A data monitoring method and system

Abstract

This invention relates to a data supervision method and system. The method includes the following steps: deploying multiple data extraction units within a data server according to the business type of the service entity, extracting business data corresponding to different business types; identifying entity objects from the extracted business data, constructing a sub-knowledge graph for the corresponding business type based on the identified entity objects, and determining neighboring sub-graphs; the service entity packages a target event and its associated data into a query request and uploads it to the data server; the data server receives the query request, selects the business type involved in the target event included in the query request, and combines the sub-knowledge graph for the corresponding business type and the neighboring sub-graphs into a dynamic knowledge graph; mapping the associated data to the dynamic knowledge graph, and performing semantic reasoning on the dynamic knowledge graph to obtain the sensitivity identification result of the data to be identified; and supervising the data of the target event based on the sensitivity identification result.

Description

Technical Field

[0001] This invention relates to a data monitoring method and system, belonging to the field of data management technology. Background Technology

[0002] In today's rapidly evolving information technology landscape, data is experiencing explosive growth, and its inherent value is becoming increasingly crucial, serving as a core driving force for development across various industries. Under these circumstances, the regulation of sensitive data has become a critical research area. Current methods for identifying sensitive data primarily rely on keyword matching, rule engines, and machine learning models. However, while these traditional technologies can identify sensitive data to a certain extent in practical applications, they suffer from high false positive rates and each has its own shortcomings, revealing numerous insurmountable drawbacks.

[0003] Current data verification and oversight solutions have the following shortcomings:

[0004] 1. Insufficient accuracy: Traditional methods rely heavily on static rules. Faced with the rapidly changing dynamic nature of data, traditional static rules are unable to accurately capture these dynamic changes, leading to frequent false alarms and missed alarms.

[0005] 2. Weak contextual understanding: Existing technologies have serious limitations in understanding the context of data. Traditional technologies find it difficult to accurately determine the sensitivity of data in different events based on different contexts.

[0006] 3. Severe Lack of Knowledge Association: Traditional methods often view business data in isolation, ignoring the relationships between different business data and contextual information, failing to fully uncover the deeper semantic value behind the data. Some sensitive information is often composed of multiple seemingly independent data fragments that are interconnected. Only by integrating these data fragments can their sensitivity and value be accurately determined. However, traditional methods, lacking the ability to analyze knowledge associations, struggle to do this. Summary of the Invention

[0007] To address the problems existing in the prior art, this invention proposes a data supervision method and system, aiming to overcome technical problems such as poor accuracy and lack of knowledge association.

[0008] The technical solution of the present invention is as follows:

[0009] On the one hand, this invention proposes a data supervision method, comprising the following steps:

[0010] Within the data server, multiple data extraction units are deployed according to the business type of the service subject, and each data extraction unit extracts business data corresponding to one business type.

[0011] Identify entity objects from the extracted business data, construct sub-knowledge graphs for the corresponding business types based on the identified entity objects, and determine the neighboring sub-graphs of each sub-knowledge graph.

[0012] The service provider packages the target event and its associated data into a query request and uploads it to the data server. The data server receives the query request, selects the business type involved in the target event included in the query request, and combines the sub-knowledge graph of the corresponding business type and the neighboring sub-graphs into a dynamic knowledge graph.

[0013] The associated data is mapped to a dynamic knowledge graph, and semantic reasoning is performed on the dynamic knowledge graph to obtain the sensitivity identification result of the data to be identified.

[0014] Based on the sensitivity assessment results and the pre-defined regulatory strategies for data with different levels of sensitivity, data related to the target event is regulated.

[0015] In a preferred embodiment, the method for determining the neighboring subgraphs of each sub-knowledge graph is specifically as follows:

[0016] The identified entity objects are defined as sub-graph nodes, and attribute lists and relationship lists of the corresponding sub-graph nodes are constructed based on entity attributes and relationships with other entities;

[0017] The feature vector of each sub-graph node is calculated using the attribute list and relation list of the sub-graph nodes.

[0018] The business relationship vector between any two sub-knowledge graphs is determined by the feature vectors of all sub-graph nodes in the sub-knowledge graphs.

[0019] The neighboring subgraphs of each sub-knowledge graph are determined based on the business relationship vector.

[0020] As a preferred embodiment, the method for determining the business relationship vector of two sub-knowledge graphs using the feature vectors of all sub-graph nodes in any two sub-knowledge graphs is as follows:

[0021] For the two selected sub-knowledge graphs, one sub-knowledge graph will be assigned a relationship perception weight to all sub-graph nodes in the other sub-knowledge graph;

[0022] The business relationship vector between the two sub-knowledge graphs is calculated using the relation-aware weights and the feature vectors of all sub-graph nodes in the corresponding sub-knowledge graph.

[0023] In a preferred embodiment, the step of combining the sub-knowledge graph of the corresponding business type and the neighboring sub-knowledge graph into a dynamic knowledge graph includes:

[0024] Construct a target event correlation matrix. The sub-knowledge graphs of the business types involved in the behaviors in the target event correlation matrix are listed as the neighboring sub-graphs corresponding to the sub-knowledge graphs of the business types involved.

[0025] The sub-knowledge graph that appears most frequently in the target event correlation matrix is ​​used as the central graph. The central graph is then associated with all its neighboring sub-graphs to form a dynamic knowledge graph.

[0026] As a preferred embodiment, the method for selecting the business type involved in the target event included in the query request is specifically as follows:

[0027] The current target event is input into the pre-trained LLM large model to obtain feedback results on the business types that the corresponding target event may involve, and the relevant business types are selected based on the feedback results.

[0028] In a preferred embodiment, in the step of performing semantic reasoning on the dynamic knowledge graph to obtain the sensitivity identification result of the data to be identified, semantic reasoning is performed using a GNN graph neural network.

[0029] As a preferred embodiment, the pre-defined monitoring strategies for data with different levels of sensitivity include:

[0030] Based on the sensitivity of the data, encryption, de-identification, and access control are applied to the data.

[0031] On the other hand, this invention also proposes a key domain data identification and protection system based on dynamic knowledge graphs, comprising:

[0032] The data extraction module is used to deploy multiple data extraction units within the data server according to the business type of the service subject. Each data extraction unit is responsible for extracting business data for one type of business.

[0033] The sub-knowledge graph construction module identifies entity objects from the extracted business data, constructs sub-knowledge graphs for the corresponding business types based on the identified entity objects, and determines the neighboring sub-graphs of each sub-knowledge graph.

[0034] The dynamic knowledge graph construction module is used to receive the query request within the data server when the service subject packages the target event and the associated data of the target event into a query request and uploads it to the data server. It selects the business type involved in the target event included in the query request and combines the sub-knowledge graph of the corresponding business type and the neighboring sub-graphs into a dynamic knowledge graph.

[0035] The data identification module is used to map related data to a dynamic knowledge graph and perform semantic reasoning on the dynamic knowledge graph to obtain the sensitivity identification result of the data to be identified.

[0036] The data monitoring module is used to monitor data related to target events based on the sensitivity identification results and pre-defined monitoring strategies for data with different levels of sensitivity.

[0037] In another aspect, the present invention also proposes an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the data monitoring method as described in any embodiment of the present invention.

[0038] In another aspect, the present invention also proposes a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the data monitoring method as described in any embodiment of the present invention.

[0039] Additional aspects and advantages of the invention will be set forth in the following description, and some of them will be obvious from the description, or may be learned by practicing the invention. Furthermore, various aspects and advantages of the invention may be realized and obtained by means of method steps and combinations particularly pointed out in the appended claims. Attached Figure Description

[0040] Figure 1 This is a flowchart of the method according to Embodiment 1 of the present invention. Detailed Implementation

[0041] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0042] It should be understood that the step numbers used in the text are for ease of description only and are not intended to limit the order in which the steps are performed.

[0043] It should be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0044] The terms “comprising” and “including” indicate the presence of the described feature, whole, step, operation, element and / or component, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or collections thereof.

[0045] The term “and / or” refers to any combination of one or more of the associated listed items, as well as all possible combinations, and includes these combinations.

[0046] Example 1:

[0047] See Figure 1 This embodiment proposes a data supervision method, including the following steps:

[0048] S100. To meet the needs of different business types of the service provider, this embodiment deploys multiple data extraction units on the data server. Each data extraction unit is specifically designed to extract and process data of a specific business type. These data extraction units, through deep learning algorithms and pre-training, are fed industry standards, corporate regulations, and industry business data of the service provider's industry during the pre-training process. Utilizing their accumulated knowledge, the trained data extraction units can extract entities, attributes, and relationships related to sensitive data. They can also perform in-depth analysis of industry standards and business documents, extracting key terms and definitions, thus laying a solid foundation for building a knowledge graph. Data extraction through these data extraction units effectively improves the efficiency and accuracy of business data extraction.

[0049] S200. Identify entity objects from the extracted business data. In this embodiment, Named Entity Recognition (NER) technology is used to identify entity objects in the data (such as "Cooperating Company AAA" and "Contract Signing Location City B"). A deep learning-based NER model, such as BERT-BiLSTM-CRF, is used to label the input data and identify the entities within it. For example, in the processing of business data, business behavior description text and business contracts are processed to identify various entities.

[0050] Each entity object is defined as a sub-graph node, and an attribute list and a relationship list for the corresponding sub-graph node are constructed based on the entity's attributes and relationships with other entities. In this embodiment, relationship extraction technology is used to extract the relationships between entities (e.g., "Cooperating Enterprise AAA - Business Transactions - Product C"). Based on a combination of remote supervision and deep learning, an existing public knowledge base is used as labeled data to train a relationship extraction model, extracting relationships between entities from the extracted business data. For example, the existing Product C knowledge base is used to train the model to extract relationships between entities in the imported text. The attribute list and relationship list of the sub-graph nodes are stored in the Neo4j graph database, and stored in Neo4j according to a scientific graph structure.

[0051] Meanwhile, this embodiment introduces Change Data Capture (CDC) technology, combined with real-time data stream processing technology (such as Apache Kafka), to dynamically update entities and relationships in the graph database. This allows the constructed knowledge graph to remain synchronized with dynamic data changes, effectively overcoming the problems of traditional methods that rely on static rules and struggle to adapt to dynamic data changes. It significantly improves the ability to track and identify dynamically sensitive data. For example, when a service provider is protecting intellectual property rights before a product goes public, changes in data such as product development costs, manufacturing costs, and the latest intellectual property achievements of industry competitors can be reflected in the knowledge graph in a timely manner, providing more accurate intelligence for intellectual property protection.

[0052] Sub-knowledge graphs corresponding to business types are constructed based on sub-graph nodes. This process determines the classification of each sub-graph node based on sub-graph nodes extracted and defined by different data extraction units. Then, the neighboring sub-graphs of each sub-knowledge graph are identified, that is, other closely related sub-knowledge graphs are identified. These neighboring sub-graphs may contain other business information that intersects with the current business type, or provide additional contextual information.

[0053] In the sub-knowledge graph, business domain knowledge is divided into a top-level business type layer, a middle-level entity layer (such as products, service objects, management personnel, and grassroots personnel), and a bottom-level attribute and relationship layer (such as product characteristics, consumer groups, management personnel's main business, and work location). This clear and reasonable hierarchical structure helps to significantly improve the query efficiency and reasoning accuracy of the knowledge graph.

[0054] S300: The service provider packages the target event and its associated data into a query request and uploads it to the data server. The data server receives the query request, selects the business type involved in the target event included in the query request, and combines the corresponding business type's sub-knowledge graph and neighboring sub-graphs into a dynamic knowledge graph. This dynamic knowledge graph not only contains the core information of the current target event but also integrates other closely related business information, thus providing a more comprehensive and in-depth perspective. By updating these sub-knowledge graphs and their neighboring sub-graphs in real time, the dynamic knowledge graph can reflect the latest developments of key domain events in real time, ensuring the timeliness and accuracy of the data. This step enables the overcoming of the limitations of traditional methods that view data in isolation in complex and ever-changing business environments. In scenarios such as intelligence analysis, it can integrate seemingly independent data fragments (such as contract records with partner companies, financial transaction records, and meeting location information) to accurately identify potentially sensitive data and comprehensively enhance the comprehensiveness of data supervision.

[0055] S400. Map the data to be identified for the target event to a dynamic knowledge graph. Specifically, in this embodiment, semantic embedding techniques (such as BERT, Graph-BERT) are used to map the data to be identified to the vector space of the dynamic knowledge graph. Taking BERT as an example, the data to be identified is input into the BERT model to obtain an accurate semantic vector representation of the data. Then, a designed projection matrix is ​​used to map it to the vector space of the dynamic knowledge graph, enabling the data to perform deep semantic matching with entities and relationships in the dynamic knowledge graph.

[0056] Semantic reasoning is performed on a dynamic knowledge graph to obtain the sensitivity assessment results of the data to be identified. This step utilizes the rich information and semantic relationships of the dynamic knowledge graph to conduct in-depth analysis and reasoning on the data to be identified. By comparing the similarity and relevance between the data to be identified and existing information in the graph, the system can automatically assess the sensitivity level of the data, such as highly sensitive, moderately sensitive, or low sensitive. This semantic reasoning is based not only on the literal meaning of the data but also considers the meaning and role of the data in a specific context, thereby improving the accuracy and comprehensiveness of the identification. The sensitivity assessment results are crucial for the subsequent formulation of data protection strategies, helping to take appropriate protection measures for data with different levels of sensitivity, ensuring the security and compliance of information.

[0057] S500: Based on the sensitivity identification results and the predetermined regulatory strategies for data with different sensitivity levels, regulate the data of the target event.

[0058] Based on the above implementation scheme, this embodiment breaks through the limitations of traditional technologies that view business data in isolation by using dynamic knowledge graphs, and realizes the construction of a combined knowledge graph that associates business data across multiple business areas. For example, when analyzing business cooperation events, it can not only identify the sensitivity of the business contract data of individual cooperating companies, but also accurately determine the sensitivity of the entire business cooperation-related data through the associated information such as business trip vehicle data and bank transaction data in neighboring subgraphs, greatly improving the accuracy and comprehensiveness of intelligence analysis. Furthermore, the constructed dynamic knowledge graph is dynamically combined based on target events, rather than a statically combined knowledge graph. When facing different target events, it can combine sub-knowledge graphs of different business types to address the knowledge information required for the current key domain events. For example, when facing commercial cases, it combines sub-knowledge graphs of commercial entities, transaction data, and contract dispute data; when facing intellectual property disputes, it combines sub-knowledge graphs of patent information, trademark registration information, and copyright information; when facing financial risk control events, it combines sub-knowledge graphs of financial transactions, customer credit investigation, and industry public opinion; and when facing safety production accidents, it combines sub-knowledge graphs of enterprise safety supervision, equipment operation and maintenance, and personnel operations, etc.

[0059] In a preferred embodiment of this example, in step S200, the method for determining the neighboring sub-graphs of each sub-knowledge graph is specifically as follows:

[0060] The feature vector of each sub-graph node is calculated using the attribute list and relation list of the sub-graph nodes; specifically, for any sub-graph node, the formula for calculating its feature vector is:

[0061] ;

[0062] in, Let represent the feature vector of the i-th sub-graph node in the m-th sub-knowledge graph. This represents the node attribute vector of the corresponding sub-knowledge graph. This represents the node relation vector of the corresponding sub-knowledge graph; where It is obtained from the attribute list of the corresponding sub-knowledge graph. It is obtained from the relation list of the corresponding sub-knowledge graph.

[0063] The business relationship vector between any two sub-knowledge graphs is determined by the feature vectors of all sub-graph nodes in the sub-knowledge graphs.

[0064] The neighboring subgraphs of each sub-knowledge graph are determined based on the business relationship vector.

[0065] In a preferred embodiment of this invention, the method for determining the business relationship vector is as follows:

[0066] For any two selected sub-knowledge graphs, one sub-knowledge graph will be assigned a relationship perception weight to all sub-graph nodes in the other sub-knowledge graph.

[0067] Calculate the business relationship vector between the two sub-knowledge graphs using the relation-aware weights and the feature vectors of all sub-graph nodes in the corresponding sub-knowledge graphs;

[0068] For example, for the first Individual knowledge graphs and the first The formula for calculating the business relationship vector in a sub-knowledge graph is:

[0069] ;

[0070] in, Indicates the first Individual knowledge graphs and the first Business relationship vectors of individual knowledge graphs Indicates the first The first in the individual knowledge graph The feature vectors of each sub-graph node Indicates the first Individual knowledge graphs for the first The first in the individual knowledge graph Relationship-aware weights are assigned to each subgraph node. For the first The total number of subgraph nodes in a knowledge graph.

[0071] The relation-aware weight can be calculated using the following formula:

[0072] ;

[0073] in, Indicates the first The first in the individual knowledge graph The feature vector of each sub-graph node; k is the feature vector of the first sub-graph node. The total number of subgraph nodes in a sub-knowledge graph; It is the sigmoid function; It is a logarithmic function.

[0074] In a preferred embodiment of this example, the step of combining the sub-knowledge graph of the corresponding business type and the neighboring sub-knowledge graph into a dynamic knowledge graph includes:

[0075] Construct a target event correlation matrix. The sub-knowledge graphs of the business types involved in the behaviors in the target event correlation matrix are listed as the neighboring sub-graphs corresponding to the sub-knowledge graphs of the business types involved.

[0076] After determining the relevance matrix of the target event, the next step is to analyze the frequency of occurrence of each sub-knowledge graph within the matrix. In this embodiment, the sub-knowledge graph with the most frequent occurrences is selected as the central graph, representing the most core and important business type in the target domain. Subsequently, the central graph is associated with all its neighboring sub-graphs. Through this association, a dynamic knowledge graph can be constructed. This dynamic knowledge graph not only reflects the core business corresponding to the target event but also demonstrates the connections and interactions between these businesses and other related businesses, thereby providing effective and rich knowledge information for knowledge reasoning in the target key domain.

[0077] As a preferred embodiment of this example, the method for selecting the business type involved in the target event included in the query request is specifically as follows:

[0078] The current target event is input into a pre-trained LLM model, which has been trained on a large amount of business data from service entities and related entities, giving it a deep understanding and analytical capability for business types. By inputting the target event into this model, the business types that may be related to the target event can be quickly and accurately identified. This method not only improves the efficiency of event processing but also ensures the accuracy and relevance of the selected business types. After receiving the feedback results, the business type information provided in the results can be further used to filter out the business types most closely related to the target event.

[0079] In a preferred embodiment of this invention, in the step of performing semantic reasoning on the dynamic knowledge graph to obtain the sensitivity identification result of the data to be identified, semantic reasoning is performed using a GNN graph neural network, and the specific steps include:

[0080] Leveraging the powerful message passing mechanism of GNNs, semantic information of nodes is efficiently propagated within dynamic knowledge graphs. Through interactions between nodes, potential sensitive information within the data can be inferred. For example, by analyzing nodes and relationships related to "XX product launch" in a dynamic knowledge graph, it is possible to accurately determine whether data concerning material procurement and product promotion constitutes sensitive information.

[0081] Subsequently, based on the semantic reasoning results of the GNN, the sensitive types of the data to be identified are labeled. Alternatively, security administrators can manually process the data to be identified and label it with its sensitive type, indicating whether the data is sensitive.

[0082] Graph reasoning algorithms can also be used to accurately identify potentially sensitive data. Taking the PageRank algorithm as an example, based on the connections between nodes in the knowledge graph, the PageRank value of each node is precisely calculated. Nodes with high PageRank values ​​and connections to known sensitive data nodes are considered potentially sensitive data. By continuously iterating and updating the PageRank values ​​of nodes, the accuracy of identifying potentially sensitive data is significantly improved. For example, in a dynamic knowledge graph, if a certain leader is known to be a sensitive node, the PageRank algorithm can be used to calculate the PageRank values ​​of other closely related staff nodes to filter out potentially sensitive individuals.

[0083] Finally, the classification results are provided to security management personnel for review and verification to confirm their accuracy. Security management personnel can modify the classification results or knowledge graph relationships based on actual business needs. Once the classification results are approved, the official classification results for the target event data are generated.

[0084] Based on the sensitive data classification results based on GNN inference, a further classification of sensitive data is performed using a context-aware model. The specific steps include:

[0085] Context-aware models are used to deeply analyze the contextual information of data. Taking the Transformer as an example, its unique multi-head attention mechanism weights information at different locations within the data, thereby accurately capturing the contextual features of the data. The data to be analyzed is divided into multiple word chunks, which are then input into the Transformer model. The model outputs the contextual representation of each word chunk for subsequent sensitivity assessment. For example, when analyzing the textual descriptions of production line monitoring videos, the Transformer accurately grasps the context by analyzing descriptive word chunks at different time points.

[0086] Subsequently, in the dynamic knowledge graph, context labels are added to each entity and relationship. When performing sensitivity assessments, the context category to which the data belongs is first accurately determined based on keywords and contextual clues in the data. Then, the sensitivity definitions of related entities and relationships in that context are queried in the dynamic knowledge graph for in-depth reasoning and judgment. For example, "In a product launch and promotion event, the product's warehouse address is sensitive information; in a normal product sales event, the same warehouse address may not be sensitive."

[0087] Based on the contextual reasoning results of a dynamic knowledge graph, the sensitivity level of the data being identified is labeled. Alternatively, security administrators can manually process the data to be identified and label its sensitivity level.

[0088] Finally, the classification results are provided to security management personnel for review and verification to confirm their accuracy. Security management personnel can modify the classification results or the relationships within the dynamic knowledge graph based on actual business needs. At this point, the identification of sensitive data in key areas driven by the dynamic knowledge graph is complete. The approved classification results officially generate the sensitive data identification results for the target event.

[0089] As a preferred embodiment of this invention, the predetermined protection strategies for data with different levels of sensitivity include:

[0090] Develop differentiated data protection strategies: For highly sensitive data, use high-strength encryption algorithms to ensure data security during transmission and storage; for moderately sensitive data, implement de-identification processing, retaining only some data characteristics to avoid leaking specific information; for low-sensitivity data, implement access control policies to restrict access permissions for unauthorized personnel and protect data from misuse.

[0091] In addition, the protection strategy includes data backup and recovery mechanisms to prevent data loss or corruption. Security managers need to back up sensitive data regularly and establish data recovery plans to ensure rapid recovery in the event of data loss or corruption, thus guaranteeing business continuity.

[0092] By formulating and implementing the above protection strategies, this embodiment achieves comprehensive protection of sensitive data in key areas, thereby improving data security and confidentiality.

[0093] Example 2:

[0094] This embodiment proposes a key domain data identification and protection system based on dynamic knowledge graphs, including:

[0095] The data extraction module is used to deploy multiple data extraction units within the data server according to the business type of the service subject. Each data extraction unit extracts business data corresponding to one business type. This module is used to implement the function of step S100 in Embodiment 1, which will not be described in detail here.

[0096] The sub-knowledge graph construction module identifies entity objects from the extracted business data, constructs sub-knowledge graphs for the corresponding business types based on the identified entity objects, and determines the neighboring sub-graphs of each sub-knowledge graph. This module is used to implement the function of step S200 in Embodiment 1, and will not be described in detail here.

[0097] The dynamic knowledge graph construction module is used to receive the query request within the data server when the service subject packages the target event and the associated data of the target event into a query request and uploads it to the data server. The module selects the business type involved in the target event included in the query request and combines the sub-knowledge graph of the corresponding business type and the neighboring sub-graphs into a dynamic knowledge graph. This module is used to implement the function of step S300 in Embodiment 1, which will not be described in detail here.

[0098] The data identification module is used to map related data to a dynamic knowledge graph and perform semantic reasoning on the dynamic knowledge graph to obtain the sensitivity identification result of the data to be identified. This module is used to implement the function of step S400 in Embodiment 1, which will not be described in detail here.

[0099] The data supervision module is used to supervise the data of the target event based on the sensitivity identification results and the predetermined supervision strategies for data with different sensitivity levels. This module is used to implement the function of step S500 in Embodiment 1, which will not be described in detail here.

[0100] Example 3:

[0101] This embodiment proposes an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the data monitoring method as described in any embodiment of the present invention.

[0102] Example 4:

[0103] This embodiment proposes a computer-readable storage medium storing a computer program that, when executed by a processor, implements the data monitoring method as described in any embodiment of the present invention.

[0104] In this application embodiment, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent the existence of A alone, A and B simultaneously, or B alone. A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one of the following" and similar expressions refer to any combination of these items, including any combination of singular or plural items. For example, at least one of a, b, and c can represent: a, b, c, a and b, a and c, b and c, or a and b and c, where a, b, and c can be single or multiple.

[0105] Those skilled in the art will recognize that the units and algorithm steps described in the embodiments disclosed herein can be implemented using electronic hardware, computer software, or a combination of electronic hardware and software. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0106] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0107] In the several embodiments provided in this application, any function, if implemented as a software functional unit and sold or used as an independent product, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0108] The above description is merely an embodiment of the present invention and does not limit the patent scope of the present invention. Any equivalent structural or procedural transformations made based on the content of the present invention's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. A data supervision method, characterized in that, Includes the following steps: Within the data server, multiple data extraction units are deployed according to the business type of the service subject, and each data extraction unit extracts business data corresponding to one business type. Identify entity objects from the extracted business data, construct sub-knowledge graphs for the corresponding business types based on the identified entity objects, and determine the neighboring sub-graphs of each sub-knowledge graph. The service provider packages the target event and its associated data into a query request and uploads it to the data server. The data server receives the query request, selects the business type involved in the target event included in the query request, and combines the sub-knowledge graph of the corresponding business type and the neighboring sub-graphs into a dynamic knowledge graph. The associated data is mapped to a dynamic knowledge graph, and semantic reasoning is performed on the dynamic knowledge graph to obtain the sensitivity identification result of the data to be identified. Based on the sensitivity assessment results and the pre-defined regulatory strategies for data with different levels of sensitivity, the data of the target event is monitored; Specifically, the method for determining the neighboring subgraphs of each sub-knowledge graph is as follows: The identified entity objects are defined as sub-graph nodes, and attribute lists and relationship lists of the corresponding sub-graph nodes are constructed based on entity attributes and relationships with other entities; The feature vector of each sub-graph node is calculated using the attribute list and relation list of the sub-graph nodes. The business relationship vector between any two sub-knowledge graphs is determined by the feature vectors of all sub-graph nodes in the sub-knowledge graphs. The neighboring subgraphs of each sub-knowledge graph are determined based on the business relationship vector; The step of combining the sub-knowledge graph of the corresponding business type and the neighboring sub-knowledge graph into a dynamic knowledge graph includes: Construct a target event correlation matrix. The sub-knowledge graphs of the business types involved in the behaviors in the target event correlation matrix are listed as the neighboring sub-graphs corresponding to the sub-knowledge graphs of the business types involved. The sub-knowledge graph that appears most frequently in the target event correlation matrix is ​​used as the central graph. The central graph is then associated with all its neighboring sub-graphs to form a dynamic knowledge graph.

2. The data supervision method according to claim 1, characterized in that, The method for determining the business relationship vector of two sub-knowledge graphs using the feature vectors of all sub-graph nodes in any two sub-knowledge graphs is as follows: For the two selected sub-knowledge graphs, one sub-knowledge graph will be assigned a relationship perception weight to all sub-graph nodes in the other sub-knowledge graph; The business relationship vector between the two sub-knowledge graphs is calculated using the relation-aware weights and the feature vectors of all sub-graph nodes in the corresponding sub-knowledge graph.

3. The data supervision method according to claim 1, characterized in that, The method for selecting the business type involved in the target event included in the query request is as follows: The current target event is input into the pre-trained LLM large model to obtain feedback results on the business types that the corresponding target event may involve, and the relevant business types are selected based on the feedback results.

4. The data supervision method according to claim 1, characterized in that: In the step of performing semantic reasoning on the dynamic knowledge graph to obtain the sensitivity identification result of the data to be identified, semantic reasoning is performed through a GNN graph neural network.

5. A data supervision method according to claim 1, characterized in that, The pre-defined regulatory strategies for data with different levels of sensitivity include: Based on the sensitivity of the data, encryption, de-identification, and access control are applied to the data.

6. A data monitoring system, characterized in that, include: The data extraction module is used to deploy multiple data extraction units within the data server according to the business type of the service subject. Each data extraction unit is responsible for extracting business data for one type of business. The sub-knowledge graph construction module identifies entity objects from the extracted business data, constructs sub-knowledge graphs for the corresponding business types based on the identified entity objects, and determines the neighboring sub-graphs of each sub-knowledge graph. The dynamic knowledge graph construction module is used to receive the query request within the data server when the service subject packages the target event and the associated data of the target event into a query request and uploads it to the data server. It selects the business type involved in the target event included in the query request and combines the sub-knowledge graph of the corresponding business type and the neighboring sub-graphs into a dynamic knowledge graph. The data identification module is used to map related data to a dynamic knowledge graph and perform semantic reasoning on the dynamic knowledge graph to obtain the sensitivity identification result of the data to be identified. The data monitoring module is used to monitor data related to target events based on the sensitivity identification results and pre-defined monitoring strategies for data with different levels of sensitivity. Specifically, the method for determining the neighboring subgraphs of each sub-knowledge graph is as follows: The identified entity objects are defined as sub-graph nodes, and attribute lists and relationship lists of the corresponding sub-graph nodes are constructed based on entity attributes and relationships with other entities; The feature vector of each sub-graph node is calculated using the attribute list and relation list of the sub-graph nodes. The business relationship vector between any two sub-knowledge graphs is determined by the feature vectors of all sub-graph nodes in the sub-knowledge graphs. The neighboring subgraphs of each sub-knowledge graph are determined based on the business relationship vector; The step of combining the sub-knowledge graph of the corresponding business type and the neighboring sub-knowledge graph into a dynamic knowledge graph includes: Construct a target event correlation matrix. The sub-knowledge graphs of the business types involved in the behaviors in the target event correlation matrix are listed as the neighboring sub-graphs corresponding to the sub-knowledge graphs of the business types involved. The sub-knowledge graph that appears most frequently in the target event correlation matrix is ​​used as the central graph. The central graph is then associated with all its neighboring sub-graphs to form a dynamic knowledge graph.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the data monitoring method as described in any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the data monitoring method as described in any one of claims 1 to 5.

Images