historical behavior sequence. Based on the connection weight matrix, the asynchronous iterative state evolution process of the Hopfield network compliance memory module is executed, updating the state of each neuron in the initial state vector in a random order to form a state vector sequence; In each iteration, it is determined whether all element differences between the current state vector and the previous state vector are lower than the set convergence threshold. If the condition is met, the current state vector is determined to be a converged state vector, and the evolution of the Hopfield network compliance memory module terminates. The vector distance between the converged state vector and all compliant behavior stable state vectors is measured. When the vector distance between any compliant behavior stable state vector and the converged state vector is less than the attraction judgment threshold, the corresponding behavior encoding vector is considered to have converged to the compliant behavior stable state vector, and the corresponding compliant behavior stable state vector is determined as the attraction state vector. Calculate the element-level difference between the convergent state vector and the attracting state vector to generate the attracting state offset. Input the reconstruction error and the attracting state offset into the judgment module and generate a behavior compliance label according to the preset fusion rules. Based on compliance tags, the corresponding behavior encoding vectors, reconstruction errors, and attractive state offsets are extracted to construct a behavior backtracking chain graph and track the related behavior nodes and temporal dependencies. Input the node weights, cumulative reconstruction error values, and offset evolution paths from the behavior backtracking chain into the risk modeling module to calculate the comprehensive risk score. Compliance labels, behavioral backtracking graphs, and comprehensive risk scores are jointly mapped to the platform's visual regulatory interface to generate dynamic views.

2. The platform security intelligent supervision method based on data governance according to claim 1, characterized in that, The preprocessing includes access path standardization, operation request semantic parsing, data flow log structure restoration, and behavior sequence fusion modeling.

3. The platform security intelligent supervision method based on data governance according to claim 1, characterized in that, The steps for calculating the reconstruction error include: The behavior encoding vector is input into the replicator neural network, which then performs a compression and reconstruction operation. The behavior encoding vector is converted into a potential expression vector with a lower dimension than the behavior encoding vector by a compressed mapping path. The potential expression vector is used to represent the behavior features of the behavior encoding vector in the compressed feature space. The latent representation vector is transformed into a reconstructed behavior encoding vector with the same dimension as the behavior encoding vector through a reconstruction mapping path; The difference between the behavior encoding vector and the reconstructed behavior encoding vector is extracted according to the element position to form an error vector; The error vector is normalized and quantized to generate the reconstruction error.

4. The platform security intelligent supervision method based on data governance according to claim 3, characterized in that, The replicator neural network includes a feature encoding module, a path discrimination and guidance module, a path selection module, a reconstruction module, and an error calculation module, including: The path discrimination and guidance module receives potential expression vectors and extracts a reference vector set from a preset set of historical high-risk behavior feature vectors. It then calculates the feature similarity between the potential expression vectors and this set, and constructs a behavior historical risk response function. The risk response function is used to measure the degree of projection response of the potential expression vector in the high-risk behavior space; The path discrimination guidance module determines the path based on the matching scores between multiple preset path guidance vectors and potential expression vectors. Risk adjustment is performed by combining the aforementioned behavioral history risk response function; Match scores for all paths Compare the paths and select the path number corresponding to the path with the highest score. The corresponding path number is then input into the path selection module as a path identification label. The path selection module guides the latent expression vector to the target reconstruction module branch based on the path discrimination label. The reconstruction module performs restoration processing on the latent expression vector to generate a reconstructed behavior encoding vector with the same dimension as the original behavior encoding vector.

5. The platform security intelligent supervision method based on data governance according to claim 1, characterized in that, The generation of behavioral compliance labels includes: Extract the reconstruction error and attractive state offset corresponding to the target behavior encoding vector, and input the reconstruction error and attractive state offset together into the behavior compliance label generation module; The behavior compliance label generation module jointly determines the reconstruction error and the attractive state offset based on preset fusion rules, and outputs the behavior compliance label. The preset fusion rules include reconstruction error judgment rules, attraction state offset judgment rules, and label decision logic rules, specifically including: Reconstruction error judgment rule: Determine whether the reconstruction error is greater than the reconstruction error threshold. If it is greater, mark it as a reconstruction anomaly. Attraction state offset judgment rule: Determine whether the attraction state offset is greater than the offset threshold. If it is greater, mark it as an abnormal deviation from the attraction state. Label decision logic rules: Based on the joint judgment results of reconstruction anomalies and deviation from attractive state anomalies, behavior compliance labels are generated through Boolean logic structures. The label categories include compliant behavior, deviation behavior, and abnormal behavior.

6. The platform security intelligent supervision method based on data governance according to claim 1, characterized in that, The construction of the behavior backtracking graph includes: Extract the behavior compliance label, reconstruction error, and attractive state offset corresponding to the target behavior encoding vector, and set the target behavior encoding vector as the starting node of the behavior backtracking chain graph; Within a preset time window, historical behavior encoding vectors that overlap with the target behavior encoding vector in access paths, data object interactions, and upstream and downstream operational dependencies are retrieved from the platform behavior logs to construct a candidate behavior encoding vector set. Based on the timestamp order, data object reference relationship and operation causal chain of each behavior encoding vector in the candidate behavior encoding vector set, the temporal dependency path between the predecessor behavior encoding vector and the successor behavior encoding vector is identified. The identified behavior encoding vectors and their temporal dependency paths are constructed into a directed graph structure. Each node in the graph is defined as a behavior encoding vector, each edge is a dependency connection path in the direction of time progression, and the edge weight represents the temporal dependency strength. By attaching the corresponding behavior compliance label, reconstruction error value, and attractive state offset value to each behavior encoding vector node in the directed graph structure, a behavior backtracking chain graph containing attribute annotations is formed.

7. A platform security intelligent supervision system based on data governance, characterized in that, include: The behavior vector generation module is used to preprocess user access paths, operation requests, and data flow logs, extract sequence features, and generate behavior encoding vectors. The replicator neural network reconstruction module is used to compress and reconstruct the behavior encoding vector, output the reconstructed behavior encoding vector, and generate a reconstruction error based on the difference between the behavior encoding vector and the reconstructed behavior encoding vector. The Hopfield network compliance memory module is used to receive behavior encoding vectors as initial state vectors, construct connection weight matrices based on multiple compliant behavior stable state vectors, perform asynchronous iterative state evolution, determine convergent state vectors, and calculate attractive state offsets. The behavior encoding vector is input into the Hopfield network compliance memory module as the initial state vector; The connection weight matrix of the Hopfield network compliance memory module is constructed based on multiple labeled compliance behavior stable state vectors. The connection weight matrix is ​​constructed using a symmetric weight update rule. The multiple compliance stable state vectors are used to characterize the identified compliance stable behavior patterns in the platform's historical behavior sequence. Based on the connection weight matrix, the asynchronous iterative state evolution process of the Hopfield network compliance memory module is executed, updating the state of each neuron in the initial state vector in a random order to form a state vector sequence; In each iteration, it is determined whether all element differences between the current state vector and the previous state vector are lower than the set convergence threshold. If the condition is met, the current state vector is determined to be a converged state vector, and the evolution of the Hopfield network compliance memory module terminates. The vector distance between the converged state vector and all compliant behavior stable state vectors is measured. When the vector distance between any compliant behavior stable state vector and the converged state vector is less than the attraction judgment threshold, the corresponding behavior encoding vector is considered to have converged to the compliant behavior stable state vector, and the corresponding compliant behavior stable state vector is determined as the attraction state vector. The module calculates the element-wise difference between the convergent state vector and the attracting state vector to generate the attracting state offset. The behavior compliance label generation module receives the reconstruction error and the attracting state offset and generates behavior compliance labels according to the preset fusion rules. The behavior backtracking chain construction module is used to construct a set of candidate behavior encoding vectors based on the overlapping access paths of the target behavior encoding vector and the historical behavior encoding vector, as well as the data object interaction or operation dependency relationship. It also constructs a behavior backtracking chain graph containing temporal dependency paths and marks the behavior compliance label, reconstruction error value and attractive state offset value of each node. The risk scoring modeling module receives node weights and cumulative reconstruction error values ​​from the behavior backtracking graph. Based on the evolution path of the attraction state offset, a comprehensive risk score is generated; The visual regulatory interface module is used to receive behavioral compliance tags, behavioral backtracking diagrams, and comprehensive risk scores, and display them together on the platform interface.

Images