Blood relationship tracking and operation log analysis method and system for education data

Abstract

The invention discloses a blood relationship tracking and operation log analysis method and system for educational data, relates to the field of educational data analysis, and realizes whole-process closed-loop management of educational data safety management by constructing a double mapping model. The method comprises the following steps: firstly, based on an SQL structure optimization model trained by unauthorized historical data, the query performance can be remarkably improved on the premise of ensuring semantic accuracy; secondly, establishing a risk identification mechanism between a database permission level and an SQL operation structure through an unauthorized access detection model constructed by permission related data; a dynamic weight decision of immediate responsiveness and security is introduced, and system efficiency and data security are intelligently balanced when an unauthorized risk is detected; performance optimization, authority control, risk assessment and blood relationship tracking are organically fused, the problem that safety and performance are difficult to consider in traditional data management is solved, and reliable guarantee is provided for safe and efficient operation of an educational data system.

Description

Technical Field

[0001] This invention belongs to the field of educational data analysis, and specifically relates to a method and system for tracing lineage and analyzing operation logs of educational data. Background Technology

[0002] Traditional SQL optimization for tracing the lineage of educational data focuses solely on performance improvement while neglecting access control and security risks. This leads to unauthorized access during data operations. In other words, traditional SQL optimization models ignore access control risks, static access control mechanisms are unable to adapt to the limitations of dynamic data operation scenarios, and there is a dilemma between system response speed and data security when there is a lack of intelligent decision support. Unclear data lineage leads to difficulties in tracing the source and inefficient impact analysis. Summary of the Invention

[0003] To address the problems in related technologies, this invention proposes a method and system for tracing lineage and analyzing operation logs of educational data, thereby overcoming the aforementioned technical problems existing in the prior art.

[0004] To solve the above-mentioned technical problems, the present invention is achieved through the following technical solution:

[0005] This invention relates to a method for kinship tracing and operation log analysis of educational data, comprising the following steps:

[0006] S1. Obtain the SQL statements for database operations corresponding to several sets of historical education data that do not involve permission settings;

[0007] S2. Obtain the structure data of the optimized SQL statement corresponding to the SQL statement collected by S1, the amount of data in the database tables involved, and the data operation type data, and construct the final optimized SQL structure mapping model.

[0008] S3. Input the SQL statements, the amount of data in the database tables involved in the operation, and the data operation type into the mapping model constructed in S2 for mapping during the current operation on educational data.

[0009] S4. Obtain the structure of several sets of historical education data involving permission settings, the permission level data of each data table involved, and whether it is unauthorized access. Then, construct the final unauthorized access existence mapping model based on the obtained data.

[0010] S5. Obtain the permission levels of the data tables involved in the optimized SQL structure data in S3 and input them into the mapping model in S4 for mapping; Based on the mapping results, compare the corresponding immediate responsiveness weight and security weight. When there is a risk of unauthorized access, if the responsiveness weight is greater than the security weight, the optimized operation SQL structure is adopted; otherwise, it is not adopted.

[0011] S6. Construct a lineage diagram of the current education data based on the final operation SQL structure data obtained after the judgment in S5.

[0012] Preferably, step S1 includes the following steps:

[0013] S11. Define several types of educational data to obtain a set of educational data types; the set of educational data types includes educational metadata types and operation log data types; the educational metadata types include technical metadata types, business metadata types, and operation metadata types; then define several types of data operation types to obtain a set of data operation types;

[0014] S12. Obtain several sets of historical education data that do not involve permission settings according to the educational data type set to obtain a historical education dataset; perform separation operations on the educational metadata and operation log data in the historical education dataset to obtain a first historical education metadata dataset and a first historical education operation log dataset.

[0015] Based on the first historical education metadata dataset and the first historical education operation log dataset, obtain the corresponding SQL statements for database operations to obtain the first historical operation SQL statement set;

[0016] By constructing a dual system of structured educational data type sets and data operation type sets, comprehensive coverage and refined management of educational data governance are achieved. By screening historical data that does not involve permission setting operations, the purity of the analysis samples is ensured. Based on the first historical educational metadata dataset, SQL statements can be extracted to accurately reconstruct historical data operation scenarios, providing a structured analysis foundation for data quality assessment, operation pattern mining, system performance optimization, and security auditing.

[0017] Preferably, step S2 includes the following steps:

[0018] S21. Based on the data operation type set and the first historical education operation log dataset, scan the first historical operation SQL statement set to obtain the original structure data of each operation SQL statement, the structure data of each operation SQL statement after subsequent operation optimization, the data volume and data operation type of the database table involved in the corresponding operation, and obtain the historical operation SQL original structure dataset, the historical optimized SQL structure dataset, the historical operation database data volume set and the historical operation type dataset.

[0019] S22. Based on the historical operation SQL original structure dataset, historical operation library data volume dataset, historical operation type dataset, and historical optimized SQL structure dataset, construct a mapping model between the operation SQL original structure data, operation library data volume, operation type data, and optimized SQL structure data to obtain the final optimized SQL structure mapping model.

[0020] By comprehensively scanning the first set of historical SQL statements, and simultaneously capturing a dual-version comparison of the original and optimized structured data, a complete record of the SQL evolution trajectory is formed. Combining quantitative indicators of the data table size involved in the operation with the classification of specific operation types, a foundation for correlation analysis of structural characteristics, data size, and operation behavior is established. Based on the four-element mapping relationship between the original SQL structure, data volume characteristics, operation type, and optimized SQL structure, a mapping model from problematic SQL to optimization solution is established, which can generate the optimal SQL rewriting solution in real time.

[0021] Preferably, the final optimized SQL structure mapping model described in S22 adopts a hybrid architecture model that combines an attention-based sequence-to-sequence model with a multi-layer fully connected network.

[0022] By capturing the syntactic structure and semantic information of the original SQL through an encoder, focusing on key operation fragments using an attention mechanism, and then generating an optimized SQL structure by combining the data volume and operation type context through a decoder, this design can effectively learn complex SQL rewriting patterns and adapt to optimization strategy adjustments under different data scales.

[0023] Preferably, step S3 includes the following steps:

[0024] S31. Based on the set of educational data types and the set of data operation types, obtain the corresponding operation SQL statement, the amount of data in the database table involved in the operation, and the data operation type during the current operation on the educational data, and obtain the current initial operation SQL statement set, the current operation database data set, and the current operation type dataset.

[0025] The current initial operation SQL statement set is scanned to obtain the current initial operation SQL structure dataset;

[0026] S32. Input the data in the current initial operation SQL structure dataset, the current operation library data set and the current operation type dataset into the final optimized SQL structure mapping model for mapping to obtain the current optimized operation SQL structure dataset.

[0027] Structured scanning of SQL statements can deeply analyze their inherent logical features, overcoming the limitations of simple syntax analysis; using a trained SQL structure mapping model for mapping can automatically generate high-performance SQL structures based on historical optimization experience, effectively avoiding the subjective bias and experience dependence problems existing in traditional manual optimization.

[0028] Preferably, step S4 includes the following steps:

[0029] S41. Set several database permission levels to obtain a system permission level set; in addition, according to the educational data type set, obtain several sets of historical educational data related to permission settings and perform separation operations to obtain a second historical educational metadata set and a second historical educational operation log dataset.

[0030] Based on the second historical education metadata dataset and the second historical education operation log dataset, obtain the corresponding database operation SQL statements to obtain the second historical operation SQL statement set; scan the second historical operation SQL statement set and obtain the structure data of each operation SQL statement to obtain the historical operation SQL structure dataset.

[0031] S42. Based on the system permission level set, obtain the permission level data of each data table involved in the operation in the historical operation SQL structure dataset and whether it is an unauthorized access, to obtain the historical data table permission level dataset and the historical unauthorized access existence dataset.

[0032] S43. Based on the historical data table permission level dataset, historical operation SQL structure dataset, and historical unauthorized access existence dataset, construct a mapping model between database permission level data, operation SQL structure data, and unauthorized access existence data to obtain the final unauthorized access existence mapping model.

[0033] Based on multi-dimensional database permission level settings, a hierarchical control system was established, enabling permission management to shift from a rough approach to a structured one. By scanning SQL statement structures and matching them with permission levels, potential unauthorized operations can be automatically identified. The constructed mapping model not only records historical unauthorized behaviors but also establishes association rules between permission levels and SQL structures, providing a basis for decision-making in dynamic permission adjustments.

[0034] Preferably, the final unauthorized access existence mapping model described in S43 adopts a hybrid neural network model that integrates a multilayer perceptron and an attention mechanism;

[0035] The model structure fully considers the sequential features of SQL statements and the discrete features of permission levels. It extracts SQL syntax patterns through convolutional networks and dynamically adjusts feature importance by combining an attention mechanism, which can effectively identify unauthorized access behavior in complex scenarios.

[0036] Preferably, step S5 includes the following steps:

[0037] S51. Based on the system permission level set, obtain the permission level data of each data table involved in the current optimized operation SQL structure dataset, and obtain the current data table permission level dataset.

[0038] Each set of optimized operation SQL structure data in the current optimized operation SQL structure dataset is combined with the current data table permission level dataset and input into the final unauthorized access existence mapping model to obtain the current unauthorized access existence dataset.

[0039] S52. Obtain the instant responsiveness weight and security weight of the data operation corresponding to each group of optimized operation SQL structure data in the current optimized operation SQL structure dataset, and obtain the current instant responsiveness weight dataset and the current security weight dataset.

[0040] S53. Based on the current real-time responsiveness weight dataset and the current security weight dataset, if there is 1 data point in the current unauthorized access dataset and the real-time responsiveness weight data of the data operation corresponding to the unauthorized access data is greater than the security weight data, the optimized operation SQL structure data is adopted and the current data table permission level dataset is adjusted.

[0041] If the current unauthorized access data contains 1 data point for unauthorized access, and the immediate responsiveness weight data of the data operation corresponding to the unauthorized access data is less than or equal to the security weight data, then the optimized operation SQL structure data will not be adopted, and the corresponding current initial operation SQL structure data will still be adopted.

[0042] Otherwise, use the entire optimized SQL structure dataset to obtain the final SQL structure dataset.

[0043] By employing a dual evaluation of immediate responsiveness weights and security weights, a multi-dimensional decision-making basis is established, enabling the system to flexibly adjust security strategies according to specific business scenarios. Conditional judgment logic is used to differentiate the processing of SQL statements with privilege escalation risks, avoiding performance losses caused by a "one-size-fits-all" approach while ensuring the security priority of critical operations. When optimizing SQL statements poses a security risk, the system automatically reverts to the initial secure version, ensuring system robustness and providing data support for continuous optimization.

[0044] Preferably, step S6 includes the following steps:

[0045] S61. Convert each final operation SQL structure data in the current final operation SQL structure dataset into an abstract syntax tree to obtain the current abstract syntax tree;

[0046] S62. Traverse the current abstract syntax tree and construct the lineage graph of the current educational data to obtain the lineage graph of the current educational data, and then visualize the lineage graph of the current educational data.

[0047] Through the transformation process of abstract syntax trees, the deep semantic structure of SQL statements can be accurately parsed, and the complex relationships between tables and fields can be fully captured. Furthermore, by constructing a lineage graph containing complete vertices and edges, the end-to-end tracking capability of data from the source table to the target table is established, making the data flow clear at a glance. The abstract data relationships are transformed into an intuitive graphical interface, which greatly reduces the threshold for understanding data lineage.

[0048] A system for tracing the lineage of educational data and analyzing operation logs includes a module for obtaining historical educational operation SQL statements, a module for constructing an optimized SQL structure mapping model, a module for mapping the current optimized operation SQL structure data, a module for constructing a mapping model for unauthorized access, a module for determining the adoption of the current optimized operation SQL structure, and a module for obtaining the lineage of current educational data.

[0049] The present invention has the following beneficial effects:

[0050] 1. This invention achieves closed-loop management of the entire process of educational data security governance by constructing a dual mapping model. First, the SQL structure optimization model trained on historical data without permissions can significantly improve query performance while ensuring semantic accuracy. Second, an unauthorized access detection model constructed through permission-related data establishes a risk identification mechanism between database permission levels and SQL operation structures. Then, a dynamic weight decision between real-time responsiveness and security is introduced to intelligently balance system efficiency and data security when unauthorized access risks are detected. Finally, a visualized lineage diagram is constructed to fully present the data flow path, providing an intuitive basis for data tracing, impact analysis, and compliance auditing. This organically integrates performance optimization, access control, risk assessment, and lineage tracing, solving the pain point of balancing security and performance in traditional data management and providing a reliable guarantee for the safe and efficient operation of educational data systems.

[0051] 2. In this invention, by scanning SQL statement structure and matching permission levels, potential unauthorized operations can be automatically identified, transforming traditional post-event auditing into real-time risk warning; the constructed mapping model not only records historical unauthorized behaviors, but also establishes association rules between permission levels and SQL structures, providing a decision-making basis for dynamic permission adjustments.

[0052] 3. This invention establishes a multi-dimensional decision-making basis through dual evaluation of immediate responsiveness weight and security weight, enabling the system to flexibly adjust security strategies according to specific business scenarios; it uses conditional judgment logic to differentiate the processing of SQL statements with privilege escalation risks, which avoids the performance loss caused by "one-size-fits-all" and ensures the security priority of critical operations.

[0053] Of course, any product implementing this invention does not necessarily need to achieve all of the advantages described above at the same time. Attached Figure Description

[0054] To more clearly illustrate the technical solutions of the embodiments of the invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0055] Figure 1 This is a flowchart illustrating a method for kinship tracing and operation log analysis of educational data according to the present invention.

[0056] Figure 2 A flowchart illustrating the process of constructing the final optimized SQL structure mapping model for this invention;

[0057] Figure 3 This is a flowchart illustrating the process of optimizing the current SQL operation.

[0058] Figure 4 A flowchart illustrating the process of constructing the final mapping model for unauthorized access;

[0059] Figure 5 A flowchart illustrating the decision-making process used to optimize the SQL structure for operations;

[0060] Figure 6 This is a schematic diagram of a module for a lineage tracing and operation log analysis system for educational data according to the present invention. Detailed Implementation

[0061] The technical solutions of the embodiments of the invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the invention, and not all embodiments. Based on the embodiments of the invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the invention.

[0062] Example 1

[0063] Please see Figure 1This embodiment is a method for tracing lineage and analyzing operation logs of educational data, including the following steps:

[0064] S1. Obtain the SQL statements for database operations corresponding to several sets of historical education data that do not involve permission settings;

[0065] S1 includes the following steps:

[0066] S11. Define several types of educational data to obtain an educational data type set; the educational data type set includes educational metadata types and operation log data types; the educational metadata types include technical metadata types, business metadata types, and operation metadata types; technical metadata includes database table structure, field types, etc.; business metadata covers educational business attributes such as student information definitions and curriculum standards; operation metadata records operation information such as data loading time and change history; then define several types of data operation to obtain a data operation type set; the data operation type set includes query, add, modify, and delete, etc.

[0067] S12. Obtain several sets of historical education data that do not involve permission settings according to the educational data type set to obtain a historical education dataset; perform separation operations on the educational metadata and operation log data in the historical education dataset to obtain a first historical education metadata dataset and a first historical education operation log dataset.

[0068] Based on the first historical education metadata dataset and the first historical education operation log dataset, obtain the corresponding SQL statements for database operations to obtain the first historical operation SQL statement set;

[0069] By constructing a dual system of structured educational data types and data operation types, comprehensive coverage and refined management of educational data governance are achieved. Technical metadata provides a standardized description of the underlying data storage architecture, ensuring the uniformity of database table structures and field types. Business metadata accurately maps the core attributes of educational business entities such as student information and curriculum standards, guaranteeing consistency between business logic and data definition. Operational metadata fully records data loading time and change history, forming a traceable data lifecycle. Clearly defined query, add, modify, and delete operation types establish a complete classification framework for subsequent behavioral analysis. Historical data without permission settings is filtered to ensure the purity of the analysis sample, and a metadata and operation log separation mechanism is adopted, maintaining the independence of core business data while fully preserving operation context information. Finally, SQL statements are extracted based on the first historical educational metadata dataset, accurately reconstructing historical data operation scenarios. This provides a structured analytical foundation for data quality assessment, operation pattern mining, system performance optimization, and security auditing, constructing a full-link governance system from data definition and business logic to operational behavior, significantly improving the standardization level, risk control capabilities, and intelligent decision support efficiency of educational data management.

[0070] S2. Obtain the structure data of the optimized SQL statement corresponding to the SQL statement collected by S1, the amount of data in the database tables involved, and the data operation type data, and construct the final optimized SQL structure mapping model.

[0071] Please see Figure 2 S2 includes the following steps:

[0072] S21. Based on the data operation type set and the first historical education operation log dataset, scan the first historical operation SQL statement set to obtain the original structure data of each operation SQL statement, the structure data of each operation SQL statement after subsequent operation optimization, the data volume and data operation type of the database table involved in the corresponding operation, and obtain the historical operation SQL original structure dataset, the historical optimized SQL structure dataset, the historical operation database data volume set and the historical operation type dataset.

[0073] The contents of the original structure dataset of the historical operation SQL can be seen in Table 1 below:

[0074] Table 1. Example table of raw SQL structure data manipulation

[0075] field name type length SQL statement name CHAR 200 SELECT CHAR 200 FROM CHAR 200 JOIN CHAR 200 ON CHAR 200 WHERE CHAR 200 GROUP CHAR 200 BY CHAR 200 HAVING CHAR 200 ORDER BY CHAR 200 SQL statement nesting number (refers to the number of nested levels of an SQL statement) CHAR 8 Record Number INT 6

[0076] S22. Based on the historical operation SQL original structure dataset, historical operation library data volume dataset, historical operation type dataset, and historical optimized SQL structure dataset, construct a mapping model between the operation SQL original structure data, operation library data volume, operation type data, and optimized SQL structure data to obtain the final optimized SQL structure mapping model.

[0077] The final optimized SQL structure mapping model described in S22 adopts a hybrid architecture model that combines an attention-based sequence-to-sequence model with a multi-layer fully connected network.

[0078] S22 includes the following steps:

[0079] S221. Construct an initial optimized SQL structure mapping model and set a first training data ratio (e.g., 8:2 or 7:3, which can be adjusted adaptively according to the actual training situation); divide the historical operation SQL original structure dataset, historical operation database data set, historical operation type dataset and historical optimized SQL structure dataset according to the first training data ratio to obtain the first training dataset and the first test dataset.

[0080] S222. Set a first training error threshold (10%~15%, which can be adjusted adaptively according to the actual training situation); input the first training dataset into the initial optimized SQL structure mapping model for training; during the training process, if the training error is less than the first training error threshold, stop training and obtain the trained optimized SQL structure mapping model; otherwise, continue training until the training error is less than the first training error threshold.

[0081] S223. Set a first test accuracy threshold (90%~95%, which can be adjusted adaptively according to the actual test situation); input the first test dataset into the trained optimized SQL structure mapping model for testing; after the test is completed, obtain the first test accuracy data; if the first test accuracy data is greater than or equal to the first test accuracy threshold, use the trained optimized SQL structure mapping model as the final optimized SQL structure mapping model; otherwise, return to S222 to continue training the trained optimized SQL structure mapping model and repeat S223 until the first test accuracy data is greater than or equal to the first test accuracy threshold.

[0082] The structure of the initial optimized SQL structure mapping model can be seen in Table 2 below:

[0083] Table 2. Schematic diagram of the SQL structure mapping model after initial optimization.

[0084] Model Name Model type Model Structure Initial optimized SQL structure mapping model A hybrid architecture model combining attention-based sequence-to-sequence models with multi-layer fully connected networks. 1. Encoder: Input Layer: Accepts the original SQL structure feature vector (200 dimensions designed according to the fields in Table 1), the scalar of the operation database data (normalized to the range of 0-1), and the one-hot encoding vector of the operation type (dimensionality determined according to the number of types); Word Embedding Layer: Converts SQL keywords and identifiers into 128-dimensional dense vectors; Bidirectional Long Short-Term Memory Network: Contains two hidden layers, each with 256 units, used to capture the sequence dependencies of the SQL statement; Attention Layer: Employs an additive attention mechanism to calculate the weighted sum of the hidden states, with the attention dimension set to 512; 2. Decoding Part: Input Layer: Receives the context vector output by the encoder and the previously generated... Optimize SQL labeling; Unidirectional Long Short-Term Memory Network: Contains 2 hidden layers, each with 256 units; Fully connected layers: First fully connected layer: 512 neurons, using ReLU activation function to process the concatenation result of attention output and LSTM state; Second fully connected layer: 256 neurons, using ReLU activation function to further extract features; Output layer: Dimensions consistent with the optimized SQL structure data size, using Softmax activation function to generate the probability distribution of the next label; 3. Connectivity components: Add 3 fully connected bridging layers between the encoder and decoder, each with 128 neurons, using Tanh activation function to facilitate information flow;

[0085] By capturing the syntactic structure and semantic information of the original SQL through an encoder, focusing on key operation fragments using an attention mechanism, and then generating an optimized SQL structure by combining the data volume and operation type context through a decoder, this design can effectively learn complex SQL rewriting patterns and adapt to optimization strategy adjustments under different data scales.

[0086] By establishing a multi-dimensional SQL operation analysis system and an intelligent mapping model, a complete closed-loop system for database performance optimization was constructed. A comprehensive scan of the first historical SQL statement set was performed, simultaneously capturing a dual-version comparison of the original and optimized structured data to form a complete record of SQL evolution. Combining quantitative indicators of the data table size involved in the operation with specific operation type classifications, a foundation for correlation analysis of structural characteristics, data scale, and operation behavior was established. SQL statements were finely decomposed and stored according to key clauses such as SELECT, FROM, and JOIN, and hierarchical identification using statement hierarchy numbers and record numbers was implemented, enabling the complete structural restoration of complex nested SQL statements. Based on the four-element mapping relationship between the original SQL structure, data volume characteristics, operation type, and optimized SQL structure, a mapping model from problematic SQL to optimization solutions was established. This model not only generates optimal SQL rewriting solutions for specific data scales and operation types but also continuously enriches optimization strategies through continuous learning, significantly improving database query efficiency, reducing system resource consumption, and ultimately achieving a paradigm shift from experience-driven to data-driven database performance management.

[0087] S3. Input the SQL statements, the amount of data in the database tables involved in the operation, and the data operation type into the mapping model constructed in S2 for mapping during the current operation on educational data.

[0088] Please see Figure 3 S3 includes the following steps:

[0089] S31. Based on the set of educational data types and the set of data operation types, obtain the corresponding operation SQL statement, the amount of data in the database table involved in the operation, and the data operation type during the current operation on the educational data, and obtain the current initial operation SQL statement set, the current operation database data set, and the current operation type dataset.

[0090] The current initial operation SQL statement set is scanned to obtain the current initial operation SQL structure dataset;

[0091] S32. Input the data in the current initial operation SQL structure dataset, the current operation library data set and the current operation type dataset into the final optimized SQL structure mapping model for mapping to obtain the current optimized operation SQL structure dataset.

[0092] By integrating multi-dimensional information such as SQL statements, data volume, and operation types, a comprehensive foundation for operational feature analysis was established, providing data support for precise optimization. Secondly, structured scanning of SQL statements can deeply analyze their inherent logical features, overcoming the limitations of simple syntax analysis. By using a trained SQL structure mapping model, high-performance SQL structures can be automatically generated based on historical optimization experience, effectively avoiding the subjective bias and experience dependence problems existing in traditional manual optimization. This not only significantly reduces the operational burden on database administrators but also dynamically adjusts execution strategies according to data scale, significantly improving the execution efficiency of large-scale data operations while ensuring data consistency, ultimately achieving a leap in the overall performance of the education data processing system.

[0093] S4. Obtain the structure of several sets of historical education data involving permission settings, the permission level data of each data table involved, and whether it is unauthorized access. Then, construct the final unauthorized access existence mapping model based on the obtained data.

[0094] Please see Figure 4 S4 includes the following steps:

[0095] S41. Set several database permission levels to obtain a system permission level set; in addition, according to the educational data type set, obtain several sets of historical educational data related to permission settings and perform separation operations to obtain a second historical educational metadata set and a second historical educational operation log dataset.

[0096] Based on the second historical education metadata dataset and the second historical education operation log dataset, obtain the corresponding database operation SQL statements to obtain the second historical operation SQL statement set; scan the second historical operation SQL statement set and obtain the structure data of each operation SQL statement to obtain the historical operation SQL structure dataset.

[0097] S42. Based on the system permission level set, obtain the permission level data of each data table involved in the operation in the historical operation SQL structure dataset and whether it is an unauthorized access (1 for yes, 0 for no), to obtain the historical data table permission level dataset and the historical unauthorized access existence dataset.

[0098] S43. Based on the historical data table permission level dataset, historical operation SQL structure dataset, and historical unauthorized access existence dataset, construct a mapping model between database permission level data, operation SQL structure data, and unauthorized access existence data to obtain the final unauthorized access existence mapping model.

[0099] The final unauthorized access existence mapping model described in S43 adopts a hybrid neural network model that integrates multilayer perceptron and attention mechanism;

[0100] S43 includes the following steps:

[0101] S431. Construct an initial mapping model for unauthorized access and set a second training data ratio (e.g., 8:2 or 7:3, which can be adjusted adaptively according to the actual training situation); divide the historical data table permission level dataset, historical operation SQL structure dataset, and historical unauthorized access dataset according to the second training data ratio to obtain the second training dataset and the second test dataset.

[0102] S432. Set a second training error threshold (10%~15%, which can be adjusted adaptively according to the actual training situation); input the second training dataset into the initial unauthorized access existence mapping model for training; during the training process, if the training error is less than the second training error threshold, stop training and obtain the trained unauthorized access existence mapping model; otherwise, continue training until the training error is less than the second training error threshold.

[0103] S433. Set a second test accuracy threshold (90%~95%, which can be adjusted adaptively according to the actual test situation); input the second test dataset into the trained unauthorized access existence mapping model for testing; after the test is completed, obtain the second test accuracy data; if the second test accuracy data is greater than or equal to the second test accuracy threshold, use the trained unauthorized access existence mapping model as the final unauthorized access existence mapping model; otherwise, return to S432 to continue training the trained unauthorized access existence mapping model and repeat S433 until the second test accuracy data is greater than or equal to the second test accuracy threshold.

[0104] The structure of the mapping model for the initial unauthorized access can be seen in Table 3 below:

[0105] Table 3. Schematic diagram of the mapping model structure for initial unauthorized access.

[0106] Model Name Model type Model Structure Initial unauthorized access has a mapping model Hybrid neural network model that integrates multilayer perceptron and attention mechanism Input Layer: SQL Structure Branch Input: Parses the SQL statement into a 500-dimensional feature vector, containing structured features such as syntax tree encoding, operation type (SELECT / UPDATE, etc.), and table relationships; Permission Level Branch Input: Encodes the database permission level into a 50-dimensional one-hot encoding vector; SQL Structure Branch (4-layer convolutional network): First Convolutional Layer: 64 convolutional kernels, kernel size 3×3, stride 1, using ReLU (Rectified Linear Unit) activation function; First Max Pooling Layer: Pooling window 2×2, stride 2; Second Convolutional Layer: 128 convolutional kernels, kernel size 3×3, stride 1, ReLU activation; Second Max Pooling Layer: Pooling window 2×2, stride 2; Flattening Layer: ... The convolutional output is flattened into a one-dimensional vector; Permission level branches (3 fully connected layers): First fully connected layer: 128 neurons, ReLU activation function; Second fully connected layer: 64 neurons, ReLU activation function; Feature fusion layer: Attention mechanism layer: weighted fusion of the output features of the two branches, with 4 attention heads; Fusion fully connected layer: 256 neurons, ReLU activation; Output layer: Final fully connected layer: 2 neurons, corresponding to "normal access" and "unauthorized access"; Activation function: Softmax function, output probability distribution; Parameter configuration: Dropout rate: 0.3, to prevent overfitting; Optimizer: Adam optimizer, learning rate 0.001; Loss function: Cross-entropy loss function;

[0107] The model structure fully considers the sequential features of SQL statements and the discrete features of permission levels. It extracts SQL syntax patterns through convolutional networks and dynamically adjusts feature importance by combining an attention mechanism, which can effectively identify unauthorized access behavior in complex scenarios.

[0108] By constructing an unauthorized access mapping model, the level of precision in educational data security management has been significantly improved. Specifically, based on multi-dimensional database permission level settings, a hierarchical control system has been established, shifting permission management from a broad approach to a structured one. By scanning SQL statement structures and matching them with permission levels, potential unauthorized operations can be automatically identified, transforming traditional post-event auditing into real-time risk warnings. The constructed mapping model not only records historical unauthorized behaviors but also establishes association rules between permission levels and SQL structures, providing a basis for dynamic permission adjustments. Finally, the model trained on historical data has self-learning capabilities, enabling it to adapt to the continuous changes in educational data scenarios and effectively solving the pain point of traditional permission management's inability to cope with complex data flows. Thus, a closed-loop management system covering the entire process from data collection and permission modeling to risk prediction has been achieved, providing a scalable and verifiable solution for educational data security.

[0109] S5. Obtain the permission levels of the data tables involved in the optimized SQL structure data in S3 and input them into the mapping model in S4 for mapping; Based on the mapping results, compare the corresponding immediate responsiveness weight and security weight. When there is a risk of unauthorized access, if the responsiveness weight is greater than the security weight, the optimized operation SQL structure is adopted; otherwise, it is not adopted.

[0110] Please see Figure 5 S5 includes the following steps:

[0111] S51. Based on the system permission level set, obtain the permission level data of each data table involved in the current optimized operation SQL structure dataset, and obtain the current data table permission level dataset.

[0112] Each set of optimized operation SQL structure data in the current optimized operation SQL structure dataset is combined with the current data table permission level dataset and input into the final unauthorized access existence mapping model to obtain the current unauthorized access existence dataset.

[0113] S52. Obtain the instant responsiveness weight and security weight of the data operation corresponding to each group of optimized operation SQL structure data in the current optimized operation SQL structure dataset, and obtain the current instant responsiveness weight dataset and the current security weight dataset.

[0114] S53. Based on the current real-time responsiveness weight dataset and the current security weight dataset, if there is 1 data point in the current unauthorized access dataset and the real-time responsiveness weight data of the data operation corresponding to the unauthorized access data is greater than the security weight data, the optimized operation SQL structure data is adopted and the current data table permission level dataset is adjusted.

[0115] If the current unauthorized access data contains 1 data point for unauthorized access, and the immediate responsiveness weight data of the data operation corresponding to the unauthorized access data is less than or equal to the security weight data, then the optimized operation SQL structure data will not be adopted, and the corresponding current initial operation SQL structure data will still be adopted.

[0116] Otherwise, use the entire optimized SQL structure dataset to obtain the final SQL structure dataset.

[0117] By introducing a dynamic weighted decision-making mechanism, an intelligent balance between performance and security is achieved while ensuring the security of educational data. Specifically, a multi-dimensional decision-making basis is established through dual evaluation of immediate responsiveness weight and security weight, enabling the system to flexibly adjust security strategies according to specific business scenarios. Conditional judgment logic is used to differentiate the processing of SQL statements with privilege escalation risks, avoiding the performance loss caused by a "one-size-fits-all" approach while ensuring the security priority of critical operations. Finally, a complete feedback loop is constructed, automatically reverting to the initial secure version when optimizing SQL statements poses a security risk, ensuring system robustness and providing data support for continuous optimization. This solves the pain point of traditional data security governance where performance and security are difficult to balance, realizing a shift from passive defense to proactive adaptation, and providing reliable assurance for the secure and efficient operation of educational data systems.

[0118] S6. Construct a lineage diagram of the current educational data based on the final operation SQL structure data obtained after the judgment in S5.

[0119] S6 includes the following steps:

[0120] S61. Convert each final operation SQL structure data in the current final operation SQL structure dataset into an abstract syntax tree. This conversion can be performed using an SQL parser (such as sqlparse, jsqlparser, etc.) to obtain the current abstract syntax tree.

[0121] S62. Traverse the current abstract syntax tree and construct the lineage graph of the current educational data to obtain the current educational data lineage graph; wherein: vertex (node): represents a data entity (such as a table or field), edge: represents the data flow direction, pointing from the source table to the target table, and includes the operation type (such as JOIN, WHERE, SELECT, etc.) and field mapping relationship; then visualize the current educational data lineage graph;

[0122] For example, consider the process of tracing lineage in a student performance analysis system; as follows:

[0123] 1. Analyze student performance data from various schools, involving the following core data tables: `students` table: stores basic student information (student ID, name, class ID); `scores` table: stores student scores for each subject (student ID, subject, score); `classes` table: stores class information (class ID, school ID, grade); `schools` table: stores school information (school ID, school name, region).

[0124] 2. SQL optimization and permission verification phase:

[0125] The initial SQL statement is a complex nested query: The SQL statement is as follows:

[0126] SELECT s.name, sc.score FROM students s, scores sc WHERE s.id =sc.student_id

[0127] AND s.class_id IN (SELECT class_id FROM classes WHERE school_id = 'S001');

[0128] After final optimization of the SQL structure mapping model, the optimized version is generated as follows:

[0129] SELECT s.name, sc.score FROM students s JOIN scores sc ON s.id =sc.student_id

[0130] JOIN classes c ON s.class_id = c.class_id WHERE c.school_id = 'S001';

[0131] 3. Unauthorized Access Detection and Decision-Making Phase:

[0132] The system permission level set is set as: {1: Public, 2: Internal, 3: Sensitive, 4: Confidential}; the current data table permission level dataset is: students table: permission level 3 (sensitive); scores table: permission level 4 (confidential); classes table: permission level 2 (internal); schools table: permission level 1 (public); the optimized SQL structure is input into the final unauthorized access mapping model, and the detection result shows: there is a risk of unauthorized access (marked as 1).

[0133] 4. Weighting and Final Decision:

[0134] Current real-time responsiveness weight dataset: query response time weight 0.7; Current security weight dataset: data leakage risk weight 0.8; Since the security weight (0.8) > real-time responsiveness weight (0.7), it is determined that the optimized SQL structure will not be used, and the initial operation SQL structure will be reverted;

[0135] 5. Bloodline relationship construction and visualization:

[0136] The final SQL structure is converted into an abstract syntax tree, and a lineage graph is constructed by traversing it: Vertex nodes:

[0137] The `name` field in the `students` table, the `score` field in the `scores` table, and the `class_id` field in the `classes` table; edge relationships: `students.name` → SELECT result (direct mapping), `scores.score` → SELECT result (direct mapping), `classes.class_id` → `students.class_id` (WHERE condition association), `classes.school_id` → constant 'S001' (WHERE condition association);

[0138] By converting the final SQL structure data into an abstract syntax tree and constructing a lineage graph, a deep understanding and transparent management of the flow path of educational data is achieved. Specifically, the conversion process of the abstract syntax tree can accurately parse the deep semantic structure of SQL statements and fully capture the complex relationships between tables and fields. Secondly, by constructing a lineage graph containing complete vertices and edges, a full-link tracking capability for data from the source table to the target table is established, making the data flow clear at a glance. Transforming abstract data relationships into an intuitive graphical interface greatly reduces the threshold for understanding data lineage. This provides operable and verifiable technical support for educational data governance, effectively solving the pain points of opaque lineage relationships and difficulties in impact analysis in traditional data management, and laying a solid foundation for data quality control, security auditing, and compliance inspection.

[0139] Example 2

[0140] Please see Figure 6 This embodiment discloses a system for tracing the lineage of educational data and analyzing operation logs. The system can implement the methods of the above embodiments, including a historical educational operation SQL statement acquisition module, an optimized SQL structure mapping model construction module, a current optimized operation SQL structure data mapping module, an unauthorized access existence mapping model construction module, a current optimized operation SQL structure adoption determination module, and a current educational data lineage acquisition module.

[0141] The historical education operation SQL statement acquisition module acquires several sets of database operation SQL statements corresponding to historical education data that do not involve permission settings;

[0142] The optimized SQL structure mapping model construction module obtains the structure data of the optimized SQL statement corresponding to the SQL statement collected by S1, the amount of data in the database tables involved, and the data operation type data, and constructs the final optimized SQL structure mapping model in combination with the SQL statement collected by S1.

[0143] The optimized SQL structure data mapping module inputs the corresponding SQL statements, the amount of data in the database tables involved in the operation, and the data operation type into the mapping model constructed by S2 for mapping during the previous operation on the educational data.

[0144] The unauthorized access existence mapping model construction module obtains several sets of structure data of operation SQL corresponding to historical education data involving permission settings, permission level data of each data table involved, and whether it is unauthorized access, and then constructs the final unauthorized access existence mapping model based on the obtained data.

[0145] The current optimized operation SQL structure uses a judgment module to obtain the permission level of the data table involved in the optimized SQL structure data in S3 and input it into the mapping model in S4 for mapping; based on the mapping result, the corresponding immediate responsiveness weight and security weight are compared. When there is a risk of unauthorized access, if the responsiveness weight is greater than the security weight, the optimized operation SQL structure is adopted; otherwise, it is not adopted.

[0146] The current education data lineage acquisition module constructs a lineage graph of the current education data based on the final operation SQL structure data obtained after judgment in S5.

[0147] In the description of this specification, references to terms such as "an embodiment," "example," "specific example," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0148] The preferred embodiments of the invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention.

Claims

1. A method for tracing lineage and analyzing operation logs of educational data, characterized in that, Includes the following steps: S1. Obtain the SQL statements for database operations corresponding to several sets of historical education data that do not involve permission settings; S2. Obtain the structure data of the optimized SQL statement corresponding to the SQL statement collected by S1, the amount of data in the database tables involved, and the data operation type data, and construct the final optimized SQL structure mapping model. S3. Input the SQL statements, the amount of data in the database tables involved in the operation, and the data operation type into the mapping model constructed in S2 for mapping during the current operation on educational data. S4. Obtain the structure of several sets of historical education data involving permission settings, the permission level data of each data table involved, and whether it is unauthorized access. Then, construct the final unauthorized access existence mapping model based on the obtained data. S5. Obtain the permission levels of the data tables involved in the optimized SQL structure data in S3 and input them into the mapping model in S4 for mapping; Based on the mapping results, compare the corresponding immediate responsiveness weight and security weight. When there is a risk of unauthorized access, if the responsiveness weight is greater than the security weight, the optimized operation SQL structure is adopted; otherwise, it is not adopted. S6. Construct a lineage diagram of the current education data based on the final operation SQL structure data obtained after the judgment in S5.

2. The method for tracing lineage and analyzing operation logs of educational data according to claim 1, characterized in that, S1 includes the following steps: S11. Define several types of educational data to obtain a set of educational data types; the set of educational data types includes educational metadata types and operation log data types; the educational metadata types include technical metadata types, business metadata types, and operation metadata types; then define several types of data operation types to obtain a set of data operation types; S12. Obtain several sets of historical education data that do not involve permission settings according to the educational data type set to obtain a historical education dataset; perform separation operations on the educational metadata and operation log data in the historical education dataset to obtain a first historical education metadata dataset and a first historical education operation log dataset. Based on the first historical education metadata dataset and the first historical education operation log dataset, obtain the corresponding SQL statements for database operations to obtain the first historical operation SQL statement set.

3. The method for tracing lineage and analyzing operation logs of educational data according to claim 2, characterized in that, S2 includes the following steps: S21. Based on the data operation type set and the first historical education operation log dataset, scan the first historical operation SQL statement set to obtain the original structure data of each operation SQL statement, the structure data of each operation SQL statement after subsequent operation optimization, the data volume and data operation type of the database table involved in the corresponding operation, and obtain the historical operation SQL original structure dataset, the historical optimized SQL structure dataset, the historical operation database data volume set and the historical operation type dataset. S22. Based on the historical operation SQL original structure dataset, historical operation library data volume dataset, historical operation type dataset, and historical optimized SQL structure dataset, construct a mapping model between the operation SQL original structure data, operation library data volume, operation type data, and optimized SQL structure data to obtain the final optimized SQL structure mapping model.

4. The method for tracing lineage and analyzing operation logs of educational data according to claim 3, characterized in that: The final optimized SQL structure mapping model described in S22 adopts a hybrid architecture model that combines an attention-based sequence-to-sequence model with a multi-layer fully connected network.

5. The method for tracing lineage and analyzing operation logs of educational data according to claim 4, characterized in that, S3 includes the following steps: S31. Based on the set of educational data types and the set of data operation types, obtain the corresponding operation SQL statement, the amount of data in the database table involved in the operation, and the data operation type during the current operation on the educational data, and obtain the current initial operation SQL statement set, the current operation database data set, and the current operation type dataset. The current initial operation SQL statement set is scanned to obtain the current initial operation SQL structure dataset; S32. Input the data from the current initial operation SQL structure dataset, the current operation library data set, and the current operation type dataset into the final optimized SQL structure mapping model for mapping to obtain the current optimized operation SQL structure dataset.

6. The method for tracing lineage and analyzing operation logs of educational data according to claim 5, characterized in that, S4 includes the following steps: S41. Set several database permission levels to obtain a system permission level set; in addition, according to the educational data type set, obtain several sets of historical educational data related to permission settings and perform separation operations to obtain a second historical educational metadata set and a second historical educational operation log dataset. Based on the second historical education metadata dataset and the second historical education operation log dataset, obtain the corresponding database operation SQL statements to obtain the second historical operation SQL statement set; scan the second historical operation SQL statement set and obtain the structure data of each operation SQL statement to obtain the historical operation SQL structure dataset. S42. Based on the system permission level set, obtain the permission level data of each data table involved in the operation in the historical operation SQL structure dataset and whether it is an unauthorized access, to obtain the historical data table permission level dataset and the historical unauthorized access existence dataset. S43. Based on the historical data table permission level dataset, historical operation SQL structure dataset, and historical unauthorized access existence dataset, construct a mapping model between database permission level data, operation SQL structure data, and unauthorized access existence data to obtain the final unauthorized access existence mapping model.

7. The method for tracing lineage and analyzing operation logs of educational data according to claim 6, characterized in that: The final unauthorized access existence mapping model described in S43 adopts a hybrid neural network model that integrates multilayer perceptron and attention mechanism.

8. A method for tracing lineage and analyzing operation logs of educational data according to claim 7, characterized in that, S5 includes the following steps: S51. Based on the system permission level set, obtain the permission level data of each data table involved in the current optimized operation SQL structure dataset, and obtain the current data table permission level dataset. Each set of optimized operation SQL structure data in the current optimized operation SQL structure dataset is combined with the current data table permission level dataset and input into the final unauthorized access existence mapping model to obtain the current unauthorized access existence dataset. S52. Obtain the instant responsiveness weight and security weight of the data operation corresponding to each group of optimized operation SQL structure data in the current optimized operation SQL structure dataset, and obtain the current instant responsiveness weight dataset and the current security weight dataset. S53. Based on the current real-time responsiveness weight dataset and the current security weight dataset, if there is 1 data point in the current unauthorized access dataset and the real-time responsiveness weight data of the data operation corresponding to the unauthorized access data is greater than the security weight data, the optimized operation SQL structure data is adopted and the current data table permission level dataset is adjusted. If the current unauthorized access data contains 1 data point for unauthorized access, and the immediate responsiveness weight data of the data operation corresponding to the unauthorized access data is less than or equal to the security weight data, then the optimized operation SQL structure data will not be adopted, and the corresponding current initial operation SQL structure data will still be adopted. Otherwise, adopt all of the current optimized operation SQL structure datasets to obtain the current final operation SQL structure dataset.

9. A method for tracing lineage and analyzing operation logs of educational data according to claim 8, characterized in that, S6 includes the following steps: S61. Convert each final operation SQL structure data in the current final operation SQL structure dataset into an abstract syntax tree to obtain the current abstract syntax tree; S62. Traverse the current abstract syntax tree and construct the lineage graph of the current educational data to obtain the lineage graph of the current educational data, and then visualize the lineage graph of the current educational data.

10. A system for implementing the method for pedigree tracing and operation log analysis of educational data as described in any one of claims 1-9.

Images