Data asset compliance auditing method based on multi-modal data feature fusion

Abstract

The invention discloses a data asset compliance auditing method based on multi-modal data feature fusion. The method comprises the steps of collecting multi-modal feature data of data assets; structural features, semi-structural features and non-structural features of the multi-modal feature data are preprocessed respectively; calculating the attention weight of the preprocessed features; carrying out feature fusion; and inputting the fused features into a logistic regression classifier, outputting a prediction probability, and completing compliance determination of the data assets. According to the method, for small and medium-scale data asset scenes, compliance automatic judgment of behaviors such as data access and circulation is realized, the problems of weak generalization ability, insufficient hidden risk identification and the like of traditional rule dependent auditing are solved, and technical support is provided for data security compliance management.

Description

Technical Field

[0001] This invention belongs to the field of data security and compliance auditing, and in particular relates to a data asset compliance auditing method based on multimodal data feature fusion. Background Technology

[0002] Traditional data compliance auditing relies on manual verification, which suffers from drawbacks such as low efficiency, limited coverage, high error rate, and inability to respond in real time. It is ill-suited to the dynamic auditing needs of large amounts of data assets, as mainly manifested in the following ways:

[0003] Static auditing is the main approach, lacking dynamic adaptability: Most solutions rely on preset rules for static verification, which cannot cope with scenarios such as dynamic transfer of data assets, dynamic changes in permissions, and updates to compliance rules, resulting in poor adaptability.

[0004] High dependence on rules and weak generalization ability: Existing algorithms mostly adopt the method of manually defining compliance rules, which is insufficient for identifying complex data association scenarios and implicit compliance risks (such as indirect data leakage), and has limited generalization ability.

[0005] Low audit efficiency and difficulty in adapting to large amounts of data: Traditional centralized audit architectures suffer from computational bottlenecks when faced with large amounts of data assets, making real-time auditing impossible. Summary of the Invention

[0006] Purpose of the Invention: The purpose of this invention is to provide a data asset compliance auditing method based on multimodal data feature fusion. Targeting small- to medium-sized data asset scenarios, it enables automatic determination of the compliance of data access and transfer activities, addressing the weaknesses of traditional rule-dependent auditing methods such as weak generalization capabilities and insufficient identification of hidden risks, thus providing technical support for data security and compliance management.

[0007] Technical solution: The present invention provides a data asset compliance auditing method based on multimodal data feature fusion, comprising the following steps:

[0008] Step 1: Collect multimodal feature data of data assets;

[0009] Step 2: Preprocess the structured features, semi-structured features, and unstructured features of the multimodal feature data respectively;

[0010] Step 3: Calculate attention weights for the preprocessed features;

[0011] Step 4: Perform feature fusion;

[0012] Step 5: Input the fused features into the logistic regression classifier, output the predicted probability, and complete the compliance determination of the data assets.

[0013] Furthermore, step 1 specifically involves: collecting three core compliance characteristics throughout the entire lifecycle of data assets, including:

[0014] Structured features: User ID, asset ID, permission type, and data sensitivity level are collected from the access control system. Each feature is a numerical or category value.

[0015] Semi-structured features: Data flow paths and API call sequences are collected from data flow logs, with each feature being a string sequence;

[0016] Unstructured features: User operation descriptions and abnormal behavior alarm texts are collected from operation logs, and each feature is a piece of natural language text.

[0017] Furthermore, step 2 specifically involves:

[0018] The structured feature preprocessing is as follows:

[0019] Categorical features: One-hot encoding is used to convert them into binary vectors. One-hot encoding is a feature engineering technique that converts categorical data into a binary vector format that can be recognized by computers.

[0020] Numerical features: Min-Max normalization is used to transform them into the [0,1] interval;

[0021] Output: Standardized structured feature vector ;

[0022] The semi-structured feature preprocessing is as follows:

[0023] Constructing a graph structure: Transform the data flow path into a directed graph, where nodes are data nodes or processing nodes and edges represent flow relationships; transform the API call sequence into an ordered graph, where nodes are API names and edges represent the call order;

[0024] Node2Vec graph embedding: Set parameters walk_length=30, num_walks=200, dimensions=128, perform random walks on the graph structure to generate node sequences, and then train Word2Vec to obtain node embedding vectors.

[0025] Sequence aggregation: The average of the embedding vectors of multiple nodes is taken to obtain the feature vector of the entire flow path or API sequence;

[0026] Output: Standardized semi-structured feature vector The dimension is 128;

[0027] The specific preprocessing of unstructured features is as follows:

[0028] Text cleaning: Remove special characters and redundant spaces from the operation log, and unify capitalization;

[0029] BERT encoding: The pre-trained model bert-base-uncased is used, with max_seq_length=64. The text is converted into a token sequence, which is then input into the BERT model. The output vector corresponding to the [CLS] token is taken as the text feature.

[0030] Vector normalization: L2 normalize the BERT output vector to ensure that the vector magnitude is 1;

[0031] Output: Standardized unstructured feature vector The dimension is 768, and then it is mapped to 128 dimensions through a linear transformation.

[0032] Furthermore, step 3 specifically includes the following steps:

[0033] Step 3.1: Initialize the linear transformation matrix and , dimension , The parameters follow a normal distribution. ;

[0034] Step 3.2: Standardize the 128-dimensional structured feature vector. Standardized semi-structured feature vectors and standardized unstructured feature vectors Perform linear transformations to generate a 64-dimensional query vector. and key vector ;

[0035] Step 3.3: Calculate the dot product score: , , ;

[0036] Step 3.4, Scaling: Divide the score by ;

[0037] Step 3.5, Softmax Normalization: Calculate the exponential function for the scaled score, then divide by the sum of exponents to obtain the attention weights. ;

[0038] .

[0039] Furthermore, step 4 specifically includes the following steps:

[0040] Step 4.1, Dimension Mapping: [This step is incomplete and requires further context.] , , Through dimensions linear transformation matrix Mapping to 128-dimensional space, we get , , ;

[0041] Step 4.2, Weighted Summation: According to the formula Calculate the fusion feature vector The dimension is 128.

[0042] Furthermore, step 5 specifically includes the following steps:

[0043] Step 5.1 Classifier Training: Train the logistic regression model using labeled compliant / non-compliant samples. The loss function is cross-entropy loss, the optimizer is Adam, and the learning rate is 0.001.

[0044] Step 5.2, Inference and Prediction: Incorporate the fused features Input a trained classifier and output the predicted probability. ;

[0045] Step 5.3, Result Judgment: Set Threshold ,like If it is not, it is judged as "non-compliant"; otherwise, it is judged as "compliant".

[0046] Step 5.4 Output audit results: including judgment results, probability of violation and weights of each modality feature.

[0047] The present invention also discloses a computer device, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the method of the present invention.

[0048] The present invention also discloses a computer-readable storage medium having a computer program / instructions stored thereon, which, when executed by a processor, implements the steps of the method of the present invention.

[0049] The present invention also discloses a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the method of the present invention.

[0050] Beneficial effects: Compared with the prior art, the present invention has the following significant advantages:

[0051] This invention proposes a two-tiered auditing mechanism of "multi-dimensional dynamic modeling - real-time computation," focusing on small- to medium-sized data asset scenarios to achieve lightweight, high-precision automated compliance auditing. Through automated auditing, it overcomes the computational bottleneck of traditional centralized auditing when dealing with large amounts of data, significantly improving efficiency.

[0052] This invention designs an attention-based multimodal data compliance feature fusion algorithm (AM-Fusion), which breaks through the limitations of traditional rule-dependent approaches and achieves accurate identification of explicit and implicit compliance risks through adaptive feature weight allocation.

[0053] Static rule dependence leads to weak generalization ability. This invention overcomes the limitations of manual rules by using multimodal feature fusion and attention mechanism to accurately identify explicit and implicit compliance risks.

[0054] This invention integrates multimodal feature processing technology and is designed for small and medium-sized data asset scenarios. It enables automatic judgment of the compliance of data access and transfer behaviors, solves the problems of weak generalization ability and insufficient identification of hidden risks in traditional rule-dependent auditing, and provides technical support for data security and compliance management. Attached Figure Description

[0055] Figure 1 This is a flowchart of the method of the present invention.

[0056] Figure 2 The detailed process for calculating attention weights is shown in the figure.

[0057] Figure 3 The process of dimensional unification and feature fusion is shown in the figure.

[0058] Figure 4 This is a flowchart of the AM-Fusion algorithm.

[0059] Figure 5 This is a flowchart of structured feature processing.

[0060] Figure 6 Flowchart for compliance assessment. Detailed Implementation

[0061] The technical solution of the present invention will be further described below with reference to the accompanying drawings.

[0062] A mechanism for automatic compliance auditing of data assets is defined in Chinese as "Attention-Based Multi Modal Data Compliance Feature Fusion Algorithm" and in English as AM-Fusion (AttentionBased Multi Modal Fusion).

[0063] 1. Algorithm localization and applicable scenarios

[0064] The core objective of the AM-Fusion algorithm is to address the shortcomings of traditional algorithms, such as insufficient fusion of multimodal compliance features (e.g., structured permission data, unstructured operation logs, and semi-structured workflow data) and weak ability to identify hidden risks. The algorithm automatically learns the importance weights of different modal features for compliance auditing through an attention mechanism, achieving precise feature fusion and improving the accuracy of violation identification. This algorithm can independently complete the entire audit process—from multimodal feature acquisition to preprocessing, fusion, and violation identification—within a small to medium-sized data asset scenario. It does not require a distributed architecture and can achieve efficient and accurate automated compliance auditing based on initial compliance rules.

[0065] 2. Algorithm Principle

[0066] Multimodal compliance features include three categories, which characterize the compliance status of data assets from different dimensions.

[0067] Structured features (S): such as user ID, asset ID, permission type, data sensitivity level, etc., are characterized by standardized format and easy quantification, but lack behavioral contextual information. They are converted into vectors using one-hot encoding and numerical encoding.

[0068] Semi-structured features (H): such as data flow paths and API call sequences, are characterized by containing relational information, but their format is flexible and difficult to quantify directly. They are transformed into vectors using the Node2Vec graph embedding method.

[0069] Unstructured features (U): such as operation log descriptions and abnormal behavior texts, are characterized by containing rich semantic information, but lack a fixed format and are difficult to quantify. They are converted into vectors using the BERT model.

[0070] The core principle of the AM-Fusion algorithm is to assign dynamic weights to different modal features through an attention mechanism. The weight reflects the contribution of the feature to the current compliance judgment task. Then, a weighted fusion is used to obtain a more discriminative fused feature vector, which is finally input into the classifier to complete the compliance / non-compliance determination. The core logic of the algorithm can be broken down into four core stages, and the overall process is as follows: Figure 1 As shown;

[0071] Table 1 Symbol Definitions

[0072]

[0073] 3. Definition of Attention Weight Calculation Model

[0074] The method uses scaled dot product attention to calculate the weights of each modality feature. This method can effectively measure the matching degree between the query vector and the key vector, while avoiding numerical overflow caused by excessive dimensionality through scaling factors.

[0075] The formula for calculating the attention weights of structured features is as follows:

[0076]

[0077] Formula Explanation: Attention weights used to calculate structured features (S) ).in,( ) is the query vector for structured features, ( ) is the key vector of the structured features, ( ), ( ) are the query vector and key vector of the semi-structured features, respectively. ), ( ) are the query vector and key vector of the unstructured features, respectively. ) is the scaling factor (value 64), and (exp()) is the exponential function. The denominator is the sum of the exponential values ​​of the three modal features after "dot product operation + scaling processing", and the numerator is the exponential value corresponding to the structured feature. This formula yields the contribution weight of the structured feature in the compliance judgment task. Semi-structured feature weight ( ) and unstructured feature weights ( The computational logic of ) and ( The formula is consistent; simply replace the query vector and key vector of the corresponding structured feature in the formula with the vector of the corresponding modality.

[0078] Similarly, semi-structured feature weights Unstructured feature weights The computational logic and The three factors are consistent; after being normalized using the Softmax function, the sum of their weights is 1.

[0079] in, and Through standardized features Obtained by performing a linear transformation:

[0080]

[0081] Query vectors used to generate structured features ( ).in,( ) is a trainable linear transformation matrix specific to structured features, with dimensions ( )(( =64), m is the standardized structured feature ( (dimensions) ) is the standardized structured feature vector. Through matrix and vector multiplication, the standardized features are mapped to the query vector space.

[0082] and Let be a trainable linear transformation matrix with dimension O(n). . and The generation logic is the same.

[0083] The detailed process of attention weight calculation is as follows: Figure 2 As shown;

[0084] 4. Feature Fusion Model Definition

[0085] fused feature vector It is a weighted sum of the standardized eigenvectors, defined by the formula:

[0086]

[0087] Formula Explanation: Used to calculate the fused feature vector F. Where... , are the attention weights for structured, semi-structured, and unstructured features, respectively, and are the standardized vectors of the three types of features, respectively. By weighted summing of each modality feature vector with its corresponding attention weight, the effective information of the three types of features is integrated to obtain a more discriminative fusion feature, providing accurate input for subsequent violation identification.

[0088] In practical implementation, since the dimensions of features from different modalities may be inconsistent, it is necessary to first unify the dimensions of the feature vectors: , , The features are mapped to the same dimensional space (e.g., 128-dimensional) through linear transformation, and then weighted fusion is performed. The process of dimensional unification and feature fusion is as follows: Figure 3 As shown;

[0089] 5. The proof of the algorithm's correctness is as follows:

[0090] Theorem: The eigenvectors fused by the AM-Fusion algorithm The accuracy rate for identifying violations is no less than the accuracy rate for identifying single-modal features, that is... .

[0091] prove:

[0092] Assume single-modal features The recognition accuracy rates are respectively Attention weights satisfy and .

[0093] The recognition accuracy of the fused features is a weighted average of the accuracy of each individual modality:

[0094]

[0095] Formula Explanation: The recognition accuracy of the fused feature is a weighted average of the recognition accuracy of each individual modality feature. Where, ( ), ( ), ( The accuracy rates of structured, semi-structured, and unstructured features used individually for violation detection are respectively. ), ( ), ( ) are the corresponding attention weights, and satisfy ( ) = 1) and ( ≥ 0).

[0096] make Then there is , , .

[0097] Substituting into the weighted average formula, we get:

[0098]

[0099] therefore, The theorem is thus proved.

[0100] The theorem shows that the fusion feature recognition performance of the AM-Fusion algorithm is no worse than that of the worst single modality feature. Furthermore, when the accuracy of a certain modality feature is high, the attention mechanism will automatically assign it a higher weight, making the fusion accuracy closer to or even exceeding the accuracy of that modality.

[0101] 6. Detailed Implementation Steps of the Algorithm

[0102] The implementation of the AM-Fusion algorithm consists of five core steps, each containing specific operational details and technical parameters to ensure reproducibility. The specific implementation process is as follows: Figure 4 .

[0103] The above embodiments are merely preferred embodiments of the present invention. It should be noted that those skilled in the art can make several improvements and equivalent substitutions without departing from the principle of the present invention. All such improvements and equivalent substitutions to the claims of the present invention fall within the protection scope of the present invention.

Claims

1. A data asset compliance auditing method based on multimodal data feature fusion, characterized in that, Includes the following steps: Step 1: Collect multimodal feature data of data assets; Step 2: Preprocess the structured features, semi-structured features, and unstructured features of the multimodal feature data respectively; Step 3: Calculate attention weights for the preprocessed features; Step 4: Perform feature fusion; Step 5: Input the fused features into the logistic regression classifier, output the predicted probability, and complete the compliance determination of the data assets.

2. The data asset compliance auditing method based on multimodal data feature fusion according to claim 1, characterized in that, Step 1 specifically involves collecting three core compliance characteristics throughout the entire lifecycle of data assets, including: Structured features: User ID, asset ID, permission type, and data sensitivity level are collected from the access control system. Each feature is a numerical or category value. Semi-structured features: Data flow paths and API call sequences are collected from data flow logs, with each feature being a string sequence; Unstructured features: User operation descriptions and abnormal behavior alarm texts are collected from operation logs, and each feature is a piece of natural language text.

3. The data asset compliance auditing method based on multimodal data feature fusion according to claim 1, characterized in that, Step 2 is as follows: The structured feature preprocessing is as follows: Categorical features: One-hot encoding is used to convert them into binary vectors. One-hot encoding is a feature engineering technique that converts categorical data into a binary vector format that can be recognized by computers. Numerical features: Min-Max normalization is used to transform them into the [0,1] interval; Output: Standardized structured feature vector ; The semi-structured feature preprocessing is as follows: Constructing a graph structure: Transform the data flow path into a directed graph, where nodes are data nodes or processing nodes and edges represent flow relationships; transform the API call sequence into an ordered graph, where nodes are API names and edges represent the call order; Node2Vec graph embedding: Set parameters walk_length=30, num_walks=200, dimensions=128, perform random walks on the graph structure to generate node sequences, and then train Word2Vec to obtain node embedding vectors. Sequence aggregation: The average of the embedding vectors of multiple nodes is taken to obtain the feature vector of the entire flow path or API sequence; Output: Standardized semi-structured feature vector The dimension is 128; The specific preprocessing of unstructured features is as follows: Text cleaning: Remove special characters and redundant spaces from the operation log, and unify capitalization; BERT encoding: The pre-trained model bert-base-uncased is used, with max_seq_length=64. The text is converted into a token sequence, which is then input into the BERT model. The output vector corresponding to the [CLS] token is taken as the text feature. Vector normalization: L2 normalize the BERT output vector to ensure that the vector magnitude is 1; Output: Standardized unstructured feature vector The dimension is 768, and then it is mapped to 128 dimensions through a linear transformation.

4. The data asset compliance auditing method based on multimodal data feature fusion according to claim 3, characterized in that, Step 3 specifically includes the following steps: Step 3.1: Initialize the linear transformation matrix and , dimension , The parameters follow a normal distribution. ; Step 3.2: Standardize the 128-dimensional structured feature vector. Standardized semi-structured feature vectors and standardized unstructured feature vectors Perform linear transformations to generate a 64-dimensional query vector. and key vector ; Step 3.3: Calculate the dot product score: , , ; Step 3.4, Scaling: Divide the score by ; Step 3.5, Softmax Normalization: Calculate the exponential function for the scaled score, then divide by the sum of exponents to obtain the attention weights. ; 。 5. A data asset compliance auditing method based on multimodal data feature fusion according to claim 4, characterized in that, Step 4 specifically includes the following steps: Step 4.1, Dimension Mapping: [This step is incomplete and requires further context.] , , Through dimensions linear transformation matrix Mapping to 128-dimensional space, we get , , ; Step 4.2, Weighted Summation: According to the formula Calculate the fusion feature vector The dimension is 128.

6. The data asset compliance auditing method based on multimodal data feature fusion according to claim 1, characterized in that, Step 5 specifically includes the following steps: Step 5.1 Classifier Training: Train the logistic regression model using labeled compliant / non-compliant samples. The loss function is cross-entropy loss, the optimizer is Adam, and the learning rate is 0.

001. Step 5.2, Inference and Prediction: Incorporate the fused features Input a trained classifier and output the predicted probability. ; Step 5.3, Result Judgment: Set Threshold ,like If it is not, it is judged as "non-compliant"; otherwise, it is judged as "compliant". Step 5.4 Output audit results: including judgment results, probability of violation and weights of each modality feature.

7. A computer device comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the steps of the method of claim 1.

8. A computer-readable storage medium having a computer program / instructions stored thereon, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method of claim 1.

9. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method of claim 1.

Images