Data leakage detection system based on artificial intelligence

Abstract

The invention relates to the technical field of intelligent campus construction, in particular to a data leakage detection system based on artificial intelligence, and the system comprises the steps: obtaining a campus access event, associating a user, a path and a field according to time, constructing a continuous jump fragment, extracting a field pair and a repeated jump relation, and recognizing a path evolution and a sudden paragraph. And associating the role identity with the field sequence, generating an access track number and forming a data leakage detection identifier. According to the method, access events are split according to time to construct a field jump chain, a path structure containing permission attributes is generated, the calling relation of field pairs in a path is counted, a field jump dependency set is formed, and the first occurrence position and operation distribution of a field are extracted to construct a path change track. And the associated field calls a syn-position and a role label to generate role behavior mapping, and a field source is extracted to establish an access track number to identify an abnormal field flow direction.

Description

Technical Field

[0001] This invention relates to the field of smart campus construction technology, and in particular to a data leakage detection system based on artificial intelligence. Background Technology

[0002] The field of smart campus construction technology involves the intelligentization of teaching, management, security and services. Core aspects include digital management of teaching resources, collection of student behavior data, intelligent security deployment and integration of campus information systems. The overall system relies on artificial intelligence, Internet of Things and big data processing technologies to build a unified data interaction and management platform to provide digital support for the campus operation process.

[0003] Traditional data breach detection systems refer to the identification of sensitive information leakage during data transmission in campus networks by setting rules or behavioral characteristics. The process usually includes setting sensitive words or data characteristics, matching the transmitted data content, extracting abnormal behavior indicators, setting judgment thresholds, and generating prompt information when the conditions are met. Common methods include keyword comparison, pattern rule setting, access behavior statistics, and abnormal frequency analysis.

[0004] Existing methods primarily rely on static rules and depend on sensitive word and threshold matching. They lack a structured representation of path behavior, cannot establish field redirection logic, and struggle to reveal implicit connections between behavioral chains. Access frequency and anomaly indicators are separated from identity information, lacking a field-role binding mechanism, making it difficult to identify unauthorized access paths. Field behavior lacks a time index, making it impossible to track the evolution of fields within the access chain, and making it difficult to reconstruct behavioral mutation points. The lack of a mapping between interface fields and access paths results in weak field source tracing capabilities, high difficulty in path backtracking, and easy omission of risky leakage nodes. Summary of the Invention

[0005] The purpose of this invention is to address the shortcomings of existing technologies by proposing an artificial intelligence-based data leakage detection system.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: a data leakage detection system based on artificial intelligence, the system comprising:

[0007] The access chain construction module obtains the permission platform, interface call entry and user authentication area access events, extracts user code, path name and field number according to the trigger time, extracts the jump position access point according to the number, calculates the path jump interface name, extracts the identity type permission tag and attaches it to the path, and outputs a set of continuous access jump segments.

[0008] The node relationship extraction module calls the set of continuous access jump segments, extracts the positions of fields before and after the path, reads the mapping between the same identity field and the path, extracts the number of times the field is called and puts it into the path sequence, reads the frequency of field jumps in different paths, and outputs a list of repeated jump pairs of access paths.

[0009] The path evolution identification module calls the list of repeated jump pairs of the access path, extracts the first access event and identity code, interface name, analyzes the field distribution of jump operation fields, numbers and organizes the path extension positions, and outputs the group of content that emerges in discontinuous paths.

[0010] The role cross-parsing module calls the non-continuous path burst content group, extracts the field order and role tags, reads the tag position and field jump operation, embeds the role field into the path fragment, extracts continuous identity tag segments, and outputs the role mixed jump field index table.

[0011] The behavior intervention and labeling module calls the path identity fragment in the role hybrid jump field index table, extracts the call source field, locates the field content and permission interface field, writes the path corresponding to the interface field to the access field trajectory set, extracts all access path numbers containing the identity jump field in the trajectory set, and outputs the data leakage detection identifier.

[0012] As a further aspect of the present invention, the continuous access jump segment set includes user code identifiers, path tag combinations, interface name sets, permission tag appendices, and field jump sequences; the access path repeated jump pair list includes a field pair mapping table, a field call frequency table, path repeated jump pairs, and field segment jump statistics; the discontinuous path burst content group includes a field access time index, operation field distribution segments, path burst location numbers, and interface call timing groups; the role mixed jump field index table includes a field call order number, a role tag mapping group, path identity field pairs, and a field jump association set; and the data leakage detection identifier includes an access field trajectory number, a permission field location group, an identity field jump path, and a leakage risk field set.

[0013] As a further aspect of the present invention, the access chain construction module includes:

[0014] The path extraction submodule obtains the user code, path name and field number from the access events of the smart campus permission platform, organizes the path set with the same field number according to the event trigger time, divides the operation area according to the field number order, and obtains the path operation number sequence.

[0015] The jump identification submodule calls the field number in the path operation number sequence, extracts the corresponding interface entry and access point of the operation field, identifies the interface name associated with the position of field number change, and extracts the jump segment by combining the order of field numbers between paths to obtain the path jump interval segment.

[0016] The permission appending submodule extracts identity type information based on the field numbers in the path jump interval segments, obtains the corresponding permission tags, and appends them to the field number positions corresponding to the path name. The tags are then concatenated sequentially according to the field number order to obtain a sequence of consecutive access jump segments.

[0017] As a further aspect of the present invention, the node relationship extraction module includes:

[0018] The path location submodule calls the access point information in the continuous access jump segment sequence, obtains the corresponding combination of adjacent fields in each path, marks the start and end positions of each field combination in the path, extracts the continuous field combination content according to the path appearance order, and obtains the path field combination segment.

[0019] The field statistics submodule extracts the field paths corresponding to the same identity code based on the field numbers in the path field combination paragraph, records the call frequency of each field in all paths, and imports them into the corresponding number sequence to obtain a list of field call frequencies.

[0020] The jump association submodule extracts the field segments in different paths based on the field number sequence in the field call frequency list, identifies the field combination relationship corresponding to repeated jumps, calculates the number of times the field combination is repeated in the jump segment, and obtains a list of repeated jump pairs in the access path.

[0021] As a further aspect of the present invention, the path evolution identification module includes:

[0022] The event extraction submodule calls the field paragraphs in the list of repeated jumps of the access path, extracts the first access event index of each field content in multiple time segments, and assigns the event indexes to the corresponding field paragraphs in sequence to obtain the field time index sequence.

[0023] The identity reading submodule extracts the corresponding identity code information and access interface name based on each event index in the field time index sequence, merges the interface name into the corresponding identity code according to the event order, and obtains the corresponding fragment of the identity interface.

[0024] The pop-up identification submodule extracts the distribution area of ​​the operation fields between fields based on the field jump order in the segment corresponding to the identity interface, identifies the path extension position in the field paragraph, and collects the jump path numbers into a set to obtain the pop-up content group of discontinuous paths.

[0025] As a further aspect of the present invention, the role cross-analysis module includes:

[0026] The field placement submodule calls the path paragraphs in the discontinuous path burst content group, extracts the field call order and corresponding role identity tags in each paragraph, compares the field order with the tag order, extracts the position of the field corresponding to each role tag, and obtains the role field order position group.

[0027] The tag matching submodule extracts the corresponding field's jump action based on the tag position in the character field sequence position group, pairs the field jump position with the character identity tag, writes the field index of the character appearing in the jump path into the path information stream, and obtains the path character corresponding index sequence.

[0028] The jump extraction submodule extracts the path identity fragments associated with consecutive field jumps based on the field order in the index sequence corresponding to the path role, records the set of fields involved in each jump, filters out the identity roles to which each field belongs in the same jump fragment, and obtains a role-mixed jump field index table.

[0029] As a further aspect of the present invention, the behavior intervention calibration module includes:

[0030] The field source extraction submodule calls the path identity fragment in the role mixed jump field index table, extracts the call source field content corresponding to the field in each path, and processes the extraction results with the field name in the permission interface field table to locate the interface information where the field is located and obtain the interface field location mapping sequence.

[0031] The trajectory path writing submodule locates the interface field information in the mapping sequence based on the interface field, extracts the corresponding call path content, and writes the path information into the access field trajectory set according to the field order, maintaining the consistency of the field call order, to obtain the access field path trajectory set.

[0032] The identity field filtering submodule filters out the location numbers containing identity jump fields based on the path number content of each field in the access field path trajectory set, extracts all corresponding path numbers, combines them into an identifiable item set, and obtains the data leakage detection identifier.

[0033] Compared with the prior art, the advantages and positive effects of the present invention are as follows:

[0034] In this invention, by splitting access events into path jump fields according to a time sequence, a jump chain associated with field numbers is constructed, allowing operational behaviors to be presented in continuous segments. Permission attributes are superimposed on the path, forming a path structure where identity and behavior change synchronously. By statistically analyzing the call relationships of field pairs in different paths, a field jump association set is formed to characterize the call dependencies between fields. By recording the first appearance position of a field in a time segment and combining it with the distribution of operation segments, a path structure change trajectory is constructed to identify the expansion and emergence characteristics of access paths. By associating field call sequence with role tags, a correspondence between role behavior and field jumps is formed. By comparing field sources with interface permission fields, an access field trajectory number set is constructed to identify the flow of sensitive fields in abnormal paths. Attached Figure Description

[0035] Figure 1 This is a flowchart of the method of the present invention;

[0036] Figure 2 This is a flowchart illustrating the acquisition process of the access chain construction module of the present invention.

[0037] Figure 3 This is a flowchart illustrating the node relationship extraction module of the present invention.

[0038] Figure 4 This is a flowchart illustrating the acquisition process of the path evolution identification module of the present invention.

[0039] Figure 5 This is a flowchart illustrating the acquisition process of the role cross-analysis module in this invention.

[0040] Figure 6 This is a flowchart illustrating the acquisition process of the behavioral intervention calibration module of the present invention. Detailed Implementation

[0041] The technical solution of the present invention will now be described with reference to the accompanying drawings.

[0042] In this embodiment of the invention, sometimes a subscript such as W1 may be written in a non-subscript form such as W1. When the difference is not emphasized, the meaning they express is the same.

[0043] To make the technical problems, technical solutions and advantages of the present invention clearer, a detailed description will be given below in conjunction with the accompanying drawings and specific embodiments.

[0044] Please see Figure 1 This invention provides a technical solution: a data leakage detection system based on artificial intelligence, the system comprising:

[0045] The access chain construction module obtains access event content from the smart campus permission platform, interface call entry and user authentication area. It extracts operation segments by user code, path name and field number according to event trigger time, extracts access point information of jump position and operation field according to field number, extracts interface name of path jump in event, extracts permission tag in identity type and appends it to path tag, and outputs a set of continuous access jump segments.

[0046] The node relationship extraction module calls the access point information in the continuous access jump segment set, extracts the field pairs that appear before and after each path and marks the start and end positions, extracts the paths corresponding to the fields in the same identity code, extracts the number of times the fields appear in the path are called and adds them to the list, extracts the number of jump mappings of the field segments in different path calls, and outputs a list of repeated jump pairs of access paths.

[0047] The path evolution identification module calls the field paragraphs in the list of repeated jumps in the access path, extracts the event index of the first access of each paragraph in multiple time segments, reads the identity code information and the corresponding access interface name, extracts the distribution segments of the operation fields between field jumps, numbers and organizes the positions in the field paragraphs where path expansion exists, and outputs the non-continuous path protrusion content group.

[0048] The role cross-parsing module calls path segments in the non-contiguous path burst content group, extracts the field call order and role identity tags involved in the path segment, extracts the position of the role identity tag and the field jump action one by one, writes the position of the role jump field into the path information stream, extracts the path identity fragments and field set in the continuous field jump, and outputs the role mixed jump field index table.

[0049] The behavior intervention labeling module calls the path identity fragment in the role mixed jump field index table, extracts the call source field content in the path identity fragment, locates the field content with the permission interface field table, writes the corresponding call path in the interface field into the access field trajectory set, extracts all access field path numbers containing identity jump fields in the trajectory set, and outputs the data leakage detection identifier.

[0050] The continuous access jump segment set includes user code identifiers, path label combinations, interface name sets, permission label additional items, and field jump sequences. The list of repeated access path jump pairs includes a field pair mapping table, a field call frequency table, repeated path jump pairs, and field segment jump statistics. The non-continuous path burst content group includes a field access time index, operation field distribution segments, path burst location numbers, and interface call time sequence groups. The role mixed jump field index table includes a field call order number, role label mapping group, path identity field pairs, and field jump association set. The data leakage detection identifier includes access field trajectory number, permission field location group, identity field jump path, and leakage risk field set.

[0051] Please see Figure 2 The access chain building module includes:

[0052] The path extraction submodule obtains the user code, path name and field number from the access events of the smart campus permission platform, organizes the path set with the same field number according to the event trigger time, divides the operation area according to the field number order, and obtains the path operation number sequence.

[0053] The system establishes a high-speed data connection to the underlying log server of the smart campus access platform and sets a 24-hour data reading time window for batch processing. During execution, the system scans the raw access logs generated by the server line by line, parses and extracts key metadata from each access event, including the unique user code initiating the access (e.g., User_ID: 20248801), the specific path name of the request, and the integer field number generated based on the front-end page DOM structure or back-end interface definition. The system then strictly sorts all extracted discrete events according to their timestamps at the millisecond level, constructing a complete time series. Traversing this series, the system matches user codes and session identifiers to merge and organize all consecutive operation events belonging to the same user within a single login cycle. Based on this, the system executes the operation area division logic according to the numerical characteristics of the field numbers, calculating the difference between two adjacent field numbers in the sequence in real time. If the calculated difference is less than the system's preset step size threshold of 5, the two fields are determined to be logically or functionally closely related and are assigned to the same operation area; conversely, if the difference exceeds the threshold, the user is determined to have started a new functional module operation, thus dividing the system into a new area. Through the above refined processing flow, the system successfully transformed massive and scattered raw log data into ordered, segmented structured data, resulting in a path operation number sequence that reflects the user's actual operation logic.

[0054] The jump identification submodule calls the field number in the path operation number sequence, extracts the corresponding interface entry and access point of the operation field, identifies the interface name associated with the position of field number change, and extracts the jump segment by combining the order of field numbers between paths, thus obtaining the path jump interval segment.

[0055] The system invokes a sequence of operation operation numbers to initiate semantic analysis at the interface level. By loading a pre-defined system interface attribution table, it maps each integer field number in the sequence to its corresponding specific functional interface. The system focuses on monitoring changes in the interface attributes of adjacent field numbers within the sequence, aiming to identify key nodes where users switch from one functional page to another. For example, when the system detects that the preceding field in the sequence is the query confirmation field 1003 belonging to the grade query interface, and the following field immediately changes to the print preview field 5001 belonging to the print service interface, the system immediately recognizes a cross-interface jump at that location. During this process, the system marks the unchanging field 1003 as the interface entry point and the changed field 5001 as the operation field access point, and combines this with the chronological order of the field numbers in the path to determine the direction and logical connection of the jump. The system correlates the start and end points of all identified interface change events, extracting jump segments containing clear source interface, target interface, and specific field information, thereby eliminating invalid in-page operations or refresh behaviors and obtaining path jump interval segments that accurately describe the business flow process.

[0056] The permission appending submodule extracts identity type information based on the field numbers in the path jump interval segments, obtains the corresponding permission tags, and appends them to the field number positions corresponding to the path name. The tags are then concatenated in the order of the field numbers to obtain a sequence of consecutive access jump segments.

[0057] Based on the field numbers marked in the path jump intervals, the system accesses the access control database and performs a reverse query to determine the minimum set of permissions required for each field to be allowed access according to the system security policy definition. Simultaneously, the system reads the identity attribute information associated with the user code initiating the access path, identifying the user's specific role at the current time, such as an undergraduate student, academic affairs officer, or system administrator. The system obtains the corresponding identity permission tag based on the identity attribute and uses data fusion technology to forcibly attach this permission tag as metadata to the field number position corresponding to the path name, imprinting an identity mark on each otherwise static number. Specifically, the system traverses the entire jump path, establishing a key-value pair mapping between field nodes and permission tags. If the user's identity is a student, each node in the path will be marked with the student role attribute. Following the order in which the field numbers are called in the original path, the system sequentially concatenates these field information with clear identity tags, forming a chain structure containing user role characteristics and behavioral trajectories, eliminating the ambiguity of identity information in the original data and obtaining a continuous access jump segment sequence with rich semantic information.

[0058] Please see Figure 3 The node relationship extraction module includes:

[0059] The path location submodule calls the access point information in the sequence of consecutive access jump segments, obtains the corresponding combination of adjacent fields in each path, marks the start and end positions of each field combination in the path, extracts the content of consecutive field combinations according to the order of appearance of the path, and obtains the path field combination paragraph.

[0060] To capture micro-level behavioral relationships, the system retrieves access point information from a sequence of consecutive access jump segments. A sliding window of size 2 scans the entire path sequence segment by segment. During this process, the system extracts two adjacent fields covered within the window and constructs them into a causal pair. For example, adjacent query and print operation fields are extracted as a specific behavioral combination. The system meticulously annotates the start and end index positions of each extracted combination within the global path at the metadata level, ensuring that subsequent analysis can trace back to specific segments of the original trajectory. Strictly adhering to the original chronological order of the path's appearance in the logs, the system extracts and stores the specific content of these consecutive field combinations, thus restoring single, isolated jump points into logical chains with complete contextual relationships. This step not only preserves the chronological order of operations but also locks into the specific environment in which the operations occurred, providing a basic unit for analyzing user behavior habits and obtaining path field combination segments that reflect local behavioral logic.

[0061] The field statistics submodule extracts the field paths corresponding to the same identity code based on the field numbers in the path field combination paragraph, records the call frequency of each field in all paths, and imports them into the corresponding number sequence to obtain a list of field call frequencies.

[0062] Upon receiving the path field combination paragraph, the system initiates a deep statistical analysis program based on identity groups. The system categorizes the data stream according to specific identity codes based on field numbers, extracting the corresponding field path data for each identity group (e.g., all student users or all administrative staff users). The system builds a high-dimensional counting matrix in memory, traversing all paths and recording the frequency of each field's access across all paths for a specific identity group. For example, the system's statistical analysis reveals that a specific print preview field is accessed very infrequently in the student group's access paths, but significantly more frequently in the administrative staff group's paths, exhibiting a clear role difference. The system integrates these statistically derived frequency values ​​into the corresponding number sequence, calculates and generates statistical indicators reflecting the access frequency and dependence of different roles on various functional modules, and reveals the behavioral benchmarks of different identity roles through quantitative data, resulting in a field call frequency list containing detailed frequency data.

[0063] The jump-related submodule extracts the field segments in different paths based on the field number sequence in the field call frequency list, identifies the field combination relationship corresponding to repeated jumps, calculates the number of times the field combination is repeated in the jump segment, and obtains a list of repeated jump pairs in the access path.

[0064] Based on the field number sequence and statistical data in the field call frequency list, the system extracts the field segments in different paths to identify high-frequency and stable repetitive redirection behaviors within the system. The system uses statistical methods to analyze the frequency distribution characteristics of field combinations, calculating the average frequency and standard deviation to set a dynamic baseline for determining repetitive redirections. In the actual operation of this embodiment, when the number of times a certain field combination (such as redirection from grade query to grade modification) occurs in all historical paths exceeds the threshold of 110 calculated based on statistical distribution, the system determines that the redirection is not an occasional erroneous operation, but rather a normalized and standardized business flow relationship within the system. The system further calculates the specific number of times this high-frequency field combination is repeated in all redirection segments, and encapsulates the source field, target field, and number of repetitions to construct the system's mainstream business logic topology, obtaining a list of repetitive redirection pairs containing core business flow information.

[0065] Please see Figure 4 The path evolution recognition module includes:

[0066] The event extraction submodule calls the access path to repeatedly jump to the field paragraphs in the list, extracts the first access event index of each field content in multiple time segments, and assigns the event indexes to the corresponding field paragraphs in sequence to obtain the field time index sequence.

[0067] To monitor the dynamic evolution of user behavior over time, the system uses a list of repeated redirects to access paths. It divides massive amounts of historical access data into multiple consecutive time segments distributed by natural weeks. For each segment recorded in the list, the system performs a full search across all the divided time segment logs to pinpoint the exact moment the behavior pattern first appeared. For example, the system might find that a specific cross-module redirection behavior did not occur in the first week, but only on Wednesday morning of the second week. The system records the unique index number of this first access event in the global log database, such as 88420, and sequentially assigns these "first trigger" event indices to the corresponding segment records. This process imbues static path relationships with a time dimension, establishing a precise mapping between behavior patterns and time nodes. This allows the system to trace the starting point of a business habit or attack behavior, obtaining a sequence of field time indexes containing timestamps.

[0068] The identity reading submodule extracts the corresponding identity code information and access interface name based on each event index in the field time index sequence, merges the interface names into the corresponding identity codes according to the event order, and obtains the corresponding fragment of the identity interface.

[0069] Based on each event index in the field's time index sequence, a reverse query operation is performed to extract the user identity code information corresponding to the event and the specific interface name accessed at that time from the original logs. The system compares records from different time points and performs a merge operation, arranging and integrating new interface names triggered by the same identity code at different time points in chronological order. For example, the system identifies that an administrator initially only accessed the basic configuration interface, but subsequently added access to the sensitive data export interface in a later time window. The system categorizes these new interface access records under that administrator's name, constructing a permission usage graph that expands over time for that role. Through this process, the system reconstructs the dynamic change trajectory of a specific role's permission usage scope on the timeline, revealing potential permission sprawl or changes in business scope, and obtaining corresponding fragments of identity interfaces that reflect the evolution of role behavior.

[0070] The pop-up identification submodule extracts the distribution area of ​​the operation fields between fields based on the field jump order in the corresponding fragment of the identity interface, identifies the path extension position in the field paragraph, and collects the jump path numbers into a set to obtain the pop-up content group of discontinuous paths.

[0071] Based on the field jump order in the corresponding fragments of the identity interface, the system deeply analyzes the distribution area of ​​the operational fields between fields, focusing on identifying discontinuous and sudden path expansion behaviors. The system prioritizes monitoring logical jumps across different functional modules, especially access paths that bypass regular intermediate steps. For example, when the system detects that a user frequently accesses the login page node from an older time slice and directly jumps to the advanced details page node that only appears in a new time slice, clearly skipping the regular list page or verification page, the system determines this behavior as a sudden path expansion based on logical discontinuity. The system extracts the numbers of these specific jump paths that do not conform to linear business logic and compiles them into an independent set. This set captures abnormal bypasses, DeepLink attacks, or unrecorded innovative access patterns in the system, obtaining groups of discontinuous path expansion content for subsequent in-depth analysis.

[0072] Please see Figure 5 The role cross-analysis module includes:

[0073] The Field Positioning submodule calls the path paragraphs in the non-contiguous path burst content group, extracts the field call order and corresponding role identity tags in each paragraph, compares the field order with the tag order, extracts the position of the field corresponding to each role tag, and obtains the role field order position group.

[0074] The system invokes path segments within the non-contiguous path burst content group, extracting the invocation order of fields within each segment and the actual role identity tag used in this access. A standard business model is established, comparing the extracted field order with the role permissions typically associated with that field in the standard business process. For example, the system verifies that the "Approval Passed" operation, currently in the third order of the path, should be attributed to "Department Manager," and performs conflict detection with the current user's "Intern" tag. During this process, the system extracts the physical location of each role tag's corresponding field in the actual HTTP request message, including the URL parameter area, Header area, or Body area, thus precisely grounding the abstract permission concept in the specific message structure. This step aims to determine the specific location of each operation step at the technical implementation level, providing a positioning basis for subsequent fine-grained matching, and obtaining a role field order position group containing physical location information.

[0075] The tag matching submodule extracts the corresponding field's jump action based on the tag position in the role field's sequential position group, pairs the field jump position with the role's identity tag, writes the field index of the role appearing in the jump path into the path information stream, and obtains the index sequence corresponding to the path role.

[0076] Based on the tag position information in the role field's sequential position group, the system further extracts the specific redirection action for the corresponding field, such as POST submission, GET query, or DELETE deletion command. The system employs forced pairing logic to associate the field's redirection position with the actual role identity tag it carries, clearly recording what specific operation a particular role performed at a specific path location. For example, the system records that at a certain redirection node, a role marked "Visitor" performed the "Backend Login" action, which belongs to "Administrator." The system writes the field indexes appearing in the redirection path into a continuous path information stream, forming a detailed "action-role-location" three-dimensional mapping record. This ensures that every minute operational step has a clear role attribution record, obtaining a path role-corresponding index sequence describing fine-grained behavioral characteristics.

[0077] The jump extraction submodule extracts the path identity fragments associated with consecutive field jumps based on the field order in the index sequence corresponding to the path role, records the set of fields involved in each jump, filters out the identity roles to which each field in the same jump fragment belongs, and obtains the role-mixed jump field index table.

[0078] Based on the field order in the index sequence corresponding to the path roles, the entire session path is scanned for integrity. The path identity segments associated with consecutive field jumps are extracted, and the set of fields involved in each jump is recorded in detail. The system executes core cross-analysis logic, focusing on screening for mixed situations where fields in the same jump segment belong to different role identities. For example, the system identifies a sudden switch or mixing of roles in the same access path where the preceding field group clearly belongs to a score-checking operation with "student" privileges, while the subsequent field group suddenly changes to a score-modification operation with "administrator" privileges. This instantaneous role switching or mixing is marked as abnormal. The system records the specific location of these cross-role intersections, the fields involved, and the type of mixing, quantifying the degree of role confusion and obtaining a role-mixed jump field index table for risk assessment.

[0079] Please see Figure 6 The behavior intervention labeling module includes:

[0080] The field source extraction submodule calls the path identity fragments in the role-mixed jump field index table, extracts the call source field content corresponding to the field in each path, matches the extraction results with the field names in the permission interface field table, locates the interface information where the field is located, and obtains the interface field location mapping sequence.

[0081] The system calls the path identity fragments in the role-mixed redirect field index table, performs source tracing analysis on paths marked as high-risk, and extracts the corresponding referrer information from the calling source fields within each path segment. The system then performs a full match against the pre-installed permission interface field table in the system's core database. This permission interface field table defines the standard interface affiliation for all legitimate fields. Through rigorous comparison, the system can accurately locate the specific interface information of abnormal fields. For example, it confirms that a sensitive "score modification" field actually belongs to the "academic performance management interface," rather than the "student front-end application" currently being used by the user. This process ensures that every suspicious field can find its true source interface and affiliation module at the technical level, eliminating data silos and obtaining an interface field location mapping sequence containing accurate metadata.

[0082] The trajectory path writing submodule locates the interface field information in the mapping sequence based on the interface field, extracts the corresponding call path content, and writes the path information into the access field trajectory set in the field order to maintain the consistency of the field call order, thus obtaining the access field path trajectory set.

[0083] Based on the interface field location mapping sequence, the system extracts all corresponding historical call path content from the full logs, aiming to reconstruct the complete trajectory of unauthorized operations or attacks. The system not only focuses on error points but also strictly writes this path information into the access field trajectory set according to the timestamp sequence and the logical order of field calls. During the writing process, the system maintains absolute consistency in the field call order, without reordering or simplifying the data in any way, to restore the true context of user operations to the greatest extent possible. By fully reproducing how the user bypassed front-end restrictions step by step and triggered unauthorized nodes, the system constructs a complete chain of evidence that can be used for forensic investigation and auditing, obtaining a detailed access field path trajectory set.

[0084] The identity field filtering submodule filters out the location numbers containing identity redirection fields based on the path number content of each field in the access field path trajectory set, extracts all corresponding path numbers, combines them into an identifiable item set, and obtains data leakage detection identifiers.

[0085] Based on the path numbers of each field in the access path trajectory set, a risk assessment program is executed to filter out special location numbers containing identity redirection fields and extract all corresponding path numbers to form an identifiable item set. The system performs a quantitative risk assessment on the identified unauthorized fields, accumulating the risk based on the sensitivity weight of the fields. For example, if the system identifies a highly weighted personal privacy field and a core modification permission field in the trajectory, the system adds their sensitivity weights together, calculating a cumulative risk value of 1.5. The system then compares this calculated risk value with a baseline threshold of 0.8, trained based on historical normal behavior. Since the calculated result significantly exceeds the security threshold, the system determines that the current behavior poses an extremely high risk of data leakage or damage, and immediately generates a data leakage detection flag.

[0086] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A data breach detection system based on artificial intelligence, characterized in that, The system includes: The access chain construction module obtains the permission platform, interface call entry and user authentication area access events, extracts user code, path name and field number according to the trigger time, extracts the jump position access point according to the number, calculates the path jump interface name, extracts the identity type permission tag and attaches it to the path, and outputs a set of continuous access jump segments. The node relationship extraction module calls the set of continuous access jump segments, extracts the positions of fields before and after the path, reads the mapping between the same identity field and the path, extracts the number of times the field is called and puts it into the path sequence, reads the frequency of field jumps in different paths, and outputs a list of repeated jump pairs of access paths. The path evolution identification module calls the list of repeated jump pairs of the access path, extracts the first access event and identity code, interface name, analyzes the field distribution of jump operation fields, numbers and organizes the path extension positions, and outputs the group of content that emerges in discontinuous paths. The role cross-parsing module calls the non-continuous path burst content group, extracts the field order and role tags, reads the tag position and field jump operation, embeds the role field into the path fragment, extracts continuous identity tag segments, and outputs the role mixed jump field index table.

2. The data leakage detection system based on artificial intelligence according to claim 1, characterized in that: The set of continuous access jump segments includes user code identifiers, path tag combinations, interface name sets, permission tag appendices, and field jump sequences. The list of repeated access path jump pairs includes a field pair mapping table, a field call frequency table, repeated path jump pairs, and field segment jump statistics. The group of non-continuous path burst content includes a field access time index, operation field distribution segments, path burst location numbers, and interface call timing groups. The role-mixed jump field index table includes a field call order number, a role tag mapping group, path identity field pairs, and a field jump association set.

3. The data leakage detection system based on artificial intelligence according to claim 1, characterized in that, The access chain construction module includes: The path extraction submodule obtains the user code, path name and field number from the access events of the smart campus permission platform, organizes the path set with the same field number according to the event trigger time, divides the operation area according to the field number order, and obtains the path operation number sequence. The jump identification submodule calls the field number in the path operation number sequence, extracts the corresponding interface entry and access point of the operation field, identifies the interface name associated with the position of field number change, and extracts the jump segment by combining the order of field numbers between paths to obtain the path jump interval segment. The permission appending submodule extracts identity type information based on the field numbers in the path jump interval segments, obtains the corresponding permission tags, and appends them to the field number positions corresponding to the path name. The tags are then concatenated sequentially according to the field number order to obtain a sequence of consecutive access jump segments.

4. The data leakage detection system based on artificial intelligence according to claim 1, characterized in that, The node relationship extraction module includes: The path location submodule calls the access point information in the continuous access jump segment sequence, obtains the corresponding combination of adjacent fields in each path, marks the start and end positions of each field combination in the path, extracts the continuous field combination content according to the path appearance order, and obtains the path field combination segment. The field statistics submodule extracts the field paths corresponding to the same identity code based on the field numbers in the path field combination paragraph, records the call frequency of each field in all paths, and imports them into the corresponding number sequence to obtain a list of field call frequencies. The jump association submodule extracts the field segments in different paths based on the field number sequence in the field call frequency list, identifies the field combination relationship corresponding to repeated jumps, calculates the number of times the field combination is repeated in the jump segment, and obtains a list of repeated jump pairs in the access path.

5. The data leakage detection system based on artificial intelligence according to claim 1, characterized in that, The path evolution identification module includes: The event extraction submodule calls the field paragraphs in the list of repeated jumps of the access path, extracts the first access event index of each field content in multiple time segments, and assigns the event indexes to the corresponding field paragraphs in sequence to obtain the field time index sequence. The identity reading submodule extracts the corresponding identity code information and access interface name based on each event index in the field time index sequence, merges the interface name into the corresponding identity code according to the event order, and obtains the corresponding fragment of the identity interface. The pop-up identification submodule extracts the distribution area of ​​the operation fields between fields based on the field jump order in the segment corresponding to the identity interface, identifies the path extension position in the field paragraph, and collects the jump path numbers into a set to obtain the pop-up content group of discontinuous paths.

6. The data leakage detection system based on artificial intelligence according to claim 1, characterized in that, The role cross-analysis module includes: The field placement submodule calls the path paragraphs in the discontinuous path burst content group, extracts the field call order and corresponding role identity tags in each paragraph, compares the field order with the tag order, extracts the position of the field corresponding to each role tag, and obtains the role field order position group. The tag matching submodule extracts the corresponding field's jump action based on the tag position in the character field sequence position group, pairs the field jump position with the character identity tag, writes the field index of the character appearing in the jump path into the path information stream, and obtains the path character corresponding index sequence. The jump extraction submodule extracts the path identity fragments associated with consecutive field jumps based on the field order in the index sequence corresponding to the path role, records the set of fields involved in each jump, filters out the identity roles to which each field belongs in the same jump fragment, and obtains a role-mixed jump field index table.

7. The data leakage detection system based on artificial intelligence according to claim 1, characterized in that, The system also includes: The behavior intervention labeling module calls the path identity fragment in the role hybrid jump field index table, extracts the call source field, locates the field content and permission interface field, writes the path corresponding to the interface field to the access field trajectory set, extracts all access path numbers containing the identity jump field in the trajectory set, and outputs the data leakage detection identifier. The data leakage detection identifier includes access field trajectory number, permission field location group, identity field jump path, and leakage risk field set.

8. The data leakage detection system based on artificial intelligence according to claim 7, characterized in that, The behavioral intervention calibration module includes: The field source extraction submodule calls the path identity fragment in the role mixed jump field index table, extracts the call source field content corresponding to the field in each path, and processes the extraction results with the field name in the permission interface field table to locate the interface information where the field is located and obtain the interface field location mapping sequence. The trajectory path writing submodule locates the interface field information in the mapping sequence based on the interface field, extracts the corresponding call path content, and writes the path information into the access field trajectory set according to the field order, maintaining the consistency of the field call order, to obtain the access field path trajectory set. The identity field filtering submodule filters out the location numbers containing identity jump fields based on the path number content of each field in the access field path trajectory set, extracts all corresponding path numbers, combines them into an identifiable item set, and obtains the data leakage detection identifier.

Images