A privacy information protection method and system based on privacy leakage evaluation

Abstract

The application relates to the technical field of data privacy protection, and discloses a privacy information protection method and system based on privacy leakage evaluation. The method comprises the following steps: collecting multi-scene heterogeneous original interaction data, fusing and cleaning to form a user privacy behavior portrait, and identifying core data nodes and associated edges. Differentiated sensitivity weights are configured for privacy categories to which each node belongs, a dynamic evaluation grid is generated, and a panoramic risk topology map is aggregated. Through simulation of the flow and aggregation process of information in the topology map, a multi-dimensional leakage probability surface is calculated, and a privacy vulnerability index is determined accordingly. In combination with a risk tolerance boundary, a protection response action sequence is derived and integrated for each privacy category to form an executable reinforcement scheme. The method can evaluate complex leakage risks caused by data correlation and realize adaptive active protection.

Description

Technical Field

[0001] This invention relates to the field of data privacy protection technology, specifically to a privacy information protection method and system based on privacy breach assessment. Background Technology

[0002] Current privacy protection practices largely rely on pre-defined static rule bases or fixed sensitive data identifiers. These technologies typically employ uniform encryption or de-identification strategies for identified sensitive information. However, when faced with heterogeneous interactive data from various service scenarios, these methods struggle to effectively assess the dynamic relationships and contextual sensitivity within the data. Their protective actions often lag behind the actual evolution of privacy risks, lacking the ability to conduct real-time, differentiated risk assessments based on the actual value and relevance of data in specific business scenarios.

[0003] Another common flaw in existing technologies is that their risk assessment models are often discrete and isolated. They typically treat various types of privacy data as independent assessment objects, calculating the risk value of their individual leakage. This approach cannot characterize and quantify the cascading risks caused by the aggregation and transmission of privacy information in complex data flow networks. When attackers use the correlation between multiple low-sensitivity data nodes to conduct inference attacks, traditional protection systems based on single-point assessments are prone to failure and cannot provide early warnings of derivative privacy leakage paths arising from data aggregation. Summary of the Invention

[0004] The purpose of this invention is to provide a privacy information protection method and system based on privacy leakage assessment, so as to solve the problems mentioned in the background art.

[0005] To achieve the above objectives, the present invention provides a privacy information protection method based on privacy breach assessment, the method comprising:

[0006] Collect raw interaction data streams related to the target user, wherein the raw interaction data streams contain heterogeneous data generated in multiple service scenarios;

[0007] The original interactive data stream is fused and cleaned to form a structured user privacy behavior profile;

[0008] Based on the user privacy behavior profile, identify the core data nodes and related edges that constitute the privacy leakage path;

[0009] For each core data node, a differentiated sensitivity metric weight is configured based on the privacy category to which its data attributes belong, and a corresponding dynamic evaluation grid is generated for each privacy category based on the sensitivity metric weight.

[0010] Aggregate dynamic evaluation grids of all privacy categories to generate a panoramic risk topology map; based on the panoramic risk topology map, simulate the flow and aggregation process of privacy information in the panoramic risk topology map, and calculate the multidimensional leakage probability surface;

[0011] Based on the multidimensional leakage probability surface, determine the privacy vulnerability index at the current moment;

[0012] Based on the preset risk tolerance boundaries, the necessary protective response action sequences are derived for each privacy category, and all protective response action sequences are integrated to form an executable privacy hardening solution.

[0013] Preferably, the step of configuring differentiated sensitivity metric weights based on the privacy category to which the data attributes belong, and generating a corresponding dynamic evaluation grid for each privacy category based on the sensitivity metric weights, includes:

[0014] The data attributes of the core data nodes are analyzed, and the core data nodes are classified into multiple preset privacy categories;

[0015] Set a baseline weight coefficient for each privacy category; obtain the access frequency and derived data volume of the core data node within a preset historical period, and calculate the dynamic adjustment factor.

[0016] The baseline weight coefficients are weighted and fused with the corresponding dynamic adjustment factors to obtain the final sensitivity measurement weight for each privacy category;

[0017] Based on the magnitude of the sensitivity metric weight, the grid partitioning density of each privacy category is determined, wherein the higher the sensitivity metric weight, the greater the corresponding grid partitioning density of the privacy category;

[0018] For each privacy category, an evaluation grid cell with a hierarchical structure is established in its data value domain space according to its corresponding grid division density. Each evaluation grid cell records the range of data values ​​it covers and its current risk status, forming the dynamic evaluation grid.

[0019] Preferably, the aggregation of the dynamic assessment grid across all privacy categories to generate a panoramic risk topology map includes:

[0020] Extract the assessment grid units that record risk status from each dynamic assessment grid as the grid units to be aggregated; analyze the correlation between dynamic assessment grids of different privacy categories at the data level, including data origin, temporal sequence, or logical deduction; based on the correlation, establish directed connection links between the grid units to be aggregated of different privacy categories, the directed connection links have weight attributes, and the magnitude of the weight attribute characterizes the strength of privacy risk propagation along the directed connection links;

[0021] All mesh cells to be aggregated with established directed connection links, along with the directed connection links themselves, are laid out and rendered in a unified topology space. The mesh cells to be aggregated serve as topology nodes, and the directed connection links serve as topology edges, thereby generating the panoramic risk topology map. Each topology node in the panoramic risk topology map stores the identifier of its source privacy category and the risk status value of the original mesh cell.

[0022] Preferably, the step of simulating the flow and aggregation process of privacy information in the panoramic risk topology map and calculating the multidimensional leakage probability surface includes:

[0023] At least one simulated leakage source point is set in the panoramic risk topology map, which corresponds to a potential privacy information exposure entry point in actual business. Starting from the simulated leakage source point, multiple rounds of risk diffusion simulation are performed in the panoramic risk topology map according to the propagation intensity and direction indicated by the weight attributes of the topology edges. The number of steps and cumulative intensity of the risk signal reaching each topology node in each round of simulation are recorded. The frequency of the risk signal reaching each topology node in all simulation rounds is counted and converted into an initial leakage probability. The initial leakage probability is corrected by combining the risk state value of the original grid cell stored in the topology node to obtain the final leakage probability value of each topology node. All topology nodes are classified according to their privacy category and position in the value domain space, and the final leakage probability values ​​of topology nodes under the same privacy category are fitted into a continuous surface in three-dimensional space, which is the multidimensional leakage probability surface.

[0024] Preferably, the collection of raw interaction data streams related to the target user includes:

[0025] Asynchronously collect raw data packets containing clickstream, transaction records, location trajectories, and device information from application client and server logs and network probes used by target users. Perform timestamp alignment and format standardization on the collected raw data packets, remove noisy data and invalid fields, and form standard data records.

[0026] Based on preset user entity parsing rules, the standard data records from different data sources are associated and bound with the unique target user identity identifier to generate the original interactive data stream arranged in chronological order.

[0027] Preferably, the step of fusing and cleaning the original interaction data stream to form a structured user privacy behavior profile includes:

[0028] The original interactive data stream is divided into behavior slices, with each behavior slice covering a complete user operation session;

[0029] Within each behavior slice, extract the operation type, operation object, and operation environment context that represent the user's intent to form a behavior tuple;

[0030] By comparing behavioral tuples in multiple consecutive behavioral slices, repetitive behavioral patterns and abnormal deviation behaviors can be identified.

[0031] The identified behavioral patterns are matched against a pre-defined privacy behavior knowledge base to identify behavioral tuples involving sensitive information.

[0032] Using the target user's identity identifier as the root node, and the marked behavioral tuples involving sensitive information and their associated context information as branches and leaves, a tree-structured user privacy behavior profile is constructed. Each node of the user privacy behavior profile includes behavior type, data content, and sensitivity level label.

[0033] Preferably, the step of identifying the core data nodes and related edges constituting the privacy leakage path based on the user privacy behavior profile includes:

[0034] The tree structure of the user privacy behavior profile is traversed, and nodes with sensitivity level labels higher than a preset threshold are initially screened as candidate data nodes. The relationship between each candidate data node is analyzed. If two candidate data nodes are sequential in time and have a semantic information derivation or enhancement relationship, a directional connection is established between them as a candidate association edge. The connection tightness of each candidate association edge is calculated. The connection tightness is determined based on the frequency of behavior transfer between the two nodes, data similarity, and time interval. Candidate association edges with connection tightness higher than a preset value and their connected candidate data nodes are screened and identified as core association edges and core data nodes, which together constitute multiple potential privacy leakage paths.

[0035] Preferably, determining the privacy vulnerability index at the current moment based on the multidimensional leakage probability surface includes:

[0036] The overall leakage risk of each privacy category is obtained by integrating the multidimensional leakage probability surface corresponding to each privacy category.

[0037] The average leakage risk of the target user in each privacy category during the historical period is obtained. The overall leakage risk at the current moment is compared with the corresponding historical average leakage risk, and the risk change ratio is calculated.

[0038] Based on the sensitivity metric weight of each privacy category, the risk change ratios are weighted and summed to obtain a comprehensive value;

[0039] The comprehensive numerical value is input into a preset indexed mapping function, and the normalized privacy vulnerability index is output. The value range of the privacy vulnerability index is from zero to one.

[0040] Preferably, the step of combining a preset risk tolerance boundary to derive necessary protective response action sequences for each privacy category, and integrating all protective response action sequences to form an executable privacy hardening scheme, includes:

[0041] The privacy vulnerability index is compared with a preset risk tolerance boundary, which includes multiple level thresholds;

[0042] The required risk handling level is determined based on the comparison results. For each privacy category, they are ranked according to the magnitude of their overall leakage risk. Based on the required risk handling level, a set of ordered protection operations is selected from a pre-set response action library for a specified number of privacy categories with high risk levels. This constitutes the protection response action sequence for the privacy category, including data anonymization, access interception, permission revocation, or log enhancement. Conflicts in the timing and resource consumption of the protection response action sequences for each privacy category are coordinated, and a unified execution sequence and resource allocation plan are formulated. Finally, these are integrated into an executable privacy hardening solution containing specific operation instructions, execution conditions, and expected indicators.

[0043] Preferably, when the processor executes the computer program, it implements the steps of a privacy information protection method based on privacy leakage assessment as described in any of the preceding claims.

[0044] Compared with the prior art, the beneficial effects of the present invention are:

[0045] By configuring differentiated sensitivity metric weights for each privacy category and generating a dynamic evaluation grid, a deep binding between the risk assessment model and the specific attributes and contexts of the data is achieved. The weights can be dynamically adjusted based on the actual sensitivity of the data in a specific context, and the evaluation grid updates accordingly in real time. This allows risk assessment to move beyond static, universally applicable thresholds and dynamically reflect changes in the value and correlation strength of privacy data, thereby achieving a more refined and realistic quantitative perception of privacy breach risks.

[0046] By constructing a panoramic risk topology map and simulating the flow and aggregation of privacy information within it, discrete data nodes and their relationships are integrated into a dynamic risk network model. The multidimensional leakage probability surface calculated on this model can visually reveal the transmission and amplification effects of privacy risks along complex paths. This elevates risk assessment from judging isolated data points to a global simulation and probabilistic prediction of systemic leakage paths and derived risks, providing a quantitative analysis tool for identifying deep and hidden leakage threats caused by data association and aggregation. Attached Figure Description

[0047] Figure 1 This is a schematic diagram illustrating the working principle of the privacy information protection method based on privacy leakage assessment described in this invention.

[0048] Figure 2 A flowchart for generating a dynamic evaluation grid;

[0049] Figure 3 A flowchart for generating a panoramic risk topology map;

[0050] Figure 4 A bar chart showing the frequency distribution of privacy-sensitive behaviors;

[0051] Figure 5 A bar chart comparing the risk of privacy breaches across different categories. Detailed Implementation

[0052] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0053] Please see Figure 1This invention provides a privacy information protection method based on privacy leakage assessment. The method includes: collecting raw interaction data streams related to target users, which originate from various service scenarios and contain heterogeneous data; by fusing and cleaning the raw interaction data streams, the scattered and messy raw data can be transformed into a structured user privacy behavior profile; based on this profile, the core data nodes constituting the privacy leakage path and the related edges connecting these nodes can be identified; for each core data node, based on the privacy category to which its data attributes are classified, differentiated sensitivity measurement weights are configured, and these weights are used to generate a hierarchical structure for each privacy category. The system employs a dynamic evaluation grid for the structure; it aggregates the dynamic evaluation grids of all privacy categories to form a panoramic risk topology map that displays global risk relationships; based on this panoramic risk topology map, it simulates the flow and aggregation process of privacy information within it, and calculates a multidimensional leakage probability surface that characterizes the probability distribution of leakage risks under different dimensions; according to this surface, it can quantify and determine the privacy vulnerability index at the current moment; finally, combined with the preset system risk tolerance boundary, it derives the necessary protective response action sequence for each privacy category, and integrates these sequences into an executable privacy hardening scheme, thereby achieving targeted and dynamic protection of user privacy information.

[0054] In one embodiment of the present invention, see [reference] Figure 2 First, the data attributes of core data nodes are analyzed and categorized into several preset privacy categories, such as identity information, location information, and financial information. A baseline weight coefficient is assigned to each privacy category, reflecting the inherent sensitivity of that privacy type. Simultaneously, the access frequency and derived data volume of each core data node within a preset historical period are obtained. A dynamic adjustment factor is calculated using a preset calculation model, reflecting the node's recent activity and data diffusion. The baseline weight coefficient and the corresponding dynamic adjustment factor are weighted and fused to obtain the final sensitivity measurement weight for each privacy category. This weight is a comprehensive representation of both static baseline and dynamic changes. Based on the magnitude of the sensitivity measurement weight, the grid division density for each privacy category is determined; higher-weighted privacy categories have higher grid division densities for more refined risk assessment. For each privacy category, hierarchical evaluation grid units are established within its data value domain space according to its corresponding grid division density. Each evaluation grid unit is responsible for recording the range of data values ​​it covers and its current risk status. The collection of these grid units constitutes the dynamic evaluation grid for that privacy category.

[0055] In practical implementation, the data attributes of core data nodes are analyzed, and these nodes are categorized into several preset privacy categories. These categories include identity identification, financial transactions, location tracking, social relationships, and health and physiological conditions. A baseline weighting coefficient is assigned to each preset privacy category: 0.3 for identity identification, 0.25 for financial transactions, 0.2 for location tracking, 0.15 for social relationships, and 0.1 for health and physiological conditions. In some embodiments, the baseline weighting coefficient is set based on the potential impact level of privacy information leakage, which is quantified according to industry standards and regulations.

[0056] The access frequency and derived data volume of the core data node within a preset historical period are obtained to calculate the dynamic adjustment factor. The core data node "Home Address" has been accessed an average of 15 times per day over the past 7 calendar days, and the derived data volume is reflected in the generation of 3 new location-consumption joint records. The dynamic adjustment factor is calculated based on the normalized results of the access frequency and derived data volume, mapping the original values ​​to the [0,1] interval. The final value of the sensitivity metric weight is obtained by weighted fusion of the baseline weight coefficient and the corresponding dynamic adjustment factor. The weighted fusion formula is as follows:

[0057] ;

[0058] in: Represents the sensitivity metric weight. Represents the benchmark weighting coefficient. Represents a dynamic adjustment factor. This represents the baseline weighting coefficient fusion coefficient, which is a preset adjustment parameter with a value range between 0.5 and 0.7. It is used to control the contribution ratio of the baseline weight and the dynamic adjustment factor.

[0059] The grid density for each privacy category is determined based on the sensitivity metric weight. Privacy categories with higher sensitivity metric weights correspond to higher grid density, which in turn determines the number of evaluation grid units within the data value domain. For the identity-based privacy category, the sensitivity metric weight is calculated to be 0.32. The preset grid density mapping rule is to multiply the weight value by the base density coefficient 100, resulting in 32 evaluation grid units. For each privacy category, hierarchical evaluation grid units are established within the data value domain according to its corresponding grid density. In a specific implementation, the data value domain for financial transactions is the range of single transaction amounts in RMB [0, 10000]. This is divided into 20 evaluation grid units according to the grid density, with each evaluation grid unit covering a sub-value range of RMB 500.

[0060] Each evaluation grid cell records the range of data values ​​it covers and its current risk status. The current risk status is determined based on a comprehensive assessment of the number of abnormal accesses and illegal association attempts for data points within the evaluation grid cell. In a specific implementation, an evaluation grid cell covers a transaction amount range of [2000, 2500] yuan, and the current risk status recorded for this evaluation grid cell is "high risk." The determination is based on the fact that, within the most recent statistical period, the number of times transaction records within this amount range have been accessed by non-useful devices exceeds a threshold of 5. In some embodiments, the dynamic evaluation grid is stored and maintained in memory or a database as a two-dimensional matrix or tree structure, where the rows and columns of the matrix represent different dimensions or attributes of the data.

[0061] In one embodiment of the present invention, see [reference] Figure 3 The process involves extracting assessment grid cells with recorded risk states from each dynamic assessment grid and designating them as the grid cells to be aggregated. Subsequently, the data-level relationships between dynamic assessment grids of different privacy categories are analyzed, including data origin relationships, temporal sequence relationships, and logical derivation relationships. Based on the identified relationships, directed connections are established between the grid cells to be aggregated in different privacy categories. Each directed connection is assigned a weight attribute, the magnitude of which characterizes the strength of privacy risk propagation along the link. Finally, all the grid cells to be aggregated with established directed connections and the directed connections between them are laid out and rendered in a unified topology space, where the grid cells to be aggregated serve as topology nodes and the directed connections serve as topology edges, thereby generating a panoramic risk topology map. Each topology node in the generated panoramic risk topology map stores the identifier of its source privacy category and the risk state value recorded by its original grid cell.

[0062] In practice, dynamic assessment grids across all privacy categories are aggregated to generate a panoramic risk topology map. Assessment grid units recording risk status are extracted from each dynamic assessment grid as the units to be aggregated. Specifically, in the identity-based dynamic assessment grid, the "ID number" value domain marked as "high risk" is extracted; in the location-based dynamic assessment grid, the "home address frequently visited time period" value domain marked as "medium risk" is extracted; and in the financial transaction-based dynamic assessment grid, the "large-amount nighttime transactions" value domain marked as "high risk" is extracted. The relationships between dynamic assessment grids of different privacy categories at the data level are analyzed, including data origin relationships, temporal sequence relationships, or logical derivation relationships. In practice, the "home address" grid unit in the location trajectory category and the "delivery address" grid unit in the financial transaction category have a data source relationship; the "mobile phone number" grid unit in the identity identification category and the "contacts friends" grid unit in the social relationship category have a logical deduction relationship; and the "work unit location" grid unit in the location trajectory category and the "company email" grid unit in the identity identification category have a data source relationship.

[0063] Based on the identified relationships, directed connections are established between grid cells of different privacy categories to be aggregated. In specific implementation, a directed connection is established from the "Home Address" grid cell to the "Large Nighttime Transaction" grid cell, with the direction representing the probability of risk transmission from location information to transaction behavior. The directed connection has a weight attribute, the magnitude of which characterizes the strength of privacy risk propagation along the directed connection. The weight attribute is calculated using the following formula:

[0064] ;

[0065] in: The propagation strength weights represent the weights of directed connections. Represents the baseline relationship strength defined based on the relationship type. This represents the normalized value of the behavior transfer frequency from the source mesh cell to the target mesh cell. Represents the semantic similarity between the data covered by the source grid cells and the target grid cells. The normalized reciprocal representing the average time interval between two actions. , , These represent the frequency factor weight, similarity factor weight, and time decay factor weight, respectively, all of which are preset non-negative coefficients. In some embodiments, the baseline relationship strength... The value is 0.8 for data origin relationships, 0.6 for logical deduction relationships, and 0.5 for temporal sequence relationships.

[0066] In some embodiments, the weight attribute calculation of directed connection links only considers the strength of the association and the access frequency. A simplified calculation method is to directly multiply the baseline relationship strength by the behavior transfer frequency. All mesh cells to be aggregated and the directed connection links with established directed connection links are laid out and rendered in a unified topology space. In a specific implementation, a force-directed graph layout algorithm is used to spatially arrange the mesh cells to be aggregated and the directed connection links. In the force-directed graph layout algorithm, the repulsive force between nodes and the attractive force transformed from the weights of the directed connection links work together to form a stable layout. The mesh cells to be aggregated serve as topology nodes, and the directed connection links serve as topology edges, thereby generating a panoramic risk topology map. Optionally, the visual attributes of the topology nodes are associated with the risk state values ​​of the original mesh cells: high-risk states are represented by red circles, medium-risk states by yellow squares, and low-risk states by green triangles. The visual thickness of the topology edges is proportional to the magnitude of the weight attribute.

[0067] Each topology node in the panoramic risk topology graph stores the identifier of its source privacy category and the risk state value of the original grid cell. In a specific implementation, a topology node representing a "home address" records its internal attributes, including the source privacy category identifier "Location_Trajectory" and the original risk state value "High". It can be understood that the panoramic risk topology graph exists in memory as a graph data structure, with node and edge objects containing complete attribute fields. Optionally, the panoramic risk topology graph supports serialization and storage as a graphical file or network format for persistent storage and offline analysis of risk states.

[0068] In one embodiment of the present invention, at least one simulated leakage source point is set in the panoramic risk topology map. These source points correspond to potential privacy information exposure entry points in actual business scenarios. Starting from the simulated leakage source point, multiple rounds of risk diffusion simulation are performed in the panoramic risk topology map according to the propagation intensity and direction indicated by the weight attributes of the topology edges. During the simulation, the number of steps and cumulative intensity of the risk signal reaching each topology node in each round of simulation are recorded. The frequency of the risk signal reaching each topology node in all simulation rounds is counted, and this frequency is converted into the initial leakage probability of the node. Then, combined with the risk state value of the original grid cell stored in the topology node, the initial leakage probability is corrected to obtain the final leakage probability value of each topology node. All topology nodes are classified according to their privacy category and specific location in the value domain space. The final leakage probability values ​​of topology nodes under the same privacy category are fitted into a continuous surface in three-dimensional space. This surface is the multidimensional leakage probability surface. The raw data required for the above process is obtained by collecting raw interaction data streams related to the target user. Data collection is performed asynchronously from multiple sources, including application client and server logs used by the target user, and network probes, to obtain raw data packets containing clickstreams, transaction records, location trajectories, and device information. The collected raw data packets are then timestamped and standardized, and noisy data and invalid fields are removed to form standard data records. Based on preset user entity parsing rules, these standard data records from different data sources are associated and bound with unique target user identifiers, generating a raw interaction data stream arranged in chronological order.

[0069] In practical implementation, the calculation process of the multidimensional leakage probability surface is closely related to the collection method of the original interactive data stream. Raw data packets are asynchronously collected from application clients used by the target user, server logs, and network probes. Application clients collect clickstream data, including button click event sequences and page dwell times; server logs collect transaction record data, including transaction time, amount, and product information; and network probes collect device information data, including device model and network protocol fingerprint. The collected raw data packets undergo timestamp alignment and format standardization. This process converts timestamps from different sources to Greenwich Mean Time (GMT) and transforms unstructured log entries into standardized key-value pair records. Noise and invalid fields are removed from the raw data packets. Noise includes heartbeat data and debug logs, while invalid fields include internal test identifier fields and obsolete version compatibility fields, forming standard data records. Based on preset user entity parsing rules, standard data records from different data sources are associated and bound to a unique target user identifier. These user entity parsing rules achieve association by matching login session tokens with device hardware identifiers, generating a raw interactive data stream arranged in chronological order.

[0070] At least one simulated leakage source point is set in the panoramic risk topology map. The simulated leakage source point corresponds to the potential privacy information exposure entry point in actual business. In specific implementation, the simulated leakage source point is set as the "abnormal location login" grid cell marked as "high risk" in the location trajectory dynamic evaluation grid, and the "cross-border transaction attempt" grid cell marked as "medium risk" in the financial transaction dynamic evaluation grid. Starting from the simulated leakage source point, multiple rounds of risk diffusion simulation are carried out in the panoramic risk topology map according to the propagation strength and direction indicated by the weight attributes of the topology edges. In specific implementation, the number of simulation rounds is set to 1000 rounds. In each round of simulation, the risk signal starts from the simulated leakage source point and propagates to adjacent topology nodes along directed connection links with a certain probability. The propagation probability is positively correlated with the weight attributes of the connection links. The number of steps and cumulative strength of the risk signal reaching each topology node in each round of simulation are recorded. The number of steps refers to the number of connection links traversed from the simulated leakage source point to the topology node, and the cumulative strength is the product of the weights of all connection links on the propagation path.

[0071] The frequency of risk signals reaching each topology node in all simulation rounds is statistically analyzed and converted into an initial leakage probability. In a specific implementation, a topology node representing a "home address" is reached by risk signals 750 times in 1000 simulation rounds, and its initial leakage probability is calculated to be 0.75. The initial leakage probability is corrected by combining the risk state values ​​of the original grid cells stored in the topology node, resulting in the final leakage probability value for each topology node. The correction process is implemented through a weighted function, specifically involving dynamically adjusting the initial leakage probability using the risk state values ​​of the original grid cells. The core of the weighted function is to combine the initial leakage probability with an adjustment factor derived from the risk state value. This adjustment factor adjusts its influence intensity through a risk state correction coefficient. In implementation, the system first obtains the risk state values ​​of the original grid cells stored in the topology node. This value is based on a comprehensive judgment of indicators such as the number of abnormal accesses and illegal association attempts of data points within the evaluation grid cell, and is quantified into preset weights. The risk state correction coefficient, as a configurable parameter, is used to control the degree to which the risk state amplifies or suppresses the probability correction. During calibration, the system calculates the adjustment amount based on the weight of the risk status value and the calibration coefficient, thereby generating the final leakage probability value to ensure that the leakage probability assessment more closely reflects the actual risk level. The calculation formula is as follows:

[0072] ;

[0073] in: This represents the final probability value of leakage. Represents the initial leakage probability. The numerical weights represent the risk state values ​​of the original grid cells: 0.3 for high-risk states, 0.1 for medium-risk states, and 0 for low-risk states. This represents the risk status correction coefficient.

[0074] All topological nodes are categorized according to their privacy category and location in the value space. The final leakage probability values ​​of topological nodes within the same privacy category are then fitted into a continuous surface in three-dimensional space. In specific implementation, for topological nodes belonging to the location trajectory category, the x-coordinate and y-coordinate represent the discretized intervals of longitude and latitude, respectively, with the y-coordinate representing the final leakage probability value. A bicubic spline interpolation algorithm is used to fit these discrete points into a smooth surface, which is part of the multidimensional leakage probability surface corresponding to the location trajectory privacy category. Optionally, the coordinate axes in the three-dimensional space can be defined according to the attributes of the privacy category. For the financial transaction category, the x-coordinate can be the transaction amount interval, and the y-coordinate can be the transaction time interval. It can be understood that each privacy category will independently generate a corresponding multidimensional leakage probability surface, and the set of all surfaces completely depicts the risk distribution under different dimensions.

[0075] In one embodiment of the present invention, the original interactive data stream is divided into behavioral slices, each covering a complete user operation session. Within each behavioral slice, the operation type, operation object, and operation environment context that characterize the user's intent are extracted, forming a behavioral tuple. Behavioral tuples from multiple consecutive behavioral slices are compared to identify repetitive behavioral patterns and abnormal deviations. The identified behavioral patterns are matched against a preset privacy behavior knowledge base to mark behavioral tuples involving sensitive information. A tree-structured user privacy behavior profile is constructed using the target user's identity as the root node and the marked behavioral tuples involving sensitive information and their associated context information as branches and leaves; each node in this profile contains a behavior type, data content, and a sensitivity level label. Based on the formed user privacy behavior profile, its tree structure is traversed, and nodes containing sensitivity level labels higher than a preset threshold are initially selected as candidate data nodes. The relationships between candidate data nodes are analyzed; if two candidate data nodes are sequentially consecutive and semantically related by information derivation or enhancement, a directional connection is established between them as a candidate association edge. The connection density of each candidate edge is calculated, based on the frequency of behavior transitions between the two nodes, data similarity, and time interval. Candidate edges with connection density higher than a preset value and their connected candidate data nodes are selected and identified as core edges and core data nodes, respectively. These core elements together constitute multiple potential privacy leakage paths.

[0076] In implementation, the raw interactive data stream is divided into behavioral slices. Each behavioral slice covers a complete user operation session. The boundary of the operation session is defined by a preset session timeout or a specific session termination event. In the implementation, the session timeout is set to 30 minutes of no interactive activity. Session termination events include the user clicking "Logout" or the application being switched to the background for more than 10 minutes. Within each behavioral slice, the operation type, operation object, and operation environment context representing the user's intent are extracted to form a behavioral tuple. The operation type includes "click", "swipe", "input", and "payment". The operation object includes "product details page", "address edit box", and "credit card input form". The operation environment context includes "IP address", "device fingerprint", "current time", and "network type". Behavioral tuples from multiple consecutive behavioral slices are compared to identify repetitive behavioral patterns and anomalous deviations. Repetitive behavioral patterns are sequences of behavioral tuples containing "clicking the financial application icon," "checking account balance," and "transferring funds to a fixed contact" that occur consistently between 9:00 PM and 10:00 PM on weekdays. Anomalous deviations are behaviors within a single behavioral slice that include uncommon combinations such as "login from an unknown IP address," "changing the linked mobile phone number," and "applying for a large temporary credit limit." The identified behavioral patterns are matched against a pre-defined privacy behavior knowledge base to identify behavioral tuples involving sensitive information. Rules in the privacy behavior knowledge base that include "changing password," "linking a new payment tool," "checking historical bills," and "frequent location service calls" are considered to involve sensitive information. A behavioral tuple containing "entering an ID number" and "performing facial recognition verification" is marked as highly sensitive.

[0077] Using the target user's identity identifier as the root node, and the marked behavioral tuples involving sensitive information and their associated context information as branches and leaves, a tree-structured user privacy behavior profile is constructed. In the specific implementation, user "User_001" serves as the root node, and its first-level child nodes are the main sensitive behavior categories sorted by time, such as "identity authentication behavior," "financial transaction behavior," and "location access behavior." Under the "financial transaction behavior" node, specific behavioral tuple child nodes are further attached, such as "Time: 2023-10-01 22:15:00, Operation: Payment, Object: Luxury Mall Order, Context: Device A, VPN Connection." Each node in the user privacy behavior profile contains behavior type, data content, and sensitivity level label. The sensitivity level label is assigned a value based on the rule matching results of the privacy behavior knowledge base, such as "high," "medium," and "low."

[0078] Based on user privacy behavior profiles, core data nodes and related edges constituting privacy leakage paths are identified. The tree structure of the user privacy behavior profile is traversed, and nodes with sensitivity level labels higher than a preset threshold are initially screened as candidate data nodes. The preset threshold is set to "medium" sensitivity level, so all nodes marked as "high" and "medium" sensitivity levels are selected. The relationships between candidate data nodes are analyzed. If two candidate data nodes are sequentially consecutive and semantically related in terms of information deduction or enhancement, a directional connection is established between them as a candidate related edge (see Table 1).

[0079] Table 1: Candidate Data Node Association Analysis Table

[0080]

[0081] The connection tightness of each candidate association edge is calculated, and the connection tightness is determined based on a combination of the frequency of behavior transitions between the two nodes, data similarity, and time interval. Connection Tightness The calculation formula is:

[0082] ;

[0083] in: Represents the tightness of the connection. The normalized value representing the frequency of behavioral transitions between two candidate data nodes. This represents the semantic similarity of the data content contained in two candidate data nodes. This represents the average time interval between two actions. , , These are the frequency factor weight, similarity factor weight, and time decay factor weight, respectively, and are preset positive coefficients. Candidate related edges with a connection density higher than a preset value and their connected candidate data nodes are selected and confirmed as core related edges and core data nodes, respectively. In some embodiments, the preset connection density threshold is 0.6, and all... Candidate edges with a value greater than 0.6 are promoted to core edges, and the candidate data nodes at both ends of them are confirmed as core data nodes.

[0084] These core data nodes and core interconnected edges together constitute multiple potential privacy leakage paths. It can be understood that a privacy leakage path contains multiple sequentially connected core data nodes and core interconnected edges, depicting the trajectory of sensitive information potentially being exposed in a chain during user behavior.

[0085] See Figure 4This is a bar chart showing the frequency distribution of privacy-sensitive behaviors. It's a data visualization chart that tracks the frequency of six sensitive behaviors, including "entering ID number," "linking a new bank card," and "checking home address." These types of charts are commonly used in the privacy and security field to help analyze the distribution patterns of sensitive user actions, identify high-frequency risk behaviors, and provide data support for privacy protection strategies. From the perspective of behavior type and frequency, this data aligns with typical scenarios for user privacy behavior profiling.

[0086] In one embodiment of the present invention, the overall leakage risk of each privacy category is obtained by integral calculation on the multidimensional leakage probability surface corresponding to each privacy category. The average leakage risk of the target user for each privacy category over a historical period is obtained. The overall leakage risk calculated at the current moment is compared with the corresponding historical average leakage risk to calculate the risk change ratio. Based on the sensitivity measurement weight of each privacy category, the respective risk change ratios are weighted and summed to obtain a comprehensive value. This comprehensive value is input into a preset exponential mapping function to output a normalized privacy vulnerability index with a value range between zero and one. A privacy hardening scheme is generated by combining a preset risk tolerance boundary, which includes multiple level thresholds. The calculated privacy vulnerability index is compared with the thresholds of the risk tolerance boundary, and the required risk handling level is determined based on the comparison result. For each privacy category, it is sorted according to the magnitude of its overall leakage risk. Based on the required risk handling level, for a specified number of privacy categories with the highest risk levels, a set of ordered protection operations is selected from a preset response action library to constitute the protection response action sequence for that privacy category; the protection operations include data anonymization, access interception, permission revocation, or log enhancement. To resolve conflicts in timing and resource usage among the protection response sequences for various privacy categories, a unified execution sequence and resource allocation plan should be developed, ultimately integrating them into an executable privacy hardening solution that includes specific operational instructions, execution conditions, and expected metrics.

[0087] In practical implementation, a multidimensional leakage probability surface determines the privacy vulnerability index at the current moment. An integral operation is performed on the multidimensional leakage probability surface corresponding to each privacy category. This integration is conducted within the data value space defined by the surface. In this implementation, the multidimensional leakage probability surface for location trajectory privacy is defined in a three-dimensional space of longitude-latitude-probability value. A double integral is performed within a preset geofence to obtain the overall leakage risk of location trajectory privacy. The average leakage risk of the target user for each privacy category over a historical period is obtained. The historical period is set to the past 30 calendar days. The historical average leakage risk is obtained by calculating the moving average of the daily overall leakage risk. The overall leakage risk calculated at the current moment is compared with the corresponding historical average leakage risk to calculate the risk change ratio. In this implementation, the overall leakage risk of financial transaction privacy at the current moment is 15.7, and its average leakage risk over the past 30 days is 10.2. The calculated risk change ratio is (15.7-10.2) / 10.2≈0.539.

[0088] Based on the sensitivity metric weight of each privacy category, the risk change rate of each privacy category is weighted and summed to obtain a comprehensive value. The weighted summation formula is:

[0089] ;

[0090] in: This represents the combined value obtained after weighted summation. Represents the total number of privacy categories. The weight of the sensitivity metric for the k-th privacy category is represented. This represents the risk change rate for the k-th privacy category. In practice, assuming there are three privacy categories—identity information, location tracking, and financial transactions—with sensitivity weights of 0.35, 0.30, and 0.25 respectively, the calculated risk change rates are 0.2, 0.5, and 0.539. The comprehensive value... It is understandable that the higher the sensitivity weight of a privacy category, the greater the impact of its risk changes on the overall value. The overall value is input into a preset exponential mapping function, which outputs a normalized privacy vulnerability index. The exponential mapping function is a monotonically increasing function defined in the range [0,+∞) to [0,1], and the privacy vulnerability index ranges from zero to one.

[0091] Based on preset risk tolerance boundaries, necessary protective response action sequences are derived for each privacy category, and all protective response action sequences are integrated to form an executable privacy hardening scheme. The privacy vulnerability index is compared with the preset risk tolerance boundaries, which include multiple level thresholds. In specific implementation, three level thresholds are set for the risk tolerance boundaries: 0.3, 0.6, and 0.8. The required risk handling level is determined based on the comparison results. If the privacy vulnerability index is 0.35475, falling between 0.3 and 0.6, the required risk handling level is determined to be "medium." For each privacy category, it is ranked according to the magnitude of its overall leakage risk. In specific implementation, the ranking result is: financial transaction category has the highest risk, followed by location tracking category, and identity information category has the lowest risk.

[0092] Based on the required risk level, a set of ordered protective actions is selected from a pre-defined response action library for a specified number of privacy categories with the highest risk levels, forming a protective response action sequence for each privacy category. In specific implementation, the strategy corresponding to the "medium" risk level is to handle the top two privacy categories in terms of risk level. For financial transaction privacy, which has the highest risk level, the protective response action sequence selected from the response action library is "enhance the transaction log recording level," "trigger secondary verification for single transactions exceeding 5,000 yuan," and "temporarily freeze transaction requests from high-risk areas." For location trajectory privacy, which has the second highest risk level, the selected sequence is "blur the location information accuracy from meter-level to street-level" and "suspend sharing real-time location with third-party applications." Protective actions include data anonymization, access blocking, permission revocation, or log enhancement.

[0093] To coordinate conflicts in timing and resource usage among privacy protection response sequences across different privacy categories, a unified execution sequence and resource allocation plan is established. In implementation, both the "enhancing transaction log recording level" operation (for financial transactions) and the "blurring location information accuracy from meter-level to street-level" operation (for location tracking) require invoking the data anonymization engine. The system plans to allocate higher priority to the former and execute the latter immediately after its completion. The final result is an executable privacy hardening solution containing specific operational instructions, execution conditions, and expected metrics. Optionally, this executable privacy hardening solution can be distributed to relevant privacy protection execution components in the form of a structured task list or workflow script.

[0094] See Figure 5This is a bar chart comparing the risk of privacy leaks across different categories. It's a visualization tool used in privacy security assessment to show the changing risks of various privacy categories. It compares the current risk levels with historical average risk levels for three privacy categories: "financial transaction privacy," "location tracking privacy," and "identity information privacy." The data differences show that financial transaction privacy is currently the focus of risk management, with its risk deviating the most from historical levels, requiring priority allocation of protection resources. This type of chart is used in privacy risk assessments to help identify privacy categories with significantly increased risk, providing data support for subsequent targeted protection.

[0095] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0096] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A privacy information protection method based on privacy breach assessment, characterized in that, include: Collect raw interaction data streams related to the target user, wherein the raw interaction data streams contain heterogeneous data generated in multiple service scenarios; The original interactive data stream is fused and cleaned to form a structured user privacy behavior profile; Based on the user privacy behavior profile, identify the core data nodes and related edges that constitute the privacy leakage path; For each core data node, based on the privacy category to which its data attributes belong, differentiated sensitivity metric weights are configured, and a corresponding dynamic evaluation grid is generated for each privacy category based on the sensitivity metric weights, including: The data attributes of the core data nodes are analyzed, and the core data nodes are classified into multiple preset privacy categories; Set a baseline weight coefficient for each privacy category; obtain the access frequency and derived data volume of the core data node within a preset historical period, and calculate the dynamic adjustment factor. The baseline weight coefficients are weighted and fused with the corresponding dynamic adjustment factors to obtain the final sensitivity measurement weight for each privacy category; Based on the magnitude of the sensitivity metric weight, the grid partitioning density of each privacy category is determined, wherein the higher the sensitivity metric weight, the greater the corresponding grid partitioning density of the privacy category; For each privacy category, an evaluation grid unit with a hierarchical structure is established in its data value domain space according to its corresponding grid division density. Each evaluation grid unit records the range of data values ​​it covers and the current risk status, forming the dynamic evaluation grid. Aggregate dynamic evaluation grids of all privacy categories to generate a panoramic risk topology map; based on the panoramic risk topology map, simulate the flow and aggregation process of privacy information in the panoramic risk topology map, and calculate the multidimensional leakage probability surface; Based on the multidimensional leakage probability surface, determine the privacy vulnerability index at the current moment; Based on the preset risk tolerance boundaries, the necessary protective response action sequences are derived for each privacy category, and all protective response action sequences are integrated to form an executable privacy hardening solution.

2. The privacy information protection method based on privacy leakage assessment as described in claim 1, characterized in that, The dynamic assessment grid that aggregates all privacy categories generates a panoramic risk topology map, including: Extract the assessment grid units that record risk status from each dynamic assessment grid as the grid units to be aggregated; analyze the correlation between dynamic assessment grids of different privacy categories at the data level, including data origin, temporal sequence, or logical deduction; based on the correlation, establish directed connection links between the grid units to be aggregated of different privacy categories, the directed connection links have weight attributes, and the magnitude of the weight attribute characterizes the strength of privacy risk propagation along the directed connection links; All mesh cells to be aggregated with established directed connection links, along with the directed connection links themselves, are laid out and rendered in a unified topology space. The mesh cells to be aggregated serve as topology nodes, and the directed connection links serve as topology edges, thereby generating the panoramic risk topology map. Each topology node in the panoramic risk topology map stores the identifier of its source privacy category and the risk status value of the original mesh cell.

3. The privacy information protection method based on privacy leakage assessment as described in claim 1, characterized in that, The process of privacy information flowing and aggregating within the panoramic risk topology map is simulated to calculate a multidimensional leakage probability surface, including: At least one simulated leakage source point is set in the panoramic risk topology map, which corresponds to a potential privacy information exposure entry point in actual business. Starting from the simulated leakage source point, multiple rounds of risk diffusion simulation are performed in the panoramic risk topology map according to the propagation intensity and direction indicated by the weight attributes of the topology edges. The number of steps and cumulative intensity of the risk signal reaching each topology node in each round of simulation are recorded. The frequency of the risk signal reaching each topology node in all simulation rounds is counted and converted into an initial leakage probability. The initial leakage probability is corrected by combining the risk state value of the original grid cell stored in the topology node to obtain the final leakage probability value of each topology node. All topology nodes are classified according to their privacy category and position in the value domain space, and the final leakage probability values ​​of topology nodes under the same privacy category are fitted into a continuous surface in three-dimensional space, which is the multidimensional leakage probability surface.

4. The privacy information protection method based on privacy leakage assessment as described in claim 1, characterized in that, The collection of raw interaction data streams related to the target user includes: Asynchronously collect raw data packets containing clickstream, transaction records, location trajectories, and device information from application client and server logs and network probes used by target users. Perform timestamp alignment and format standardization on the collected raw data packets, remove noisy data and invalid fields, and form standard data records. Based on preset user entity parsing rules, the standard data records from different data sources are associated and bound with unique target user identifiers to generate the original interactive data stream arranged in chronological order.

5. The privacy information protection method based on privacy leakage assessment as described in claim 4, characterized in that, The process of fusing and cleaning the original interactive data stream to form a structured user privacy behavior profile includes: The original interactive data stream is divided into behavior slices, with each behavior slice covering a complete user operation session; Within each behavior slice, extract the operation type, operation object, and operation environment context that represent the user's intent to form a behavior tuple; By comparing behavioral tuples in multiple consecutive behavioral slices, repetitive behavioral patterns and abnormal deviation behaviors can be identified. The identified behavioral patterns are matched against a pre-defined privacy behavior knowledge base to identify behavioral tuples involving sensitive information. Using the target user's identity identifier as the root node, and the marked behavioral tuples involving sensitive information and their associated context information as branches and leaves, a tree-structured user privacy behavior profile is constructed. Each node of the user privacy behavior profile includes behavior type, data content, and sensitivity level label.

6. The privacy information protection method based on privacy leakage assessment as described in claim 5, characterized in that, The process of identifying core data nodes and related edges constituting the privacy leakage path based on the user privacy behavior profile includes: The tree structure of the user privacy behavior profile is traversed, and nodes with sensitivity level labels higher than a preset threshold are initially screened as candidate data nodes. The relationship between each candidate data node is analyzed. If two candidate data nodes are sequential in time and have a semantic information derivation or enhancement relationship, a directional connection is established between them as a candidate association edge. The connection tightness of each candidate association edge is calculated. The connection tightness is determined based on the frequency of behavior transfer between the two nodes, data similarity, and time interval. Candidate association edges with connection tightness higher than a preset value and their connected candidate data nodes are screened and identified as core association edges and core data nodes, which together constitute multiple potential privacy leakage paths.

7. The privacy information protection method based on privacy leakage assessment as described in claim 1, characterized in that, The step of determining the privacy vulnerability index at the current moment based on the multidimensional leakage probability surface includes: The overall leakage risk of each privacy category is obtained by integrating the multidimensional leakage probability surface corresponding to each privacy category. The average leakage risk of the target user in each privacy category during the historical period is obtained. The overall leakage risk at the current moment is compared with the corresponding historical average leakage risk, and the risk change ratio is calculated. Based on the sensitivity metric weight of each privacy category, the risk change ratios are weighted and summed to obtain a comprehensive value; The comprehensive numerical value is input into a preset indexed mapping function, and the normalized privacy vulnerability index is output. The value range of the privacy vulnerability index is from zero to one.

8. The privacy information protection method based on privacy leakage assessment as described in claim 7, characterized in that, The method combines a preset risk tolerance boundary, derives necessary protective response action sequences for each privacy category, and integrates all protective response action sequences to form an executable privacy hardening scheme, including: The privacy vulnerability index is compared with a preset risk tolerance boundary, which includes multiple level thresholds; The required risk handling level is determined based on the comparison results. For each privacy category, they are ranked according to the magnitude of their overall leakage risk. Based on the required risk handling level, a set of ordered protection operations is selected from a pre-set response action library for a specified number of privacy categories with high risk levels. This constitutes the protection response action sequence for the privacy category, including data anonymization, access interception, permission revocation, or log enhancement. Conflicts in the timing and resource consumption of the protection response action sequences for each privacy category are coordinated, and a unified execution sequence and resource allocation plan are formulated. Finally, these are integrated into an executable privacy hardening solution containing specific operation instructions, execution conditions, and expected indicators.

9. A privacy information protection system based on privacy breach assessment, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the privacy information protection method based on privacy leakage assessment as described in any one of claims 1 to 8.

Images