Cross-border personal data transmission security detection method and system based on differential privacy

Abstract

The present application belongs to the technical field of cross-border data security, and provides a cross-border personal data transmission security detection method and system based on differential privacy, which comprises multi-dimensional situation awareness, privacy budget allocation, explainability and audit, and execution and response. Through synchronous perception of technical environment risks, multi-country regulatory constraints and multi-modal data features, the overall control of the cross-border transmission security situation is realized, and the one-sidedness of single-dimensional perception is avoided. Based on the deep Q network algorithm, the privacy budget is dynamically allocated under multiple constraints, which not only ensures the protection strength of high-sensitive data, but also avoids the excessive loss of the utility of low-sensitive data. The explainable report is generated in combination with causal analysis, and the whole process is notarized by relying on the alliance chain, so that the decision-making black box and audit tracing problems are solved, the cross-border supervision requirements are met, and the balance of cross-border transmission in terms of security, compliance and usability is improved.

Description

Technical Field

[0001] This application relates to the field of cross-border data security technology, and in particular to a method and system for security detection of cross-border personal data transmission based on differential privacy. Background Technology

[0002] Cross-border personal data transfer refers to the electronic transmission of personal data across countries or jurisdictions, involving privacy protection regulations in different jurisdictions. In international cooperation in fields such as healthcare and finance, such transfers need to simultaneously meet requirements for technical security, regulatory compliance, and data availability, creating a complex environment of dual technical and regulatory constraints.

[0003] Currently, existing technologies mainly employ traditional differential privacy mechanisms, which achieve privacy protection through a unified privacy budget allocation and noise addition. These methods are typically based on a fixed budget allocation strategy and provide overall protection for a single data type.

[0004] Existing technologies suffer from the following problems: Firstly, privacy budget allocation lacks intelligent and dynamic adaptability. Current technologies allocate privacy budgets at a fixed ratio; however, real-time attack risk levels, link budget margins, and data attribute sensitivity all affect the allocation. Allocating too high a budget to low-sensitivity background areas results in data utility loss, while allocating too low a budget to highly sensitive disease areas fails to meet compliance requirements. Secondly, decision interpretability and audit traceability are insufficient. Existing technologies do not clearly define the key influencing factors of privacy budget allocation, nor do they establish an immutable evidence storage mechanism. Regulatory agencies cannot verify the budget allocation logic, making it difficult to balance security, compliance, and availability in cross-border transmissions. Summary of the Invention

[0005] The purpose of this application is to propose a method and system for security detection of cross-border personal data transmission based on differential privacy, so as to solve the technical problem of balancing security, compliance and availability in cross-border transmission as mentioned in the background art.

[0006] To address the aforementioned technical problems, this application provides a method for secure detection of cross-border personal data transmission based on differential privacy, employing the following technical solution:

[0007] A method for secure detection of cross-border personal data transmission based on differential privacy includes the following steps:

[0008] Multidimensional situational awareness processing is performed on three types of information: technical environment risks, multi-country regulatory constraints, and multimodal data characteristics in cross-border personal data transmission environments. This results in structured situational awareness results that include attack risk level, link budget margin, side-channel attack strength value, compliance rules, and attribute-level sensitivity scores.

[0009] The structured situation awareness result is integrated based on a deep Q network algorithm, privacy budget allocation processing is performed on each data attribute, constraints of the allocation process include that the privacy budget of each data attribute is not lower than a preset lower limit of technology, is not higher than a maximum privacy budget allowed by a corresponding regulation, and a total of all attribute budgets is not higher than a link budget margin, and an attribute-level privacy budget vector is obtained;

[0010] A causal analysis is performed on a decision-making process of the deep Q network model, and key information in a whole process of cross-border data transmission is stored and audited by an intelligent contract in combination with a consortium chain, to obtain a causally explainable report and an unforgeable audit record, and the key information in the whole process of cross-border data transmission includes a digital signature of a participant;

[0011] According to the attribute-level privacy budget vector, attribute-level noise injection is performed on different types of data attributes, real-time monitoring of sudden risks in a transmission process is performed, and adaptive dynamic adjustment is performed based on a sensitive level of a data attribute and a transmission link priority, to obtain safe data that can be transmitted across borders.

[0012] Preferably, the multi-dimensional situation awareness processing includes:

[0013] Technical environmental risk awareness: an isolation forest algorithm is used to extract request frequency, data access range, and transmission delay characteristics of a cross-border transmission request, to perform member inference attack detection, and obtain an attack risk level; a legal large model is called to determine a maximum privacy budget of each cross-border transmission link, a link budget margin is calculated by a difference between the maximum privacy budget and a historical used privacy budget of the link; real-time electromagnetic signals of a transmission device are collected by an electromagnetic radiation sensor, a side channel attack intensity value is calculated by comparing a variance of the real-time electromagnetic signals and a preset normal signal baseline;

[0014] Multi-national regulation constraint awareness: jurisdiction, data attribute, and regulation clause class entities are extracted from multi-national privacy regulation texts, constraint relationships between the entities are labeled, and a cross-country compliance knowledge graph is formed by storing the entities in a graph database; a legal large model is called, a target region name and a data attribute type are input, and compliance rules are obtained by quantifying fuzzy regulation clauses;

[0015] Multi-modal data feature awareness: a lightweight image model is used to extract medical image features, the features are split into lesion regions and background regions, and attribute-level sensitivity scores are calculated; a text model is used to extract diagnostic text semantic features, the features are split into diagnostic conclusions and symptom descriptions, and attribute-level sensitivity scores are calculated.

[0016] Preferably, the compliance rules include a regulation allowed maximum privacy budget and desensitization requirements; based on the attribute-level sensitivity scores, a data attribute sensitive level is divided into a high sensitive attribute, a medium sensitive attribute, and a low sensitive attribute; and the transmission link priority is divided into a high priority link and a low priority link.

[0017] Preferably, the privacy budget allocation process comprises: constructing a state space of a deep Q network model, the input information being a structured situation awareness result; defining a model action space as an attribute-level privacy budget vector; initializing an experience replay pool, a main network and a target network of the model, selecting an action using an ε-greedy strategy, updating the main network parameters by extracting samples from the experience replay pool, updating the target network parameters at a preset training time step interval, and obtaining the attribute-level privacy budget vector by maximizing the cumulative reward value in combination with a composite reward function.

[0018] Preferably, the causal analysis comprises: constructing a causal relationship graph, the nodes being a structured data attribute sensitivity score, a multi-modal data attribute sensitivity score, a maximum privacy budget allowed by regulations, an attack risk level and a side-channel attack intensity value; using an intervention analysis method to fix the node values and observe the changes in the privacy budget, deducing the contribution degree of each node, and generating a causally interpretable report;

[0019] The smart contract audit process comprises: using a consortium chain framework to store the structured situation awareness result, the attribute-level privacy budget vector, the causally interpretable report, the digital signature of the participant and the time stamp; deploying a smart contract on the consortium chain, calculating the serial link cumulative privacy budget and the parallel link cumulative privacy budget, and when the total cumulative privacy budget reaches a preset global budget threshold, automatically freezing the link and issuing an alarm.

[0020] Preferably, the attribute-level noise injection comprises: for numerical data, using a Laplace mechanism; for discrete data, using an exponential mechanism; for medical image data, using a feature-level Laplace mechanism to add noise; for text data, using a word embedding perturbation mechanism to add noise.

[0021] Preferably, the adaptive dynamic adjustment process comprises: using an extreme gradient boosting model to predict a side-channel attack dynamic threshold and a link budget dynamic early warning value in combination with the link type and the data sensitivity mean; when the side-channel attack intensity value exceeds the dynamic threshold, the link budget margin is lower than the dynamic early warning value, or the regulations of the target area are updated, triggering the adjustment: adjusting the privacy budget value according to the data attribute sensitivity level; freezing low-priority links and stopping the allocation of new budgets, transferring the saved budgets to high-priority links; interrupting the current transmission, reacquiring the structured situation awareness result, and starting a new round of deep Q network model decision-making.

[0022] Preferably, the composite reward function comprises: a privacy protection benefit negatively related to the success rate of member inference attacks, the weight of which being dynamically adjusted according to the attack risk level; a data utility loss related to the data perplexity, the weight of which being fixed; and a compliance score positively related to the compliance degree of the attribute-level privacy budget vector, the weight of which being fixed; the reward value being calculated according to the privacy protection benefit-data utility loss deduction item + compliance score.

[0023] To solve the above technical problems, the embodiments of the present application also provide a cross-border personal data transmission security detection system based on differential privacy, comprising:

[0024] A multi-dimensional situation awareness module, which collects and quantifies technical environment risks, multi-country regulatory constraints and multi-modal data characteristics affecting cross-border data transmission security in real time, converts fuzzy information into structured situation awareness results, and outputs comprehensive data including attack risk level, link budget margin, side channel attack intensity value, compliance rules and attribute-level sensitivity score;

[0025] A privacy budget allocation module, which receives the structured situation awareness results, integrates the input information through a deep Q network algorithm, allocates the optimal privacy budget for each data attribute under the constraint conditions that the privacy budget of each data attribute is not lower than the technical lower limit, not higher than the maximum privacy budget allowed by regulations, and the total sum of all attribute budgets does not exceed the link budget margin, and outputs an attribute-level privacy budget vector;

[0026] An interpretable audit module, which receives the attribute-level privacy budget vector and the structured situation awareness results, performs causal analysis on the decision-making process of the deep Q network model to generate a natural language interpretable report, and uses alliance chain technology to store and transmit key information throughout the process, automatically calculates the cumulative privacy budget through a smart contract and triggers an audit alarm;

[0027] An execution response module, which receives the attribute-level privacy budget vector, performs differentiated attribute-level noise injection on different types of data attributes to generate secure data, and monitors sudden risks in the transmission process in real time, dynamically adjusts the privacy protection strategy based on the data attribute sensitivity level and the transmission link priority.

[0028] Preferably, the multi-dimensional situation awareness module comprises a technical awareness unit, a regulatory awareness unit and a multi-modal data awareness unit; the technical awareness unit receives cross-border transmission request logs and device sensor signals, detects member inference attacks and calculates attack risk levels through an isolation forest algorithm, determines the maximum privacy budget of the link and calculates the budget margin through a legal large model, and calculates the side channel attack intensity value through electromagnetic signal analysis; the regulatory awareness unit receives multi-country regulatory texts and target area information, and outputs compliance rules through knowledge graph construction and legal large model analysis; the multi-modal data awareness unit receives structured and unstructured data, and outputs attribute-level sensitivity scores through attribute splitting and sensitivity evaluation;

[0029] The privacy budget allocation module receives the structured situation awareness results, constructs the state space of the deep Q network model, defines the action space as the attribute-level privacy budget vector, and outputs the optimal allocation scheme through reinforcement learning training;

[0030] The interpretable audit module receives the attribute-level privacy budget vector and the structured situation awareness result, constructs a causal relationship diagram, and derives the contribution degree of each factor through intervention analysis, generates a causally interpretable report, stores the environmental state, privacy budget vector, interpretable report, digital signature and timestamp in a consortium chain, and calculates the cumulative privacy budget of the serial link and parallel link through the deployed smart contract, and automatically freezes the link and alarms when the global threshold is exceeded;Audit records are transmitted to the regulatory party in real time;

[0031] The execution response module receives the attribute-level privacy budget vector, adopts the Laplace mechanism for numerical data, the exponential mechanism for discrete data, the feature-level Laplace mechanism for medical images, and the word embedding perturbation mechanism for text data to perform noise injection and generate secure data, real-time monitor the side channel attack intensity value, budget margin and regulation update, use a machine learning model to predict the dynamic threshold, trigger privacy budget value adjustment, link priority scheduling and re-decision closed loop, and feed back the adjusted strategy to the privacy budget allocation module for iterative optimization.

[0032] The beneficial effects of the present application are as follows:

[0033] The present application provides a cross-border personal data transmission security detection method based on differential privacy, which comprehensively controls the security situation of cross-border transmission by synchronously perceiving technical environmental risks, multi-country regulatory constraints and multi-modal data features, avoiding the one-sidedness of single-dimensional perception;Based on the deep Q network algorithm, the privacy budget is dynamically allocated under multiple constraints, which not only ensures the protection strength of high-sensitive data, but also avoids the excessive loss of low-sensitive data utility;Combined with causal analysis to generate an interpretable report, relying on a consortium chain to realize full-process notarization, solving the decision-making black box and audit traceability problem, meeting the cross-border regulatory requirements, improving the balance of cross-border transmission in security, compliance and usability.

[0034] The method introduces the deep Q network algorithm into privacy budget allocation, realizes multi-objective optimization of privacy protection, data utility and compliance through the design of a composite reward function, and is more intelligent and scenario-adaptive than existing fixed allocation methods;Attribute-level sensitivity scoring and targeted noise injection strategies are proposed for multi-modal data, feature-level Laplace mechanism is used for medical images, and word embedding perturbation mechanism is used for diagnostic text, solving the protection deficiency or utility waste problem caused by traditional coarse-grained processing;Fusion of legal large model and machine learning model can not only quantitatively analyze the ambiguous regulatory provisions in different regions, but also can detect member inference attacks, side channel attacks and other risks in real time, improving the adaptability of cross-border scenarios.

[0035] The method breaks through the black box barrier of differential privacy technology by combining causal explainable reports with alliance chain storage, enabling regulatory agencies to clearly understand the privacy budget allocation logic and enhancing the trust of cross-border transmission; the adaptive dynamic adjustment mechanism can respond to sudden risks in real time, and through priority link scheduling and budget redistribution, it ensures the continuous safety of high-sensitive data transmission, achieving the trinity protection of privacy safety, data availability and compliance check for cross-border personal data transmission, and providing reliable technical support for high-sensitive scenarios such as medical treatment and finance. BRIEF DESCRIPTION OF DRAWINGS

[0036] In order to more clearly illustrate the schemes in the present application, the drawings needed in the description of the embodiments of the present application will be briefly introduced as follows. Obviously, the drawings in the following description are some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0037] Figure 1 is a flow chart of the first embodiment of the present application;

[0038] Figure 2 is a system architecture diagram of the second embodiment of the present application. DETAILED DESCRIPTION

[0039] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the present application belongs; the terms used in the specification of the application are only for the purpose of describing the specific embodiments and are not intended to limit the present application; the specification, claims and above drawing description of the present application and the terms "include" and "have" and any variations thereof in the specification are intended to cover non-exclusive inclusion.

[0040] Reference herein to "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the present application. The appearance of the phrase in various places in the specification does not necessarily all refer to the same embodiment, nor is it necessarily mutually exclusive of other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0041] In order to enable those skilled in the art to better understand the schemes of the present application, the technical solutions in the embodiments of the present application will be described clearly and completely in conjunction with the drawings.

[0042] Embodiment one

[0043] As shown in Figure 1 , the cross-border personal data transmission safety detection method based on differential privacy includes steps 1 to 4:

[0044] Step 1: Multi-dimensional situation awareness: Perform multi-dimensional situation awareness on three types of information, including technical environment risks, multi-national regulatory constraints, and multi-modal data characteristics, to obtain structured situation awareness results containing attack risk levels, link budget margins, side-channel attack intensity values, compliance rules, and attribute-level sensitivity scores.

[0045] Further, the multi-dimensional situation awareness process includes technical environment risk awareness, multi-national regulatory constraint awareness, and multi-modal data characteristic awareness. The compliance rules include the maximum privacy budget allowed by regulations and desensitization requirements. Based on the attribute-level sensitivity scores, data attribute sensitivity levels are classified into high-sensitive attributes, medium-sensitive attributes, and low-sensitive attributes.

[0046] Transmission link priority is divided into high-priority links and low-priority links based on the sensitivity of the transmitted data, with the following division logic:

[0047] High-priority link: A link used to transmit high-sensitive data, which can cause serious harm to users, such as medical discrimination and property loss, and meets the requirements of high privacy protection intensity in regulations, including links transmitting medical data and financial data.

[0048] Low-priority link: A link used to transmit low-sensitive data, which has relatively small harm to users and relatively loose regulatory constraints, including links transmitting marketing data and ordinary user behavior data.

[0049] The essence of the division is to match the data sensitivity level with the link resource guarantee priority to ensure that high-sensitive data can obtain more sufficient privacy budget and more priority link resources during transmission, avoiding insufficient protection of high-sensitive data due to resource occupation by low-sensitive data.

[0050] Step 1.1: Technical environment risk awareness: Attack risk and link state monitoring: Monitor technical security risks through member inference attack detection and side-channel attack quantification detection, and simultaneously statistics the privacy budget usage of each transmission link, finally output risk level and remaining budget.

[0051] Step 1.1.1: Member inference attack detection.

[0052] The Isolation Forest algorithm is used, which can identify anomalies without labeled attack samples. First, collect a large number of normal cross-border transmission requests as training samples, such as normal medical data transmission requests and ordinary personal information transmission requests, and build multiple isolation trees based on these samples.

[0053] For each transmission request to be detected, the request frequency, data access range, and transmission delay features need to be extracted, with the following extraction methods:

[0054] Request frequency: The total number of transmission requests initiated by the request initiator in a unit of time is counted from the cross-border transmission log. For example, if initiator A initiates 20 requests in 1 hour, the request frequency is 20 times / hour;

[0055] Data access range: The data access range is determined by the data access permission identifier and the data size carried in the transmission request. For example, if the request accesses 5 types of core data such as user medical history and diagnosis conclusion, and the data size exceeds 100 MB, it is determined that the data access range is large. If only 2 types of basic data such as user age and gender are accessed, and the data size is less than 10 MB, it is determined that the data access range is small;

[0056] Transmission delay: The time difference between the request sending time and the receiving party's confirmation time is recorded. For example, if the request sending time is 10:00:00 and the receiving party's confirmation time is 10:00:05, the transmission delay is 5 seconds.

[0057] After extracting the features, the path length from the root to the isolated path in multiple isolated trees is calculated, and then compared with the average path length of normal samples to obtain an anomaly score. The closer the anomaly score is to 1, the more the request deviates from the normal characteristics, and the higher the probability of being a member inference attack. The closer the anomaly score is to 0, the lower the risk.

[0058] The final output of the attack risk level is based on a three-level risk standard divided according to the anomaly score, specifically: anomaly score ≥ 0.7 is high risk, 0.5 ≤ anomaly score < 0.7 is medium risk, and anomaly score < 0.5 is low risk. Each cross-border transmission request will correspond to an output attack risk level.

[0059] Step 1.1.2: Multi-link privacy budget margin monitoring.

[0060] For each cross-border transmission link, such as the first country to the first alliance and the first country to the second alliance, the maximum privacy budget of the link is determined according to the regulations of the target region. The specific determination method is as follows:

[0061] First, determine the target region corresponding to the link, for example, the target region of the first country to the first alliance link is the first alliance;

[0062] Call the trained legal large model LawGPT, input the target region name and the data attribute type of the link transmission, such as medical data and general personal information. LawGPT is described in step 1.2;

[0063] The legal large model analyzes the privacy regulations of the target region, such as the GDPR of the first alliance, and outputs the upper limit of the privacy protection strength allowed by the region for the corresponding data attribute type, which is the maximum privacy budget of the link. For example, the first alliance regulations have strict privacy protection requirements for medical data, and the legal large model outputs a maximum privacy budget of 1.0 for the first country to the first alliance link; the second alliance region has lower protection requirements for ordinary personal information, and the maximum privacy budget for the first country to the second alliance link is 2.0.

[0064] After determining the maximum privacy budget, the accumulated privacy budget used in all historical transmission processes of the link is determined, that is, the total privacy budget allocated to the data attribute by the link during each transmission. Subtract the used budget from the maximum privacy budget to get the link budget surplus. If the link budget surplus is lower than the preset warning value, for example, 0.2, a budget warning is triggered, prompting the link to reduce privacy budget allocation in the future to avoid violations.

[0065] Step 1.1.3: Side channel attack quantitative detection.

[0066] Real-time electromagnetic signals of the transmission device are collected through electromagnetic radiation sensors, including servers, terminals, etc. At the same time, the electromagnetic signal baseline of the device during normal data transmission is pre-stored, which is a reference standard for signal fluctuation stability, for example, the fluctuation range of electromagnetic signals during normal transmission is between 100 μV and 120 μV. Compare the fluctuation degree of the real-time signal with the baseline, and the fluctuation degree is measured by variance, which is a statistical indicator describing the degree of data dispersion, i.e. the size of fluctuation. The specific calculation steps are as follows:

[0067] Calculate the mean of the real-time electromagnetic signal sequence, for example, collect 1000 real-time signal sampling points, add the values of all sampling points and divide by 1000 to get the mean;

[0068] Calculate the deviation of each sampling point value from the mean, and then square each deviation;

[0069] Calculate the average of all squared deviations, which is the variance of the real-time electromagnetic signal. For example, the mean of the real-time signal is 110 μV, the value of a sampling point is 130 μV, the deviation is 20 μV, the squared deviation is 400 μV², and the average of all sampling point squared deviations is 60 μV². The variance of the real-time signal is 60 μV².

[0070] The calculation of the side channel attack intensity value is: side channel attack intensity value = |real-time signal variance - normal signal baseline variance| ÷ normal signal baseline variance. The larger the side channel attack intensity value, the more likely the device is under a side channel attack, such as a power analysis attack that leaks data through electromagnetic radiation. Set the high-risk standard for the side channel attack intensity value ≥ 0.8, and when the detected side channel attack intensity value reaches or exceeds 0.8, trigger the subsequent emergency adjustment.

[0071] Step 1.2: Multi-country regulation constraint perception: Multi-country regulation quantification analysis: Convert ambiguous regulatory provisions in different countries or regions into executable technical requirements, output data attribute-target region corresponding compliance rules.

[0072] Step 1.2.1: Construction of cross-country compliance knowledge graph.

[0073] First, extract key entities from multi-country regulation texts, such as first alliance, second alliance, etc. jurisdiction, name, medical history, lesion area, etc. data attributes, and GDPR Art. 44, etc. regulatory provisions. Regulatory texts include GDPR, Personal Information Protection Law, etc. Then, legal experts label the constraint relationships between entities, such as the first alliance requiring stricter privacy protection for medical history data, and the second alliance requiring lower desensitization for ordinary personal information. Finally, store these entity-relation information in a special graph database, such as Neo4j, to form a queryable cross-country compliance knowledge graph. For example, querying the requirements of the first alliance for lesion area data can directly obtain specific rules from the knowledge graph.

[0074] Step 1.2.2: Quantification of ambiguous regulatory provisions.

[0075] Use a specially trained legal large model LawGPT, with training data covering privacy regulations in more than 120 countries, input customized queries, such as: Convert the requirements of the first alliance GDPR on the sufficiency of medical history data into privacy protection intensity and desensitization operations.

[0076] The structured results output by the legal large model include maximum privacy budget and desensitization requirements. Among them, the maximum privacy budget is a quantitative indicator of privacy protection intensity, and the smaller the value of the maximum privacy budget, the stronger the privacy protection intensity. For example, the legal large model outputs the first alliance's maximum privacy budget for medical history data as 0.2, indicating that medical history data needs strong privacy protection in the first alliance region; the maximum privacy budget for ordinary personal information in the second alliance is 1.5, indicating that the privacy protection intensity of ordinary personal information in the second alliance region is relatively low. Desensitization requirements such as complete noise addition for medical history data, and partial masking for names, such as processing Zhang San as Zhang * San.

[0077] The output results of the legal large model LawGPT need to be specially adapted to cross-border scenarios: For the same data attribute, such as medical history, different maximum privacy budgets need to be output according to the differences in regulations in the target regions, such as 0.2 in the first alliance and 1.5 in the second alliance, while clearly binding the budget with the desensitization requirements of the data attribute, such as complete noise addition for medical history data in the first alliance and partial masking for ordinary personal information in the second alliance, to ensure that the regulation quantification results directly serve subsequent privacy budget allocation and noise injection, realizing seamless conversion from regulatory requirements to technical parameters.

[0078] Step 1.3: Multimodal data feature perception: attribute-level sensitivity score: attribute splitting is performed on structured data and unstructured data, and the privacy protection priority of each attribute in the two types of data is evaluated respectively, and the corresponding sensitivity score is output.

[0079] Step 1.3.1: Structured data scoring.

[0080] Step 1.3.1.1: For structured data such as name, age, medical history, etc., score each attribute from three dimensions, with a score range of 1 to 5 for each dimension, with 5 indicating the highest priority in that dimension. The three dimensions are:

[0081] Leakage impact: refers to the harm to users after the data attribute is leaked, for example, medical history data leakage may lead to medical discrimination against users, and the leakage impact is 5 points; the harm of age data leakage to users is smaller, and the leakage impact is 3 points;

[0082] Compliance requirements: refers to the strictness of the regulations on the data attribute, for example, the first alliance has stricter constraints on the name than on the age, and the compliance requirements of the name are 5 points, and the compliance requirements of the age are 3 points;

[0083] Data value: refers to the importance of the data attribute to the business, for example, the value of medical history data to medical diagnosis is higher than that of age, and the data value of medical history is 5 points, and the data value of age is 4 points.

[0084] Step 1.3.1.2: After scoring, the 1 to 5 scores of the three dimensions of leakage impact, compliance requirements and data value need to be unified in scale, and the unified method is linear normalization processing, as follows:

[0085] For each dimension, find the highest score and the lowest score of all structured data attributes in that dimension;

[0086] For each attribute in that dimension, calculate the normalized score using (original score - lowest score in that dimension) ÷ (highest score in that dimension - lowest score in that dimension), resulting in a normalized score with a range of 0 to 1. For example, the highest score in the leakage impact dimension is 5, the lowest score is 3, and the original score of a certain attribute is 5, the normalized score is (5-3) ÷ (5-3) = 1; if the original score is 3, the normalized score is (3-3) ÷ (5-3) = 0.

[0087] Step 1.3.1.3: After unifying the scale, calculate the structured data sensitivity weight, the specific method is:

[0088] For each dimension, calculate the entropy value according to the normalized score, the smaller the entropy value, the greater the difference in scores of the attributes in that dimension, and the more significant the impact on sensitivity;

[0089] Subtract the entropy value of each dimension from 1 to get the difference coefficient of the dimension;

[0090] Add the difference coefficients of all dimensions, and then divide the difference coefficient of each dimension by the total difference coefficient to get the structured data sensitivity weight of the dimension. For example, the difference coefficient of the leakage impact is 0.37, the compliance requirement is 0.37, the data value is 0.26, and the total difference coefficient is 1.0. The corresponding structured data sensitivity weights are 0.37, 0.37, and 0.26, respectively.

[0091] Step 1.3.1.4: Finally, multiply the structured data sensitivity weight of each dimension by the original score of the attribute in that dimension, and then add the results of the three dimensions to get the structured data attribute sensitivity score. For example, the name gets 5 points in the leakage impact, 5 points in the compliance requirement, and 3 points in the data value. The structured data attribute sensitivity score is 0.37x5 + 0.37x5 + 0.26x3 ≈ 4.4. The higher the structured data attribute sensitivity score, the stronger the privacy protection required. For example, the structured data attribute sensitivity score of medical history is 5.0, which requires stronger privacy protection than the age data with a score of 3.3.

[0092] Step 1.3.2: Multi-modal data attribute sensitivity score: For unstructured data, first perform attribute splitting, and then calculate the sensitivity score.

[0093] Step 1.3.2.1: Medical image attribute splitting and scoring: For medical images such as CT images, use the lightweight image model MobileNet to extract image features and split them into two attributes: lesion area and background area.

[0094] The lesion area is a high-sensitivity attribute that contains key information such as tumor location and size, while the background area is a low-sensitivity attribute, such as normal lung tissue. When calculating the multi-modal data sensitivity weight, adjustments are made based on the characteristics of the medical scene, specifically: leakage impact weight 0.4, compliance requirement weight 0.4, and data value weight 0.2.

[0095] Score each attribute from three dimensions, 1 to 5 points: the lesion area gets 5 points in the leakage impact, 5 points in the compliance requirement, and 5 points in the data value; the background area gets 1 point in the leakage impact, 1 point in the compliance requirement, and 2 points in the data value.

[0096] The multi-modal data attribute sensitivity score is obtained by multiplying the sensitivity weight of each dimension by the score of the attribute in that dimension, and then adding the results of the three dimensions. For example, the multi-modal data attribute sensitivity score of the lesion area = 0.4 x 5 + 0.4 x 5 + 0.2 x 5 = 5.0; the multi-modal data attribute sensitivity score of the background area = 0.4 x 1 + 0.4 x 1 + 0.2 x 2 = 1.2.

[0097] Step 1.3.2.2: Diagnostic text attribute splitting and scoring: For diagnostic text, such as medical records, use the text model DistilBERT to extract semantic features and split them into two attributes: diagnostic conclusion and symptom description. The diagnostic conclusion belongs to a high-sensitive attribute, such as lung cancer in the late stage, and the symptom description belongs to a medium-sensitive attribute, such as coughing and chest pain.

[0098] Using the multi-modal data sensitivity weights, the leakage impact is 0.4, the compliance requirement is 0.4, and the data value is 0.2. After scoring, the multi-modal data attribute sensitivity score is calculated: the diagnostic conclusion gets 5 points for leakage impact, 5 points for compliance requirement, and 4.8 points for data value, and the multi-modal data attribute sensitivity score = 0.4 x 5 + 0.4 x 5 + 0.2 x 4.8 ≈ 4.96; the symptom description gets 3 points for leakage impact, 3 points for compliance requirement, and 3.5 points for data value, and the multi-modal data attribute sensitivity score = 0.4 x 3 + 0.4 x 3 + 0.2 x 3.5 ≈ 3.1.

[0099] After the above processing, the limitations of traditional unstructured data privacy protection are broken through, and the medical image CT graph is split into high-sensitive lesion area and low-sensitive background area, the diagnostic text is split into high-sensitive diagnostic conclusion and medium-sensitive symptom description, and the cross-border regulatory requirements are combined, such as the strict restrictions of the first alliance GDPR on lesion data. The attribute-level sensitivity score is calculated to achieve fine-grained privacy protection of unstructured data and adapt to cross-border multi-modal data transmission scenarios.

[0100] Step 2: Privacy budget allocation: based on the structured situation awareness result, the privacy budget allocation process is integrated, and each data attribute is allocated a privacy budget. The constraints of the allocation process include that the privacy budget of each data attribute is not lower than the preset technical lower limit, not higher than the maximum privacy budget allowed by the corresponding regulations, and the total budget of all attributes is not higher than the link budget margin, to obtain an attribute-level privacy budget vector.

[0101] Further, the privacy budget allocation process includes:

[0102] The state space of the deep Q network model is constructed, and the input information is the structured situation awareness result, including the attribute-level sensitivity score of all data attributes, the maximum privacy budget allowed by the regulations, the abnormal score corresponding to the attack risk level, the side channel attack intensity value, and the link budget margin;

[0103] define a model action space as an attribute-level privacy budget vector;

[0104] Initialize the experience replay pool, the main network and the target network of the model, select actions using the ε-greedy strategy, update the parameters of the main network by extracting samples from the experience replay pool, update the parameters of the target network at intervals of a preset training time step, and obtain the attribute-level privacy budget vector by maximizing the cumulative reward value in combination with the composite reward function.

[0105] Further, the composite reward function includes: a privacy protection benefit negatively related to the success rate of member inference attacks, the weight of which is dynamically adjusted according to the attack risk level; a data utility loss related to the data perplexity, the weight of which is fixed; and a compliance score positively related to the compliance degree of the attribute-level privacy budget vector, the weight of which is fixed.

[0106] Step 2.1: State space construction.

[0107] All key information output by the situation awareness stage is integrated into a structured environment state as input to the deep Q network model. The information contained in the environment state is as follows:

[0108] The structured data attribute sensitivity score of all structured data attributes, such as name 4.4, age 3.3, medical history 5.0;

[0109] The multi-modal data attribute sensitivity score of all multi-modal data attributes, such as lesion area 5.0, background area 1.2, diagnosis conclusion 4.96, and symptom description 3.1;

[0110] The maximum privacy budget allowed by regulations in the target region for each data attribute, such as name 0.8, age 1.5, medical history 0.2, lesion area 0.15, background area 1.8, diagnosis conclusion 0.2, and symptom description 1.5;

[0111] The anomaly score corresponding to the risk level of the member inference attack, such as 0.68 for medium risk;

[0112] The side channel attack strength value, such as 1.4;

[0113] The budget margin of the transmission link, such as 0.3.

[0114] For example, for the medical data transmission link from the first country to the first alliance, the environment state can be described as: [name 4.4, age 3.3, medical history 5.0, lesion area 5.0, background area 1.2, diagnosis conclusion 4.96, symptom description 3.1, name 0.8, age 1.5, medical history 0.2, lesion area 0.15, background area 1.8, diagnosis conclusion 0.2, symptom description 1.5, 0.68, 1.4, 0.3], ensuring that the deep Q network model can fully perceive the current transmission environment.

[0115] Step 2.2: Action space definition.

[0116] The action of the deep Q network model is the attribute-level privacy budget vector, that is, a specific privacy budget value is assigned to each data attribute. The assignment needs to meet three constraint conditions:

[0117] The privacy budget value of each data attribute cannot exceed the maximum privacy budget allowed by the regulations in the target region, for example, the maximum privacy budget allowed by the regulations in the lesion area of the first alliance region is 0.15, and the assigned privacy budget value of the lesion area cannot exceed 0.15;

[0118] The privacy budget value of each data attribute cannot be lower than the technical lower limit, which is set to 0.1 to avoid the data losing all use value due to too much noise, for example, the privacy budget value of the age data cannot be lower than 0.1;

[0119] The sum of the privacy budget values of all data attributes cannot exceed the budget margin of the transmission link, for example, the link budget margin is 0.3, and the sum of the privacy budget values of all attributes should be ≤0.3.

[0120] For example, when assigning privacy budgets to the first country to the first alliance medical data transmission link, the attribute-level privacy budget vector that meets the constraints can be set as: name 0.04, age 0.04, medical history 0.04, lesion area 0.04, background area 0.04, diagnosis conclusion 0.04, symptom description 0.04, the sum of all values is 0.28, and each value meets the first two constraints.

[0121] Step 2.3: Reward function design.

[0122] A composite reward function is designed to quantify the goodness of each round of privacy budget allocation decision, guiding the deep Q network model to learn the optimal strategy. The calculation result of the composite reward function is called reward value, which is composed of three parts, as follows:

[0123] Privacy protection benefit: negatively correlated with the success rate of member inference attack, the lower the success rate of member inference attack, for example, 10%, the higher the privacy protection benefit. The weight of privacy protection benefit is dynamically adjusted according to the risk level of member inference attack: when the risk level is high, the weight is set to 0.5; when the risk level is medium, the weight is set to 0.4; when the risk level is low, the weight is set to 0.3. For example, the weight corresponding to medium risk is 0.4, and the success rate of member inference attack is 10%, so the privacy protection benefit = 0.4 x (1-10%) = 0.36.

[0124] Data utility loss: negatively related to the availability of the noisy data, the lower the availability of the noisy data, for example, the medical data diagnostic accuracy rate decreases from 95% to 70%, the higher the data utility loss. The weight of the data utility loss is fixed at 0.3, which is set by expert experience to balance privacy protection and data availability. The calculation method of data utility loss is: (the confusion degree of noisy data-the confusion degree of original data) ÷ the confusion degree of original data. The higher the confusion degree, the lower the data availability, for example, the original data confusion degree is 100, the noisy data confusion degree is 105, the data utility loss = (105-100) ÷ 100 = 0.05, and the corresponding deduction item = 0.3 x 0.05 = 0.015.

[0125] Compliance score: positively related to the compliance degree of the attribute-level privacy budget vector. If the privacy budget values of all data attributes comply with the maximum privacy budget allowed by the regulations, and no attribute exceeds the upper limit, the compliance score is 1. If there is an attribute that exceeds the upper limit, the score is deducted by the average value of (the value that exceeds the upper limit ÷ the maximum privacy budget allowed by the regulations), for example, an attribute exceeds the upper limit by 0.1, and the maximum privacy budget allowed by the regulations is 0.2, the deduction score = 0.1 ÷ 0.2 = 0.5, and the compliance score = 1-0.5 = 0.5. The weight of the compliance score is fixed at 0.3 to ensure compliance priority, for example, the compliance score is 1, and the corresponding compliance benefit = 0.3 x 1 = 0.3.

[0126] The final calculation method of the reward value is: privacy protection benefit-data utility loss deduction item+compliance benefit, for example, the reward value in the above example = 0.36-0.015+0.3 = 0.645. The deep Q network model learns the privacy budget allocation method of high privacy, high utility and high compliance by maximizing the cumulative reward value.

[0127] Step 2.4: Deep Q network model training and inference.

[0128] Step 2.4.1: initialize the core components of the deep Q network model, including:

[0129] Experience replay pool: used to store sample data during training, with a capacity of 10,000, each sample containing the current environment state, current action, current reward value and next environment state, and the current action is the attribute-level privacy budget vector;

[0130] Main network: used to predict the value of each action, i.e. the expected reward value corresponding to the action, the network structure includes an input layer, two layers of fully connected hidden layers and an output layer, the dimension of the input layer is consistent with the dimension of the environment state, for example 17 dimensions, the first layer of fully connected hidden layer has 64 neurons, the second layer has 32 neurons, both use ReLU activation function, the dimension of the output layer is consistent with the size of the action space, for example 1000 kinds of action combinations correspond to 1000 dimensions;

[0131] Target network: used to stabilize the training process, the initial parameters are completely consistent with the main network, and the parameters are updated once every 100 training time steps, which are the parameters of the current main network.

[0132] Step 2.4.2: The training process is performed in a training cycle, a total of 1000 training cycles are set, each training cycle contains 50 training time steps, and the specific steps are as follows:

[0133] Obtain the initial environment state from the multi-dimensional situation awareness stage and input the main network;

[0134] In each training time step, an ε-greedy strategy is used to select an action: set the ε value to 0.1, i.e. 90% probability of selecting the action with the highest predicted value from the main network, and 10% probability of randomly selecting an action for exploring more potential optimal strategies;

[0135] Execute the selected action, i.e. allocate privacy budget according to the attribute-level privacy budget vector, calculate the corresponding reward value, and obtain the next environment state after executing the action;

[0136] Store the current environment state, current action, current reward value and next environment state in the experience replay pool;

[0137] When the number of samples in the experience replay pool is ≥ 32, randomly select 32 samples from the experience replay pool;

[0138] Predict the maximum action value of the next environment state using the target network, and calculate the target action value by combining the current reward value, target action value = current reward value + discount factor × maximum action value of next environment state, the discount factor is set to 0.9;

[0139] Predict the predicted action value of the current environment state and the current action using the main network, and calculate the mean square error between the predicted action value and the target action value, i.e. the loss value;

[0140] Minimize the loss value using the Adam optimizer, and set the learning rate to 0.001 to update the parameters of the main network;

[0141] Every 100 training time steps, copy the parameters of the main network to the target network to update the target network parameters.

[0142] After the training is completed, the real-time environment state is input to the main network, the main network outputs the predicted value of each actionable action, and the action with the highest predicted value is selected as the final attribute-level privacy budget vector for subsequent data processing.

[0143] Step 3: Explainable and audit: perform causal analysis on the decision-making process of the deep Q network model, and combine the alliance chain to store evidence and smart contract audit processing on the key information of the whole process of cross-border data transmission, to obtain a causal explainable report and an unforgeable audit record, and the key information of the whole process of cross-border data transmission includes the digital signature of the participants.

[0144] Further, the causal analysis includes: constructing a causal relationship diagram, the nodes are structured data attribute sensitivity scores, multi-modal data attribute sensitivity scores, maximum privacy budget allowed by regulations, attack risk levels and side channel attack intensity values, the causal relationship is: the higher the sensitivity score, the smaller the maximum privacy budget allowed by regulations, the higher the attack risk level, the greater the side channel attack intensity value, and the smaller the privacy budget value of the corresponding data attribute; using intervention analysis method to fix node value and observe privacy budget change, deduce contribution degree of each node, and generate causal explainable report;

[0145] The smart contract audit processing includes: using the alliance chain framework to store structured situation awareness results, attribute-level privacy budget vectors, causal explainable reports, digital signatures of participants and timestamps; deploying a smart contract on the alliance chain, calculating the cumulative privacy budget of the sequence link and the cumulative privacy budget of the parallel link, and when the total cumulative privacy budget reaches the preset global budget threshold, automatically freezing the link and warning.

[0146] Step 3.1: Causal explainable report generation.

[0147] Step 3.1.1: First, construct a causal relationship diagram to clearly identify the key factors affecting privacy budget allocation and the causal relationship between privacy budget values, and the specific nodes and relationships are as follows:

[0148] Nodes: structured data attribute sensitivity scores, multi-modal data attribute sensitivity scores, maximum privacy budget allowed by regulations, member inference attack risk levels and side channel attack intensity values;

[0149] Causal relationship: the higher the structured data attribute sensitivity score, the smaller the corresponding privacy budget value; the higher the multi-modal data attribute sensitivity score, the smaller the corresponding privacy budget value; the smaller the maximum privacy budget allowed by regulations, the smaller the corresponding privacy budget value; the higher the member inference attack risk level, the larger the anomaly score, the smaller the corresponding privacy budget value; the greater the side channel attack intensity value, the smaller the corresponding privacy budget value.

[0150] Step 3.1.2: Based on the causal relationship diagram, the contribution of each factor to the privacy budget value is derived using intervention analysis, which means fixing the value of a certain factor and observing the change in the privacy budget value. For example, fix the multi-modal data attribute sensitivity score of the lesion region at 5.0, and observe the change in the privacy budget value of the lesion region while keeping other factors unchanged, to determine the contribution of this factor.

[0151] Step 3.1.3: Finally, call the legal large model LawGPT to generate a natural language format causal explainable report, which needs to include the following contents:

[0152] The reason for determining the privacy budget value of each data attribute, for example: the privacy budget value of the lesion region is 0.04, the reasons include: the multi-modal data attribute sensitivity score is 5.0, the first alliance regulation allows the maximum privacy budget to be 0.15, the current side channel attack intensity value is 1.4, and the risk is high;

[0153] Counterfactual results, that is, if a key factor changes, the adjustment direction of the privacy budget value, for example: if the side channel attack intensity value decreases from 1.4 to 0.5, the risk is low, and the privacy budget value of the lesion region can be adjusted to 0.08, which still meets the regulatory requirements.

[0154] The causal explainable report needs to ensure that non-technical personnel, such as regulatory agency staff, can clearly understand the decision logic.

[0155] Step 3.2: Alliance chain storage and smart contract audit.

[0156] Step 3.2.1: Use the alliance chain to store the key data of the whole process of cross-border data transmission, the specific framework of the alliance chain is Hyperledger Fabric, and the stored data content is as follows:

[0157] Environmental state information, that is, the structured environmental state constructed in step 2.1;

[0158] The final output attribute-level privacy budget vector;

[0159] Causal explainable report;

[0160] Digital signatures of each participant, including data sender, data receiver and regulatory agency, digital signature is used to ensure that the data source is traceable;

[0161] Timestamp, records the specific time of data generation, accurate to seconds.

[0162] The storage mode of the consortium chain is blockchain storage, each block contains the above data and the hash value of the previous block, the hash value is a unique string generated by an encryption algorithm, if the data of the previous block is tampered with, the hash value will change, thereby ensuring that the stored data cannot be tampered with.

[0163] Step 3.2.2: Deploy the smart contract on the consortium chain, the smart contract is a pre-written automatic execution code for calculating the cumulative privacy budget of cross-border transmission, the specific calculation rules are as follows:

[0164] Sequence link refers to multiple rounds of cross-border transmission of the same user: the cumulative privacy budget is the sum of all values in the attribute-level privacy budget vector of each transmission, for example, the sum of the attribute-level privacy budget vectors of a user's 3 rounds of transmission is 0.3, 0.28, and 0.32, the cumulative privacy budget of the sequence link = 0.3 + 0.28 + 0.32 = 0.9;

[0165] Parallel link refers to simultaneous cross-border transmission of different users: the cumulative privacy budget is the maximum value of the sum of the attribute-level privacy budget vectors of each link, and the cumulative privacy budget of the parallel link is the maximum value of the sum of the attribute-level privacy budget vectors of each link among all parallel links, for example, the sum of the attribute-level privacy budget vectors of two parallel links is 0.3 and 0.25, the cumulative privacy budget of the parallel link = 0.3;

[0166] Total cumulative privacy budget = sequence link cumulative privacy budget + parallel link cumulative privacy budget.

[0167] The global budget threshold is pre-set in the smart contract, which is determined by the regulatory agency, for example, 3.0, if the total cumulative privacy budget ≥ global budget threshold, the smart contract will automatically perform two operations: one is to freeze the current cross-border transmission link and prohibit new transmission requests; two is to send an alarm message to the regulatory agency, such as a short message or an email, to prompt the budget to exceed the threshold.

[0168] All audit records, including cumulative privacy budget calculation results and alarm records, are stored in real time on the consortium chain, ensuring compliance throughout the cross-border transmission process, and the audit records can be permanently traced.

[0169] By building a causal explainable report + consortium chain storage audit closed loop, compared with traditional consortium chain only storing budget allocation results, the causal explanation report is included in the on-chain storage, and the cumulative privacy budget is automatically calculated by the smart contract and the threshold alarm is triggered, solving the black box problem of reinforcement learning model, meeting the traceable and explainable compliance requirements of cross-border supervision.

[0170] Step 4: Execution and response: according to the attribute-level privacy budget vector, attribute-level noise injection is performed on different types of data attributes, real-time monitoring of burst risk in the transmission process, adaptive dynamic adjustment based on data attribute sensitivity level and transmission link priority, to obtain secure data that can be transmitted across borders.

[0171] Further, the attribute-level noise injection includes: for numerical data, using Laplace mechanism to inject; for discrete data, using exponential mechanism to inject; for medical image data, using feature-level Laplace mechanism to add noise; for text data, using word embedding perturbation mechanism to add noise.

[0172] Further, the adaptive dynamic adjustment process includes: using an extreme gradient boosting model to predict the dynamic threshold value of side channel attack and the dynamic early warning value of link budget based on link type and data sensitivity average; when monitoring the side channel attack intensity value exceeding the dynamic threshold value, the link budget margin below the dynamic early warning value or detecting target area regulation updates, triggering adjustment: adjusting the privacy budget value according to the data attribute sensitivity level; freezing low-priority links and stopping allocating new budget, transferring the saved budget to high-priority links; interrupting the current transmission, reacquiring structured situational awareness results, and starting a new round of deep Q network model decision.

[0173] Step 4.1: Attribute-level noise injection.

[0174] According to the type of data attribute, the corresponding privacy protection mechanism is selected, and after adding noise to each attribute, the transmissible secure data is generated, and the type of data attribute includes numerical, discrete, medical image and text.

[0175] Step 4.1.1: Numerical data noise injection: numerical data includes age and medical history indicators, etc., using Laplace mechanism to add noise. The specific steps are:

[0176] Determine the original value of the numerical data, for example, the original value of the medical history index is 120 mg / dL;

[0177] Determine the attribute sensitivity of the data attribute, which is set by domain experts, and the attribute sensitivity of numerical data is the maximum change amount that the data may occur, for example, the attribute sensitivity of the medical history index is set to 20 mg / dL;

[0178] Determine the privacy budget value of the data attribute, which comes from the attribute-level privacy budget vector output in step 2.4, for example, the privacy budget value of the medical history index is 0.06;

[0179] Calculate the scale parameter of the Laplace distribution, the calculation method is: attribute sensitivity ÷ privacy budget value, for example, scale parameter = 20 ÷ 0.06 ≈ 333.33 mg / dL;

[0180] A noise value is randomly sampled from a Laplace distribution, which has the characteristic that the closer the value is to 0, the higher the probability of occurrence. For example, a noise value of 45.2 mg / dL is sampled;

[0181] The noise value is added to the original value to obtain the noisy security data, for example, 120 + 45.2 = 165.2 mg / dL.

[0182] Step 4.1.2: Discrete data noise injection: Discrete data includes names, etc., and noise is added using an exponential mechanism. The specific steps are:

[0183] Determine the original value of the discrete data, for example, the original value of the name is Zhang San;

[0184] Construct a fuzzy option set containing multiple fuzzy results similar to the original value, for example, the fuzzy option set of the name is Zhang San, Zhang Ming, and Li San;

[0185] Calculate the similarity score of each fuzzy option with the original value, i.e. the utility function value, the higher the similarity, the higher the score, for example, the similarity score of Zhang San and Zhang San is 0.9, Zhang Ming is 0.7, and Li San is 0.3;

[0186] Determine the utility function sensitivity of the data attribute, which is set by domain experts and is the maximum possible change in similarity score, for example, the utility function sensitivity of the name is set to 0.2;

[0187] Determine the privacy budget value of the data attribute, for example, the privacy budget value of the name is 0.05;

[0188] Calculate the selection probability of each fuzzy option, the calculation method is: exponential function (privacy budget value x similarity score ÷ (2 x utility function sensitivity)) ÷ the sum of the exponential function results of all fuzzy options, for example, the selection probability of Zhang San = exponential function (0.05 x 0.9 ÷ (2 x 0.2)) ÷ (exponential function (0.05 x 0.9 ÷ 0.4) + exponential function (0.05 x 0.7 ÷ 0.4) + exponential function (0.05 x 0.3 ÷ 0.4)) ≈ 1.119 ÷ 3.248 ≈ 0.344;

[0189] Randomly select a fuzzy option according to the selection probability as the noisy security data, for example, select Zhang San.

[0190] Step 4.1.3: Medical image noise injection: For the lesion area and background area in the medical image, noise is added using a feature-level Laplace mechanism. The specific steps are:

[0191] Extract the feature map of the lesion region and the background region in the medical image, which is extracted by the MobileNet model in step 1.3.2, for example, the pixel value of the feature map of the lesion region is 0.6;

[0192] Determine the feature sensitivity of the feature map, which is set by medical experts and is the maximum possible change of the feature image pixel value, for example, the feature sensitivity of the lesion region is set to 0.5;

[0193] Determine the privacy budget value of the region, for example, the privacy budget value of the lesion region is 0.04;

[0194] Calculate the scale parameter of the Laplace distribution, the calculation method is: feature sensitivity ÷ privacy budget value, for example, scale parameter = 0.5 ÷ 0.04 = 12.5;

[0195] Sample noise value from Laplace distribution, for example, sample 0.3;

[0196] Add the noise value to the feature map pixel value to get the noisy feature map;

[0197] Reconstruct the noisy feature map into a medical image using an image decoder as noisy security data, the lesion region is hidden after adding noise, and the background region only adds a small amount of noise to retain image usability.

[0198] Step 4.1.4: Text data noise injection: For the diagnosis conclusion and symptom description in the diagnosis text, use the word embedding perturbation mechanism to add noise. The specific steps are:

[0199] Extract the word embedding vector of the text attribute, which is extracted by the DistilBERT model in step 1.3.2, for example, the word embedding vector of the diagnosis conclusion lung cancer advanced is [0.2, 0.5, -0.1], only show the first 3 dimensions, the actual is 768 dimensions;

[0200] Determine the embedding sensitivity of the word embedding vector, which is set by natural language processing experts and is the maximum possible change of the word embedding vector value, for example, the embedding sensitivity of the diagnosis conclusion is set to 0.3;

[0201] Determine the privacy budget value of the text attribute, for example, the privacy budget value of the diagnosis conclusion is 0.05;

[0202] Calculate the scale parameter of the Laplace distribution, the calculation method is: embedding sensitivity ÷ privacy budget value, for example, scale parameter = 0.3 ÷ 0.05 = 6;

[0203] Sample noise vector from Laplace distribution, for example, sample [0.4, 0.1, -0.2];

[0204] The noise vector is added to the original word embedding vector to obtain a noisy word embedding vector;

[0205] The noisy word embedding vector is reconstructed into text by the text generation model as noisy security data, for example, late-stage lung cancer is reconstructed into lung malignancy, and slight adjustments of cough and chest pain are made to cough and chest discomfort.

[0206] Step 4.2: Adaptive dynamic adjustment.

[0207] Real-time monitoring of three types of sudden risks in cross-border transmission process, once the risk condition is triggered, immediately adjust the privacy protection strategy, as follows:

[0208] Risk trigger conditions:

[0209] The side channel attack strength value exceeds the dynamic threshold value, and the dynamic threshold value is predicted based on link type, data sensitivity average and other characteristics through the extreme gradient boosting model XGBoost, for example, the dynamic threshold value of the first country to the first alliance medical data link is 0.75, and the dynamic threshold value of the first country to the second alliance marketing data link is 0.9;

[0210] The budget margin of the transmission link is lower than the dynamic warning value, and the dynamic warning value is also predicted by the extreme gradient boosting model, for example, the dynamic warning value of the high sensitive data link is 0.3, and the dynamic warning value of the low sensitive data link is 0.2;

[0211] The LawGPT detects that the privacy regulations of the target area are updated, and the update content involves the adjustment of the privacy budget value, for example, the first alliance lowers the maximum privacy budget allowed by the regulations in the lesion area from 0.15 to 0.12.

[0212] Adjustment strategy:

[0213] Privacy budget value adjustment: structured data attribute sensitivity score ≥ 4.5, or multi-modal data attribute sensitivity score ≥ 4.5 for high sensitive attribute;

[0214] The structured data attribute sensitivity score is between 3.0 and 4.5, or the multi-modal data attribute sensitivity score is between 3.0 and 4.5 for medium sensitive attribute;

[0215] The structured data attribute sensitivity score is less than 3.0, or the multi-modal data attribute sensitivity score is less than 3.0 for low sensitive attribute

[0216] The privacy budget value of high-sensitive attributes is reduced by 20%, for example, the privacy budget value of the lesion area is reduced from 0.04 to 0.04*0.8=0.032; the privacy budget value of medium-sensitive attributes is reduced by 10%, and the reduced privacy budget value should not be lower than the technical lower limit 0.1, for example, the privacy budget value of the symptom description is reduced from 0.02 to 0.02*0.9=0.018; the privacy budget value of low-sensitive attributes remains unchanged;

[0217] Link priority scheduling: freeze low-priority links, such as links for transmitting marketing data and ordinary user behavior data, stop allocating new privacy budgets for them, transfer the saved budgets to high-priority links, such as links for transmitting medical data and financial data;

[0218] Re-decision loop: interrupt the current ongoing cross-border transmission, return to the multi-dimensional situation awareness stage, re-collect the environmental state information, including the updated attack strength, regulatory requirements, and budget surplus, start a new round of deep Q network model decision-making, generate a new attribute-level privacy budget vector, and perform attribute-level noise injection in step 4.1 again to ensure data privacy safety under sudden risks.

[0219] By using the extreme gradient boosting model XGBoost to predict the dynamic threshold, compared with the traditional fixed threshold, such as all link side channel attack high risk threshold is 0.8, the dynamic threshold can adapt to the scene difference according to the link type and the average value of data sensitivity, such as the first alliance medical link threshold 0.75, the second alliance marketing link threshold 0.9, avoid over-protection in low-risk scenarios and insufficient protection in high-risk scenarios, and improve the adaptability of the threshold.

[0220] Embodiment two

[0221] Based on the same inventive concept as the cross-border personal data transmission security detection method based on differential privacy provided in the embodiments of the present application, the embodiments of the present application also provide a cross-border personal data transmission security detection system based on differential privacy. For the contents in the system embodiments, if there is any ambiguity, reference can be made to the corresponding contents in the method embodiments.

[0222] As shown in Figure 2 The cross-border personal data transmission security detection system based on differential privacy comprises:

[0223] A multi-dimensional situation awareness module, which collects and quantifies the technical environmental risks, multi-country regulatory constraints and multi-modal data features affecting the cross-border data transmission security in real time, converts the fuzzy information into structured situation awareness results, and outputs comprehensive data including attack risk level, link budget surplus, side channel attack strength value, compliance rules and attribute-level sensitivity score;

[0224] a privacy budget allocation module, receiving the structured situation awareness result, integrating input information through a deep Q network algorithm, allocating an optimal privacy budget for each data attribute under the constraint conditions that the privacy budget of each data attribute is not lower than the technical lower limit, not higher than the maximum privacy budget allowed by regulations, and the sum of all attribute budgets does not exceed the link budget margin, and outputting an attribute-level privacy budget vector;

[0225] an interpretable audit module, receiving the attribute-level privacy budget vector and the structured situation awareness result, performing causal analysis on the decision-making process of the deep Q network model to generate a natural language interpretable report, and storing and transmitting key information of the whole process by using a consortium chain technology, automatically calculating the cumulative privacy budget by using a smart contract and triggering an audit alarm, realizing decision-making interpretation and process traceability;

[0226] an execution response module, receiving the attribute-level privacy budget vector, performing differentiated attribute-level noise injection on different types of data attributes to generate secure data, and monitoring sudden risks in the transmission process in real time, dynamically adjusting the privacy protection strategy based on the sensitive level of the data attribute and the transmission link priority, and ensuring the continuous safety and compliance of cross-border data transmission.

[0227] Further, the multi-dimensional situation awareness module includes a technical awareness unit, a regulation awareness unit and a multi-modal data awareness unit; the technical awareness unit receives cross-border transmission request logs and device sensor signals, detects member inference attacks and calculates attack risk levels by using an isolation forest algorithm, determines the maximum privacy budget of the link and calculates the budget margin by using a legal large model, and calculates the side channel attack intensity value by analyzing electromagnetic signals; the regulation awareness unit receives multi-country regulation texts and target area information, and outputs compliance rules by knowledge graph construction and legal large model analysis; the multi-modal data awareness unit receives structured and unstructured data, and outputs attribute-level sensitivity scores by attribute splitting and sensitivity evaluation; the multi-dimensional situation awareness module transmits the integrated structured situation awareness result to the privacy budget allocation module and the interpretable audit module;

[0228] The privacy budget allocation module receives the structured situation awareness result, constructs a state space of a deep Q network model, wherein the inputs include the sensitivity scores of all data attributes, the maximum privacy budget allowed by regulations, the attack risk level indicators, the side channel attack intensity value and the link budget margin, defines the action space as an attribute-level privacy budget vector that meets multiple constraints, trains the output optimal allocation scheme through reinforcement learning, and transmits the attribute-level privacy budget vector to the interpretable audit module and the execution response module;

[0229] The interpretable audit module receives the attribute-level privacy budget vector and the structured situation awareness result, constructs a causal relationship diagram and derives the contribution degree of each factor through intervention analysis, and generates a causal interpretable report; at the same time, the alliance chain is used to store the environmental state, the privacy budget vector, the interpretable report, the digital signature and the time stamp, and through the deployed smart contract, the cumulative privacy budget of the serial link and the parallel link is calculated, and when the global threshold is exceeded, the link is automatically frozen and an alarm is given; the audit record is transmitted to the regulatory party in real time;

[0230] The execution response module receives the attribute-level privacy budget vector, and performs noise injection on numerical data using the Laplace mechanism, on discrete data using the exponential mechanism, on medical images using the feature-level Laplace mechanism, and on text data using the word embedding perturbation mechanism, to generate secure data; at the same time, the side channel attack intensity value, the budget margin and the regulation update are monitored in real time, the dynamic threshold is predicted using a machine learning model, the privacy budget value adjustment, the link priority scheduling and the re-decision closed loop are triggered, and the adjusted strategy is fed back to the privacy budget allocation module for iterative optimization.

[0231] Obviously, the above-described embodiments are only part of the embodiments of the present application, not all the embodiments, and the preferred embodiments of the present application are given in the drawings, but do not limit the patent scope of the present application. The present application can be implemented in many different forms, and on the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present application more thorough and comprehensive. Although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing specific embodiments, or make equivalent replacements to some technical features. Any equivalent structure made by using the content of the specification and drawings, directly or indirectly applied to other related technical fields, is also within the scope of the patent protection of the present application.

Claims

1. A method for detecting the security of cross-border personal data transmission based on differential privacy, characterized in that, The method comprises the following steps: Multi-dimensional situation awareness processing is performed on three types of information including technical environment risk, multi-national regulatory constraints and multi-modal data characteristics of cross-border personal data transmission environment, to obtain structured situation awareness results including attack risk level, link budget margin, side channel attack intensity value, compliance rules and attribute-level sensitivity score; Based on the deep Q network algorithm, the structured situation awareness results are integrated, and privacy budget allocation processing is performed on each data attribute. The constraints of the allocation process include that the privacy budget of each data attribute is not lower than the preset technical lower limit, not more than the maximum privacy budget allowed by the corresponding regulations, and the total sum of all attribute budgets is not more than the link budget margin, to obtain an attribute-level privacy budget vector; Causal analysis is performed on the decision-making process of the deep Q network model, and the cross-border data transmission whole-process key information is notarized and audited by the smart contract in combination with the alliance chain, to obtain a causally interpretable report and an unalterable audit record. The cross-border data transmission whole-process key information includes digital signatures of participants; According to the attribute-level privacy budget vector, attribute-level noise injection is performed on each type of data attribute, real-time monitoring of sudden risks in the transmission process is performed, and adaptive dynamic adjustment is performed based on the data attribute sensitivity level and the transmission link priority, to obtain secure data that can be transmitted across borders; The multi-dimensional situation awareness processing comprises: Technical environment risk awareness: an isolation forest algorithm is used to extract the request frequency, data access range and transmission delay characteristics of the cross-border transmission request, perform member inference attack detection, and obtain the attack risk level; a legal large model is called to determine the maximum privacy budget of each cross-border transmission link, and the link budget margin is calculated by the difference between the maximum privacy budget and the historical used privacy budget of the link; the real-time electromagnetic signal of the transmission equipment is collected through an electromagnetic radiation sensor, and the variance of the real-time electromagnetic signal and the preset normal signal baseline is compared to calculate the side channel attack intensity value; Multi-national regulatory constraint awareness: the jurisdiction, data attribute and regulation clause class entities are extracted from the multi-national privacy regulation text, the constraint relationship between the entities is labeled, and a cross-border compliance knowledge graph is formed by storing the entities in a graph database; the legal large model is called, the target area name and data attribute type are input, and the compliance rules are quantified from the fuzzy regulation clauses; Multi-modal data feature awareness: a lightweight image model is used to extract medical image features, which are split into lesion area and background area and the attribute-level sensitivity score is calculated; a text model is used to extract diagnostic text semantic features, which are split into diagnostic conclusion and symptom description and the attribute-level sensitivity score is calculated; The privacy budget allocation process comprises: constructing a state space of a deep Q network model, input information being a structured situation awareness result, including attribute-level sensitivity scores of all data attributes, maximum privacy budgets allowed by regulations, anomaly scores corresponding to attack risk levels, side channel attack strength values and link budget margins; defining a model action space as an attribute-level privacy budget vector; initializing an experience replay pool, a main network and a target network of the model, selecting an action by using an epsilon-greedy strategy, updating parameters of the main network by extracting samples from the experience replay pool, updating parameters of the target network at preset training time steps, and obtaining the attribute-level privacy budget vector by combining a composite reward function to maximize a cumulative reward value.

2. The method of claim 1, wherein the method further comprises: The compliance rules include maximum privacy budgets allowed by regulations and desensitization requirements. Based on the attribute-level sensitivity scores, data attribute sensitivity levels are divided into high-sensitivity attributes, medium-sensitivity attributes and low-sensitivity attributes. The transmission link priorities are divided into high-priority links and low-priority links.

3. The method of claim 1, wherein the method further comprises: The causal analysis comprises: constructing a causal relationship diagram, nodes being structured data attribute sensitivity scores, multi-modal data attribute sensitivity scores, maximum privacy budgets allowed by regulations, attack risk levels and side channel attack strength values, and the causal relationship being that the higher the sensitivity score, the smaller the maximum privacy budget allowed by regulations, the higher the attack risk level, the greater the side channel attack strength value, and the smaller the privacy budget value of the corresponding data attribute; fixing node values and observing privacy budget changes by using an intervention analysis method, deriving a contribution degree of each node, and generating a causally explainable report; The smart contract auditing process comprises: storing the structured situation awareness result, the attribute-level privacy budget vector, the causally explainable report, digital signatures of participants and time stamps by using a consortium chain framework; deploying a smart contract on the consortium chain, calculating a serial link cumulative privacy budget and a parallel link cumulative privacy budget, and automatically freezing links and issuing an alarm when a total cumulative privacy budget reaches a preset global budget threshold.

4. The method of claim 1, wherein the method further comprises: The attribute-level noise injection comprises: for numerical data, using a Laplace mechanism to calculate a Laplace distribution scale parameter according to data attribute sensitivity and attribute-level privacy budgets, adding a sampled noise value to an original value to obtain secure data; for discrete data, using an exponential mechanism to construct a fuzzy option set and calculate a similarity score, determining a selection probability according to a utility function sensitivity and a corresponding privacy budget, and randomly selecting an option to obtain secure data; for medical image data, using a feature-level Laplace mechanism to add noise; for text data, using a word embedding perturbation mechanism to add noise.

5. The method of claim 2, wherein the method further comprises: The adaptive dynamic adjustment comprises: using an extreme gradient boosting model to predict a side channel attack dynamic threshold and a link budget dynamic early warning value in combination with link types and data sensitivity means; when it is monitored that the side channel attack strength value exceeds the dynamic threshold, the link budget margin is lower than the dynamic early warning value or it is detected that regulations in a target region are updated, triggering adjustment: adjusting the privacy budget value according to data attribute sensitivity levels. Freezing low-priority links and stopping allocating new budgets, transferring saved budgets to high-priority links; interrupting current transmission, re-acquiring structured situation awareness results, and starting a new round of deep Q network model decision-making.

6. The method of claim 1, wherein the method further comprises: The composite reward function comprises: Privacy protection benefits negatively related to the success rate of membership inference attacks, the weight of which is dynamically adjusted according to the attack risk level; Data utility loss related to data perplexity, the weight of which is fixed; and Compliance score positively related to the compliance degree of the attribute-level privacy budget vector, the weight of which is fixed.

7. A cross-border personal data transmission security detection system based on differential privacy, characterized in that, Comprise: A multi-dimensional situation awareness module for real-time collection and quantification of technical environment risks, multi-country regulatory constraints and multi-modal data characteristics affecting cross-border data transmission security, converting into structured situation awareness results, and outputting comprehensive data including attack risk level, link budget surplus, side channel attack intensity value, compliance rules and attribute-level sensitivity score; A privacy budget allocation module for receiving structured situation awareness results, integrating input information through a deep Q network algorithm, allocating optimal privacy budgets for each data attribute under the constraints that the privacy budget of each data attribute is not lower than the technical lower limit, not higher than the maximum privacy budget allowed by regulations, and the total sum of all attribute budgets does not exceed the link budget surplus, and outputting an attribute-level privacy budget vector; An interpretable audit module for receiving the attribute-level privacy budget vector and the structured situation awareness results, performing causal analysis on the decision-making process of the deep Q network model to generate a natural language interpretable report, and storing and transmitting key information throughout the process using alliance chain technology, automatically calculating cumulative privacy budgets through smart contracts and triggering audit alarms; An execution response module for receiving the attribute-level privacy budget vector, performing differentiated attribute-level noise injection for each type of data attribute to generate secure data, and monitoring sudden risks in the transmission process in real time, dynamically adjusting privacy protection strategies based on data attribute sensitivity levels and transmission link priorities; The multi-dimensional situation awareness module comprises a technical awareness unit, a regulatory awareness unit and a multi-modal data awareness unit; The technical awareness unit is configured to use the isolation forest algorithm to extract the request frequency, data access range and transmission delay characteristics of the cross-border transmission request, perform membership inference attack detection, and obtain the attack risk level; Call the legal large model to determine the maximum privacy budget of each cross-border transmission link, calculate the link budget surplus by the difference between the maximum privacy budget and the historical used privacy budget of the link, and calculate the side channel attack intensity value by comparing the variance of the real-time electromagnetic signal collected by the electromagnetic radiation sensor and the preset normal signal baseline; The regulatory awareness unit is configured to extract jurisdiction, data attribute and regulation clause class entities from multi-country privacy regulation texts, label the constraint relationship between entities and store them in a graph database to form a cross-country compliance knowledge graph; call the legal large model, input the target region name and data attribute type, and quantify the fuzzy regulation clauses to obtain compliance rules; The multi-modal data perception unit is configured to extract medical image features by using a lightweight image model, split the features into lesion regions and background regions, and calculate attribute-level sensitivity scores; The text model is used to extract semantic features of the diagnosis text, split the features into diagnosis conclusions and symptom descriptions, and calculate attribute-level sensitivity scores; The privacy budget allocation module is further configured to construct a state space of a deep Q network model, input information being structured situation awareness results, including attribute-level sensitivity scores of all data attributes, maximum privacy budget allowed by regulations, abnormal scores corresponding to attack risk levels, side channel attack strength values, and link budget margins; define a model action space as an attribute-level privacy budget vector; initialize an experience replay pool, a main network, and a target network of the model, select actions by using an epsilon-greedy strategy, update parameters of the main network by extracting samples from the experience replay pool, update parameters of the target network at preset training time steps, and obtain the attribute-level privacy budget vector by combining a compound reward function to maximize cumulative reward values.

8. The cross-border personal data transmission security detection system based on differential privacy according to claim 7, characterized in that, The interpretable audit module is further configured to receive the attribute-level privacy budget vector and the structured situation awareness results, construct a causal relationship diagram, derive contribution degrees of factors by intervention analysis, generate a causally interpretable report, store an environmental state, a privacy budget vector, an interpretable report, a digital signature, and a timestamp in a consortium chain, calculate cumulative privacy budgets of sequential links and parallel links by using a smart contract, automatically freeze links and issue alarms when the cumulative privacy budgets exceed a global threshold, and transmit audit records to a regulatory party in real time. The execution response module is further configured to receive the attribute-level privacy budget vector, perform noise injection by using a Laplace mechanism for numerical data, an exponential mechanism for discrete data, a feature-level Laplace mechanism for medical images, and a word embedding perturbation mechanism for text data, generate secure data, monitor side channel attack strength values, budget margins, and regulation updates in real time, predict dynamic thresholds by using a machine learning model, trigger privacy budget value adjustment, link priority scheduling, and a re-decision closed loop, and feed back adjusted strategies to the privacy budget allocation module for iterative optimization.

Images