Method for controlling unstructured data access risk, computer equipment and medium

Abstract

The invention discloses a method for controlling an unstructured data access risk, computer equipment and a medium. The method comprises the following steps: in response to an access request for target unstructured data, performing content analysis on the target unstructured data based on a pre-trained large model to obtain multi-dimensional semantic information; determining the importance level of the target unstructured data based on the multi-dimensional semantic information and a preset business rule; obtaining the authority level and historical behavior data of an access subject initiating the access request and the context information of the current access; determining a basic risk value according to a matching relationship between the importance level and the permission level; based on the historical behavior data and the context information, correcting the basic risk value to obtain a target risk value; and generating a target risk control instruction according to the target risk value, and executing the target risk control instruction. According to the method and the device, accurate assessment of the unstructured data access risk is realized, and the accuracy of data security protection is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security, in particular to a method for controlling access risk of unstructured data, a computer device and a medium. BACKGROUND

[0002] As the cornerstone of information security, the importance of data security is increasingly highlighted in the era of data-driven decision-making. Unstructured data, such as text, images, audio and video, accounts for a growing proportion of enterprise data assets, and often contains a large amount of valuable information, but also carries a high risk of data leakage and unauthorized access.

[0003] Currently, the calculation of unstructured data usage risk mainly relies on traditional technical means: one is a rule-based method, which matches through predefined keywords, regular expressions, etc. However, this method has limited coverage, is difficult to understand complex semantic context, has high maintenance costs and high false positive rates. Two is to use deep learning technology for risk judgment, but this method is not transparent in the decision-making process, making it difficult to trace and explain, affecting the credibility and auditability in actual security control scenarios.

[0004] Therefore, the method for managing unstructured data risk used in the prior art has the problem of low accuracy. SUMMARY

[0005] The purpose of the embodiments of the present application is to provide a method for controlling access risk of unstructured data, a computer device, a machine-readable storage medium and a computer program product, to solve the problem of low accuracy of the method for managing unstructured data risk used in the prior art.

[0006] To achieve the above-mentioned purpose, the first aspect of the present application provides a method for controlling access risk of unstructured data, which comprises: In response to an access request for target unstructured data, performing content analysis on the target unstructured data based on a pre-trained large model to obtain multi-dimensional semantic information; Based on the multi-dimensional semantic information and the preset business rules, determining the importance level of the target unstructured data; Obtaining the permission level, historical behavior data and current access context information of the access subject initiating the access request; According to the matching relationship between the importance level and the permission level, determining a basic risk value; Based on the historical behavior data and the context information, correcting the basic risk value to obtain a target risk value; Generating a target risk control instruction according to the target risk value, and executing the target risk control instruction.

[0007] In the embodiments of the present application, the pre-trained large model is used to analyze the content of the target unstructured data to obtain multi-dimensional semantic information, including: determining the modal type of the target unstructured data; calling a pre-trained analysis model corresponding to the modal type to process the target unstructured data to obtain multi-dimensional semantic information; wherein the multi-dimensional semantic information includes subject information, event information, time information, location information, reason information and method information.

[0008] In the embodiments of the present application, the pre-trained analysis model corresponding to the modal type is called to process the target unstructured data to obtain multi-dimensional semantic information, including: in the case of text data, the pre-trained natural language processing model is used to extract key information from the target unstructured data to obtain multi-dimensional semantic information; in the case of image data or video data, the trained computer vision model is used to perform target recognition, scene recognition and / or text recognition processing on the target unstructured data to obtain multi-dimensional semantic information; in the case of audio data, the pre-trained speech recognition model is used to convert the target unstructured data into target text data, and the natural language processing model is used to extract key information from the target text data to obtain multi-dimensional semantic information.

[0009] In the embodiments of the present application, the importance level of the target unstructured data is determined based on the multi-dimensional semantic information and the preset business rules, including: converting the multi-dimensional semantic information into a structured feature vector; matching the structured feature vector with sensitive information features in a preset business rule library, the preset business rule library including sensitive information features in different business fields and sensitivity weight values corresponding to each sensitive information feature; determining a sensitivity score of the target unstructured data according to a target sensitivity weight value corresponding to the target sensitive information feature matched; comparing the sensitivity score with a plurality of preset level threshold intervals, and determining the importance level of the target unstructured data according to a target level threshold interval in which the sensitivity score is located.

[0010] In the embodiments of the present application, the basic risk value is determined according to the matching relationship between the importance level and the permission level, including: determining the highest data level in the allowed access data level corresponding to the permission level; judging whether the importance level is higher than the highest data level; In a case where the importance level is higher than the highest data level, the basic risk value is determined as a preset high risk value; In a case where the importance level is not higher than the highest data level, the basic risk value is determined as a preset low risk value.

[0011] In the embodiments of the present application, the basic risk value is corrected based on the historical behavior data and the context information to obtain a target risk value, including: According to the historical behavior data, the access frequency of the access subject to the high risk level data within a preset time window is counted, and a behavior risk factor is determined based on a preset time decay function according to the access frequency; A context risk factor is determined based on the context information, and the context information includes at least one of access time, source IP address, and device fingerprint; The basic risk value, the behavior risk factor, and the context risk factor are weighted and fused to obtain the target risk value.

[0012] In the embodiments of the present application, a target risk control instruction is generated according to the target risk value, including: In a case where the target risk value is higher than a first preset threshold, a first risk control instruction is generated, and the first risk control instruction includes blocking access and alarming to an administrator; In a case where the target risk value is between a second preset threshold and the first preset threshold, a second risk control instruction is generated, and the second risk control instruction includes allowing access, recording an audit log, and issuing a prompt information; In a case where the target risk value is lower than the second preset threshold, a third risk control instruction is generated, and the third risk control instruction includes allowing access and recording a regular log; The first preset threshold is greater than the second preset threshold.

[0013] The second aspect of the present application provides a computer device, including a memory and a processor, the memory stores a computer program, and the processor implements the above-mentioned method for controlling the risk of accessing unstructured data when executing the computer program.

[0014] The third aspect of the present application provides a machine readable storage medium, the machine readable storage medium stores a program or instruction, and the program or instruction is executed by a processor to implement the above-mentioned method for controlling the risk of accessing unstructured data.

[0015] The fourth aspect of the present application provides a computer program product, including a computer program, and the computer program implements the above-mentioned method for controlling the risk of accessing unstructured data when executed by a processor.

[0016] By the technical solution, in response to an access request for target unstructured data, the target unstructured data is parsed based on a pre-trained large model to obtain multi-dimensional semantic information, then based on the multi-dimensional semantic information and a preset business rule, a degree of importance of the target unstructured data is determined, and a permission level of an access subject initiating the access request, historical behavior data, and context information of current access are obtained, then based on a matching relationship between the degree of importance and the permission level, a basic risk value is determined, the basic risk value is further corrected based on the historical behavior data and the context information to obtain a target risk value, finally, a target risk control instruction is generated according to the target risk value, and the target risk control instruction is executed. The application realizes a leap from static rule judgment to intelligent and accurate evaluation of unstructured data access risk by fusing the deep semantic understanding ability of a large model and dynamic behavior context analysis, and improves the accuracy of data security protection.

[0017] Other features and advantages of the embodiments of the present application will be described in detail in the following specific implementation part. BRIEF DESCRIPTION OF DRAWINGS

[0018] The accompanying drawings are included to provide a further understanding of the embodiments of the present application, and constitute a part of the specification, and are used to explain the embodiments of the present application together with the following specific implementation, but do not constitute a limitation to the embodiments of the present application. In the drawings: Figure 1 A flowchart of a method for controlling unstructured data access risk provided by an embodiment of the present application; Figure 2 A flowchart of a method for controlling unstructured data access risk provided by an embodiment of the present application. DETAILED DESCRIPTION

[0019] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. It should be understood that the specific implementation described herein is only used to illustrate and explain the embodiments of the present application, and is not used to limit the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without making creative efforts fall within the scope of protection of the present application.

[0020] It should be noted that if the embodiments of the present application involve directional indications (such as up, down, left, right, front, back, etc.), the directional indications are only used to explain the relative position relationship, movement condition, etc. between components in a certain specific posture (as shown in the drawings), if the specific posture changes, the directional indications also change accordingly.

[0021] Furthermore, if the embodiments of this application involve descriptions such as "first" or "second," these descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, features defined with "first" or "second" may explicitly or implicitly include at least one of those features. Additionally, the technical solutions of various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed in this application.

[0022] Figure 1 This is a flowchart illustrating a method for controlling the risks of unstructured data access, provided as an embodiment of this application. Figure 1 As shown in the figure, this application provides a method for controlling the risk of unstructured data access, which may include the following steps.

[0023] Step S101: In response to the access request for the target unstructured data, the content of the target unstructured data is parsed based on the pre-trained large model to obtain multi-dimensional semantic information. Step S102: Based on multi-dimensional semantic information and preset business rules, determine the importance level of the target unstructured data; Step S103: Obtain the permission level, historical behavior data, and current access context information of the access subject that initiated the access request; Step S104: Determine the basic risk value based on the matching relationship between importance level and permission level; Step S105: Based on historical behavior data and contextual information, the basic risk value is corrected to obtain the target risk value; Step S106: Generate target risk control instructions based on the target risk value, and execute the target risk control instructions.

[0024] In this embodiment, unstructured data refers to data that does not have a predefined data model or is not organized in a predetermined way, such as text documents, emails, images, videos, and audio files, the content of which is difficult to parse directly using traditional database tools. Pre-trained large models refer to deep learning models with powerful semantic understanding capabilities, such as GPT, BERT, and CLIP, which are pre-trained on massive datasets and can understand and generate human language or process multimodal information. Multi-dimensional semantic information refers to structured information extracted from data content that can summarize core facts; in this embodiment, it specifically refers to the six dimensions of subject, event, time, location, cause, and method. Importance levels are based on data content sensitivity and business rules, classifying data value and risk, and can include high, medium, and low levels. The accessing subject is the entity that initiates the data access request, which can be a user, application, or system process. Context information refers to environmental parameters at the time of the access behavior, such as access time, source IP address, and device fingerprint. Basic risk value and target risk value: The basic risk value is a quantitative result of the initial risk assessment based on static permission matching; the target risk value is the final, more accurate risk quantification result after incorporating dynamic behavior and contextual information. Risk control instructions are commands generated based on the risk value and used to execute security measures, such as blocking access, issuing alerts, and logging.

[0025] Currently, traditional data security protection methods, such as access control lists based on fixed rules, are inadequate when dealing with unstructured data. They cannot understand the true meaning of the data content, resulting in either overly lenient (leading to risks) or overly strict (impacting business efficiency) permission settings. To address this, this application introduces the deep semantic understanding capabilities of large-scale models, elevating data security strategies from a data attribute-based to a data content-based level. This achieves an intelligent, refined, and adaptive data access risk control mechanism. Based on accurate identification of data content sensitivity, combined with visitor behavior patterns and current environmental information, it dynamically assesses and handles the risks inherent in each access request in real time, thereby ensuring security without disrupting legitimate business operations.

[0026] Specifically, when a company's document management system, data platform, or any system storing unstructured data receives an access request—for example, a user attempting to open a report—the request is intercepted and sent to the risk calculation engine. The risk calculation engine first invokes a file content parsing service, which identifies the file's MIME type or extension to determine its modality, and then schedules the appropriate large model for deep parsing. For example, for a PDF contract, a natural language processing model is used to extract information such as the contracting parties (subjects), purchase amount (event), signing date (time), performance location (location), purpose of cooperation (reason), and payment method (method), and outputs it as a structured JSON object.

[0027] Furthermore, the parsed multi-dimensional semantic information is fed into an importance assessment module, which embeds a configurable business rule base. For example, in the finance department, the business rule base might define a rule: if the event information contains an amount greater than 1 million and the subject is a core customer, then the importance of the data should be marked as high. The assessment module matches the parsing results with all rules, calculates a comprehensive sensitivity score, and ultimately maps it to one of three levels: "high," "medium," or "low." Simultaneously, the system obtains the user's permission level from the identity authentication system, queries the user's recent access records from the behavior analysis database, and obtains contextual information such as the IP address and time of the current request from the network device.

[0028] Next, static matching is performed. If the file is classified as high-level but the user's permissions are only medium, the base risk value is set to a higher value, such as 80 points. Then, dynamic correction is performed. The behavior analysis component finds that the user has attempted to access 5 highly classified files in the past hour, increasing the behavior risk factor by 15 points; simultaneously, the context analysis component finds that the login IP comes from an infrequently used region, increasing the context risk factor by 10 points. Finally, a weighted formula is used to calculate the final risk value of 105 points. Finally, the risk handling module generates a target risk control instruction based on the preset strategy. This instruction is sent to the access gateway or data security agent via API, ultimately executing the action corresponding to the target risk control instruction. For example, if the target risk value > 100 points corresponds to the highest level of control instruction, then the final action would be to "block this access, send a real-time alarm to the security operations center, and record this abnormal behavior to the security incident and incident management system."

[0029] The above technical solution, in response to access requests for target unstructured data, performs content parsing on the target unstructured data based on a pre-trained large-scale model to obtain multi-dimensional semantic information. Then, based on this multi-dimensional semantic information and preset business rules, it determines the importance level of the target unstructured data and obtains the access level, historical behavior data, and current access context information of the accessing entity initiating the access request. Next, based on the matching relationship between the importance level and the access level, a basic risk value is determined. Further, based on historical behavior data and context information, the basic risk value is corrected to obtain the target risk value. Finally, a target risk control instruction is generated and executed based on the target risk value. This application, by integrating the deep semantic understanding capabilities of a large-scale model with dynamic behavioral context analysis, achieves a leap from static rule judgment to intelligent and accurate assessment of unstructured data access risks, improving the accuracy of data security protection.

[0030] In this embodiment of the application, content parsing of target unstructured data based on a pre-trained large model to obtain multi-dimensional semantic information may include: Determine the modal type of the target unstructured data; The pre-trained parsing model corresponding to the modality type is invoked to process the target unstructured data in order to obtain multi-dimensional semantic information; The multi-dimensional semantic information includes subject information, event information, time information, location information, cause information, and method information.

[0031] In this embodiment, modality refers to the form or perception channel of data, including text, images, audio, and video. A pre-trained parsing model is a dedicated artificial intelligence model pre-trained for specific modal data, used to complete deep parsing tasks for the corresponding data type. Because unstructured data is diverse in form and complex in structure, a single model cannot efficiently and accurately process all data types. Therefore, this embodiment constructs a unified multimodal parsing framework, ensuring the system has the comprehensive capability to process various types of unstructured data within an enterprise by configuring dedicated parsing models for different modal data.

[0032] Specifically, the system maintains a modality-model mapping registry to record the associations between different modality types and their corresponding pre-trained parsing models. When an access request for target unstructured data is received and the parsing process is triggered, the system first quickly detects and determines the modality type by analyzing the file's MIME type or extension. Subsequently, based on the determined modality type, the system queries the modality-model mapping registry to obtain the corresponding model access endpoint and calls the appropriate dedicated parsing model to process the target unstructured data, thereby outputting multi-dimensional semantic information that conforms to the specifications.

[0033] Through the aforementioned multimodal parsing framework, the system can adaptively select the optimal parsing path based on the characteristics of the data itself. This not only improves the accuracy and efficiency of content parsing but also provides a unified and high-quality structured data foundation for subsequent advanced security control functions such as importance assessment and dynamic risk analysis.

[0034] In this embodiment, calling a pre-trained parsing model corresponding to the modality type to process the target unstructured data to obtain multi-dimensional semantic information may include: When the target unstructured data is text data, key information is extracted from the target unstructured data based on a pre-trained natural language processing model to obtain multi-dimensional semantic information. When the target unstructured data is image data or video data, the trained computer vision model is used to perform target recognition, scene recognition and / or text recognition on the target unstructured data to obtain multi-dimensional semantic information. When the target unstructured data is audio data, a pre-trained speech recognition model is used to convert the target unstructured data into target text data. A natural language processing model is then used to extract key information from the target text data to obtain multi-dimensional semantic information.

[0035] In this embodiment, the natural language processing model is an artificial intelligence model specifically designed to understand and process human language, such as ERNIE and ChatGLM; the computer vision model is an AI model specifically designed to parse image and video content, such as YOLO and Faster R-CNN; and the speech recognition model is an AI model specifically designed to convert speech signals into text.

[0036] In the specific implementation process, the system adopts the optimal parsing path for different modal data: For text data, the system directly calls a pre-trained large language model, guides the model to extract key information through structured prompts, and directly outputs structured results containing multi-dimensional semantic information such as subject, event, time, location, cause, and method.

[0037] For image or video data, the system first performs target detection and scene analysis using a computer vision model to identify entities and visual elements; at the same time, it uses OCR technology to extract text information from the image; then, the visual recognition results are fused with the text content to generate a comprehensive description, which is then fed into a natural language processing model for deep semantic analysis, ultimately extracting complete multi-dimensional semantic information.

[0038] For audio data, the system first converts the audio content into text transcription using a speech recognition model, and then sends the generated text into a natural language processing pipeline to extract multi-dimensional semantic information according to the text data processing method.

[0039] Through this hierarchical and collaborative parsing architecture, the system can fully leverage the advantages of each specialized model in its respective modality, ensuring both consistency in cross-modal data processing and accuracy and efficiency in parsing various types of data, thus establishing a reliable data foundation for subsequent risk assessment.

[0040] In this application embodiment, determining the importance level of target unstructured data based on multi-dimensional semantic information and preset business rules may include: Convert multi-dimensional semantic information into structured feature vectors; The structured feature vectors are matched with sensitive information features in a preset business rule base, which includes sensitive information features from different business domains and sensitivity weight values ​​for each sensitive information feature. Based on the target sensitivity weight values ​​corresponding to the matched target sensitive information features, the sensitivity score of the target unstructured data is determined. The sensitivity score is compared with multiple preset level threshold ranges, and the importance level of the target unstructured data is determined based on the target level threshold range in which the sensitivity score falls.

[0041] In this embodiment, the structured feature vector transforms non-numerical, discrete, multi-dimensional semantic information into a uniformly formatted numerical representation that can be directly mathematically processed by a computer. The business rule base is a dataset storing domain-specific knowledge, including sensitive information features from different business domains and their corresponding sensitivity weights. The business rule base defines which combinations of information features are considered sensitive under what business contexts. The sensitivity weight is a quantified value representing the importance of a particular sensitive information feature in risk assessment. The sensitivity score is a quantified value representing the overall sensitivity of the data, calculated by comprehensively evaluating the weights of all matched sensitive information features. The level threshold range refers to a pre-defined numerical range used to map data sensitivity scores to specific importance levels. Each importance level corresponds to one or more consecutive numerical ranges, which constitute the decision boundary for data classification.

[0042] To address the issues of opaque decision-making in traditional expert systems and poor interpretability of deep learning models, this application's embodiments employ a technical approach that combines rule matching and quantitative scoring to achieve an importance determination scheme that maintains the accuracy of expert knowledge while also possessing the computability and interpretability of the model.

[0043] Specifically, after obtaining the multidimensional semantic information corresponding to the target unstructured data, the multidimensional semantic information is first converted into feature vectors. In one example, this can be achieved by constructing an information dimension vocabulary and generating multi-hot encoded vectors, where each dimension corresponds to the existence state or frequency of a specific information element. Then, the feature vectors are matched against all sensitive information features in the business rule base. After matching, the sensitivity score of the target unstructured data is determined based on the target sensitivity weight values ​​corresponding to the matched target sensitive information features. The sensitivity score can be calculated using various strategies, such as summation, model taking, or weighted average. Summation adds the target sensitivity weight values ​​of all matching rules, while model taking takes the highest weight among all matching rules. Finally, the sensitivity score is compared with multiple preset level threshold intervals, and the importance level of the target unstructured data is determined based on the target level threshold interval in which the sensitivity score falls.

[0044] Thus, by constructing a configurable business rule base and a quantitative scoring mechanism, this application embodiment achieves transparency and traceability in the data rating process, enabling the system to possess expert-level judgment accuracy while greatly enhancing credibility and operational flexibility in compliance audit scenarios.

[0045] In this embodiment of the application, determining the basic risk value based on the matching relationship between importance level and permission level may include: Determine the highest data level among the allowed data levels corresponding to the permission level; Determine whether the importance level is higher than the highest data level; When the importance level is higher than the highest data level, the base risk value is set as the preset high risk value; If the importance level is not higher than the highest data level, the basic risk value is set as the preset low risk value.

[0046] In this embodiment, the allowed data access levels corresponding to each permission level are preset. A preliminary risk assessment is formed by comparing the importance level of the data with the user's permission level. Specifically, the system first determines the upper limit of the data level allowed for the current user's permission level by querying the access control policy matrix. For example, a regular employee's permissions may only allow access to low-level and medium-level data, with medium being the highest data level. Subsequently, the system executes key judgment logic. If the importance level of the target unstructured data is higher than the highest data level allowed for user access, it indicates that the access has exceeded the user's normal permission range, and the basic risk value is set to a preset high-risk value; otherwise, it is set to a preset low-risk value. This ensures that even if the user's behavior pattern and access environment are normal, any attempt to access data beyond their permissions will be identified as a potential risk. This basic risk value serves as a benchmark for subsequent dynamic correction, providing a reliable assessment starting point for the integration of behavioral analysis and context awareness. This ensures the rigor of basic access control and lays a solid foundation for building a multi-dimensional intelligent risk assessment system.

[0047] In this embodiment of the application, the target risk value is obtained by correcting the basic risk value based on historical behavior data and contextual information, which may include: Based on historical behavioral data, the frequency of access to high-risk data by the accessing subject within a preset time window is counted, and behavioral risk factors are determined based on the access frequency using a preset time decay function. Context risk factors are determined based on context information, which includes at least one of the following: access time, source IP address, and device fingerprint. The target risk value is obtained by weighting and fusing the base risk value, behavioral risk factors, and contextual risk factors.

[0048] In this embodiment, the time decay function is a mathematical function used to represent the gradual weakening of the influence of historical events on the present over time, such as the exponential decay function. The behavioral risk factor and the contextual risk factor are both numerical values ​​calculated using a quantitative model, representing the abnormality of historical behavior and the abnormality of the current access context, respectively.

[0049] To overcome the limitations of static permission checks in existing technologies, this application's embodiments introduce a dynamic risk factor calculation mechanism. By analyzing the behavioral sequences of "who," "when," "where," and "how" accesses "what," it identifies access activities that may seem normal individually but are extremely risky when combined, thereby achieving proactive defense.

[0050] In one embodiment, the system performs dynamic risk assessment by analyzing users' historical behavior patterns to calculate the behavioral risk factor. Specifically, it first queries the user's access records to high-risk data within a preset time window (e.g., 24 hours), and then applies a time decay function for weighted calculation. The specific calculation formula is: Behavioral Risk Factor = ,in This represents the time interval between the i-th visit and the current visit. The attenuation coefficient is configurable, and the final calculation result is normalized and mapped to a preset range (such as 0-20) to ensure the standardization and comparability of the values.

[0051] In one embodiment, for calculating the contextual risk factor, the system performs multi-dimensional contextual analysis based on a user behavior baseline profile. This user behavior baseline profile records the user's regular behavior patterns, including: frequently logged-in time periods, frequently used IP address ranges, and a list of frequently used devices. This application embodiment can determine the contextual risk factor based on the user behavior baseline profile and preset risk judgment rules, according to contextual information. The preset risk judgment rules may include at least one of time anomaly rules, geographical anomaly rules, and device anomaly rules; wherein, the time anomaly rule adds 5 points if the access occurs outside of working hours; the geographical anomaly rule adds 10 points if the source IP is not in a frequently used IP range or belongs to a high-risk area; and the device anomaly rule adds 15 points if the device fingerprint has never been seen before or does not match frequently used devices. The above specific values ​​are only illustrative and can be set according to actual conditions. When the preset risk judgment rules include at least two of the time anomaly rules, geographical anomaly rules, and device anomaly rules, the contextual risk factor is the sum of the scores corresponding to each risk judgment rule.

[0052] Finally, the base risk value, behavioral risk factors, and contextual risk factors are weighted and fused to obtain the target risk value. The weights can be adjusted by the administrator based on the company's risk preferences. Thus, by establishing a two-tiered analysis framework combining historical behavior and real-time environment, a shift from passive defense to proactive risk awareness is achieved, effectively identifying abnormal access patterns based on legitimate permissions and significantly improving the detection capabilities for internal threats and advanced persistent attacks.

[0053] In this embodiment of the application, generating a target risk control instruction based on a target risk value may include: If the target risk value is higher than the first preset threshold, a first risk control instruction is generated. The first risk control instruction includes blocking access and alerting the administrator. When the target risk value is between the second preset threshold and the first preset threshold, a second risk control instruction is generated. The second risk control instruction includes allowing access, recording audit logs, and issuing a prompt message. If the target risk value is lower than the second preset threshold, a third risk control instruction is generated, which includes allowing access and recording regular logs. The first preset threshold is greater than the second preset threshold.

[0054] In this embodiment, the preset threshold is a predefined critical value used to classify different risk levels and trigger corresponding actions. To ensure that the system can take the most appropriate measures based on the level of risk and avoid a one-size-fits-all approach that could impact business operations, this embodiment can determine the target risk control instruction based on the target risk value and the preset threshold. By setting a first preset threshold and a second preset threshold, continuous risk values ​​are divided into three risk levels: high, medium, and low, and differentiated measures are configured for each level.

[0055] Specifically, when the target risk value exceeds a first preset threshold, a first risk control instruction is generated, and the system immediately blocks the access and sends a real-time alarm to the security administrator. This is suitable for access behaviors that are clearly unauthorized or pose a high threat. When the target risk value is between the second and first preset thresholds, a second risk control instruction is generated, and the system allows the access to be completed but records detailed audit logs and sends a security prompt to the user. This is suitable for risk scenarios where there are suspicious risks but the blocking criteria have not yet been met. When the target risk value is below the second preset threshold, a third risk control instruction is generated, and the system normally allows the access and only records basic operation logs. This is suitable for regular low-risk access. In this way, this embodiment of the application, by establishing a precise mapping between quantitative risk assessment and graded response mechanisms, effectively defends against high-risk threats while ensuring business access efficiency.

[0056] Figure 2 A flowchart illustrating a method for controlling the risks of unstructured data access, provided in a specific embodiment of this application. Figure 2 As shown in a specific embodiment of this application, the method for controlling the risk of unstructured data access includes: 1. Multimodal Content Parsing: Utilizing large models to perform deep semantic parsing on unstructured data, extracting multi-dimensional semantic information including subject (Who), event (What), time (When), location (Where), reason (Why), and method (How). For text data, natural language processing techniques are used to directly extract key information; for audio and video data, speech recognition, computer vision, and multimodal fusion are combined to generate a unified semantic representation.

[0057] 2. Importance Assessment: A qualitative rule base is built based on industry characteristics. According to the security requirements of different fields (such as the financial industry focusing on financial data and the medical industry focusing on patient privacy), the extracted semantic information is intelligently assessed, and the importance of the file is divided into three levels: high, medium and low, so as to achieve accurate classification based on business scenarios.

[0058] 3. Access Permission Judgment: Establish a hierarchical permission system, defining high, medium, and low access levels, each corresponding to access qualifications for files of varying importance. By comparing file importance with user permission levels in real time, unauthorized access is accurately identified. The permission judgment logic is: if the importance of unstructured data exceeds the user's or terminal's permission level, it is determined that the access permission has been exceeded.

[0059] 4. Risk Calculation: A basic risk value is generated based on the permission verification results, and a dynamic adjustment mechanism is introduced. By analyzing the user's historical access patterns and current access context (such as access frequency, time, location, etc.), the risk value is corrected in real time, realizing an upgrade from static judgment to dynamic assessment.

[0060] 5. Risk Warning and Handling: Establish a tiered response mechanism to trigger corresponding handling strategies based on the risk level. Measures such as restricting access, encrypting storage, and data anonymization can be taken according to the risk level. For example, if a high-risk warning is triggered, access will be immediately blocked and a warning notification will be sent to the administrator. If a medium-risk warning is triggered, access will be allowed but recorded for auditing. If a low-risk warning is triggered, access will be allowed normally.

[0061] This application's embodiments achieve intelligent risk calculation for unstructured data by combining the file content parsing capabilities of a large-scale model with industry-specific qualitative information. Specifically, the semantic understanding capabilities of the large-scale model accurately extract the 5W1H information and combine it with industry-specific qualitative information to assess the importance of the file. The automated parsing and assessment process significantly improves the efficiency of risk calculation. Risk values ​​are dynamically adjusted based on access behavior and contextual information, enhancing the flexibility of risk management. Through risk warning and handling mechanisms, unauthorized access is effectively prevented, ensuring data security.

[0062] This application also provides a computer device, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the method for controlling the risk of unstructured data access described above.

[0063] This application also provides a machine-readable storage medium on which a program or instruction is stored, and when the program or instruction is executed by a processor, it implements the method for controlling the risk of unstructured data access described above.

[0064] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the method for controlling the risk of unstructured data access described above.

[0065] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0066] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0067] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0068] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0069] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0070] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0071] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0072] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0073] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for controlling the risks of accessing unstructured data, characterized in that, The method includes: In response to a request to access the target unstructured data, the target unstructured data is parsed based on a pre-trained large model to obtain multi-dimensional semantic information. Based on the multi-dimensional semantic information and preset business rules, the importance level of the target unstructured data is determined; Obtain the permission level, historical behavior data, and current access context information of the access subject that initiated the access request; The basic risk value is determined based on the matching relationship between the importance level and the permission level; Based on the historical behavior data and the context information, the basic risk value is corrected to obtain the target risk value; Generate target risk control instructions based on the target risk value, and execute the target risk control instructions.

2. The method according to claim 1, characterized in that, The pre-trained large model performs content parsing on the target unstructured data to obtain multi-dimensional semantic information, including: Determine the modal type of the target unstructured data; The pre-trained parsing model corresponding to the modality type is invoked to process the target unstructured data to obtain multi-dimensional semantic information; The multi-dimensional semantic information includes subject information, event information, time information, location information, cause information, and method information.

3. The method according to claim 2, characterized in that, The invocation of the pre-trained parsing model corresponding to the modality type processes the target unstructured data to obtain multi-dimensional semantic information, including: When the target unstructured data is text data, key information is extracted from the target unstructured data based on a pre-trained natural language processing model to obtain the multi-dimensional semantic information. When the target unstructured data is image data or video data, the target unstructured data is processed by target recognition, scene recognition and / or text recognition based on a trained computer vision model to obtain the multi-dimensional semantic information. When the target unstructured data is audio data, the target unstructured data is converted into target text data based on a pre-trained speech recognition model, and key information is extracted from the target text data based on the natural language processing model to obtain the multi-dimensional semantic information.

4. The method according to claim 1, characterized in that, The determination of the importance level of the target unstructured data based on the multi-dimensional semantic information and preset business rules includes: The multi-dimensional semantic information is converted into a structured feature vector; The structured feature vector is matched with sensitive information features in a preset business rule base, which includes sensitive information features in different business domains and sensitivity weight values ​​corresponding to each sensitive information feature. Based on the target sensitivity weight value corresponding to the matched target sensitive information features, the sensitivity score of the target unstructured data is determined; The sensitivity score is compared with multiple preset level threshold intervals, and the importance level of the target unstructured data is determined based on the target level threshold interval in which the sensitivity score is located.

5. The method according to claim 1, characterized in that, The step of determining the basic risk value based on the matching relationship between the importance level and the permission level includes: Determine the highest data level among the allowed data access levels corresponding to the permission level; Determine whether the importance level is higher than the highest data level; When the importance level is higher than the highest data level, the base risk value is determined to be a preset high-risk value; If the importance level is not higher than the highest data level, the basic risk value is determined to be a preset low risk value.

6. The method according to claim 1, characterized in that, The step of correcting the basic risk value based on the historical behavior data and the context information to obtain the target risk value includes: Based on the historical behavior data, the frequency of access to high-risk data by the accessing subject within a preset time window is counted, and the behavior risk factor is determined based on the access frequency using a preset time decay function. Context risk factors are determined based on the context information, which includes at least one of access time, source IP address, and device fingerprint. The target risk value is obtained by weighting and fusing the base risk value, the behavioral risk factor, and the contextual risk factor.

7. The method according to claim 1, characterized in that, The step of generating target risk control instructions based on the target risk value includes: If the target risk value is higher than a first preset threshold, a first risk control instruction is generated, which includes blocking access and alerting the administrator. When the target risk value is between the second preset threshold and the first preset threshold, a second risk control instruction is generated. The second risk control instruction includes allowing access, recording audit logs, and issuing a prompt message. If the target risk value is lower than the second preset threshold, a third risk control instruction is generated, which includes allowing access to and recording of regular logs; Wherein, the first preset threshold is greater than the second preset threshold.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the method for controlling the risk of unstructured data access as described in any one of claims 1 to 7.

9. A machine-readable storage medium on which a program or instructions are stored, characterized in that, When the program or the instructions are executed by the processor, they implement the method for controlling the risk of unstructured data access as described in any one of claims 1 to 7.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method for controlling the risk of unstructured data access as described in any one of claims 1 to 7.

Images