Script file risk hierarchical management and control method and device, medium and product

Abstract

The invention discloses a script file risk grading control method and device, a medium and a product. The method is applicable to the field of financial science and technology, and comprises the following steps: acquiring a script file in a table structure form to be subjected to risk hierarchical management and control from a database; constructing a data blood relationship map according to the script file; the data consanguinity map comprises a data table node, a field node and a processing script node; performing importance scoring on each node in the data consanguinity map, and determining a risk level corresponding to each node according to the importance score of each node and a risk level threshold value; and determining an execution triggering condition and security monitoring strength corresponding to the script file according to the risk level corresponding to each node. According to the technical scheme, the problems of coarse granularity and response lag of data processing protection in the prior art can be solved, and the execution triggering condition and the monitoring strength are dynamically adjusted by quantifying the script influence factor and performing segmented weighting.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of computer technology and are applicable to the field of financial technology, particularly to a method, device, medium, and product for risk classification and control of script files. Background Technology

[0002] Current data security protection solutions primarily rely on static access control, which is based on role-based predefined data tables and script access control. For example, administrators assign fixed permission levels to scripts, users verify permission tags when executing scripts, and execution logs are recorded for post-event auditing. However, existing technologies have the following drawbacks: 1. Coarse-grained control: Permissions are bound to fixed roles, failing to dynamically assess the actual impact of scripts, leading to over-control of low-risk scripts or insufficient protection for high-risk scripts. 2. Lack of critical quantification: Inability to identify key processing nodes at the field level, resulting in missed detection of high-risk scripts. 3. Delayed response: Change alerts are based on post-event manual intervention, unable to proactively escalate the triggering conditions for high-risk operations. 4. Inefficient resource allocation: Homogeneous monitoring strategies fail to focus on core risk points, leading to wasted audit resources. Summary of the Invention

[0003] This invention provides a script file risk classification and control method, device, medium and product to overcome the problems of coarse-grained data processing and protection and slow response in the prior art. It achieves dynamic adjustment of execution trigger conditions and monitoring intensity by quantifying script influence factors and assigning segmented weights.

[0004] According to one aspect of the present invention, a method for risk classification and control of script files is provided, comprising: Obtain a script file in the form of a table structure to be subject to risk classification and control from the database. The script file in the form of a table structure includes at least one data table, the data table includes at least one field, and the script file also includes a processing script. The processing script is program code that performs target operations on the data table or the field. The target operations include at least one of CRUD operations. A data lineage graph is constructed based on the script file; the data lineage graph includes data table nodes, field nodes, and processing script nodes; Each node in the data lineage map is scored for importance, and the risk level of each node is determined based on its importance score and risk level threshold. The execution trigger conditions and security monitoring strength of the script file are determined based on the risk level corresponding to each node.

[0005] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, which is then executed by the at least one processor to enable the at least one processor to execute the script file risk classification and control method according to any embodiment of the present invention.

[0006] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions, the computer instructions being configured to cause a processor to execute and implement the script file risk classification and control method according to any embodiment of the present invention.

[0007] According to another aspect of the present invention, embodiments of the present invention also provide a computer program product, the computer program product including a computer program, which, when executed by a processor, implements the script file risk classification and control method described in any embodiment of the present invention.

[0008] This invention provides a script file in table structure format, representing a table to be subject to risk classification and control, obtained from a database. The script file includes at least one data table with at least one field, and a processing script (program code performing target operations on the data table or field, including at least one of CRUD operations). A data lineage graph is then constructed based on the script file, comprising data table nodes, field nodes, and processing script nodes. Each node in the data lineage graph is then scored for importance, and its corresponding risk level is determined based on its importance score and risk level threshold. Finally, the execution trigger conditions and security monitoring intensity corresponding to each node are determined based on its risk level. This invention overcomes the problems of coarse-grained data processing protection and delayed response in existing technologies by quantifying script influence factors and assigning segmented weights to dynamically adjust execution trigger conditions and monitoring intensity.

[0009] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0010] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 This is a flowchart of a script file risk classification and control method according to an embodiment of the present invention; Figure 2 This is a schematic diagram of the structure of a script file risk classification and control device according to an embodiment of the present invention; Figure 3 This is a schematic diagram of the structure of an electronic device that implements the script file risk classification and control method of the present invention. Detailed Implementation

[0012] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0013] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and their derivatives, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0014] It is understood that before using the technical solutions disclosed in the various embodiments of this disclosure, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in this disclosure in an appropriate manner in accordance with relevant laws and regulations, and user authorization should be obtained.

[0015] It is understandable that the information collected is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data all comply with the relevant laws, regulations and standards of the relevant countries and regions, take necessary confidentiality and protection measures, follow the "minimum necessary" requirement, do not violate public order and good morals, and provide corresponding operation access points for users to choose to authorize or refuse.

[0016] Example 1 Another type of existing data security protection solution is lineage analysis and early warning: this involves parsing script logs to build a table-level lineage graph, triggering downstream alerts when data tables are changed, and manually reviewing high-risk operations. However, this solution has the following drawbacks: lineage analysis only focuses on table-level dependencies and cannot identify key processing nodes at the field level, thus missing high-risk scripts; change alerts are based on post-event manual intervention and cannot proactively raise the triggering conditions for high-risk operations.

[0017] Figure 1 This is a flowchart of a script file risk classification and control method according to an embodiment of the present invention. This embodiment is applicable to script file risk classification and control situations. The method can be executed by the script file risk classification and control device in this embodiment of the present invention. The device can be implemented in software and / or hardware, such as... Figure 1 As shown, the method specifically includes the following steps: S101. Obtain the script file in the form of a table structure to be used for risk classification and control from the database.

[0018] The script file, which is in the form of a table structure, includes at least one data table, and the data table includes at least one field. The script file also includes a processing script, which is program code that performs target operations on the data table or field. The target operations include at least one of the following: add, delete, modify, and query.

[0019] It is known that script files can be program code script files, the content of which is program code statements for related tables, representing the processing logic of the corresponding tables and fields.

[0020] It should be explained that a data table can be a storage unit for structured data, a field can be a column / attribute in a data table, and a processing script can be a program that performs data transformation or calculation.

[0021] Specifically, retrieve script logs and table structure definitions.

[0022] S102. Construct a data lineage map based on the script file.

[0023] The data lineage graph includes data table nodes, field nodes, and processing script nodes.

[0024] It should be noted that a data lineage graph can be a directed graph structure that describes the dependencies between data tables, fields, and processing scripts.

[0025] For example, a certain data lineage can be represented as: Data table T1 → Field c1 → Processing script A → Field c2 ← Data table T2.

[0026] Specifically, there are two types of relationships in the data lineage graph: containment relationship: the relationship where a data table points to a field (e.g., data table T1 → field c1); data flow relationship: the bidirectional dependency between a field and a processing script (e.g., field c1 → processing script A, script X → field b).

[0027] Specifically, the process involves obtaining script logs and table structure definitions, extracting data tables, fields, and processing script entities as nodes using fixed rules, and identifying inclusion relationships and data flow relationships from the scripts as edges. A data lineage graph, stored in the form of an adjacency dictionary, is then constructed using these nodes and edges. The adjacency dictionary stores the adjacency matrix in dictionary form, where the key is the starting point identifier and the value is the sequence of neighboring nodes of that starting point.

[0028] S103. Assess the importance of each node in the data lineage graph, and determine the risk level of each node based on its importance score and risk level threshold.

[0029] In this embodiment, the importance score of each node can also be called the influence factor, which can be the calculated weight value of each node, reflecting the criticality of the script in the data flow.

[0030] For example, risk levels can be divided into: high risk, medium risk, and low risk. Correspondingly, the risk level threshold can include three sub-thresholds: for example, if the importance score is in [0.1, +∞), it can be considered high risk; if the importance score is in [0.05, 0.1), it can be considered medium risk; and if the importance score is in [0, 0.05), it can be considered low risk.

[0031] Specifically, a graph-based node importance ranking algorithm (webpage importance scoring algorithm) assigns an importance score to each node in the data lineage graph. Then, by comparing each node's importance score with a preset risk level threshold, the risk level corresponding to each node is determined.

[0032] S104. Determine the execution trigger conditions and security monitoring strength of the script file according to the risk level of each node.

[0033] It should be noted that the execution trigger condition can be a predefined rule required to execute the script file (such as an approval process or environmental detection); the security monitoring strength can be the audit granularity of the script file execution process (such as log recording frequency or anomaly detection threshold).

[0034] Specifically, the execution trigger conditions and security monitoring intensity of the script file are dynamically adjusted according to the risk level of each node to achieve risk-level control of the script file.

[0035] This invention provides a script file in table structure format, representing a table to be subject to risk classification and control, obtained from a database. The script file includes at least one data table with at least one field, and a processing script (program code performing target operations on the data table or field, including at least one of CRUD operations). A data lineage graph is then constructed based on the script file, comprising data table nodes, field nodes, and processing script nodes. Each node in the data lineage graph is then scored for importance, and its corresponding risk level is determined based on its importance score and risk level threshold. Finally, the execution trigger conditions and security monitoring intensity corresponding to each node are determined based on its risk level. This invention overcomes the problems of coarse-grained data processing protection and delayed response in existing technologies by quantifying script influence factors and assigning segmented weights to dynamically adjust execution trigger conditions and monitoring intensity.

[0036] Optionally, each node in the data lineage graph can be scored for importance, including: Obtain the total number of nodes and the score of each node in the data pedigree graph.

[0037] The total number of nodes can be the total number of all nodes included in the data lineage graph, and the score of each node can be the importance score of each node (also known as the node weight value).

[0038] Specifically, this involves obtaining the total number of nodes in the pedigree graph and the importance score of each node. In the implementation, the initial score for each node can be directly assigned.

[0039] Identify the set of dangling nodes in the data lineage graph, and determine the global contribution value of the current round based on the score of each dangling node and the total number of nodes.

[0040] It needs to be explained that a dangling node can be a node with no outgoing edges. No outgoing edges means that the node has no edges that go out of it (edges that start from it, for example, node a→ node b, the edge represented by this arrow for node a is the outgoing edge of node a).

[0041] The global contribution value can be the impact of all suspended nodes on the current node's importance score calculation.

[0042] In the actual implementation process, the process of scoring the importance of each node is an iterative process. In each iteration, it is necessary to identify the set of dangling nodes in the data lineage graph, and then calculate the global contribution value of the current round based on the score of each dangling node and the total number of nodes.

[0043] Get the inbound contribution value of each node.

[0044] In this embodiment, the inbound contribution value is used to measure the influence of each node on other nodes.

[0045] The inbound contribution value is the ratio of the score of the source node pointing to the current node to the out-degree of the source node; the out-degree of the source node is the number of outbound edges corresponding to the source node.

[0046] It should be noted that the source node of the current node can be a node with edges pointing to the current node. For example, if node a → node b, then node a is the source node of node b. If there are nodes a → node b and nodes a → node c, then the number of outgoing edges corresponding to the source node a is 2.

[0047] Specifically, iterate through all incoming nodes and calculate the incoming contribution value of each node: Incoming contribution value = Score of source node / Out-degree of source node.

[0048] The score for each node in the new round is determined based on its inbound contribution value and global contribution value.

[0049] Specifically, the score for each node in the new round is calculated based on the inbound contribution value and global contribution value of each node in the current round.

[0050] Replace the score of each node in the data lineage graph with the score of each node in the new round, and return to perform the operation of identifying the set of dangling nodes in the data lineage graph until the norm difference between two adjacent rounds is less than the convergence threshold, or the number of iterations reaches the preset number, then stop the iteration and obtain the importance score of each node.

[0051] It is known that the norm difference is calculated by subtracting corresponding elements of two vectors, taking the absolute value, and then summing them up. In this embodiment, the norm difference between two adjacent rounds can be calculated by subtracting the score of each node in the previous round from the score of each node in the current round, taking the absolute value, and then summing them up.

[0052] The convergence threshold and the preset number of iterations can both be set according to actual needs or empirical values. This embodiment does not limit these values, and users can set and adjust them dynamically. For example, the convergence threshold can be set to 1e by default. -6 The default number of times can be set to 100.

[0053] Specifically, the score of each node in the new round replaces the score of each node in the data lineage graph. The process then returns to identify the set of dangling nodes in the data lineage graph and continues to execute subsequent steps until the norm difference between two adjacent rounds is less than the convergence threshold or the number of iterations reaches the preset number. The iteration then stops, and finally the importance score of each node is obtained.

[0054] The technical solution of this invention updates the weights based on real-time data lineage graphs and scores the importance of each node in the data lineage graph. Lineage analysis focuses on field-level dependencies and can identify key processing nodes at the field level, which can reduce the omission of high-risk scripts.

[0055] In practice, after the iteration stops, the importance score of each node can be normalized, and the sum of the importance scores of each node can be normalized to 1.

[0056] After obtaining the importance score for each node, key scripts and key tables can be identified based on the importance score of each node: filter the processing script nodes with the top K1 importance scores (K1 is configurable, defaults to the top 10%) to obtain the key script list: [Processing script A, Processing script C, ...]; filter the data table nodes with the top K2 importance scores (K2 is configurable, defaults to the top 10%) to obtain the key table list: [Data table T1, Data table T2, ...]; filter the field nodes with the top K3 importance scores (K3 is configurable, defaults to the top 10%) to obtain the key field list: [Field c1, Field c2, ...].

[0057] Optionally, the global contribution value for the current round is determined based on the score of each suspended node and the total number of nodes, including: Obtain the damping factor.

[0058] In this embodiment, the damping factor can be a preset value used to represent the probability of "continuing to jump along the link". The damping factor can be set to 0.85 by default.

[0059] The sum of the scores of all suspended nodes, the ratio of the total number of nodes, and the product of this ratio and the damping factor are used to determine the global contribution value for the current round.

[0060] Specifically, the global contribution value = damping factor × (sum of scores of all suspended nodes / total number of nodes).

[0061] In the technical solution of this invention embodiment, the global contribution value is a scalar that will be shared by all nodes in the next iteration and added to their own score calculation formula, thereby ensuring that "even if some nodes do not leave the edge, their 'importance' will not disappear, but will flow back into the whole graph evenly", ensuring that the sum of scores after iteration convergence and normalization is 1.

[0062] Optionally, the score for each node in the new round is determined based on its inbound contribution and global contribution, including: The sum of each node's inbound contribution and global contribution is used as the first value for each node.

[0063] Specifically, calculate the first value for each node: the first value for each node = the inbound contribution value of each node + the global contribution value.

[0064] The second value is determined based on the damping factor and the total number of nodes.

[0065] Specifically, the second value = (1 - damping factor) / total number of nodes.

[0066] The product of the first value corresponding to each node and the damping factor, and the sum of the product and the second value, are used to determine the score of each node in the new round.

[0067] Specifically, the calculation method for the score of each node in the new round can be expressed as: the score of node i in the new round = (1 - damping factor) / total number of nodes + damping factor × (node ​​i's inbound contribution value + global contribution value), where node i is any node in the data lineage graph.

[0068] The technical solution of this invention reduces norm error by calculating the score of each node in the new round based on the input contribution value and global contribution value of each node in each round during the iteration process, while considering the input weight and uniform compensation of dangling nodes.

[0069] Optionally, in the first iteration, the score of each node in the data lineage graph is the initial value.

[0070] The initial value is determined based on the total number of nodes.

[0071] In the specific implementation process, in the first iteration, the score of all nodes can be initialized to 1 / total number of nodes to ensure that the initial weight of each node in the data lineage graph is evenly distributed.

[0072] The technical solution of this invention determines the initial value of each node in the data lineage graph based on the total number of nodes in the first iteration round, ensuring that the weight of each node is the same at the beginning of the iteration, thereby reducing the impact of individual differences on the iteration process.

[0073] Optionally, a data lineage graph can be constructed based on script logs, including: Entity extraction is performed on the script file to obtain the data table entity, field entity, and processing script entity included in the script file. The data table entity, field entity, and processing script entity are then used as data table nodes, field nodes, and processing script nodes in the data lineage graph.

[0074] Specifically, data tables, fields, and processing script entities can be extracted from script logs using fixed rules, and used as nodes for subsequently building a data lineage graph.

[0075] Based on script statements, the inclusion relationship and data flow relationship between each node are identified, and the inclusion relationship and data flow relationship are used as the edge between each node in the data lineage graph.

[0076] For example, the inclusion relationship between a data table and a field can be that a certain data table contains a certain field. This can be seen from the program code statements, or from the table creation statements or the database metadata tables. Similarly, the data flow relationships of data table T1 → processing script A (fields as script input) and processing script A → data table T2 (script output to fields) can both be identified from the program code.

[0077] Construct a data lineage graph based on data table nodes, field nodes, processing script nodes, and the edges between each node.

[0078] Specifically, the extracted data tables, fields, and processing script entity nodes are used as nodes to construct the data lineage graph, and the inclusion relationships and data flow relationships between each node are used as edges to construct the data lineage graph, ultimately forming the data lineage graph.

[0079] The technical solution of this invention, by constructing nodes including three types of data tables, fields, and processing scripts, accurately identifies key processing scripts and can dynamically assess the actual impact of the scripts.

[0080] Optionally, the execution trigger conditions and security monitoring strength of the script file can be determined based on the risk level of each node, including: If a node has a risk level of high risk, then the trigger condition for the script file is determined to be triple approval, and the security monitoring intensity is full-link audit.

[0081] Specifically, for high-risk processing scripts / data tables / fields: the triggering conditions are adjusted to require triple approval (submitter + department head + data owner); the security monitoring intensity is full-link audit (input / output snapshots + execution environment fingerprints).

[0082] If all script files have a low risk level, then the trigger condition for the script file is set to automatic execution, and the security monitoring strength is set to record the execution log.

[0083] Specifically, for low-risk processing scripts / data tables / fields: the trigger condition is adjusted to automatic execution; the security monitoring intensity is set to only record execution logs.

[0084] Otherwise, the trigger condition corresponding to the script file is determined to be dual approval, and the security monitoring strength is output result verification.

[0085] Specifically, for medium-risk processing scripts / data tables / fields: the triggering condition is adjusted to require approval from both the submitter and the data owner; the security monitoring strength is output result verification.

[0086] The technical solution of this invention dynamically adjusts the execution triggering conditions and security monitoring intensity, reduces invalid audit overhead through a graded risk monitoring strategy, and blocks high-risk unauthorized operations.

[0087] The technical solution of this invention overcomes the problems of coarse-grained data processing protection and slow response in existing technologies. It provides a script file risk classification and control scheme based on dynamic lineage analysis. This scheme quantifies the criticality of processing scripts / data tables / fields through field-level importance scoring, improving identification accuracy by over 40% (compared to table-level lineage). It automatically responds to data flow changes by updating weights based on real-time lineage graphs; reduces invalid audit overhead by 70% through a tiered risk monitoring strategy; and blocks over 95% of high-risk unauthorized operations through a triple approval mechanism. This invention's technical solution can accurately identify critical processing scripts, dynamically adjust execution trigger conditions and security monitoring intensity, and prevent large-scale data pollution and tampering.

[0088] Example 2 Figure 2 This is a schematic diagram of a script file risk classification and control device according to an embodiment of the present invention. This embodiment is applicable to script file risk classification and control situations. The device can be implemented using software and / or hardware, and can be integrated into any device that provides script file risk classification and control functionality, such as… Figure 2 As shown, the script file risk classification and control device specifically includes: an acquisition module 201, a construction module 202, a scoring module 203, and a determination module 204.

[0089] The acquisition module 201 is used to acquire a script file in the form of a table structure to be subject to risk classification and control from the database. The script file in the form of a table structure includes at least one data table, the data table includes at least one field, and the script file also includes a processing script. The processing script is program code that performs target operations on the data table or the field. The target operations include at least one of CRUD operations. Construction module 202 is used to construct a data lineage graph based on the script file; the data lineage graph includes data table nodes, field nodes, and processing script nodes; The scoring module 203 is used to score the importance of each node in the data lineage graph and determine the risk level of each node based on the importance score and risk level threshold. The determination module 204 is used to determine the execution trigger conditions and security monitoring strength of the script file according to the risk level corresponding to each node.

[0090] Optionally, the scoring module 203 includes: The first acquisition unit is used to acquire the total number of nodes and the score of each node in the data lineage graph; The identification and determination unit is used to identify the set of dangling nodes in the data lineage graph and determine the global contribution value of the current round based on the score of each dangling node and the total number of nodes. The second acquisition unit is used to acquire the inbound contribution value of each node; the inbound contribution value is the ratio of the score of the source node pointing to the current node to the outbound degree of the source node; the outbound degree of the source node is the number of outbound edges corresponding to the source node. A determining unit is used to determine the score of each node in the new round based on the inbound contribution value of each node and the global contribution value; The execution unit is used to replace the score of each node in the data lineage graph with the score of each node in the new round, and return to perform the operation of identifying the set of dangling nodes in the data lineage graph until the norm difference between two adjacent rounds is less than the convergence threshold, or the number of iterations reaches the preset number, then the iteration stops and the importance score of each node is obtained.

[0091] Optionally, the identification and determination unit is specifically used for: Obtain the damping factor; The sum of the scores of all suspended nodes, the ratio of the total number of nodes, and the product of this ratio and the damping factor are used to determine the global contribution value for the current round.

[0092] Optionally, the determining unit is specifically used for: The sum of each node's inbound contribution value and the global contribution value is used as the first value corresponding to each node; The second value is determined based on the damping factor and the total number of nodes; The product of the first value corresponding to each node and the damping factor, and the sum of the product and the second value, are used to determine the score of each node in the new round.

[0093] Optionally, in the first iteration, the score of each node in the data lineage graph is an initial value; the initial value is determined based on the total number of nodes.

[0094] Optionally, the building module 202 is specifically used for: Entity extraction is performed on the script file to obtain the data table entity, field entity, and processing script entity included in the script file, and the data table entity, field entity, and processing script entity are used as data table nodes, field nodes, and processing script nodes in the data lineage graph. Based on script statements, the inclusion relationship and data flow relationship between each node are identified, and the inclusion relationship and data flow relationship are used as the edge between each node in the data lineage graph; A data lineage graph is constructed based on the data table nodes, the field nodes, the processing script nodes, and the edges between each node.

[0095] Optionally, the determining module 204 is specifically used for: If the risk level corresponding to the node is high risk, then the trigger condition corresponding to the script file is determined to be triple approval, and the security monitoring strength is full-link audit. If the risk level corresponding to all the script files is low risk, then the trigger condition for the script file is determined to be automatic execution, and the security monitoring strength is to record the execution log. Otherwise, the trigger condition corresponding to the script file is determined to be dual approval, and the security monitoring strength is output result verification.

[0096] The above-mentioned products can execute the script file risk classification and control method provided in any embodiment of the present invention, and have the corresponding functional modules and beneficial effects of the execution method.

[0097] Example 3 Figure 3 A schematic diagram of an electronic device 30 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0098] like Figure 3As shown, the electronic device 30 includes at least one processor 31 and a memory, such as a read-only memory 32 or a random access memory 33, communicatively connected to the at least one processor 31. The memory stores computer programs executable by the at least one processor. The processor 31 can perform various appropriate actions and processes based on the computer program stored in the read-only memory 32 or loaded from storage unit 38 into the random access memory 33. The random access memory 33 can also store various programs and data required for the operation of the electronic device 30. The processor 31, read-only memory 32, and random access memory 33 are interconnected via a bus 34. An input / output interface 35 is also connected to the bus 34.

[0099] Multiple components in electronic device 30 are connected to input / output interface 35, including: input unit 36, such as keyboard, mouse, etc.; output unit 37, such as various types of monitors, speakers, etc.; storage unit 38, such as disk, optical disk, etc.; and communication unit 39, such as network card, modem, wireless transceiver, etc. Communication unit 39 allows electronic device 30 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0100] Processor 31 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 31 include, but are not limited to, central processing units, graphics processing units, various special-purpose artificial intelligence computing chips, various processors running machine learning model algorithms, digital signal processors, and any suitable processor, controller, microcontroller, etc. Processor 31 executes the various methods and processes described above, such as the script file risk classification and control method: Obtain a script file in the form of a table structure to be subject to risk classification and control from the database. The script file in the form of a table structure includes at least one data table, the data table includes at least one field, and the script file also includes a processing script. The processing script is program code that performs target operations on the data table or the field. The target operations include at least one of CRUD operations. A data lineage graph is constructed based on the script file; the data lineage graph includes data table nodes, field nodes, and processing script nodes; Each node in the data lineage map is scored for importance, and the risk level of each node is determined based on its importance score and risk level threshold. The execution trigger conditions and security monitoring strength of the script file are determined based on the risk level corresponding to each node.

[0101] In some embodiments, the script file risk classification and control method can be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 38. In some embodiments, part or all of the computer program can be loaded and / or installed on electronic device 30 via read-only memory 32 and / or communication unit 39. When the computer program is loaded into random access memory 33 and executed by processor 31, one or more steps of the script file risk classification and control method described above can be performed. Alternatively, in other embodiments, processor 31 can be configured to execute the script file risk classification and control method by any other suitable means (e.g., by means of firmware).

[0102] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays, application-specific integrated circuits (ASICs), application-specific standard products (ASICs), systems-on-a-chip (SoCs), payload programmable logic devices, computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0103] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0104] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory, read-only memory, erasable programmable read-only memory (flash memory), optical fibers, portable compact disk read-only memory, optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0105] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a cathode ray tube or liquid crystal display monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0106] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0107] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to address the shortcomings of traditional physical hosts and virtual private servers, such as high management difficulty and weak business scalability.

[0108] In one embodiment, the present invention further includes a computer program product, which includes a computer program that, when executed by a processor, implements the script file risk classification and control method of any embodiment of the present invention.

[0109] In the implementation of a computer program product, computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof. Programming languages ​​include object-oriented programming languages ​​as well as conventional procedural programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including local area networks (LANs) or wide area networks (WANs), or it can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0110] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0111] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for risk classification and control of script files, characterized in that, include: Obtain a script file in the form of a table structure to be subject to risk classification and control from the database. The script file in the form of a table structure includes at least one data table, the data table includes at least one field, and the script file also includes a processing script. The processing script is program code that performs target operations on the data table or the field. The target operations include at least one of CRUD operations. A data lineage graph is constructed based on the script file; the data lineage graph includes data table nodes, field nodes, and processing script nodes; Each node in the data lineage map is scored for importance, and the risk level of each node is determined based on its importance score and risk level threshold. The execution trigger conditions and security monitoring strength of the script file are determined based on the risk level corresponding to each node.

2. The method according to claim 1, characterized in that, Each node in the data pedigree graph is scored for importance, including: Obtain the total number of nodes and the score of each node in the data pedigree graph; Identify the set of dangling nodes in the data lineage graph, and determine the global contribution value of the current round based on the score of each dangling node and the total number of nodes; Obtain the inbound contribution value of each node; the inbound contribution value is the ratio of the score of the source node pointing to the current node to the outbound degree of the source node; the outbound degree of the source node is the number of outbound edges corresponding to the source node; The score for each node in the new round is determined based on the inbound contribution value of each node and the global contribution value. Replace the score of each node in the data lineage graph with the score of each node in the new round, and return to perform the operation of identifying the set of dangling nodes in the data lineage graph until the norm difference between two adjacent rounds is less than the convergence threshold, or the number of iterations reaches the preset number, then stop the iteration and obtain the importance score of each node.

3. The method according to claim 2, characterized in that, The global contribution value for the current round is determined based on the score of each suspended node and the total number of nodes, including: Obtain the damping factor; The sum of the scores of all suspended nodes, the ratio of the total number of nodes, and the product of this ratio and the damping factor are used to determine the global contribution value for the current round.

4. The method according to claim 2, characterized in that, The score for each node in the new round is determined based on the inbound contribution value of each node and the global contribution value, including: The sum of each node's inbound contribution value and the global contribution value is used as the first value corresponding to each node; The second value is determined based on the damping factor and the total number of nodes; The product of the first value corresponding to each node and the damping factor, and the sum of the product and the second value, are used to determine the score of each node in the new round.

5. The method according to claim 2, characterized in that, In the first iteration, the score of each node in the data lineage graph is an initial value; the initial value is determined based on the total number of nodes.

6. The method according to claim 1, characterized in that, Constructing a data lineage graph based on the script logs includes: Entity extraction is performed on the script file to obtain the data table entity, field entity, and processing script entity included in the script file, and the data table entity, field entity, and processing script entity are used as data table nodes, field nodes, and processing script nodes in the data lineage graph. Based on script statements, the inclusion relationship and data flow relationship between each node are identified, and the inclusion relationship and data flow relationship are used as the edge between each node in the data lineage graph; A data lineage graph is constructed based on the data table nodes, the field nodes, the processing script nodes, and the edges between each node.

7. The method according to claim 1, characterized in that, The execution trigger conditions and security monitoring strength of the script file are determined based on the risk level corresponding to each node, including: If the risk level corresponding to the node is high risk, then the trigger condition corresponding to the script file is determined to be triple approval, and the security monitoring strength is full-link audit. If the risk level corresponding to all the script files is low risk, then the trigger condition for the script file is determined to be automatic execution, and the security monitoring strength is to record the execution log. Otherwise, the trigger condition corresponding to the script file is determined to be dual approval, and the security monitoring strength is output result verification.

8. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to execute the script file risk classification and control method according to any one of claims 1-7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that are used to cause a processor to execute the script file risk classification and control method according to any one of claims 1-7.

10. A computer program product comprising a computer program that, when executed by a processor, implements the script file risk classification and control method according to any one of claims 1-7.

Images