Data security management method and system based on AI drive

Abstract

The invention discloses a data security management method and system based on AI drive, and relates to the technical field of artificial intelligence and data security, and the method comprises the steps: generating a fusion feature vector through a multi-modal feature extraction and semantic alignment mechanism; constructing a blood relationship knowledge graph, performing graph embedding calculation on the blood relationship knowledge graph to obtain a graph embedding vector, and calculating a blood relationship propagation sensitivity score; generating a sensitivity evaluation result through a dynamic decision neural network in combination with context features of the data access request; generating and executing an access control strategy according to a sensitivity evaluation result, and triggering cascade label evaluation on downstream derivative data along a blood relationship knowledge graph; and selecting samples based on confidence, submitting the samples to manual auditing, and executing incremental learning updating on model parameters according to auditing feedback. According to the method, the sensitivity identification accuracy of cross-modal data is improved through multi-modal semantic fusion, and automatic cascade updating of sensitive tags is realized through a blood relationship propagation mechanism.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of artificial intelligence and data security technology, and in particular to an AI-driven data security management method and system. BACKGROUND

[0002] With the rapid development of cloud computing, big data and artificial intelligence technology, enterprise data presents the characteristics of large scale, diverse types and frequent flow. Data has become the core asset of enterprises, but at the same time, it also faces increasingly serious security threats. How to effectively identify and protect sensitive data, prevent data leakage and misuse, has become an important issue in the field of data security.

[0003] Traditional data security management technology mainly relies on manual review and rule matching methods for data classification and access control, which has low efficiency, low accuracy and is difficult to adapt to dynamic changes. In particular, when dealing with large-scale, multi-modal unstructured data, existing technologies are difficult to achieve automated and intelligent sensitive information identification and classification management. At the same time, the sensitive attribute changes of data in the process of flow and use are difficult to track, and the access control strategy lacks flexibility, resulting in a large security risk in sensitive data protection. SUMMARY

[0004] In view of the above existing problems, the present application is proposed.

[0005] Therefore, the present application provides an AI-driven data security management method and system to solve the technical problems of low accuracy of sensitive data identification, difficulty in tracking sensitive attributes in the data flow process, and lack of flexibility of access control strategy in the prior art.

[0006] To solve the above technical problems, the present application provides the following technical solutions: In a first aspect, the present application provides an AI-driven data security management method, which comprises: Obtaining a data object to be classified, identifying the modal type and processing the content of each modal to generate an analysis result object; Performing feature extraction on the analysis result object, mapping the modal feature vectors to a unified semantic space through a semantic alignment mechanism and calculating cross-modal interaction weights to generate a fusion feature vector; Constructing a blood relationship knowledge graph based on the fusion feature vector and the data operation log, performing graph embedding calculation on the blood relationship knowledge graph to obtain a graph embedding vector, and calculating a blood relationship propagation sensitivity score; Extracting the context feature vector of the data access request, combining the fusion feature vector, the graph embedding vector and the blood relationship propagation sensitivity score, and generating a sensitivity evaluation result through a dynamic decision neural network; According to the sensitivity evaluation result, an access control strategy is generated and executed, and a cascade label evaluation is triggered along a blood relationship knowledge graph for downstream derived data; Based on the confidence, a sample is selected for manual review, and according to the review feedback, incremental learning is performed to update the model parameters.

[0007] As a preferred scheme of the AI-driven data security management method, the generation of the analysis result object includes: Obtain the data object to be classified, and determine the modal type according to the file format of the data object; When the modal type is a mixed type, separate the modal contents in the data object; Perform sensitive mode pre-scanning on each modal content, and extract a set of sensitive entities for each modal; Based on the set of sensitive entities, a cross-modal semantic consistency matrix is constructed, the sensitive mode is judged according to the cross-modal semantic similarity, and a sensitive pre-judgment label is generated; Each modal content is respectively subjected to standardization processing, and the analysis result object is generated in combination with the sensitive pre-judgment label.

[0008] As a preferred scheme of the AI-driven data security management method, the generation of the fusion feature vector includes: Each modal content in the analysis result object is respectively input into a corresponding pre-training encoder, each modal feature vector is extracted and normalized, and a multi-modal feature set is constructed; Each modal feature vector in the multi-modal feature set is projected to a unified dimension through a feature projection matrix to obtain a projected feature vector; A modal sequence matrix containing the projected feature vector is constructed, and modal position encoding is added; A sensitive region mask matrix is constructed based on the sensitive pre-judgment label, and the sensitive region mask matrix is converted into an attention bias term; Based on the sensitive region bias term, the multi-head self-attention of the modal sequence matrix is calculated, the attention output matrix is weighted average-pooled, and the fusion feature vector is generated.

[0009] As a preferred scheme of the AI-driven data security management method, the construction of the blood relationship knowledge graph includes: Create a node for the data object, use the fusion feature vector as the node feature, and add the node to the blood relationship knowledge graph; Extract the blood relationship of the data object from the data operation log, determine the propagation weight according to the operation type, create a directed blood relationship edge, and add it to the blood relationship knowledge graph; Graph embedding calculation is performed on the blood relationship knowledge graph using a graph neural network to obtain a graph embedding vector of each node in the blood relationship knowledge graph; A bloodline path is constructed based on a directed bloodline edge in the bloodline knowledge graph, and a bloodline propagation sensitivity score is calculated along the bloodline path.

[0010] As a preferred scheme of the AI-driven data security management method, the sensitivity evaluation result is generated by the dynamic decision neural network, including: The multi-dimensional context features are extracted from the data access request and mapped to a unified dimension to obtain a context feature vector; The context risk coefficient is calculated based on the context feature vector; The context-aware feature vector is generated by dynamically weighting the context risk coefficient, the bloodline propagation sensitivity score, the fusion feature vector, and the graph embedding vector; The context-aware feature vector is input into the dynamic decision neural network to generate a comprehensive sensitivity score and a sensitivity level probability distribution; Based on the context risk coefficient and the sensitivity level probability distribution, the sensitivity label and the confidence are determined by a hierarchical decision mechanism to generate the sensitivity evaluation result.

[0011] As a preferred scheme of the AI-driven data security management method, the sensitivity evaluation result is generated and the access control strategy is executed, including: The sensitivity label of the data object is updated according to the sensitivity evaluation result, and the label change history is recorded; The corresponding access control strategy template is queried according to the sensitivity label, the data-level access rule is generated, and the access control gateway is pushed; Downstream derivative data is identified along the bloodline knowledge graph, and an asynchronous label re-evaluation task is triggered for the downstream derivative data and added to the re-evaluation queue.

[0012] As a preferred scheme of the AI-driven data security management method, the model parameter is updated by incremental learning according to the audit feedback, including: The training sample weight is calculated and the composite loss function is defined; The optimizer performs incremental update on the model parameters based on the composite loss function; The performance indicators of the updated model are evaluated on an independent validation set, and when the performance indicators are better than the current model, the updated model parameters are saved.

[0013] In a second aspect, the present application provides an AI-driven data security management system, including: A data preprocessing module is used to obtain a data object to be classified, identify the modal type, process the content of each mode, and generate an analysis result object; The cross-modal fusion module is configured to perform feature extraction on the analysis result object, map the feature vectors of each mode to a unified semantic space through a semantic alignment mechanism, calculate cross-modal interaction weights, and generate a fusion feature vector. The bloodline propagation module is configured to construct a bloodline knowledge graph based on the fusion feature vector and the data operation log, perform graph embedding calculation on the bloodline knowledge graph to obtain a graph embedding vector, and calculate a bloodline propagation sensitivity score. The dynamic decision module is configured to extract a context feature vector of the data access request, combine the fusion feature vector, the graph embedding vector, and the bloodline propagation sensitivity score, and generate a sensitivity evaluation result through a dynamic decision neural network. The policy execution module is configured to generate and execute an access control policy according to the sensitivity evaluation result, and trigger cascading label evaluation along the bloodline knowledge graph for downstream derivative data. The model optimization module is configured to select samples for manual review based on confidence, and perform incremental learning update on model parameters according to review feedback.

[0014] In a third aspect, the present application provides a computer device comprising a memory and a processor, the memory storing a computer program, wherein the computer program is executed by the processor to implement any step of the AI-driven data security management method according to the first aspect of the present application.

[0015] In a fourth aspect, the present application provides a computer-readable storage medium storing a computer program, wherein the computer program is executed by the processor to implement any step of the AI-driven data security management method according to the first aspect of the present application.

[0016] The present application has the following beneficial effects: the present application sets different propagation weights according to operation types in the bloodline knowledge graph and introduces a decay coefficient, realizes quantitative propagation and reasonable inheritance of sensitivity attributes in data derivative paths, and solves the technical problem that the prior art cannot track changes in sensitive attributes during data flow. By calculating the context risk coefficient and dynamically adjusting the feature fusion weight and the decision strategy, the sensitivity determination can be adjusted adaptively according to the access scenario, reducing the false positive rate and the false negative rate. Through the cascading label reevaluation triggered by the bloodline knowledge graph and the end-to-end incremental learning based on artificial feedback, the consistency of the sensitivity label is realized, and the model parameters are continuously optimized, improving the automation level and accuracy of data security management. BRIEF DESCRIPTION OF DRAWINGS

[0017] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0018] Figure 1 The overall flowchart of the AI-driven data security management method.

[0019] Figure 2 The feature fusion flowchart of the AI-driven data security management method.

[0020] Figure 3 The bloodline knowledge graph construction flowchart of the AI-driven data security management method.

[0021] Figure 4 The structural block diagram of the AI-driven data security management system. DETAILED DESCRIPTION

[0022] In order to make the above-mentioned purposes, features and advantages of the present application more apparent and easy to understand, the specific embodiments of the present application will be described in detail below with reference to the drawings.

[0023] In the following description, many specific details are set forth in order to provide a thorough understanding of the present application, but the present application can also be implemented in other ways different from those described herein, and those skilled in the art can make similar generalizations without departing from the scope of the present application, therefore the present application is not limited to the specific embodiments disclosed below.

[0024] Secondly, the "one embodiment" or "embodiment" referred to herein means that the specific features, structures or characteristics can be included in at least one implementation of the present application. "In one embodiment" appearing in different places in the specification does not mean the same embodiment, nor is it an embodiment that is separate or selectively excluded from other embodiments.

[0025] Reference Figures 1-4 For one embodiment of the present application, the embodiment provides an AI-driven data security management method, and the overall flowchart is as shown in Figure 1 The method comprises the following steps: S1: obtaining a data object to be classified, identifying the modal type and processing the modal content to generate an analysis result object.

[0026] Specifically, step S1 comprises: S1.1: obtaining a data object to be classified, and determining the modal type according to the file format of the data object.

[0027] The data object includes data content and metadata, and the metadata includes file format, creation time, system to which the data object belongs, and the like.

[0028] In one embodiment, the modal type is determined by a format mapping table, which establishes a correspondence between file extensions and modal types, and a predefined set of modal types includes text, image, video, and mixed. In another embodiment, if the file format does not exist in the mapping table, secondary identification is performed by reading the file header features.

[0029] S1.2: When the modal type is a mixed type, separate the modal content in the data object.

[0030] Further, for a data object of a composite document type, a document parser is called to extract text content and embedded image content; for a data object of a video file type, key frames are extracted as video frame content at a preset frame rate, and audio-to-text is extracted as supplementary text content.

[0031] S1.3: Perform sensitive mode pre-scanning on each modal content to extract a set of sensitive entities for each modal.

[0032] Further, for text content, a set of text sensitive entities is extracted by a sensitive word library and named entity recognition; for image content, a set of image sensitive entities is extracted by a target detection model to identify sensitive objects such as certificates and faces; for video frame content, a set of video sensitive entities is extracted by frame-level target detection.

[0033] S1.4: Construct a cross-modal semantic consistency matrix based on the set of sensitive entities, determine the sensitive mode according to the cross-modal semantic similarity, and generate a sensitive pre-judgment label.

[0034] Preferably, the modal sensitive entities are converted into semantic vectors by a pre-trained entity encoder, which is a visual-linguistic joint pre-training model capable of mapping different modal entities to a unified semantic space; the cosine similarity between the semantic vectors of different modal sensitive entities is calculated to construct a cross-modal semantic consistency matrix; the global maximum similarity value of the consistency matrix is calculated, and when the maximum similarity value is greater than a preset sensitivity judgment threshold and the corresponding entity pair belongs to a predefined sensitive entity library, it is determined as a high-confidence sensitive mode, and a sensitive pre-judgment label containing the entity pair identifier, similarity score, and sensitive type is generated.

[0035] It should be noted that the preset sensitivity judgment threshold is determined according to statistical analysis of historical data, and can be adjusted according to business security policies in actual application; the predefined sensitive entity library contains various types of sensitive entity patterns and their semantic features, and supports dynamic updating according to the model optimization results of step S6.

[0036] S1.5: Perform standardization processing on each modality content respectively, and generate an analysis result object in combination with the sensitive pre-judgment label.

[0037] Preferably, by constructing a cross-modal semantic consistency matrix and converting the sensitive pre-judgment label into an attention bias item to guide feature fusion, the multi-modal sensitive information recognition breaks through the limitations of single-modal recognition, can capture cross-modal associated sensitive content, and improves the sensitive information recognition accuracy of mixed format data.

[0038] S2: Perform feature extraction on the analysis result object, map each modality feature vector to a unified semantic space through a semantic alignment mechanism, calculate cross-modal interaction weights, and generate a fusion feature vector.

[0039] Specifically, the feature fusion process diagram is as shown in Figure 2 , which includes: S2.1: Input each modality content in the analysis result object into the corresponding pre-trained encoder, extract each modality feature vector and perform normalization processing, and construct a multi-modal feature set.

[0040] In one embodiment, according to the modality type in the analysis result object, the corresponding pre-trained encoder is selected to extract the features of each modality content. For text content, a pre-trained language model is used to extract a text feature vector; for image content, a pre-trained visual model is used to extract an image feature vector; for video frame content, a pre-trained video model is used to extract a video feature vector. The extracted modality feature vectors are normalized to construct a multi-modal feature set.

[0041] S2.2: Project each modality feature vector in the multi-modal feature set to a unified dimension through a feature projection matrix to obtain a projected feature vector.

[0042] Specifically, for the feature vectors in the multi-modal feature set with inconsistent dimensions, linear transformation is performed through a feature projection matrix to map them to a unified dimension to obtain a projected feature vector, and the feature projection matrix is a learnable parameter.

[0043] S2.3: Construct a modality sequence matrix containing the projected feature vector, and add modality position encoding.

[0044] Further, the projected feature vectors are arranged in order of modality type to construct a modality sequence matrix, and the rows of the modality sequence matrix correspond to different modalities and the columns correspond to feature dimensions. A learnable modality position encoding is added to each modality in the modality sequence matrix, and the modality position encoding is used to identify the modality type to which the feature vector belongs. The modality position encoding and the corresponding projected feature vector are added to obtain the modality sequence matrix after position encoding.

[0045] S2.4: Construct a sensitive region mask matrix based on the sensitive pre-judgment label, and convert the sensitive region mask matrix into an attention bias term.

[0046] Preferably, the entity position information is extracted from the sensitive pre-judgment label, and a sensitive region mask matrix is constructed based on the entity position information. The mask matrix corresponds to the dimensions of the modal sequence matrix, and the sensitive region position is marked as 1 and the non-sensitive region position is marked as 0. When the similarity score is included in the sensitive pre-judgment label, the similarity score is mapped to the corresponding position of the mask matrix to form a weighted mask matrix. The sensitive region mask matrix is converted into an attention bias term, which is realized by linear transformation of the mask value.

[0047] It should be noted that the attention bias term is added to the corresponding position of the attention score matrix in the subsequent multi-head self-attention calculation, which enhances the attention weight of the sensitive region.

[0048] S2.5: Calculate the multi-head self-attention of the modal sequence matrix based on the sensitive region bias term, and perform weighted average pooling on the attention output matrix to generate a fusion feature vector.

[0049] Specifically, for each attention head, the modal sequence matrix is transformed into a Query matrix, a Key matrix and a Value matrix through a Query weight matrix, a Key weight matrix and a Value weight matrix. The dot product of the Query matrix and the transpose of the Key matrix is calculated to obtain an attention score matrix.

[0050] Further, the attention bias term is added to the corresponding position of the attention score matrix, and the biased attention score matrix is scaled and normalized to obtain a cross-modal interaction weight matrix. The cross-modal interaction weight matrix is multiplied by the Value matrix to obtain the attention output.

[0051] Further, the outputs of all attention heads are spliced and linearly transformed to obtain an attention output matrix. The attention output matrix is subjected to weighted average pooling, and the pooling weight is obtained by multiplying the attention score and the sensitive pre-judgment score and then normalizing, to generate a fusion feature vector.

[0052] Preferably, the multi-head attention mechanism is used to capture the sensitive information correlation across modalities in a unified semantic space, solving the problem of multi-modal judgment conflict in the prior art. The attention bias mechanism constructed based on the sensitive pre-judgment label guides the multi-head self-attention calculation to focus on the sensitive region, so that the sensitive content obtains a higher expression weight in the fusion feature. Through the dual weighting and pooling mechanism of the attention score and the sensitive pre-judgment score, the generated fusion feature vector highlights the sensitive information representing the cross-modal correlation, reduces the interference of non-sensitive information, and provides a high-quality semantic representation basis for subsequent blood propagation and dynamic decision-making.

[0053] S3: constructing a blood relation knowledge graph based on the fusion feature vector and the data operation log, performing graph embedding calculation on the blood relation knowledge graph to obtain a graph embedding vector, and calculating a blood relation propagation sensitivity score.

[0054] Specifically, a blood relation knowledge graph construction process schematic diagram is shown in FIG. 3, which includes the following steps. Figure 3 S3.1: creating a node for a data object, taking the fusion feature vector as a node feature, and adding the node to the blood relation knowledge graph.

[0055] It should be noted that the node contains a data object identifier, a fusion feature vector, a modal type, and a creation timestamp.

[0056] S3.2: extracting a blood relation of the data object from the data operation log, determining a propagation weight according to an operation type, creating a directed blood relation edge, and adding the directed blood relation edge to the blood relation knowledge graph.

[0057] Among them, the operation record of the target data identifier is queried from the data operation log, and a source data identifier, an operation type, and an operation time are extracted. The operation type includes copying, field extraction, aggregation, and desensitization.

[0058] Further, further, a differential propagation weight is set according to the operation type, and the propagation weight is in descending order: copying operation, field extraction operation, aggregation operation, and desensitization operation. The above setting is based on the retention degree of sensitive information by different operations: copying completely retains sensitive information, field extraction partially retains, aggregation reduces data granularity, and desensitization significantly weakens sensitivity.

[0059] Further, for each source data identifier, if a corresponding source data node exists in the blood relation knowledge graph, a directed blood relation edge from the source data node to the data node is created, and the directed blood relation edge contains an operation type, a propagation weight, and an operation time.

[0060] S3.3: performing graph embedding calculation on the blood relation knowledge graph by using a graph neural network to obtain a graph embedding vector of each node in the blood relation knowledge graph.

[0061] Preferably, the graph neural network aggregates neighbor node features of each node and performs nonlinear transformation, and iteratively updates the graph embedding vector of each node through multiple layers.

[0062] S3.4: constructing a blood relation path based on the directed blood relation edge in the blood relation knowledge graph, and calculating a blood relation propagation sensitivity score along the blood relation path.

[0063] ​Specifically, all source data nodes of the current data node and corresponding bloodline paths are obtained; for each source data node, the product of its sensitivity score, the propagation weight of the corresponding bloodline edge, and the attenuation coefficient based on the path hop count is calculated, the attenuation coefficient attenuates with the increase of the path hop count; the calculation results of all source data nodes are accumulated to obtain the bloodline propagation sensitivity score of the current data node.

[0064] Preferably, through the differential propagation weight and path attenuation mechanism, the automatic propagation and quantitative calculation of the sensitivity along the data bloodline path are realized, so that the sensitivity of the derived data can be dynamically determined according to the source data, the operation type, and the propagation distance, without manual annotation one by one. The graph embedding vector obtained through the graph neural network fuses the topological structure information of the bloodline network, thereby enhancing the accuracy of subsequent decision-making.

[0065] S4: Extracting the context feature vector of the data access request, combining the fusion feature vector, the graph embedding vector, and the bloodline propagation sensitivity score, and generating a sensitivity evaluation result through a dynamic decision-making neural network.

[0066] Specifically, step S4 includes: S4.1: Extracting multi-dimensional context features from the data access request and mapping them to a unified dimension to obtain a context feature vector.

[0067] In an embodiment, the data access request contains request user identification, request time, access location, device information, and operation type information. The multi-dimensional context features include but are not limited to user role features, time features, location features, operation features, and device features.

[0068] Among them, the user role feature is obtained by querying the user role mapping table to obtain the role label and vector encoding; the time feature is obtained by calculating the period information (such as hour, week, etc.) of the request time and the working time identification; the location feature is obtained by mapping the access location to the area code and judging whether it is the user's usual location, containing the area code and the abnormal location identification; the operation feature is obtained by determining the risk level according to the operation type and calculating the operation frequency abnormality, wherein the operation frequency abnormality is calculated based on the user historical operation behavior statistics; the device feature is obtained by extracting the device type and trust state. After the above-mentioned dimensional features are standardized and mapped to a unified dimension, they are spliced to form a context feature vector.

[0069] Further, the user role feature vector, the time feature vector, the location feature vector, the operation feature vector, and the device feature vector are spliced, mapped to a unified dimension through a fully connected layer and a nonlinear activation function, and a context feature vector is generated. Through the multi-dimensional feature dynamic fusion mechanism, the limitations of traditional single content features are broken through, multi-dimensional comprehensive evaluation is realized, and "abnormal access behavior under legal permission" can be identified, making up for the shortcomings of the permission control method.

[0070] S4.2: Calculate the context risk coefficient based on the context feature vector.

[0071] Preferably, the context risk coefficient is used to quantify the degree of abnormality of the current access scenario, and the calculation process is as follows: a user behavior baseline model is constructed based on historical access logs, which records the normal access patterns of users, including commonly used access time periods, commonly used access locations, commonly used access devices, and other statistical information. The deviation degree of the context feature vector of the current access request from the user behavior baseline is calculated, and the deviation degree can be calculated using Mahalanobis distance. When the deviation degree exceeds the deviation degree threshold, it is determined as an abnormal access scenario, and the context risk coefficient is increased. The deviation degree threshold is determined by statistical analysis of historical normal access samples. The abnormal access scenario includes but is not limited to: late-night access, out-of-place access, new device access, high-frequency access, etc.

[0072] Preferably, through the context risk coefficient, the system can identify "abnormal access behavior under legal permission". For example, an employee downloads data in large quantities at midnight before leaving the company, although the permission is legal, the access mode is abnormal, and the context risk coefficient will be significantly increased, triggering more stringent sensitivity evaluation.

[0073] S4.3: Combine the context risk coefficient, the blood relationship propagation sensitivity score, the fusion feature vector, and the graph embedding vector to generate a context-aware feature vector through dynamic weighting.

[0074] In one embodiment, dynamic weighting includes: calculating the fusion weight of the fusion feature vector and the graph embedding vector according to the context risk coefficient and the blood relationship propagation sensitivity score; when the context risk coefficient is high or the blood relationship propagation sensitivity score is high, the weight of the graph embedding vector is increased to strengthen the influence of blood relationship; when the context risk coefficient is low and the blood relationship propagation sensitivity score is low, the weight of the fusion feature vector is increased to highlight the data content features; the fusion vector is obtained by weighted fusion, and the context risk coefficient and the blood relationship propagation sensitivity score are spliced as additional dimensions to generate the context-aware feature vector.

[0075] S4.4: Input the context-aware feature vector into a dynamic decision neural network to generate a comprehensive sensitivity score and a sensitivity level probability distribution.

[0076] Specifically, the dynamic decision neural network adopts a multi-task learning architecture, including a shared feature extraction layer and two independent output branches. The shared feature extraction layer contains multiple fully connected layers and nonlinear activation functions, which are used to learn a deep representation of the context-aware feature vector. In the output layer, the regression branch outputs a comprehensive sensitivity score through a sigmoid activation function, with a value range of [0, 1], which is used to quantify the sensitivity of the data; the classification branch outputs a sensitivity level probability distribution through a softmax activation function, corresponding to the public, internal, sensitive, confidential, and top secret five levels, indicating the probability of the data belonging to each level. The confidence is calculated according to the maximum probability value of the sensitivity level probability distribution, and the higher the maximum probability, the higher the confidence.

[0077] In addition, the "dynamic" feature is reflected in that the network uses attention mechanisms or gating mechanisms inside, which can dynamically adjust the attention weight of different feature dimensions according to the risk information and blood-sensitive information in the input features, realizing adaptive decision-making.

[0078] S4.5: Based on the context risk coefficient and the sensitivity level probability distribution, the sensitivity label and the confidence are determined through a hierarchical decision mechanism to generate the sensitivity evaluation result.

[0079] It should be noted that the hierarchical decision mechanism includes coarse-grained judgment and fine-grained evaluation. The coarse-grained judgment quickly determines the sensitivity range based on the context risk coefficient, and the fine-grained evaluation accurately determines the final label based on the sensitivity level probability distribution. Specifically, when the context risk coefficient is lower than the safety threshold and the maximum probability value of the sensitivity level probability distribution corresponds to the public or internal level, a low sensitivity label is directly output; when the context risk coefficient exceeds the safety threshold or the maximum probability value of the sensitivity level probability distribution corresponds to the sensitive, confidential, or top secret level, fine-grained evaluation is performed in combination with the comprehensive sensitivity score to determine the final sensitivity label and confidence.

[0080] Preferably, through the hierarchical decision mechanism combining coarse-grained and fine-grained, the low-risk request is quickly responded and the high-risk request is accurately evaluated, which significantly improves the system throughput while ensuring the accuracy of the decision. Through the dynamic decision neural network of multi-task learning, the joint optimization output of sensitivity score and sensitivity level is realized, the decision strategy is adaptively adjusted according to the risk scenario, and the evaluation accuracy across scenarios is improved.

[0081] S5: According to the sensitivity evaluation result, generate and execute the access control policy, and trigger the cascading label evaluation along the blood knowledge graph for the downstream derived data; Specifically, step S5 includes: S5.1: Update the sensitivity label of the data object according to the sensitivity evaluation result, and record the label change history.

[0082] Specifically, the determined sensitivity label, the comprehensive sensitivity score and the confidence are obtained from the sensitivity evaluation result. The current label record of the data object in the label repository is queried, and whether the new label is consistent with the current label is compared. When the sensitivity label is different from the current label, the current label record is moved to the historical version table, and the historical version table contains the data object identification, the historical label, the effective start time, the effective end time and the change reason field; the label value, the update time and the version number of the current label record are updated. When the sensitivity label is the same as the current label, only the last confirmation time of the current label record is updated, and the label value remains unchanged.

[0083] S5.2: According to the sensitivity label, the corresponding access control policy template is queried, the data level access rule is generated and pushed to the access control gateway.

[0084] Further, according to the sensitivity label, the corresponding access control policy template is queried from the pre-defined policy template library, and the policy template includes the role set allowed to access, the operation type set allowed, the encryption requirement and the audit level. The data level access rule is generated based on the policy template, and the access rule includes the data object identification, the allowed role list, the allowed operation list, the encryption identification and the audit level. The access rule is pushed to the access control gateway, and the runtime policy cache of the access control gateway is updated.

[0085] It should be noted that when the sensitivity label is of a high sensitivity level, the data encryption service is triggered to perform encryption processing on the data content at the same time of generating the access rule.

[0086] S5.3: The downstream derivative data is identified along the blood relationship knowledge graph, and an asynchronous label re-evaluation task is triggered for the downstream derivative data and added to a re-evaluation queue.

[0087] Further, all out-edges with the current data node as the source node are queried in the blood relationship knowledge graph, and a set of downstream data nodes pointed by the out-edges is obtained. For each downstream node in the set of downstream data nodes, a label re-evaluation task is generated, and the re-evaluation task includes the downstream data object identification, the trigger reason, the upstream data identification, the upstream label value and the task priority. The re-evaluation task is added to the re-evaluation queue, and the re-evaluation queue is sorted according to the task priority and executes the re-evaluation asynchronously.

[0088] Further, when the sensitivity level of the upstream label changes by more than one level, the re-evaluation task is set to high priority; when the upstream label remains the same sensitivity level or changes by an adjacent level, it is set to normal priority.

[0089] Preferably, the persistence storage of sensitivity labels and the automatic push of access control policies are realized through the label cascade update and policy execution step. The consistency propagation of sensitivity labels in the data flow process is ensured by recognizing downstream derivative data and triggering cascade re-evaluation through the blood knowledge graph.

[0090] S6: Select samples for manual review based on confidence, and perform incremental learning update on model parameters according to review feedback.

[0091] In order to continuously improve the accuracy and adaptability of the data security management system, the present application designs an incremental learning mechanism based on artificial feedback. This mechanism selects low confidence samples for manual review through active learning strategy, and uses review feedback to gradually optimize model parameters, realizing continuous improvement of system performance, while avoiding the calculation cost and service interruption caused by full retraining.

[0092] Specifically, set a confidence threshold (such as 0.7), and submit samples below the confidence threshold for manual review. Accumulate the review samples within a certain time window (such as 24 hours) or quantity threshold (such as 100) to form a feedback sample set, each sample containing a data object, a system predicted label and a manual corrected label. Re-execute feature extraction on each data object in the feedback sample set to obtain fusion feature vector, graph embedding vector and blood propagation sensitivity score, and extract context feature vector of data access request if necessary, and construct training samples combined with manual corrected label.

[0093] Further, according to the sample distribution of sensitive level categories and the system prediction error, the training sample weight is calculated, so that the minority class samples and the prediction difficult samples have higher weight. A composite loss function is defined, which includes classification loss, regression loss and regularization term. Among them, the classification loss is used to optimize the prediction accuracy of the sensitivity level probability distribution, the regression loss is used to optimize the prediction accuracy of the comprehensive sensitivity score, and the regularization term is used to prevent overfitting. By setting the loss weight coefficient, the three losses are combined by weighting, so that the model is improved in both sensitivity level determination and sensitivity quantification scoring.

[0094] Further, an optimizer is used to perform incremental learning update on model parameters, and different learning rates are used for parameters of different levels: a smaller learning rate is used for fine-tuning of feature extraction related network, and a larger learning rate is used for dynamic decision neural network, so as to learn new patterns while maintaining the ability to judge historical data.

[0095] Further, the performance indicators of the updated model are evaluated on an independent validation set, and when the performance indicators are better than the current model, the updated model parameters are saved.

[0096] The embodiment also provides an AI-driven data security management system, a structural block diagram of which is shown in the figure. Figure 4 The system comprises: a data preprocessing module, configured to acquire a data object to be classified, identify a modal type, and process each modal content to generate an analysis result object; a cross-modal fusion module, configured to extract features from the analysis result object, map each modal feature vector to a unified semantic space through a semantic alignment mechanism, and calculate cross-modal interaction weights to generate a fusion feature vector; a blood relationship propagation module, configured to construct a blood relationship knowledge graph based on the fusion feature vector and a data operation log, perform graph embedding calculation on the blood relationship knowledge graph to obtain a graph embedding vector, and calculate a blood relationship propagation sensitivity score; a dynamic decision module, configured to extract a context feature vector of a data access request, combine the fusion feature vector, the graph embedding vector, and the blood relationship propagation sensitivity score, and generate a sensitivity evaluation result through a dynamic decision neural network; a policy execution module, configured to generate and execute an access control policy according to the sensitivity evaluation result, and trigger cascading label evaluation along a blood relationship knowledge graph for downstream derived data; a model optimization module, configured to select samples based on confidence for manual review, and perform incremental learning update on model parameters according to review feedback.

[0097] The embodiment also provides a computer device suitable for the AI-driven data security management method, comprising a memory and a processor; the memory is configured to store computer executable instructions, and the processor is configured to execute the computer executable instructions to implement the AI-driven data security management method proposed in the above embodiment.

[0098] The computer device can be a terminal, and the computer device comprises a processor, a memory, a communication interface, a display screen, and an input device connected through a system bus. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device comprises a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium to run. The communication interface of the computer device is configured to perform wired or wireless communication with external terminals. The wireless communication can be achieved through WIFI, an operator network, NFC (near field communication), or other technologies. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen. The input device of the computer device can be a touch layer overlaid on the display screen, or a key, trackball, or touchpad arranged on the shell of the computer device. The input device can also be an external keyboard, touchpad, or mouse, etc.

[0099] The embodiment also provides a storage medium on which a computer program is stored, the program being executed by a processor to implement the AI-driven data security management method proposed in the above embodiment; the storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as a static random access memory (SRAM), an electrically erasable programmable read-only memory (EEPROM), an erasable programmable read-only memory (EPROM), a programmable read-only memory (PROM), a read-only memory (ROM), a magnetic memory, a flash memory, a magnetic disk, or an optical disk.

[0100] To sum up, the application realizes the quantitative propagation and reasonable inheritance of the sensitivity attribute on the data derivation path by setting differentiated propagation weights according to the operation type and introducing a decay coefficient in the blood relationship knowledge graph, solves the technical problem that the prior art cannot track the change of the sensitive attribute in the data flow process. By calculating the context risk coefficient and dynamically adjusting the feature fusion weight and the decision strategy, the sensitivity determination can be adaptively adjusted according to the access scene, and the false positive rate and the false negative rate are reduced. Through the cascaded label reevaluation triggered by the blood relationship knowledge graph and the end-to-end incremental learning based on artificial feedback, the consistent propagation of the sensitivity label and the continuous optimization of the model parameters are realized, and the automation level and the accuracy of the data security management are improved.

[0101] It should be noted that the above embodiments are only used to illustrate the technical solutions of the application but not limit the application. Although the application has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the application can be modified or replaced equivalently without departing from the spirit and scope of the technical solutions of the application, and all of them should be covered in the scope of the claims of the application.

Claims

1. An AI-driven data security management method, characterized in that: include: Obtain the data object to be classified, identify the modality type, process the content of each modality, and generate the parsing result object; Feature extraction is performed on the parsed result object. The feature vectors of each modality are mapped to a unified semantic space through a semantic alignment mechanism, and cross-modal interaction weights are calculated to generate a fused feature vector. A bloodline knowledge graph is constructed based on the fused feature vector and data operation log. Graph embedding is performed on the bloodline knowledge graph to obtain graph embedding vectors, and bloodline propagation sensitivity scores are calculated. Extract the contextual feature vector of the data access request, combine it with the fusion feature vector, graph embedding vector and kinship propagation sensitivity score, and generate sensitivity assessment results through a dynamic decision neural network; Access control policies are generated and executed based on the sensitivity assessment results, while cascading label assessments are triggered on downstream derived data along the lineage knowledge graph. Samples are selected based on confidence levels and submitted for manual review. Incremental learning updates are performed on the model parameters based on the review feedback.

2. The AI-driven data security management method as described in claim 1, characterized in that: The generated parsing result object includes: Obtain the data objects to be classified, and determine the modality type based on the file format of the data objects; When the modality type is a mixed type, separate the modality content in the data object; Perform sensitive pattern pre-scanning on the content of each modality and extract the sensitive entity set of each modality; A cross-modal semantic consistency matrix is ​​constructed based on the set of sensitive entities. Sensitive patterns are determined based on cross-modal semantic similarity, and sensitive prediction labels are generated. Standardization processing is performed on each modality of content, and the parsing result object is generated by combining the sensitive prediction tags.

3. The AI-driven data security management method as described in claim 1, characterized in that: The generated fusion feature vector includes: Each modal content in the parsed result object is input into the corresponding pre-trained encoder, the feature vectors of each modality are extracted and normalized, and a multimodal feature set is constructed. The feature vectors of each modality in the multimodal feature set are projected to a unified dimension using a feature projection matrix to obtain the projected feature vectors. Construct a modality sequence matrix containing the projected feature vectors, and add modality position encoding; A sensitive region mask matrix is ​​constructed based on the sensitive prediction label, and the sensitive region mask matrix is ​​converted into an attention bias term; Multi-head self-attention is calculated based on the sensitive region bias term of the modality sequence matrix, and weighted average pooling is performed on the attention output matrix to generate a fused feature vector.

4. The AI-driven data security management method as described in claim 1, characterized in that: The construction of the kinship knowledge graph includes: Create nodes for data objects, use the fused feature vectors as node features, and add the nodes to the lineage knowledge graph; Extract the lineage relationships of data objects from the data operation logs, determine the propagation weights based on the operation types, create directed lineage edges, and add them to the lineage knowledge graph; A graph neural network is used to perform graph embedding calculations on the kinship knowledge graph to obtain the graph embedding vector of each node in the kinship knowledge graph; Bloodline paths are constructed based on directed bloodline edges in the bloodline knowledge graph, and bloodline propagation sensitivity scores are calculated along the bloodline paths.

5. The AI-driven data security management method as described in claim 1, characterized in that: The generation of sensitivity assessment results through a dynamic decision neural network includes: Extract multi-dimensional contextual features from data access requests and map them to a unified dimension to obtain a contextual feature vector; Calculate the context risk coefficient based on the context feature vector; By combining contextual risk coefficients, kinship transmission sensitivity scores, fused feature vectors, and graph embedding vectors, context-aware feature vectors are generated through dynamic weighting. The context-aware feature vector is input into a dynamic decision neural network to generate a comprehensive sensitivity score and a sensitivity level probability distribution. Based on the contextual risk coefficient and the probability distribution of sensitivity levels, a hierarchical decision-making mechanism is used to determine sensitivity labels and confidence levels, and generate sensitivity assessment results.

6. The AI-driven data security management method as described in claim 1, characterized in that: Generating and executing access control policies based on the sensitivity assessment results includes: Update the sensitivity labels of data objects based on the sensitivity assessment results, and record the label change history; Based on the sensitivity tags, query the corresponding access control policy templates, generate data-level access rules, and push them to the access control gateway; Identify downstream derived data along the kinship knowledge graph, trigger asynchronous label re-evaluation tasks for the downstream derived data, and add them to the re-evaluation queue.

7. The AI-driven data security management method as described in claim 1, characterized in that: The incremental learning update of model parameters based on review feedback includes: Calculate the training sample weights and define the composite loss function; An optimizer is used to perform incremental updates to the model parameters based on the composite loss function; Evaluate the performance metrics of the updated model on an independent validation set. If the performance metrics are better than the current model, save the updated model parameters.

8. An AI-driven data security management system, based on the AI-driven data security management method according to any one of claims 1 to 7, characterized in that: include: The data preprocessing module is used to acquire data objects to be classified, identify modality types, process the content of each modality, and generate parsing result objects. The cross-modal fusion module is used to extract features from the parsed result object, map the feature vectors of each modality to a unified semantic space through a semantic alignment mechanism, calculate the cross-modal interaction weights, and generate a fused feature vector. The bloodline propagation module is used to construct a bloodline knowledge graph based on the fused feature vector and data operation log, perform graph embedding calculation on the bloodline knowledge graph to obtain a graph embedding vector, and calculate the bloodline propagation sensitivity score. The dynamic decision module is used to extract the context feature vector of the data access request, and combine it with the fusion feature vector, graph embedding vector and kinship transmission sensitivity score to generate sensitivity assessment results through the dynamic decision neural network; The policy execution module is used to generate and execute access control policies based on the sensitivity assessment results, and simultaneously trigger cascading label assessments for downstream derived data along the lineage knowledge graph. The model optimization module is used to select samples based on confidence level for submission to manual review, and to perform incremental learning updates on the model parameters based on the review feedback.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, it implements the steps of the AI-driven data security management method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, it implements the steps of the AI-driven data security management method according to any one of claims 1 to 7.

Images