Safety supervision method and system for public data operation platform

Abstract

The invention discloses a security supervision method and system for a public data operation platform, relates to the technical field of data security supervision, and solves the problem that new security risks generated in dynamic flow, combination and calculation processes cannot be effectively handled due to the fact that data is regarded as static assets in an existing method. Total factor operation data is collected through a distributed probe, and a secure digital twinborn body is constructed. And dynamically generating and executing an adaptive desensitization rule according to the context information of the access request by utilizing a decision tree model at the API gateway. And deploying a streaming anomaly detection engine at the edge side to perform real-time feature monitoring and confidence coefficient calculation, and implementing a hierarchical response strategy of instant interception, synchronous digital twinborn analysis or direct release according to the relationship between the confidence coefficient and a preset threshold value. And the digital twin and decision tree model is driven to be iteratively updated through a feedback mechanism. According to the invention, the initiative, real-time performance and accuracy of public data operation platform safety supervision are effectively improved.

Description

Technical Field

[0001] This invention relates to the field of data security supervision technology, specifically to a security supervision method and system for public data operation platforms. Background Technology

[0002] With the rapid development of information technology, data is increasingly widely used in all sectors of society, becoming one of the most important resources in modern society, especially in public data operation platforms. As a hub for information resources, these platforms not only support numerous public services but also carry a large amount of sensitive and critical information. The massive amounts of sensitive data face severe security challenges in their cross-institutional and cross-scenario circulation and sharing, making their security a focus of attention across all sectors of society. Therefore, ensuring data security and privacy while guaranteeing smooth and efficient data operation has become a major challenge in data management and technology development.

[0003] In existing methods, when conducting security supervision of public data operation platforms, data is often treated as a static asset, ignoring the new risks arising from its dynamic flow, combination, and computation within the operation platform. For example, CN119885281A discloses a data security supervision method for public data operation platforms that achieves privacy protection through sensitive data classification and desensitization intensity adjustment. However, its analysis is based solely on the static characteristics of the data and fails to capture the dynamic risks in data flow in real time, making it difficult to cope with dynamically evolving attack methods and the risk of data misuse in complex business scenarios.

[0004] Therefore, a security supervision method and system for public data operation platforms is needed to solve the above problems. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention discloses a security supervision method and system for public data operation platforms. Through dynamic modeling, context awareness, real-time edge response, and closed-loop iteration, it addresses new security risks arising from the dynamic flow and use of data in public data operation platforms, thereby enhancing the security protection capabilities of public data operation platforms.

[0006] The present invention adopts the following technical solution: A security oversight method for public data operation platforms includes the following steps: Deploy distributed probes on the public data operation platform to collect all elements of the platform's operation data in real time and store them in a secure data repository. Based on the real-time and historical data collected in the secure data repository, construct a secure digital twin that is synchronized with the public data operation platform. Deploy an API gateway on the public data operation platform to capture the context information of data access requests. Based on the context information, use a decision tree model to evaluate the operation scenario, user role, and data sensitivity of the data access request in real time, and generate appropriate de-identification rules. De-identify sensitive data according to the de-identification rules. Deploy a lightweight streaming anomaly detection engine at the edge of the API gateway to perform real-time feature monitoring of de-identification processing operations and data access requests, and to calculate confidence and determine events. If the confidence level is greater than a preset high threshold, it is determined to be a high-confidence threat event, triggering immediate interception of the data access request; if the confidence level is less than or equal to the preset high threshold but greater than the preset low threshold, it is determined to be a low-confidence abnormal event, and the context information of the data access request is synchronized to the secure digital twin for analysis; if the confidence level is less than or equal to the preset low threshold, it is determined to be a normal event, and the data access request is allowed. The event determination results, event characteristics, and handling results are fed back to the security digital twin and decision tree model for iterative updates.

[0007] Furthermore, the full-element operational data includes at least data access requests, user behavior, network traffic, and system logs. The secure digital twin provides a virtual digital representation of the elements of the public data operation platform and updates the data collected by the distributed probes in real time based on a message queue. The elements include at least topology, data patterns, user permissions, and behavioral patterns.

[0008] Furthermore, the context information includes at least visitor identity, access time, access location, access operation type, and access data sensitivity. When the API gateway captures the context information of the data access request, it extracts the numerical or categorical features of the context information and converts them into feature vectors, which are then input into the decision tree model. The decision tree model splits layer by layer from the root node to the leaf node to output a three-dimensional classification result of the feature vector's operation scenario, user role, and data sensitivity. Based on the three-dimensional classification result output by the decision tree model, the most suitable desensitization rule is matched from a predefined desensitization rule library.

[0009] Furthermore, the lightweight streaming anomaly detection engine monitors the temporal, content, and behavioral characteristics of de-identification operations and data access requests in real time, and performs temporal anomaly detection based on a pruned Long Short-Term Memory (LSTM) network to capture abnormal patterns in the operation sequence. The LSTM network calculates the error value based on the difference between the predicted and true values ​​of the features, and obtains the confidence level through a Sigmoid function mapping.

[0010] Furthermore, when a threat event is determined to be of high confidence, the gateway routing rules are modified to immediately intercept data access requests on the API gateway, and the immediate interception instructions are synchronized to the data access middleware for collaborative interception via the RPC call protocol.

[0011] Furthermore, when an anomaly is determined to be of low confidence, anomaly synchronization and security analysis are performed within the secure digital twin. Specific operations include: A graph neural network is used to perform entity and relationship correlation analysis on synchronous abnormal events, and the intent of abnormal events is judged by combining the global user relationship graph. AI attack agents are used to simulate known and unknown attack paths within a secure digital twin. Sandbox tests are then conducted within the secure digital twin, within which the defense strategy deployed by the public data operation platform is implemented, to evaluate the security effectiveness of the defense strategy. In a secure digital twin, a scenario where defense strategies are breached is simulated, and the impact of sensitive data leaks is extrapolated through data lineage mapping.

[0012] Furthermore, if the impact of a sensitive data breach exceeds a predetermined range, data access requests will be intercepted immediately, and security policy instructions will be updated based on the security benefit assessment results of the defense strategy; if the impact of a sensitive data breach is less than or equal to a predetermined range, data access requests will be allowed.

[0013] Furthermore, a security monitoring system for a public data operation platform, the security monitoring system for a public data operation platform comprising: The data acquisition layer collects all operational data of the public data operation platform by deploying distributed probes and stores it in a secure data repository. Based on the data in the secure data repository, a secure digital twin is constructed and synchronized. The intelligent desensitization layer captures the context information of data access requests through the API gateway and uses a decision tree model to evaluate the operation scenario, user role, and data sensitivity of the request in real time in order to generate and execute appropriate desensitization rules. The edge detection layer is deployed on the edge side of the intelligent desensitization layer. It uses a streaming anomaly detection engine to monitor data access requests and desensitization operations in real time, calculate confidence and determine events, and perform interception, release or reporting operations based on the event determination results. The feedback optimization layer receives abnormal event information reported by the edge detection layer, performs in-depth analysis in the secure digital twin, and feeds back the event judgment and handling results to the digital twin and the decision tree model to achieve iterative model updates.

[0014] The beneficial effects of this invention are as follows: 1. This invention deploys distributed probes to collect all elements of the public data operation platform's operational data in real time and stores it in a secure data repository. It constructs a secure digital twin synchronized with the platform, obtains the platform's operational data in real time, and generates a digital twin synchronized with the platform's status, effectively reflecting the platform's actual operating status and providing real-time data support for subsequent anomaly detection and decision-making.

[0015] 2. This invention captures the contextual information of data access requests in the API gateway and evaluates the operational scenario, user role, and data sensitivity of the access request through a decision tree model. It then generates corresponding de-identification rules to process sensitive data, effectively reducing the risk of data leakage, ensuring that only necessary data access is allowed, and providing appropriate protection for sensitive data. Furthermore, a lightweight streaming anomaly detection engine is deployed at the edge of the API gateway to monitor the characteristics of de-identification processing operations and data access requests in real time, performing confidence calculations and event determination. This enables rapid identification of potential security threats and effective prevention of attacks and abuse.

[0016] 3. This invention employs a three-tiered confidence-based judgment mechanism, forming an intelligent filter. When the confidence level exceeds a preset high threshold, the system classifies it as a high-confidence threat event and triggers immediate interception, ensuring rapid response and effective protection against high-threat events and preventing data leakage or other security incidents. When the confidence level is in the intermediate range, the system classifies it as a low-confidence anomaly and synchronizes the context information to the digital twin for further analysis. This tiered anomaly judgment and analysis method not only facilitates real-time response but also provides data support for future event handling, continuously improving the system's ability to handle complex security events.

[0017] 4. This invention feeds back the event determination results, event characteristics, and processing results to the secure digital twin and decision tree model, driving model iteration and optimization. Through continuous feedback on events and model updates, the adaptability and accuracy of the decision tree model are enhanced, enabling the system to continuously optimize its security protection strategies over time. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of the overall process of the present invention; Figure 2 This is a diagram of the overall system architecture in this invention. Detailed Implementation

[0019] The following will refer to the appendices in the embodiments of the present invention. Figure 1 To be continued Figure 2The technical solutions in the embodiments of the present invention are clearly and completely described herein. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0020] This invention discloses a security supervision method for a public data operation platform, as shown in the attached figure. Figure 1 This includes the following steps: S1: Collect all operational data and construct a secure digital twin. Deploy distributed probes on the public data operation platform to collect all elements of the platform's operation data in real time and store them in a secure data repository. Based on the real-time and historical data collected in the secure data repository, construct a secure digital twin that is synchronized with the public data operation platform. Distributed probes are deployed on the data source nodes of the public data operation platform, such as databases and data middleware, transmission links such as data sharing channels and API interfaces, application terminals such as government terminals, and third-party cooperative systems, to collect real-time operational data of all elements, including at least data access requests, user behavior, network traffic, and system logs. Data access request: includes request ID, target data identifier, operation type such as read, modify, and export, and request timestamp; User behavior includes user account, affiliated organization, role permissions, access IP, terminal fingerprint, and operation sequence, such as login, query, and download; Network traffic includes packet size, transmission protocol, link bandwidth usage, and abnormal packet characteristics such as malicious port access. System logs include node resource load such as CPU, memory and disk, permission change records, and data schema modification logs.

[0021] The collected data is written to a secure data repository in real time via an encrypted transmission channel such as TLS 1.3. A real-time streaming partitioning and historical archive partitioning architecture is used to ensure that the data is tamper-proof and traceable.

[0022] The dynamic construction and synchronization of a secure digital twin is based on real-time and historical data from a secure data repository. This constructs a virtual digital representation of elements of the public data operation platform, including at least topology, data patterns, user permissions, and behavioral patterns, forming a secure digital twin. Specific implementation details include: Static element mirroring: replicates the physical platform's topology, such as the connection relationships between servers, network devices, and storage nodes; data patterns, such as table structures; field types and sensitive field annotations; and user permission matrices, such as the mapping relationships between roles, data, and operations. Dynamic element simulation: Learn user historical behavior patterns through LSTM time series model, such as the regular access period of a certain government role is 8:30-17:30, with an average of ≤50 operations per day, and reproduce user behavior patterns in twins; Real-time synchronization mechanism: Data synchronization is achieved using message queues such as Kafka, where: High-frequency synchronization (100ms level): dynamic data such as data access requests, user behavior, and network traffic; Low-frequency synchronization (5-minute level): Changes in static elements such as topology, data patterns, and user permissions; Synchronous verification: The virtual twin and the physical platform are compared every hour to check for deviations in elements such as permission configuration consistency and behavior pattern matching. When the deviation exceeds 5%, calibration is automatically triggered to ensure consistency between the virtual and physical environments.

[0023] S2: Generate and execute dynamic desensitization rules. Deploy an API gateway on the public data operation platform to capture the context information of data access requests. Based on the context information, use a decision tree model to evaluate the operation scenario, user role, and data sensitivity of the data access request in real time, and generate appropriate de-identification rules. De-identify sensitive data according to the de-identification rules. Contextual information includes at least visitor identity, access time, access location, access operation type, and access data sensitivity. When the API gateway captures the contextual information of the data access request, it extracts the numerical or categorical features of the contextual information and converts them into feature vectors, which are then input into the decision tree model. The decision tree model splits layer by layer from the root node to the leaf node to output a three-dimensional classification result of the feature vector, which includes the operation scenario, user role, and data sensitivity. Based on the three-dimensional classification result output by the decision tree model, the most suitable desensitization rule is matched from the predefined desensitization rule library.

[0024] After the API gateway intercepts a data access request, it performs structured processing on the context information, including numerical feature extraction of access time, access data sensitivity, and single request data volume; categorical feature encoding of visitor identity, access geolocation, and access operation type; and assembling the processed numerical and categorical features into a 6-dimensional feature vector according to a fixed dimension.

[0025] The decision tree model uses data sensitivity level as the root node. The first layer splits according to user role, the second layer splits according to operation scenario, and the final leaf node outputs the three-dimensional classification results of operation scenario, user role, and data sensitivity. The predefined de-identification rule base is indexed by three-dimensional classification. Each classification result corresponds to a unique optimal rule, and the rule matching response time is ≤10ms.

[0026] The intelligent data masking process is embedded in the API gateway, which processes request data in real time according to the matching masking rules. The processing results are synchronized to: the request-response stream of the physical platform, which is returned to the visitor; a secure data repository that records the mapping relationship before and after masking, which can only be queried by authorized auditors; and a secure digital twin for subsequent anomaly analysis.

[0027] S3: Lightweight streaming anomaly monitoring and confidence calculation Deploy a lightweight streaming anomaly detection engine at the edge of the API gateway to perform real-time feature monitoring of de-identification processing operations and data access requests, and to calculate confidence and determine events. The lightweight streaming anomaly detection engine monitors the temporal, content, and behavioral features of de-identification operations and data access requests in real time. It performs temporal anomaly detection based on a pruned Long Short-Term Memory (LSTM) network to capture abnormal patterns in the operation sequence. The LSTM network calculates the error value based on the difference between the predicted and true values ​​of the features and obtains the confidence level through the Sigmoid function. The lightweight streaming anomaly detection engine performs multi-dimensional feature extraction and monitoring of de-identification operations and data access requests, including: Temporal characteristics: Capture operation sequences and access frequencies according to time series; Content characteristics: Completeness of desensitization processing, such as whether all sensitive fields have been desensitized; Data content consistency, such as whether the data type requested matches the purpose of the operation. Behavioral characteristics: Deviations in the visitor's historical behavior baseline, such as a user's regular access time being 9:00-17:00, but currently accessing at 2:00 AM; frequency of cross-scenario operations, such as switching from an approval scenario to a download scenario within a short period of time.

[0028] Temporal anomaly detection is performed using a pruned LSTM network. The monitored features are input into the pruned Long Short-Term Memory (LSTM) network. Model pruning reduces redundant parameters and ensures lightweight operation at the edge. The specific process is as follows: Feature input: Transform temporal features, content features, and behavioral features into fixed-dimensional feature vectors, and input them into the pruned LSTM at time steps; Anomaly prediction: The pruned LSTM predicts the expected value of the current feature based on historical normal feature patterns, and calculates the error between the predicted value and the true value. Confidence score calculation: The error value is mapped to a threat confidence score of 0-100 using the Sigmoid function. The larger the error, the higher the confidence score, which represents a higher probability of threat.

[0029] S4: Incident Classification and Handling When the confidence level exceeds a preset high threshold, it is identified as a high-confidence threat event, triggering immediate interception of data access requests. When a high-confidence threat event is identified, the API gateway modifies its routing rules to immediately intercept data access requests, and synchronizes the immediate interception command to the data access middleware via RPC for collaborative interception. High-confidence threat events (confidence level > 85 points): If the de-identification algorithm is tampered with, immediately execute the following: The API gateway modifies its routing rules to intercept the request; the interception command is synchronized to the data access middleware (such as database access middleware or caching middleware) via RPC protocol, achieving collaborative blocking between the gateway and middleware to avoid single-point defense failure; an alert is pushed to the administrator, including the attack source and event characteristics.

[0030] If the confidence level is less than or equal to a preset high threshold and greater than a preset low threshold, it is determined to be a low-confidence anomaly. The context information of the data access request is synchronized to the digital twin for analysis. When an anomaly is determined to be low-confidence, anomaly event synchronization and security analysis are performed within the secure digital twin. Specific operations include: A graph neural network is used to perform entity and relationship correlation analysis on synchronous abnormal events, and the intent of abnormal events is judged by combining the global user relationship graph. AI attack agents are used to simulate known and unknown attack paths within a secure digital twin. Sandbox tests are then conducted within the secure digital twin, within which the defense strategy deployed by the public data operation platform is implemented, to evaluate the security effectiveness of the defense strategy. In a secure digital twin, a scenario where defense strategies are breached is simulated, and the impact of sensitive data leaks is extrapolated through data lineage mapping.

[0031] If the impact of a sensitive data breach exceeds a predetermined range, data access requests will be immediately blocked, and security policy instructions will be updated based on the security benefit assessment of the defense strategy; if the impact of a sensitive data breach is less than or equal to a predetermined range, data access requests will be allowed.

[0032] Low-confidence anomaly events (25 points < confidence level ≤ 85 points): such as government personnel accessing L3 level data remotely for the first time, or operation sequences containing unconventional modifications and deletions. The complete context of the event (feature vector, anonymized records, data lineage) will be synchronized to the secure digital twin. Intent assessment, strategy testing, and impact simulation analysis will be completed within the digital twin, and secondary handling results will be output.

[0033] Intent Judgment of Abnormal Events Based on GNN Association Analysis After receiving the context, the digital twin uses the DGL tool to construct an event entity relationship graph. Entities include the user who initiated the request, the data being accessed, and the request interface API. Relationships include access and association.

[0034] Combined with the global user relationship graph, such as whether a user has a collaborative relationship with high-risk users or whether there are any historical abnormal records, a malicious intent score of 0-100 is calculated using the GNN model. A score ≥60 is judged as suspicious malicious intent, and <60 is judged as misoperation or low risk.

[0035] The digital twin is loaded with an AI attack agent, which is trained based on reinforcement learning. It can simulate attacks such as SQL injection, XSS, and unauthorized access. Starting from the current abnormal event, it simulates known attack paths, such as abnormal request → bypassing WAF → accessing sensitive data, and unknown attack paths, such as abnormal request → exploiting API vulnerabilities → tampering with data.

[0036] Strategy Evaluation: Reproduce the existing defense strategies of the public data operation platform within the twin, such as WAF rules, access control lists, and data masking rules, and test the success rate of the attacking agent's breach. If the success rate of the breakthrough is ≤10%, the defense strategy is considered effective. If the success rate of the breach is greater than 30%, the defense strategy is deemed to have a vulnerability, and the vulnerability point needs to be recorded, such as a certain WAF rule failing to block a specific injection statement.

[0037] Assuming the defense strategy is breached, the digital twin can trace the source, processing, and flow nodes of the sensitive data currently being requested through a data lineage graph, such as user tables containing ID card numbers and mobile phone numbers, API interfaces, and third-party applications.

[0038] Compare the potential data leakage volume (e.g., 1000 pieces of sensitive user information) and the number of associated users (e.g., involving 50 enterprise users) with a preset range (e.g., data volume ≤ 500 pieces and number of users ≤ 20). If the limit is exceeded: trigger secondary interception, synchronize to API gateway and middleware via RPC, and generate policy update suggestions, such as tightening access permissions for the API or increasing the de-identification level; If the result is within the preset range: allow the request to proceed, and only record the simulation results to the security log.

[0039] When the confidence level is less than or equal to the preset low threshold, it is determined to be a normal event and a data access request is made; normal events (confidence level ≤ 25 points): the operation log is recorded to the secure data repository directly through the request.

[0040] The preset high and low thresholds are calibrated quarterly based on historical data from the digital twin.

[0041] S5: End-to-End Feedback Iteration The event determination results, event characteristics, and handling results are fed back to the security digital twin and decision tree model for iterative updates.

[0042] The event determination results, event characteristics, and handling effects are integrated into a feedback flow to drive the system's self-evolution. Adjust the model evaluation weights using data on the desensitization effect to improve the accuracy of rule matching; Add new features of high-confidence threats to the LSTM training set, incrementally train the model, and improve the anomaly detection rate; Optimize the behavioral simulation model of the secure digital twin using the analysis results of low-confidence events to enhance in-depth analysis capabilities.

[0043] Key information throughout the entire process, such as data collection records, anonymization rule logs, details of abnormal events, and model iteration trajectories, will be written into the consortium blockchain to ensure that the data is tamper-proof and traceable.

[0044] A security monitoring system for a public data operation platform, comprising: The data acquisition layer collects all operational data of the public data operation platform by deploying distributed probes and stores it in a secure data repository. Based on the data in the secure data repository, a secure digital twin is constructed and synchronized. The intelligent desensitization layer captures the context information of data access requests through the API gateway and uses a decision tree model to evaluate the operation scenario, user role, and data sensitivity of the request in real time in order to generate and execute appropriate desensitization rules. The edge detection layer is deployed on the edge side of the intelligent desensitization layer. It uses a streaming anomaly detection engine to monitor data access requests and desensitization operations in real time, calculate confidence and determine events, and perform interception, release or reporting operations based on the event determination results. The feedback optimization layer receives abnormal event information reported by the edge detection layer, performs in-depth analysis in the secure digital twin, and feeds back the event judgment and handling results to the digital twin and the decision tree model to achieve iterative model updates.

[0045] The system adopts a layered design, with each layer's components operating independently and communicating with each other, ensuring modular functionality and strong scalability.

[0046] Data Acquisition Layer: Full-Element Data Acquisition and Twin Construction As the system's data foundation layer, it is responsible for providing the data source for all subsequent security operations. Its core components include three categories: Distributed probes: Deployed at key locations such as servers, databases, and application nodes of the public data operation platform to collect comprehensive operational data, specifically including: System operation data: CPU / memory usage, network bandwidth, process status; Data flow: data transmission path, data read / write frequency, data format; User operation data: user login logs, access interface records, and operation behavior sequences.

[0047] Secure data repository: Employs a distributed storage architecture to store two types of data: Real-time data acquisition: for immediate analysis; Historical data collection: used for secure digital twin construction and model training.

[0048] Secure digital twin: Based on data in the repository, a virtual mirror is built that maps 1:1 to the public data operation platform, synchronizing the platform's operating status, data flow links, and user behavior, providing a virtual testing environment for subsequent in-depth analysis.

[0049] Intelligent data masking layer: dynamically adaptable access control As the system's access filtering layer, it protects sensitive data before it is transmitted externally. Its core components are the API gateway and the decision tree model, and its workflow is as follows: Context information capture: The API gateway intercepts all data access requests entering the platform and extracts the context information of the requests, including the request source IP, user ID and role, identifier of the accessed data, and request time.

[0050] Multi-dimensional real-time evaluation: Contextual information is input into the decision tree model, and the model evaluates the decision from three dimensions: Operation scenario: Determine whether the request conforms to a normal business scenario; User role: Verifies whether a user's permissions match the permission level for accessing data; Data Sensitivity: Based on preset sensitive data tags. For example, ID card numbers and bank card numbers are highly sensitive, while names are moderately sensitive, thus determining the sensitivity level of the accessed data.

[0051] Desensitization rule execution: The model generates appropriate desensitization rules based on the evaluation results. For example, highly sensitive data is masked by blocking the middle characters, and moderately sensitive data is replaced with hash values. After the API gateway performs desensitization on the sensitive data in the request, it forwards the request to the platform.

[0052] Edge detection layer: Real-time anomaly identification and rapid handling As the system's real-time defense layer, it is deployed at the edge of the API gateway to achieve millisecond-level anomaly detection and handling. Its core component is a streaming anomaly detection engine, and its core functions include: Real-time feature monitoring: Monitoring two types of objects: Data access requests: Monitor the timing characteristics of requests, such as request frequency per unit time; content characteristics, such as request parameter format; and behavioral characteristics, such as user operation sequence. Desensitization process: Monitor whether the desensitization rules are executed normally.

[0053] Confidence calculation: The monitored features are analyzed using a pruned LSTM network to calculate the anomaly confidence level.

[0054] Event Judgment and Handling: Based on the confidence level and preset high / low thresholds, perform three types of operations: High-confidence threat events: Immediately intercept requests and simultaneously synchronize with the data access middleware via RPC protocol to achieve collaborative interception between the gateway and middleware; Low-confidence exception events: Do not intercept the request, but report the request context information to the feedback optimization layer; Normal event: Allow the request directly and log the request to the secure data repository.

[0055] Feedback Optimization Layer: Deep Analysis and Closed-Loop Iteration As the core optimization layer of the system, it receives abnormal events reported by the edge detection layer, performs in-depth analysis through a secure digital twin, and feeds back the results to achieve system optimization. Its core work includes two categories: In-depth analysis of abnormal events: Three analyses are performed on reported abnormal events within the secure digital twin: Intent analysis: Graph neural networks are used to analyze the entities, users, data, interfaces, and relationships in an event, and combined with a global user relationship graph, to determine whether the event has malicious intent; Defense strategy testing: Simulate attack paths using AI attack agents and test the security effectiveness of the platform's existing defense strategies, such as interception success rate, within the twin. Leakage Impact Simulation: Simulate scenarios where defense strategies are breached, trace the scope of sensitive data leakage through data lineage mapping, and trigger secondary interception if the impact exceeds the preset range.

[0056] Model and twin iteration: Feeding back "event judgment results, handling results, and analysis conclusions" to two core components: Decision tree model: Update the weights of the evaluation dimensions of the model; Secure digital twin: Synchronizes the latest operating status, defense strategies, and data links of the platform to ensure that the virtual image is consistent with the actual platform.

[0057] The technical solution of the present invention has been described above with reference to the preferred embodiments shown in the accompanying drawings. However, it will be readily understood by those skilled in the art that the scope of protection of the present invention is obviously not limited to these specific embodiments. Without departing from the principles of the present invention, any equivalent modifications or substitutions made by those skilled in the art to the relevant technical features will fall within the scope of protection of the present invention.

Claims

1. A security supervision method for a public data operation platform, characterized in that, Includes the following steps: Deploy distributed probes on the public data operation platform to collect all elements of the platform's operation data in real time and store them in a secure data repository. Based on the real-time and historical data collected in the secure data repository, construct a secure digital twin that is synchronized with the public data operation platform. Deploy an API gateway on the public data operation platform to capture the context information of data access requests. Based on the context information, use a decision tree model to evaluate the operation scenario, user role, and data sensitivity of the data access request in real time, and generate appropriate de-identification rules. De-identify sensitive data according to the de-identification rules. Deploy a lightweight streaming anomaly detection engine at the edge of the API gateway to perform real-time feature monitoring of de-identification processing operations and data access requests, and to calculate confidence and determine events. When the confidence level is greater than the preset high threshold, it is judged as a high-confidence threat event, triggering immediate interception of data access requests; If the confidence level is less than or equal to the preset high threshold and greater than the preset low threshold, it is determined to be an abnormal event with low confidence, and the context information of the data access request is synchronized to the secure digital twin for analysis; if the confidence level is less than or equal to the preset low threshold, it is determined to be a normal event, and the data access request is approved. The event determination results, event characteristics, and handling results are fed back to the security digital twin and decision tree model for iterative updates.

2. The security supervision method for a public data operation platform according to claim 1, characterized in that, The full-element operational data includes at least data access requests, user behavior, network traffic, and system logs. The secure digital twin provides a virtual digital representation of the elements of the public data operation platform and updates the data collected by the distributed probes in real time based on a message queue. The elements include at least topology, data patterns, user permissions, and behavioral patterns.

3. The security supervision method for a public data operation platform according to claim 1, characterized in that, The context information includes at least the visitor's identity, access time, access location, access operation type, and access data sensitivity. When the API gateway captures the context information of the data access request, it extracts the numerical or categorical features of the context information and converts them into feature vectors, which are then input into the decision tree model. The decision tree model splits layer by layer from the root node to the leaf node to output a three-dimensional classification result of the feature vector's operation scenario, user role, and data sensitivity. Based on the three-dimensional classification result output by the decision tree model, the most suitable desensitization rule is matched from a predefined desensitization rule library.

4. The security supervision method for a public data operation platform according to claim 1, characterized in that, The lightweight streaming anomaly detection engine monitors the temporal, content, and behavioral characteristics of de-identification operations and data access requests in real time, and performs temporal anomaly detection based on a pruned Long Short-Term Memory (LSTM) network to capture abnormal patterns in the operation sequence. The LSTM network calculates the error value based on the difference between the predicted and true values ​​of the features, and obtains the confidence level through a Sigmoid function mapping.

5. A security supervision method for a public data operation platform according to claim 1, characterized in that, When a threat event is determined to be of high confidence, the API gateway will immediately intercept data access requests by modifying the gateway routing rules, and the immediate interception command will be synchronized to the data access middleware for collaborative interception via the RPC call protocol.

6. A security supervision method for a public data operation platform according to claim 1, characterized in that, When an anomaly is determined to be of low confidence, anomaly event synchronization and security analysis are performed within the secure digital twin. Specific operations include: A graph neural network is used to perform entity and relationship correlation analysis on synchronous abnormal events, and the intent of abnormal events is judged by combining the global user relationship graph. AI attack agents are used to simulate known and unknown attack paths within a secure digital twin. Sandbox tests are then conducted within the secure digital twin, within which the defense strategy deployed by the public data operation platform is implemented, to evaluate the security effectiveness of the defense strategy. In a secure digital twin, a scenario where defense strategies are breached is simulated, and the impact of sensitive data leaks is extrapolated through data lineage mapping.

7. A security supervision method for a public data operation platform according to claim 6, characterized in that, If the impact of a sensitive data breach exceeds a predetermined range, data access requests will be immediately blocked, and security policy instructions will be updated based on the security benefit assessment of the defense strategy; if the impact of a sensitive data breach is less than or equal to a predetermined range, data access requests will be allowed.

8. A security monitoring system for a public data operation platform, characterized in that: A security supervision method for a public data operation platform according to any one of claims 1-7, wherein the security supervision system for a public data operation platform comprises: The data acquisition layer collects all operational data of the public data operation platform by deploying distributed probes and stores it in a secure data repository. Based on the data in the secure data repository, a secure digital twin is constructed and synchronized. The intelligent desensitization layer captures the context information of data access requests through the API gateway and uses a decision tree model to evaluate the operation scenario, user role, and data sensitivity of the request in real time in order to generate and execute appropriate desensitization rules. The edge detection layer is deployed on the edge side of the intelligent desensitization layer. It uses a streaming anomaly detection engine to monitor data access requests and desensitization operations in real time, calculate confidence and determine events, and perform interception, release or reporting operations based on the event determination results. The feedback optimization layer receives abnormal event information reported by the edge detection layer, performs in-depth analysis in the secure digital twin, and feeds back the event judgment and handling results to the digital twin and the decision tree model to achieve iterative model updates.

Images