AI-based cross-border data security flow monitoring system

Abstract

The invention discloses an AI-based cross-border data security flow monitoring system. The system comprises a data acquisition and preprocessing module, a sensitive information identification module, a risk assessment module, an abnormal behavior early warning module and a dynamic adjustment module. The invention relates to the technical field of data security and artificial intelligence, in particular to an AI-based cross-border data security flow monitoring system, which has the following advantages: 1, the sensitive information identification accuracy is improved, and missed judgment and misjudgment are reduced; 2, dynamic risk assessment is realized, and cross-border scene changes are adapted; 3, capturing abnormal behaviors in real time, and intercepting safety risks in advance; and 4, the system has self-optimization capability, and long-term efficient operation of the system is guaranteed.

Description

Technical Field

[0001] This invention relates to the fields of data security and artificial intelligence technology, and in particular to an AI-based cross-border data security flow monitoring system. Background Technology

[0002] With the accelerating pace of globalization, cross-border data flows are becoming increasingly frequent. As a crucial factor of production, the secure flow of data is vital for enterprise development and national information security. However, existing cross-border data security flow monitoring systems face numerous challenges when dealing with massive amounts of heterogeneous cross-border data.

[0003] Regarding the identification of sensitive data, existing systems mostly employ rule-based identification methods, which are inaccurate for complex and ever-changing sensitive information types, easily leading to missed or false identifications. In terms of risk assessment, risk assessment models are mostly static, lacking adaptability and unable to accurately assess risks based on real-time changes in cross-border data flows. Regarding abnormal behavior early warning, warnings are often delayed, failing to promptly detect and prevent insecure cross-border data flows, thus failing to meet the needs of cross-border data security protection. Summary of the Invention

[0004] In view of this, the present invention aims to provide an AI-based cross-border data security flow monitoring system, which aims to solve the problems of inaccurate identification of sensitive data information, poor adaptability of risk assessment models, and delayed warning of abnormal behavior in existing cross-border data security flow monitoring systems, so as to achieve accurate, real-time and efficient monitoring of cross-border data security flow.

[0005] The technical solution of this invention is implemented as follows: A cross-border data security flow monitoring system based on AI includes a data acquisition and preprocessing module, a sensitive information identification module, a risk assessment module, an abnormal behavior early warning module, and a dynamic adjustment module; The data acquisition and preprocessing module is used to collect various types of data during cross-border data flow and preprocess them to obtain standardized data; The sensitive information identification module is used to identify sensitive information in standardized data; The risk assessment module is used to conduct risk assessment by combining multiple dimensions such as the results of sensitive information identification. The abnormal behavior early warning module is used to monitor data flow behavior and issue abnormal warnings; The dynamic adjustment module is used to dynamically adjust other modules based on the early warning results and the actual handling situation.

[0006] Preferably, the data collected by the data acquisition and preprocessing module includes data content, data transmission source, transmission destination, transmission time, and transmission frequency, and the preprocessing operations include cleaning, deduplication, and format conversion.

[0007] Preferably, the sensitive information identification module uses a BERT-BiLSTM-CRF model that integrates domain knowledge graphs to identify sensitive information, through the formula... The recognition result is calculated, where For input data, For domain knowledge graphs semantic enhancement vectors, This is a vector concatenation operation.

[0008] Preferably, the domain knowledge graph contains domain knowledge related to sensitive information related to cross-border data, including entities and relations related to personal identity information, trade secrets, and state secrets.

[0009] Preferably, the risk assessment module incorporates multi-dimensional features including sensitive information identification results, the security level of the cross-border destination of the data, data type, and transmission frequency to construct a dynamic risk assessment model based on reinforcement learning.

[0010] Preferably, the risk assessment module uses a formula Calculate the risk assessment value, where This is a risk assessment value. For the first The weights of each feature For the first Normalized values ​​of each feature Number of features, weights The algorithm dynamically adjusts based on actual feedback through reinforcement learning.

[0011] Preferably, the abnormal behavior early warning module uses a clustering algorithm to construct a model of normal data flow behavior pattern, calculates the distance between real-time behavior and normal behavior pattern model, and issues an abnormal behavior early warning when the distance exceeds a set threshold.

[0012] Preferably, the abnormal behavior early warning module uses the Euclidean distance formula. Calculate the distance, where For real-time behavior 1 eigenvalue, The corresponding number in the normal behavior pattern model The mean of each feature, The number of behavioral characteristics.

[0013] Preferably, the dynamic adjustment module dynamically adjusts the model parameters of the sensitive information identification module, the feature weights of the risk assessment module, and the threshold of the abnormal behavior early warning module.

[0014] Preferably, the clustering algorithm is the K-means clustering algorithm, which constructs a normal behavior pattern model through historical normal cross-border data flow behavior data, and obtains each cluster center as a representative of the normal behavior pattern.

[0015] The embodiments of the present invention have the following advantages due to the adoption of the above technical solutions: I. This invention uses a BERT-BiLSTM-CRF model that integrates domain knowledge graphs for sensitive information identification, which improves the accuracy of sensitive information identification and reduces the occurrence of missed and false identifications.

[0016] Second, the dynamic risk assessment model based on reinforcement learning can continuously optimize the risk assessment results based on historical data and real-time feedback, thereby enhancing the model's adaptability and making the risk assessment more accurate.

[0017] Third, the abnormal behavior early warning module can issue timely early warnings of abnormal behavior by constructing a normal behavior pattern model and calculating the distance between the real-time behavior and the model, thus avoiding the problem of delayed early warning.

[0018] Fourth, the dynamic adjustment module can dynamically adjust each module of the system according to the actual situation, which further improves the adaptability and accuracy of the system and ensures the secure flow of cross-border data.

[0019] The above overview is for illustrative purposes only and is not intended to be limiting in any way. In addition to the illustrative aspects, embodiments, and features described above, further aspects, embodiments, and features of the invention will become readily apparent from the accompanying drawings and the following detailed description. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a system module architecture diagram of the present invention; Figure 2 This is a diagram of the sensitive information identification model architecture of the present invention; Figure 3 This is a logic diagram of the risk assessment module of the present invention. Figure 4This is the abnormal behavior early warning logic diagram of the present invention. Detailed Implementation

[0022] In the following description, only certain exemplary embodiments are briefly described. As those skilled in the art will recognize, the described embodiments can be modified in various ways without departing from the spirit or scope of the invention. Therefore, the drawings and description are considered to be exemplary in nature and not restrictive.

[0023] It is important to note that terms such as "first," "second," "symmetric," and "array" are used only to distinguish between descriptive and positional descriptions and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, features specified with terms such as "first" or "symmetric" may explicitly or implicitly include one or more of that feature; similarly, when the quantity of certain features is not limited by words such as "two" or "three," it should be noted that such features also explicitly or implicitly include one or more features. In this invention, unless otherwise explicitly specified and limited, terms such as "installation," "connection," and "fixation" should be interpreted broadly; for example, they can refer to a fixed connection, a detachable connection, or an integral molding; they can refer to a mechanical connection, a direct connection, a welding connection, or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the accompanying drawings and specific circumstances.

[0024] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0025] like Figure 1-4 This invention provides an AI-based cross-border data security flow monitoring system, including a data acquisition and preprocessing module, a sensitive information identification module, a risk assessment module, an abnormal behavior early warning module, and a dynamic adjustment module; The data acquisition and preprocessing module is used to collect various types of data during cross-border data flow and preprocess them to obtain standardized data; The sensitive information identification module is used to identify sensitive information in standardized data; The risk assessment module is used to conduct risk assessments by combining multiple dimensions such as the results of sensitive information identification. The abnormal behavior early warning module is used to monitor data flow behavior and issue abnormal warnings; The dynamic adjustment module is used to dynamically adjust other modules based on the early warning results and actual handling situation; The present disclosure provides at least one embodiment of an AI-based cross-border data security flow monitoring system, which constructs a full-process monitoring system of "collection-identification-assessment-early warning-optimization", including a data collection and preprocessing module, a sensitive information identification module, a risk assessment module, an abnormal behavior early warning module, and a dynamic adjustment module, forming a closed-loop management.

[0026] The data acquisition and preprocessing module collects and preprocesses comprehensive information on cross-border data flows, providing standardized input for subsequent analysis. Its advantage lies in strengthening the data foundation, avoiding interference from dirty data, and improving the accuracy of downstream module analysis. The sensitive information identification module accurately identifies sensitive content in the data, pinpointing the source of risk and providing core evidence for risk assessment, serving as the primary checkpoint for ensuring data compliance. The risk assessment module integrates multi-dimensional features to quantify risks, making abstract risks "visible and quantifiable," supporting decision-makers in assessing data flow security. The abnormal behavior early warning module captures abnormal patterns in real time, intercepting risks at their "budding stage" and preventing security incidents from escalating. The dynamic adjustment module optimizes all modules in tandem, enabling the system to self-evolve and adapt to the dynamic changes in cross-border data scenarios. This system covers the entire lifecycle of cross-border data flows, solving the problems of "fragmented and static" traditional monitoring and achieving an upgrade from "passive response" to "proactive defense."

[0027] The data acquisition and preprocessing module acquires data including data content, data transmission source, transmission destination, transmission time, and transmission frequency. Preprocessing operations include cleaning, deduplication, and format conversion. The data acquisition and preprocessing module covers the "full-link, multi-dimensional" information of cross-border data flow, including basic metadata (data content, source IP / domain name, destination IP / domain name, etc.), behavioral time-series data (transmission start / end time, single transmission duration, transmission frequency, etc.), and traffic characteristic data (transmission data volume, bandwidth utilization, etc.).

[0028] Data collection is achieved through a combination of "active probes and passive log collection". Traffic probes are deployed at cross-border data transmission nodes to capture network layer data in real time. At the same time, business system logs are connected to supplement application layer context information. Its advantage is that it covers both the "network-application" perspective and avoids the blind spots of a single collection method.

[0029] Preprocessing operations include cleaning (identifying and filtering invalid data), deduplication (removing duplicates based on data hash values), and format conversion (unifying text encoding, standardizing time formats, aligning numerical units, etc.). Their advantages are respectively ensuring data availability, improving storage efficiency and analysis accuracy, making heterogeneous data comparable, and removing obstacles for cross-module collaborative analysis.

[0030] Through standardized preprocessing, the original "messy data" is transformed into a "clean, standardized, and analyzable" dataset, providing high-quality input for subsequent AI models and serving as the "first door" to ensuring the accuracy of the system.

[0031] The sensitive information identification module uses a BERT-BiLSTM-CRF model that integrates domain knowledge graphs to identify sensitive information, through a formula. The recognition result is calculated, where For input data, For domain knowledge graphs semantic enhancement vectors, This is a vector concatenation operation; Domain knowledge graphs contain domain knowledge related to sensitive information concerning cross-border data, including entities and relationships related to personally identifiable information, trade secrets, and state secrets; The sensitive information identification module adopts the BERT-BiLSTM-CRF model that integrates domain knowledge graphs to construct a three-layer identification system of "semantic understanding + sequence modeling + knowledge enhancement".

[0032] The BERT layer utilizes a pre-trained language model to mine semantic associations in the data, generating dynamic word vectors to solve the semantic loss problem of the traditional bag-of-words model; the BiLSTM layer models sequence data bidirectionally, capturing long-distance dependencies and enhancing contextual semantic understanding; the CRF layer introduces sequence labeling constraints to improve recognition accuracy; and domain knowledge graph enhancement constructs a cross-border sensitive information knowledge graph through vector concatenation (…). Injecting prior knowledge into the model can compensate for the lack of understanding of vertical domains by general semantic models.

[0033] formula middle, For knowledge graph input The semantic enhancement vector enables the model to possess both general semantic understanding and domain knowledge reasoning capabilities, solving the identification challenge of sensitive information with "multiple types and strong concealment" in cross-border scenarios.

[0034] Compared to traditional rule engines / single AI models, this model boasts advantages such as accurate identification (improved accuracy in identifying fuzzy semantics and combined sensitive features, with a false negative rate reduced by over 30%), domain adaptability (the knowledge graph can be dynamically expanded to quickly adapt to business changes, solving the problem of "difficulty in updating" rule models), and enhanced interpretability (the entity-relationship structure of the knowledge graph provides a traceability basis for the identification results, meeting the "interpretable identification" requirement in compliance audits). It is the core of the system's "risk identification" function, and accurate identification provides "targets" for subsequent risk assessment and early warning, reducing the risk of cross-border data leakage from the source.

[0035] The risk assessment module incorporates multi-dimensional features, including sensitive information identification results, the security level of the cross-border destination of the data, data type, and transmission frequency, to construct a dynamic risk assessment model based on reinforcement learning. The risk assessment module uses formulas Calculate the risk assessment value, where This is a risk assessment value. For the first The weights of each feature For the first Normalized values ​​of each feature Number of features, weights The algorithm dynamically adjusts based on actual feedback through reinforcement learning. The risk assessment module constructs a "5-dimensional, 20+ sub-features" assessment system, covering multiple dimensions including data, behavior, and environment.

[0036] Data dimensions include sensitive information type, quantity, and data complexity; behavioral dimensions include transmission frequency, transmission time, and transmission path; environmental dimensions include destination security level, source credibility, and historical risk records; dynamic features include data transmission rate changes and the proportion of burst traffic. Features are initially weighted using the Analytic Hierarchy Process (AHP), and then dynamically adjusted using reinforcement learning algorithms (such as the PPO algorithm). The formula... middle, The system is optimized in real time based on actual risk feedback, enabling risk assessment to adapt to the dynamic changes in cross-border scenarios. Traditional static assessment models suffer from problems such as "poor scenario adaptation and high misjudgment rate". This module achieves accurate risk quantification (risk score discrimination improved by 40%), real-time self-optimization (the model automatically adjusts weights every hour to adapt to dynamic scenarios), and risk predictability (identifying "potential high-risk behaviors" in advance, with warning time windows 2-3 hours ahead).

[0037] Output risk assessment value It serves as the core basis for the system's "risk decision-making," enabling cross-border data risks to be upgraded from "qualitative judgment" to "quantitative control," and supporting tiered response.

[0038] The abnormal behavior warning module uses a clustering algorithm to build a model of normal data flow behavior patterns, calculates the distance between real-time behavior and the normal behavior pattern model, and issues an abnormal behavior warning when the distance exceeds a set threshold. The abnormal behavior early warning module uses the Euclidean distance formula. Calculate the distance, where For real-time behavior 1 eigenvalue, The corresponding number in the normal behavior pattern model The mean of each feature, The number of behavioral characteristics; The clustering algorithm is K-means clustering, which constructs a normal behavior pattern model through historical normal cross-border data flow behavior data, and obtains each cluster center as a representative of the normal behavior pattern; The abnormal behavior early warning module adopts a two-stage approach of "offline modeling + real-time monitoring". The offline stage uses the K-means clustering algorithm to cluster historical normal cross-border data flow behavior, constructing... Each cluster contains the mean and distribution of features representing normal behavior patterns; in the real-time phase, features are extracted from the current data flow behavior using the Euclidean distance formula. Calculate the relationship with each normal cluster center If the distance exceeds a threshold (set based on the 95th quantile of the distance distribution of historical anomaly data), it is judged as abnormal behavior and an alert is issued. Compared with traditional "threshold alarms", this module has the advantages of behavior pattern adaptation (by clustering to mine "normal behavior boundaries" to avoid "one-size-fits-all" threshold misjudgment, reducing the false alarm rate by more than 50%), comprehensive coverage of anomaly patterns (identifying hidden abnormal behaviors), and real-time guarantee (alert delay is controlled within 1 minute, solving the "lag" problem of traditional alerts).

[0039] By using "normal behavior modeling - real-time distance calculation - threshold early warning," risks are intercepted "during transmission," which is a key link in the system's "proactive defense" and significantly reduces security incident losses compared to "post-transmission auditing."

[0040] The dynamic adjustment module dynamically adjusts the model parameters of the sensitive information identification module, the feature weights of the risk assessment module, and the thresholds of the abnormal behavior early warning module. The dynamic adjustment module constructs a closed loop of "feedback-analysis-optimization", covering the core modules of the system.

[0041] For the sensitive information identification module, cases of "missed identification" and "false identification" are automatically labeled and added to the model training set. Incremental training is triggered weekly to update model parameters, ensuring that the identification capability continuously evolves with business changes. For the risk assessment module, based on the correlation analysis of "risk assessment value - actual security event," weights are adjusted hourly using a reinforcement learning algorithm. The formula... Dynamically adapts to changes in cross-border scenarios; for the abnormal behavior early warning module, it statistically analyzes cases of "false alarms and missed alarms" and automatically adjusts the K-means clustering centers and distance thresholds to ensure that the normal behavior pattern model adapts to business fluctuations in real time. Traditional monitoring systems are "fixed once launched," while this module achieves system self-evolution (automatic iterative optimization without manual intervention), scenario adaptability (covering multiple scenarios and ensuring the control needs of different scenarios) and long-term cost control (reducing manual intervention by 70%, transforming system operation and maintenance from "passive firefighting" to "proactive optimization") through "multi-module linkage optimization."

[0042] This module is the "central brain" of the system. Through continuous optimization, it ensures that the system operates "accurately, efficiently, and adaptively" in complex scenarios of cross-border data flow, which is the foundation for the system to play its value in the long term.

[0043] In this embodiment, the present invention operates as follows: First, data collection and preprocessing are performed: Information such as data content, data transmission source, transmission destination, transmission time, and transmission frequency are collected extensively from transmission nodes and business systems involved in cross-border data flows. The collected data is then cleaned to remove noisy data (such as data with incorrect encoding or data corresponding to incomplete data packets) and irrelevant data (redundant information unrelated to cross-border data security flow monitoring); deduplication is carried out, removing duplicate data based on data hash values ​​and other methods; finally, format conversion is performed to standardize the data format to meet the processing requirements of subsequent modules, resulting in standardized data. Following this, sensitive information identification and risk assessment are performed: Standardized data is input into the sensitive information identification module, which uses a BERT-BiLSTM-CRF model that integrates domain knowledge graphs for sensitive information identification. First, the BERT model extracts semantic features from the data, then the BiLSTM model captures contextual semantic relationships. Domain knowledge graphs are then introduced to semantically enhance the BiLSTM output, and finally, sequence labeling is completed through the CRF layer to identify sensitive information. Next, the sensitive information identification results, along with multi-dimensional features such as the cross-border destination security level, data type, and transmission frequency of the data, are input into the risk assessment module. Calculate the risk assessment value, where This is a risk assessment value. For the first The weights of each feature For the first Normalized values ​​of each feature To determine the number of features, feature weights are dynamically adjusted using reinforcement learning algorithms. This enables the assessment of risks associated with cross-border data flows and outputs the risk assessment results. Finally, there's the abnormal behavior early warning and dynamic adjustment module: This module utilizes clustering algorithms (such as K-means clustering) to construct a model of normal data flow patterns based on historical normal cross-border data flow behavior, obtaining cluster centers as representatives of normal behavior patterns. When monitoring real-time cross-border data flow behavior, behavioral features are extracted and analyzed using Euclidean distance... The system calculates the distance between real-time behavior and the normal behavior pattern model. If the distance exceeds a set threshold, an abnormal behavior warning is issued. The dynamic adjustment module adjusts the model parameters of the sensitive information identification module (such as the training parameters of the BERT-BiLSTM-CRF model) and the feature weights of the risk assessment module based on the warning results and actual processing conditions. The thresholds of the abnormal behavior early warning module are dynamically adjusted to ensure that the system continuously, accurately, and efficiently monitors the secure flow of cross-border data.

[0044] The following are several other specific embodiments of the application of this invention: Example 1: Optimization Scheme for Abnormal Behavior Early Warning Based on DBSCAN Clustering This embodiment optimizes the abnormal behavior early warning module for scenarios with uneven density of cross-border data flow behavior (such as high-frequency transmission during office hours and low-frequency legitimate transmission outside of office hours): 1. Data Acquisition and Preprocessing: The data collection dimensions are the same as the core solution, but the focus is on the correlation features of "transmission time-behavior density" (such as marking legitimate behaviors such as "transmission between 2-4 am" and "transmission frequency ≤ 3 times per day"). During preprocessing, "time window density statistics" are added (transmission frequency is counted according to 1-hour windows and used as a new feature input).

[0045] 2. Sensitive Information Identification and Risk Assessment: The module logic is the same as the core solution, but in the risk assessment model, "transmission time window density" is used as an independent feature in the weighted calculation (the formula R adds w density × f density, and the weights are adapted to day and night differences through reinforcement learning).

[0046] 3. Abnormal Behavior Warning (DBSCAN replaces K-means): Offline modeling: The DBSCAN clustering algorithm (no need to preset the number of clusters, and identify normal behavior clusters by "density reachability") is used to cluster historical data according to "transmission frequency, time window density, and sensitive proportion" to discover complex patterns such as "low-density legitimate clusters" (such as a small amount of backup data at night) and "high-density compliant clusters" (such as high-frequency business transmission during the day).

[0047] Real-time monitoring: Calculate the "density distance" between real-time behavior and the core point of DBSCAN (integrating spatial distance and density deviation). When the distance exceeds the dynamic threshold (adaptively adjusted by density fluctuations within the cluster), an early warning is triggered.

[0048] Advantages: Compared to K-means, it fits the "normal behavior of non-spherical and uneven density" more accurately, reduces the situation of "legitimate low transmission at night being misjudged", and reduces the false alarm rate by 25%.

[0049] 4. Dynamically adjust and adapt: If DBSCAN clustering discovers a "legitimate transfer of the new density pattern" (such as a newly added "weekly backup every Saturday"), the dynamic adjustment module will automatically: Update the knowledge graph for sensitive information identification (mark this pattern as a "legitimate backup scenario"); Optimize the time window density weighting for risk assessment (reduce the risk score for this scenario).

[0050] Example 2: Customized Monitoring Solution for Cross-border E-commerce Scenarios This embodiment focuses on the scenario of "data flow (order information, user privacy, logistics data) on cross-border e-commerce platforms" and provides customized module extensions: 1. Data Acquisition and Preprocessing: The data collection dimensions have been expanded to include "order sensitive information" (such as buyer's ID number and the last four digits of credit card), "logistics and customs clearance data" (such as customs code and tariff amount), and "promotional activity markers" (major promotional period / regular period).

[0051] The preprocessing adds "e-commerce sensitive field extraction" (identifying "coupon codes and user purchase preference keywords" through regular expression matching) and performs compliance verification on "customs clearance data" (such as whether the format conforms to customs regulations).

[0052] 2. Sensitive information identification module expansion: The domain knowledge graph adds "e-commerce sensitive entities," linking relationships such as "coupon code → marketing sensitive," "user purchase preference → profile sensitive," and "customs code → regulatory sensitive."

[0053] The model training incorporates "e-commerce specific corpus" (such as platform agreement text and promotional rules) to enhance the recognition of scenario-sensitive information such as "100-20 discount coupon" and "bonded warehouse code B01".

[0054] 3. Scenario-based optimization of the risk assessment module: The multi-dimensional features now include "Platform Credit Rating" (third-party institution scoring) and "Promotional Activity Weight" (dynamically relaxed transmission frequency threshold during major promotional periods).

[0055] In the risk formula R, the weight w of the "promotion activity" feature is dynamically adjusted with the promotion cycle (e.g., during Double 11, w of promotion is temporarily reduced by 30% to avoid misjudging normal promotion data as high risk).

[0056] 4. Abnormal Behavior and Dynamic Adjustment: The anomaly warning focuses on "e-commerce specific risks", such as "bulk export of user order data before major promotions" and "data tampering during customs clearance (abnormal changes in customs codes)".

[0057] Dynamically adjust the associated "e-commerce business cycle": automatically update the normal behavior model before major promotions (adapting to high-frequency transmission), and roll back the threshold after major promotions to ensure monitoring accuracy at different stages.

[0058] Example 3: Federated Learning-Driven Cross-Domain Collaborative Monitoring Scheme This embodiment addresses the scenario of "cross-border data transfer across multiple branches of multinational corporations (with high privacy compliance requirements)" and employs federated learning to solve the problems of "local data storage and collaborative model optimization": 1. Data Acquisition and Preprocessing (Localized): Each branch office collects data locally (e.g., the European branch collects EU user data, only transmitting encrypted feature vectors to avoid cross-border transmission of raw data), and after preprocessing, generates a "localized feature package" (e.g., sensitive information marking results, transmission behavior encoding).

[0059] 2. Sensitive Information Identification and Risk Assessment (Federated Training): Model training: A federated learning framework (such as the FedAvg algorithm) is used. Each branch trains the sensitivity identification model and risk assessment model locally and only uploads the model gradient parameters to the headquarters aggregation server.

[0060] Aggregation optimization: The headquarters aggregates gradients, updates the global model, and then distributes them back to each branch office to achieve "data not leaving the domain and model co-evolving" and avoid violating privacy regulations such as GDPR.

[0061] Advantages: Compared to centralized training, the risk of privacy leakage is reduced by 90%, while it can integrate data features from multiple regions (such as EU privacy rules and Asian business scenarios).

[0062] 3. Abnormal Behavior Warning (Federated Modeling): The normal behavior model is generated by each branch contributing its local normal mode (with encrypted transmission of cluster center parameters), which is then aggregated at headquarters into a "global normal behavior model" that takes into account regional differences (e.g., nighttime transmission in the European branch is abnormal, while nighttime operation and maintenance in the Asian branch is normal).

[0063] During real-time monitoring, branch offices first compare the model with the local normal model, and then synchronize the global model verification to reduce misjudgments.

[0064] 4. Dynamic adjustment (cross-domain collaboration): If a new compliant transmission mode is discovered in a certain region (such as the addition of a "cloud backup encrypted channel" in the Asia-Pacific region), the feature weights of this mode will be synchronized to the global model through federated learning, and other regions will automatically adapt, achieving "one-stop update, global collaboration".

[0065] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various variations or substitutions within the technical scope disclosed in the present invention, and these should all be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. An AI-based cross-border data security flow monitoring system, characterized in that, It includes a data acquisition and preprocessing module, a sensitive information identification module, a risk assessment module, an abnormal behavior early warning module, and a dynamic adjustment module; The data acquisition and preprocessing module is used to collect various types of data during cross-border data flow and preprocess them to obtain standardized data; The sensitive information identification module is used to identify sensitive information in standardized data; The risk assessment module is used to conduct risk assessment by combining multiple dimensions such as the results of sensitive information identification. The abnormal behavior early warning module is used to monitor data flow behavior and issue abnormal warnings; The dynamic adjustment module is used to dynamically adjust other modules based on the early warning results and the actual handling situation.

2. The AI-based cross-border data security flow monitoring system according to claim 1, characterized in that: The data acquired by the data acquisition and preprocessing module includes data content, data transmission source, transmission destination, transmission time, and transmission frequency. The preprocessing operations include cleaning, deduplication, and format conversion.

3. The AI-driven cross-cultural visual symbol generation method according to claim 1, characterized in that: The sensitive information identification module uses a BERT-BiLSTM-CRF model that integrates domain knowledge graphs to identify sensitive information, through the formula... The recognition result is calculated, where For input data, For domain knowledge graphs semantic enhancement vectors, This is a vector concatenation operation.

4. The AI-based cross-border data security flow monitoring system according to claim 3, characterized in that: The domain knowledge graph contains domain knowledge related to sensitive information related to cross-border data, including entities and relations related to personal identity information, trade secrets, and state secrets.

5. The AI-based cross-border data security flow monitoring system according to claim 1, characterized in that: The risk assessment module incorporates multi-dimensional features, including sensitive information identification results, the security level of the cross-border destination of the data, data type, and transmission frequency, to construct a dynamic risk assessment model based on reinforcement learning.

6. The AI-based cross-border data security flow monitoring system according to claim 5, characterized in that: The risk assessment module uses a formula Calculate the risk assessment value, where This is a risk assessment value. For the first The weights of each feature For the first Normalized values ​​of each feature Number of features, weights The algorithm dynamically adjusts based on actual feedback through reinforcement learning.

7. The AI-based cross-border data security flow monitoring system according to claim 1, characterized in that: The abnormal behavior early warning module uses a clustering algorithm to construct a model of normal data flow behavior patterns, calculates the distance between real-time behavior and the normal behavior pattern model, and issues an abnormal behavior early warning when the distance exceeds a set threshold.

8. The AI-based cross-border data security flow monitoring system according to claim 7, characterized in that: The abnormal behavior early warning module uses the Euclidean distance formula. Calculate the distance, where For real-time behavior 1 eigenvalue, The corresponding number in the normal behavior pattern model The mean of each feature, The number of behavioral characteristics.

9. The AI-based cross-border data security flow monitoring system according to claim 1, characterized in that: The dynamic adjustment module dynamically adjusts the model parameters of the sensitive information identification module, the feature weights of the risk assessment module, and the threshold of the abnormal behavior early warning module.

10. The AI-based cross-border data security flow monitoring system according to claim 7, characterized in that: The clustering algorithm is the K-means clustering algorithm, which constructs a normal behavior pattern model through historical normal cross-border data flow behavior data, and obtains each cluster center as a representative of the normal behavior pattern.

Images