Data security control method and system

Abstract

The invention relates to the technical field of computer information security, discloses a data security management and control method and system, and aims to solve the problems of security protection blind areas and response lag caused by management and control system splitting, strategy staticizing, passive risk identification and unclear sensitive data base number in the prior art. The method comprises the steps that a plurality of heterogeneous data sources are connected, operation logs and metadata are collected in real time, and a unified data blood relationship map representing data assets, user entities and processing activity circulation relations is constructed; when a data access request is received, multi-dimensional security features of a user behavior baseline, data sensitivity, and operating environment context are extracted. According to the scheme, panoramic tracking of cross-system data flow and risk assessment of context awareness are achieved, the recognition capability of abnormal behaviors is improved, accurate calculation of risk propagation is supported, automatic gradient response of security strategies is achieved, and service flexibility is considered while data security is guaranteed.

Description

Technical Field

[0001] This invention belongs to the field of computer information security technology, specifically relating to a data security management method and system. Background Technology

[0002] In the wave of digital transformation, data has become a core strategic asset driving enterprise innovation and development. The generation, flow, and application of massive amounts of data have profoundly changed business models and the way society operates. At the same time, the importance of data security has become increasingly prominent, serving as the cornerstone for ensuring the healthy and stable development of the digital economy.

[0003] Data security management refers to the process of classifying, grading, controlling access, monitoring risks, and auditing data throughout its entire lifecycle using a series of technical means and management strategies to ensure its confidentiality, integrity, and availability. Its goal is to build a comprehensive, dynamic, and intelligent security protection system.

[0004] Existing technologies for data security management suffer from the following shortcomings: First, the management system is fragmented, with different security tools operating independently, lacking a unified data perspective and policy coordination, resulting in blind spots and weaknesses in the protection system. Second, management strategies are static, relying mainly on manually preset rules, making it difficult to adapt to rapid business changes and the dynamic evolution of new threats, leading to delayed responses. Third, risk identification capabilities are passive, mostly issuing alerts and tracing after security incidents occur, lacking real-time perception and proactive prediction capabilities for abnormal data behavior. Finally, the data asset baseline is unclear, and the ability to identify sensitive information in massive amounts of unstructured data is insufficient, resulting in inaccurate application of security policies. These problems collectively lead to severe data breach risks and compliance challenges for enterprises, urgently requiring a more intelligent and integrated data security management solution. Summary of the Invention

[0005] The purpose of this invention is to overcome the shortcomings of existing technologies by providing a data security management method and system that can effectively solve the problems described in the background. Existing data security management systems generally rely on static, pre-configured access control rules and isolated monitoring mechanisms. This approach cannot dynamically adapt to real-time changes in user behavior, data context, and operating environment. Therefore, existing technologies struggle to accurately assess the real-time risks associated with data access requests, leading to an inherent structural contradiction between ensuring data security and maintaining operational flexibility. Furthermore, the lack of unified data lineage tracing capabilities across heterogeneous systems makes comprehensive risk tracing and auditing of sensitive data throughout its entire lifecycle extremely difficult, resulting in serious security vulnerabilities and compliance challenges.

[0006] To achieve the above objectives, the present invention provides the following technical solution: In one aspect, a data security management and control system, comprising the following components: The data acquisition and lineage construction module is used to connect to multiple heterogeneous data sources within the enterprise, collect data operation logs and metadata in real time, and construct a unified data lineage graph that represents the flow relationship between data assets, user entities and data processing activities by parsing, associating and aggregating the logs and metadata. The multidimensional feature extraction module is used to extract multidimensional security features associated with a data access request based on historical data and current request information when a data access request is received. The multidimensional security features include user behavior baseline features, data sensitivity features, and operating environment context features. The dynamic risk quantification module is used to take the unified data lineage graph as topological input and integrate the multi-dimensional security features as attribute input for nodes and edges. It performs real-time, end-to-end risk propagation and aggregation calculation on the current data access request through a preset graph neural network model, thereby outputting a real-time risk score that quantifies the security risk of the request. The adaptive policy execution module is used to dynamically decide and generate an adaptive security management policy that matches the risk level from a predefined policy library containing multiple security control levels, based on the real-time risk score output by the dynamic risk quantification module, and to implement precise access control on the data access request through the policy execution point.

[0007] On the other hand, a data security management method includes the following specific steps: Step S110: Connect to multiple heterogeneous data sources, collect data operation logs and metadata in real time, and construct a unified data lineage map based on the logs and metadata to represent the flow relationship between data assets, user entities and data processing activities. Step S120: When a data access request is received, extract the multi-dimensional security features associated with the request. The multi-dimensional security features include user behavior baseline features, data sensitivity features, and operating environment context features. Step S130: Based on the unified data lineage map and the multidimensional security features, a graph neural network model is used to dynamically quantify the risk of the data access request and generate a real-time risk score. Step S140: Based on the real-time risk score, dynamically generate an adaptive security control strategy and execute the strategy to control the data access request.

[0008] Preferably, the data acquisition and lineage building module is specifically used to: retrieve structured and unstructured operation logs from relational databases, non-relational databases, data warehouses, data lakes, file storage systems, and application services through acquisition agents deployed on each data source side or through standard protocol interfaces (e.g., database connection drivers, application programming interfaces). The operation logs at least include the operation subject, operation object, operation type, operation timestamp, source network address, and execution status information.

[0009] Furthermore, when constructing a unified data lineage graph, the data acquisition and lineage construction module specifically operates as follows: defining data assets (e.g., database tables, files, message queue topics), user accounts, service accounts, and applications as nodes in the graph; defining operations such as data access, data copying, data transformation, and data export as directed edges connecting nodes; using information such as operation type, data volume, and timestamp as attributes of the edges; and using metadata information of data assets (e.g., data classification and data tags) as attributes of the nodes, thereby forming a dynamically updated, weighted directed acyclic graph.

[0010] Furthermore, the unified data lineage graph is updated via real-time streaming processing. The data acquisition and lineage construction module integrates a streaming computing engine, which processes the acquired incremental log data as an event stream, parses the event content in real time, and converts it into incremental changes to nodes or edges in the graph, ensuring that the graph state and the actual data flow state remain synchronized within a second-level delay.

[0011] Preferably, when extracting baseline features of user behavior, the multi-dimensional feature extraction module specifically operates as follows: for each user entity, based on its historical data access logs for at least 90 days, it statistically models its regular behavioral patterns across multiple dimensions. These dimensions include the distribution of access time periods, access geographic location aggregation points, fingerprints of commonly used client devices, the distribution of the type and sensitivity of accessed data objects, the frequency ratio of data operation types (create, delete, modify, query), and the complexity pattern of data query statements. The module employs unsupervised learning algorithms (e.g., Isolation Forest or Single-Class Support Vector Machine) to construct a multi-dimensional normal behavioral profile model for each user.

[0012] Furthermore, when processing the current data access request, the multidimensional feature extraction module compares the corresponding dimension feature value of the current request with the user's normal behavior profile model to calculate a deviation score. After normalization, this deviation score serves as a key component of the user's behavior baseline features; a high score indicates a significant anomaly between the current behavior and the historical baseline.

[0013] Preferably, when extracting data sensitivity features, the multi-dimensional feature extraction module specifically operates as follows: it integrates a data content awareness and classification submodule. This submodule automatically scans and identifies sensitive data such as personal identification information, financial information, and intellectual property in the data asset content through regular expression matching, keyword database matching, and a pre-trained natural language processing model. Based on the identification results and a preset sensitivity grading standard (e.g., divided into four levels: public, internal, secret, and top secret), a static sensitivity grade score is assigned to each data asset node.

[0014] Furthermore, the data sensitivity feature includes a dynamic sensitivity adjustment factor. This factor is dynamically adjusted based on the data asset's position in the lineage graph and the frequency with which it is accessed by high-risk users or exhibits abnormal behavior, reflecting the temporary increase in risk to the data due to its context.

[0015] Preferably, when extracting operational environment context features, the multi-dimensional feature extraction module includes: the reputation of the source IP address initiating the request (obtained by comparison with a threat intelligence database), the security compliance status of the terminal device (obtained through linkage with a mobile device management system or terminal detection and response system), the network connection type (internal network, virtual private network, public network), whether the access occurred during a non-working time window, and known vulnerability information of the application service carrying the data access. These features together constitute a comprehensive assessment of the environmental risk of a single access operation.

[0016] Preferably, the graph neural network model used in the dynamic risk quantification module is a graph attention network model. This model can utilize a self-attention mechanism to dynamically assign different attention weights to neighboring nodes in the data lineage graph during risk calculation. This mechanism gives higher influence to nodes that are directly or indirectly related to the current access request and have historically higher risks (e.g., data assets that have been accessed by abnormal behavior or users with abnormal behavior) in risk aggregation calculation, thereby improving the accuracy and context awareness of risk assessment.

[0017] Furthermore, the calculation process of the dynamic risk quantification module is as follows: the user behavior baseline features, data sensitivity features, and operating environment context features output by the multi-dimensional feature extraction module are vectorized and used as the initial feature embedding of the corresponding nodes (user nodes, data asset nodes) in the graph; the graph attention network model, through multi-layer information propagation and aggregation, weightedly fuses the node's own features with the features of its neighboring nodes to generate a high-level risk representation that can characterize the current access request in the global data flow environment; finally, the high-level risk representation is decoded into a continuous real-time risk score between 0 and 1 through a fully connected layer network.

[0018] Preferably, the policy library in the adaptive policy execution module includes a set of predefined, tiered control policies corresponding to risk score ranges. For example, a risk score between 0.0 and 0.2 corresponds to an "allow" policy; a risk score between 0.2 and 0.4 corresponds to an "allow and record audit logs" policy; a risk score between 0.4 and 0.7 corresponds to a "require multi-factor authentication" policy; a risk score between 0.7 and 0.9 corresponds to a "dynamically de-identify or mask the returned data" policy; and a risk score higher than 0.9 corresponds to a "directly deny access and trigger a security alarm" policy.

[0019] Furthermore, the adaptive policy enforcement module implements control by communicating with policy enforcement points deployed on the data access link. These policy enforcement points can be database firewalls, API gateways, proxies in service meshes, or data access middleware. The adaptive policy enforcement module sends specific control instructions (e.g., refusing connections, redirecting to an authentication page, applying de-identification rules to query result sets) to the corresponding policy enforcement points, enabling them to intervene in the data flow in real time.

[0020] Compared with the prior art, the present invention has the following beneficial effects: By constructing a unified data lineage map, this invention enables panoramic and refined tracking of data flow across heterogeneous systems, solving the problems of fragmented security monitoring perspectives and difficulty in conducting comprehensive risk tracing in existing technologies, and providing a solid data foundation for context-aware risk assessment.

[0021] This invention introduces a comprehensive analysis of features from three dimensions: user behavior, data sensitivity, and operating environment. It also utilizes unsupervised learning to establish a baseline of user behavior, enabling a deep profile of access requests. Compared to traditional access control based on static rules, it can identify potential internal threats and abnormal access behaviors earlier and more accurately.

[0022] By using a graph neural network model to dynamically quantify the risk of data lineage graphs, the spread and accumulation effects of risks in the data flow chain can be effectively captured, realizing an upgrade from "point" defense to "surface" defense, and greatly improving the ability to identify complex, multi-stage attack patterns.

[0023] This invention combines real-time risk scores with a gradient-based adaptive strategy to achieve dynamic adjustment and automated execution of security control measures. While ensuring that high-risk operations are effectively blocked, the impact on normal business operations is minimized, thus achieving an effective balance between data security and business agility. Attached Figure Description

[0024] Figure 1This is a schematic diagram of the overall technical solution architecture of the present invention; Figure 2 This is a schematic diagram of the core principle framework of dynamic risk quantification based on graph neural networks in this invention. Detailed Implementation

[0025] To further illustrate the technical means and effects of the present invention in achieving its intended purpose, the following detailed description of the specific implementation methods, structures, features, and effects of the present invention, in conjunction with the accompanying drawings and preferred embodiments, is provided below.

[0026] Example 1 This embodiment is applied to the complex IT environment of a large multinational financial holding group. The group's business covers multiple areas including commercial banking, investment banking, and asset management. Its data infrastructure consists of local systems located in data centers in different regions and multiple public cloud platforms, forming a typical hybrid cloud heterogeneous data environment. This environment faces multiple data security challenges, including internal employee misoperation, malicious attacks, and external advanced persistent threats. The data security management system described in this invention is deployed in the group's central security operations center, aiming to provide dynamic, intelligent, and unified security protection for sensitive customer data and transaction data in its core business systems.

[0027] Reference Figure 1 and Figure 2 The data security management system of this invention includes a data acquisition and lineage construction module, a multi-dimensional feature extraction module, a dynamic risk quantification module, and an adaptive strategy execution module. The specific operation flow and method steps S110 to S140 of this system are closely corresponding.

[0028] First, step S110 is executed, initiating a comprehensive data acquisition and lineage construction process by the data acquisition and lineage building module. This module utilizes lightweight acquisition agents deployed across various heterogeneous data sources and standardized protocol interfaces to achieve real-time, non-intrusive acquisition of massive data operation logs and metadata within the group. Specifically, for the group's core IBM DB2-based relational database cluster, the acquisition agent monitors the network traffic of the database instances and parses the database communication protocols to capture the execution records of all Structured Query Language (SCL) commands. For the MongoDB non-relational database used in the customer relationship management system, the acquisition agent subscribes to its operation log (oplog) to obtain real-time CRUD operation records. For the data warehouse and data lake built on a public cloud platform, the module calls the cloud service provider's application programming interface (API) to obtain access logs for data warehouse tables and object storage buckets. For file servers distributed across various business departments, the acquisition agent records file creation, reading, modification, and deletion operations by mounting file system drivers or monitoring operating system kernel events.

[0029] All collected raw operation logs were standardized into a unified JSON format. Each log record precisely included the operation subject (e.g., employee ID, service account identifier), operation object (e.g., fully qualified name of database table, absolute path of file), operation type (e.g., SELECT, INSERT, UPDATE, DELETE, READ, WRITE), operation timestamp accurate to milliseconds, source network address of the request, operation execution result status code, and the amount of data affected by the operation.

[0030] After data acquisition is completed, the core task of the data acquisition and lineage construction module is to build and maintain a unified data lineage graph. This graph is a dynamically updated, weighted directed acyclic graph, and its construction process is as follows: First, all identifiable data assets within the group (e.g., every table in DB2, every collection in MongoDB, every partition in the data lake, every directory on the file server), all user accounts (including employee accounts and outsourced personnel accounts), all service accounts, and all applications that perform data processing (e.g., batch processing ETL jobs and online analytical processing reporting services) are defined as nodes in the graph. Each type of node contains rich attribute information. For example, data asset nodes contain metadata such as their data classification (e.g., customer personal information, transaction records) and data tags (e.g., internal public, confidential); user nodes contain organizational structure information such as their department, position, and security level.

[0031] Secondly, data manipulation behaviors are defined as directed edges connecting the aforementioned nodes. For example, when a user performs a database query, a directed edge of type "data access" is created between the user node and the queried database table node; when an ETL job extracts data from one database table and loads it into another data warehouse table, a directed edge of type "data transformation" is created between these two data asset nodes, and the service node of the ETL job is associated as an attribute of this edge. The edge attributes record detailed information about the operation, such as the operation type, the timestamp of the operation, and the amount of data transferred or processed.

[0032] To ensure the real-time nature of the lineage graph, this module integrates a high-performance streaming engine, such as Apache Flink. Incremental log data is continuously pushed to a message queue middleware (such as Apache Kafka), forming an event stream. The streaming engine subscribes to this event stream, parses each log event in real time, and instantly converts it into incremental change operations on the graph (e.g., creating new nodes, creating new edges, or updating the attributes of existing nodes and edges). The entire update process is designed to complete within sub-second latency, ensuring that the state of the data lineage graph remains highly synchronized with the actual data flow in the physical world.

[0033] Next, step S120 is executed. When the system's data access control point (e.g., an agent deployed at the front end of the database) intercepts a new data access request, such as an investment analyst attempting to access a database table storing a large number of customer transaction records through a data analysis tool, the multidimensional feature extraction module is immediately activated to extract multidimensional security features around the request.

[0034] The first dimension is the baseline features of user behavior. The multidimensional feature extraction module, for each individual user entity, uses statistical methods and unsupervised machine learning algorithms to construct a refined multidimensional profile model of normal behavior based on all historical data access logs of the past 90 days. The specific modeling dimensions include: 1. Access time period distribution, for example, the analyst's access behavior is highly concentrated between 9 AM and 6 PM on weekdays; 2. Access geographic location aggregation points, 99% of the source IP addresses of his access requests belong to the company's office network IP segment in Shanghai; 3. Commonly used client device fingerprints, the analyst usually uses a specific model of laptop provided by his company for access, and the operating system version, browser type, and other information of this device constitute a stable device fingerprint; 4. Distribution of accessed data object types and sensitivity, his historical access objects are mainly concentrated on data assets marked as "market information" and "research reports", and he rarely touches highly sensitive data such as "customer personal identification information"; 5. Frequency ratio of data operation types, SELECT query operations account for more than 99% of his operations, and INSERT, UPDATE, DELETE and other write operations are almost zero; 6. Complexity pattern of data query statements, the abstract syntax tree depth of his query statements is usually less than 10, and the number of related tables does not exceed 3. The module uses the isolated forest algorithm to train a model that can define the boundaries of the user's normal behavior based on the above multi-dimensional features. When processing a current data access request, the module inputs various feature values ​​of the current request into the model, and the model outputs an anomaly deviation score. For example, if the current request is initiated at 3:00 AM, the source IP address comes from an unknown public network, and the query attempts to access a highly sensitive customer identity information table, the deviation score will be calculated as a high value close to 1.0. Conversely, for regular requests that match historical behavior patterns, the score will be close to 0.0.

[0035] The second dimension is data sensitivity features. This module integrates a data content awareness and classification submodule. This submodule utilizes a regular expression library (for matching formatted sensitive information such as ID card numbers, bank card numbers, and mobile phone numbers), a keyword library (for matching sensitive words such as "contract" and "financial statements"), and a pre-trained natural language processing model (for understanding semantic sensitivity in unstructured text) to periodically perform deep scanning and intelligent classification of the content of all data assets within the group. Based on the scanning results and the group's internal data security classification standards (divided into four levels: public, internal, secret, and top secret), a static sensitivity level score is assigned to each data asset node in the lineage graph. In addition, the data sensitivity features also include a dynamic sensitivity adjustment factor. This factor is not fixed but dynamically calculated based on the data asset's topological position in the lineage graph and its context. For example, if a data asset is frequently accessed by many high-privilege users, or if it is a key data source for generating the group's core financial statements, its dynamic sensitivity adjustment factor will increase accordingly, so that its final sensitivity feature value can more accurately reflect its current business value and potential risks.

[0036] The third dimension is the contextual characteristics of the operating environment. This module, through collaboration with other security systems and services, obtains rich contextual information about the environment in which the current access request takes place. These characteristics include: 1. The credibility of the source IP address initiating the request, determined by real-time queries of third-party threat intelligence databases to determine whether the IP is associated with botnets, malicious scanning, or other activities; 2. The security compliance status of the endpoint device, obtained through integration with the group's endpoint detection and response system to determine whether the requesting device has the latest security patches installed, whether the antivirus software's virus database is up-to-date, and whether any known malware processes exist; 3. The network connection type, determining whether the connection is through the company's trusted internal network, a securely encrypted virtual private network, or directly through the untrusted public internet; 4. Whether the access occurred within a predefined non-working time window (e.g., holidays or late at night); 5. Whether the application service carrying this data access itself has any known, unpatched security vulnerabilities. All these environmental characteristics are quantified and combined to form a comprehensive assessment of the environmental risks of a single access operation.

[0037] Subsequently, step S130 is executed. Based on the unified data lineage graph constructed in the previous steps and the extracted multi-dimensional security features, the dynamic risk quantification module performs real-time, end-to-end dynamic risk quantification on the current data access request. The core of this module employs an advanced graph neural network model, specifically a graph attention network model. The unique feature of this model is its use of a self-attention mechanism, which dynamically and unequally allocates attention weights to the neighboring nodes of a node in the data lineage graph during risk calculation.

[0038] The specific calculation process is as follows: First, the user behavior baseline features (deviation score), data sensitivity features (comprehensive score), and operational environment context features (comprehensive risk score) output by the multi-dimensional feature extraction module are vectorized and used as the initial feature embedding vectors for the nodes directly related to the current request in the graph (i.e., the user node initiating the request and the data asset node being accessed). Next, the graph attention network model begins multi-layer information propagation and aggregation operations. In each layer, for each node in the graph, the model calculates the attention coefficient between it and all its neighboring nodes. This coefficient determines the weight that each neighboring node's features should be assigned when aggregating neighbor information.

[0039] For example, when assessing the risk of an analyst accessing client trading data, if the lineage graph shows that the client's trading data table was recently accessed by another user account with unusual behavior, or has a data transfer relationship with a known, leaked data asset, then the graph attention mechanism will give these historically higher-risk associated nodes a greater influence in the risk aggregation calculation. Its core attention coefficient calculation formula is: in, It is a node For nodes Attention coefficient and It is the feature vector of the node. It is a shared linear transformation weight matrix. It is the weight vector of a single-layer feedforward neural network. It is a node The set of neighboring nodes, , The node feature vector after linear transformation is the encoded representation of the original features. This means concatenating two vectors into a longer vector, which is then used as input to the attention mechanism. This allows the model to consider information from both nodes simultaneously. Calculate a linear combination of attention scores; the result is a scalar representing the node. and The strength of the correlation between them Activation function, introducing nonlinearity. An exponential function is used to construct the numerator of the softmax function, ensuring that the attention weights are positive. For nodes All neighbors Normalization is performed to ensure that the sum of all attention weights is 1. Through this mechanism, the model can intelligently identify the most critical risk indicators in the global data flow environment and effectively propagate their impact to the currently evaluated access request. After multiple layers of such information propagation and weighted aggregation, the model generates a high-level risk representation vector for the current access request, which deeply characterizes its role in the global data flow environment. Finally, this high-level risk representation vector is fed into a fully connected neural network, which decodes it into a continuous real-time risk score between 0 and 1 using a sigmoid activation function. The higher the score, the greater the security risk inherent in the data access request.

[0040] Finally, in step S140, the adaptive strategy execution module makes dynamic strategy decisions and executes based on the real-time risk score output by the dynamic risk quantification module. This module internally maintains a predefined, gradient-based control strategy library that strictly corresponds to risk score ranges. This strategy library is designed to achieve the optimal balance between risk and business convenience. Here is a specific example of a policy library definition: Risk scores between 0.0 and 0.2 are considered completely normal business operations, corresponding to the "unconditional allow" policy; risk scores between 0.2 and 0.4 are considered low-risk operations, corresponding to the "allow access but require detailed audit logs for subsequent review" policy; risk scores between 0.4 and 0.7 are considered medium-risk operations, and the system will automatically trigger a two-factor authentication process, corresponding to the "require users to perform multi-factor authentication via mobile SMS verification code or biometrics" policy; risk scores between 0.7 and 0.9 are considered high-risk operations, corresponding to the "allow access, but dynamically anonymize or mask the returned data" policy, for example, replacing sensitive fields such as ID card numbers and bank card numbers in the returned result set with asterisks; risk scores above 0.9 are considered extremely high-risk malicious behavior, corresponding to the "directly reject this access request and immediately trigger a high-priority security alert" policy.

[0041] The adaptive policy enforcement module implements control by communicating in real-time, with low latency, with policy enforcement points deployed at key nodes in the group's data access chain. These policy enforcement points are the components that actually execute access control actions, and they take various forms, such as database firewalls deployed in front of database servers, API gateways in microservice architectures, sidecar proxies in service meshes, or secure access middleware integrated into application code. In this embodiment, when the module generates a specific control instruction, for example, for the access request with a risk score of 0.92, the generated instruction is "deny connection and issue an alert." The module immediately sends this instruction to the database firewall responsible for protecting the target database through a secure management interface in the form of a structured message (such as JSON or gRPC). Upon receiving the instruction, the database firewall immediately adds a temporary rule to its access control rules, blocking any connection from the analyst's source IP address to the target database within a specified time window (e.g., the next 30 minutes). Simultaneously, a detailed alert event containing all risk context information (user, access object, time, risk score, key risk characteristics, etc.) will be pushed to the group's security information and incident management platform, notifying the security operations team to conduct manual intervention and in-depth investigation. In this way, the system achieves closed-loop automated control from risk perception to policy response.

[0042] Example 2 This example is set in a rapidly growing internet technology company that builds its business platform entirely on a public cloud-native technology stack. Its core architecture is designed around containerization and microservices. In this environment, data access primarily occurs not through traditional direct database connections, but through well-defined application programming interfaces (APIs). Data storage is also more diverse, including numerous NoSQL databases, distributed message queues, and object storage services. The company's primary security concern is protecting its massive user data from misuse and ensuring the confidentiality of its core algorithms and business logic.

[0043] In this embodiment, the overall architecture of the data security management system remains consistent with that of Embodiment 1, but different technical approaches are adopted in the specific technical implementation of some modules to better adapt to the characteristics of the cloud-native environment.

[0044] Step S110: The data acquisition and lineage building module is adapted for cloud-native environments. Data acquisition no longer relies on installing agents on virtual machines or physical machines, but is achieved through deep integration with the cloud-native ecosystem. Specifically, for microservices running in Kubernetes clusters, this module utilizes the traffic mirroring function of service meshes (such as Istio) to capture API call traffic between all services and parse out the data interaction information. For message queues (such as Apache Kafka), the module subscribes to all business topics by deploying a consumer client, thereby recording the message production and consumption relationships. For object storage services (such as Amazon S3), server-side access logging is enabled, and logs are imported into a central log analysis system in real time. After the collected log data is parsed, it is also used to build a unified data lineage graph. The node types in the graph are correspondingly expanded to users, microservices, API endpoints, message queue topics, object buckets, etc., and the edges represent data flow relationships such as API calls, message publishing / subscription, and file upload / download.

[0045] In step S120, the multi-dimensional feature extraction module employs a different unsupervised learning algorithm than Example 1—One-Class Support Vector Machine (SVM)—when extracting baseline features of user behavior. The core idea of ​​this algorithm is to find a minimum hypersphere or hyperplane in the high-dimensional feature space that encompasses the vast majority of normal data points. For each development engineer in the company, the module extracts feature vectors based on their historical API call logs, including the frequency distribution of API endpoint calls, the combination patterns of HTTP request methods, the data structure and size of request loads, and call time series patterns. These historical feature vectors are used to train a dedicated One-Class Support Vector Machine model. When a new API call request arrives, the module extracts its corresponding feature vector and determines whether the vector lies within the pre-trained normal behavior boundary. If a feature vector falls outside the boundary, it is considered abnormal, and its distance to the boundary is calculated as a deviation score. Compared to Isolation Forest, One-Class Support Vector Machine exhibits unique advantages in processing high-dimensional sparse data and is more suitable for analyzing complex API call behavior patterns.

[0046] In step S130, the dynamic risk quantification module employs another mainstream graph neural network model—Graph Convolutional Network (GCN)—when calculating risk. Unlike graph attention networks, GCN uses the same weights (usually normalized weights based on node degree) for all neighbor nodes when aggregating neighbor node information. Its core idea for information propagation is to perform local averaging of features. Its single-layer propagation rule can be simplified as follows: in, It is an adjacency matrix with self-loops added. It is the original adjacency matrix. It is an identity matrix, representing that each node is connected to itself (self-loop), ensuring that the node's own characteristics are also preserved. yes The degree matrix, It is the first The node feature matrix of the layer, It is the trainable weight matrix of this layer. Activation functions, typically ReLU or other nonlinear functions, introduce nonlinear expressiveness and enhance model fitting ability. Although graph convolutional networks cannot assign different importance to different neighbors like graph attention networks, they are more computationally efficient. For scenarios with relatively homogeneous risk propagation patterns, they can achieve effective risk quantification at a lower computational cost. In this embodiment, the model also receives multidimensional features as input, performs multi-layer graph convolution operations, and finally outputs a quantified real-time risk score.

[0047] Step S140: The policy execution point of the adaptive policy execution module is tightly integrated with the cloud-native architecture. In this embodiment, the main policy execution points are the API gateway deployed at the traffic inlet and the sidecar proxy (e.g., Envoy) integrated in the service mesh. Assume an API call request from a development engineer is assessed as medium-high risk by the dynamic risk quantification module, with a risk score of 0.78. The adaptive policy execution module queries the policy library and matches a policy that "requires multi-factor authentication and dynamically masks the returned data." The module first marks the user's current session with a state requiring MFA verification by calling the identity authentication service API. When the API gateway processes the user's next request, it detects this state and automatically redirects the request to the multi-factor authentication page. After the user completes authentication, the request is allowed to proceed to the backend microservice. When the microservice generates response data, it is intercepted by the sidecar proxy in the service mesh on its way back to the user. The adaptive policy execution module has issued a specific masking rule (e.g., a regular expression for identifying and replacing the user's email address) to the sidecar proxy. According to this rule, the sidecar proxy processes the JSON payload of the response in real time, replacing sensitive field values ​​with masks, and then returns the processed data to the API gateway and the end user. This execution method based on the API gateway and service mesh does not require any modification to the code of the business microservices, achieving complete decoupling between security control and business logic, demonstrating the high adaptability and flexibility of this invention in modern cloud-native application scenarios.

[0048] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any simple modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. A data security management and control method, characterized in that, Includes the following steps: Connect to multiple heterogeneous data sources, collect data operation logs and metadata in real time, and construct a unified data lineage map that represents the flow relationship between data assets, user entities and data processing activities by parsing, associating and aggregating the data operation logs and metadata. When a data access request is received, based on historical data operation logs and metadata and current request information, multi-dimensional security features associated with the data access request are extracted. These multi-dimensional security features include user behavior baseline features, data sensitivity features, and operating environment context features. Using the unified data lineage graph as topological input and integrating the multidimensional security features as attribute input for nodes and edges, a preset graph neural network model is used to perform real-time, end-to-end risk propagation and aggregation calculation on the current data access request, thereby outputting a real-time risk score that quantifies the security risk of the data access request. Based on the real-time risk score output by the graph neural network model, a dynamic decision is made from a predefined policy library containing multiple security control levels to generate an adaptive security management policy that matches the risk level, and access control is implemented on the data access request through the policy execution point.

2. The method according to claim 1, characterized in that, The specific steps for constructing a unified data lineage map include: The data assets, user accounts, service accounts, and applications are defined as nodes in the unified data lineage graph; Data access, data copying, data transformation, and data export operations are defined as directed edges connecting the nodes. The operation type, data volume, and timestamp information are used as attributes of the directed edge; The metadata information of the data assets is used as the attribute of the node, thereby forming a dynamically updated weighted directed acyclic graph.

3. The method according to claim 1, characterized in that, The specific steps for extracting baseline features of user behavior include: For each user entity, based on its historical data access logs, we statistically analyze and model its regular behavior patterns across multiple dimensions, including access time period distribution, access geographic location aggregation points, fingerprints of commonly used client devices, distribution of the type and sensitivity of accessed data objects, frequency ratio of data operation types, and complexity patterns of data query statements. An unsupervised learning algorithm is used to construct a multi-dimensional normal behavior profile model for each user entity; When processing the current data access request, the corresponding dimension feature value of the current request is compared with the normal behavior profile model of the user entity to calculate a deviation score, and the deviation score is used as a component of the user behavior baseline feature.

4. The method according to claim 1, characterized in that, The specific steps for extracting data sensitivity features include: By using regular expression matching, keyword database matching, and pre-trained natural language processing models, sensitive data in data asset content can be automatically scanned and identified. Based on the identification results and the preset sensitivity grading standards, a static sensitivity level score is assigned to each data asset node; The data sensitivity feature also includes a dynamic sensitivity adjustment factor, which is dynamically adjusted based on the position of the data asset in the unified data lineage map and the frequency with which it is accessed by high-risk users or abnormal behaviors.

5. The method according to claim 1, characterized in that, The specific steps for extracting operational context features include: Obtain the reputation of the source network address that initiated the data access request; Obtain the security and compliance status of the terminal device that initiated the data access request; Obtain the network connection type that initiated the data access request; Determine whether the data access request occurred within a non-working time window; Obtain known vulnerability information of the application service that carries the data access.

6. The method according to claim 1, characterized in that, The graph neural network model is a graph attention network model; The graph attention network model utilizes a self-attention mechanism to dynamically assign different attention weights to neighboring nodes in the unified data lineage graph during risk calculation, thereby giving higher influence to nodes that are historically at higher risk and are associated with the current data access request in risk aggregation calculation.

7. The method according to claim 6, characterized in that, The specific steps for risk aggregation calculation using the graph attention network model include: The user behavior baseline features, the data sensitivity features, and the operating environment context features are vectorized and used as the initial feature embedding for the corresponding nodes in the unified data lineage graph. The graph attention network model, through multi-layer information propagation and aggregation, weightedly fuses the features of a node itself with the features of its neighboring nodes to generate a high-level risk representation of the current data access request in the global data flow environment. The advanced risk representation is decoded into a continuous real-time risk score through a fully connected layer network.

8. The method according to claim 1, characterized in that, The strategy library contains a set of predefined, gradient-based management strategies corresponding to the real-time risk score range; The tiered control strategy includes an allow strategy, an allow and log audit strategy, a multi-factor authentication strategy, a dynamic desensitization or masking strategy for returned data, and a denial of access and triggering security alerts strategy.

9. A control system applied to the data security control method according to any one of claims 1-8, characterized in that, include: The data acquisition and lineage construction module is used to connect to multiple heterogeneous data sources, collect data operation logs and metadata in real time, and construct a unified data lineage map that represents the flow relationship between data assets, user entities and data processing activities by parsing, associating and aggregating the data operation logs and metadata. The multidimensional feature extraction module is used to extract multidimensional security features associated with the data access request based on historical data and current request information when a data access request is received. The multidimensional security features include user behavior baseline features, data sensitivity features, and operating environment context features. The dynamic risk quantification module is used to take the unified data lineage graph as topological input and integrate the multi-dimensional security features as attribute input for nodes and edges. Through a preset graph neural network model, it performs real-time, end-to-end risk propagation and aggregation calculation on the current data access request, thereby outputting a real-time risk score that quantifies the security risk of the data access request. The adaptive policy execution module is used to dynamically decide and generate an adaptive security management policy that matches the risk level from a predefined policy library containing multiple security control levels, based on the real-time risk score output by the dynamic risk quantification module, and to implement access control on the data access request through the policy execution point.

10. The system according to claim 9, characterized in that, The adaptive policy enforcement module implements control by communicating with the policy enforcement point deployed on the data access link; The policy enforcement points are database firewalls, API gateways, proxies or data access middleware in service meshes; The adaptive policy execution module generates specific control instructions and sends them to the corresponding policy execution points, which then perform real-time intervention on the data flow.

Images