Secure cross-border data transmission method based on semantic analysis

Abstract

The invention relates to the technical field of cross-border data secure transmission, and particularly discloses a semantic analysis-based cross-border data secure transmission method, which comprises the following steps of: dividing a sender credit investigation level through a multi-source credit investigation acquisition and semantic analysis model; the method comprises the following steps: preprocessing to-be-transmitted multi-modal data, and classifying the data through semantic alignment; matching transmission authority according to credit investigation levels and data types, separating transmittable data according to core / non-core data, and performing hierarchical encryption according to sensitive types of the data; data are transmitted through a cross-border private line of a TLS1.3 protocol, a sliding window and a retransmission mechanism are combined, and the integrity is verified by adopting a Hash algorithm. According to the invention, compliance dynamic adaptation is realized, protection precision and reliability are improved, and safety and efficiency are balanced.

Description

Technical Field

[0001] This invention relates to the field of cross-border data security transmission technology, and in particular to a cross-border data security transmission method based on semantic analysis. Background Technology

[0002] With the rapid development of the globalized digital economy, cross-border data transmission has become a core support for enterprise business expansion and international cooperation, covering multiple industries such as finance, technology, healthcare, and manufacturing. However, current cross-border data transmission faces three major pain points, severely restricting its compliance, security, and efficiency: Compliance adaptation is challenging: Cross-border data regulations vary significantly across different countries and regions, with differing provisions regarding data classification, encryption requirements, and transmission permissions. Existing technologies lack the ability to dynamically respond to regulations in multiple regions, easily leading to either over-compliance resulting in inefficiency or under-compliance triggering regulatory penalties.

[0003] Imbalance between security and transmission efficiency: Existing cross-border data transmission technologies generally suffer from the problem of "heavy encryption, light classification": either all data is encrypted with uniform high strength, leading to a significant increase in transmission latency; or only text data is filtered for sensitive words, ignoring the semantically sensitive information of multimodal data such as images, audio, and video, which easily leads to the risk of data leakage. At the same time, the lack of dynamic assessment of the sender's credit status makes it impossible to allocate transmission permissions differently based on the sender's compliance history and credit rating, resulting in a security vulnerability where trusted and untrusted entities have the same transmission rights.

[0004] Insufficient accuracy of semantic analysis and lack of end-to-end control: Existing technologies are mostly single-modal semantic analysis models (such as the BERT model for text only), resulting in a high rate of misclassification of data; secondly, semantic analysis models do not dynamically update sensitive word databases in accordance with the latest regulations. In addition, existing solutions lack a complete end-to-end control mechanism, failing to cover the closed loop of "pre-transmission credit assessment - in-transmission anomaly monitoring - post-transmission compliance audit," making it difficult to trace responsibility after data tampering or illegal transmission.

[0005] In summary, existing cross-border data transmission technologies cannot simultaneously meet the requirements of "dynamic compliance adaptation, precise security protection, optimized transmission efficiency, and closed-loop end-to-end control." There is an urgent need for an end-to-end technical solution that integrates semantic analysis, dynamic credit scoring, hierarchical encryption, and compliance auditing. Summary of the Invention

[0006] The purpose of this invention is to solve the problems of insufficient credit assessment, transmission efficiency, and security protection in existing cross-border data transmission.

[0007] To achieve the above objectives, this invention provides a method for secure cross-border data transmission based on semantic analysis, comprising the following steps: S1. Credit Data Collection and Classification: Credit data from multiple sources is collected and preprocessed, including cleaning, deduplication, and standardization. An initial credit score is set, and the XLM-RoBERTa semantic analysis model is used to extract keywords from the credit data and trigger corresponding deductions. An LSTM threshold prediction model is used in conjunction with local regulations to dynamically set two thresholds between 0 and the initial credit score, forming three credit score ranges. The credit level is then classified as low, medium, and high based on these three score ranges. S2. Semantic Analysis and Classification of Data to be Transmitted: Standardize and preprocess the data to be transmitted, then perform semantic alignment and semantic analysis using a semantic analysis model; based on the semantic analysis results, and combined with the laws and regulations of the sender and receiver regions, classify the data to be transmitted into: general data, sensitive data, highly sensitive data, and restricted data using a classification model; add tags to highly sensitive data, and refuse transmission, encrypt and back up restricted data, and issue warnings. S3. Data Transmission Decision and Data Processing: Based on the sender's credit rating and the classification results of the data to be transmitted, transmission permissions are matched; the core semantic units of the data to be transmitted are extracted using a keyword extraction + weighted sorting scheme, and divided into core data and non-core data. Core data is highly preserved, while non-core data is compressed. Then, the corresponding encryption method is selected according to the classification results: sensitive data is encrypted, and highly sensitive data is encrypted with high strength. S4. Secure cross-border transmission: Cross-border leased line transmission using TLS 1.3 protocol, with integrity verification enabled. The encrypted key is transmitted first, followed by the encrypted data packet, and a transmission log is recorded simultaneously. S5. Receiver decryption and data restoration: The receiver receives the transmitted data, completes decryption, block separation, decompression and data merging, verifies data integrity, and restores the data.

[0008] Preferably, the method further includes: constructing a real-time updated labeled dataset, including sensitive words and restricted words that comply with the latest regulations, and adjusting the semantic analysis model and classification model monthly using the latest labeled dataset.

[0009] Preferably, in step S1, the credit data collection is processed by ETL through Apache NiFi, the deduction weight of keywords is trained and optimized based on labeled data, and the keyword triggering deduction requires that the keyword semantic similarity be ≥0.85; The threshold update is triggered immediately when the sender's location changes or regulations are updated. If the credit data shows that the sender has been dishonest or punished within three months, their credit rating will be downgraded by one level.

[0010] Preferably, in step S2, the standardization preprocessing of the data to be transmitted includes: text data adopting Unicode encoding to unify the format, removing stop words and performing lemmatization using the NLTK tool; image data being converted to RGB format and having a unified resolution; audio data being converted to WAV format and having a unified sampling rate; and video data having keyframes extracted and audio tracks separated for separate processing. We use the mBERT pre-trained model combined with the CLIP model to achieve semantic alignment and understanding of multimodal and multilingual data, and XGBoost is used for classification.

[0011] Preferably, in step S2, the highly sensitive data is tagged, including: source, destination, time, and data type; the basic information of the de-identified data is restricted from being recorded, backed up to a local encrypted server, and a warning is issued to the regulatory agency.

[0012] Preferably, in step S3, the transmission permissions are: high credit level for transmitting general data, sensitive data, and highly sensitive data; medium credit level for transmitting general data and sensitive data; and low credit level for transmitting general data.

[0013] Preferably, in step S3, BERT keyword extraction + TF-IDF weight sorting is used to extract core semantic units; sensitive data is encrypted with AES-192 + ECC, and highly sensitive data is encrypted with AES-256 + ECC.

[0014] Preferably, in step S4, the transmission process adopts the sliding window protocol and ARQ automatic retransmission mechanism, and the transmission log is recorded using the Syslog protocol, encrypted and stored, and retained for a period of ≥1 year.

[0015] Preferably, in step S5, the data integrity is verified by comparing the SHA-256 hash values ​​of the merged data with the original data sent from the sending end. If the hash values ​​are inconsistent, data retransmission is triggered and an exception log is recorded.

[0016] Preferably, the method further includes an abnormal behavior monitoring step: using the IsolationForest model to monitor abnormal behavior during transmission, interrupting transmission and triggering an early warning when the abnormal score is greater than or equal to a set value; abnormal behavior includes abnormal transmission time, abnormal data volume, and abnormal receiving address; The method also includes a compliance audit step: automatically generating a compliance report that includes credit rating, data classification, encryption method, transmission link, and transmission log, supporting online auditing by regulatory agencies.

[0017] The present invention employs the above-mentioned semantic analysis-based method for secure cross-border data transmission, and its beneficial effects are as follows: (1) The present invention constructs a security system of “credit rating - semantic protection - hierarchical encryption - full-link monitoring”, which greatly improves the accuracy and reliability of protection, forms a security closed loop of “pre-transmission - during transmission - after transmission”, and effectively prevents data leakage, tampering and loss; (2) This invention achieves a balance between security and efficiency by performing differentiated processing and architecture optimization for different types of data. The dynamic update mechanism can adapt to changes in regulations and business, meet the transmission needs of multiple regions, and reduce operation and maintenance costs. Attached Figure Description

[0018] Figure 1 This is a flowchart of a cross-border data security transmission method based on semantic analysis according to the present invention; Figure 2 This invention relates to a data transmission strategy for a cross-border data security transmission method based on semantic analysis. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to specific embodiments and the accompanying drawings. It should be understood that these descriptions are merely exemplary and not intended to limit the scope of the invention. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concept of the invention.

[0020] like Figure 1 As shown, the present invention provides a method for secure cross-border data transmission based on semantic analysis, comprising: We construct a real-time updated labeled dataset, including sensitive and restricted words that comply with the latest regulations, and use the latest labeled dataset to train and adjust the semantic analysis model and classification model every month.

[0021] S1. Credit Data Collection and Classification: S11. Multi-source credit data collection: Collect the sender's filing certificate through the cross-border data transmission filing API of the Cyberspace Administration of China, collect the sender's transmission records through the system's historical logs, and collect the sender's credit data through third-party databases and official credit reporting centers.

[0022] S12. Data Preprocessing: The Apache NiFi tool is used to perform ETL processing on the above data, completing cleaning (removing outliers), deduplication (merging duplicates), and standardization (unifying data format) to generate a structured credit dataset.

[0023] S13. Credit Score Calculation: The initial baseline score is set at 100 points; the XLM-RoBERTa semantic analysis model is used to extract keywords from the credit data. If keywords such as dishonesty, punishment, and data leakage are matched (semantic similarity ≥ 0.85), the corresponding credit score will be deducted. The LSTM threshold prediction model is combined with local regulations to dynamically set two thresholds T1 and T2 between 0 and 100 (0 < T2 < T1 < 100). When 100 ≥ score ≥ T1, it is a high credit level; when T1 > score ≥ T2, it is a medium credit level; and when T2 > score ≥ 0, it is a low credit level. The threshold is updated immediately when the sender's region changes or the regulations are updated. If the sender's credit data contains records of dishonesty or penalties within the past three months, the credit rating will be downgraded by one level.

[0024] S2. Semantic analysis and classification of data to be transmitted: S21. Multimodal data preprocessing: Text data adopts Unicode encoding to unify the format, and stops are removed and lemmatization is performed using NLTK tools to generate standardized text; image data is converted to RGB format and the resolution is unified; audio data is converted to WAV format and the sampling rate is unified; key frames are extracted from video data and audio tracks are separated and processed separately. While retaining core information, the processing complexity is reduced and independent optimization and collaborative analysis of audio and video are achieved.

[0025] S22. Semantic Analysis and Alignment: The mBERT pre-trained model is combined with the CLIP model to achieve semantic alignment and semantic analysis of multimodal and multilingual data, and output the core semantic vector.

[0026] S23. Data Classification and Labeling: The XGBoost classification model trained on the labeled dataset is used to determine the data type contained in the data to be transmitted, and the data to be transmitted is divided into general data, sensitive data (such as names, ID cards, customer lists, etc.), highly sensitive data (such as technical solutions, financial data, biometric information, etc.), and restricted data (such as unauthorized technology, classified information, etc.). Add labels to highly sensitive data that comply with the ISO / IEC 19770-2 standard, including: source, destination, time, and data type; refuse to transmit restricted data, record the basic information of the de-identified data, back it up to a local encrypted server, and issue a warning to regulatory agencies.

[0027] S3. Data Transmission Decisions and Data Processing: S31. Transmission Permission Matching: High credit rating transmits general data, sensitive data, and highly sensitive data; medium credit rating transmits general data and sensitive data; low credit rating transmits general data. For example... Figure 2 As shown.

[0028] S32. Extract core semantic units and divide into blocks: Use BERT keyword extraction + TF-IDF weight sorting to extract the core semantic units of the data to be transmitted, and divide it into core data containing core semantic units and non-core data that does not contain core semantic units. S33. Differentiated Compression: Core data retains its original precision, while non-core data is compressed; text data uses the Zstandard compression algorithm, image data uses the WebP compression algorithm, and audio data uses the OPUS compression algorithm to generate compressed packages and metadata.

[0029] S34. Hierarchical encryption processing: General data: Only block compression and non-core data compression are performed; Sensitive data: Core data, compressed packages, and metadata are encrypted using the AES-192 symmetric encryption algorithm, and the AES key is encrypted using the ECC encryption algorithm; Highly sensitive data uses the AES-256 symmetric encryption algorithm to encrypt core data, compressed packages, and metadata, and uses the ECC algorithm to encrypt the symmetric key. At the same time, the highly sensitive data tags are encrypted using AES-128.

[0030] S4, Secure Cross-Border Transmission: Cross-border leased line transmission using TLS 1.3 protocol and SHA-256 integrity verification enabled; sliding window protocol and ARQ automatic retransmission mechanism are enabled during transmission to improve transmission efficiency and avoid data loss. First, the encrypted key is transmitted, followed by the encrypted data packet. Simultaneously, the Syslog protocol is used to record the transmission log, which is stored encrypted on the local server with a retention period of ≥1 year.

[0031] S5. Receiver decryption and data restoration: The receiver receives the transmitted data, decrypts the symmetric key using the ECC private key, and then decrypts the data packet using the key; it separates the core data into a compressed package using the metadata identifier, and decompresses the non-core data; it merges the data using a merging algorithm, verifies the data integrity using the SHA-256 algorithm, and triggers data retransmission and records the exception log when the hash values ​​are inconsistent.

[0032] S6. Anomaly Monitoring and Compliance Audit: Abnormal behavior monitoring: The IsolationForest model is used to monitor abnormal behavior during transmission. When the abnormal score is greater than or equal to the set value, the transmission is interrupted and an alarm is triggered. Abnormal behaviors include abnormal transmission time, abnormal data volume, abnormal receiving address, etc. Compliance Audit: Automatically generates compliance reports that include credit rating, data classification, encryption method, transmission link, and transmission logs, supporting online audits by regulatory agencies.

[0033] Example: I. Parameter Settings: Core framework: PyTorch 2.1, Spark 3.4; system integrates ETL tools, encryption libraries, transport protocol tools, model calling libraries, caching tools and other components.

[0034] 1. Annotated dataset: 100,000 annotated data entries containing the latest legally sensitive and restricted words; 2. Threshold setting (based on an LSTM threshold prediction model (based on PyTorch), combined with the risk level of the target area): High-risk area x: T1=80, T2=60; Medium-risk areas y: T1=70, T2=50; Low-risk areas z: T1=60, T2=40.

[0035] 3. Deduction Rules: Serious violations (major data breaches, multiple administrative violations, etc.): 50 points; Minor violations (minor compliance flaws, single breaches of contract, etc.): 20 points; Potential risks (compliance audit pending): 5 points; The semantic similarity of keywords that trigger point deductions is set to ≥0.85; The threshold for abnormal transmission behavior is set at 0.9 (anomaly score of the IsolationForest model). 4. Data compression settings: Text compression is 80%, image compression is 40%, and the resolution is uniformly 256×256; the audio sampling rate is 16kHz and the bit rate is 128kbps; the video extraction interval is 10 frames.

[0036] II. Object and Data Settings: Set up two objects, A and B, and assign them credit data containing different keywords. Then, transmit three different data types to three regions with different risks. 1. Object setting: A: No prohibited keywords; B: Prohibited keywords (including penalty records within the last three months). 2. Data types: General data: Publicly available product promotional materials (English text, 500KB); Sensitive data: Customer list (Excel spreadsheet, including names and email addresses, 2MB); Highly sensitive data: Model design scheme (PDF text, 3MB) + user fingerprint images (10 images, RGB format, 0.5MB). III. Data Transmission: 1. Credit rating classification: The credit data of A and B are processed by ETL through the built-in Processor of Apache NiFi to complete format parsing, data cleaning (removing invalid / outlier values), deduplication (removing duplicate content), and standardization (unifying data format, data content expression, and data encoding) to generate a structured credit dataset. Two credit datasets were used to perform keyword matching using the XLM-RoBERTa model (based on PyTorch+Transformers). The results showed that A had a credit score of 100 and no penalty records within the past three months; B had a credit score of 75 and a penalty record within the past three months. Transmissions from region A to regions x, y, and z are all of high credit rating. Data transmission from region B to region x is classified as low credit rating, from region y as medium credit rating, and from region z as medium credit rating.

[0037] 2. Analysis, processing, and transmission of data to be transmitted: (1) Transmission from A to regions x, y, and z: Product promotional copy, after semantic alignment using the mBERT+CLIP model (based on Transformers), was classified as "general data" (no sensitive information) by the XGBoost classification model, and transmission permission matching (rule engine Drools) allowed transmission; customer information was classified as sensitive data (including personal identification information), and transmission was allowed; model design scheme and fingerprint image were classified as highly sensitive information, and transmission was allowed; tags were added to the algorithm design scheme and fingerprint image (transmitted object—A, time, transmission region—x, recipient, data type—technical solution, biometric information).

[0038] By using BERT keyword extraction and TF-IDF weight ranking, the algorithm architecture and fingerprint features of the model design scheme are taken as the core semantic units. Data compression: Promotional texts are compressed using Zstandard, generating a compressed file + metadata (compression format, original size); customer lists are compressed using Zstandard, generating a compressed file + metadata; non-core areas of images (without fingerprint features) are compressed using WebP, generating a compressed file + metadata. Encryption processing (based on OpenSSL and PyCryptodome): Sensitive data (customer list) is encrypted with AES-192 symmetric encryption and ECC encryption of the AES key; Highly sensitive data (design scheme, fingerprint features) is encrypted with AES-256 symmetric encryption and ECC encryption of the AES key; Data tags are encrypted with AES-128. Transmission: The transmission link is TLS1.3 protocol + cross-border leased line, and HMAC-SHA256 algorithm is enabled; the transmission order is: ECC key first, then data compressed packet; at the same time, sliding window protocol (window size adjusted to 512KB) + ARQ automatic retransmission mechanism is enabled; Anomaly monitoring: The IsolationForest model monitors the transmission process. The transmission time, data volume, and receiving address are all normal. The anomaly score is 0 < 0.9, and there are no warnings. Transmission logs: The Syslog protocol records and stores transmission time, link information, and data size; it also generates compliance reports (credit rating, data type, encryption method, and transmission logs).

[0039] Receiver restoration: Decrypt the AES key using the ECC private key, decrypt the data packet using the key, separate the data according to the metadata, decompress the data using Zstandard / WebP, merge the core data (model algorithm architecture, fingerprint features) with the restored non-core data (text, list, non-fingerprint feature images), calculate the hash value using SHA-256, and if it matches the preset hash value of the sender, the restoration is successful.

[0040] (2) Transmission from B to regions x, y, and z: Region X has a low credit rating, and its transmission permission is general data. Transmission of product promotional materials is allowed, but transmission of customer lists, model design plans, and fingerprint images is denied. The specific transmission process for product promotional materials is the same as that for region A.

[0041] Regions Y and Z are classified as medium credit rating, with matching transmission permissions for general data and sensitive data. Transmission of product promotional materials and customer lists is permitted, while transmission of model design schemes and fingerprint images is prohibited. The transmission process for product promotional materials and customer lists is the same as that for region A.

[0042] It is worth noting that all contents not described in detail in this invention are existing technologies and are well known to those skilled in the art.

[0043] This invention employs a semantic analysis-based cross-border data security transmission method to construct a security system of "credit classification - semantic protection - hierarchical encryption - full-link monitoring," significantly improving protection accuracy and reliability. It forms a security closed loop of "pre-transmission - during transmission - post-transmission," effectively preventing data leakage, tampering, and loss. By performing differentiated processing and architecture optimization for different types of data, a balance between security and efficiency is achieved. The dynamic update mechanism can adapt to changes in regulations and business, meet the transmission needs of multiple regions, and reduce operation and maintenance costs.

[0044] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the technical solutions of the present invention, and these modifications or equivalent substitutions cannot cause the modified technical solutions to deviate from the spirit and scope of the technical solutions of the present invention.

Claims

1. A method for secure cross-border data transmission based on semantic analysis, characterized in that, Includes the following steps: S1. Credit Data Collection and Classification: Credit data from multiple sources is collected and preprocessed, including cleaning, deduplication, and standardization. An initial credit score is set, and the XLM-RoBERTa semantic analysis model is used to extract keywords from the credit data and trigger corresponding deductions. An LSTM threshold prediction model is used in conjunction with local regulations to dynamically set two thresholds between 0 and the initial credit score, forming three credit score ranges. The credit level is then classified as low, medium, and high based on these three score ranges. S2. Semantic Analysis and Classification of Data to be Transmitted: Standardize and preprocess the data to be transmitted, then perform semantic alignment and semantic analysis using a semantic analysis model; based on the semantic analysis results, and combined with the laws and regulations of the sender and receiver regions, classify the data to be transmitted into: general data, sensitive data, highly sensitive data, and restricted data using a classification model; add tags to highly sensitive data, and refuse transmission, encrypt and back up restricted data, and issue warnings. S3. Data Transmission Decision and Data Processing: Based on the sender's credit rating and the classification results of the data to be transmitted, transmission permissions are matched; the core semantic units of the data to be transmitted are extracted using a keyword extraction + weighted sorting scheme, and divided into core data and non-core data. Core data is highly preserved, while non-core data is compressed. Then, the corresponding encryption method is selected according to the classification results: sensitive data is encrypted, and highly sensitive data is encrypted with high strength. S4. Secure cross-border transmission: Cross-border leased line transmission using TLS 1.3 protocol, with integrity verification enabled. The encrypted key is transmitted first, followed by the encrypted data packet, and a transmission log is recorded simultaneously. S5. Receiver decryption and data restoration: The receiver receives the transmitted data, completes decryption, block separation, decompression and data merging, verifies data integrity, and restores the data.

2. The method according to claim 1, characterized in that, The method also includes: constructing a real-time updated labeled dataset, including sensitive words and restricted words that comply with the latest regulations, and adjusting the semantic analysis model and classification model monthly using the latest labeled dataset.

3. The method according to claim 1, characterized in that, In step S1, the credit data collection is processed by ETL through Apache NiFi, the deduction weight of keywords is trained and optimized based on labeled data, and the keyword triggering deduction must meet the requirement that the semantic similarity of the keywords is ≥0.85; The threshold update is triggered immediately when the sender's location changes or regulations are updated. If the credit data shows that the sender has been dishonest or punished within three months, their credit rating will be downgraded by one level.

4. The method according to claim 1, characterized in that, In step S2, the standardized preprocessing of the data to be transmitted includes: text data adopts Unicode encoding to unify the format, and stop words are removed and lemmatization is performed using the NLTK tool; image data is converted to RGB format and the resolution is unified; audio data is converted to WAV format and the sampling rate is unified; key frames are extracted from video data and audio tracks are separated and processed separately. We use the mBERT pre-trained model combined with the CLIP model to achieve semantic alignment and understanding of multimodal and multilingual data, and XGBoost is used for classification.

5. The method according to claim 1, characterized in that, In step S2, the highly sensitive data is tagged with: source, destination, time, and data type; the basic information of the de-identified data is restricted, backed up to a local encrypted server, and a warning is issued to the regulatory agency.

6. The method according to claim 1, characterized in that, In step S3, the transmission permissions are as follows: high credit level transmits general data, sensitive data, and highly sensitive data; medium credit level transmits general data and sensitive data; and low credit level transmits general data.

7. The method according to claim 1, characterized in that, In step S3, BERT keyword extraction + TF-IDF weight sorting is used to extract core semantic units; sensitive data is encrypted with AES-192 + ECC, and highly sensitive data is encrypted with AES-256 + ECC.

8. The method according to claim 1, characterized in that, In step S4, the transmission process adopts the sliding window protocol and ARQ automatic retransmission mechanism, and the transmission log is recorded using the Syslog protocol, encrypted and stored, and retained for a period of ≥1 year.

9. The method according to claim 8, characterized in that, In step S5, the data integrity is verified by comparing the SHA-256 hash values ​​of the merged data with the original data sent from the sending end. If the hash values ​​are inconsistent, data retransmission is triggered and an exception log is recorded.

10. The method according to claim 1, characterized in that, The method also includes an abnormal behavior monitoring step: using the IsolationForest model to monitor abnormal behavior during transmission, interrupting transmission and triggering an alert when the abnormal score is greater than or equal to a set value; abnormal behavior includes abnormal transmission time, abnormal data volume, and abnormal receiving address; The method also includes a compliance audit step: automatically generating a compliance report that includes credit rating, data classification, encryption method, transmission link, and transmission log, supporting online auditing by regulatory agencies.

Images