Dynamic data governance method and system based on intelligent rules

Abstract

The application is suitable for the technical field of data governance, and particularly relates to a dynamic data governance method and system based on intelligent rules. The method comprises the following steps: matching a preset intelligent rule based on the behavior characteristics of an access request to determine the risk level corresponding to the access request; when the risk level is greater than a preset threshold, analyzing the data content of the access request according to the intelligent rule; dynamically determining the disturbance processing depth according to the risk level, and constructing a traceable association relationship between the pseudo addresses through multiple hash processing; processing the data of the access request based on the pseudo address chain to obtain a processing result. Through the identification of risk characteristics, the application can perform early defense, timely discover and block potential attack behaviors, reduce the probability of security incidents, greatly improve the efficiency and security of dynamic data governance based on intelligent rules, and ensure the safe and reliable data exchange between the internal and external networks and smooth connection.

Description

[0001] This application is a divisional application of the invention application filed on October 14, 2025, with Chinese application number 202511463998.3 and title "A Data Governance Processing Method and System". Technical Field

[0002] This invention relates to the field of data governance technology, and in particular to a dynamic data governance method and system based on intelligent rules. Background Technology

[0003] Data governance refers to the management rules established within an enterprise or organization to ensure data quality. It includes the standardized management of all aspects of data collection, storage, processing, sharing, and use.

[0004] Data governance is particularly important during data interaction between the intranet and the extranet. Data may face various risks when transmitted across networks, such as unauthorized data access, leakage of sensitive information, or virus intrusion. Strict control and detection of data flow between the intranet and the extranet can reduce potential security risks and ensure the security and reliability of enterprise data assets.

[0005] Therefore, "how to detect access requests" is the technical problem that this invention needs to solve. Summary of the Invention

[0006] The purpose of this invention is to provide a dynamic data governance method and system based on intelligent rules to solve the problem of "how to detect access requests" mentioned in the background art.

[0007] To achieve the above objectives, the present invention provides the following technical solution: A dynamic data governance method based on intelligent rules, the method comprising: Receive access requests and match preset intelligent rules based on the behavioral characteristics of the access requests to determine the risk level corresponding to the access requests; When the risk level is greater than the preset threshold, the data content of the access request is parsed according to the intelligent rules, the target address corresponding to the access request is perturbed, and at least one pseudo address is generated. The perturbation processing depth is dynamically determined based on the risk level, and a traceable association is built between the pseudo addresses through multiple hash processing to form a pseudo address chain corresponding to the risk level. The access request data is processed based on the pseudo-address chain to obtain the processing result; Based on whether the processing result contains risk characteristics, the corresponding governance rules are dynamically triggered. When the processing result does not contain risk characteristics, the real processing result is output based on the real target address corresponding to the pseudo address link backtracking access request.

[0008] In this method, the execution subject is the internal network port, and the intelligent rule is a set of rules constructed based on the behavioral characteristics of access requests and preset rule parameters.

[0009] Furthermore, the step of receiving an access request and determining the risk level corresponding to the access request by matching the behavioral characteristics of the access request with preset intelligent rules includes: Receive access requests uploaded by users to the intranet, identify the risk level, and access the buffer in the intranet; Within the buffer, several virtual containers are configured, resulting in at least a first container, a second container, and a root container; When the risk level is greater than the threshold, the corresponding access request is defined as a sensitive request; From the virtual containers, select high-risk containers and connect the sensitive requests to the high-risk containers.

[0010] Furthermore, the step of receiving access requests uploaded by users to the intranet and identifying the risk level includes: Construct a behavior detection mechanism for access requests to obtain behavior trajectories, wherein the behavior trajectories include at least: access frequency, instruction pattern, and data packet characteristics; A risk database is constructed, which consists of behavioral trajectory items and risk level items. The risk level is dynamically adjusted using the risk database.

[0011] Furthermore, the step of parsing the data content of the access request according to the intelligent rules, performing perturbation processing on the target address corresponding to the access request, and generating at least one pseudo address when the risk level is greater than a preset threshold includes: When the risk level of the access request is greater than the threshold, the access request is imported into the first container; The target address corresponding to the access request is parsed and located, and random perturbation is performed to obtain several pseudo addresses, wherein the pseudo addresses include at least: a first pseudo address and a second pseudo address. The pseudo addresses are written into the corresponding virtual container and an identifier field is embedded. The step of importing the access request into the first container when the risk level of the access request is greater than the threshold includes: Establish a one-to-one correspondence between hash counts and risk levels; Collect attribute data of access requests, wherein the attribute data includes at least: IP, type and risk level, and adjust the number of hashes based on the attribute data and behavioral patterns.

[0012] Furthermore, the step of dynamically determining the perturbation processing depth based on the risk level and constructing a traceable association between the pseudo addresses through multiple hash processes to form a pseudo address chain corresponding to the risk level includes: Select a hash function, hash the first pseudo address to generate a first hash value, and insert it into the second pseudo address. Hash the second pseudo address to obtain a second hash value, and write it into the third pseudo address. Continue in this manner until the nth pseudo address is obtained. Calculate the number of hashes and establish a correspondence between the number of hashes and the risk level.

[0013] Furthermore, the step of processing the access request data based on the pseudo-address chain to obtain the processing result includes: The access request is processed sequentially using all the virtual containers, and after obtaining the processing results, all the virtual containers are initialized. Record all hash values ​​corresponding to each access request, establish a mapping between hash values ​​and virtual containers, and integrate them to generate a verification set; The verification set is sent to the root container, and the verification mechanism is embedded.

[0014] Furthermore, the step of dynamically triggering corresponding governance rules based on whether the processing result contains risk characteristics, and outputting the real processing result based on the real target address corresponding to the pseudo-address link backtracking access request when the processing result does not contain risk characteristics, includes: Determine if there are any risk characteristics in the processing result. If so, mark the access request as a malicious request and trigger the pre-built security alert rules. If not, trace back the access request through the hash value and the identifier field. The access request and target address are imported into the root container to determine the actual result, identify the type of the actual result, create a one-to-one corresponding handling rule for the type, encapsulate the processing result, and send it back to the internal network. Specifically, the content of creating a one-to-one corresponding handling rule, encapsulating the processing result, and sending it back to the internal network includes: Identify the target end of the processing results and set the priority for each target end; Once the data return is complete, a security log is generated and sent to the preset terminal.

[0015] Furthermore, the method also includes: The source terminal of each access request is determined based on the attribute data. Based on the security logs and processing results, risk profiles are drawn, with each source terminal corresponding to a risk profile.

[0016] The present invention also provides a dynamic data governance system based on intelligent rules. This system is used to implement the aforementioned dynamic data governance method based on intelligent rules. The system's operation includes: Receive access requests and match preset intelligent rules based on the behavioral characteristics of the access requests to determine the risk level corresponding to the access requests; When the risk level is greater than the preset threshold, the data content of the access request is parsed according to the intelligent rules, the target address corresponding to the access request is perturbed, and at least one pseudo address is generated. The perturbation processing depth is dynamically determined based on the risk level, and a traceable association is built between the pseudo addresses through multiple hash processing to form a pseudo address chain corresponding to the risk level. The access request data is processed based on the pseudo-address chain to obtain the processing result; Based on whether the processing result contains risk characteristics, the corresponding governance rules are dynamically triggered. When the processing result does not contain risk characteristics, the real processing result is output based on the real target address corresponding to the pseudo address link backtracking access request.

[0017] In this method, the execution subject is the internal network port, and the intelligent rule is a set of rules constructed based on the behavioral characteristics of access requests and preset rule parameters.

[0018] Compared with the prior art, the beneficial effects of the present invention are: This invention isolates core areas by creating buffers, reducing the risk of direct attacks or lateral spread to the internal network, and enabling threat detection and analysis. Deploying virtual containers within the buffers further enhances isolation, allowing suspicious requests to be executed and their behavior monitored, facilitating the detection of unknown threats. Connecting access requests to different numbers of virtual containers enables cross-validation, further improving data processing security. Generating pseudo-addresses hides the real topology and reduces the attack surface, preventing sensitive information leakage and trapping malicious requests, facilitating analysis, delaying attacks, and collecting threat intelligence. Hashning the pseudo-addresses ensures their evolution is irreversible and unforgeable, facilitating the complete reconstruction of the access request processing chain, meeting auditing and forensic requirements, and significantly improving data processing security. Initialization via virtual containers prevents sensitive information leakage and ensures the independence of each access request's verification environment. Identifying risk characteristics enables proactive defense, timely detection and blocking of potential attacks, reducing the probability of security incidents, and greatly improving the efficiency and security of dynamic data governance based on intelligent rules, ensuring secure, reliable, and seamless data exchange between internal and external networks. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention.

[0020] Figure 1 A flowchart illustrating the dynamic data governance method based on intelligent rules provided in this embodiment of the invention.

[0021] Figure 2 This is a first sub-flow diagram of the dynamic data governance method based on intelligent rules provided in an embodiment of the present invention.

[0022] Figure 3 This is a second sub-flow diagram of the dynamic data governance method based on intelligent rules provided in an embodiment of the present invention.

[0023] Figure 4 The third sub-flow diagram of the dynamic data governance method based on intelligent rules provided in the embodiments of the present invention.

[0024] Figure 5 The fourth sub-flow diagram of the dynamic data governance method based on intelligent rules provided in the embodiments of the present invention.

[0025] Figure 6 This is a block diagram illustrating the composition of a dynamic data governance system based on intelligent rules, as provided in an embodiment of the present invention.

[0026] Figure 7 This is a block diagram of the receiving module in a dynamic data governance system based on intelligent rules, provided in an embodiment of the present invention.

[0027] Figure 8 This is a block diagram of the embedded module in the dynamic data governance system based on intelligent rules provided in an embodiment of the present invention.

[0028] Figure 9 This is a block diagram of the initialization module in a dynamic data governance system based on intelligent rules, provided in an embodiment of the present invention.

[0029] Figure 10 This is a block diagram of the initialization module in a dynamic data governance system based on intelligent rules, provided in an embodiment of the present invention. Detailed Implementation

[0030] In Example 1, Figure 1 The implementation flow of the dynamic data governance method based on intelligent rules provided in this embodiment of the invention is illustrated below, and is described in detail below: S100: Receives access requests uploaded by users to the intranet, identifies the risk level, accesses a buffer in the intranet, and configures several virtual containers in the buffer, obtaining at least a first container, a second container, and a root container.

[0031] The system receives and identifies access requests uploaded to the intranet by users. Based on the source, frequency, and parameters of the access requests, it determines the corresponding risk level. The specific method for determining the risk level can be as follows: assign a risk value to the source, frequency, etc., sum the risk values ​​of each access request, and then divide the sum into several intervals, each interval corresponding to a risk level. A buffer is created between the intranet and the extranet, and access requests are imported into this buffer. The buffer is a security isolation layer, referring to a secure isolation and relay environment between the intranet and the extranet. Its main function is to temporarily store, process, and isolate external access requests. Several virtual containers are deployed within the buffer. Virtual containers are logically isolated processing units; they are neither physical servers nor traditional application containers, but rather virtualized environment units that make up the buffer. Each virtual container runs independently. The buffer consists of at least a first container, a second container, and a root container, with all virtual containers arranged in a chain, i.e., the first container is followed by the second container, and the root container is connected to the end of all virtual containers.

[0032] S200: When the risk level of the access request is greater than the threshold, the access request is imported into the first container, the target address corresponding to the access request is parsed and located, and random perturbation processing is performed to obtain several pseudo addresses, wherein the pseudo addresses include at least: a first pseudo address and a second pseudo address, the pseudo addresses are written into the corresponding virtual container, and an identification field is embedded.

[0033] If the risk level of an access request exceeds a threshold, the request is transferred to the first container and fully analyzed to determine the specific source information, access parameters, and target resources. Random perturbation is applied to the target address, generating several pseudo-addresses. This random perturbation refers to fine-tuning the access path, request parameters, and access time. A pseudo-address is assigned to each virtual container and inserted into it. The access request is processed sequentially using the pseudo-addresses in each virtual container (using the corresponding program or terminal to perform risk detection). Each virtual container performs specific operations based on the pseudo-address, such as simulated access, data verification, hash calculation, or security analysis. Throughout the process, virtual containers maintain logical isolation, and processing operations are tracked and correlated through embedded identifier fields to ensure accurate tracing of the access request's source and processing trajectory. This achieves secure isolation, effective verification, and dynamic protection for high-risk requests. Each pseudo-address corresponds to a point (program or terminal, etc.) for anomaly detection. Anomaly detection is performed on the access request through this point to determine if suspicious behavior exists.

[0034] S300: Select a hash function, hash the first pseudo address to generate a first hash value, and insert it into the second pseudo address. Hash the second pseudo address to obtain a second hash value, and write it into the third pseudo address. Continue in this manner until the nth pseudo address is obtained. Calculate the number of hashes, establish the correspondence between the number of hashes and the risk level, process the access request using all virtual containers in sequence, and initialize all virtual containers after obtaining the processing results.

[0035] In addition to using identifier fields to record and associate the verification process, hashing can be used to enhance the association. A hash function (SHA-256, SHA-1, etc.) is selected to hash the first pseudo-address, and the resulting hash value is defined as the first hash value. This first hash value is then written into the second pseudo-address. The hash function is then used to hash the new second pseudo-address to obtain the second hash value, which is then written into the third pseudo-address, and so on. A chained tagging method is used to adjust all pseudo-addresses. The advantage of this is that by verifying the authenticity of the nth pseudo-address, it can be determined whether the access request has passed the verification of all virtual containers. It also prevents pseudo-addresses from being tampered with, ensuring the verification process is genuine and reliable.

[0036] In this application, if the risk level of the access request is high, more hashing is performed, and more virtual containers are used to process and detect the access request; if the risk level is low, fewer processing and detection operations are performed.

[0037] Record the number of hashes and establish a correspondence between the number of hashes and the risk level of the access request. This ensures that high-risk requests are associated with more hashes. Each virtual container performs independent parsing, verification, perturbation, and security analysis operations on the access request through its internally configured pseudo-address to determine whether risk characteristics exist. After determining the judgment result, initialize each virtual container, clear temporary data, reset pseudo-address and identification fields, and restore the processing environment.

[0038] S400: Determine whether there are risk characteristics in the processing result. If so, mark the access request as a malicious request and trigger the pre-built security alarm rule. If not, trace back the access request through the hash value and the identifier field, import the access request and the target address into the root container, determine the real result, identify the type of the real result, create a one-to-one corresponding handling rule for the type, package the processing result, and send it back to the intranet.

[0039] The system determines whether the processing result contains risk characteristics. If so, the corresponding access request is marked as malicious and a security alert rule is triggered. This rule includes: real-time notification to the security management platform, recording detailed event logs, isolating related virtual containers, and blocking further propagation of suspicious requests. If the processing result does not contain risk characteristics, the access request is traced back using pre-embedded hash values ​​and identifier fields. The access request and its corresponding target address are imported into the root container within the buffer. In the root container, the access request is further parsed to determine the true result. The true result refers to "the result obtained by processing the access request using the real access address (target address)." Define the type of the actual result, such as different categories like data access, query operation, control command, or log recording. Access requests can also be categorized based on the type of data to be written to the intranet (video, image, text, etc.). Create a corresponding handling rule for each type, including data distribution, alarm triggering, log recording, and policy execution. The root container packages the processing results, ensuring the data format conforms to intranet reception specifications, embeds necessary security identifiers and tracking information, and sends the access request back to the intranet. For example, if an access request contains video data, the handling rule for the video type is: store the video data in a cloud drive, and only send the video's sharing link back to the intranet.

[0040] In Example 2, Figure 2 This paper illustrates the implementation flow of a dynamic data governance method based on intelligent rules provided by an embodiment of the present invention. The following details the steps of receiving access requests uploaded by users to the intranet, identifying risk levels, accessing a buffer in the intranet, and configuring several virtual containers in the buffer: S101: When the risk level is greater than the threshold, the corresponding access request is defined as a sensitive request.

[0041] If the risk level of an access request exceeds the threshold, the corresponding access request will be defined as a sensitive request.

[0042] S102: Select a high-risk container from the virtual containers and connect the sensitive request to the high-risk container.

[0043] High-risk containers are identified and selected from the virtual containers. These high-risk containers are specifically designed to handle sensitive requests and have strict security isolation mechanisms and independent processing logic within their internal environment.

[0044] In Example 3, Figure 2The implementation flow of the dynamic data governance method based on intelligent rules provided by an embodiment of the present invention is illustrated. The following details the steps of receiving access requests uploaded by users to the intranet and identifying the risk level: S103: Construct a behavior detection mechanism for access requests and obtain behavior trajectories, wherein the behavior trajectories include at least: access frequency, instruction pattern, and data packet characteristics.

[0045] A behavior detection mechanism is constructed, which refers to a set of methods for real-time capture, analysis, and evaluation of access request behavior. This mechanism records access request behavior data and generates corresponding behavior trajectories. The behavior trajectories include three core dimensions: access frequency, command pattern, and data packet characteristics. Access frequency measures the number of access requests and the access rhythm within a unit of time to identify abnormally high-frequency or low-frequency access behaviors. Command pattern analyzes the operation type, call order, and command structure carried in the request to identify potential malicious operations or abnormal command combinations. Data packet characteristics include data packet size, header information, protocol type, payload characteristics, and encryption method, used to detect abnormal patterns in data transmission.

[0046] S104: Construct a risk database, wherein the risk database consists of behavioral trajectory items and risk level items, and use the risk database to dynamically adjust the risk level.

[0047] Create a risk database, which is specifically used to store and manage the risk characteristics of access requests. The risk database consists of behavioral trajectory items and risk level items. In other words, each access request corresponds to a behavioral trajectory, and each behavioral trajectory corresponds to a risk level.

[0048] In Example 4, Figure 3 The implementation flow of the dynamic data governance method based on intelligent rules provided by an embodiment of the present invention is illustrated. The following details the step of importing the access request into the first container when the risk level of the access request is greater than the threshold: S201: Establish a one-to-one correspondence between the number of hashes and the risk level.

[0049] The hash count refers to the number of times a pseudo address is hashed using a hash function; each risk level corresponds to one hash count.

[0050] S202: Collect attribute data of access requests, wherein the attribute data includes at least: IP, type and risk level, and adjust the number of hashes based on the attribute data and behavioral patterns.

[0051] In addition to adjusting the number of hashes based on the risk level, the attributes of the access request should also be considered. These attributes include IP information and access request type information. The IP is used to identify the source address of the access request, which can identify requests from suspicious sources or abnormal regions. The second is the type information, which is used to define the specific category of the access request, such as file transfer request, instruction execution request, and data read request.

[0052] In Example 5, Figure 4 The implementation flow of the dynamic data governance method based on intelligent rules provided by an embodiment of the present invention is illustrated. The following details the steps of sequentially processing the access request using all virtual containers and initializing all virtual containers after obtaining the processing results: S301: Record all hash values ​​corresponding to each access request, establish a mapping between hash values ​​and virtual containers, and integrate them to generate a verification set.

[0053] The hash value corresponding to each access request is stored, and the mapping corresponding to each hash value is determined. The hash value is then integrated to generate a verification set, which is mainly used to backtrack the data governance process.

[0054] For example, an access request is hashed three times. The first pseudo-address and its corresponding identifier field are integrated, and the new first pseudo-address is hashed to obtain the first hash value. The first hash value is inserted into the second pseudo-address and hashed to obtain the second hash value. The second hash value is inserted into the third pseudo-address and hashed. The first, second, and third pseudo-addresses are written into the first, second, and third containers, respectively. Using the program or terminal in each virtual container pseudo-address, anomaly detection is performed on the access request. All hash values ​​corresponding to the access request and the detection results of the virtual containers are integrated to obtain a verification set.

[0055] S302: Send the verification set to the root container and embed the verification mechanism.

[0056] The verification set is sent to the root container, and a verification mechanism is embedded. Specifically, the root container, as the final decision unit, verifies and analyzes the detection results of each virtual container after receiving the verification set to determine whether there is a defect. If not, the access request is routed to the target address.

[0057] In Example 5, Figure 5 This paper illustrates the implementation flow of a dynamic data governance method based on intelligent rules provided by an embodiment of the present invention. The following details the steps of creating processing rules that correspond one-to-one with the type, packaging the processing results, and sending them back to the intranet: S401: Identify the target end of the processing result and set the priority of each target end.

[0058] Identify the target end corresponding to the processing result, that is, determine the business node, application module or storage unit that the access request ultimately needs to be delivered to, and set a corresponding priority for each target end, which can be divided into high, medium and low priorities.

[0059] S402: After the return is completed, a security log is generated and sent to the preset terminal.

[0060] Once the data return is complete, a security log is generated. The security log is used to record the entire process information of this access request. The security log is then sent to a preset terminal, which refers to the terminal of the data governance administrator.

[0061] In Example 6, unlike Example 1, the method further includes: The source terminal of each access request is determined based on the attribute data. Based on the security logs and processing results, risk profiles are drawn, with each source terminal corresponding to a risk profile.

[0062] Based on the IP information in the attribute data of each access request, the source terminal of each access request is determined, and the behavioral characteristics, abnormal event records and risk levels exhibited by the access request during the intranet access process are extracted to create a risk profile, which can characterize the potential threat tendencies of each source terminal.

[0063] Figure 6 The diagram illustrates the structural composition of a dynamic data governance system based on intelligent rules provided in an embodiment of the present invention. The dynamic data governance system 1 based on intelligent rules includes: The receiving module 11 is used to receive access requests uploaded by users to the intranet, identify the risk level, access the buffer in the intranet, and configure several virtual containers in the buffer, at least obtaining a first container, a second container and a root container. The embedding module 12 is used to import the access request into the first container when the risk level of the access request is greater than the threshold, parse and locate the target address corresponding to the access request, and perform random perturbation processing to obtain several pseudo addresses, wherein the pseudo addresses include at least: a first pseudo address and a second pseudo address, write the pseudo addresses into the corresponding virtual container, and embed an identification field. Initialization module 13 is used to select a hash function, hash the first pseudo address to generate a first hash value, and insert it into the second pseudo address. Hash the second pseudo address to obtain a second hash value, and write it into the third pseudo address, and so on, until the nth pseudo address is obtained. The hash count is calculated, and a correspondence between the hash count and the risk level is established. All virtual containers are used in sequence to process the access request, and after obtaining the processing result, all virtual containers are initialized. The feedback module 14 is used to determine whether there are risk characteristics in the processing result. If so, the access request is marked as a malicious request and a pre-built security alarm rule is triggered. If not, the access request is traced back through the hash value and the identifier field. The access request and the target address are imported into the root container to determine the real result, identify the type of the real result, create a one-to-one corresponding handling rule for the type, package the processing result, and send it back to the intranet.

[0064] Figure 7 This diagram illustrates the structural composition of a dynamic data governance system based on intelligent rules provided in an embodiment of the present invention. The receiving module 11 includes: Definition unit 111 is used to define the corresponding access request as a sensitive request when the risk level is greater than the threshold. Access unit 112 is used to select high-risk containers from the virtual containers and access the sensitive request into the high-risk containers; The acquisition unit 113 is used to construct a behavior detection mechanism for access requests and acquire behavior trajectories, wherein the behavior trajectories include at least: access frequency, instruction pattern and data packet characteristics; The adjustment unit 114 is used to construct a risk database, wherein the risk database consists of behavioral trajectory items and risk level items, and the risk level is dynamically adjusted using the risk database.

[0065] Figure 8 This diagram illustrates the structural composition of a dynamic data governance system based on intelligent rules provided in an embodiment of the present invention. The embedded module 12 includes: Establishment unit 121 is used to establish a one-to-one correspondence between hash counts and risk levels; Hash unit 122 is used to collect attribute data of access requests, wherein the attribute data includes at least: IP, type and risk level, and the number of hashes is adjusted based on the attribute data and behavioral patterns.

[0066] Figure 9 This diagram illustrates the structural composition of a dynamic data governance system based on intelligent rules provided in an embodiment of the present invention. The initialization module 13 includes: Recording unit 131 is used to record all hash values ​​corresponding to each access request, establish a mapping between hash values ​​and virtual containers, and integrate them to generate a verification set; Sending unit 132 is used to send the verification set to the root container and embed the verification mechanism.

[0067] Figure 10 This diagram illustrates the structural composition of a dynamic data governance system based on intelligent rules provided in an embodiment of the present invention. The feedback module 14 includes: The identification unit 141 is used to identify the target end of the processing result and set the priority of each target end; The generation unit 142 is used to generate a security log after the return is completed and send it to a preset terminal.

[0068] The receiving module 11 is mainly used to complete step S100, the embedding module 12 is mainly used to complete step S200, the initialization module 13 is mainly used to complete step S300, and the return module 14 is mainly used to complete step S400. The definition unit 111 is mainly used to complete step S101, the access unit 112 is mainly used to complete step S102, the acquisition unit 113 is mainly used to complete step S103, and the adjustment unit 114 is mainly used to complete step S104. The establishment unit 121 is mainly used to complete step S201, and the hash unit 122 is mainly used to complete step S202; Recording unit 131 is mainly used to complete step S301, and sending unit 132 is mainly used to complete step S302; The identification unit 141 is mainly used to complete step S401, and the generation unit 142 is mainly used to complete step S402.

[0069] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. A dynamic data governance method based on intelligent rules, characterized in that, The method includes: Receive access requests and match preset intelligent rules based on the behavioral characteristics of the access requests to determine the risk level corresponding to the access requests; When the risk level is greater than the preset threshold, the data content of the access request is parsed according to the intelligent rules, the target address corresponding to the access request is perturbed, and at least one pseudo address is generated. The perturbation processing depth is dynamically determined based on the risk level, and a traceable association is built between the pseudo addresses through multiple hash processing to form a pseudo address chain corresponding to the risk level. The access request data is processed based on the pseudo-address chain to obtain the processing result; Based on whether the processing result contains risk characteristics, the corresponding governance rules are dynamically triggered. When the processing result does not contain risk characteristics, the real processing result is output based on the real target address corresponding to the backtracking access request of the pseudo address chain. In this method, the execution subject is the internal network port, and the intelligent rule is a set of rules constructed based on the behavioral characteristics of access requests and preset rule parameters; The steps of receiving an access request and determining the risk level corresponding to the access request by matching the behavioral characteristics of the access request with preset intelligent rules include: Receive access requests uploaded by users to the intranet, identify the risk level, and access the buffer in the intranet; Within the buffer, several virtual containers are configured, resulting in at least a first container, a second container, and a root container; When the risk level is greater than the threshold, the corresponding access request is defined as a sensitive request; From the virtual containers, select a first container and connect the sensitive request to the first container; The step of parsing the data content of the access request according to the intelligent rules, performing perturbation processing on the target address corresponding to the access request, and generating at least one pseudo address when the risk level is greater than a preset threshold includes: When the risk level of the access request is greater than the threshold, the access request is imported into the first container; The target address corresponding to the access request is parsed and located, and random perturbation is performed to obtain several pseudo addresses. The pseudo addresses include at least a first pseudo address and a second pseudo address. The pseudo addresses are written into the corresponding virtual container and an identifier field is embedded.

2. The dynamic data governance method based on intelligent rules according to claim 1, characterized in that, The step of receiving access requests uploaded by users to the intranet and identifying the risk level includes: Construct a behavior detection mechanism for access requests to obtain behavior trajectories, wherein the behavior trajectories include at least: access frequency, instruction pattern, and data packet characteristics; A risk database is constructed, which consists of behavioral trajectory items and risk level items. The risk level is dynamically adjusted using the risk database.

3. The dynamic data governance method based on intelligent rules according to claim 2, characterized in that, The step of importing the access request into the first container when the risk level of the access request is greater than the threshold includes: Establish a one-to-one correspondence between hash counts and risk levels; Collect attribute data of access requests, wherein the attribute data includes at least: IP, type and risk level, and adjust the number of hashes based on the attribute data and behavioral patterns.

4. The dynamic data governance method based on intelligent rules according to claim 1, characterized in that, The step of dynamically determining the perturbation processing depth based on the risk level and constructing a traceable association between the pseudo addresses through multiple hash processes to form a pseudo address chain corresponding to the risk level includes: Select a hash function, hash the first pseudo address to generate a first hash value, and insert it into the second pseudo address. Hash the second pseudo address to obtain a second hash value, and write it into the third pseudo address. Continue in this manner until the nth pseudo address is obtained. Calculate the number of hashes and establish a correspondence between the number of hashes and the risk level.

5. The dynamic data governance method based on intelligent rules according to claim 1, characterized in that, The step of processing the access request data based on the pseudo-address chain to obtain the processing result includes: The access request is processed sequentially using all the virtual containers, and after obtaining the processing results, all the virtual containers are initialized. Record all hash values ​​corresponding to each access request, establish a mapping between hash values ​​and virtual containers, and integrate them to generate a verification set; The verification set is sent to the root container, and the verification mechanism is embedded.

6. The dynamic data governance method based on intelligent rules according to claim 3, characterized in that, The step of dynamically triggering corresponding governance rules based on whether the processing result contains risk characteristics, and outputting the real processing result based on the real target address corresponding to the backtracking access request of the pseudo address chain when the processing result does not contain risk characteristics includes: Determine if there are any risk characteristics in the processing result. If so, mark the access request as a malicious request and trigger the pre-built security alert rules. If not, trace back the access request through the hash value and the identifier field. The access request and target address are imported into the root container to determine the actual result, identify the type of the actual result, create a one-to-one corresponding handling rule for the type, encapsulate the processing result, and send it back to the intranet. Specifically, the creation of the one-to-one corresponding handling rule, the encapsulation of the processing result, and the sending back to the intranet include: Identify the target end of the processing results and set the priority for each target end; Once the data return is complete, a security log is generated and sent to the preset terminal.

7. The dynamic data governance method based on intelligent rules according to claim 6, characterized in that, The method further includes: The source terminal of each access request is determined based on the attribute data. Based on the security logs and processing results, risk profiles are drawn, with each source terminal corresponding to a risk profile.

8. A dynamic data governance system based on intelligent rules, characterized in that, The system is used to implement the dynamic data governance method based on intelligent rules as described in any one of claims 1 to 7, and the system's operation includes: Receive access requests and match preset intelligent rules based on the behavioral characteristics of the access requests to determine the risk level corresponding to the access requests; When the risk level is greater than the preset threshold, the data content of the access request is parsed according to the intelligent rules, the target address corresponding to the access request is perturbed, and at least one pseudo address is generated. The perturbation processing depth is dynamically determined based on the risk level, and a traceable association is built between the pseudo addresses through multiple hash processing to form a pseudo address chain corresponding to the risk level. The access request data is processed based on the pseudo-address chain to obtain the processing result; Based on whether the processing result contains risk characteristics, the corresponding governance rules are dynamically triggered. When the processing result does not contain risk characteristics, the real processing result is output based on the real target address corresponding to the backtracking access request of the pseudo address chain. In this method, the execution subject is the internal network port, and the intelligent rule is a set of rules constructed based on the behavioral characteristics of access requests and preset rule parameters; The process of receiving an access request and determining the risk level corresponding to the access request by matching the behavioral characteristics of the access request with preset intelligent rules includes: Receive access requests uploaded by users to the intranet, identify the risk level, and access the buffer in the intranet; Within the buffer, several virtual containers are configured, resulting in at least a first container, a second container, and a root container; When the risk level is greater than the threshold, the corresponding access request is defined as a sensitive request; From the virtual containers, select a first container and connect the sensitive request to the first container; When the risk level exceeds a preset threshold, the data content of the access request is parsed according to the intelligent rules, and perturbation processing is performed on the target address corresponding to the access request to generate at least one pseudo address. The content includes: When the risk level of the access request is greater than the threshold, the access request is imported into the first container; The target address corresponding to the access request is parsed and located, and random perturbation is performed to obtain several pseudo addresses. The pseudo addresses include at least a first pseudo address and a second pseudo address. The pseudo addresses are written into the corresponding virtual container and an identifier field is embedded.

Images