Security risk assessment method, device and equipment of data component, medium and program product

Abstract

The invention discloses a security risk assessment method, device and equipment for a data component, a medium and a program product. The method comprises the following steps: collecting business-related fields and data contents from a data source, performing data cleaning, outputting a data set, and registering basic information describing features of the data set; fields are regarded as a node set, a graph structure is constructed based on field information registered for the fields contained in the data set, a node relation classification model is obtained through model training, and safety level information of all the fields in the data set environment is output; for each field, obtaining a new field security feature according to the basic information and the security level information, mining an implicit relationship between the fields and forming edges, and constructing a data security risk map according to nodes and the edges; inputting the information of the nodes and the information of the edges into an information entropy model, and calculating the security risk information entropy of the data component; and packaging the security level information of the field, the data security risk map, the security risk information entropy and the basic information into a data component.

Description

Technical Field

[0001] This application relates to the field of security assessment of data products, and in particular to a method, apparatus and equipment, medium and program product for security risk assessment of data components. Background Technology

[0002] In recent years, the concept of data elements has emerged, serving as an "intermediate state" between raw data and data products, characterized by standardization, reusability, high security, and strong interoperability. However, current security audits for data element production are primarily manual, lacking automated audits and offering insufficient security granularity. Furthermore, risk assessment of data information within data elements is crucial during data circulation. Current data-oriented risk assessment methods mainly focus on statistical analysis and machine learning. Statistical analysis relies on data distribution characteristics and lacks universality, while machine learning relies on pre-set engineering experience and decision tree models, requiring extensive human experience accumulation and failing to consider the security impact of global fields on target fields within the overall dataset environment. Therefore, the current data element concept security assessment system is inadequate. Audits of data element results within the dataset only monitor for anomalies in fields, lacking quantitative assessment indicators, and the dataset description lacks security risk information and business-related information. Summary of the Invention

[0003] This application provides a method, apparatus, equipment, medium, and program product for assessing the security risks of data components, which can solve the problems of insufficient security assessment system for the concept of data components and limited data circulation scenarios in the existing approach.

[0004] In a first aspect, embodiments of this application provide a method for assessing the security risks of data components, the method comprising:

[0005] Collect business-related fields and data content from the data source, perform data cleaning and output a dataset, and register basic information to describe the characteristics of the dataset.

[0006] The fields are treated as a set of nodes. A graph structure is constructed based on the field information registered for the fields contained in the dataset. A node relationship classification model based on the graph structure is obtained through model training. The security level information of each field in the dataset environment is output using the node relationship classification model.

[0007] For each field, new field security features are obtained based on the basic information and the security level information. Fields that incorporate the new field security features are regarded as a set of nodes. Implicit relationships between fields are mined and edges are formed. A data security risk graph is constructed based on the nodes and the edges.

[0008] The information of the nodes and the information of the edges are input into the information entropy model to calculate the security risk information entropy of the entire data component and quantify the security risk assessment result of the data component.

[0009] The security level information of the field, the data security risk map, the security risk information entropy, and the basic information are encapsulated together into the data component.

[0010] Optionally, constructing the graph structure based on the field information registered in the fields included in the dataset includes:

[0011] The fields are classified using a graph attention network method. The node features corresponding to the fields are extracted through a multi-layer graph neural network with an attention mechanism. The node features include the semantic features of the fields, the semantic features of the data source to which they belong, the data source, the data purpose, and whether the data has been anonymized.

[0012] A method based on cosine similarity is used to search for the neighboring nodes of each node.

[0013] Optionally, the implicit relationships between the mined fields include:

[0014] Based on the identified security level information of the fields, the attribute features and classification features of each field are extracted again, and a data graph is constructed. A multi-layer graph attention network is used to construct the hidden layer, and multiple multi-layer perceptron models are constructed according to the node category to output node features of different security levels. The node features are input into the affine transformation model and the classification results are output to identify the implicit relationships between fields.

[0015] Optionally, the calculation of the security risk information entropy of the entire data component includes: calculating the information entropy of each node; calculating the information entropy of each edge; calculating the weighted quantized information entropy of nodes and edges; and calculating the information entropy of each node based on the security level distribution.

[0016] Optionally, the basic information includes the metadata of the dataset, data records, unified identifiers, attribute descriptions, ownership information, and acquisition methods.

[0017] Optionally, after quantifying the security risk assessment results of the data component, the usage scenario is determined based on its security risk and permission attributes.

[0018] Secondly, embodiments of this application also provide a security risk assessment device for data components, the device comprising:

[0019] The data collection module collects business-related fields and data content from the data source, performs data cleaning and outputs a dataset, and registers basic information describing the characteristics of the dataset.

[0020] The security classification module treats fields as sets of nodes, constructs a graph structure based on the field information registered for the fields contained in the dataset, obtains a node relationship classification model based on the graph structure through model training, and outputs the security level information of each field in the dataset environment using the node relationship classification model.

[0021] The implicit relationship mining module obtains new field security features for each field based on the basic information and the security level information. Fields that incorporate the new field security features are regarded as a set of nodes. Implicit relationships between fields are mined and edges are formed. A data security risk graph is constructed based on the nodes and the edges.

[0022] The security risk quantification module inputs the information of the node and the information of the edge into the information entropy model, calculates the security risk information entropy of the entire data component, and quantifies the security risk assessment result of the data component.

[0023] The encapsulation module encapsulates the security level information of the field, the data security risk graph, the security risk information entropy, and the basic information together into the data component.

[0024] Thirdly, embodiments of this application also provide an electronic device, including a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the security risk assessment method for data components as described in the first aspect.

[0025] Fourthly, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the security risk assessment method for data components as described in the first aspect.

[0026] Fifthly, embodiments of this application also provide a computer program product, including computer instructions, which, when executed by a processor, implement the steps of the security risk assessment method for data components as described in the first aspect.

[0027] In this embodiment, business-related fields and data content are collected from a data source, and a dataset is output after data cleaning. Basic information describing the dataset's characteristics is registered. Fields are treated as sets of nodes, and a graph structure is constructed based on the field information registered for the fields included in the dataset. A node relationship classification model based on the graph structure is obtained through model training. The node relationship classification model is used to output the security level information of each field in the dataset environment. For each field, new field security features are obtained based on the basic information and the security level information. Fields incorporating the new field security features are treated as sets of nodes. Implicit relationships between fields are mined and edges are formed. A data security risk graph is constructed based on the nodes and edges. The information of the nodes and edges is input into an information entropy model to calculate the security risk information entropy of the entire data component, quantifying the security risk assessment result of the data component. The security level information of the fields, the data security risk graph, the security risk information entropy, and the basic information are encapsulated together in the data component. Therefore, the processed fields are combined into a dataset, and a security risk assessment is performed on the dataset, including the definition of security level in the context of joint fields, data relationship mining, and overall security attributes of the dataset. The above feature information is integrated and encapsulated into a data component as a primary data product, which supports fine-tuning of multi-dimensional data circulation scenarios based on its own security characteristics. Attached Figure Description

[0028] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0029] Figure 1 This is a flowchart of the security risk assessment method for data components provided in the embodiments of this application;

[0030] Figure 2 This is a flowchart of the data component field security classification processing in the security risk assessment method of this application embodiment;

[0031] Figure 3 This is a flowchart of the implicit relationship mining process for data component fields in the security risk assessment method of this application;

[0032] Figure 4 This is a flowchart of the security risk quantification process for data components based on information entropy in the security risk assessment method of this application;

[0033] Figure 5This is a structural diagram of a security risk assessment device for data components according to an embodiment of this application.

[0034] Figure 6 This is a structural diagram of the electronic device involved in this application. Detailed Implementation

[0035] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0036] To construct a data representation format with high information density, strong security risk attributes, and high usability, the concept of data components is proposed. Data components mainly include the basic information of the dataset and data security risk information.

[0037] This application provides a method for assessing the security risks of data components.

[0038] See Figure 1 , Figure 1 This is a flowchart of a security risk assessment method for data components provided in an embodiment of this application. The method includes the following steps.

[0039] S101, Data Collection and Processing. Collect business-related fields and data content from data sources, perform data cleaning and processing, output a dataset, and register basic information describing the characteristics of the dataset.

[0040] In this embodiment, fields and data content related to this business are collected from the original data source, and after data cleaning, key field anonymization and other processing, a data set that meets the transaction requirements is output.

[0041] After obtaining the processed dataset, the following information needs to be registered: metadata (table structure and field attributes of all resources (data sources), data records (including but not limited to files, database records, and message queue formats), unified identifier (assigning a unique identifier to each data component), attribute description (including but not limited to data description, storage information, time, region, period, etc.), ownership information (including but not limited to provider information, processor information, and scope of application), and acquisition method (including but not limited to files, data streams, and APIs).

[0042] S102, Data Component Field Security Classification Processing. Fields are treated as sets of nodes. A graph structure is constructed based on the field information registered for the fields included in the dataset. A node relationship classification model based on the graph structure is obtained through model training. The node relationship classification model is then used to output the security level information of each field in the dataset environment.

[0043] Figure 2 This is a flowchart representing the process of security classification of data component fields in S102.

[0044] The following is based on Figure 2 The process of S102 is further explained, which includes the following steps.

[0045] S1021, extract features from the fields contained in the dataset. First, extract word vectors from the field names. Since field names have specific domain features, [the following is chosen]. The model is trained on a corpus of field names and the word vectors for field i are obtained. and the resource name to which the field belongs. Simultaneously, the general word vector model BERT is used to extract sentence vectors describing the fields. and the sentence vector of the resource name to which the field belongs. In addition, attributes such as data source, data purpose, and whether data has been anonymized are directly constructed into a comprehensive attribute vector. Finally, the feature representation of field i is obtained by combining the features:

[0046] S1022 is a neighborhood graph constructed based on cosNN (Cosine Nearest Neighbor) algorithm. Fields are treated as sets of nodes. (c is the total number of fields), and each node The initial feature vector is .

[0047] Edges are formed between nodes that share attribute similarities or implicit business connections with the current node. Since these relationships need to be measured by evaluating the similarity between feature vectors, a cosine similarity-based cosNN algorithm is used to find the neighboring nodes of each node when constructing the graph relationships. The specific implementation is as follows:

[0048] First, for each node Computation and other nodes Cosine similarity:

[0049]

[0050] in Represents the vector dot product. and This represents the magnitude of the vector. Then, a threshold k is set; if... Then node Determined as a node The neighboring nodes. Therefore, for each node... Select its neighboring nodes to form a set And construct an edge set based on this rule. :

[0051]

[0052] The final image is as follows: .

[0053] S1023, Construct a multi-layer GAT (Graph Attention Network) model. First, construct an M-layer GAT network, with each node... The features are mapped to the high-dimensional embedding of the m-th layer via GAT. and initialization The node features at layer m are as follows:

[0054]

[0055] in The vector in the middle is the feature vector of the m-th layer. It is the set of neighbors of node i. It is the learnable weight matrix of the m-th layer. It is the attention coefficient between node i and node j. This is the sigmoid activation function. The attention coefficients here... The calculation formula is:

[0056]

[0057] In the formula These are the attention coefficients of layer m. and It consists of two learnable weight matrices, where || represents the concatenation of features. Let i be the set of neighboring nodes of node i, and LeakyReLu be a non-linear activation function.

[0058] Furthermore, to enhance the model's ability to represent multiple class labels, a multi-head attention mechanism is introduced into the GAT model. Each head independently calculates its attention coefficient, and the results are then averaged. Therefore, the feature update formula for the m-th layer is modified as follows:

[0059]

[0060] Where K is the number of attention heads. and These are the weight matrix and attention coefficient of the k-th head, respectively.

[0061] S1024, the output of the MLP (Multilayer Perceptron) layer. Next, the hidden layer output of the GAT needs to be transformed into classification label features for node i. This requires dimensionality reduction of the GAT hidden layer output features and mapping them to actual security classification label features. Based on the above feature definitions, an MLP model is constructed to calculate its score function:

[0062]

[0063] in and Let represent the weight matrix and bias of the p-th layer, respectively. The first layer uses sigmoid activation, and the second layer uses softmax, which can transform the classification result into the probability of multi-class results.

[0064] Finally, four categories of safety level labels were defined as follows: The loss is calculated using the cross-entropy (CE) loss function:

[0065]

[0066] S1025, Model training. Then, stochastic gradient descent is used to adjust the loss function. By training, we can obtain graph-based... Node relationship classification model After the model is trained, it can perform classification prediction, and the output results include the security level category of node i. and corresponding score weights .

[0067] return Figure 1 Let me continue explaining.

[0068] S103, Data Component Field Implicit Relationship Mining and Processing. For each field, new field security features are obtained based on basic information and security level information. Fields that incorporate the new field security features are regarded as a set of nodes. Implicit relationships between fields are mined and edges are formed. A data security risk graph is constructed based on the nodes and edges.

[0069] Figure 3 This is a flowchart representing the implicit relationship mining process of data component fields in S103.

[0070] The following is based on Figure 3 The process of S103 is further explained, which includes the following steps.

[0071] S1031, Construct combined field features based on security classification. For each field i, in addition to the original basic information features... Based on this, and based on the security level categories obtained above and corresponding score weights Corresponding features By fusing the two types of features, a new field security feature is obtained. .

[0072] S1032, Construct a fully connected graph Fields incorporating security features are treated as a set of nodes. (c is the total number of fields), and each node The initial feature vector is Next, an edge set needs to be built. Since the goal is to uncover all possible implicit relationships between nodes, a fully connected edge set needs to be constructed. .

[0073] The final image is as follows: .

[0074] S1033, GAT model feature encoding. Constructing a good graph. Then, the GAT model in S102 is still used to encode the field features, that is, the hidden layer features calculated by the GAT model. Define the initialization vector. The hidden layer features after processing by the L-layer GAT model are denoted as The algorithm process of GAT is the same as that in S102, and will not be repeated here.

[0075] S1034, Multi-class MLP Decoding. This method uses a category-specific MLP instead of a unified decoder, upgrading node categories from "input features" to "network structure." This gives each type of node an independent, semantically aligned embedding space, improving representation purity and parameter efficiency, and significantly simplifying subsequent modeling of relationships between nodes. An MLP model with four label categories is constructed based on the node's safety category. Feature dimensionality reduction is then performed on nodes in the four categories from "Level 1" to "Level 4."

[0076]

[0077] in and Representing categories Weights and biases in an MLP model It is an activation function.

[0078] S1035, the loss function is obtained through the Affine (Affine Transformation) model. Since it predicts the category of relationships between nodes, relation features need to be constructed. Hypothetical graph. An edge contains nodes i and j, and the corresponding feature pair after encoding by the GAT model is: The feature pairs after MLP decoding of the corresponding category are: Then, the relationship features between node i and node j are expressed by subtraction, and input into the Affine model to obtain the final score function through affine transformation:

[0079]

[0080] in and The weights and biases of the Affine model are respectively... It is an activation function.

[0081] Next, the loss function is constructed. Considering that the relation classification task only needs to distinguish between two classes: those with existing relations and those without, the loss can be calculated based on the cross-entropy (CE) loss function as follows:

[0082]

[0083] S1036, Model Training. Then, stochastic gradient descent is used to adjust the loss function. By training, we can obtain graph-based... Node relationship classification model After the model is trained, it can perform node relationship classification and prediction, and the output result is the relationship label. and weight Among them, relationship tags This indicates whether there is an implicit relationship between field i and field j (1 indicates that there is, 0 indicates that there is no relationship).

[0084] S1037, Construct a data security risk diagram. We now have the security level category of field i, calculated in S102. and corresponding score weights It also possesses the relationships between the fields calculated in S103. and weight Based on the above information, a data security risk map can be constructed for all fields of the dataset. The specific definitions of nodes and edges are as follows.

[0085] Node set :

[0086]

[0087] The attributes of each node are: .

[0088] edge set :

[0089]

[0090] Finally, the diagram Information is encapsulated into data components, which then support the subsequent quantitative assessment of the security risks of these data components.

[0091] return Figure 1 Let me continue explaining.

[0092] S104, Security Risk Quantification of Data Components Based on Information Entropy. The information of nodes and edges is input into the information entropy model to calculate the security risk information entropy of the entire data component, thus quantifying the security risk assessment result of the data component.

[0093] Figure 4 This is a flowchart representing the information entropy-based data component security risk quantification process in S104.

[0094] The output graph in S103 is now known. Information, including: This represents a set of nodes in the graph, where each node represents one field in the dataset; This represents the set of edges in the graph, where each edge represents a label indicating whether there is a relationship between two fields.

[0095] The following is based on Figure 4 The processing of S104 is further explained, which includes the following steps.

[0096] S1041, Calculate the information entropy of each node. For each node i, its information entropy... It can be based on its security level Let's calculate. There are m possible values ​​for the security level, and the probability of each value is... The information entropy is then:

[0097]

[0098] S1042, calculate the information entropy of the edges. For each edge... Its information entropy Based on relationship tags Let's calculate it. Assume the relation label has n possible values, and the probability of each value is... The information entropy is then:

[0099]

[0100] S1043, Calculate the weighted quantized information entropy of nodes and edges. :

[0101]

[0102] S1044, in addition to the quantification of nodes and relationships in the graph structure itself, it is also necessary to consider the information entropy under different field level distributions. Therefore, the information entropy of field level distribution is also included in the calculation:

[0103]

[0104] The first term is the weighted sum of the information entropy of nodes and edges, and the second term is the information entropy of the node weight distribution.

[0105] return Figure 1 Let me continue explaining.

[0106] S105, Data Component Encapsulation. This encapsulates the field's security level information, data security risk graph, security risk information entropy, and basic information together into a data component.

[0107] The field security levels and data security risk diagrams of the dataset were obtained through the calculations in steps S102 to S104. and quantitative assessment value of safety risks Together with the basic information of the dataset, these are encapsulated into data components. By integrating the above feature information and encapsulating it into data components, as a data product, it supports fine-grained matching of multi-dimensional data flow scenarios based on its own security characteristics.

[0108] Optionally, a graph structure is constructed based on field information registered for fields included in the dataset, including:

[0109] The graph attention network method is used to classify fields. The node features corresponding to the fields are extracted through a multi-layer graph neural network with attention mechanism. The node features include the semantic features of the field, the semantic features of the data source to which it belongs, the data source, the data purpose, and whether it is anonymized. The cosine similarity-based method is used to search for the neighboring nodes of each node.

[0110] When constructing the graph structure and performing GAT classification, the following optimizations are made: (1) Instead of using a fully connected graph, the cosNN method based on cosine similarity is used to search for the neighboring nodes of each node, thereby improving the classification accuracy and model execution efficiency; (2) The node features include not only the semantic features of the field, but also the semantic features of the resource to which it belongs, the data source, the data purpose, whether it is desensitized, etc., to enrich the dimensions of the node features.

[0111] Optionally, the implicit relationships between fields are mined, including: based on the security level information of the fields, re-extracting the attribute features and classification features of each field, constructing a data graph, constructing a hidden layer using a multi-layer graph attention network, constructing multiple multi-layer perceptron models according to the node category and outputting node features of different security levels, inputting the node features into an affine transformation model and outputting classification results, thereby identifying the implicit relationships between fields.

[0112] The multi-layer GAT model, with its flexible attention mechanism and powerful generalization ability, can extract complex node features. It then outputs node features with different security levels through a multi-class MLP model. Subsequently, the node features are transformed into node relationship features, and an Affine model is used to output the classification results. The advantage of adding an Affine transformation after the multi-MLP model lies in its ability to flexibly map the hidden states to an output space of arbitrary dimensions through learnable scaling and translation parameters. This is highly suitable for transforming the output of the multi-MLP model into low-dimensional classification results and effectively providing them to the loss function.

[0113] Optionally, the security risk information entropy of the entire data component is calculated, including: calculating the information entropy of each node; calculating the information entropy of each edge; calculating the weighted quantized information entropy of nodes and edges; and calculating the information entropy of each node based on the security level distribution.

[0114] Based on the implicit security risk graph identified in the data component, the information entropy of each node is calculated according to the security level distribution using the information entropy theory. At the same time, the information entropy of the edges is calculated by combining the association between nodes, so as to obtain the overall information entropy of the data of the nodes and edges, thereby quantifying the security risk assessment result of the data component.

[0115] Optionally, the basic information includes the dataset's metadata, data records, unified identifier, attribute description, ownership information, and acquisition method.

[0116] Optionally, after quantifying the security risk assessment results of the data components, the use case can be determined based on their security risks and permission attributes.

[0117] After the data components are processed, their use cases can be determined based on their security and permission attributes (security risk quantification results, scope of application, etc.), including low-density, medium-density, and high-density data application scenarios. Low-density scenarios are suitable for data delivery with low-intensity control, such as files, data streams, and APIs. Medium-density scenarios are suitable for data delivery with medium-intensity encryption, where data is used outside the domain under the protection of security components, such as data sandboxes. High-density scenarios use the strictest communication encryption and the data does not leave the domain, and use technologies such as privacy computing to achieve delivery.

[0118] The security risk assessment method for data components proposed in this application embodiment can be derived from... Figure 5The safety risk assessment device 200 shown is used for execution.

[0119] Figure 5 The device 200 shown includes a data collection module 201, a security classification module 202, a hidden relationship mining module 203, a security risk quantification module 204, and an encapsulation module 205.

[0120] The data collection module 201 is used to collect business-related fields and data content from the data source, perform data cleaning and output the dataset, and register basic information to describe the characteristics of the dataset.

[0121] The security classification module 202 is used to treat fields as a set of nodes, construct a graph structure based on the field information registered for the fields contained in the dataset, obtain a node relationship classification model based on the graph structure through model training, and output the security level information of each field in the dataset environment using the node relationship classification model.

[0122] The implicit relationship mining module 203 is used to obtain new field security features for each field based on basic information and security level information. Fields that have incorporated the new field security features are regarded as a set of nodes. Implicit relationships between fields are mined and edges are formed. A data security risk graph is constructed based on nodes and edges.

[0123] The security risk quantification module 204 is used to input the information of nodes and edges into the information entropy model, calculate the security risk information entropy of the entire data component, and quantify the security risk assessment results of the data component.

[0124] The encapsulation module 205 is used to encapsulate the field's security level information, data security risk diagram, security risk information entropy, and basic information together into the data component.

[0125] like Figure 6 As shown, this application embodiment also provides an electronic device 400, including a processor 401 and a memory 402. The memory 402 stores a program or instructions that can run on the processor 401. When the program or instructions are executed by the processor 401, they implement the various steps of the above-mentioned data component security risk assessment method embodiment and can achieve the same technical effect. To avoid repetition, they will not be described again here.

[0126] It should be noted that the electronic devices in the embodiments of this application include the mobile electronic devices and non-mobile electronic devices described above.

[0127] This application also provides a computer-readable storage medium storing a computer program. When executed by a processor, this computer program implements the various processes of the security risk assessment method embodiment for the data component described above, and achieves the same technical effect. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0128] This application also provides a computer program product, including computer instructions, which, when executed by a processor, implement the above-described... Figure 1 The various processes of the security risk assessment method embodiment for the data components shown are all applicable and can achieve the same technical effect. To avoid repetition, they will not be described again here.

[0129] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0130] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0131] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A method for assessing the security risks of data components, characterized in that, include: Collect business-related fields and data content from the data source, perform data cleaning and output a dataset, and register basic information to describe the characteristics of the dataset. The fields are treated as a set of nodes. A graph structure is constructed based on the field information registered for the fields contained in the dataset. A node relationship classification model based on the graph structure is obtained through model training. The security level information of each field in the dataset environment is output using the node relationship classification model. For each field, new field security features are obtained based on the basic information and the security level information. Fields that incorporate the new field security features are regarded as a set of nodes. Implicit relationships between fields are mined and edges are formed. A data security risk graph is constructed based on the nodes and the edges. The information of the nodes and the information of the edges are input into the information entropy model to calculate the security risk information entropy of the entire data component and quantify the security risk assessment result of the data component. The security level information of the field, the data security risk map, the security risk information entropy, and the basic information are encapsulated together into the data component.

2. The method according to claim 1, characterized in that, The construction of the graph structure based on the field information registered in the fields contained in the dataset includes: The fields are classified using a graph attention network method. The node features corresponding to the fields are extracted through a multi-layer graph neural network with an attention mechanism. The node features include the semantic features of the fields, the semantic features of the data source to which they belong, the data source, the data purpose, and whether the data has been anonymized. A method based on cosine similarity is used to search for the neighboring nodes of each node.

3. The method according to claim 1 or 2, characterized in that, The implicit relationships between the mined fields include: Based on the identified security level information of the fields, the attribute features and classification features of each field are extracted again, and a data graph is constructed. A multi-layer graph attention network is used to construct the hidden layer, and multiple multi-layer perceptron models are constructed according to the node category to output node features of different security levels. The node features are input into the affine transformation model and the classification results are output to identify the implicit relationships between fields.

4. The method according to claim 1 or 2, characterized in that, The calculation of the security risk information entropy of the entire data component includes: Calculate the information entropy of each node; Calculate the information entropy of each edge; Calculate the weighted quantized information entropy of nodes and edges; Calculate the information entropy of each node based on the security level distribution.

5. The method according to claim 1 or 2, characterized in that, The basic information includes the dataset's metadata, data records, unified identifier, attribute description, ownership information, and acquisition method.

6. The method according to claim 1 or 2, characterized in that, After quantifying the security risk assessment results of the data components, the usage scenarios are determined based on their security risks and permission attributes.

7. A security risk assessment device for data components, characterized in that, include: The data collection module collects business-related fields and data content from the data source, performs data cleaning and outputs a dataset, and registers basic information describing the characteristics of the dataset. The security classification module treats fields as sets of nodes, constructs a graph structure based on the field information registered for the fields contained in the dataset, obtains a node relationship classification model based on the graph structure through model training, and outputs the security level information of each field in the dataset environment using the node relationship classification model. The implicit relationship mining module obtains new field security features for each field based on the basic information and the security level information. Fields that incorporate the new field security features are regarded as a set of nodes. Implicit relationships between fields are mined and edges are formed. A data security risk graph is constructed based on the nodes and the edges. The security risk quantification module inputs the information of the node and the information of the edge into the information entropy model, calculates the security risk information entropy of the entire data component, and quantifies the security risk assessment result of the data component. The encapsulation module encapsulates the security level information of the field, the data security risk graph, the security risk information entropy, and the basic information together into the data component.

8. An electronic device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the security risk assessment method for a data component as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the security risk assessment method for data components as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, It includes computer instructions that, when executed by a processor, implement the steps of the security risk assessment method for data components as described in any one of claims 1 to 6.

Images