Data leakage detection method and device, computer equipment and storage medium

Abstract

The invention discloses a data leakage detection method and device, computer equipment and a storage medium, belongs to the technical field of data security, and is applied to sensitive data detection of a financial system or a health medical system. Firstly, the authenticity and complexity of a test sample are remarkably improved, various scenes such as format change, field splitting, encryption processing, noise interference and semantic camouflage are covered, and a complex attack environment can be effectively simulated; secondly, an adaptive field mapping and dynamic test template mechanism is introduced, so that test data can be flexibly adjusted according to different service scenes or detection products, and the test efficiency and scene adaptability are improved; and finally, through presetting various machine learning algorithms, automatically training to generate a high-precision sensitive data classifier, and realizing accurate identification of sensitive fields in unknown data. According to the method, a set of end-to-end sensitive data detection and evaluation framework capable of being automatically executed is constructed, and the method has the technical advantages of high efficiency, flexibility and intellectualization.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of data security, and particularly relates to a data leakage detection method and device, computer equipment and a storage medium. BACKGROUND

[0002] In the process of business development of the financial industry, a large amount of sensitive information will be involved. In order to prevent customer information leakage, a large number of data leakage prevention products will be deployed in the enterprise. The current data leakage prevention product (DLP) mainly uses a large number of regular and rule matching methods. However, the data leakage methods are various, and the interception effects of different products are different. Therefore, it is difficult to quickly and accurately understand the effectiveness of the DLP product in different scenarios.

[0003] The conventional manual test method is to summarize some scenes such as splitting, encryption, format conversion, and image conversion according to historical problem experience. Some false data test files are created for these scenes, and then the data test files are used to test different DLP products. The manual test process is relatively long, and a large amount of manpower is needed to create files and test different DLP products. SUMMARY

[0004] The purpose of the embodiments of the application is to provide a data leakage detection method, device, computer equipment and storage medium to solve the technical problem that the current manual test method is relatively long, and a large amount of manpower is needed to create files and test different DLP products.

[0005] In order to solve the above technical problem, the embodiments of the application provide a data leakage detection method, which adopts the following technical solution: A data leakage detection method comprises the following steps: An initial sample is obtained from a preset sensitive data sample library, and a diversified initial test sample is generated by randomizing the field combination of the initial sample, to obtain an initial test sample set, wherein the initial sample is a sample in a mixed format containing text and numbers; According to the initial test sample set, a data splitting algorithm is used to split the initial test sample in the initial test sample set according to a preset rule, to obtain a segmented sample set; For the segmented sample set, a preset encryption algorithm is used to encrypt the sensitive field, to obtain an encrypted sample set; Sensitive field encryption features are extracted from the encrypted sample set, and a complex scene simulation method is used to randomly insert noise fields and fake data fields in the sensitive field encryption features, to obtain a complex scene sample set; According to the complex scene sample set, a dynamic test template is constructed, and a customized test sample set is generated according to detection requirements through an adaptive field mapping mechanism, so as to obtain a requirement test sample set; By adopting an automatic detection process, a preset machine learning classification algorithm is used to learn the requirement test sample features in the requirement test sample set, so as to obtain a sensitive data classifier; The sensitive data classifier is used for sensitive data recognition on the to-be-detected data, so as to judge whether the detection contains sensitive information, and obtain a data detection result.

[0006] To solve the above technical problems, the embodiment of the application further provides a data leakage detection device, which adopts the technical scheme as follows: A data leakage detection device comprises: An initial sample module is configured to obtain initial samples from a preset sensitive data sample library, generate diversified initial test samples by randomizing field combinations of the initial samples, and obtain an initial test sample set, wherein the initial samples are mixed format samples containing text and numbers; A data segmentation module is configured to perform sensitive data segmentation on the initial test samples in the initial test sample set according to the initial test sample set and a preset rule by using a data splitting algorithm, and obtain a segmented sample set; An encryption processing module is configured to perform encryption processing on sensitive fields in the segmented sample set by using a preset encryption algorithm, and obtain an encrypted sample set; A random insertion module is configured to extract sensitive field encryption features from the encrypted sample set, and obtain a complex scene sample set by randomly inserting noise fields and fake data fields in the sensitive field encryption features by using a complex scene simulation method; A field mapping module is configured to construct a dynamic test template according to the complex scene sample set, and generate a customized test sample set according to detection requirements through an adaptive field mapping mechanism, so as to obtain a requirement test sample set; A feature learning module is configured to learn the requirement test sample features in the requirement test sample set by using a preset machine learning classification algorithm through an automatic detection process, so as to obtain a sensitive data classifier; A sensitive recognition module is configured to use the sensitive data classifier to perform sensitive data recognition on the to-be-detected data, judge whether the detection contains sensitive information, and obtain a data detection result.

[0007] To solve the above technical problems, the embodiment of the application further provides a computer device, which adopts the technical scheme as follows: A computer device comprises a memory and a processor, the memory stores computer readable instructions, and the processor implements the steps of the data leakage detection method according to any one of the above when executing the computer readable instructions.

[0008] To solve the above technical problems, the embodiment of the application also provides a computer readable storage medium, which adopts the technical scheme as follows: A computer readable storage medium stores computer readable instructions, and the computer readable instructions are executed by a processor to implement the steps of the data leakage detection method according to any one of the above.

[0009] Compared with the prior art, the embodiment of the application has the following beneficial effects: The application discloses a data leakage detection method and device, a computer device and a storage medium, and belongs to the technical field of data security, and is applied to sensitive data detection of a financial system or a health care system. The application realizes automatic testing and sensitive information recognition capability evaluation of a data leakage detection system by constructing a test sample system covering a wide range and having various disturbances and combining a machine learning intelligent classification mechanism. First, the test sample is significantly improved in authenticity and complexity, and various actual leakage scenes such as format change, field splitting, encryption processing, noise interference and semantic camouflage are covered, so that a complex attack environment can be effectively simulated, and boundary conditions that are difficult to be recognized by a traditional rule are broken through. Second, adaptive field mapping and a dynamic test template mechanism are introduced, so that test data can be flexibly adjusted according to different business scenes or detection products, and test efficiency and scene adaptability are improved. Finally, a plurality of machine learning algorithms are preset, a high-precision sensitive data classifier is automatically trained and generated, accurate recognition of sensitive fields in unknown data is realized, manual intervention is significantly reduced, and the intelligent level and the expandability of detection are improved. The application constructs an end-to-end and automatically executable sensitive data detection and evaluation framework, and has the technical advantages of high efficiency, flexibility and intelligence. BRIEF DESCRIPTION OF DRAWINGS

[0010] In order to more clearly illustrate the schemes in the application, the drawings needed in the description of the embodiments of the application will be briefly introduced. Obviously, the drawings in the following description are some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative labor.

[0011] Figure 1 An exemplary system architecture diagram to which the application can be applied is shown; Figure 2 A flowchart of one embodiment of the data leakage detection method according to the application is shown; Figure 3 Fig. 1 shows a structural schematic diagram of an embodiment of a data leakage detection apparatus according to the present application; Figure 4 Fig. 2 shows a structural schematic diagram of an embodiment of a computer device according to the present application. DETAILED DESCRIPTION

[0012] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs; the terminology used in the description herein is for describing particular embodiments only and is not intended to be limiting of the application; the use herein of terms such as "comprise" and "have" and any variations thereof are intended to cover a non-exclusive inclusion; the use herein of terms such as "first", "second" and the like are intended to distinguish between similar objects unless the context indicates otherwise.

[0013] Reference herein to "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the application. The appearances of the phrase that "an embodiment" in various places in the specification are not necessarily all referring to the same embodiment, nor are they necessarily mutually exclusive or alternative embodiments. It is expressly understood that the embodiments described herein are merely examples from a

[0014] In order to better understand the technical solutions of the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings.

[0015] As shown in Fig. 1, the system architecture 100 can include a terminal device 101, a network 102 and a server 103. The terminal device 101 can be a notebook computer 1011, a tablet computer 1012 or a mobile phone 1013. The network 102 is a medium for providing a communication link between the terminal device 101 and the server 103. The network 102 can include various connection types, such as wired, wireless communication links or optical fiber cables, etc. Figure 1 A user can use the terminal device 101 to interact with the server 103 through the network 102 to receive or send messages, etc. Various communication client applications can be installed on the terminal device 101, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0016]

[0017] ​The terminal device 101 can be various electronic devices with a display screen and supporting web browsing, in addition to the notebook computer 1011, the tablet computer 1012 or the mobile phone 1013, the terminal device 101 can also be an electronic book reader, an MP3 player, an MP4 player, a laptop computer and a desktop computer, etc.

[0018] The server 103 can be a server providing various services, for example, a background server providing support for a page displayed on the terminal device 101.

[0019] It should be noted that the data leakage detection method provided by the embodiments of the present application is generally executed by a server / terminal device, and accordingly, the data leakage detection apparatus is generally arranged in a server / terminal device.

[0020] It should be understood that Figure 1 The number of terminal devices, networks and servers in the system is only illustrative, and the system can have any number of terminal devices, networks and servers according to the implementation needs.

[0021] With reference to Figure 2 , a flow chart of one embodiment of the data leakage detection method according to the present application is shown. The data leakage detection method comprises the following steps: S201, obtaining an initial sample from a preset sensitive data sample library, and generating diversified initial test samples by randomizing the field combination of the initial sample, to obtain an initial test sample set, wherein the initial sample is a sample in a mixed format containing text and numbers; Specifically, the preset sensitive data sample library is generated based on historical business data samples, and includes high-sensitive (such as an ID card number, a mobile phone number), medium-sensitive (such as a policy number, a vehicle frame number), and low-sensitive (such as an address, an email) information fields. Each type of sensitive field should define a data format specification, such as an ID card number being 18 digits, a license plate number being a province abbreviation + 5-6 digits, and the like. Field randomization processing includes field order scrambling, insertion of irrelevant information fields between fields, truncation or padding of some fields, automatic splicing of mixed fields (such as “Zhang San + ID card number + mobile phone number”), and the like. The generation process of the test sample set needs to achieve structural diversity and semantic authenticity. For example, “name + ID card number” sentence samples and embedded context samples such as “the license plate purchased in ×× is ××” can be generated. The technical focus of this step is: 1) automation of field-level random sampling and recombination logic; 2) sample semantic consistency verification to avoid semantic conflicts caused by field combination errors; and 3) sample batch generation interface support for custom field template and quantity configuration.

[0022] S202, according to the initial test sample set, adopting a data splitting algorithm to perform sensitive data segmentation on the initial test sample in the initial test sample set according to a preset rule, to obtain a segmented sample set; Specifically, the data splitting algorithm performs field segmentation processing based on character-level, word-level, or semantic-level rules. Common rules include: truncation by fixed length (such as every 3 digits), cutting by key characters (such as spaces, commas, and line breaks), and splitting specific fields by regular expressions (such as separating a mobile phone number and splitting an ID card number by region code / birth year / month / sequence code). In addition, a language model can be used to assist in determining semantic boundaries for context splitting. The splitting form can be: one sample is split into multiple sub-samples, or the same field is split and distributed in different positions or even different files. For example, an ID card number “1**10*****01******” can be split into “1**”, “10*****”, and “01******” and written into multiple lines or multiple sheets. The segmented sample set needs to record the mapping relationship between the original field and the sub-field, which is used for recombination or label training. In order to increase the detection difficulty, reordering after splitting, and pseudo-data mixing can be introduced. Technically, a module (such as a rule engine) capable of flexibly configuring splitting strategies is needed to support matching different splitting logics according to field types, and output structured JSON or columned Excel formats.

[0023] S203, for the segmented sample set, performing encryption processing on the sensitive fields by a preset encryption algorithm, to obtain an encrypted sample set; Specifically, the encryption algorithm should support multiple encryption types, including symmetric encryption (such as AES, DES), asymmetric encryption (such as RSA), hash functions (such as SHA-256, MD5), and reversible and irreversible encoding (such as Base64, URL encoding). Different encryption methods are selected for different sensitive field types. For example, identity card numbers and mobile phone numbers can use symmetric encryption; frame numbers and addresses can use one-way hash functions to increase unreadability. The encryption process can include the following levels: field-level encryption (only encrypt the field value), record-level encryption (encrypt the entire record), and document-level encryption (such as PDF encryption, Office file encryption). In addition, for image format samples, image steganography can be used to embed sensitive fields in encrypted form in image pixels. The encrypted sample set should retain the encryption algorithm type, key usage record, and data mapping table before and after encryption, to facilitate the verification of detection capabilities and rule adaptability. The encryption module should support batch processing, high-concurrency operations, and provide log auditing functions to ensure traceability and consistency of the encryption process. Encryption strength should have configuration parameters such as key length, salting strategy, etc., to improve sample diversity and the ability to simulate attack scenarios.

[0024] S204, extracting sensitive field encryption features from the encrypted sample set, and using a complex scenario simulation method to obtain a complex scenario sample set by randomly inserting noise fields and fake data fields in the sensitive field encryption features; Specifically, the extraction of encryption features of sensitive fields refers to analyzing the structure of the ciphertext in encrypted samples, such as character distribution, length, pattern, encryption flag (such as whether there is a specific prefix, whether it is a printable character, etc.), and constructing complex scenarios based on this. The complex scenario simulation method includes inserting fake noise (such as random alphanumeric combinations, special symbols) into the encrypted field, or mixing interference information in the context (such as wrapping the encrypted field in a paragraph with non-sensitive business data). For example, "ciphertext A" can be expanded to "This is the customer's code: ciphertext A, please check", or a table containing a mix of sensitive ciphertext and fake fields is constructed, making it difficult for detection to rely solely on static pattern matching. In addition, data confusion can also be simulated by field drift, i.e. inserting sensitive fields into non-standard positions such as Excel hidden columns, merged cells, chart titles, or storing them in JSON nested structures, database BLOB fields. The core technology of this stage is the ability to disguise and controllable disturbance generation logic, including field insertion probability control, noise intensity configuration, context interference model, etc., making the samples more challenging. The final complex scenario samples should be able to systematically evaluate the recognition ability of DLP products in the face of atypical leakage methods.

[0025] S205: Based on a complex scenario sample set, a dynamic test template is constructed, and a customized test sample set is generated according to the detection requirements through an adaptive field mapping mechanism to obtain the required test sample set. Specifically, dynamic test templates refer to the generation logic of test scenario samples configured in a templated manner. Template content includes parameters such as field type, field location, field encryption / obfuscation status, document structure, and file format. When building this template, it should support YAML, JSON, or form UI formats for flexible configuration. An adaptive field mapping mechanism is a process that uses a rule engine or machine learning model to determine which fields are sensitive in different formats or contexts, supporting operations such as field renaming, format conversion, and structure alignment. For example, mapping the "phone number" field to variant field names such as "ContactNumber" and "Phone#" should still maintain the identification association. This mechanism needs to support functions such as field labeling, weight setting, synonym handling, and structure migration. The final customized test sample set should cover specific business needs (such as testing only image leakage, nested compression, unstructured PDFs, etc.) or specific DLP product scenarios (such as email DLP, printing DLP, etc.) and have controllable variables for easy test comparison. The key to this step is to abstract a general template construction method for multiple scenarios and multiple samples, combined with a parameterized sample generation engine, to quickly output test data that meets the set conditions.

[0026] S206 employs an automated detection process, using a pre-set machine learning classification algorithm to learn the features of the requirement test samples in the requirement test sample set, thereby obtaining a sensitive data classifier; Specifically, this step trains a sensitive data classifier based on machine learning methods to automatically identify sensitive fields in samples with different formats and noise perturbations. The training process includes feature extraction, feature selection, model training, and evaluation. Features can be categorized into structural features (such as field position, field length, and character type), contextual features (such as contextual word frequency, TF-IDF, and N-gram sequences), format features (such as whether it is a date / number / encoded data), and semantic features (such as extracting semantic similarity through word embedding models). Supported machine learning models include classic classification algorithms such as Random Forest, XGBoost, and Support Vector Machine (SVM), and deep learning models such as BERT and LSTM can also be introduced for unstructured data processing. Classification labels are typically divided into four categories: "high sensitivity," "medium sensitivity," "low sensitivity," and "non-sensitive." Model evaluation metrics include accuracy, recall, and F1 score. The training process recommends using cross-validation to improve the model's generalization ability and provides a visualized confusion matrix to help identify false positives / false negatives. This classifier will serve as an important reference for DLP rule optimization, helping to improve the rationality and coverage of the rules.

[0027] S207, Use a sensitive data classifier to identify sensitive data in the data to be detected, determine whether the detection contains sensitive information, and obtain the data detection result.

[0028] Specifically, this step involves applying the previously trained sensitive data classifier to actual business data or unknown sample data to determine whether it contains sensitive information fields. The detection process includes data preprocessing (format standardization, field extraction), feature extraction (maintaining consistency with the training model), classification prediction (using the trained model to determine the sensitivity level of each data point), and result output. Results may include classification labels, field locations, confidence scores, etc. For structured data, the sensitivity level of each field can be output; for unstructured documents, OCR, natural language processing, and other methods are needed to extract text information into analyzable objects. It is recommended that the detection results be output in a standard format (such as JSON or CSV) and stored in a database for analysis and auditing. To improve the interpretability of the detection, model interpretability tools such as LIME and SHAP can be used to analyze the basis for the model's identification of sensitive fields and assist in manual verification. The final detection results will be used to determine whether the sample has been successfully identified and whether the DLP product has met the risk rules, thus serving as a basic data source for quantitatively evaluating DLP capabilities.

[0029] Furthermore, the steps of obtaining initial samples from a pre-defined sensitive data sample library and generating diverse initial test samples by randomizing the field combinations of the initial samples to obtain an initial test sample set specifically include: Initial samples that meet preset conditions are selected from the sensitive data sample library. The preset conditions include the data format, data type, and the business domain to which the data belongs. The selected initial samples are randomized to generate diverse initial test samples. The randomization process includes randomly shuffling the field order, randomly replacing field values, and randomly adding or removing fields. The generated diverse initial test samples are aggregated to obtain an initial test sample set containing multiple initial test samples.

[0030] In this embodiment, the initial sample screening is based on flexible filtering conditions, allowing users to set data formats (e.g., pure numbers, mixed text, containing special characters, etc.), data types (e.g., ID card, mobile phone number, license plate number, etc.), and business scenario classifications (e.g., insurance, banking, e-commerce, etc.) as needed, to ensure the representativeness and diversity of the samples. In the field randomization process, the system uses a preset perturbation strategy to perform controlled mutations on the sample structure, including shuffling the field order (e.g., changing "name + ID card + mobile phone number" to "mobile phone number + name + ID card"), equivalent substitution of field values ​​(e.g., replacing mobile phone number with virtual data of the same model range), and adding or deleting fields (e.g., adding the non-sensitive field "place of birth" or removing "gender," etc.). Furthermore, to improve data diversity, the system also introduces a template-driven sample synthesis strategy, supporting the dynamic combination of fields to construct sentence-style samples using template language, for example: "The contact information for customer [name] is [mobile phone number]." All generated samples will be aggregated to form a unified initial test sample set.

[0031] The above steps can significantly enhance the coverage and variability of test samples, and improve the accuracy and completeness of DLP detection capability assessment.

[0032] Furthermore, based on the initial test sample set, the step of using a data splitting algorithm to perform sensitive data segmentation on the initial test samples in the initial test sample set according to preset rules to obtain a segmented sample set specifically includes: Invoke the preset data splitting algorithm, which includes splitting based on regular expressions, splitting based on semantic understanding, and splitting based on location information; According to preset rules, each initial test sample in the initial test sample set is split into multiple segmented samples containing sensitive data, wherein each segmented sample contains at least one piece of sensitive data. The multiple segmented samples obtained from the splitting are aggregated to obtain a segmented sample set containing the multiple segmented samples.

[0033] In this embodiment, the data splitting algorithm has multi-dimensional splitting capabilities, enabling intelligent processing for different types of data formats and contextual structures. The regular expression-based splitting algorithm is suitable for data with obvious structural features, such as ID card numbers (\d{18}) and mobile phone numbers (1[3-9]\d{9}), quickly identifying and extracting sensitive fields through pattern matching. The semantic understanding-based splitting algorithm utilizes Natural Language Processing (NLP) technologies, such as part-of-speech tagging and Natural Entity Recognition (NER), to identify sensitive entity boundaries in text, achieving intelligent splitting of sensitive information in embedded natural language statements. For example, "Zhang San's ID card is 1**10*****01******" can be split into "Zhang San" and "1**10*****01******". The location-based splitting algorithm is suitable for tabular or structured document data, extracting sensitive fields through row and column indexes or field position rules. Preset rules include splitting length, field context range, and sensitive field prefix and suffix identifiers, ensuring that each segment retains complete sensitive elements and enhancing the complexity simulation of DLP detection. After splitting, all segmented samples undergo structured processing in a unified format (such as JSON arrays or tables) to form a standardized set of segmented samples that can be directly used for encryption or complex scenario simulation.

[0034] Through the above steps, the sensitive information was accurately disassembled and reconstructed, enhancing the verification accuracy of the test samples' ability to penetrate DLP rules.

[0035] Furthermore, according to preset rules, the step of splitting each initial test sample in the initial test sample set into multiple segmented samples containing sensitive data specifically includes: Identify sensitive data fields in each initial test sample that conform to a preset regular expression pattern, and separate the sensitive data fields that conform to the preset regular expression pattern from the initial test sample to obtain the first segment sample; Identify sensitive data fields with sensitive semantic information in each initial test sample, and separate the sensitive data fields with sensitive semantic information from the initial test samples to obtain the second segment samples; Identify the sensitive data fields carrying sensitive location identification information in each initial test sample, and separate the sensitive data fields carrying sensitive location identification information from the initial test samples to obtain the third segment sample; By combining the first segment sample, the second segment sample, and the third segment sample, multiple segment samples containing sensitive data are obtained.

[0036] In this embodiment, the splitting of sensitive data fields is performed collaboratively through three complementary methods, improving the comprehensiveness and accuracy of sensitive information identification. First, for sensitive fields with standardized formats (such as ID card numbers, mobile phone numbers, bank card numbers, etc.), the system uses a preset regular expression library for accurate identification, extracting the matching pattern field as the first segment sample. These fields typically have fixed lengths, numeric patterns, or specific starting symbols, thus enabling efficient extraction through rule matching. Second, for fields that may not have format features but possess semantic sensitivity (such as "home address," "company internal number," "customer name," etc.), the system introduces semantic analysis methods based on word vectors or named entity recognition (NER), combining contextual information to determine their sensitivity, and extracting them as the second segment sample. Finally, for fields in structured data or document data that carry location information (such as the nth column in a table being "mobile phone number," or a field named "SSN"), the system extracts the corresponding data according to field labels or preset location mapping rules, generating the third segment sample. The three types of segmented samples were then combined through structural merging to form a segmented sample set, which not only preserved the original sensitive information but also improved the heterogeneity of the samples and the breadth of test coverage.

[0037] Taking a large insurance company's internal DLP (Data Loss Prevention) inspection as an example, the company possesses a large amount of structured and unstructured customer information, requiring the identification and prevention of sensitive data leakage during compliance checks. The testing system extracts a "Customer Information Change Application Form" as the initial sample from its pre-set sensitive data sample library, which includes fields such as name, ID number, mobile phone number, home address, and policy number. The system first uses regular expressions to identify and extract the ID number (18 digits) and mobile phone number (11 digits starting with 1) fields, forming the first segment sample. Subsequently, using a semantic recognition module, fields such as "Insured's Address," "Work Address," and "Referrer's Name," which lack obvious formatting features, are judged to be medium to high-sensitivity information based on context, and extracted as the second segment sample. Finally, for the original data stored in an Excel spreadsheet, the system identifies the column positions corresponding to the header "PhoneNo." and "ID Number," and extracts sensitive fields from these columns to form the third segment sample.

[0038] Through the above steps, sensitive data fields can be identified and broken down from multiple dimensions, improving the intelligence of sample segmentation processing and its adaptability to complex scenarios.

[0039] Furthermore, the steps of extracting encryption features of sensitive fields from the encrypted sample set and obtaining a complex scenario sample set by randomly inserting noise fields and forged data fields into the encryption features of sensitive fields using a complex scenario simulation method specifically include: Extract the encryption form of sensitive fields from the encrypted sample set, and use it as the encryption feature of sensitive fields; Design a complex scenario simulation strategy, which covers data leakage scenarios involving data obfuscation, data nesting, and data masquerading; Based on the complex scenario simulation strategy, noise fields are randomly inserted into the encryption features of sensitive fields. The noise fields are fields that are similar in format to the sensitive data but do not contain sensitive information. Simultaneously, a forged data field is randomly inserted into the encryption feature of the sensitive field. The forged data field is a field generated according to a preset generation rule that is different from the sensitive data in both format and content. The sensitive field encryption features after inserting noise fields and forged data fields are recombined to form test samples under complex scenarios, and then a complex scenario sample set containing multiple complex scenario test samples is generated.

[0040] In this embodiment, the system first parses the encrypted sample set, identifying the encrypted representation of sensitive fields, such as Base64 encoded strings, AES-encrypted hexadecimal ciphertext, hash values, etc., and manages them by labeling their structure, length, and character distribution as "encryption features." Next, a complex scenario simulation strategy is designed, focusing on obfuscation, nesting, and camouflage in real-world data leakage, to build a test perturbation model. Data obfuscation strategies include inserting noise fields with similar formats but meaningless content into the ciphertext, such as random number strings of the same length, empty field placeholders, and invalid data with swapped character positions. Data nesting strategies simulate multiple layers of packaging, such as embedding ciphertext into compressed files, embedding image metadata, or placing it in nested JSON objects. Data camouflage strategies obfuscate judgment by inserting forged fields, such as inserting "forged ID numbers" or "format variation fields" into the ciphertext, making it appear legitimate but semantically insensitive. The insertion position uses a random strategy (such as middle, prefix, suffix), and the insertion amount is configurable, forming complex samples after perturbation of encryption features. Ultimately, the system unifies and structures these samples into a complex scenario sample set, which is used to evaluate the anti-interference capability and recognition accuracy of DLP products when facing atypical leakage forms.

[0041] By following the steps above, we can fully simulate real-world scenarios of sensitive data being leaked under encryption and disguise, thereby improving the DLP testing's coverage of complex attack methods.

[0042] Furthermore, based on a complex scenario sample set, a dynamic test template is constructed, and a customized test sample set is generated according to the detection requirements through an adaptive field mapping mechanism. The specific steps to obtain the required test sample set include: The characteristics of test samples in a complex scenario sample set are analyzed, and dynamic test templates are constructed based on these characteristics. These dynamic test templates can flexibly adjust the test strategy according to different data leakage scenarios. Define adaptive field mapping rules, which are used to map test sample fields in a complex scenario sample set to actual detection requirement fields; Based on the detection requirements, adaptive field mapping rules are used to perform field mapping processing on test samples in the complex scene sample set to generate customized test samples that match the detection requirements. The generated customized test samples are aggregated to obtain a set of requirement test samples containing multiple customized test samples.

[0043] In this embodiment, the system first analyzes the sample structure and content features in the complex scenario sample set, extracting attribute features such as the data leakage scenario in which the sample exists (e.g., embedded in email body, hidden fields in tables, image metadata, etc.), the distribution location of sensitive fields, and the scrambling form of fields, and constructs a dynamic test template accordingly. This template is highly parameterized and can automatically adjust the generation strategy according to the test objective. For example, if the test is specified as "email DLP," the template will insert sensitive fields into the email subject, body, attachments, etc., simulating real leakage. Adaptive field mapping rules define the semantic or structural correspondence between complex sample fields and target detection system fields, supporting field synonym recognition (e.g., "Mobile" mapping to "phone number"), structural adjustment (e.g., mapping nested JSON fields to a flat structure), and naming standardization. After the user sets specific detection requirements (e.g., testing DLP over an HTTP channel), the system converts the complex scenario sample fields into the target structure through mapping rules and generates data matching the test scenario. Finally, these samples are aggregated and output to form a set of requirement test samples that meets the scenario, structure, and field requirements, for automated test execution and result analysis.

[0044] Through the above steps, test data can be quickly adapted and flexibly converted between different DLP products, improving the automation and targeting of the testing process.

[0045] Furthermore, an automated detection process is adopted, which involves learning the features of requirement test samples in the requirement test sample set through a preset machine learning classification algorithm to obtain a sensitive data classifier. This process specifically includes: Multiple machine learning classification algorithms are preset, and the appropriate machine learning classification algorithm is selected based on the characteristics of the required test samples in the required test sample set; The set of requirement test samples is input into an appropriate machine learning classification algorithm for training in order to learn the features of the requirement test samples. Through the training process, the parameters of the machine learning classification algorithm are continuously adjusted until the preset classification accuracy is achieved; The trained machine learning classification algorithm is used as a sensitive data classifier.

[0046] In this embodiment, the system pre-configures several mainstream machine learning classification algorithms, including Logistic Regression, Support Vector Machine (SVM), Random Forest, Gradient Boosting Tree (such as XGBoost), and Neural Networks (such as MLP), supporting flexible use in both structured and unstructured scenarios. The system first analyzes the feature types of the samples in the required test sample set, such as the structure, textuality, and semantic complexity of the fields, and selects the most suitable classification model accordingly. For example, decision tree models are preferred for structured field classification, while deep learning-based text classification models (such as BERT) are preferred for natural language samples. During the training phase, the system inputs test samples with sensitive labels into the selected model, automatically extracting multi-dimensional features such as field length, character distribution, contextual word frequency, and semantic embedding, and iteratively trains the model parameters to optimize classification accuracy. During training, the system dynamically adjusts hyperparameters (such as learning rate, regularization term, tree depth, etc.) and uses cross-validation and performance evaluation mechanisms (such as Precision, Recall, F1-score) to measure performance until a preset accuracy threshold (such as above 90%) is reached. The final output model is a sensitive data classifier that can be directly used for sensitive information identification. This classifier can be embedded in the detection system for real-time or batch identification.

[0047] Through the above steps, a high-performance classifier model with self-learning capabilities is formed, improving the intelligence and accuracy of sensitive data detection.

[0048] In the above embodiments, this application discloses a data leakage detection method, belonging to the field of data security technology, and applied to the detection of sensitive data in financial systems or healthcare systems. This application achieves automated testing and sensitive information identification capability evaluation of a data leakage detection system by constructing a comprehensive and diverse test sample system, combined with a machine learning intelligent classification mechanism. First, it significantly improves the realism and complexity of the test samples, covering various real-world leakage scenarios such as format changes, field splitting, encryption processing, noise interference, and semantic masquerading, effectively simulating complex attack environments and overcoming boundary conditions that are difficult to identify using traditional rules. Second, it introduces an adaptive field mapping and dynamic test template mechanism, enabling test data to be flexibly adjusted according to different business scenarios or detection products, improving testing efficiency and scenario adaptability. Finally, by pre-setting multiple machine learning algorithms, it automatically trains and generates a high-precision sensitive data classifier, achieving accurate identification of sensitive fields in unknown data, significantly reducing manual intervention, and improving the intelligence and scalability of the detection. This application constructs an end-to-end, automatically executable sensitive data detection and evaluation framework, possessing technical advantages of high efficiency, flexibility, and intelligence.

[0049] For example, in healthcare systems, the security of sensitive data such as patient medical records and diagnostic reports is paramount. Taking a large tertiary hospital as an example, its healthcare system processes massive amounts of patient information daily, facing the risk of data breaches. Using the data breach detection method proposed in this application, a comprehensive and complex test sample system was first constructed, covering various real-world breach scenarios. For instance, key fields in patient medical records, such as names and ID numbers, were formatted differently; the date format was changed from "YYYY-MM-DD" to "DD / MM / YYYY"; some fields were split, such as splitting contact numbers into area codes, the first few digits of the number, and the last few digits; the data was also encrypted, simulating encryption methods that attackers might use; noise interference was added by inserting irrelevant characters into the medical record text; and semantic masquerading was performed, such as describing "cancer" as a "special disease," etc.

[0050] Meanwhile, an adaptive field mapping and dynamic test template mechanism are introduced to flexibly adjust test data according to the business scenarios of different departments in the hospital, such as outpatient, inpatient, and laboratory.

[0051] In this embodiment, the data leakage detection method operates on electronic devices (e.g., Figure 1 The server shown can receive instructions or acquire data via wired or wireless connection. It should be noted that the aforementioned wireless connection methods may include, but are not limited to, 3G / 4G connections, WiFi connections, Bluetooth connections, WiMAX connections, Zigbee connections, UWB (ultra-wideband) connections, and other currently known or future wireless connection methods.

[0052] It should be emphasized that, in order to further ensure the privacy and security of the aforementioned sensitive data, the sensitive data can also be stored in a blockchain node.

[0053] The blockchain referred to in this application is a novel application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and encryption algorithms. Essentially, a blockchain is a decentralized database, a chain of data blocks linked together using cryptographic methods. Each data block contains information about a batch of network transactions, used to verify the validity of the information (anti-counterfeiting) and generate the next block. A blockchain can include an underlying blockchain platform, a platform product service layer, and an application service layer.

[0054] The embodiments of this application can acquire and process relevant data based on artificial intelligence technology. Artificial intelligence (AI) refers to the theories, methods, technologies, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to obtain optimal results.

[0055] Foundational technologies for artificial intelligence generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies mainly encompass computer vision, robotics, biometrics, speech processing, natural language processing, and machine learning / deep learning.

[0056] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by instructing related hardware through computer-readable instructions. These computer-readable instructions can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above methods. The aforementioned storage medium can be a non-volatile storage medium such as a magnetic disk, optical disk, or read-only memory (ROM), or random access memory (RAM).

[0057] It should be understood that although the steps in the flowcharts of the accompanying figures are shown sequentially as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the accompanying figures may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0058] Further reference Figure 3 As a response to the above Figure 2 The implementation of the method shown in this application provides an embodiment of a data leakage detection device, which is similar to... Figure 2 Corresponding to the method embodiments shown, this device can be specifically applied to various electronic devices.

[0059] like Figure 3 As shown, the data leakage detection device 300 described in this embodiment includes: The initial sample module 301 is used to obtain initial samples from a preset sensitive data sample library and generate diverse initial test samples by randomizing the field combinations of the initial samples to obtain an initial test sample set, wherein the initial samples are samples containing a mixture of text and numbers. The data segmentation module 302 is used to perform sensitive data segmentation on the initial test samples in the initial test sample set according to the initial test sample set and a data splitting algorithm according to preset rules, so as to obtain a segmented sample set. The encryption processing module 303 is used to encrypt sensitive fields of the segmented sample set using a preset encryption algorithm to obtain an encrypted sample set. The random insertion module 304 is used to extract the encryption features of sensitive fields from the encrypted sample set, and to obtain the complex scenario sample set by randomly inserting noise fields and forged data fields into the encryption features of sensitive fields using a complex scenario simulation method. The field mapping module 305 is used to construct dynamic test templates based on complex scenario sample sets, and generate customized test sample sets according to detection requirements through an adaptive field mapping mechanism to obtain the required test sample set. The feature learning module 306 is used to learn the features of the requirement test samples in the requirement test sample set through a preset machine learning classification algorithm using an automated detection process, and obtain a sensitive data classifier. The sensitive data identification module 307 is used to identify sensitive data in the data to be detected using a sensitive data classifier, determine whether the detection contains sensitive information, and obtain the data detection result.

[0060] Furthermore, the initial sample module 301 specifically includes: The data filtering unit is used to filter out initial samples that meet preset conditions from the sensitive data sample library. The preset conditions include the data format, data type, and the business domain to which the data belongs. The randomization unit is used to randomize the fields of the selected initial samples to generate diverse initial test samples. The field randomization process includes randomly shuffling the field order, randomly replacing the field values, and randomly adding or removing fields. The first set-processing unit is used to set-process the generated diverse initial test samples to obtain an initial test sample set containing multiple initial test samples.

[0061] Furthermore, the data segmentation module 302 specifically includes: The algorithm invocation unit is used to invoke a preset data splitting algorithm, which includes splitting based on regular expressions, splitting based on semantic understanding, and splitting based on location information. The data splitting unit is used to split each initial test sample in the initial test sample set into multiple segmented samples containing sensitive data according to preset rules, wherein each segmented sample contains at least one piece of sensitive data. The second set-processing unit is used to set-process the multiple segmented samples obtained from the splitting to obtain a set of segmented samples containing multiple segmented samples.

[0062] Furthermore, the data splitting unit specifically includes: The first segmentation subunit is used to identify sensitive data fields in each initial test sample that conform to a preset regular expression pattern, and to separate the sensitive data fields that conform to the preset regular expression pattern from the initial test sample to obtain the first segment sample. The second segmentation subunit is used to identify sensitive data fields with sensitive semantic information in each initial test sample, and to separate the sensitive data fields with sensitive semantic information from the initial test sample to obtain the second segmented sample; The third segment subunit is used to identify the sensitive data fields carrying sensitive location identification information in each initial test sample, and to separate the sensitive data fields carrying sensitive location identification information from the initial test sample to obtain the third segment sample; The segmented combination subunit is used to combine the first segmented sample, the second segmented sample, and the third segmented sample to obtain multiple segmented samples containing sensitive data.

[0063] Furthermore, the encryption processing module 303 specifically includes: The encryption form parsing unit is used to parse the encryption form of sensitive fields from the encrypted sample set, and use it as the encryption feature of sensitive fields; The scenario simulation strategy unit is used to design complex scenario simulation strategies, which cover data leakage scenarios such as data obfuscation, data nesting, and data masquerading. The noise field insertion unit is used to insert a noise field at a random position in the encryption feature of the sensitive field according to the complex scenario simulation strategy. The noise field is a field that is similar to the sensitive data format but does not contain sensitive information. The forged data field insertion unit is used to simultaneously insert a forged data field at a random position in the encryption feature of the sensitive field, wherein the forged data field is a field generated according to a preset generation rule that is different from the sensitive data in both format and content; The feature recombination unit is used to recombine the encrypted features of sensitive fields after inserting noise fields and forged data fields to form test samples under complex scenarios, and to generate a complex scenario sample set containing multiple complex scenario test samples.

[0064] Furthermore, the field mapping module specifically includes: The dynamic test template unit is used to analyze the characteristics of test samples in a complex scenario sample set and construct dynamic test templates based on the test sample characteristics. The dynamic test template can flexibly adjust the test strategy according to different data leakage scenarios. The field mapping rule unit is used to define adaptive field mapping rules, which are used to map test sample fields in a complex scenario sample set to actual detection requirement fields. The field mapping processing unit is used to perform field mapping processing on test samples in a complex scenario sample set according to detection requirements and using adaptive field mapping rules to generate customized test samples that match the detection requirements. The third set-up processing unit is used to set up the generated customized test samples to obtain a set of requirement test samples containing multiple customized test samples.

[0065] Furthermore, the feature learning module specifically includes: The classification algorithm selection unit is used to preset multiple machine learning classification algorithms and select the appropriate machine learning classification algorithm according to the characteristics of the required test samples in the required test sample set. The classification algorithm training unit is used to input the set of requirement test samples into the appropriate machine learning classification algorithm for training, so as to learn the features of the requirement test samples. The algorithm parameter adjustment unit is used to continuously adjust the parameters of the machine learning classification algorithm during the training process until the preset classification accuracy is achieved. The sensitive data classifier output unit is used to use the trained machine learning classification algorithm as a sensitive data classifier.

[0066] In the above embodiments, this application discloses a data leakage detection device, belonging to the field of data security technology, applied to the detection of sensitive data in financial systems or healthcare systems. This application achieves automated testing and sensitive information identification capability evaluation of the data leakage detection system by constructing a comprehensive and diverse test sample system, combined with a machine learning intelligent classification mechanism. First, it significantly improves the realism and complexity of the test samples, covering various real-world leakage scenarios such as format changes, field splitting, encryption processing, noise interference, and semantic masquerading, effectively simulating complex attack environments and overcoming boundary conditions that are difficult to identify using traditional rules. Second, it introduces an adaptive field mapping and dynamic test template mechanism, enabling test data to be flexibly adjusted according to different business scenarios or detection products, improving testing efficiency and scenario adaptability. Finally, by pre-setting multiple machine learning algorithms, it automatically trains and generates a high-precision sensitive data classifier, achieving accurate identification of sensitive fields in unknown data, significantly reducing manual intervention, and improving the intelligence and scalability of the detection. This application constructs an end-to-end, automatically executable sensitive data detection and evaluation framework, possessing technical advantages of high efficiency, flexibility, and intelligence.

[0067] To address the aforementioned technical problems, embodiments of this application also provide a computer device. Please refer to [link / reference needed]. Figure 4 , Figure 4 This is a basic structural block diagram of the computer device in this embodiment.

[0068] The computer device 4 includes a memory 41, a processor 42, and a network interface 43 that are interconnected via a system bus. It should be noted that only the computer device 4 with memory 41, processor 42, and network interface 43 is shown in the figure; however, it should be understood that it is not required to implement all the components shown, and more or fewer components can be implemented alternatively. Those skilled in the art will understand that the computer device described here is a device capable of automatically performing numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes, but is not limited to, microprocessors, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), embedded devices, etc.

[0069] The computer device can be a desktop computer, laptop, handheld computer, or cloud server, etc. The computer device can interact with the user via a keyboard, mouse, remote control, touchpad, or voice control.

[0070] The memory 41 includes at least one type of readable storage medium, including flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 41 may be an internal storage unit of the computer device 4, such as the hard disk or memory of the computer device 4. In other embodiments, the memory 41 may also be an external storage device of the computer device 4, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the computer device 4. Of course, the memory 41 may also include both the internal storage unit and its external storage device of the computer device 4. In this embodiment, the memory 41 is typically used to store the operating system and various application software installed on the computer device 4, such as computer-readable instructions for data leakage detection methods. In addition, the memory 41 can also be used to temporarily store various types of data that have been output or will be output.

[0071] In some embodiments, the processor 42 may be a central processing unit (CPU), controller, microcontroller, microprocessor, or other data processing chip. The processor 42 is typically used to control the overall operation of the computer device 4. In this embodiment, the processor 42 is used to execute computer-readable instructions stored in the memory 41 or to process data, for example, to execute computer-readable instructions of the data leakage detection method.

[0072] The network interface 43 may include a wireless network interface or a wired network interface, which is typically used to establish communication connections between the computer device 4 and other electronic devices.

[0073] This application also provides an implementation method, namely, a computer device including a memory and a processor. The memory stores computer-readable instructions, and when the processor executes the computer-readable instructions, it implements the steps of the data leakage detection method described above, that is, it implements: A data breach detection method, comprising: Initial samples are obtained from a pre-defined sensitive data sample library, and diverse initial test samples are generated by randomizing the field combinations of the initial samples to obtain an initial test sample set. The initial samples are samples containing a mixture of text and numbers. Based on the initial test sample set, a data splitting algorithm is used to perform sensitive data segmentation on the initial test samples in the initial test sample set according to preset rules, resulting in a segmented sample set. For the segmented sample set, sensitive fields are encrypted using a preset encryption algorithm to obtain an encrypted sample set; The encryption features of sensitive fields are extracted from the encrypted sample set, and a complex scenario simulation method is used to obtain a complex scenario sample set by randomly inserting noise fields and forged data fields into the encryption features of sensitive fields. Based on a complex scenario sample set, a dynamic test template is constructed, and a customized test sample set is generated according to the detection requirements through an adaptive field mapping mechanism to obtain the required test sample set. An automated detection process is adopted, and the characteristics of the requirement test samples in the requirement test sample set are learned through a preset machine learning classification algorithm to obtain a sensitive data classifier; A sensitive data classifier is used to identify sensitive data in the data to be detected, determine whether the detection contains sensitive information, and obtain the data detection results.

[0074] This application also provides another embodiment, namely, a computer-readable storage medium storing computer-readable instructions that can be executed by at least one processor to cause the at least one processor to perform the steps of the data leakage detection method described above, i.e., to achieve: A data breach detection method, comprising: Initial samples are obtained from a pre-defined sensitive data sample library, and diverse initial test samples are generated by randomizing the field combinations of the initial samples to obtain an initial test sample set. The initial samples are samples containing a mixture of text and numbers. Based on the initial test sample set, a data splitting algorithm is used to perform sensitive data segmentation on the initial test samples in the initial test sample set according to preset rules, resulting in a segmented sample set. For the segmented sample set, sensitive fields are encrypted using a preset encryption algorithm to obtain an encrypted sample set; The encryption features of sensitive fields are extracted from the encrypted sample set, and a complex scenario simulation method is used to obtain a complex scenario sample set by randomly inserting noise fields and forged data fields into the encryption features of sensitive fields. Based on a complex scenario sample set, a dynamic test template is constructed, and a customized test sample set is generated according to the detection requirements through an adaptive field mapping mechanism to obtain the required test sample set. An automated detection process is adopted, and the characteristics of the requirement test samples in the requirement test sample set are learned through a preset machine learning classification algorithm to obtain a sensitive data classifier; A sensitive data classifier is used to identify sensitive data in the data to be detected, determine whether the detection contains sensitive information, and obtain the data detection results.

[0075] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0076] This application can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics devices, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0077] It should be noted that the software tools or components not belonging to this company that appear in the various embodiments of this application are merely illustrative examples and do not represent actual use.

[0078] Obviously, the embodiments described above are only some embodiments of this application, not all embodiments. The accompanying drawings show preferred embodiments of this application, but do not limit the patent scope of this application. This application can be implemented in many different forms; rather, the purpose of providing these embodiments is to provide a more thorough and comprehensive understanding of the disclosure of this application. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing specific embodiments, or make equivalent substitutions for some of the technical features. Any equivalent structures made using the content of this application's specification and drawings, directly or indirectly applied to other related technical fields, are similarly within the scope of patent protection of this application.

Claims

1. A data leakage detection method, characterized in that, include: Initial samples are obtained from a pre-set sensitive data sample library, and diverse initial test samples are generated by randomizing the field combinations of the initial samples to obtain an initial test sample set, wherein the initial samples are samples containing a mixture of text and numbers. Based on the initial test sample set, a data splitting algorithm is used to perform sensitive data segmentation on the initial test samples in the initial test sample set according to preset rules to obtain a segmented sample set. For the segmented sample set, the sensitive fields are encrypted using a preset encryption algorithm to obtain an encrypted sample set; Sensitive field encryption features are extracted from the encrypted sample set, and a complex scenario simulation method is used to obtain a complex scenario sample set by randomly inserting noise fields and forged data fields into the sensitive field encryption features. Based on the complex scenario sample set, a dynamic test template is constructed, and a customized test sample set is generated according to the detection requirements through an adaptive field mapping mechanism to obtain the required test sample set. An automated detection process is adopted, and the characteristics of the requirement test samples in the requirement test sample set are learned through a preset machine learning classification algorithm to obtain a sensitive data classifier; The sensitive data classifier is used to identify sensitive data in the data to be detected, and it is determined whether the detection contains sensitive information to obtain the data detection result.

2. The data leakage detection method as described in claim 1, characterized in that, The step of obtaining initial samples from a preset sensitive data sample library and generating diverse initial test samples by randomizing the field combinations of the initial samples to obtain an initial test sample set specifically includes: Initial samples that meet preset conditions are selected from the sensitive data sample library, wherein the preset conditions include the data format, data type, and the business domain to which the data belongs; The selected initial samples are subjected to field randomization to generate the diverse initial test samples. The field randomization includes randomly shuffling the field order, randomly replacing the field values, and randomly adding or removing fields. The generated diverse initial test samples are aggregated to obtain the initial test sample set containing multiple initial test samples.

3. The data leakage detection method as described in claim 1, characterized in that, The step of using a data splitting algorithm to perform sensitive data segmentation on the initial test samples in the initial test sample set according to a preset rule, based on the initial test sample set, specifically includes: Invoke a preset data splitting algorithm, wherein the data splitting algorithm includes splitting based on regular expressions, splitting based on semantic understanding, and splitting based on location information; According to the preset rules, each initial test sample in the initial test sample set is split into multiple segmented samples containing sensitive data, wherein each segmented sample contains at least one piece of sensitive data. The multiple segmented samples obtained from the splitting are aggregated to obtain the segmented sample set containing the multiple segmented samples.

4. The data leakage detection method as described in claim 3, characterized in that, The step of splitting each initial test sample in the initial test sample set into multiple segmented samples containing sensitive data according to the preset rules specifically includes: Identify sensitive data fields in each initial test sample that conform to a preset regular expression pattern, and separate the sensitive data fields that conform to the preset regular expression pattern from the initial test sample to obtain the first segment sample; Identify sensitive data fields with sensitive semantic information in each initial test sample, and separate the sensitive data fields with sensitive semantic information from the initial test samples to obtain the second segment samples; Identify the sensitive data fields carrying sensitive location identification information in each initial test sample, and separate the sensitive data fields carrying sensitive location identification information from the initial test samples to obtain the third segment sample; By combining the first segmented sample, the second segmented sample, and the third segmented sample, multiple segmented samples containing sensitive data are obtained.

5. The data leakage detection method as described in claim 1, characterized in that, The step of extracting sensitive field encryption features from the encrypted sample set and obtaining a complex scenario sample set by randomly inserting noise fields and forged data fields into the sensitive field encryption features using a complex scenario simulation method specifically includes: The encryption form of the sensitive field is parsed from the encrypted sample set and used as the encryption feature of the sensitive field; Design a complex scenario simulation strategy, wherein the complex scenario simulation strategy covers data leakage scenarios such as data obfuscation, data nesting, and data masquerading; According to the complex scenario simulation strategy, a noise field is randomly inserted into the sensitive field encryption feature, wherein the noise field is a field that is similar to the sensitive data format but does not contain sensitive information; Simultaneously, a forged data field is randomly inserted into the encryption feature of the sensitive field, wherein the forged data field is a field generated according to a preset generation rule that is different from the sensitive data in both format and content; The sensitive field encryption features after inserting the noise field and the forged data field are recombined to form a test sample under complex scenarios, and then combined into a complex scenario sample set containing multiple complex scenario test samples.

6. The data leakage detection method as described in claim 1, characterized in that, The step of constructing a dynamic test template based on the complex scenario sample set and generating a customized test sample set according to the detection requirements through an adaptive field mapping mechanism to obtain the required test sample set specifically includes: The characteristics of test samples in the complex scenario sample set are analyzed, and a dynamic test template is constructed based on the characteristics of the test samples. The dynamic test template can flexibly adjust the test strategy according to different data leakage scenarios. Define an adaptive field mapping rule, wherein the adaptive field mapping rule is used to map the test sample fields in the complex scenario sample set to the actual detection requirement fields; Based on the detection requirements, the adaptive field mapping rules are used to perform field mapping processing on the test samples in the complex scene sample set to generate customized test samples that match the detection requirements. The generated customized test samples are aggregated to obtain a set of requirement test samples containing multiple customized test samples.

7. The data leakage detection method as described in claim 1, characterized in that, The step of adopting an automated detection process, which involves learning the features of the requirement test samples in the requirement test sample set through a preset machine learning classification algorithm to obtain a sensitive data classifier, specifically includes: Multiple machine learning classification algorithms are preset, and the appropriate machine learning classification algorithm is selected according to the characteristics of the required test samples in the required test sample set. The set of required test samples is input into the adapted machine learning classification algorithm for training in order to learn the features of the required test samples. Through the training process, the parameters of the machine learning classification algorithm are continuously adjusted until the preset classification accuracy is achieved; The trained machine learning classification algorithm is used as the sensitive data classifier.

8. A data leakage detection device, characterized in that, include: The initial sample module is used to obtain initial samples from a preset sensitive data sample library, and generate diverse initial test samples by randomizing the field combinations of the initial samples to obtain an initial test sample set, wherein the initial samples are samples containing a mixture of text and numbers. The data segmentation module is used to perform sensitive data segmentation on the initial test samples in the initial test sample set according to the initial test sample set and a data splitting algorithm according to preset rules, so as to obtain a segmented sample set. The encryption processing module is used to encrypt sensitive fields in the segmented sample set using a preset encryption algorithm to obtain an encrypted sample set. The random insertion module is used to extract sensitive field encryption features from the encrypted sample set, and to obtain a complex scene sample set by randomly inserting noise fields and forged data fields into the sensitive field encryption features using a complex scene simulation method. The field mapping module is used to construct a dynamic test template based on the complex scenario sample set, and generate a customized test sample set according to the detection requirements through an adaptive field mapping mechanism to obtain the required test sample set. The feature learning module is used to learn the features of the requirement test samples in the requirement test sample set through a preset machine learning classification algorithm using an automated detection process, so as to obtain a sensitive data classifier. The sensitive data identification module is used to identify sensitive data in the data to be detected using the sensitive data classifier, determine whether the detection contains sensitive information, and obtain the data detection result.

9. A computer device, characterized in that, The device includes a memory and a processor, wherein the memory stores computer-readable instructions, and the processor executes the computer-readable instructions to implement the steps of the data leakage detection method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-readable instructions, which, when executed by a processor, implement the steps of the data leakage detection method as described in any one of claims 1 to 7.

Images