Data security classification and grading method and system based on AI

Abstract

The invention belongs to the technical field of data security, and particularly relates to an AI-based data security classification and grading method, which comprises the following steps of: firstly, collecting and preprocessing multi-source data of a database and a service system to generate structured metadata; packaging the metadata into a semantic chain, inputting the semantic chain into an AI large model, outputting a data table background inference result, and disassembling a preset rule base by the AI large model to generate a rule analysis result; then combining background and rule output, packaging a data security classification and grading model, executing attribute, background and rule three-layer verification on metadata fields, and outputting a classification and grading result and a judgment reason; and finally, through rule matching degree and business rationality quantitative evaluation, a qualified result enters a bank data security management process. According to the method, the problems of low manual annotation efficiency and insufficient regular matching accuracy in existing data classification can be solved.

Description

Technical Field

[0001] This invention belongs to the field of data security technology, and in particular relates to an AI-based data security classification and grading method and system. Background Technology

[0002] With the profound development of the digital economy, data has become a core strategic asset for enterprise operations and development. Especially in the financial sector, the data processed and stored by banking institutions on a daily basis includes a large amount of sensitive information such as customers' personal identification information (e.g., ID card numbers, bank card numbers), transaction records, and account balance information. The secure management of such data is not only directly related to the legitimate rights and interests of financial consumers, but also affects the stable operation of the financial order, and even relates to the implementation of the national data security strategy.

[0003] To standardize data security management, several laws and regulations have been issued, explicitly requiring data processors to take corresponding security protection measures based on data classification and grading results. For example, the State Financial Regulatory Commission issued the "Measures for the Management of Data Security of Banking and Insurance Institutions," which further refines the specific requirements for data classification and grading in the financial sector. It stipulates that banking institutions must classify data into different categories and levels based on dimensions such as data sensitivity and business importance, and formulate differentiated security control strategies for different levels of data to ensure data security throughout its entire lifecycle. Under this regulatory framework, conducting efficient and accurate data classification and grading has become a necessary prerequisite for banking institutions to meet compliance requirements and mitigate data security risks.

[0004] However, the two mainstream technical solutions currently used by banking institutions in data classification and grading practices both have insurmountable technical flaws, failing to simultaneously meet the dual requirements of regulatory compliance and actual business efficiency. The specific flaws are as follows: Firstly, a manual annotation approach is employed. This approach relies on professionals with financial business knowledge and an understanding of data classification and grading standards to manually read data metadata and, based on business experience, annotate the data categories and levels one by one. This approach has two major problems: Firstly, it is extremely inefficient. Banks typically have tens of thousands of data tables, each containing dozens of fields, making manual annotation time-consuming and unsuitable for business scenarios with rapidly growing data volumes. Secondly, it is costly. Recruiting, training, and managing professionals requires significant human resources investment, and the manual annotation process is susceptible to subjective differences in experience and fatigue, leading to inconsistent annotation results and further increasing the risk of subsequent data security management.

[0005] Secondly, a regular expression matching solution is adopted. This solution builds a rule engine, pre-sets keyword-based matching rules (e.g., data containing the keyword "ID number" is judged as highly sensitive data), and uses the rule engine to automatically match data metadata, thereby achieving data classification and grading. Compared with manual annotation, this solution has a significant improvement in processing efficiency. However, because the rule engine only has keyword matching capabilities and lacks semantic understanding and business scenario awareness capabilities, it cannot understand the business meaning and application scenarios behind the data, resulting in a serious lack of accuracy in the classification and grading results.

[0006] Therefore, existing technologies lack a solution that can balance efficiency and accuracy and achieve data classification and grading in conjunction with business scenarios. This makes it difficult to meet the data security management requirements of banking institutions under regulatory compliance and actual business needs. There is an urgent need to propose a new technical solution to solve the above-mentioned technical problems. Summary of the Invention

[0007] The technical problem solved by this invention is to provide an AI-based data security classification and grading method and system to address the issues of low efficiency of manual annotation and insufficient accuracy of regular expression matching in existing data grading and classification methods.

[0008] The basic solution provided by this invention is an AI-based data security classification and grading method, comprising: S1: Collect data from database storage and business system data, generate multi-source data, and preprocess it to generate structured metadata; S2: Generate a semantic chain from the structured metadata in the form of metadata information and task instructions, and submit it to the AI ​​big model. The AI ​​big model uses its semantic understanding capabilities in the financial field to perform reasoning and output background inference results. S3: Preset the rule base and input it into the AI ​​big model. The AI ​​big model performs semantic decomposition of the rule base and outputs the rule parsing results. S4: Based on the AI ​​big model processed by steps S2 and S3, it is encapsulated into a data security classification and grading model. The data security classification and grading model is called to perform field attribute verification, background verification and rule verification on each field in the structured metadata, and output the classification and grading results and the reason for the judgment. S5: Based on the matching degree of preset rules and the business rationality score, the classification and grading results are quantitatively evaluated, and the evaluation results that meet the requirements are directly entered into the bank's data security management process.

[0009] Furthermore, S1 includes: S1-1: Establish a connection with the middle platform system database through the JDBC protocol, execute the SHOW TABLES and DESCRIBE table name SQL statements, and collect the basic structure information of the data tables; S1-2: Call the CMBD system open API, pass in the unique identifier of the data table, and obtain the management attribute information of the business class to which the data table belongs; S1-3: Based on the basic structure information of the obtained data table and the management attribute information of the business class, perform null value filtering and redundancy judgment processing respectively, and output structured metadata.

[0010] Furthermore, S2 includes: S2-1: Divide the structured metadata into semantic chains of application scenarios, core uses and data types according to task instructions, input them into the AI ​​big model to extract scenario features, use features and data type features, and then perform quantitative encoding. S2-2: The AI ​​large-scale model sets a weight matrix based on the priority of financial business, and calculates the weighted score of the quantified and encoded scenario features, usage features, and data type features. The expression is as follows:

[0011]

[0012]

[0013] in, The total score for scene features. This represents the total number of scene feature items. For scene feature vectors, As scene feature weights; The total score is for the usage characteristics. This represents the total number of usage-related characteristics. For the purpose of feature vectors, Weights for usage characteristics; The total score for data type features. The total number of data type feature items. For data type feature vectors, Weights for data type features; S2-3: The AI ​​large model, based on preset threshold judgment rules, transforms the total score of scene features, the total score of purpose features, and the total score of data type features into background labels, and integrates and outputs the background inference results.

[0014] Furthermore, S2 also includes: S2-4: Based on historical labeled data, iteratively optimize the scene feature weights, usage feature weights, and data type feature weights respectively. The optimization objective is to minimize the error between the predicted label and the actual label, expressed as:

[0015] in, Indicates the first Update weights in the next iteration For the first The weight matrix of the next iteration. The learning rate, ranging from 0.01 to 0.1. This is the error loss function.

[0016] Furthermore, S3 includes: S3-1: Based on regulatory requirements, the regulatory requirements are further refined into scenarios in conjunction with the core business scenarios of banks, generating a mapping relationship including scenarios, data objects, and sensitivity, as well as a classification and grading rule base including exceptions. S3-2: Encapsulate the original rules in the classification and grading rule base in a structured format, and output a classification and grading rule in a unified format of rule ID + legal basis + scenario scope + data object + judgment condition + sensitivity level + exception case; S3-3: Input the classification and grading rules into the AI ​​big model. Based on the pre-trained semantic understanding ability in the financial field, the AI ​​big model performs semantic decomposition and rule conflict detection and correction on the classification and grading rules, and outputs the rule parsing results.

[0017] Furthermore, S4 includes: S4-1: Construct a security classification and grading model using the AI ​​model output from the background inference results of S2 and the AI ​​model output from the rule parsing results of S3. S4-2: Input structured metadata into the security classification and grading model, and perform linked judgments in the order of field attribute verification, background verification and rule verification. Each layer of verification is dynamically adjusted based on the results of the previous layer; output a standardized field classification and grading result report.

[0018] Furthermore, the standardized field classification and grading result report includes basic information, three-level verification details, final result, and judgment reason.

[0019] Furthermore, S5 includes: S5-1: Randomly select fields, determine the matching degree between their classification results and the rules in the preset rule base, and output the rule matching results; S5-2: Based on the degree of matching between the verification results of the enterprise's business specialists and the actual business use, output the business rationality result; S5-3: The rule matching result and the business rationality score are weighted and summed based on the rule matching degree weight and the business rationality score weight, and the final evaluation result is output. If the final evaluation result is within the preset score range, it will directly enter the bank's data security management process; otherwise, it will be manually verified.

[0020] An AI-based data security classification and grading system, applied to the aforementioned AI-based data security classification and grading method, includes a data acquisition module, a preprocessing module, a classification and grading decision module, and an accuracy assessment module, wherein: The data acquisition module is used to collect data from database storage and business systems, generating multi-source data; The preprocessing module is used to preprocess multi-source data and generate structured metadata; The classification and grading decision module first generates a semantic chain from structured metadata according to metadata information and task instructions, and submits it to the AI ​​big model. The AI ​​big model uses its semantic understanding capabilities in the financial field to perform reasoning and outputs background inference results. Then, a pre-set rule base is input into the AI ​​big model, which performs semantic decomposition of the rule base and outputs rule parsing results. Finally, the processed AI big model is encapsulated into a data security classification and grading model. The data security classification and grading model is called to perform field attribute verification, background verification, and rule verification on each field in the structured metadata, and outputs classification and grading results and judgment reasons. The accuracy assessment module is used to quantitatively evaluate the classification and grading results based on the matching degree of preset rules and the business rationality score, and the assessment results that meet the requirements are directly entered into the bank's data security management process.

[0021] The principle and advantages of this invention are as follows: This technical solution uses AI semantic understanding capabilities as its core support to construct a fully automated system encompassing "data preprocessing - classification and grading decision-making - result accuracy evaluation." First, database table structure information and data table ownership management information from the business system are collected through a specific protocol. After cleaning and noise reduction, structured metadata containing complete content such as field definitions, ownership systems, and data table comments is generated, providing a high-quality data foundation for subsequent decisions. Next, the structured metadata is encapsulated into a semantic chain and input into a large AI model. Leveraging the model's semantic understanding and reasoning capabilities in the financial field, it first infers the application scenarios, core uses, and data types of the data tables from a global perspective. Then, it deeply analyzes the preset classification and grading rules, clarifying rule definitions, judgment criteria, boundary ranges, and exceptions. Finally, combining the field's own information with the inferred business background, each field is classified and graded, and judgment reasons are generated. Finally, a specific scoring mechanism is used to dynamically evaluate the accuracy of the classification and grading results. Based on the evaluation score, it determines whether the results meet the requirements and the subsequent processing methods, forming a complete technical closed loop.

[0022] The advantages are: This solution effectively solves the core problems of low efficiency in manual annotation and insufficient accuracy in regular expression matching in existing data classification and grading methods. To address the inefficiencies of manual annotation, the solution automates the entire process, eliminating the need for professionals to annotate data one by one. This significantly reduces manpower and training costs, greatly improves the efficiency of data classification and grading, and can quickly adapt to the processing needs of massive data tables in institutions such as banks. To address the shortcomings of regular expression matching methods, such as lack of semantic understanding and inability to be combined with business scenarios for judgment, this solution relies on the semantic understanding and reasoning capabilities of AI large models. It can accurately infer the business background of data tables and make judgments based on deep matching of business background and rules. This avoids the problem of scenario misjudgment caused by relying solely on keyword matching, greatly improves the accuracy of classification and grading results, and ensures that data classification and grading not only comply with regulatory requirements but also adapt to the differentiated needs in actual business scenarios, providing reliable support for data security management. Attached Figure Description

[0023] Figure 1 This is a flowchart of an embodiment of the present invention; Figure 2 This is a functional block diagram of an embodiment of the present invention. Detailed Implementation

[0024] The following detailed description illustrates the specific implementation method: In this application, to ensure the stability and efficiency of the fully automated processing of the technical solution, a complete hardware and software environment must first be deployed, including: Hardware environment: The server is configured with 8 cores and 16GB of memory, supporting concurrent processing of up to 100 data tables, with a maximum number of fields per table. The database server uses MySQL 8.0 / Oracle 12c to store metadata of all business data tables of the banking institution; the CMDB system server uses Linux CentOS 7.9 to store management attribute information such as the business system and team to which the data tables belong.

[0025] Software environment: Developed using Java, integrating JDBC-driven data acquisition, and supporting mainstream databases such as MySQL, Oracle, and SQL Server; the AI ​​large-scale model uses a privately deployed model with semantic understanding capabilities in the financial field, such as a financial semantic model fine-tuned based on Llama 3, achieving high accuracy in semantic understanding. Single-field decision time Seconds; The results evaluation module is developed based on the Python language and integrates the Pandas library for data statistics and scoring calculations.

[0026] Rule base preparation: A classification and grading rule base conforming to the "Measures for the Management of Data Security of Banking and Insurance Institutions" is pre-built, containing four elements: "Scenario - Data Object - Sensitivity Level - Legal Basis". Example rules are shown below: Scenario Classification: Enterprise Real-Name Authentication Retention; Data Objects: Unified Social Credit Code, Enterprise Name; Sensitivity Level: High Sensitivity; Legal Basis: Article 28 of the Personal Information Protection Law; Scenario Classification: Customer account opening application; Data Objects: Customer ID number, bank card number; Sensitivity Level: Highly Sensitive; Legal Basis: Article 21 of the Data Security Law.

[0027] Therefore, based on the above-mentioned pre-set conditions, the embodiments of the technical solution of this application are basically as shown in the appendix. Figure 1 As shown: An AI-based data security classification and grading method, including: S1: Collect data from database storage and business systems, generate multi-source data, and preprocess it to generate structured metadata; examples of the collected data are shown below: #### Data Example Data table information: Source tracing system: Invoice middleware system Source Management System: Ticket System - User Center Database name: bs_user_default Instance type: mysql Table name: u_ecif_cert_apply Data Table Notes: Enterprise Real-Name Authentication Application Form Field definition: Name: id, Comment: Primary key ID Name: cert_apply_id, Note: Enterprise Real-Name Authentication Request Number Name: ecif_id, Comment: Customer ID Name: icredit_code, Note: Unified Social Credit Code Name: company_name, Note: Company name Name: employee_amount, Comment: Number of employees Name: create_date, Comment: Creation time Name: modify_date, Comment: Modification time Name: create_userid, Comment: Creator Name: modify_userid, Comment: Modifier Name: channel_no, Note: Real-name authentication channel number Name: apply_date, Comment: Application date Name: apply_source, Comment: Real-name authentication source: API, WEB.

[0028] Therefore, S1 includes: S1-1: Establish a connection with the middle platform system database through the JDBC protocol, execute the SHOW TABLES and DESCRIBE table name SQL statements to collect the basic structure information of the data table; as shown in the data example above, establish a connection with the "invoice middle platform system" database (database name: bs_user_default, instance type: MySQL) through the JDBC protocol, execute the SHOW TABLES and DESCRIBE table name SQL statements to collect the basic structure information of the data table "u_ecif_cert_apply", including field names (such as id, icredit_code), field comments (such as "primary key ID" "unified social credit code"), data types (such as int, varchar (20)), field length, etc.

[0029] S1-2: Call the CMDB system open API, passing in the unique identifier of the data table, to obtain the management attribute information of the business class to which the data table belongs; as in the data example above, call the CMDB system open API, passing in the unique identifier of the data table "Source System = Invoice Middle Platform System". Database name=bs_user_default The table name is set to "u_ecif_cert_apply". This retrieves management attribute information for the data table, including its business system (Niupiao System - User Center), team (Enterprise Customer Department), creation time, last update time, and data volume (10,000 records).

[0030] S1-3: Based on the obtained basic structure information of the data table and the management attribute information of the business class, perform null value filtering and redundancy judgment processing respectively, and output structured metadata; specifically, null value filtering is to calculate the "field integrity" of a single metadata record, and its expression is: Field Integrity Number of non-null fields Total number of metadata fields In this embodiment, the metadata of the "u_ecif_cert_apply" data table in the data example above contains 12 fields, including the source system, database name, table name, table comment, and 10 field definitions. All fields have no null values, ensuring complete field integrity. ,satisfy The effective threshold is used to retain this data.

[0031] Redundancy determination is based on an MD5 hash value generated from the combination of "originating system + database name + table name", as shown in the data example above. The system performs an MD5 hash (using the bill platform system, bs_user_default, and u_ecif_cert_apply) check and finds no duplicate hash values ​​in historical records. This ensures no redundancy and outputs the final metadata.

[0032] S2: Generate a semantic chain from the structured metadata according to the metadata information and task instructions, and submit it to the AI ​​big model. The AI ​​big model uses its semantic understanding capabilities in the financial field to perform reasoning and output the background inference results; S2 includes: S2-1: Divide the structured metadata into semantic chains of application scenarios, core uses and data types according to task instructions, input them into the AI ​​big model to extract scenario features, use features and data type features, and then perform quantitative encoding. S2-2: The AI ​​large-scale model sets a weight matrix based on the priority of financial business, and calculates the weighted score of the quantified and encoded scenario features, usage features, and data type features. The expression is as follows:

[0033]

[0034]

[0035] in, The total score for scene features. This represents the total number of scene feature items. For scene feature vectors, As scene feature weights; The total score is for the usage characteristics. This represents the total number of usage-related characteristics. For the purpose of feature vectors, Weights for usage characteristics; The total score for data type features. The total number of data type feature items. For data type feature vectors, Weights for data type features; In this embodiment, the weighted matrices of the quantized and encoded scene features, usage features, and data type features, based on the priority of financial business, are shown in the following tables, including Table 1 Scene Feature Vectors and Weights, Table 2 Usage Feature Vectors and Weights, and Table 3 Data Type Feature Vectors and Weights, respectively: Table 1 Scene Feature Vectors and Weights

[0036] Based on the above example design of scene feature vectors and their weight matrices, the range of the total scene feature score in this application is as follows: The higher the score, the more inclined they are to "real-name authentication scenarios".

[0037] Table 2. Application Feature Vectors and Weights

[0038] Based on the above example design of the use feature vector and its weight matrix, the range of the total score of the use feature in this application is within [range missing]. The higher the score, the more it indicates a preference for "business approval data storage purposes".

[0039] Table 3. Feature Vectors and Weights for Data Types

[0040] Based on the example design of the above data type feature vectors and weight matrices, the range of the total score of the data type features in this application is within the range of... The higher the score, the more likely it is to be "enterprise core identity information type".

[0041] S2-3: The AI ​​large model, based on preset threshold judgment rules, transforms the total score of scene features, the total score of purpose features, and the total score of data type features into background labels, and integrates them to output the background inference results; an example of scene label judgment is as follows:

[0042] When scene feature score When the score is 0.2-0.5, it is determined to be a core target scenario; when the score is 0.2-0.5, it is determined to be a related scenario; when the score is... When this happens, a manual check is triggered to rule out abnormal scenarios.

[0043] Example of determining the purpose label:

[0044] When the use feature score When the score is between 0.2 and 0.5, it is determined to be a core application; when the score is between 0.2 and 0.5, it is determined to be a basic application; when the score is between 0.5 and 0.5, it is determined to be a basic application. At that time, manual verification is triggered.

[0045] The following is an example of how to determine the data type label:

[0046] When data type feature score When the score is 0.3-0.6, it is determined to be core identity information; when the score is 0.3-0.6, it is determined to be business information. At that time, it is determined to be operation log information and does not require high-sensitivity control.

[0047] Meanwhile, to improve the adaptability of the above algorithm, the iterative update logic of the weight matrix is ​​improved, including: S2-4: Based on historical labeled data, iteratively optimize the scene feature weights, usage feature weights, and data type feature weights respectively. The optimization objective is to minimize the error between the predicted label and the actual label, expressed as:

[0048] in, Indicates the first Update weights in the next iteration For the first The weight matrix of the next iteration. The learning rate, ranging from 0.01 to 0.1, is used to control the step size for weight updates. The error loss function is cross-entropy loss, which is used to calculate the difference in probability distribution between the predicted label and the actual label. Therefore, by adopting this optimization logic, the algorithm can adaptively adjust the weights in different financial business scenarios, thereby further improving the accuracy of background inference.

[0049] Taking the collected data from the above data examples as examples, the background inference results are displayed, and the semantic chain example is as follows: Known metadata information: Source Business System: Niupiao System - User Center, Data Table Notes: Enterprise Real-Name Authentication Application Form, Fields include "Unified Social Credit Code", "Real-Name Authentication Request Number", and "Real-Name Authentication Channel Number", Data Volume: 10,000 records, Belongs to: Enterprise Customer Department.

[0050] Task instructions: 1. Infer the application scenario of this data table; 2. Infer the core purpose of this data table; 3. Infer the data type stored in the table.

[0051] Requirements: Based on the business logic of the financial field, output structured conclusions and explain the basis for the inferences.

[0052] The background inference results output by the large AI model are as follows: 1. Application Scenario: Enterprise customer real-name authentication application scenario; Inference Basis: The source business system is "Niupiao System - User Center", the data table annotation is clearly "Enterprise Real-Name Authentication Application Form", the fields include "Real-Name Authentication Request Number" and "Real-Name Authentication Channel Number", which is consistent with the real-name authentication business process before enterprise customers open an account, and the total score of the scenario features is also high. The assignment and calculation process is omitted during label determination. This is determined to be a scenario for enterprise real-name authentication applications; 2. Core Purpose: Stores all business data during the enterprise customer real-name authentication application process, supporting the approval and record traceability of real-name authentication business; Inference Basis: Fields include "Application Date," "Creator," and "Channel Number," allowing traceability of the application source and operator, meeting business approval and compliance audit requirements; Purpose Feature Score. The assignment and calculation process is omitted during label determination. This is determined to be related to business approval and record tracing. 3. Data Type: Core Enterprise Identity Information; Inference Basis: The field contains "Unified Social Credit Code" and "Enterprise Name," both of which are key information identifying the enterprise entity and conform to the definition of "core enterprise identity information" in the "Administrative Measures for Data Security of Banking and Insurance Institutions." Data type feature score. The assignment and calculation process is omitted during label determination. This was determined to be core identity information of the enterprise.

[0053] S3: Pre-set a rule base and input it into the AI ​​large model. The AI ​​large model performs semantic decomposition of the rule base and outputs the rule parsing results. S3 includes... S3-1: Based on regulatory requirements and combined with the core business scenarios of banks, the regulatory requirements are further refined into specific scenarios, generating a mapping relationship including scenarios, data objects, sensitivity, and regulatory basis, as well as a classification and grading rule base including exceptions. The relevant regulatory requirements include the *Data Security Law*, the *Personal Information Protection Law*, and the *Administrative Measures for Data Security of Banking and Insurance Institutions*, clearly defining data categories and sensitivity level classification standards. Core business scenarios such as account opening, transfers, loan approval, anonymized statistics, and historical data archiving further refine the regulatory requirements into specific scenarios, clarifying the mapping relationship between scenario, data object, and sensitivity. For example, in the scenario of customer account opening and retention, unanonymized ID card numbers / bank card numbers are considered highly sensitive data; in the scenario of anonymized statistical reports, only the first 6 digits plus the last 4 digits of the ID card number are retained as low-sensitivity data. For special business scenarios, such as test data, anonymized data, and third-party shared data, supplementary exception conditions for the rules can be added. For example, if a field comment contains a test identifier or is anonymized, even if it matches highly sensitive data keywords, the highly sensitive rule will not apply, and it should be judged as low-sensitivity non-production data.

[0054] S3-2: Encapsulate the original rules in the classification and grading rule base into a structured format, outputting a classification and grading rule in a unified format: Rule ID + Legal Basis + Scenario Scope + Data Object + Judgment Condition + Sensitivity Level + Exception Cases; Example as follows: Rule ID: R-FI-001 (FI represents the financial sector) Legal basis: Article 13 of the Measures for the Administration of Data Security of Banking and Insurance Institutions, Article 28 of the Personal Information Protection Law Scope of application: Real-name authentication and retention scenarios for enterprise customers (excluding anonymization, statistical analysis, and testing scenarios). Data objects: Unified Social Credit Code, Company Name, Legal Representative's ID Number (not anonymized) Judgment criteria: 1. Field comments do not contain "de-identification," "anonymization," or "testing" identifiers; 2. The data table belongs to a business system such as "User Center" or "Customer Management"; 3. The fields are used for "identity verification" or "business retention" (not statistical analysis). Sensitivity level: High sensitivity Exceptions: 1. If the field is only used for "internal compliance audit" and an access whitelist is set, it can be downgraded to medium sensitivity; 2. If the data has been stored for more than 7 years and has no business relevance, it should be judged as "archived data - low sensitivity".

[0055] S3-3: Input the classification and grading rules into the AI ​​model. Based on its pre-trained semantic understanding capabilities in the financial domain, the AI ​​model performs semantic decomposition and rule conflict detection and correction on the classification and grading rules, and outputs the rule parsing results. Specifically: First, the classification and grading rules are combined with task instructions and encapsulated into prompt words, clarifying the parsing objectives, output format, and quality requirements of the large AI model. Each prompt word should contain three parts: rule information, task instructions, and constraints. An example of the rule information is shown below: Rule ID: R-FI-001 (FI represents the financial sector) Legal basis: Article 13 of the Measures for the Administration of Data Security of Banking and Insurance Institutions, Article 28 of the Personal Information Protection Law Scope of application: Real-name authentication and retention scenarios for enterprise customers (excluding anonymization, statistical analysis, and testing scenarios). Data objects: Unified Social Credit Code, Company Name, Legal Representative's ID Number (not anonymized) Judgment criteria: 1. Field comments do not contain "de-identification," "anonymization," or "testing" identifiers; 2. The data table belongs to a business system such as "User Center" or "Customer Management"; 3. The fields are used for "identity verification" or "business retention" (not statistical analysis). Sensitivity level: High sensitivity Exceptions: 1. If the field is only used for "internal compliance audit" and an access whitelist is set, it can be downgraded to medium sensitivity; 2. If the data has been stored for more than 7 years and has no business relevance, it should be judged as "archived data - low sensitivity".

[0056] Example of a task instruction is as follows: 1. Deconstruct the "scenario boundaries" of this rule: Clarify which scenarios are applicable and which are excluded, and quantify the criteria for scenario determination; 2. Deconstruct the "data object boundary" of this rule: Clarify the criteria for determining data objects such as the "Unified Social Credit Code"; 3. Deconstruct the "priority of judgment conditions" of this rule: If multiple judgment conditions conflict, clarify the priority order; 4. Break down the "exceptional triggering conditions" of this rule: clarify the specific criteria for determining "internal compliance audit" and "storage exceeding 7 years"; 5. Output structured parsing results, and indicate the "source of basis" for each decomposition item.

[0057] Examples of constraints are as follows: 1. The analysis must conform to the business logic of the financial field and avoid deviating from the actual business scenarios of banks; 2. No new conditions or exceptions may be added that are not mentioned in the rules; only semantic decomposition of existing text is permitted. 3. If there are vague statements in the rules, the scope should be clarified based on industry practices.

[0058] After receiving the prompt words, the AI ​​big model, based on its pre-trained semantic understanding capabilities in the financial field, performs multi-level semantic decomposition of the rules, namely the structured extraction of rule elements: the five major elements in the rule, namely "scenario, data object, condition, level, and exception", are broken down into independent modules, and each module is labeled with "definition description, judgment basis, and boundary range". Priority ranking of conditional logic: For multiple decision conditions in a rule, the priority is determined through semantic association analysis to avoid condition conflicts in subsequent decisions; Industry-specific clarification of vague expressions: For vague expressions such as "system-like" and "related identifiers" in the rules, supplementary clarifications will be made based on general definitions in the banking sector.

[0059] Finally, to avoid logical conflicts during parallel parsing of multiple rules, the AI ​​large model performs rule conflict detection. The detection dimensions include: scene-data object matching relationship, judgment condition-sensitivity level mapping relationship, and exception case-main rule compatibility. The conflict judgment criteria are as follows: when two rules have "completely overlapping scene scope" and "completely identical data objects" but "different sensitivity levels" and no explicit priority label, they are judged as "high-priority conflict"; when the judgment ambiguity is caused by "partial overlap of scenes" or "partial association of data objects", they are judged as "low-priority conflict". For high-priority conflicts, the rules with the "highest level of legal basis" are prioritized for correction, such as the Personal Information Protection Law having a higher priority than internal industry rules. For low-priority conflicts, "scenario-specific conditions" are added, such as subdividing "real-name authentication scenarios" into "real-name authentication before account opening" and "real-name authentication during the account period," each corresponding to different rules. The corrected rules are then fed back to the rule base, forming a closed loop of "parsing-conflict detection-rule optimization."

[0060] Finally, to ensure that the analysis results comply with regulatory requirements, the AI ​​big data model calls the regulatory knowledge interface to perform compliance verification on the decomposed rules.

[0061] Therefore, the final output of the classification and grading rule parsing is a structured rule parsing report. This report must include four parts: basic rule information, element breakdown details, conflict detection results, and compliance verification conclusions. It must also have a uniform format and clear expression, and can be directly used as the input basis for subsequent classification and grading result determination.

[0062] S4: Based on the AI ​​model processed in steps S2 and S3, it is encapsulated into a data security classification and grading model. This model is then used to perform field attribute validation, background validation, and rule validation on each field in the structured metadata, outputting the classification and grading results and the rationale for the judgment. S4 includes: S4-1: Construct a security classification and grading model using the AI ​​big model output from the background inference results of S2 and the AI ​​big model output from the rule parsing results of S3; In this application, the security classification and grading model is based on the business background data output from step S2 and the structured rule data output from step S3. It is formed by a background-rule-field linkage judgment model through prompt word engineering encapsulation. It has the integrated capabilities of automatic field attribute verification, accurate background matching, and rule compliance adaptation. It can directly receive the structured metadata output from step S1 and output field-level classification and grading results and judgment reasons.

[0063] S4-2: Input structured metadata into the security classification and grading model, and perform linked judgments in the order of field attribute verification, background verification, and rule verification. Each layer of verification is dynamically adjusted based on the results of the previous layer; output a standardized field classification and grading result report, in which: The goal of field attribute validation is to confirm whether the basic attributes of the field to be judged conform to the definition of "data object" in the S3 rule, and to exclude fields with abnormal attributes. The validation logic is that if the field comment contains the keyword of data object in the S3 rule and the data type meets the rule requirements, the validation passes; otherwise, the validation fails and is judged as "not the target data object and not applicable to the current rule". Finally, the field attribute validation status and validation basis are output.

[0064] The goal of background validation is to confirm whether the S2 background of the data table to which the field to be judged belongs is consistent with the "scenario scope" of the S3 rule, and to exclude fields with mismatched scenarios. The validation logic is that if the S2 application scenario label is completely included in the applicable scenario of the S3 rule and there are no scenario features excluded by the S3 rule, then the validation passes; otherwise, the validation fails and other scenario rules need to be matched or marked "scenario mismatch, manual verification required". The final output results are: background validation status and validation basis.

[0065] The goal of rule validation is to determine the final classification and grading result of the field based on the results of the first two layers of validation, combined with the priority and exception cases of the S3 rule's judgment conditions; the validation logic is as follows: If the first two layers of verification pass: verify one by one according to the "judgment condition priority" of the S3 rule. For example, first verify "field comments have no desensitization mark", then verify "system affiliation meets the requirements". If all conditions are met, output the classification + grading result corresponding to the S3 rule. If an exception is triggered: If a field meets the exception conditions in S3, such as being stored for more than 7 years and having no business relevance, the classification result will be adjusted according to the exception rules, such as being downgraded from "high sensitivity" to "low sensitivity", and marked with "exception trigger identifier"; If either of the first two layers fails the validation, it is determined that "the current rule is not applicable" and other scenario rules in the rule base need to be matched. If there is no matching rule, it is marked as "rule needs to be manually added". Output results: rule verification status, verification basis.

[0066] After the final model completes the three-layer verification, it outputs a standardized "Field Classification and Grading Result Report". The report must include four parts: "Basic Information, Details of Three-Layer Verification, Final Result, and Reasons for Judgment", to ensure that the results are traceable and auditable.

[0067] S5: Based on the matching degree of preset rules and the business rationality score, the classification and grading results are quantitatively evaluated, and evaluation results that meet the requirements are directly entered into the bank's data security management process; S5 includes: S5-1: Randomly select fields, determine the matching degree between their classification results and the rules in the preset rule base, and output the rule matching results; in this embodiment, the rule matching degree weight ratio is... For example, five fields are randomly selected: icredit_code, company_name, employee_amount, create_date, and channel_no, and the degree of match between their rating results and the rules is checked. In this example, the results of all five fields completely match the rules, with a rule matching score of 10 points and a weighted score of... point.

[0068] S5-2: Based on the degree of matching between the enterprise business specialist's verification results and the actual business application, output the business rationality result; in this embodiment, the business rationality weight accounts for 40%. For example, the verification conclusion is: the highly sensitive fields are all core enterprise identity information, and the low-sensitivity fields are operation records or basic business information, which are completely consistent with the business purpose of the enterprise real-name authentication application form. The business rationality score is 10 points, and the weighted score is... point.

[0069] S5-3: The rule matching result and the business rationality score are weighted and summed based on the rule matching degree weight and the business rationality score weight, and the final evaluation result is output. If the final evaluation result is within the preset score range, it directly enters the bank data security management process; otherwise, it is manually verified. In this example, the final score is 6+4=10 points. According to the score range, 10-8 points is accurate, 7-6 points is good, and below 6 points is inaccurate. Therefore, the classification and grading result obtained in this embodiment is determined to be accurate, and no manual verification is required. It can directly enter the bank data security management process.

[0070] like Figure 2 As shown, in another embodiment of this example, an AI-based data security classification and grading system is also included, applied to the aforementioned AI-based data security classification and grading method. This system includes a data acquisition module, a preprocessing module, a classification and grading decision module, and an accuracy assessment module, wherein: The data acquisition module is used to collect data from database storage and business systems, generating multi-source data; The preprocessing module is used to preprocess multi-source data and generate structured metadata; The classification and grading decision module first generates a semantic chain from structured metadata according to metadata information and task instructions, and submits it to the AI ​​big model. The AI ​​big model uses its semantic understanding capabilities in the financial field to perform reasoning and outputs background inference results. Then, a pre-set rule base is input into the AI ​​big model, which performs semantic decomposition of the rule base and outputs rule parsing results. Finally, the processed AI big model is encapsulated into a data security classification and grading model. The data security classification and grading model is called to perform field attribute verification, background verification, and rule verification on each field in the structured metadata, and outputs classification and grading results and judgment reasons. The accuracy assessment module is used to quantitatively evaluate the classification and grading results based on the matching degree of preset rules and the business rationality score, and the assessment results that meet the requirements are directly entered into the bank's data security management process.

[0071] The above are merely embodiments of the present invention. Commonly known structures and characteristics are not described in detail here. Those skilled in the art are aware of all common technical knowledge in the field prior to the application date or priority date, are aware of all existing technologies in that field, and have the ability to apply conventional experimental methods prior to that date. Those skilled in the art can, under the guidance of this application, improve and implement this solution in combination with their own capabilities. Some typical known structures or methods should not be obstacles for those skilled in the art to implement this application. It should be noted that those skilled in the art can make several modifications and improvements without departing from the structure of the present invention. These should also be considered within the scope of protection of the present invention, and will not affect the effectiveness of the implementation of the present invention or the practicality of the patent. The scope of protection claimed in this application should be determined by the content of its claims, and the specific embodiments described in the specification can be used to interpret the content of the claims.

Claims

1. An AI-based data security classification grading method, characterized in that: Comprise: S1: collect database storage data and business system data, generate multi-source data, and pre-process to generate structured metadata; S2: generate semantic chains from structured metadata according to metadata information and task instructions, and submit them to an AI large model; the AI large model performs reasoning through financial domain semantic understanding capabilities and outputs background inference results; S3: preset a rule base and input it into the AI large model; the AI large model performs semantic disassembly on the rule base and outputs rule analysis results; S4: encapsulate the AI large model processed in steps S2 and S3 into a data security classification and grading model; call the data security classification and grading model to perform field attribute verification, background verification, and rule verification on each field in the structured metadata; and output classification and grading results and judgment reasons; S5: quantitatively evaluate the classification and grading results based on preset rule matching degree and business rationality score, and directly enter the evaluation results that meet the requirements into the bank data security management process.

2. The AI-based data security classification method of claim 1, wherein: The S1 comprises: S1-1: establish a connection with the database of the middle platform system through the JDBC protocol, execute the SHOW TABLES and DESCRIBE table name SQL statements, and collect the basic structure information of the data table; S1-2: call the CMBD system open API, input the unique identifier of the data table, and obtain the management attribute information of the business class to which the data table belongs; S1-3: based on the obtained basic structure information of the data table and the management attribute information of the business class, perform null value filtering processing and redundancy determination processing respectively, and output structured metadata.

3. The AI-based data security classification method of claim 1, wherein: The S2 comprises: S2-1: divide the structured metadata into semantic chains of application scenarios, core uses, and data types according to task instructions, input them into the AI large model to extract scene features, use features, and data type features, and perform quantitative coding; S2-2: the AI large model sets a weight matrix based on financial business priority, weights and calculates the scores of the quantitatively coded scene features, use features, and data type features, and the expression is: wherein, is a total score of scene features, is a total number of scene feature items, is a scene feature vector, is a scene feature weight; is a total score of use features, is a total number of use feature items, is a use feature vector, is a use feature weight; is a total score of data type features, is a total number of data type feature items, is a data type feature vector, is a data type feature weight; S2-3: the AI large model converts the total scores of the scene features, use features, and data type features into background labels based on preset threshold judgment rules, and integrates and outputs the background inference results.

4. The AI-based data security classification method of claim 3, wherein: The S2 further comprises: S2-4: iteratively optimize the scene feature weight, use feature weight, and data type feature weight based on historical annotation data, and the optimization target is to minimize the error between the predicted label and the actual label, and the expression is: wherein, denotes the update weight of the iteration, is the weight matrix of the iteration, is the learning rate, taking values from 0.01-0.1, is the error loss function.

5. The AI-based data security classification method of claim 4, wherein: The S3 comprises: S3-1: based on regulatory requirements, refine the regulatory requirements in combination with bank core business scenarios to generate a mapping relationship including scenarios, data objects, and sensitivity, as well as a classification and grading rule base including exception cases; S3-2: structure the original rules in the classification and grading rule base in a structured format, and output classification and grading rules in a unified format of rule ID + regulatory basis + scenario range + data object + judgment condition + sensitivity level + exception case. S3-3: input the classification and grading rules into the AI large model, and the AI large model performs semantic disassembly and rule conflict detection and correction on the classification and grading rules based on the pre-trained semantic understanding ability in the financial field, and outputs the rule analysis result.

6. The AI-based data security classification method of claim 5, wherein: The S4 includes: S4-1: the AI large model output by the background inference result of S2 and the AI large model output by the rule analysis result of S3 are used to construct a security classification and grading model; S4-2: input the structured metadata into the security classification and grading model, and perform linkage determination in the order of field attribute verification, background verification and rule verification, and each layer of verification is dynamically adjusted based on the result of the previous layer; output the standardized field classification and grading result report.

7. The AI-based data security classification method of claim 6, wherein: The standardized field classification and grading result report includes basic information, three-layer verification details, final result and judgment reason.

8. The AI-based data security classification method of claim 7, wherein: The S5 includes: S5-1: randomly extract a field, judge the matching degree of its classification result with the rules in the preset rule library, and output the rule matching result; S5-2: based on the matching degree of the enterprise business officer verification result and the actual business purpose, output the business rationality result; S5-3: based on the rule matching degree weight and the business rationality score weight, the rule matching result and the business rationality result are weighted and summed, and the final evaluation result is output; if the final evaluation result is in the preset score interval, it directly enters the bank data security management process, otherwise it is manually checked.

9. An AI-based data security classification grading system applied to an AI-based data security classification grading method according to any one of claims 1-8, characterized in that: It includes a data collection module, a preprocessing module, a classification and grading decision module, and an accuracy evaluation module, wherein: The data collection module is used to collect database storage data and business system data to generate multi-source data; The preprocessing module is used to preprocess the multi-source data to generate structured metadata; The classification and grading decision module is used to first generate a semantic chain from the structured metadata according to the metadata information and task instruction form, and submit it to the AI large model, and the AI large model performs reasoning through the semantic understanding ability in the financial field to output the background inference result; then a preset rule library is input into the AI large model, and the rule library is semantically disassembled by the AI large model to output the rule analysis result; finally, the processed AI large model is packaged into a data security classification and grading model, and each field in the structured metadata is subjected to field attribute verification, background verification and rule verification by calling the data security classification and grading model, and the classification and grading result and the judgment reason are output; The accuracy evaluation module is used to quantitatively evaluate the classification and grading result based on the preset rule matching degree and business rationality score, and the evaluation result meeting the requirements is directly entered into the bank data security management process.

Images