A method and system for protecting privacy data of a big data analysis process

Abstract

This invention discloses a method and system for privacy data protection in big data analysis, relating to the field of civil aviation data security and privacy protection technology. The method includes: acquiring multi-source heterogeneous civil aviation data, extracting passenger identity features, travel trajectory features, and consumption behavior features, and generating a structured feature matrix; extracting the relationships between fields using a convolutional neural network, calculating initial field sensitivity values, generating field sensitivity weights by combining field uniqueness indicators and initial sensitivity values, and generating a privacy level mapping table containing the field sensitivity weights; calculating query sensitivity and privacy budget parameters, generating differential privacy noise parameters and homomorphic encryption keys, and generating a hierarchical protection strategy; performing noise injection and ciphertext transformation on the original data to generate a de-identified dataset; and performing passenger flow statistics through encrypted computation to generate publicly available analysis results. This method avoids over-protection of low-sensitivity data while ensuring sufficient security for high-sensitivity data.

Description

Technical Field

[0001] This invention relates to the field of civil aviation data security and privacy protection technology, and in particular to a method and system for protecting privacy data in a big data analysis process. Background Technology

[0002] With the deepening of digital transformation in the civil aviation industry, airlines, airports, and related service providers have accumulated massive amounts of heterogeneous data from multiple sources, including passenger identity information, flight booking records, travel trajectory data, and airport consumption behavior. This data contains enormous commercial value, and in-depth analysis can achieve application goals such as accurate passenger flow prediction, personalized service recommendations, and operational efficiency optimization.

[0003] However, civil aviation data contains a large amount of sensitive personal privacy information, such as ID card numbers, passport information, travel destinations, and consumption preferences. The leakage of this information would pose a serious threat to passenger privacy. Existing privacy protection technologies have the following technical shortcomings in civil aviation big data analysis applications: Traditional privacy protection methods use a uniform level of protection, failing to differentiate based on the sensitivity of different data fields. For example, passenger names and flight numbers have different levels of privacy sensitivity, but existing methods often use the same protection strategy, leading to over-protection or under-protection. Existing technologies ignore the impact of the relationships between data fields on the risk of privacy leakage. In civil aviation data, seemingly harmless combinations of fields may reveal sensitive information; for example, combinations of flight time and seat number may identify a specific passenger, but traditional methods lack effective assessment of such correlation risks. A single privacy protection mechanism cannot balance the strength of privacy protection with data usability. Pure data anonymization, while protecting privacy, severely damages the statistical characteristics and analytical value of the data; while simple encryption methods, while ensuring data security, cannot support complex data analysis operations.

[0004] Therefore, there is an urgent need for a method and system for protecting privacy data in the big data analysis process. Summary of the Invention

[0005] This invention provides a method and system for protecting privacy data in the big data analysis process, in order to solve the above-mentioned problems existing in the prior art.

[0006] To achieve the above objectives, the present invention provides the following technical solution: A method for protecting privacy data in a big data analytics process includes: S1: Acquire multi-source heterogeneous civil aviation data, extract passenger identity features, travel trajectory features, and consumption behavior features, and generate a structured feature matrix; S2: Based on the structured feature matrix, the correlation between fields is extracted through a convolutional neural network. The initial value of field sensitivity is calculated based on the correlation. The field sensitivity weight is generated by combining the field uniqueness index and the initial value of sensitivity. A privacy level mapping table containing the field sensitivity weight is generated based on the sensitivity weight. S3: Based on the privacy level mapping table, calculate the query sensitivity and privacy budget parameters, generate differential privacy noise parameters and homomorphic encryption keys based on the query sensitivity and privacy budget parameters, and generate a hierarchical protection strategy based on the noise parameters and encryption keys; S4: Based on a hierarchical protection strategy, noise injection and ciphertext conversion are performed on the original data to generate a de-identified dataset that has undergone k-anonymization. S5: Based on the anonymized dataset, perform passenger flow statistics through dense-state computation to generate publicly available analysis results.

[0007] Furthermore, S1 includes: S11: Obtain passenger check-in data, ticket booking data, and transaction data from the departure system, reservation system, and payment system, respectively. The data includes timestamps, data source identifiers, and data format markers. S12: Use data cleaning algorithms to remove duplicate records and outliers, and then link and merge the cleaned multi-source data according to the passenger's unique identifier. S13: Extract the ID number and name fields from the merged data as identity features, extract the departure point, destination, and flight number fields as travel trajectory features, and extract the ticket price and payment method fields as consumption behavior features; S14: Arrange the three types of extracted features in a predefined column order to construct a structured feature matrix where rows represent passenger records and columns represent feature dimensions.

[0008] Furthermore, S2 includes: S21: Input the structured feature matrix into the input layer of the convolutional neural network, and extract local features by scanning adjacent fields through the convolutional kernel; S22: Downsample the convolutional features in the pooling layer, calculate the correlation strength value between each field and other fields through the fully connected layer, and generate the initial value of field sensitivity based on the correlation strength value; S23: Count the number of different values ​​for each field, divide it by the total number of records in the dataset to obtain the field uniqueness index; multiply the uniqueness index by the preset first weight coefficient to obtain the first component, multiply the initial sensitivity value by the preset second weight coefficient to obtain the second component, and add the first component and the second component to obtain the field sensitivity weight, where the first weight coefficient is greater than the second weight coefficient. S24: Based on the distribution range of sensitivity weights, divide the fields into three privacy levels: high, medium, and low, and construct a mapping table from field names to privacy levels.

[0009] Furthermore, S3 includes: S31: Read the privacy level mapping table and identify the high privacy level field set, the medium privacy level field set, and the low privacy level field set; S32: Generate homomorphic encrypted public-private key pairs for high privacy level fields and configure key length parameters based on the Paillier encryption scheme; S33: For each field in the privacy level, calculate its global sensitivity as a query result. The global sensitivity is the maximum difference between query results of adjacent datasets. Take the reciprocal of the sensitivity weight to obtain the privacy budget parameter. Divide the global sensitivity by the privacy budget parameter to obtain the scale parameter of the Laplace distribution. S34: Set generalization rules for low privacy level fields, including the granularity of numerical range division and the position of character mask; S35: Encapsulate key parameters, noise parameters, and generalization rules into a hierarchical protection strategy in JSON format.

[0010] Furthermore, S13 includes: S131: The document number is identified using a preset ID document format pattern, which includes alphanumeric combination rules. Fields that match successfully are marked as document number-type identity features. S132: Identify the departure and destination fields by comparing with the IATA airport code database, identify the flight number field by the combination pattern of airline identification code and flight number, and mark the identified fields as travel trajectory features; S133: Identify the ticket price field through numerical judgment and currency symbol, identify the payment method field through a predefined list of payment method keywords, and mark the identified fields as consumption behavior characteristics.

[0011] Furthermore, S23 includes: S231: Count the number of different values ​​for each field, divide it by the total number of records in the dataset to obtain the uniqueness index, which reflects the degree of dispersion of field values; S232: Calculate the Pearson correlation coefficient between each field and other fields, and take the average of the absolute values ​​of the correlation coefficients as the correlation strength value of that field; S233: Multiply the uniqueness index by a preset first weight coefficient to obtain the first component, multiply the association strength value by a preset second weight coefficient to obtain the second component, and add the first component and the second component to obtain the sensitivity weight of the field, wherein the first weight coefficient is greater than the second weight coefficient.

[0012] Furthermore, S33 includes: S331: For each field at the medium privacy level, calculate its global sensitivity as a query result. The global sensitivity is the maximum difference between query results from adjacent datasets. S332: Read the sensitivity weight of the field from the privacy level mapping table, and set the privacy budget parameter to the reciprocal of the sensitivity weight to ensure that highly sensitive fields are protected by privacy. S333: Divide the global sensitivity by the privacy budget parameter to obtain the scale parameter of the Laplace distribution, which is used for subsequent noise generation.

[0013] Furthermore, S34 includes: S341: For numeric fields with low privacy levels, divide the numeric range evenly into a preset number of intervals, with each interval represented by the median value; S342: For character fields with low privacy levels, determine a fixed percentage of characters to retain based on the average length of the field, retain the first fixed percentage of characters, and replace the remaining characters with wildcards.

[0014] Furthermore, S4 includes: S41: Parse the JSON configuration in the graded protection strategy and extract the processing parameters corresponding to each privacy level; S42: For high privacy level fields, use the Paillier public key to convert plaintext values ​​into ciphertext, maintaining the homomorphic property of the ciphertext field; S43: For the privacy level field, generate random noise based on the Laplace distribution and superimpose it onto the original value to generate differential privacy-preserving data; S44: For low privacy level fields, perform generalization to map specific values ​​to broader categories; S45: Perform k-anonymization validation and adjustment on the processed dataset so that any record has the same quasi-identifier combination as at least k-1 other records, generating a de-identified dataset.

[0015] Furthermore, a system for a method of protecting privacy data in a big data analytics process includes: The data acquisition module is used to acquire multi-source heterogeneous data from civil aviation, extract features, and generate a structured feature matrix; The privacy assessment module is used to extract correlations based on the structured feature matrix through a convolutional neural network and generate a privacy level mapping table. The policy configuration module is used to configure differential privacy parameters and encryption keys based on the privacy level mapping table, and generate hierarchical protection policies. The data desensitization module is used to perform noise injection and ciphertext conversion based on a hierarchical protection strategy to generate a desensitized dataset. The dense state analysis module is used to perform statistical analysis based on desensitized datasets through dense state calculations, generating publicly available analysis results.

[0016] Compared with the prior art, the present invention has the following advantages: This invention utilizes convolutional neural networks to deep learn the complex relationships between fields in civil aviation data. Combined with field uniqueness indicators, it constructs a sensitivity weighting system, achieving refined, tiered protection based on data sensitivity. Compared to traditional uniform protection methods, it can match the most suitable protection strength to data fields with different sensitivities, avoiding overprotection of low-sensitivity data while ensuring sufficient security for high-sensitivity data. By combining differential privacy noise injection with homomorphic encryption, a hybrid protection strategy adaptable to different privacy levels is constructed. The differential privacy mechanism provides theoretically provable privacy guarantees for statistical queries, while homomorphic encryption supports data operations in encrypted form. Their synergistic effect achieves an optimal balance between privacy protection and data availability. By automatically identifying potential relationships between data fields through a deep learning model, correlation risks are incorporated into the sensitivity assessment system, effectively preventing privacy leakage attacks based on field combination reasoning. This proactive correlation risk protection mechanism significantly improves the overall level of privacy protection.

[0017] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention.

[0018] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0019] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is a flowchart illustrating a method for protecting privacy data during big data analysis, as described in an embodiment of the present invention. Figure 2 This is a flowchart illustrating the generation of the structured feature matrix in an embodiment of the present invention; Figure 3 This is a structural diagram of a system for protecting privacy data in a big data analysis process, as described in an embodiment of the present invention. Detailed Implementation

[0020] The preferred embodiments of the present invention will be described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.

[0021] The embodiments of the present invention provide, as follows Figure 1 As shown, a method for protecting privacy data in a big data analytics process includes: S1: Acquire multi-source heterogeneous civil aviation data, extract passenger identity features, travel trajectory features, and consumption behavior features, and generate a structured feature matrix; S2: Based on the structured feature matrix, the correlation between fields is extracted through a convolutional neural network. The initial value of field sensitivity is calculated based on the correlation. The field sensitivity weight is generated by combining the field uniqueness index and the initial value of sensitivity. A privacy level mapping table containing the field sensitivity weight is generated based on the sensitivity weight. S3: Based on the privacy level mapping table, calculate the query sensitivity and privacy budget parameters, generate differential privacy noise parameters and homomorphic encryption keys based on the query sensitivity and privacy budget parameters, and generate a hierarchical protection strategy based on the noise parameters and encryption keys; S4: Based on a hierarchical protection strategy, noise injection and ciphertext conversion are performed on the original data to generate a de-identified dataset that has undergone k-anonymization. S5: Based on the anonymized dataset, perform passenger flow statistics through dense-state computation to generate publicly available analysis results.

[0022] The working principle and beneficial effects of the above technical solution are as follows: This method achieves the security of civil aviation data analysis by constructing a hierarchical privacy protection framework. First, passenger data from the civil aviation system is collected and transformed into a unified feature representation, resolving the issue of inconsistent formats among multi-source data. Then, a deep learning model is used to analyze the dependencies between fields, and the sensitivity of each field is quantified based on the degree of data dispersion, classifying fields according to risk level. Corresponding protection measures are formulated for different levels: encryption technology supporting ciphertext computation is used for core sensitive information; perturbation values ​​following a specific probability distribution are injected into moderately sensitive information; and coarse-grained replacement is performed on low-sensitivity information. The processed data ensures that no single record can be identified individually, and finally, statistical calculations are completed under protected conditions, outputting publishable results.

[0023] In another embodiment, such as Figure 2 As shown, S1 includes: S11: Obtain passenger check-in data, ticket booking data, and transaction data from the departure system, reservation system, and payment system, respectively. The data includes timestamps, data source identifiers, and data format markers. S12: Use data cleaning algorithms to remove duplicate records and outliers, and then link and merge the cleaned multi-source data according to the passenger's unique identifier. S13: Extract the ID number and name fields from the merged data as identity features, extract the departure point, destination, and flight number fields as travel trajectory features, and extract the ticket price and payment method fields as consumption behavior features; S14: Arrange the three types of extracted features in a predefined column order to construct a structured feature matrix where rows represent passenger records and columns represent feature dimensions.

[0024] The working principle and beneficial effects of the above technical solution are as follows: This process solves the problem of scattered and inconsistent data sources in civil aviation. Original records are extracted from check-in, reservation, and payment systems, with each record including metadata such as generation time, source system, and encoding format. Data quality is improved through deduplication and outlier filtering. Records from different systems are linked into a complete file using the passenger's unique code. Three types of information are separated from the linked file: identification information (including identification document and name), trajectory information (including departure and arrival locations and flight number), and consumption information (including price and payment method). This information is organized into a table in a fixed order, with each row corresponding to a passenger file and each column corresponding to a feature dimension, providing standardized input for subsequent analysis.

[0025] In another embodiment, S2 includes: S21: Input the structured feature matrix into the input layer of the convolutional neural network, and extract local features by scanning adjacent fields through the convolutional kernel; S22: Downsample the convolutional features in the pooling layer, calculate the correlation strength value between each field and other fields through the fully connected layer, and generate the initial value of field sensitivity based on the correlation strength value; S23: Count the number of different values ​​for each field, divide it by the total number of records in the dataset to obtain the field uniqueness index; multiply the uniqueness index by the preset first weight coefficient to obtain the first component, multiply the initial sensitivity value by the preset second weight coefficient to obtain the second component, and add the first component and the second component to obtain the field sensitivity weight, where the first weight coefficient is greater than the second weight coefficient. S24: Based on the distribution range of sensitivity weights, divide the fields into three privacy levels: high, medium, and low, and construct a mapping table from field names to privacy levels.

[0026] The working principle and beneficial effects of the above technical solution are as follows: A structured feature matrix is ​​used as input to a neural network. A convolutional kernel slides across the matrix to capture local correlation patterns between adjacent fields. The convolutional operation can identify informational relationships contained in combinations of fields such as "flight number and departure point" and "fare and payment method."

[0027] The pooling layer performs dimensionality reduction sampling on the feature maps obtained from convolution, retaining the most significant associated features. A fully connected layer establishes the connection relationship between each field and all other fields, calculating the influence strength of each field on other fields. A greater influence strength indicates a stronger association between the field and other fields, and a higher risk that leaking this field might lead to the inference of other fields; therefore, a larger initial sensitivity value is applied to this field.

[0028] Count the number of all possible values ​​for each field and calculate the ratio of this number to the total number of records in the dataset. The closer the ratio is to 1, the more dispersed the values ​​of that field are, the more likely each traveler is to have a different value for that field, and the more likely that field is to be used as an identifier to identify a specific individual.

[0029] Two weighting coefficients, α and β, are defined, where α > β. α adjusts the contribution of the uniqueness index, and β adjusts the contribution of the association strength. The calculation formula is as follows: Here, U represents the uniqueness index, and C represents the association strength value. Since the uniqueness index more directly reflects the risk of a field being used as an identifier, it is given a larger weighting coefficient. This weighted fusion comprehensively considers the privacy risks of both the identifiability and association of the field.

[0030] Analyze the numerical distribution of sensitivity weights for all fields and determine two thresholds to divide the weight range into three segments. Fields with weights exceeding the high threshold are classified as high privacy level, requiring the strongest protection measures; fields with weights between the two thresholds are classified as medium privacy level, requiring moderate protection; and fields with weights below the low threshold are classified as low privacy level, requiring basic protection measures. Establish a mapping table from field names to privacy levels to provide a basis for subsequent protection strategy configuration.

[0031] In another embodiment, S3 includes: S31: Read the privacy level mapping table and identify the high privacy level field set, the medium privacy level field set, and the low privacy level field set; S32: Generate homomorphic encrypted public-private key pairs for high privacy level fields and configure key length parameters based on the Paillier encryption scheme; S33: For each field in the privacy level, calculate its global sensitivity as a query result. The global sensitivity is the maximum difference between query results of adjacent datasets. Take the reciprocal of the sensitivity weight to obtain the privacy budget parameter. Divide the global sensitivity by the privacy budget parameter to obtain the scale parameter of the Laplace distribution. S34: Set generalization rules for low privacy level fields, including the granularity of numerical range division and the position of character mask; S35: Encapsulate key parameters, noise parameters, and generalization rules into a hierarchical protection strategy in JSON format.

[0032] The working principle and beneficial effects of the above technical solution are as follows: The privacy level mapping table is read, and the level labels of all fields are traversed. Fields marked with a high privacy level are collected into one set, fields marked with a medium privacy level are collected into another set, and fields marked with a low privacy level are collected into a third set. Different protection techniques will be used for fields in different sets.

[0033] For a set of high-privacy fields, generate public and private keys based on the Paillier encryption scheme. The Paillier encryption scheme exhibits additive homomorphism, meaning that adding two ciphertexts and then decrypting them equals adding the two plaintexts. This allows for statistical operations on the ciphertexts without decryption. The key length parameter is configured; longer keys offer higher security but also increase computational overhead, requiring a trade-off between security and efficiency.

[0034] For each field in the set of privacy-level fields, calculate its global sensitivity. Global sensitivity is defined as the maximum possible difference in query results when the same query is executed on adjacent datasets (i.e., two datasets that differ by only one record). For example, for a counting query, the global sensitivity is 1 because adding or removing a record will at most change the count by 1. Read the sensitivity weight w for this field from the mapping table, and calculate the privacy budget parameter ε = 1 / w. A larger sensitivity weight indicates a more sensitive field, a smaller privacy budget, and means more noise needs to be added to provide stronger protection. Calculate the scale parameter of the Laplace distribution. , where Δf is the global sensitivity. The scale parameter determines the distribution range of the noise; the larger the scale, the greater the noise amplitude.

[0035] For low-privacy-level fields, if the field is a numeric type, the value range is determined based on the maximum and minimum values. This range is then evenly divided into several intervals, with the midpoint value representing all original values ​​within each interval, thus reducing data precision. If the field is a character type, the proportion of characters to be retained is calculated based on the average length of the field values. The first part of the characters is retained to maintain basic semantics, while the latter part is replaced with asterisks or other wildcards to achieve partial masking.

[0036] The generated public and private key parameters, Laplace distribution scaling parameters, generalization interval partitioning rules, and masking position rules are organized into a structured document in JSON format. JSON format offers good readability and parsing, facilitating automatic reading and execution by the program. The policy document contains complete information such as field identifiers, protection levels, protection method types, and related parameters, serving as an operational guide for the data anonymization process.

[0037] In another embodiment, S13 includes: S131: The document number is identified using a preset ID document format pattern, which includes alphanumeric combination rules. Fields that match successfully are marked as document number-type identity features. S132: Identify the departure and destination fields by comparing with the IATA airport code database, identify the flight number field by the combination pattern of airline identification code and flight number, and mark the identified fields as travel trajectory features; S133: Identify the ticket price field through numerical judgment and currency symbol, identify the payment method field through a predefined list of payment method keywords, and mark the identified fields as consumption behavior characteristics.

[0038] The working principle and beneficial effects of the above technical solution are as follows: Pre-define the format patterns of various identity documents, including character length, alphanumeric combination rules, and check digit algorithms. Scan the data fields and match the field values ​​with the document format patterns. Fields that conform to the identity document format of a specific country or region are marked as identity features such as document numbers. This pattern-based recognition method can automatically handle the diverse document types of travelers from different countries.

[0039] Maintain a global three-letter airport code database, which maps each airport to a unique three-letter identifier. Scan data fields, compare field values ​​with the code database, and mark fields with successful matches as departure or destination. For the flight number field, define the recognition pattern as a combination of the airline's two-letter code and a numerical number, for example, CA1234 represents Air China flight 1234. Identify the flight number field through pattern matching and mark it as a travel trajectory feature.

[0040] For the ticket price field, first determine if the field value is a numeric type, then check for the presence of currency symbols such as ¥, $, €, etc. Simultaneously verify that the value is within a reasonable ticket price range, for example, greater than zero and not exceeding the normal ticket price ceiling. For the payment method field, maintain a list containing keywords such as credit card, debit card, third-party payment, cash, etc. Perform text matching between the field value and the list; if a match is found, mark it as a payment method feature.

[0041] In another embodiment, S23 includes: S231: Count the number of different values ​​for each field, divide it by the total number of records in the dataset to obtain the uniqueness index, which reflects the degree of dispersion of field values; S232: Calculate the Pearson correlation coefficient between each field and other fields, and take the average of the absolute values ​​of the correlation coefficients as the correlation strength value of that field; S233: Multiply the uniqueness index by a preset first weight coefficient to obtain the first component, multiply the association strength value by a preset second weight coefficient to obtain the second component, and add the first component and the second component to obtain the sensitivity weight of the field, wherein the first weight coefficient is greater than the second weight coefficient.

[0042] The working principle and beneficial effects of the above technical solution are as follows: Iterate through all record values ​​of the field and use a hash table or set data structure to count the number of unique values. Divide the number of unique values ​​by the total number of records in the dataset to obtain the uniqueness index U. This index ranges from 0 to 1. U=1 indicates that each record has a completely different value in this field, and the field has full unique identification capability; U close to 0 indicates that most records have the same value in this field, and the field has almost no identification capability.

[0043] Pearson correlation coefficient is selected as the indicator to measure the degree of linear association between fields. For numerical fields, the correlation coefficient is calculated directly; for categorical fields, numerical encoding is performed first, followed by calculation. The correlation coefficient between the target field and every other field in the dataset is calculated, and the average of the absolute values ​​of the correlation coefficients is taken as the association strength value C for that field. The larger the association strength value, the stronger the dependency between that field and other fields, and the higher the risk of inferring other information through association analysis after disclosing that field.

[0044] We set a first weighting coefficient α and a second weighting coefficient β, satisfying the constraint that α > β. This is because the uniqueness index directly reflects the risk of a field acting as a quasi-identifier, while the association strength reflects the risk of indirect inference; the former contributes more directly to privacy threats. The formula for calculating the sensitivity weight S is: ; U represents the uniqueness index, and C represents the association strength value. By adjusting the specific values ​​of α and β, the relative importance of the two risk factors can be flexibly controlled. The calculation results comprehensively reflect the privacy leakage risk of the field in both direct identification and indirect inference dimensions, providing a quantitative basis for subsequent allocation of protection levels.

[0045] In another embodiment, S33 includes: S331: For each field at the medium privacy level, calculate its global sensitivity as a query result. The global sensitivity is the maximum difference between query results from adjacent datasets. S332: Read the sensitivity weight of the field from the privacy level mapping table, and set the privacy budget parameter to the reciprocal of the sensitivity weight to ensure that highly sensitive fields are protected by privacy. S333: Divide the global sensitivity by the privacy budget parameter to obtain the scale parameter of the Laplace distribution, which is used for subsequent noise generation.

[0046] The working principle and beneficial effects of the above technical solution are as follows: This detailed solution elucidates the derivation process of the differential privacy parameters. For each intermediate-level field, the maximum impact of adding or deleting a single record on the result when it is used as query output is analyzed, i.e., the global sensitivity GS. The sensitivity weight W of this field is read from the mapping table, and its reciprocal 1 / W is taken as the privacy budget ε. This ensures that fields with higher sensitivity are allocated smaller privacy budgets, thereby injecting more noise. The ratio GS / ε is calculated to obtain the scaling parameter λ of the Laplace distribution. This parameter controls the noise amplitude and provides a precise basis for subsequent noise generation.

[0047] In another embodiment, S34 includes: S341: For numeric fields with low privacy levels, divide the numeric range evenly into a preset number of intervals, with each interval represented by the median value; S342: For character fields with low privacy levels, determine a fixed percentage of characters to retain based on the average length of the field, retain the first fixed percentage of characters, and replace the remaining characters with wildcards.

[0048] The working principle and beneficial effects of the above technical solution are as follows: This solution illustrates the generalization processing rules for low-level fields. For numeric fields, they are evenly divided into several intervals according to their value range, and each original value is replaced with the midpoint value of its interval, reducing data precision but preserving statistical characteristics. For character fields, a retention ratio p is determined based on the average length. The first p proportion of characters are displayed as is, and subsequent characters are all replaced with wildcards such as asterisks, preserving some readable information while protecting privacy.

[0049] In another embodiment, S4 includes: S41: Parse the JSON configuration in the graded protection strategy and extract the processing parameters corresponding to each privacy level; S42: For high privacy level fields, use the Paillier public key to convert plaintext values ​​into ciphertext, maintaining the homomorphic property of the ciphertext field; S43: For the privacy level field, generate random noise based on the Laplace distribution and superimpose it onto the original value to generate differential privacy-preserving data; S44: For low privacy level fields, perform generalization to map specific values ​​to broader categories; S45: Perform k-anonymization validation and adjustment on the processed dataset so that any record has the same quasi-identifier combination as at least k-1 other records, generating a de-identified dataset.

[0050] The working principle and beneficial effects of the above technical solution are as follows: This stage performs the actual data transformation operation. After parsing the strategy configuration file and extracting various parameters, the plaintext values ​​of high-level fields are converted into ciphertext using a public key, maintaining the property that addition operations can be performed between ciphertexts. For mid-level fields, random noise is generated according to the Laplace distribution parameters and superimposed on the original values, so that modifications to a single record are submerged in noise. For low-level fields, a preset generalization mapping is performed. After the transformation is completed, it is checked whether the dataset meets the k-anonymity requirement, that is, the quasi-identifier combination of each record appears at least k times. If it does not meet the requirement, the generalization granularity is adjusted or noise is added, and finally, a de-identified dataset that meets privacy requirements is output.

[0051] In another embodiment, such as Figure 3 As shown, a system for protecting privacy data in a big data analytics process includes: The data acquisition module is used to acquire multi-source heterogeneous data from civil aviation, extract features, and generate a structured feature matrix; The privacy assessment module is used to extract correlations based on the structured feature matrix through a convolutional neural network and generate a privacy level mapping table. The policy configuration module is used to configure differential privacy parameters and encryption keys based on the privacy level mapping table, and generate hierarchical protection policies. The data desensitization module is used to perform noise injection and ciphertext conversion based on a hierarchical protection strategy to generate a desensitized dataset. The dense state analysis module is used to perform statistical analysis based on desensitized datasets through dense state calculations, generating publicly available analysis results.

[0052] The working principle and beneficial effects of the above technical solution are as follows: The data acquisition module is responsible for capturing raw data from multiple civil aviation business systems, and extracting standardized features after cleaning and correlation. The privacy assessment module receives the feature data, uses convolutional neural networks to analyze field correlations, quantifies sensitivity by combining uniqueness indicators, and outputs privacy level classification results. The policy configuration module calculates encryption keys, noise parameters, and generalization rules for fields of different levels based on the classification results, generating a unified protection policy. The data anonymization module performs encryption, noise addition, and generalization operations on the raw data according to the policy, and verifies anonymity requirements. The encrypted analysis module performs statistical queries in encrypted or noisy states, directly outputting publicly available aggregation results, avoiding the exposure of sensitive information throughout the process. Data is transferred between modules through standardized interfaces, forming a complete privacy-protected data analysis chain.

[0053] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from the spirit and scope of this invention.

Claims

1. A method for protecting privacy data in a big data analytics process, characterized in that, include: S1: Acquire multi-source heterogeneous civil aviation data, extract passenger identity features, travel trajectory features, and consumption behavior features, and generate a structured feature matrix; including: S11: Obtain passenger check-in data, ticket booking data, and transaction data from the departure system, reservation system, and payment system, respectively. The data includes timestamps, data source identifiers, and data format markers. S12: Use data cleaning algorithms to remove duplicate records and outliers, and then link and merge the cleaned multi-source data according to the passenger's unique identifier. S13: Extract the ID number and name fields as identity features from the merged data; extract the departure point, destination, and flight number fields as travel trajectory features; and extract the fare and payment method fields as consumption behavior features; including: S131: The document number is identified using a preset ID document format pattern, which includes alphanumeric combination rules. Fields that match successfully are marked as document number-type identity features. S132: Identify the departure and destination fields by comparing with the IATA airport code database, identify the flight number field by the combination pattern of airline identification code and flight number, and mark the identified fields as travel trajectory features; S133: Identify the ticket price field through numerical judgment and currency symbol, identify the payment method field through a predefined list of payment method keywords, and mark the identified fields as consumption behavior characteristics; S14: Arrange the three types of extracted features in a predefined column order to construct a structured feature matrix in which rows represent passenger records and columns represent feature dimensions; S2: Based on the structured feature matrix, the correlation between fields is extracted through a convolutional neural network. The initial value of field sensitivity is calculated based on the correlation. The field sensitivity weight is generated by combining the field uniqueness index and the initial value of sensitivity. A privacy level mapping table containing the field sensitivity weight is generated based on the sensitivity weight. S3: Based on the privacy level mapping table, calculate query sensitivity and privacy budget parameters; generate differential privacy noise parameters and homomorphic encryption keys based on the query sensitivity and privacy budget parameters; and generate a tiered protection strategy based on the noise parameters and encryption keys; including: S31: Read the privacy level mapping table and identify the high privacy level field set, the medium privacy level field set, and the low privacy level field set; S32: Generate homomorphic encrypted public-private key pairs for high privacy level fields and configure key length parameters based on the Paillier encryption scheme; S33: For each field at the medium privacy level, calculate its global sensitivity as a query result. The global sensitivity is the maximum difference between query results from adjacent datasets. Take the reciprocal of the sensitivity weight to obtain the privacy budget parameter. Divide the global sensitivity by the privacy budget parameter to obtain the scale parameter of the Laplace distribution; including: S331: For each field at the medium privacy level, calculate its global sensitivity as a query result. The global sensitivity is the maximum difference between query results from adjacent datasets. S332: Read the sensitivity weight of the field from the privacy level mapping table, and set the privacy budget parameter to the reciprocal of the sensitivity weight to ensure that highly sensitive fields are protected by privacy. S333: Divide the global sensitivity by the privacy budget parameter to obtain the scale parameter of the Laplace distribution, which is used for subsequent noise generation; S34: Set generalization rules for low privacy level fields, including the granularity of numerical range division and the position of character mask; S35: Encapsulate key parameters, noise parameters, and generalization rules into a hierarchical protection strategy in JSON format; S4: Based on a hierarchical protection strategy, noise injection and ciphertext conversion are performed on the original data to generate a de-identified dataset that has undergone k-anonymization. S5: Based on the de-identified dataset, perform passenger flow statistics through dense-state computation to generate publicly available analysis results.

2. The method for protecting privacy data in the big data analysis process according to claim 1, characterized in that, S2 include: S21: Input the structured feature matrix into the input layer of the convolutional neural network, and extract local features by scanning adjacent fields through the convolutional kernel; S22: Downsample the convolutional features in the pooling layer, calculate the correlation strength value between each field and other fields through the fully connected layer, and generate the initial value of field sensitivity based on the correlation strength value; S23: Count the number of different values ​​for each field, divide it by the total number of records in the dataset to obtain the field uniqueness index; multiply the uniqueness index by the preset first weight coefficient to obtain the first component, multiply the initial sensitivity value by the preset second weight coefficient to obtain the second component, and add the first component and the second component to obtain the field sensitivity weight, where the first weight coefficient is greater than the second weight coefficient. S24: Based on the distribution range of sensitivity weights, divide the fields into three privacy levels: high, medium, and low, and construct a mapping table from field names to privacy levels.

3. The method for protecting privacy data in the big data analysis process according to claim 1, characterized in that, S3 include: S31: Read the privacy level mapping table and identify the high privacy level field set, the medium privacy level field set, and the low privacy level field set; S32: Generate homomorphic encrypted public-private key pairs for high privacy level fields and configure key length parameters based on the Paillier encryption scheme; S33: For each field in the privacy level, calculate its global sensitivity as a query result. The global sensitivity is the maximum difference between query results of adjacent datasets. Take the reciprocal of the sensitivity weight to obtain the privacy budget parameter. Divide the global sensitivity by the privacy budget parameter to obtain the scale parameter of the Laplace distribution. S34: Set generalization rules for low privacy level fields, including the granularity of numerical range division and the position of character mask; S35: Encapsulate key parameters, noise parameters, and generalization rules into a hierarchical protection strategy in JSON format.

4. The method for protecting privacy data in the big data analysis process according to claim 2, characterized in that, S23 includes: S231: Count the number of different values ​​for each field, divide it by the total number of records in the dataset to obtain the uniqueness index, which reflects the degree of dispersion of field values; S232: Calculate the Pearson correlation coefficient between each field and other fields, and take the average of the absolute values ​​of the correlation coefficients as the correlation strength value of that field; S233: Multiply the uniqueness index by a preset first weight coefficient to obtain the first component, multiply the association strength value by a preset second weight coefficient to obtain the second component, and add the first component and the second component to obtain the sensitivity weight of the field, wherein the first weight coefficient is greater than the second weight coefficient.

5. The method for protecting privacy data in the big data analysis process according to claim 1, characterized in that, S34 includes: S341: For numeric fields with low privacy levels, divide the numeric range evenly into a preset number of intervals, with each interval represented by the median value; S342: For character fields with low privacy levels, determine a fixed percentage of characters to retain based on the average length of the field, retain the first fixed percentage of characters, and replace the remaining characters with wildcards.

6. The method for protecting privacy data in the big data analysis process according to claim 1, characterized in that, S4 include: S41: Parse the JSON configuration in the graded protection strategy and extract the processing parameters corresponding to each privacy level; S42: For high privacy level fields, use the Paillier public key to convert plaintext values ​​into ciphertext, maintaining the homomorphic property of the ciphertext field; S43: For the privacy level field, generate random noise based on the Laplace distribution and superimpose it onto the original value to generate differential privacy-preserving data; S44: For low privacy level fields, perform generalization to map specific values ​​to broader categories; S45: Perform k-anonymization validation and adjustment on the processed dataset so that any record has the same quasi-identifier combination as at least k-1 other records, generating a de-identified dataset.

7. A system for protecting privacy data in a big data analytics process, characterized in that, Applied to the method of any one of claims 1-6, comprising: The data acquisition module is used to acquire multi-source heterogeneous data from civil aviation, extract features, and generate a structured feature matrix; The privacy assessment module is used to extract correlations based on the structured feature matrix through a convolutional neural network and generate a privacy level mapping table. The policy configuration module is used to configure differential privacy parameters and encryption keys based on the privacy level mapping table, and generate hierarchical protection policies. The data desensitization module is used to perform noise injection and ciphertext conversion based on a hierarchical protection strategy to generate a desensitized dataset. The dense state analysis module is used to perform statistical analysis based on desensitized datasets through dense state calculations, generating publicly available analysis results.

Images