Sensitive information identification method and device, equipment, medium and product

Abstract

The invention provides a sensitive information identification method and device, equipment, a medium and a product. The method comprises the following steps: acquiring to-be-identified data; identifying a word segmentation attribute of the to-be-identified data and at least one of the following attributes: a data source value attribute, a business value attribute and a grading value attribute, and determining a target identification attribute of the to-be-identified data; calculating the target sensitivity of the to-be-identified data according to the target identification attribute, comparing the target sensitivity with a preset sensitivity threshold, and taking the to-be-identified data with the target sensitivity not less than the preset sensitivity threshold as target sensitive information; and processing the to-be-identified data according to the target sensitive information and a preset sensitive information processing rule. According to the sensitive information identification method and device, the sensitivity of the to-be-identified data is adjusted through the attribute reflecting the data value, it is guaranteed that the sensitivity of the to-be-identified data and the sensitivity of application are better met when the sensitive information is identified, and the accuracy of sensitive information identification is guaranteed.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the technical field of information security, and particularly relate to a sensitive information identification method, device, equipment, medium and product. BACKGROUND

[0002] In the big data era, data is large in scale, rapid in growth, various in type, different in structure, and non-standard in description. Moreover, a large amount of sensitive data is contained in the data, and 85% of the data is unstructured data, which poses great challenges to the efficiency and accuracy of sensitive data identification.

[0003] However, in the existing sensitive data discovery and identification scheme, the manual definition of sensitive keywords is inefficient, and based on the manual definition of sensitive keywords, only the sensitive data that matches successfully can be identified, and sensitive data with sensitive semantics will be missed. Therefore, the data security cannot be effectively prevented and controlled. Moreover, the identification method based on the sensitive information identification model is only sensitive to the segmentation itself, and does not consider the value of the data, and there may be misidentification of high-value data. SUMMARY

[0004] Embodiments of the present application provide a sensitive information identification method, device, equipment, medium and product to solve the problem of low efficiency and inaccuracy of existing sensitive data identification.

[0005] To solve the above technical problems, the present application is implemented as follows:

[0006] In a first aspect, the embodiments of the present application provide a sensitive information identification method, comprising:

[0007] obtaining to-be-identified data;

[0008] identifying a segmentation attribute of the to-be-identified data and at least one of the following attributes: a data source value attribute, a business value attribute, and a hierarchical value attribute, to determine a target identification attribute of the to-be-identified data;

[0009] calculating a target sensitivity of the to-be-identified data according to the target identification attribute, and comparing the target sensitivity with a preset sensitivity threshold, and taking to-be-identified data with a target sensitivity not less than the preset sensitivity threshold as target sensitive information, wherein the sensitivity threshold is calculated according to at least one of the data source value attribute, the business value attribute, and the hierarchical value attribute;

[0010] processing the to-be-identified data according to a preset sensitive information processing rule according to the target sensitive information.

[0011] Optionally, the to-be-identified data includes to-be-stored data and to-be-accessed data.

[0012] According to the target sensitive information, the to-be-recognized data is processed according to a preset sensitive information processing rule, including:

[0013] According to the target sensitive information, the to-be-stored data is processed according to a preset sensitive information processing rule, including:

[0014] Or,

[0015] According to the target sensitive information, the to-be-recognized data is processed according to a preset sensitive information processing rule, including:

[0016] Optionally, the to-be-recognized data is structured data or unstructured data.

[0017] The tokenization attribute of the to-be-recognized data is identified, including:

[0018] If the to-be-recognized data is structured data, the name and description of each data item in the to-be-recognized data are taken as the tokenization attribute.

[0019] Or,

[0020] If the to-be-recognized data is unstructured data, the filler, onomatopoeic word and interjection in the to-be-recognized data are removed by a natural language processing tool, and the remaining tokens are taken as the tokenization attribute.

[0021] Optionally, at least one of the following attributes of the to-be-recognized data is identified: data source value attribute, business value attribute, and hierarchical value attribute, including:

[0022] The Internet Protocol address of the data producer of the to-be-recognized data or the device submitting the storage request is identified, and the data source value attribute of the to-be-recognized data is determined.

[0023] And / or,

[0024] The business situation to which the to-be-recognized data belongs is identified, and the business value attribute of the to-be-recognized data is determined.

[0025] And / or,

[0026] The hierarchical situation of the to-be-recognized data is identified, and the hierarchical value attribute of the to-be-recognized data is determined.

[0027] Optionally, the target sensitivity of the to-be-recognized data is calculated according to the target recognition attribute, including:

[0028] The target token in the to-be-recognized data is calculated according to the tokenization attribute.

[0029] A pre-stored sensitive word set is obtained, the semantic similarity between the target token and each word in the sensitive word set is calculated, and the target sensitivity of the target token is determined.

[0030] Optionally, the process of calculating the sensitivity threshold value comprises:

[0031] acquiring comparison data, the comparison data comprising data with the same data source value attribute as the data to be identified and data with the same business value attribute but different data source value attribute from the data to be identified and with the hierarchical value attribute not lower than the hierarchical value attribute of the data to be identified;

[0032] calculating a threshold compensation value of the sensitivity threshold value according to the comparison data;

[0033] determining the sensitivity threshold value according to the threshold compensation value and a preset sensitivity reference value.

[0034] In a second aspect, an embodiment of the present application provides a sensitive information identification device, comprising:

[0035] an acquisition module configured to acquire data to be identified;

[0036] an identification module configured to identify a target identification attribute of the data to be identified by identifying a word segmentation attribute and at least one of the following attributes of the data to be identified: data source value attribute, business value attribute and hierarchical value attribute;

[0037] a first processing module configured to calculate a target sensitivity of the data to be identified according to the target identification attribute, compare the target sensitivity with a preset sensitivity threshold value, and take the data to be identified with the target sensitivity not less than the preset sensitivity threshold value as target sensitive information, wherein the sensitivity threshold value is calculated according to at least one of the data source value attribute, the business value attribute and the hierarchical value attribute;

[0038] a second processing module configured to process the data to be identified according to a preset sensitive information processing rule according to the target sensitive information.

[0039] In a third aspect, an embodiment of the present application provides an electronic device, comprising a processor, a memory and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction is executed by the processor to implement the steps in the sensitive information identification device method according to any one of the first aspect.

[0040] In a fourth aspect, an embodiment of the present application provides a readable storage medium, wherein the readable storage medium stores a program or instruction, and the program or instruction is executed by a processor to implement the steps in the sensitive information identification device method according to any one of the first aspect.

[0041] In a fifth aspect, an embodiment of the present application provides a computer program product comprising computer instructions which, when executed by a processor, implement the steps in the sensitive information identification device method of any one of the first aspect.

[0042] In the present application, the data to be identified is acquired, and the word segmentation attribute of the data to be identified and at least one of the following attributes: data source value attribute, business value attribute, and hierarchical value attribute are identified to determine the target identification attribute of the data to be identified. By considering the value of the data itself, the risk of misidentification caused by incomplete keyword definition is reduced. According to the target identification attribute, the target sensitivity of the data to be identified is calculated, and the target sensitivity is compared with a preset sensitivity threshold. The data to be identified whose target sensitivity is not less than the preset sensitivity threshold is taken as target sensitive information, wherein the sensitivity threshold is calculated according to at least one of the data source value attribute, the business value attribute, and the hierarchical value attribute. Instead of relying completely on manually defined keywords, the problem of low identification accuracy caused by the inability to exhaustively define keywords is avoided. According to the target sensitive information, the data to be identified is processed according to a preset sensitive information processing rule. By comprehensively considering multiple attributes, the identification of sensitive information is not limited to the surface features of the data, but the intrinsic value of the data is analyzed in depth. This multi-dimensional evaluation method can better reflect the true sensitivity of the data, ensure that the identified sensitive information is more consistent with the sensitivity of the data to be identified and the sensitivity of the application, ensure the accuracy of sensitive information identification, and solve the problems of low efficiency and inaccuracy of existing sensitive data identification. BRIEF DESCRIPTION OF DRAWINGS

[0043] Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments with reference made to the accompanying drawings. The drawings are for purposes of illustration only and are not intended to limit the present application thereto. The same reference numerals in different drawings denote the same or similar components. In the drawings:

[0044] Figure 1 is a flowchart of a sensitive information identification method provided by an embodiment of the present application;

[0045] Figure 2 is a structural schematic diagram of a sensitive information identification device provided by an embodiment of the present application;

[0046] Figure 3 is a structural schematic diagram of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0047] With reference to the drawings of the embodiments of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described, obviously, the described embodiments are a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all the other embodiments obtained by those skilled in the art without creative work are within the protection scope of the present application.

[0048] Please refer to Figure 1 The embodiment of the present application provides a sensitive information identification method, comprising:

[0049] Step 11: obtaining to-be-identified data;

[0050] In the embodiment of the present application, the to-be-identified data is data to be determined whether sensitive information exists, specifically comprising: to-be-stored data and to-be-accessed data; that is, when data is stored, obtaining the to-be-stored data, determining the to-be-stored data as the to-be-identified data; or when data is accessed, based on an access request, determining the to-be-accessed data, and determining the to-be-accessed data as the to-be-identified data.

[0051] Step 12: identifying the tokenization attribute of the to-be-identified data and at least one of the following attributes: data source value attribute, business value attribute, hierarchical value attribute, to determine the target identification attribute of the to-be-identified data;

[0052] In the embodiment of the present application, through comprehensive analysis of the above attributes, the target identification attribute of the to-be-identified data is determined, the accuracy and effectiveness of data processing are improved, and the risk of misidentification caused by incomplete keyword definition is reduced by considering the value of the data itself.

[0053] In the embodiment of the present application, optionally, the to-be-identified data is structured data or unstructured data;

[0054] Identifying the tokenization attribute of the to-be-identified data comprises:

[0055] If the to-be-identified data is structured data, the name and brief description of each data item in the to-be-identified data are taken as the tokenization attribute;

[0056] Or,

[0057] If the to-be-identified data is unstructured data, the virtual word, onomatopoeic word and interjection in the to-be-identified data are removed through a natural language processing tool, and the remaining tokenization is taken as the tokenization attribute.

[0058] In the embodiment of the present application, the word segmentation attribute is obtained based on the data itself, if the to-be-identified data is structured data, the name and brief description of each data item in the to-be-identified data are taken as the word segmentation attribute, such as the unique identifier of the user, the user name, the registration time, the account status and the like; if the to-be-identified data is unstructured data, the to-be-identified data is processed by the existing natural language processing method, and after removing the function words (such as prepositions, conjunctions, auxiliary words, mood words), onomatopoeic words, exclamation words, the remaining word segmentation is taken as the word segmentation attribute.

[0059] In the embodiment of the present application, optionally, at least one attribute of the to-be-identified data is identified, including:

[0060] The data source value attribute of the to-be-identified data is determined by identifying the data source value attribute of the to-be-identified data.

[0061] And / or,

[0062] The business value attribute of the to-be-identified data is determined by identifying the business situation to which the to-be-identified data belongs.

[0063] And / or,

[0064] The hierarchical value attribute of the to-be-identified data is determined by identifying the hierarchical situation of the to-be-identified data.

[0065] In the embodiment of the present application, the data source value attribute is the attribute of the producer of the to-be-identified data, the producer can be a person, a unit, an IP address or the like; that is, whether in a data storage scenario or a data access scenario, the to-be-identified data is produced by a producer, and the to-be-identified data is to be or has been stored, and the producer needs to be noted when storing, such as the user identifier (the user is a registered user, such as a personal registration, the user is a person, if the unit is registered, the user is a unit) submitting the storage request, or the IP address of the device submitting the storage request, so as to obtain the identification of the data source value attribute, and take the identification as the data source value attribute, and record the data source value attribute as ID0, ID0 = data producer identifier, ID0 represents the value of the to-be-identified data from the producer level, and the data produced by the high-value producer (such as the core department) will also have higher value.

[0066] For the business value attribute, the to-be-identified data is also annotated with a business case when stored, and the business case can be pre-set by a user, and one of the business cases is selected when stored, such as: the business cases include asset data, personal data, and work orders, and the business cases can be set according to specific business cases, and can be modified according to the change of the business, so as to obtain the corresponding business case, and the business value attribute is recorded as BU0, then BU0 = data business case, BU0 represents the value of the to-be-identified data from the application level, and the data value produced by the high-value application (such as core business) is also high.

[0067] For the hierarchical value attribute, the to-be-identified data is also annotated with a hierarchical classification when stored, and the hierarchical classification is determined by a data producer according to the value of the data itself, and the hierarchical annotation can be determined according to the actual situation, so as to obtain the hierarchical result, and the hierarchical value attribute is recorded as GC0, then GC0 = data hierarchical result, GC0 represents the value of the to-be-identified data from the asset level, and the higher the hierarchical classification, the higher the asset value of the to-be-identified data.

[0068] Therefore, the data value of the to-be-identified data is represented by the data source value attribute, the business value attribute, and the hierarchical value attribute, and the risk of misidentification caused by incomplete keyword definition is reduced by comprehensively considering the value of the data itself.

[0069] Step 13: calculating the target sensitivity of the to-be-identified data according to the target identification attribute, and comparing the target sensitivity with a preset sensitivity threshold, and taking the to-be-identified data with a target sensitivity not less than the preset sensitivity threshold as target sensitive information, wherein the sensitivity threshold is calculated according to at least one of the data source value attribute, the business value attribute, and the hierarchical value attribute, and the identification of sensitive information is not limited to the surface characteristics of the data, but deeply analyzes the intrinsic value of the data, and the multi-dimensional evaluation method can better reflect the true sensitivity of the data, and ensures that the identification of sensitive information is more in line with the sensitivity of the to-be-identified data itself and the sensitivity of the application, and ensures the accuracy of the identification of sensitive information.

[0070] In the embodiment of the application, the target sensitivity of the to-be-identified data is calculated according to the target identification attribute, including:

[0071] calculating a target word in the to-be-identified data according to the word segmentation attribute;

[0072] obtaining a pre-stored sensitive word set, calculating the semantic similarity of each word in the target word and the sensitive word set, and determining the target sensitivity of the target word.

[0073] In some embodiments, the sensitive word set is determined by a user, and the same meaning words of the user-determined words are obtained based on the user-determined words through intelligent learning, and the sensitive word set is supplemented with other public words related to sensitive attributes obtained through crawling and the like; and the sensitive word set is continuously expanded based on the user determination, so as to ensure the relative comprehensiveness of the sensitive word set and avoid the situation that the sensitive information recognition is inaccurate due to the user's inability to fully enumerate or timely supplement and modify the sensitive words.

[0074] According to the sensitive word set, the target sensitive degree of each word in the target segmentation is determined, and the target sensitive degree of each word in the target segmentation is determined by calculating the semantic similarity between each word in the target segmentation and each word in the sensitive word set, such as calculating the Euclidean distance, so as to ensure the accuracy of sensitive information recognition by considering semantic similarity instead of only literal similarity, and to obtain the semantic similarity between each word in the target segmentation and each word in the sensitive word set, so as to determine the highest similarity as the sensitive degree of the word, and to determine the target sensitive degree of the target segmentation.

[0075] In the embodiments of the present application, optionally, the calculation process of the sensitive degree threshold value includes:

[0076] Obtaining comparison data, the comparison data including: data with the same data source value attribute as the data source value attribute of the to-be-identified data, and data with the same business value attribute but different data source value attribute, and the hierarchical value attribute is not lower than the hierarchical value attribute of the to-be-identified data;

[0077] According to the comparison data, the threshold compensation value of the sensitive degree threshold value is calculated;

[0078] According to the threshold compensation value and the preset sensitive degree reference value, the sensitive degree threshold value is determined.

[0079] In some embodiments, when determining the comparison data, the data source value attribute ID0, the business value attribute BU0, and the hierarchical value attribute GC0 are considered.

[0080] Specifically, the data produced by the same data source is similar to the to-be-identified data, and therefore, the data produced by ID0 and already stored is determined as the comparison data. The data produced by non-ID0 may also be similar to the to-be-identified data, and therefore, whether the data is the comparison data is considered from two aspects of business value and classification value, for example, the data with the business value of BU0 and the classification value not lower than GC0 is taken as the comparison data, that is, the comparison data includes the data with the same data source value attribute as the to-be-identified data and the data with the same business value attribute but different data source value attribute and the classification value attribute not lower than the classification value attribute of the to-be-identified data.

[0081] In some embodiments, the comparison data is similar to the to-be-identified data, and the application (such as: access, attack, etc.) of the comparison data can be used to infer the possible application of the to-be-identified data in the future, and then the risk of the to-be-identified data in subsequent application is estimated, and a threshold compensation value is determined through the risk, so that the sensitive threshold is adjusted in a targeted manner through the threshold compensation value, so that the final sensitive threshold is more in line with the sensitivity of the to-be-identified data itself and the sensitivity of the application.

[0082] Specifically, the calculation method of the threshold compensation value is:

[0083] Determine the word segmentation of each comparison data;

[0084] Determine the IP address of each comparison data;

[0085] Group the word segmentation of each comparison data into a word segmentation set, and group the word segmentation of the to-be-accessed data into a word segmentation set, and calculate the similarity Sim between the word segmentation set of each comparison data and the word segmentation set of the to-be-accessed data by using an existing method i,0 , wherein i is the comparison data identifier;

[0086] Calculate the access anomaly value of each comparison data

[0087] , wherein is the number of word segmentation of sensitive information identified in the comparison data i, is the total number of word segmentation in the comparison data i, is the maximum abnormal access ratio of the comparison data i, GC i is the classification value of the comparison data i, min{} is the minimum value function, is the correlation degree between the business value of the comparison data i and the business value of the to-be-identified data (the correlation degree is: if the two business values are the same, then Otherwise, a preset value, such as 0.5, or a correlation degree table is set by a user in advance, wherein the correlation degree between any two service values is marked in the table, and the correlation degree represents the correlation between the two service values in the service and the data, and the value is obtained by looking up the table;

[0088] wherein, The calculation process is:

[0089] Determine the total number of accesses to each IP address of the comparison data i wherein, j is an IP address identifier of the comparison data i;

[0090] Determine the total number of alarms involving the IP address j from the alarm log of the device

[0091] wherein, max{} is a maximum value function;

[0092] Determine the threshold compensation value

[0093] wherein, I is the total number of comparison data; a is a pre-set compensation coefficient, which is determined according to actual needs; n 7 is the total number of alarms in the alarm log.

[0094] The threshold compensation value reflects the access risk of the to-be-identified data in future applications through the abnormal access of other data similar to the to-be-identified data, and the greater the threshold compensation value, the greater the risk encountered in the future, so that the range of sensitive information identification in the to-be-identified data is increased, and in addition to the segmented words that are definitely sensitive information being identified as sensitive words, the segmented words with lower similarity are also considered as sensitive words, so as to maximize the protection of data security and prevent data leakage due to unsafe environment.

[0095] Determine the sensitive threshold value β according to the threshold compensation value,

[0096] wherein, a2 is a compensation weight, which is determined according to actual needs, and is used to adjust the compensation effect of the threshold compensation value, and the greater the value, the greater the compensation effect; b0 is a pre-set reference value, which is obtained by a user according to actual identification needs, and can also be a default value, such as 0.98; the greater the threshold compensation value Com, the smaller the sensitive threshold value, so that more segmented words are identified as sensitive, and the safety of data is better ensured.

[0097] Step 14: processing the to-be-identified data according to the target sensitive information according to a preset sensitive information processing rule.

[0098] In the embodiment of the present application, the target sensitive information is determined by processing the to-be-identified data according to the target sensitive information, so that the security and privacy protection of the sensitive information in the storage and access process are ensured, data leakage is prevented, and customer satisfaction is improved.

[0099] In the embodiment of the present application, the to-be-identified data includes to-be-stored data and to-be-accessed data.

[0100] According to the target sensitive information, the to-be-identified data is processed according to a preset sensitive information processing rule, including:

[0101] According to the target sensitive information, the to-be-stored data is encrypted and stored;

[0102] Or,

[0103] According to the target sensitive information, the to-be-accessed data is desensitized.

[0104] In the embodiment of the present application, the to-be-stored data is encrypted, the security of the data on the storage medium is ensured, unauthorized access and data leakage are prevented, even if the data is stolen, the attacker cannot read the encrypted content, so that the sensitive information is effectively protected; and when the to-be-accessed data is desensitized, the sensitive information is replaced or hidden, so that the real data is not leaked when displayed or used, and the risk of abuse of data in a non-secure environment is reduced.

[0105] In the embodiment of the present application, the to-be-identified data is obtained; the word segmentation attribute of the to-be-identified data and at least one of the following attributes: data source value attribute, business value attribute, hierarchical value attribute are identified, the target identification attribute of the to-be-identified data is determined; by considering the value of the data itself, the risk of misidentification caused by incomplete keyword definition is reduced; the target sensitivity of the to-be-identified data is calculated according to the target identification attribute, and the target sensitivity is compared with a preset sensitivity threshold, the to-be-identified data whose target sensitivity is not less than the preset sensitivity threshold is taken as the target sensitive information, wherein the sensitivity threshold is calculated according to at least one of the data source value attribute, the business value attribute, and the hierarchical value attribute; instead of relying completely on manually defined keywords, the problem of low recognition accuracy caused by incomplete keyword definition is avoided; the to-be-identified data is processed according to a preset sensitive information processing rule according to the target sensitive information. By comprehensively considering multiple attributes, the identification of sensitive information is not limited to the surface characteristics of the data, but the intrinsic value of the data is analyzed in depth. This multi-dimensional evaluation method can better reflect the true sensitivity of the data, ensure that the identification of sensitive information is more in line with the sensitivity of the to-be-identified data itself and the sensitivity of the application, ensure the accuracy of the identification of sensitive information, and solve the problems of low efficiency and inaccuracy of existing sensitive data identification.

[0106] Please refer to Figure 2 This invention provides a sensitive information identification device, comprising:

[0107] Module 21 is used to acquire the data to be identified;

[0108] The identification module 22 is used to identify the word segmentation attributes of the data to be identified and at least one of the following attributes: data source value attribute, business value attribute, and hierarchical value attribute, and to determine the target identification attribute of the data to be identified.

[0109] The first processing module 23 is used to calculate the target sensitivity of the data to be identified based on the target identification attribute, compare the target sensitivity with a preset sensitivity threshold, and take the data to be identified with a target sensitivity not less than the preset sensitivity threshold as target sensitive information. The sensitivity threshold is calculated based on at least one of the data source value attribute, business value attribute, and hierarchical value attribute.

[0110] The second processing module 24 is used to process the data to be identified according to the target sensitive information in accordance with the preset sensitive information processing rules.

[0111] The sensitive information identification device provided in this embodiment of the invention can achieve Figure 1 The various processes implemented in the method embodiments achieve the same technical effect, and will not be described again here to avoid repetition.

[0112] This invention provides an electronic device 30, see [link to relevant documentation]. Figure 3 As shown, Figure 3 This is a schematic diagram of the electronic device 30 according to an embodiment of the present invention, including a processor 31, a memory 32, and a program or instructions stored in the memory 32 and executable on the processor 31. When the program or instructions are executed by the processor, they implement the steps in any of the sensitive information identification methods of the present invention.

[0113] This invention provides a readable storage medium on which a program or instruction is stored. When the program or instruction is executed by a processor, it implements the various processes of the embodiments of the sensitive information identification method as described above and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0114] This application also provides a computer program product, including computer instructions, which, when executed by a processor, implement the above-described... Figure 1 The various processes of the method embodiments shown can achieve the same technical effect, and will not be described again here to avoid repetition.

[0115] Computer-readable media includes permanent and non-permanent, removable and non-removable media, which can be implemented by any method or technology to store information. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible by a computing device. According to the definition herein, computer-readable media does not include transitory media such as modulated data signals and carriers.

[0116] It should be noted that in the technical solutions of the present disclosure, the collection, collection, update, analysis, processing, use, transmission, storage and other aspects of user personal information are in line with relevant laws and regulations, are used for legal purposes, and do not violate public order and good customs. Necessary measures are taken to prevent illegal access to user personal information data and maintain user personal information security and network security.

[0117] It should be noted that in this paper, the term "includes", "contains" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed, or includes elements inherent to such process, method, article or device. Without more limitations, the element defined by the statement "includes a" does not exclude the presence of another identical element in the process, method, article or device including the element.

[0118] The above-mentioned serial numbers of the embodiments of the present application are only for description, and do not represent the advantages and disadvantages of the embodiments.

[0119] Those skilled in the art can clearly understand the above-mentioned embodiment method can be realized by means of software and necessary general hardware platform, of course, also can be through hardware, but in many cases the former is the better embodiment. Based on such understanding, the technical scheme of the present application essentially or the part which contributes to the prior art can be embodied in the form of software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes a plurality of instructions to make a service classification device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) execute the method described in each embodiment of the present application.

[0120] The above only describes the preferred embodiments of the present application, and it should be pointed out that for those skilled in the art, without departing from the principles of the present application, a number of improvements and refinements can be made, which should be considered as the protection scope of the present application.

Claims

1. A method of identifying sensitive information, characterized by, The method comprises: obtaining to-be-identified data; identifying the word segmentation attribute of the to-be-identified data and at least one of the following attributes: data source value attribute, business value attribute, and hierarchical value attribute, to determine the target identification attribute of the to-be-identified data; calculating the target sensitivity of the to-be-identified data according to the target identification attribute, and comparing the target sensitivity with a preset sensitivity threshold, and regarding the to-be-identified data with a target sensitivity not less than the preset sensitivity threshold as target sensitive information, wherein the sensitivity threshold is calculated according to at least one of the data source value attribute, the business value attribute, and the hierarchical value attribute; processing the to-be-identified data according to a preset sensitive information processing rule according to the target sensitive information.

2. The sensitive information identification method of claim 1, wherein the to-be-identified data comprises to-be-stored data and to-be-accessed data; processing the to-be-identified data according to a preset sensitive information processing rule according to the target sensitive information comprises: performing encrypted storage processing on the to-be-stored data according to the target sensitive information; or performing desensitization processing on the to-be-accessed data according to the target sensitive information.

3. The sensitive information identification method of claim 1, wherein the to-be-identified data is structured data or unstructured data; identifying the word segmentation attribute of the to-be-identified data comprises: if the to-be-identified data is structured data, regarding the name and description of each data item in the to-be-identified data as the word segmentation attribute; or if the to-be-identified data is unstructured data, removing virtual words, onomatopoeic words, and interjections in the to-be-identified data by a natural language processing tool, and regarding the remaining words as the word segmentation attribute.

4. The sensitive information identification method of claim 1, wherein identifying at least one of the following attributes of the to-be-identified data: data source value attribute, business value attribute, and hierarchical value attribute comprises: identifying the Internet Protocol address of the data producer of the to-be-identified data or the device that submitted the storage request to determine the data source value attribute of the to-be-identified data; and / or identifying the business situation to which the to-be-identified data belongs to determine the business value attribute of the to-be-identified data; and / or identifying the hierarchical situation of the to-be-identified data to determine the hierarchical value attribute of the to-be-identified data. calculating the target sensitivity of the to-be-identified data according to the target identification attribute comprises: calculating the target word of the to-be-identified data according to the word segmentation attribute; obtaining a pre-stored sensitive word set, calculating the semantic similarity between the target word and each word in the sensitive word set, and determining the target sensitivity of the target word.

6. The sensitive information identification method of claim 1, wherein 5. The method of claim 1, wherein, the calculation process of the sensitivity threshold comprises: ​ ​ ​ ​ Obtaining comparison data, the comparison data including data with the same data source value attribute as the to-be-identified data and data with the same business value attribute but different data source value attribute from the to-be-identified data and with a hierarchical value attribute not lower than that of the to-be-identified data; Calculating a threshold compensation value of the sensitivity threshold according to the comparison data; Determining the sensitivity threshold according to the threshold compensation value and a preset sensitivity reference value.

7. A sensitive information identifying apparatus characterized by comprising: Comprising: An obtaining module, configured to obtain to-be-identified data; An identifying module, configured to identify a word segmentation attribute and at least one of the following attributes of the to-be-identified data: data source value attribute, business value attribute, and hierarchical value attribute, and determine a target identification attribute of the to-be-identified data; A first processing module, configured to calculate a target sensitivity of the to-be-identified data according to the target identification attribute, compare the target sensitivity with a preset sensitivity threshold, and take to-be-identified data with a target sensitivity not less than the preset sensitivity threshold as target sensitive information, wherein the sensitivity threshold is calculated according to at least one of the data source value attribute, business value attribute, and hierarchical value attribute; A second processing module, configured to process the to-be-identified data according to a preset sensitive information processing rule according to the target sensitive information.

8. An electronic device, comprising: A processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction is executed by the processor to implement the steps in the sensitive information identification device method according to any one of claims 1 to 6.

9. A readable storage medium, characterized by, A readable storage medium storing a program or instruction, wherein the program or instruction is executed by a processor to implement the steps in the sensitive information identification device method according to any one of claims 1 to 6.

10. A computer program product, characterised in that, Computer instructions executable by a processor to implement the steps in the sensitive information identification device method according to any one of claims 1 to 6.

Images