Network security data privacy protection management system
By semantic modeling and structural adjustment of access requests, the problem of privacy violations in data execution paths that are difficult to identify in existing technologies is solved, enabling effective judgment and management of privacy violations and supporting continuous management and traceable recording.
Patent Information
- Application Number
- CN202610073560.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-01-20
- Publication Date
- 2026-05-05
AI Technical Summary
Existing cybersecurity data privacy protection and management systems struggle to identify privacy violations stemming from data execution path structures, resulting in privacy risks going undetected.
The execution semantic modeling module performs semantic parsing on access requests to generate intermediate execution semantic representations. These representations are then analyzed by the privacy violation existence determination module to construct privacy violation existence proof objects. The semantic structure is adjusted in the execution structure resolution module, and finally, the re-determination module performs re-determination and generates audit data.
It enables the identification and management of privacy violations formed by the data-dependent execution path structure, provides a clear structured expression form, and supports the continuous management and traceable recording of privacy violations.
Smart Images
Figure CN121980588A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security technology, and in particular to a network security data privacy protection and management system. Background Technology
[0002] A cybersecurity data privacy protection and management system refers to a system that manages and controls data access behavior involving personal privacy or sensitive information during networked data access and processing. Such systems are typically deployed at data access points or in data processing chains to analyze access requests and constrain or record data processing behaviors that may involve privacy risks. With the increasing prevalence of centralized data storage and collaborative processing across multiple business systems, cybersecurity data privacy protection and management systems are gradually becoming an important technical means to ensure the compliant use of data. Their management objects include not only the data fields themselves but also how the data is used during processing. Existing network security data privacy protection management systems typically judge data access requests based on field-level rules or access policies. In practice, they primarily determine the existence of privacy risks by identifying whether the access request contains predefined sensitive fields. However, in real-world applications, some access requests do not directly contain a single sensitive field, but through the combination of multiple non-sensitive fields and the structural relationships within the data processing path, privacy violations can still occur during execution. Because current technologies lack the ability to analyze the structure of data execution paths, it is difficult to identify such privacy violations that depend on the semantic structure of execution, thus preventing the effective detection of privacy risks. Summary of the Invention
[0003] To overcome the above shortcomings, this invention provides a network security data privacy protection and management system, which aims to improve the problem that existing technologies rely solely on field-level rules to determine data access requests and have difficulty identifying privacy violations that depend on the data execution path structure. This invention provides the following technical solution: a network security data privacy protection and management system, comprising: The execution semantic modeling module is used to perform semantic parsing on access requests and generate an intermediate execution semantic representation that characterizes the semantic structure of the access request in the data execution path. The privacy violation existence determination module is used to analyze the execution semantic intermediate representation based on a predetermined privacy violation existence determination model in order to determine whether there are any situations in the data execution path that satisfy the predetermined execution semantic structure conditions. The privacy violation existence proof construction module is used to generate a privacy violation existence proof object based on the corresponding execution semantic structure when it is determined that there is a situation that satisfies the execution semantic structure conditions; The execution structure resolution module is used to perform structural adjustments on the execution semantic intermediate representation based on the privacy violation existence proof object; The re-determination module is used to re-determine the existence of privacy violations based on the intermediate semantic representation of the execution after structural adjustment; The audit data generation module is used to record the data corresponding to the privacy violation existence proof object and the re-determination process. Preferably, the semantic modeling step includes: The access request is parsed using a syntax parsing method to generate an abstract syntax structure for the access request; Based on the abstract syntax structure, the expression structure analysis method is used to extract the field references involved in the access request, and the dependency relationship of the fields in the expression tree is analyzed to determine the composition relationship between the fields; By adopting the execution operator modeling method, the processing operations in the access request are mapped to execution operator nodes, and an operator connection structure is established based on data dependencies to generate an intermediate execution semantic representation for representing the semantic structure of the data execution path. Preferably, the privacy violation determination step includes: A structural rule matching method is used to obtain execution semantic structure conditions describing the execution path structure of privacy violations from a pre-configured set of privacy rules; The execution semantic structure conditions are parsed to form structured decision conditions. Preferably, the privacy violation determination step further includes: Map the field relationships described in the execution semantic structure conditions to connection constraints between field nodes; The execution path structure description is mapped to the connection constraints between execution operator nodes, generating structural constraints that can be matched in the intermediate representation of execution semantics. Preferably, the privacy violation determination step further includes: Based on the connection relationships between the execution operator nodes, the semantic structure traversal method is used to traverse the intermediate representation of the execution semantics. During the traversal, extract semantic node combinations that can form the data execution path. Preferably, the privacy violation determination step further includes: During the traversal, a structural pattern matching method is used to match the traversed semantic nodes and their connection relationships with the structural constraints; When a match is successful, the corresponding set of semantic nodes is determined to form the execution semantic substructure. Preferably, the steps for constructing the proof of the existence of the privacy violation include: Select the identified execution semantic substructure; The execution semantic substructure is associated with the execution semantic structure conditions that trigger identification to form a privacy violation existence proof object. Preferably, the execution structure resolution step includes: Based on the privacy violation existence proof object, locate the execution semantic substructure associated with the privacy violation existence proof object in the execution semantic intermediate representation; Changing the field combination method or execution operator connection method in the execution semantic substructure is used to modify the structural relationship of the located execution semantic substructure. Preferably, the re-determination step includes: Based on the intermediate semantic representation of the execution after the structural modification, the same structural traversal and structural pattern matching method as the first privacy violation existence determination is used to perform the privacy violation existence determination again; Record the results of the privacy violation determination process. Preferably, the audit data generation step includes: Record objects that provide evidence of privacy violations in the form of structured data; Record the determination result corresponding to the object that proves the existence of the privacy violation. The present invention has the following beneficial effects: 1. In this invention, by modeling and analyzing the semantic structure of data access requests during the execution process, the object of privacy violation judgment is expanded from a single field to the structural relationship level in the data execution path. This enables the judgment and management of privacy violations formed by the combination of dependent fields and the execution path structure, making up for the inadequacy of identifying structural privacy risks based solely on field-level rules. 2. In this invention, by constructing a privacy violation existence proof object, the privacy violation judgment result, the corresponding execution semantic substructure, and the judgment basis are uniformly encapsulated, so that the privacy violation judgment process has a clear structured expression form, thereby providing a consistent data foundation for subsequent structural adjustments, re-judgments, and audit records, and avoiding the separation between the judgment result and the judgment basis. 3. In this invention, by adjusting the structural relationships related to privacy violations at the semantic structure level and re-executing the existence determination after the structural modification, the privacy violation management process forms a closed-loop process of "determination - processing - re-determination - recording", thereby realizing continuous management of changes in the privacy risk status during data access and providing support for the traceable recording of the privacy violation handling process. Attached Figure Description Figure 1 This is a system architecture diagram of a network security data privacy protection and management system proposed in this invention. Detailed Implementation The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. Example 1: In the first embodiment of the present invention, the present invention provides a network security data privacy protection management system, such as... Figure 1 As shown, it includes the following steps: The execution semantic modeling module is used to perform semantic parsing on access requests and generate an intermediate execution semantic representation that characterizes the semantic structure of the access request in the data execution path. Furthermore, the semantic modeling steps include: The access request is parsed using a syntax parsing method to generate an abstract syntax structure for the access request; Based on the abstract syntax structure, the expression structure analysis method is used to extract the field references involved in the access request, and the dependency relationship of the fields in the expression tree is analyzed to determine the composition relationship between the fields; By adopting the execution operator modeling method, the processing operations in the access request are mapped to execution operator nodes, and an operator connection structure is established based on data dependencies to generate an intermediate execution semantic representation for representing the semantic structure of the data execution path. Specifically, when the system receives an access request for data resources, it first uses a syntax parsing method to parse the request, generating an abstract syntactic structure representing the hierarchical relationship of the access request syntax. During the syntax parsing process, field identifier nodes that indicate data fields are identified from the abstract syntactic structure, and the field identifiers and their corresponding data object identifiers are extracted, thereby obtaining the field reference information involved in the access request. Through this parsing process, a set of field references is formed to characterize the scope of field access in the access request. After resolving field references, the system uses an expression structure analysis method based on this abstract syntax structure to analyze the hierarchical and dependency relationships of fields in the access request, in order to determine the combination relationships between fields. These field combination relationships describe the structural associations formed when multiple fields participate in processing within the same expression structure or the same data execution path, and the determined field combination relationships are recorded. After obtaining field reference information and their combination relationships, the system uses an execution operator modeling method to construct an execution semantic structure representing the data execution path. First, the data processing operations in the access request are mapped to execution operator nodes, and an operator connection structure is established based on the data dependencies between execution operators. Simultaneously, field reference information and field combination relationships are attached to the corresponding execution operator nodes and their connection relationships, thereby generating an intermediate execution semantic representation for representing the semantic structure of the data execution path. Through the above processing steps, the system converts the access request into an execution semantic intermediate representation. This execution semantic intermediate representation clearly reflects the data fields involved in the access request, the combination relationships between fields, and the processing structure relationships in the data execution path. It serves as a unified structured input for subsequent analysis and processing based on the execution semantic structure. The privacy violation existence determination module is used to analyze the intermediate representation of execution semantics based on a predetermined privacy violation existence determination model in order to determine whether there are any situations in the data execution path that meet the predetermined execution semantic structure conditions. Furthermore, the steps for determining the existence of a privacy violation include: A structural rule matching method is used to obtain execution semantic structure conditions describing the execution path structure of privacy violations from a pre-configured set of privacy rules; The semantic structure conditions are parsed to form structured decision conditions. Furthermore, the steps for determining the existence of privacy violations also include: Map the field relationships described in the execution semantic structure conditions to connection constraints between field nodes; The execution path structure description is mapped to the connection constraints between execution operator nodes, generating structural constraints that can be matched in the intermediate representation of execution semantics. Furthermore, the steps for determining the existence of privacy violations also include: Based on the connection relationships between the execution operator nodes, the semantic structure traversal method is used to traverse the intermediate representation of the execution semantics. During the traversal, extract semantic node combinations that can form the data execution path. Furthermore, the steps for determining the existence of privacy violations also include: During the traversal, a structural pattern matching method is used to match the traversed semantic nodes and their connection relationships with structural constraints; When a match is successful, the corresponding set of semantic nodes is determined to form the execution semantic substructure. Specifically, after constructing the execution semantic intermediate representation, the system needs to perform privacy violation determination on the execution semantic intermediate representation. First, based on the context information of the access request, the system uses a structured rule matching method to select the privacy rule corresponding to the current access request from a pre-configured set of privacy rules. This privacy rule describes the structural features of the data execution path that constitutes a privacy violation. Then, the system parses the selected privacy rule, converting the description of field relationships and execution path structure in the privacy rule into structured execution semantic structural conditions. After obtaining the structured execution semantic structure conditions, the system needs to further perform structure mapping processing on the execution semantic structure conditions. First, the system maps the association relationships between fields described in the execution semantic structure conditions to connection constraints between field nodes, and maps the data execution path structure described in the execution semantic structure conditions to connection constraints between execution operator nodes, thereby generating a set of structure constraints to limit the structure of the intermediate representation of execution semantics. After generating the structural constraints, the system performs semantic structure traversal processing on the intermediate execution semantic representation. The intermediate execution semantic representation contains execution operator nodes and the connections between them, which represent the data transmission path during execution. Therefore, the system uses the connections between execution operator nodes as the basis for traversal to iterate through the semantic structure in the intermediate execution semantic representation. During the traversal, the system sequentially accesses the execution operator nodes in the execution semantic intermediate representation according to the connection order between the execution operator nodes, and simultaneously obtains the field nodes associated with the current execution operator node and their connection relationships. By gradually expanding the access scope along the connection relationships of the execution operator nodes, the system can cover the semantic structure regions in the execution semantic intermediate representation that can form a complete data execution path. After completing the access to the execution operator node and its associated field node, the system extracts a semantic node combination from the traversed semantic structure. This semantic node combination consists of execution operator nodes and their associated field nodes connected sequentially in the same execution path, and is used to represent the data execution path structure that may be formed during the data execution process. Through the above traversal and extraction process, the system obtains a set of semantic node combinations that can constitute the data execution path, providing clear structural input for the subsequent semantic structure matching and execution semantic substructure recognition process based on structural constraints. During the traversal, the system employs a structural pattern matching method to match and judge the semantic node combinations and their connections against structural constraints. When a semantic node combination satisfies the field connection relationships and execution operator connection relationships defined by the structural constraints, the system determines that the semantic node combination constitutes an execution semantic substructure, and accordingly determines that there exists a situation in the data execution path that satisfies the execution semantic structure conditions. If no semantic node combination that satisfies the structural constraints is identified during the traversal, it is determined that there is no situation in the execution semantic intermediate representation that satisfies the execution semantic structure conditions. Through the above implementation steps, the system completes the process of determining the existence of privacy violations based on the intermediate representation of execution semantics, and obtains the execution semantic substructure information corresponding to the determination result, providing a definite structural input for the subsequent construction of privacy violation existence proof and execution structure resolution processing. The privacy violation existence proof construction module is used to generate a privacy violation existence proof object based on the corresponding execution semantic structure when it is determined that there is a situation that satisfies the execution semantic structure conditions; Furthermore, the steps for constructing proof of the existence of a privacy violation include: Select the identified execution semantic substructure; The execution semantic substructure is associated with the execution semantic structure conditions that trigger identification, in order to form an object for proving the existence of privacy violations. Specifically, after identifying the execution semantic substructure, the system filters the identified substructures, selecting the one corresponding to the current access request. During this filtering process, the system uniquely identifies and records the execution semantic substructure based on its structural position in the intermediate execution semantic representation and the semantic node information it contains. Through these processes, the system obtains the execution semantic substructure associated with the current access request, representing the specific semantic structure fragment in the data execution path that satisfies the privacy violation structural conditions. After selecting the execution semantic substructure, the system establishes an association between the selected substructure and its corresponding execution semantic structure condition. This association indicates the correspondence between the execution semantic substructure and the privacy violation determination criteria. The system thus forms a structure-condition association record by recording the correspondence between the structure identifier information of the execution semantic substructure and the condition identifier information of the execution semantic structure condition. This structure-condition association record is stored as a privacy violation existence proof object, and can therefore be used to uniformly encapsulate the execution semantic substructure and its corresponding structure determination criteria. Through the above steps, the system transforms the determination of the existence of privacy violations into a proof object containing the execution semantic substructure and its corresponding structural determination basis. This enables subsequent processing to perform targeted processing on the execution semantic structure based on the proof object, and provides clear structured input for subsequent structural adjustments and audit records. The execution structure resolution module is used to structurally adjust the intermediate representation of execution semantics based on the privacy violation existence proof object. Furthermore, the structural resolution steps include: Based on the privacy violation existence proof object, locate the execution semantic substructure associated with the privacy violation existence proof object in the execution semantic intermediate representation; Changing the field combination method or execution operator connection method in the execution semantic substructure is used to modify the structural relationship of the located execution semantic substructure. Specifically, after constructing the privacy violation existence proof object, the system performs structure resolution processing. First, the system reads the structural association information recorded in the privacy violation existence proof object, and then performs structure localization processing in the execution semantic intermediate representation based on this structural association information. During the structure localization process, the system determines the execution semantic substructure corresponding to the privacy violation existence proof object in the execution semantic intermediate representation based on the semantic nodes identified in the privacy violation existence proof object and their connection relationships, and obtains the field nodes, execution operator nodes, and their connection relationships that constitute the execution semantic substructure. After locating the execution semantic substructure, the system modifies the execution structure relationships obtained from the location. First, the system adjusts the field combination relationships in the execution semantic substructure by changing the connection methods between field nodes or the combination relationships of fields participating in the same processing structure, thereby reconstructing the association state of fields in the execution semantic substructure; or, it adjusts the connection relationships of execution operators in the execution semantic substructure, thereby reconnecting the data execution path structure in the execution semantic substructure by changing the data dependency connection methods between execution operator nodes. After the structural relationship is modified, the system writes the modified execution semantic substructure back to the execution semantic intermediate representation, which changes the original structural relationship in the execution semantic intermediate representation that satisfies the privacy violation execution semantic structure condition, thus forming the execution semantic intermediate representation after structural adjustment. Through the above implementation steps, the system can complete the targeted structural resolution process of the execution semantic substructure based on the privacy violation existence proof object, thereby changing the relevant structural relationships in the intermediate representation of execution semantics and providing a definite structural input for subsequent re-determination processing based on the structural adjustment results. The re-determination module is used to re-determine the existence of privacy violations based on the intermediate semantic representation of the execution after structural adjustment; Furthermore, the re-determination step includes: Based on the intermediate semantic representation of the execution after the structural modification, the same structural traversal and structural pattern matching method as the first privacy violation existence determination is used to perform the privacy violation existence determination again; Record the results of the privacy violation determination process. Specifically, after modifying the structural relationships of the execution semantic substructure and generating the structurally adjusted intermediate representation of the execution semantics, the system performs a re-determination process on the structurally adjusted intermediate representation of the execution semantics. The re-determination process uses the same determination process and technical means as the initial determination of the existence of privacy violations to ensure consistency in the technical path between the two determination processes. Therefore, based on the structurally adjusted intermediate representation of execution semantics, the system performs a structural traversal of the intermediate representation of execution semantics according to the connection relationships between execution operator nodes. During the traversal, the system sequentially accesses the execution operator nodes and their associated field nodes in the intermediate representation of execution semantics, and obtains the semantic structure information that constitutes the data execution path. While completing the structure traversal, the system employs the same structure pattern matching method as the initial privacy violation determination to match the semantic node combinations and their connections obtained during the traversal with the corresponding structural constraints. By performing structure pattern matching on the intermediate execution semantic representation after structural adjustment, the system determines whether a semantic structure satisfying the execution semantic structure conditions still exists in the intermediate execution semantic representation after the structural modification. After completing the re-determination process, the system records the determination result obtained during the re-determination. This determination result is used to characterize the status of the privacy violation determination after the semantic intermediate representation structure adjustment is performed, and serves as input data for subsequent audit data generation steps. The audit data generation module is used to record data related to the objects that provide evidence of privacy violations and the re-evaluation process. Furthermore, the audit data generation steps include: Record objects that provide evidence of privacy violations in the form of structured data; Record the determination results corresponding to the objects that provide evidence of the existence of privacy violations. Specifically, after completing the re-determination process and obtaining the corresponding determination result, the system executes the audit data generation process. First, the system reads the privacy violation existence proof object. This privacy violation existence proof object contains the execution semantic substructure used to characterize the basis for determining the existence of the privacy violation and its corresponding execution semantic structure condition information. The system performs structured processing on the privacy violation existence proof object, organizing the structural information constituting the privacy violation existence proof object according to a predetermined data structure and recording it in structured data form. This structured data is used to fully characterize the structural composition of the privacy violation existence proof object and its correspondence in the execution semantic intermediate representation. After completing the structured recording of the object proving the existence of a privacy violation, the system further obtains the judgment result corresponding to that object and associates the judgment result with the object. By binding the judgment result with the corresponding object proving the existence of a privacy violation, audit data describing the entire process of determining the existence of a privacy violation is formed. Through the above implementation steps, the system completes the structured recording processing of the objects proving the existence of privacy violations and their corresponding judgment results, thereby generating audit data that reflects the basis for judging the existence of privacy violations and the relationship between the judgment results, providing definite data input for subsequent auditing and traceability processing. Example 2: In a scenario of joint querying of shared data across multiple business systems, different business systems initiate access requests to the same data resource through a unified data access interface. These requests typically involve the combined use of multiple fields and multi-level data processing operations. Although the access requests may not directly contain explicitly sensitive fields at the field level, the combination of fields and the processing logic within the execution path can still lead to privacy-violating data access results during data execution. Existing privacy protection mechanisms, typically based on field-level or rule-level interception, struggle to accurately identify and handle such privacy violations dependent on the execution path structure, making it difficult to detect privacy risks in a timely manner. To address these issues, this invention provides a network security data privacy protection management system, the structure of which is as follows: Figure 1 As shown. The specific implementation process of this system is as follows: In the semantic modeling process, when the system receives an access request from a business system, it first parses the request. The system identifies the fields involved in data access from the access request and records how these fields are used. After parsing the fields, the system constructs a semantic structure representing the data execution path based on the combined usage relationships of the fields in the access request. This semantic structure uses fields as basic semantic nodes and forms a structured representation through the combination relationships between fields, reflecting the field association state of the access request during data execution. The privacy violation determination process involves several steps. After constructing the execution semantic structure, the system retrieves the execution semantic structure conditions corresponding to the access request from pre-configured privacy determination rules based on the access request's context information. These execution semantic structure conditions describe the structural features that constitute a privacy violation within the data execution path. The system converts these conditions into structural constraints that can be matched within the execution semantic structure and then iterates through that structure. During this iteration, the system performs structural matching on the field combinations within the execution semantic structure to identify whether any execution semantic substructures satisfy the structural constraints. When an execution semantic substructure satisfying the structural constraints is identified, the system records it and proceeds to the privacy violation existence proof construction process. In the process of constructing a privacy violation existence proof, the system selects the execution semantic substructure corresponding to the current access request from the identified execution semantic substructures and establishes a correspondence between this execution semantic substructure and the execution semantic structure conditions that trigger the judgment. Thus, the system forms a privacy violation existence proof object, which is used to uniformly encapsulate the execution semantic substructure and its corresponding structural judgment criteria, providing a clear structural anchor for subsequent structural processing. In the execution structure resolution process, after obtaining the privacy violation existence proof object, the system locates the execution semantic substructure associated with this proof object within the execution semantic structure and modifies the structural relationships of this substructure. During the structural modification process, the system adjusts the field combination methods and the connection methods between execution operators in the execution semantic substructure, thereby changing the original execution semantic structure state that satisfies the privacy violation structure conditions. After the modification is completed, the system writes the updated execution semantic structure back to the execution semantic intermediate representation. In the re-determination process, after the execution structure is resolved, the system re-executes the privacy violation existence determination process based on the updated execution semantic structure and records the determination results obtained in the re-determination process. During the audit data generation process, the system records the objects proving the existence of privacy violations and their corresponding judgment results, and stores the execution semantic substructure and execution semantic structure conditions in structured data form. Simultaneously, the system establishes the association between the objects proving the existence of privacy violations and the access requests that trigger this process, thereby forming complete audit data. Finally, it should be noted that the above are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.
Claims
1. A network security data privacy protection management system, characterized in that, include: The execution semantic modeling module is used to perform semantic parsing on access requests and generate an intermediate execution semantic representation that characterizes the semantic structure of the access request in the data execution path. The privacy violation existence determination module is used to analyze the execution semantic intermediate representation based on a predetermined privacy violation existence determination model in order to determine whether there are any situations in the data execution path that satisfy the predetermined execution semantic structure conditions. The privacy violation existence proof construction module is used to generate a privacy violation existence proof object based on the corresponding execution semantic structure when it is determined that there is a situation that satisfies the execution semantic structure conditions; The execution structure resolution module is used to perform structural adjustments on the execution semantic intermediate representation based on the privacy violation existence proof object; The re-determination module is used to re-determine the existence of privacy violations based on the intermediate semantic representation of the execution after structural adjustment; The audit data generation module is used to record the data corresponding to the privacy violation existence proof object and the re-determination process.
2. The network security data privacy protection management system according to claim 1, characterized in that, The semantic modeling steps include: The access request is parsed using a syntax parsing method to generate an abstract syntax structure for the access request; Based on the abstract syntax structure, the expression structure analysis method is used to extract the field references involved in the access request, and the dependency relationship of the fields in the expression tree is analyzed to determine the composition relationship between the fields; By adopting the execution operator modeling method, the processing operations in the access request are mapped to execution operator nodes, and an operator connection structure is established based on data dependencies to generate an intermediate execution semantic representation for representing the semantic structure of the data execution path.
3. The network security data privacy protection management system according to claim 1, characterized in that, The steps for determining the existence of privacy violations include: A structural rule matching method is used to obtain execution semantic structure conditions describing the execution path structure of privacy violations from a pre-configured set of privacy rules; The execution semantic structure conditions are parsed to form structured decision conditions.
4. The network security data privacy protection management system according to claim 1, characterized in that, The steps for determining the existence of privacy violations also include: Map the field relationships described in the execution semantic structure conditions to connection constraints between field nodes; The execution path structure description is mapped to the connection constraints between execution operator nodes, generating structural constraints that can be matched in the intermediate representation of execution semantics.
5. A network security data privacy protection management system according to claim 1, characterized in that, The steps for determining the existence of privacy violations also include: Based on the connection relationships between the execution operator nodes, the semantic structure traversal method is used to traverse the intermediate representation of the execution semantics. During the traversal, extract semantic node combinations that can form the data execution path.
6. The network security data privacy protection management system according to claim 1, characterized in that, The steps for determining the existence of privacy violations also include: During the traversal, a structural pattern matching method is used to match the traversed semantic nodes and their connection relationships with the structural constraints; When a match is successful, the corresponding set of semantic nodes is determined to form the execution semantic substructure.
7. A network security data privacy protection management system according to claim 1, characterized in that, The steps for constructing the proof of the existence of the privacy violation include: Select the identified execution semantic substructure; The execution semantic substructure is associated with the execution semantic structure conditions that trigger identification to form a privacy violation existence proof object.
8. A network security data privacy protection management system according to claim 1, characterized in that, The execution structure resolution step includes: Based on the privacy violation existence proof object, locate the execution semantic substructure associated with the privacy violation existence proof object in the execution semantic intermediate representation; Changing the field combination method or execution operator connection method in the execution semantic substructure is used to modify the structural relationship of the located execution semantic substructure.
9. A network security data privacy protection management system according to claim 1, characterized in that, The re-determination step includes: Based on the intermediate semantic representation of the execution after the structural modification, the same structural traversal and structural pattern matching method as the first privacy violation existence determination is used to perform the privacy violation existence determination again; Record the results of the privacy violation determination process.
10. A network security data privacy protection management system according to claim 1, characterized in that, The audit data generation steps include: Record objects that provide evidence of privacy violations in the form of structured data; Record the determination result corresponding to the object that proves the existence of the privacy violation.