Data desensitization method and device, storage medium, electronic equipment and program product

Abstract

The invention discloses a data desensitization method and device, a storage medium, electronic equipment and a program product, and relates to the field of financial science and technology and the field of information security, and the method comprises the steps: constructing a blood relationship dependence graph based on a data processing link; determining the blood relationship dependence intensity of the derivative data on the original sensitive data according to the blood relationship dependence map, wherein the blood relationship dependence intensity represents the probability of obtaining the original sensitive data after leakage of the derivative data; determining the desensitization intensity of the target business data according to the sensitive field in the target business data, the scene identifier and the sensitivity level of the target business data and the blood relationship dependence intensity, and then determining a desensitization strategy according to the desensitization intensity; and performing desensitization processing on the target business data according to the desensitization strategy, and outputting the desensitized target business data. According to the method and the device, the technical problem of high desensitization leakage risk caused by incapability of effectively tracking and identifying derivative sensitive data in a desensitization technology in the prior art is solved.

Description

Technical Field

[0001] This application relates to the fields of financial technology and information security, and more specifically, to a data desensitization method, apparatus, storage medium, electronic device, and program product. Background Technology

[0002] Data masking is a crucial technical means for data security and privacy compliance in industries such as finance and telecommunications. Commonly used masking technologies fall into three main categories: The first is static offline batch masking, which uses batch processing tools to perform masking operations on offline stored data according to pre-configured fixed rules, such as masking phone numbers. The second is gateway-level fixed-rule interception, where masking rules are preset in the network API gateway, and all request data passing through the gateway is uniformly matched and masked according to these rules. The third is database field tag-based masking, which adds tags to fields marked as "sensitive" in the database (such as bank card numbers), and when queries involve such "sensitive" fields, database plugins automatically perform masking based on the tags.

[0003] However, existing data masking technologies cannot effectively track and identify derived sensitive data generated during data processing and circulation, leading to a high risk of missed masking in practical applications. For example, traditional solutions can only identify and process sensitive fields explicitly marked or formatted in the original data table, and cannot analyze and track derived data generated after these original sensitive data undergo operations such as splicing, transformation, and function calculations during business processing. For instance, in financial transactions, a "customer identifier" may be composed of "name" and the "last four digits of ID number." Existing technologies cannot identify the relationship between such derived fields and the original sensitive data, resulting in these derived data containing sensitive information fragments not being included in the masking control scope during actual circulation, easily creating vulnerabilities and hidden dangers in data security protection.

[0004] There is currently no effective solution to the above problems. Summary of the Invention

[0005] This application provides a data desensitization method, apparatus, storage medium, electronic device, and program product to at least solve the technical problem that existing desensitization technologies cannot effectively track and identify derived sensitive data, resulting in a high risk of missed desensitization.

[0006] According to one aspect of the embodiments of this application, a data desensitization method is provided, comprising: constructing a lineage dependency graph based on a data processing link, wherein the lineage dependency graph is used to record the dependency relationship and transformation path between original sensitive data and derived data in the data processing link; determining the lineage dependency strength of derived data on original sensitive data according to the lineage dependency graph, wherein the lineage dependency strength characterizes the probability of obtaining the original sensitive data after the derived data is leaked; determining the desensitization strength of the target business data according to the sensitive fields in the target business data, the scenario identifier and sensitivity level of the target business data, and the lineage dependency strength, and then determining a desensitization strategy according to the desensitization strength, wherein the desensitization strength is used to select a corresponding desensitization strategy from a preset mapping relationship; performing desensitization processing on the target business data according to the desensitization strategy, and outputting the desensitized target business data.

[0007] Optionally, constructing a lineage dependency graph based on the data processing chain includes: generating lineage dependency records based on the data processing chain, wherein the lineage dependency records include the processing steps of data collected by multiple data acquisition units and the structured mapping relationship between data input and output fields; constructing a directed acyclic graph based on the lineage dependency records, wherein nodes in the directed acyclic graph represent data fields and edges in the directed acyclic graph represent data processing functions; and constructing the lineage dependency graph based on the directed acyclic graph.

[0008] Optionally, the data processing link corresponds to multiple data acquisition units, which include a virtual machine monitoring interface probe, a gateway interceptor, and a database auditing plugin. The virtual machine monitoring interface probe is used to collect sensitive data in the application's memory, the gateway interceptor is used to collect parameters in Hypertext Transfer Protocol requests, and the database auditing plugin is used to collect structured query operation logs.

[0009] Optionally, the bloodline dependency strength of derived data on original sensitive data is determined based on the bloodline dependency graph, including: for each derived field in the directed acyclic graph, the basic dependency strength of the derived field is determined based on the number and type of original sensitive fields that the derived field depends on; the basic dependency strength of the derived field is attenuated based on a preset attenuation coefficient and the number of data processing layers to obtain the bloodline dependency strength of the derived field, wherein, for derived fields generated by single-layer processing, the number of data processing layers and the preset attenuation coefficient are both 1.

[0010] Optionally, the basic dependency strength of the derived field is determined based on the number and type of the original sensitive fields that the derived field depends on, including: determining the basic dependency strength as 1 when the derived field depends on a single original sensitive field; determining the basic dependency strength as 0 when the derived field does not depend on any original sensitive fields; and assigning a first weight to the original sensitive fields among the multiple fields and a second weight to the non-sensitive fields among the multiple fields when the derived field depends on multiple fields, and then determining the basic dependency strength based on the ratio of the sum of the weights of all fields among the multiple fields to the sum of the weights of the original sensitive fields.

[0011] Optionally, the basic dependency strength of the derived field is calculated by attenuating it according to the preset attenuation coefficient and the number of data processing layers to obtain the lineage dependency strength of the derived field, including: obtaining the number of data processing layers that the derived field passes through in the directed acyclic graph; performing an exponential operation on the preset attenuation coefficient to obtain the attenuation factor, wherein the exponent of the exponential operation is the number of data processing layers; and multiplying the basic dependency strength by the attenuation factor to obtain the lineage dependency strength.

[0012] Optionally, the desensitization strength of the target business data is determined based on the sensitive fields in the target business data, the scenario identifier and sensitivity level of the target business data, and the lineage dependency strength. This includes: extracting sensitive field features based on the lineage dependency graph, and using a Bloom filter and a preset data cache to collaboratively identify sensitive fields in the target business data; obtaining the business scenario weight, sensitivity level, and lineage dependency strength corresponding to the scenario identifier of the sensitive field; multiplying the sensitivity level by a first coefficient to obtain a first product, multiplying the lineage dependency strength by a second coefficient to obtain a second product, and multiplying the business scenario weight corresponding to the scenario identifier by a third coefficient to obtain a third product, wherein the sum of the first, second, and third coefficients is 1; and adding the first, second, and third products to obtain the desensitization strength.

[0013] Optionally, obtaining the business scenario weight, sensitivity level, and lineage dependency strength corresponding to the scenario identifier of a sensitive field includes: obtaining the business attributes, format features, and validation features of the sensitive field, as well as the scenario identifier, and generating a combined feature vector; performing a double hash operation on the combined feature vector to generate a fixed-length feature fingerprint, wherein the double hash operation includes a cascaded processing of a first round of unencrypted hash operation and a second round of collision-resistant encrypted hash operation; querying the feature fingerprint in a preset data cache; if the feature fingerprint is not found in the preset data cache, inputting the feature fingerprint into a Bloom filter for batch matching, wherein the preset data cache stores the feature fingerprints of sensitive fields whose call frequency exceeds a preset frequency threshold; the Bloom filter is used to determine whether the feature fingerprint exists in the preset set of sensitive field feature fingerprints based on a probability model; if the Bloom filter returns a successful matching result, outputting the sensitivity level, lineage dependency strength, and business scenario weight of the scenario identifier corresponding to the sensitive field.

[0014] Optionally, the data desensitization method further includes: storing the feature fingerprints of sensitive fields whose number of matches exceeds a preset threshold within a preset time period into a preset data cache; generating an unidentified alarm signal when the Bloom filter returns a no-match result; and triggering a feature fingerprint update process based on the unidentified alarm signal.

[0015] Optionally, the correspondence between the numerical range of desensitization intensity and the desensitization strategy is a preset mapping relationship. The desensitization strategy is determined based on the desensitization intensity, including: when the desensitization intensity is greater than or equal to a first threshold, the first strategy is determined as the desensitization strategy, wherein the first strategy is used to perform irreversible encryption transformation on the original data for desensitization processing; when the desensitization intensity is greater than or equal to a second threshold and less than the first threshold, the second strategy is determined as the desensitization strategy, wherein the second threshold is less than the first threshold; the second strategy is used to replace the remaining information in the original data (excluding some key information) with obfuscated characters while retaining some key information in the original data; when the desensitization intensity is greater than or equal to a third threshold and less than the second threshold, the third strategy is determined as the desensitization strategy, wherein the third threshold is less than the second threshold; the third strategy is used to replace the middle part of the field information with placeholders while retaining the fixed beginning and end positions of the field; when the desensitization intensity is less than the third threshold, the fourth strategy is determined as the desensitization strategy, wherein the fourth strategy is used to partially obfuscate the field or keep the field as is.

[0016] Optionally, after performing de-identification processing on the target business data according to the de-identification strategy and outputting the de-identified target business data, the data de-identification method further includes: performing security verification and availability verification on the de-identified target business data to obtain security scores and availability scores, wherein security verification includes information entropy detection and differential attack simulation, and availability verification includes business continuity monitoring; based on the security scores and availability scores, a near-end strategy optimization reinforcement learning algorithm is adopted to dynamically adjust the first coefficient, the second coefficient, and the third coefficient to optimize the de-identification strategy.

[0017] According to another aspect of the embodiments of this application, a data desensitization apparatus is also provided, comprising: a first processing unit, configured to construct a lineage dependency graph based on a data processing link, wherein the lineage dependency graph is used to record the dependency relationship and transformation path between original sensitive data and derived data in the data processing link; a second processing unit, configured to determine the lineage dependency strength of derived data on original sensitive data according to the lineage dependency graph, wherein the lineage dependency strength characterizes the probability of obtaining the original sensitive data after the derived data is leaked; a third processing unit, configured to determine the desensitization strength of the target business data according to the sensitive fields in the target business data, the scenario identifier and sensitivity level of the target business data, and the lineage dependency strength, and then determine a desensitization strategy according to the desensitization strength, wherein the desensitization strength is used to select the corresponding desensitization strategy from a preset mapping relationship; and a fourth processing unit, configured to perform desensitization processing on the target business data according to the desensitization strategy and output the desensitized target business data.

[0018] According to another aspect of the embodiments of this application, a computer-readable storage medium is also provided, which stores a computer program, wherein when the computer program is executed, the device where the computer-readable storage medium is located performs the above-described data desensitization method.

[0019] According to another aspect of the embodiments of this application, an electronic device is also provided, including one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors perform the data desensitization method described above.

[0020] According to another aspect of the embodiments of this application, a computer program product is also provided, including a computer program or instructions, which implement the above-described data desensitization method when executed by a processor.

[0021] In this application, the data processing system can first construct a lineage dependency graph based on the data processing chain, whereby the lineage dependency graph is used to record the dependency relationship and transformation path between the original sensitive data and the derived data in the data processing chain; then, the lineage dependency strength of the derived data on the original sensitive data is determined according to the lineage dependency graph, whereby the lineage dependency strength characterizes the probability of obtaining the original sensitive data after the derived data is leaked; furthermore, the de-identification strength of the target business data is determined according to the sensitive fields in the target business data, the scenario identifier and sensitivity level of the target business data, and the lineage dependency strength, and then a de-identification strategy is determined according to the de-identification strength, whereby the de-identification strength is used to select the corresponding de-identification strategy from the preset mapping relationship; finally, the de-identification processing of the target business data is performed according to the de-identification strategy, and the de-identified target business data is output.

[0022] As described above, the data processing system constructs a lineage dependency graph based on the data processing chain. This graph records and maps the dependencies and transformation paths between original sensitive data and derived data within the data processing chain. This helps to understand the source of derived data at the system level and provides a structured information foundation for tracking and identifying derived data. Determining the lineage dependency strength of derived data on original sensitive data based on the lineage dependency graph provides a quantitative assessment dimension for the necessity of desensitizing derived data. Determining the lineage dependency strength allows the desensitization decision-making process to consider not only the sensitivity level of the data itself but also the closeness of the association between the derived data and the original sensitive data, i.e., the probability of retrieving the original sensitive data after leakage.

[0023] When determining the anonymization strength of target business data, multiple dimensions can be comprehensively considered, including sensitive fields, scenario identifiers and sensitivity levels, and lineage dependence. This allows the selection of anonymization strategies to be more tailored to the specific attributes of the data and its business environment. Finally, by applying the anonymization strategy mapped from the anonymization strength to the target business data, different degrees of anonymization can be applied to derived data with varying lineage dependence, ensuring that the anonymization is related to the original sensitive data. This helps to cover the differentiated identification and adaptive processing of derived sensitive data in the data processing flow, thereby reducing the risk of missed anonymization of derived data. This solves the technical problem in existing anonymization technologies where the inability to effectively track and identify derived sensitive data leads to a high risk of missed anonymization. Attached Figure Description

[0024] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0025] Figure 1This is a schematic diagram of an optional data desensitization method according to an embodiment of this application;

[0026] Figure 2 This is a schematic diagram of an optional data desensitization device according to an embodiment of this application. Detailed Implementation

[0027] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0028] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0029] It should also be noted that the information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, and displayed data) collected in this application are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with the relevant laws, regulations, and standards of the relevant regions, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding operation entry points are provided for users to choose to authorize or refuse. For example, this system has interfaces with relevant users or organizations. Before obtaining relevant information, a request to obtain the information needs to be sent to the aforementioned user or organization through the interface, and the relevant information is obtained only after receiving consent from the aforementioned user or organization.

[0030] According to an embodiment of this application, an embodiment of a data desensitization method is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0031] It should be noted that the information collected in this application (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of this data all comply with relevant laws, regulations, and standards, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding access points are provided for users to choose to authorize or refuse. For example, interfaces are set up between this system and relevant users or organizations, providing users with corresponding access points to choose to agree to or refuse automated decision-making results; if the user chooses to refuse, the process proceeds to the expert decision-making stage.

[0032] According to the embodiments of this application, a data processing system (hereinafter referred to as the system) can be used as the execution subject of the data desensitization method of this application embodiment. The system can be a software system or an embedded system combining software and hardware. Of course, the method execution subject in the embodiments of this application can also be other forms of execution subject, such as devices, equipment, etc. It should be known by those skilled in the art that this application does not particularly limit the specific form of the method execution subject.

[0033] According to an embodiment of this application, a method embodiment for data desensitization is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0034] Figure 1 This is a schematic diagram of a data desensitization method according to an embodiment of this application. For example... Figure 1 As shown, the method includes the following steps:

[0035] Step S101: Construct a lineage dependency graph based on the data processing link. The lineage dependency graph is used to record the dependency relationship and transformation path between the original sensitive data and the derived data in the data processing link.

[0036] Optionally, a data processing chain can refer to the complete flow path of data from generation, processing, transformation to storage or output during the operation of a data processing system. A lineage dependency graph can refer to a graph structure used to visualize the dependencies and transformation history between data. In data anonymization scenarios, a lineage dependency graph can be used to record the dependencies and transformation paths between original sensitive data and derived data in the data processing chain. Original sensitive data can refer to key personal or business information that needs to be protected and is directly contained in the source business data, such as ID card numbers and bank card numbers in a financial scenario. Derived data can refer to new data fields generated from original sensitive data through one or more processing functions such as concatenation, hashing, and formatting, such as a customer identifier generated from an ID card number using an algorithm.

[0037] By constructing a lineage dependency graph based on the data processing chain, structured and traceable data relationship information can be provided, helping the system understand how derived data evolved from the original sensitive data. By establishing clear dependency records, when identifying sensitive fields, attention can be paid not only to the static attributes of the data itself but also to the source of the data in the dynamic processing flow, facilitating more accurate de-identification decisions.

[0038] Step S102: Determine the bloodline dependence strength of the derived data on the original sensitive data based on the bloodline dependence map, wherein the bloodline dependence strength characterizes the probability of obtaining the original sensitive data after the derived data is leaked.

[0039] Optionally, lineage dependence strength can refer to an important indicator that quantifies the degree of dependence of derived data on the original sensitive data. The value range can be [0.0, 1.0], where 0.0 indicates that the derived data has no dependency on the original sensitive data, making it almost impossible to deduce the original data after leakage, and 1.0 indicates that the derived data is completely dependent on the original sensitive data, with a high risk of decryption after leakage. In the scenario of desensitizing financial sensitive data, the desensitization strength of the derived data can be dynamically adjusted according to the lineage dependence strength. The higher the lineage dependence strength, the greater the risk of decrypting the original sensitive data after the derived data is leaked, and the more stringent the desensitization strategy needs to be.

[0040] Compared to relying solely on preset static sensitivity levels, introducing lineage dependency strength allows the formulation of desensitization strategies to reflect the inherent relationships between data. Fields directly derived from highly sensitive data can be assigned a higher lineage dependency strength, triggering stricter desensitization strategies. Conversely, derived fields that have undergone multiple complex transformations and experienced significant information loss can be assigned a lower lineage dependency strength, allowing for more lenient desensitization methods. This facilitates fine-tuning of desensitization strength, controlling risks while reducing one-size-fits-all desensitization operations that excessively impact usability.

[0041] Step S103: Determine the desensitization strength of the target business data based on the sensitive fields in the target business data, the scenario identifier and sensitivity level of the target business data, and the lineage dependence strength. Then, determine the desensitization strategy based on the desensitization strength. The desensitization strength is used to select the corresponding desensitization strategy from the preset mapping relationship.

[0042] Optionally, target business data can refer to the data carried by the business request that needs to be de-identified. Sensitive fields can refer to data items in the target business data that are identified as needing protection. Scenario identifiers are used to distinguish different business scenarios, such as payment transactions, account inquiries, and clearing reconciliation. Sensitivity levels can be predefined classifications of data sensitivity, such as level 1 (low sensitivity) to level 5 (high sensitivity). De-identification strength is a value calculated based on the sensitive fields in the target business data, the scenario identifier and sensitivity level of the target business data, and the strength of lineage dependence, used to map to specific de-identification strategies. Preset mapping relationships are used to define the correspondence between different de-identification strength value ranges and specific de-identification strategies.

[0043] By combining the static attributes of the data itself (sensitivity level), the business environment (scenario identifier), and the dynamic relationships between data (lineage dependency strength), a comprehensive desensitization strength is calculated. This makes the selection of desensitization strategies no longer isolated and fixed, but dynamically adjustable according to changes in data and scenarios. For example, even fields with the same sensitivity level can be assigned different desensitization strengths in high-risk business scenarios and low-risk query scenarios, based on the different lineage dependency strengths of the fields. This triggers differentiated desensitization processing, helping to improve the adaptability and accuracy of desensitization strategies.

[0044] Step S104: Perform desensitization processing on the target business data according to the desensitization strategy, and output the desensitized target business data.

[0045] Optionally, by implementing a desensitization strategy that matches the desensitization intensity, sensitive information can be adapted and transformed before the data flows out or is used. This helps to meet the principle of minimizing data usage, reduce the risk of data leakage, and take into account both business continuity and data availability.

[0046] In one optional embodiment, constructing a lineage dependency graph based on a data processing link includes: the data processing system generating lineage dependency records based on the data processing link, wherein the lineage dependency records include the processing steps of data collected by multiple data acquisition units and the structured mapping relationship between data input and output fields; constructing a directed acyclic graph based on the lineage dependency records, wherein nodes in the directed acyclic graph represent data fields and edges in the directed acyclic graph represent data processing functions; and constructing a lineage dependency graph based on the directed acyclic graph.

[0047] Optionally, a lineage dependency record can refer to a structured data record used to store information about the data processing process extracted from the data processing chain. The data content of the lineage dependency record may include identifiers of processing steps, identifiers of input data fields, identifiers of output data fields, and structured mapping relationships between data input and output fields.

[0048] Optionally, structured mapping relationships are used to describe the organization of logical connections between data inputs and outputs in kinship dependency records. Structured mapping relationships can be one-to-one, one-to-many, or many-to-one. For example, a concatenation function that takes two input fields, "surname" and "last four digits of ID number," and outputs a "full name of customer" field can constitute a many-to-one mapping relationship. Structured mapping relationships help clarify the precise logic of record data transformation.

[0049] Optionally, a Directed Acyclic Graph (DAG) can refer to a data structure consisting of vertices and directed edges that does not contain cycles. In financial applications, nodes in a DAG represent data fields, such as "ID number" or "customer identifier," while edges represent data processing functions, such as "MD5 hash." The direction of the edges indicates the flow of data from input fields to output fields. DAGs help to clearly depict the derivation relationships and dependency paths between data.

[0050] Optionally, for a directed acyclic graph (DAG), "directed" means that the edges in the DAG have a direction; for example, it is possible to point from A to B, but this does not mean that B also points to A. "Acyclic" means that there is no path in the DAG that starts from a node and returns to the starting node along the edges, i.e., there are no cycles, and it can be used to represent the dependencies between elements.

[0051] Optionally, lineage analysis can be used to trace the dependencies between original sensitive data and derived data, and a lineage dependency graph can be constructed. The lineage dependency graph represents the dependency and transformation path between data fields and processing functions as a directed acyclic graph, which is conducive to achieving full-link identification and coverage of derived data.

[0052] By introducing kinship dependency records and directed acyclic graphs (DAGs), the kinship dependency graph construction process can be decomposed into three hierarchical stages: data acquisition and structuring, relationship modeling, and graph generation. This hierarchical processing helps unify heterogeneous data processing chain information from multiple sources, such as function calls, network requests, and database operations, into formatted kinship dependency records, providing standardized input for subsequent analysis. Furthermore, by using the DAG as a graph theory model to abstract the dependencies and transformation relationships between data, complex data flow chains can be transformed into computational models that are easy to perform path analysis and dependency strength calculations. Ultimately, the kinship dependency graph constructed based on DAGs not only visually displays data relationships but also supports efficient graph traversal and query operations.

[0053] In one optional embodiment, the data processing link corresponds to multiple data acquisition units, which include a virtual machine monitoring interface probe, a gateway interceptor, and a database auditing plugin. The virtual machine monitoring interface probe is used to collect sensitive data in the application's memory, the gateway interceptor is used to collect parameters in Hypertext Transfer Protocol requests, and the database auditing plugin is used to collect structured query operation logs.

[0054] Optionally, JVMTI (Java Virtual Machine Tool Interface) is a set of interfaces provided by the Java Virtual Machine, allowing developers to write tools to monitor, debug, and analyze the runtime status of Java programs. JVMTI probes are a mechanism within JVMTI that allows users to insert observation points during Java program execution. When the program reaches these observation points, user-defined callback functions are triggered, allowing users to collect data, analyze behavior, and debug problems. A virtual machine monitoring interface probe can refer to a software component implemented based on the Java Virtual Machine Tool Interface or other similar runtime monitoring interfaces. This virtual machine monitoring interface probe, by injecting into the target application process, can monitor specific events during application execution in memory, such as method entry / exit, field access, and object allocation. The functionality of virtual machine monitoring interface probes focuses on collecting sensitive data processing and transformation events occurring in application memory.

[0055] Optionally, a gateway interceptor can refer to a software module deployed on a network gateway. A gateway interceptor can intercept network request and response data packets flowing through the gateway and can collect parameter information from business requests encapsulated in Hypertext Transfer Protocol or other application layer protocols.

[0056] Optionally, a database auditing plugin can refer to a software component that is integrated with or runs as an agent outside a database management system. Database auditing plugins collect data operation behavior by monitoring structured query language commands received by the database or the database's transaction logs. This helps record the flow and changes of data at the persistent storage level. For example, it can collect source table fields, target table fields, and possible data transformation functions involved in statements, thereby forming a record of dependencies during the data storage stage.

[0057] By enabling data flow within application memory, data exchange at network boundaries, and operations during persistent data storage, multi-dimensional, end-to-end data collection can be performed, which helps reduce incomplete dependency records caused by a single data collection source.

[0058] In one optional embodiment, determining the kinship dependency strength of derived data on original sensitive data based on the kinship dependency graph includes: the data processing system can determine the basic dependency strength of each derived field in the directed acyclic graph based on the number and type of original sensitive fields that the derived field depends on; and perform attenuation calculation on the basic dependency strength of the derived field based on a preset attenuation coefficient and the number of data processing layers to obtain the kinship dependency strength of the derived field, wherein, for a derived field generated by a single layer of processing, both the number of data processing layers and the preset attenuation coefficient are 1.

[0059] Optionally, the base dependency strength can refer to an initial value used to quantify the degree of association between a derived field and its direct dependency on the original sensitive field. Base dependency strength reflects the proportion of direct dependency of derived data on source data in a single data processing operation. For example, a derived field generated entirely from a single sensitive field using a hash function can have a base dependency strength of 1.0, indicating full dependency.

[0060] Optionally, the preset attenuation coefficient can be a constant factor ranging from 0 to 1, used to simulate the loss of information or weakening of correlation in each layer of processing when calculating multi-layer dependencies. The specific value of the preset attenuation coefficient can be set according to business scenarios or experience, such as 0.7, 0.8, or 0.9. A smaller preset attenuation coefficient means that the strength of indirect dependencies decays faster. For derived fields generated by single-layer processing, both the number of data processing layers and the preset attenuation coefficient are 1. This means that if the number of data processing layers is 1, the basic dependency strength of the derived field is determined according to the number and type of the original sensitive fields that the derived field depends on. The basic dependency strength can be directly used as the lineage dependency strength of the derived field generated by single-layer processing.

[0061] In one optional embodiment, the basic dependency strength of a derived field is determined based on the number and type of original sensitive fields that the derived field depends on, including: determining the basic dependency strength as 1 when the derived field depends on a single original sensitive field; determining the basic dependency strength as 0 when the derived field does not depend on any original sensitive fields; and assigning a first weight to the original sensitive fields among the multiple fields and a second weight to the non-sensitive fields among the multiple fields when the derived field depends on multiple fields, and then determining the basic dependency strength based on the ratio of the sum of the weights of all fields among the multiple fields to the sum of the weights of the original sensitive fields.

[0062] Optionally, a single original sensitive field can refer to a derived field node in a directed acyclic graph that is connected to one and only one field node marked as "original sensitive" through only one direct dependency path. This can indicate that the derived data is directly transformed from a single source of sensitive data, such as through a hash function or encryption function.

[0063] Optionally, not relying on any original sensitive fields can mean that none of the upstream dependency paths of the derived field node contain any field nodes marked as "originally sensitive", that is, the generation of the derived data does not involve any source sensitive information at all.

[0064] By categorizing the dependency scenarios of derived fields into three types: dependent on a single original sensitive field, not dependent on any original sensitive field, and dependent on multiple fields (including sensitive and non-sensitive fields), and specifying corresponding strength assignments or calculation methods for each type, the calculation process of basic dependency strength becomes clear, definite, and easy to implement. This categorization approach allows for a finer distinction between data dependencies of different natures, providing more accurate initial values ​​for subsequent calculations. This improves the operability and consistency of the kinship dependency strength calculation model, ensuring that data with different dependency patterns receive reasonable and consistent initial strength assessments, and avoiding biases caused by subjective judgment.

[0065] In one optional embodiment, the attenuation calculation of the basic dependency strength of the derived field is performed based on a preset attenuation coefficient and the number of data processing layers to obtain the lineage dependency strength of the derived field. This includes: the data processing system can obtain the number of data processing layers that the derived field passes through in the directed acyclic graph; the preset attenuation coefficient is exponentially operated to obtain an attenuation factor, wherein the exponent of the exponent operation is the number of data processing layers; and the basic dependency strength is multiplied by the attenuation factor to obtain the lineage dependency strength.

[0066] Optionally, the number of data processing layers can be used to quantify and describe the transformation "depth" or "distance" experienced by a data field in a directed acyclic graph (DAG). In a DAG, the number of edges traversed from a derived field node back along its dependency edges to the original sensitive field node it depends on can be defined as the number of data processing layers from the derived field to the original sensitive field. When a derived field depends on multiple original sensitive fields, the number of data processing layers can take a maximum, minimum, or average value; for example, the number of layers of the longest path can be used to assess the risk distance in the worst-case scenario.

[0067] By introducing the number of data processing layers as the exponent in the exponential operation and using a preset attenuation coefficient as the base, it is beneficial to construct an exponential decay model to calculate the attenuation factor and ultimately adjust the basic dependency strength through multiplication. This exponential decay model can simulate the nonlinear loss of information in multiple data processing processes. With each additional processing layer, the dependency strength does not decrease nonlinearly, but rather weakens exponentially in proportion to the preset attenuation coefficient, better reflecting the actual situation where original sensitive information is gradually diluted, transformed, or masked in complex data processing chains. Thus, a quantitative tool with high computational efficiency, clear logic, and the ability to effectively characterize the attenuation law of indirect dependency risk can be provided. The lineage dependency strength calculated by this exponential decay model can more finely distinguish between direct dependencies and multi-level indirect dependencies, ensuring that the lineage dependency strength of data that depends on remote, multi-transformed derivative data is lower than that of directly dependent data.

[0068] For example, the data collection and kinship dependency mapping process may include:

[0069] First, input the raw business data, such as transaction requests and database operation logs.

[0070] Then, multi-source data acquisition is performed, which can collect raw business data through multiple data acquisition units, including:

[0071] Virtual machine monitoring interface probes are used to collect the flow of sensitive data in the memory of JVM applications, such as tracing the process of generating customer identifiers after ID card numbers are processed by concatenation functions;

[0072] Gateway interceptors are used to collect parameters from Hypertext Transfer Protocol (HTTP) requests, such as transaction amounts in payment scenarios.

[0073] The database auditing plugin is used to collect and record Structured Query Language (SQL) operation logs, such as "INSERT INTO audit_log (user_id, amount) VALUES (...)".

[0074] Next, a lineage dependency graph can be constructed. The construction process may include: First, based on data collected by multiple data acquisition units, a lineage dependency record reflecting the structured mapping relationship between data processing steps and data input / output fields is generated. Based on this lineage dependency record, a directed acyclic graph (DAG) is constructed with data fields as nodes and data processing functions as edges. This can be achieved by tracing the input / output relationship of data processing functions using JVMTI. Then, the sensitivity level of derived fields is calculated, such as "customer_id=md5 (ID card number)". The sensitivity level of customer_id inherits the 5 levels of the ID card number. Derived fields can also be called derived data. Finally, based on the input / output relationship of data processing functions in the data flow, and combined with the characteristics of financial business, the dependency ratio is quantified. This may specifically include basic dependency strength calculation and multi-level decay calculation, thereby calculating the lineage dependency strength.

[0075] In constructing a lineage dependency graph, the degree of dependence of derived data on the original sensitive data can be determined, i.e., the lineage dependency strength can be calculated. The calculation of lineage dependency strength includes: basic dependency strength calculation and multi-level attenuation calculation. Basic dependency strength calculation (single-level processing, direct dependency) refers to scenarios where derived data is generated through only one processing function and directly depends on the original sensitive data. It is calculated based on the number and type of the original sensitive fields that the derived data depends on. The formula for basic dependency strength calculation is: Basic dependency strength = Input weight of the original sensitive field / Total weight of all input fields. Multi-level attenuation calculation refers to scenarios where derived data indirectly depends on the original sensitive data through multiple processing layers (A, B, C). It calculates the attenuation of the basic dependency strength based on the number of data processing layers and a preset attenuation coefficient to obtain the final lineage dependency strength. With each layer of data processing, the dependency strength dynamically attenuates due to information loss, avoiding the risk of excessively amplifying indirect dependencies. The calculation formula for multi-level attenuation can be: final dependency strength = previous level dependency strength × 0.8 processing times, where the attenuation coefficient of 0.8 is the optimized value for financial scenarios, which can be adjusted to 0.7 to 0.9 according to compliance requirements. The lower the coefficient, the faster the indirect dependency attenuates.

[0076] Optionally, after constructing the lineage dependency graph, the basic dependency strength needs to be calculated based on the fields that the derived data depends on, in order to determine the lineage dependency strength of the derived data on the original sensitive data. This lineage dependency strength calculation is based on the number and type of the original sensitive fields that the derived data depends on, and is divided into the following three scenarios:

[0077] The first scenario is full dependency: when derived data is generated from only one original sensitive field, its base dependency strength is 1.0. For example, the derived data "Digital RMB Real-Name Wallet ID" can be generated by performing a secure hash algorithm (SecureHashAlgorithm3, SM3) on a single original sensitive field "ID Card Number," and the base dependency strength of the derived data "Digital RMB Real-Name Wallet ID" is 1.0. Similarly, the derived data "Customer Identifier" can be generated by performing a message-digest algorithm (Message-DigestAlgorithm5, MD5) on "Bank Card Number," and the base dependency strength of the derived data "Customer Identifier" is still 1.0.

[0078] The second scenario involves partial dependency: when derived data is generated from multiple fields, including both original sensitive and non-sensitive fields, different weights need to be assigned to different types of fields for calculation. The specific rule is: assign a first weight, such as 1.0, to the original sensitive fields, and a second weight, such as 0.5, to the non-sensitive fields. The basic dependency strength is equal to the ratio of the sum of the weights of all original sensitive fields to the sum of the weights of all fields (including both sensitive and non-sensitive fields). For example, the derived data "Transaction Details" can be generated by concatenating "Wallet ID" (sensitive, weight 1.0), "Transaction Time" (non-sensitive, weight 0.5), and "Transaction Amount" (sensitive, weight 1.0). The basic dependency strength of the derived data "Transaction Details" is the ratio of the sum of the sensitive field weights (1.0 + 1.0 = 2.0) to the total weight (1.0 + 0.5 + 1.0 = 2.5), which is 0.8. For example, the derived data "full name of customer" can be generated by concatenating "surname" (non-sensitive, weight 0.5) and "last 4 digits of ID number" (sensitive, weight 1.0). The basic dependency strength of the derived data "full name of customer" is 1.0 / (0.5+1.0)≈0.67.

[0079] The third scenario is no dependency: when the derived data does not depend on any original sensitive fields, its base dependency strength is 0.0. For example, the derived data "system status code" can be generated from non-sensitive fields such as "response code" and "timestamp", without involving the original sensitive fields. The base dependency strength of the derived data "system status code" is 0.0, and no desensitization processing is required.

[0080] Optionally, for multi-layer attenuation calculations, taking the original sensitive data "bank card number" (sensitivity level 5, initial lineage dependency strength 1.0) in financial transactions as an example, the chain of generating "audit logs" from the original sensitive data "bank card number" through three layers of processing is as follows:

[0081] Process 1: The bank card number is processed using the Message-Digest Algorithm 5 (MD5) to generate the derived data "Customer Identifier". Since this derived data "Customer Identifier" is directly generated from a single original sensitive field, its basic dependency strength is 1.0. Based on a data processing layer of 1 and a preset attenuation coefficient (e.g., 0.8), the lineage dependency strength of the "Customer Identifier" is calculated to be: 1.0 × 0.8¹ = 0.8.

[0082] Process 2: Concatenate the "Customer Identifier" and the "Order Number" to generate a new derived data "Transaction Association ID". At this point, the dependency of "Transaction Association ID" on the original "Bank Card Number" is indirect, and the lineage dependency strength of the previous process 1 (i.e., "Customer Identifier") is 0.8. Based on the lineage dependency strength of "Customer Identifier", a second attenuation calculation is performed according to the data processing layer number of 2 and the same attenuation coefficient, resulting in the lineage dependency strength of "Transaction Association ID" as: 0.8 × 0.8² = 0.512.

[0083] Process 3: Combine the "Transaction Association ID" with the "Operator" information to generate the final derived data, the "Audit Log." At this point, the processing layer has accumulated to 3. Based on the strength of the previous level's "Transaction Association ID" (0.512), a third attenuation calculation is performed, resulting in the final lineage dependency strength of the "Audit Log" being approximately: 0.512 × 0.8³ ≈ 0.262. The de-identification strategy can be downgraded from "encryption" to "basic mask," balancing security and business availability.

[0084] Optionally, after completing the kinship analysis and kinship dependency strength calculation, the system can output a structured kinship map and a sensitive field feature library. The structured kinship map can record the dependencies and transformation paths between data fields in a structured data format such as JSON. The sensitive field feature library can record feature information for each field, including kinship dependency strength and sensitivity level.

[0085] In one optional embodiment, the desensitization strength of the target business data is determined based on the sensitive fields in the target business data, the scenario identifier and sensitivity level of the target business data, and the lineage dependency strength. This includes: extracting sensitive field features based on the lineage dependency graph; using a Bloom filter and a preset data cache to collaboratively identify sensitive fields in the target business data; obtaining the business scenario weight, sensitivity level, and lineage dependency strength corresponding to the scenario identifier of the sensitive field; multiplying the sensitivity level by a first coefficient to obtain a first product; multiplying the lineage dependency strength by a second coefficient to obtain a second product; multiplying the business scenario weight corresponding to the scenario identifier by a third coefficient to obtain a third product, wherein the sum of the first, second, and third coefficients is 1; and adding the first, second, and third products to obtain the desensitization strength.

[0086] Optionally, a Bloom filter can refer to a space-efficient and fast data structure used to determine whether an element might exist in a set or definitely does not exist in the set. A Bloom filter maps elements to a bit array using multiple hash functions, and during a query, checks if all corresponding bits are 1. The business scenario weight can refer to a predefined value used to quantify the relative sensitivity or importance of different business scenarios to the risk of data leakage.

[0087] Optionally, the first, second, and third coefficients can refer to three constants between 0 and 1, and their sum is 1. The first, second, and third coefficients serve as weighting factors, used to adjust the contribution ratio of the three input items—sensitivity level, lineage dependence strength, and business scenario weight—to the final anonymization strength result in the weighted summation calculation. The specific values ​​of the three coefficients can reflect the system's emphasis on different risk dimensions.

[0088] Optionally, sensitive field features are extracted based on the kinship dependency graph, and a Bloom filter is used in conjunction with a preset data cache for sensitive field identification. High-frequency fields can be matched first through the cache, while low-frequency and newly added fields are matched in batches through the Bloom filter. Combined with the SIMD instruction set for acceleration, a high-throughput identification capability of less than or equal to 1ms per match is achieved.

[0089] This approach leverages a Bloom filter in conjunction with a pre-defined data cache to efficiently and accurately identify sensitive fields, acquiring three attributes for each sensitive field: business scenario weight, sensitivity level, and lineage dependence strength. A weighted summation linear model then merges these three attributes—with their different dimensions and meanings—into a single desensitization strength value. The first, second, and third coefficients control the relative importance of sensitivity level, lineage dependence strength, and business scenario weight in the final decision. This transforms potentially isolated or experience-based decision factors into a quantifiable, adjustable, and interpretable computational model. The weighted summation model allows for flexible adjustment of the weights of different risk factors, such as data sensitivity, data correlation, and business environment risk, in the decision-making process. This makes the generation of desensitization strategies transparent, configurable, and adaptable to different scenario requirements, rather than a black box or fixed process, thus improving the rationality and consistency of desensitization decisions.

[0090] In one optional embodiment, obtaining the business scenario weight, sensitivity level, and lineage dependency strength corresponding to the scenario identifier of a sensitive field includes: the data processing system can obtain the business attributes, format features, and verification features of the sensitive field, as well as the scenario identifier, and generate a combined feature vector; perform a double hash operation on the combined feature vector to generate a fixed-length feature fingerprint, wherein the double hash operation includes a cascaded processing of a first round of unencrypted hash operation and a second round of anti-collision encrypted hash operation; query the feature fingerprint in a preset data cache; if the feature fingerprint is not found in the preset data cache, input the feature fingerprint into a Bloom filter for batch matching, wherein the preset data cache stores the feature fingerprints of sensitive fields whose call frequency exceeds a preset frequency threshold; the Bloom filter is used to determine whether the feature fingerprint exists in the preset sensitive field feature fingerprint set based on a probability model; if the Bloom filter returns a successful matching result, output the sensitivity level, lineage dependency strength, and business scenario weight of the scenario identifier corresponding to the sensitive field.

[0091] Optionally, by combining sensitivity level, lineage dependence strength and business scenario weight, the desensitization strength can be calculated through a three-dimensional decision model, and the corresponding desensitization strategy can be selected from the preset mapping relationship based on the desensitization strength, which is conducive to realizing scenario-based dynamic desensitization based on business scenario and data dependency relationship.

[0092] By combining the business attributes, format features, validation features, and scenario identifiers of sensitive fields to generate combined feature vectors, the feature fingerprints can have stronger scenario-discrimination capabilities and field specificity, reducing false matches. Through dual hash operations, such as the cascading of unencrypted hashing and collision-resistant encrypted hashing, the generation speed can be guaranteed while significantly enhancing the fingerprint's collision resistance and uniqueness, reducing the probability of different fields generating the same fingerprint. A two-level query architecture using a pre-set data cache and a Bloom filter can optimize the matching paths for frequently accessed fields, and leverage the memory and speed advantages of Bloom filters to handle matching of all or low-frequency fields. This improves the accuracy, uniqueness, query efficiency, and memory overhead of sensitive field attribute acquisition, making the data input source for subsequent de-identification strength calculations more reliable and faster.

[0093] In an optional embodiment, the data desensitization method further includes: the data processing system storing the feature fingerprints of sensitive fields whose number of matches exceeds a preset threshold within a preset time period into a preset data cache; generating an unidentified alarm signal when the Bloom filter returns a no-match result; and triggering a feature fingerprint update process based on the unidentified alarm signal.

[0094] Optionally, the preset time period can refer to the length of a time window used to count the frequency of field matches. The preset threshold can refer to a numerical threshold used to determine whether a field is considered high-frequency. Only fields whose number of matches within the preset time period exceeds the preset threshold will have their related data stored in the preset data cache. The preset threshold can be set according to cache capacity and performance goals.

[0095] Optionally, an unidentified alarm signal can refer to a signal or event emitted internally or externally by the system, indicating that a characteristic fingerprint was encountered during the sensitive field identification process. This characteristic fingerprint is neither in the preset data cache nor passed the Bloom filter matching check. The unidentified alarm signal can carry relevant information, such as the original field data, feature vector, scene identifier, etc.

[0096] Optionally, the feature fingerprint update process can refer to a predefined set of procedures triggered in response to unidentified alarm signals. The goal of the feature fingerprint update process is to add the feature information of newly discovered sensitive fields to the system's identification base library. Specifically, this may include updating the bit array of the Bloom filter, persistently storing the feature fingerprint and attributes, and adding the feature information of the newly discovered sensitive fields to the candidate list for the next cache fill. The feature information of the newly discovered sensitive fields may include feature fingerprints, business attributes, format features, sensitivity levels, and lineage dependency strength.

[0097] For example, the process of identifying sensitive fields based on Bloom filters and preset data caches may include:

[0098] First, input real-time business data streams that have been collected and labeled using a lineage dependency graph construction.

[0099] Then, scenario-based feature fingerprint generation is performed. To efficiently and accurately identify sensitive fields, the system first generates a unique feature fingerprint for each sensitive field to be identified. This feature fingerprint generation process follows a multi-dimensional coding principle that combines financial compliance and field uniqueness, involving feature extraction, feature combination construction, and double hashing. Feature extraction can refer to extracting the business attributes (such as the type of business scenario), format features (such as the length of the bank card number and the issuing bank's identifier, or the level identifier of the digital RMB wallet), and verification features (such as the check digit of the bank card number), and generating a basic feature vector based on these extracted features. Feature combination construction can refer to concatenating this basic feature vector with the scenario identifier of the field to form a combined feature that can represent the business scenario and field characteristics, for example, "PAY_001_amount". Double hashing can include the cascading processing of a first round of unencrypted hashing and a second round of collision-resistant encrypted hashing, ultimately generating a fixed-length feature fingerprint. For example, double hashing can refer to the system using the Murmur hash algorithm (such as MurmurHash3) and the secure hash algorithm (SHA-256) to perform double hashing, which helps to ensure the uniqueness and collision resistance of certificate fingerprint features and meet the fast computing needs in high-concurrency financial scenarios.

[0100] Then, based on the dual-channel matching of the preset data cache and the Bloom filter, the system adopts a collaborative mechanism between the preset data cache and the Bloom filter, which is conducive to achieving high throughput and low latency in sensitive field identification. The preset data cache can be used to store the feature fingerprints of sensitive fields whose call frequency exceeds a preset frequency threshold. The capacity of the preset data cache can be set according to the distribution of high-frequency fields in financial transactions, and a "least recently used" strategy is used to eliminate low-frequency entries. For example, high-frequency fields (such as transaction amounts in payment scenarios) that have been matched ≥1000 times within 5 consecutive minutes are cached in memory, which helps ensure a cache hit rate ≥95%. High-frequency fields in the cache can be processed first, reducing the time for a single match to ≤1 microsecond. The Bloom filter system component can be used to determine whether the feature fingerprint exists in the preset set of sensitive field feature fingerprints based on a probability model, mainly processing low-frequency fields and newly added uncached fields. In the actual matching process, the system first queries the preset data cache. If the feature fingerprint is not found in the cache, the Bloom filter is triggered for batch matching and verification. This batch verification process can be accelerated using a single instruction stream multi-data stream instruction set, thereby achieving higher throughput and facilitating a balance between efficient identification and full coverage.

[0101] Finally, the system outputs the results of sensitive field identification and alarm signals for unidentified fields. The sensitive field identification results include the identified sensitive fields, their corresponding scene identifiers, and sensitivity levels. For unidentified fields, an unidentified alarm signal is generated, which can be used to trigger the subsequent feature fingerprint database update process.

[0102] In one optional embodiment, the correspondence between the numerical range of the desensitization intensity and the desensitization strategy is a preset mapping relationship. Determining the desensitization strategy based on the desensitization intensity includes: when the desensitization intensity is greater than or equal to a first threshold, determining the first strategy as the desensitization strategy, wherein the first strategy is used to perform irreversible encryption transformation on the original data for desensitization processing; when the desensitization intensity is greater than or equal to a second threshold and less than the first threshold, determining the second strategy as the desensitization strategy, wherein the second threshold is less than the first threshold; the second strategy is used to replace the remaining bit information in the original data (excluding some key bit information) with obfuscated characters while retaining some key bit information in the original data; when the desensitization intensity is greater than or equal to a third threshold and less than the second threshold, determining the third strategy as the desensitization strategy, wherein the third threshold is less than the second threshold; the third strategy is used to replace the middle part of the field information with placeholders while retaining the fixed beginning and end positions of the field; when the desensitization intensity is less than the third threshold, determining the fourth strategy as the desensitization strategy, wherein the fourth strategy is used to partially obfuscate the field or keep the field as is.

[0103] Optionally, the first, second, third, and fourth strategies can represent a security gradient from the strongest to the weakest protection. By mapping the de-identification strength to the de-identification strategy, it is beneficial to achieve differentiated execution of de-identification strength; that is, high de-identification strength triggers strong protection measures, while low de-identification strength corresponds to weaker or no-processing measures. This provides a configurable, tiered de-identification execution framework, making de-identification operations no longer a binary or singular choice of de-identification or not de-identification, but rather allowing for fine-tuning based on subtle differences in risk, such as different de-identification strengths. This helps to preserve the business characteristics and ease of use of data while meeting data security and compliance requirements.

[0104] Optionally, information entropy detection and differential attack simulation can be performed on the de-identified target business data to verify whether the de-identification effect meets the security threshold. Furthermore, the parameters in the three-dimensional decision model can be dynamically adjusted through Proximal Policy Optimization Reinforcement Learning (PPO), which is conducive to achieving self-evolution and closed-loop optimization of the de-identification strategy.

[0105] For example, the system can execute dynamic desensitization strategies based on a three-dimensional decision model, and the execution process may include:

[0106] First, obtain the results of sensitive field identification and the bloodline dependence strength corresponding to the sensitive field from the bloodline dependence graph.

[0107] Next, a three-dimensional decision model is constructed and the desensitization strength is calculated. The system can calculate the desensitization strength based on a three-dimensional decision model, which comprehensively considers three dimensions: sensitivity level, lineage dependence strength, and business scenario weight. Based on these three dimensions, corresponding desensitization strategies are executed. The calculation formula for the three-dimensional decision model is: Desensitization Strength = First Coefficient × Sensitivity Level + Second Coefficient × Lineage Dependence Strength + Third Coefficient × Business Scenario Weight. Wherein, the sum of the first, second, and third coefficients is 1, and all are non-negative numbers.

[0108] Optionally, the sensitivity level ranges from 1 to 5, with higher values ​​indicating greater sensitivity. The lineage dependence strength ranges from 0.0 to 1.0, with 1.0 indicating that derived data is completely dependent on the original sensitive field. Business scenario weights can be assigned weights from 0.0 to 2.0 based on the risk level of different business scenarios; for example, a liquidation scenario weight could be 1.5, while a query scenario weight could be 0.5.

[0109] For example, the desensitization strength calculation example is as follows: In a payment scenario (the business scenario weight can be 1.5), for a bank card number (sensitivity level is 5, bloodline dependence strength is 1.0), if the first coefficient is set to 0.5, the second coefficient to 0.3, and the third coefficient to 0.2, then the desensitization strength of the bank card number is calculated as: 0.5×5+0.3×1.0+0.2×1.5=3.1. A dynamic mask desensitization strategy can be executed, for example, retaining the last 4 digits of the bank card number.

[0110] For example, during the strategy mapping and execution process based on the desensitization intensity range, the calculated desensitization intensity will fall within a preset numerical range. The system determines the final desensitization strategy to be executed based on the preset mapping relationship between this numerical range and the desensitization strategy. The mapping relationship and examples are shown in Table 1:

[0111] Table 1

[0112]

[0113] The desensitization strength calculation can be: Desensitization Strength = 0.5 × Sensitivity Level + 0.3 × Lineage Dependence Strength + 0.2 × Scenario-Specific Weight. Desensitization strategies are triggered when the calculated result falls within the corresponding numerical range. Dynamic adjustments can include: automatically increasing the threshold for core scenarios (such as liquidation) (e.g., triggering the interval 1 strategy for interval 2); the default numerical range for new fields is 3, which can be adjusted after lineage analysis. To meet high-level data security compliance requirements, the system uses a high-strength encryption strategy by default for fields falling within the highest desensitization strength range, and all desensitization strategy executions generate audit logs including a 256-bit hash value using a secure hash algorithm to ensure traceability and support compliant auditing.

[0114] Next, multi-node collaborative data masking can be performed. For example, based on a defined data masking strategy, the system can collaboratively perform data masking operations at multiple levels, such as the gateway layer, application layer, and storage layer, forming a layered protection. The gateway layer can perform fast data masking operations such as lightweight masking, the application layer can perform secondary data masking on derived data using components such as virtual machine monitoring interface probes, and the storage layer can perform encrypted write operations using database triggers.

[0115] Finally, the system can output the de-identified business data and the de-identification policy execution log, which includes the policy version and the effective time.

[0116] In an optional embodiment, after performing de-identification processing on the target business data according to the de-identification strategy and outputting the de-identified target business data, the data de-identification method further includes: performing security verification and availability verification on the de-identified target business data to obtain a security score and an availability score, wherein the security verification includes information entropy detection and differential attack simulation, and the availability verification includes business continuity monitoring; based on the security score and the availability score, a near-end strategy optimization reinforcement learning algorithm is used to dynamically adjust the first coefficient, the second coefficient, and the third coefficient to optimize the de-identification strategy.

[0117] For example, the system can verify and optimize the desensitization effect, and the process may include:

[0118] First, obtain the anonymized target business data, the original data hash library used for correlation and traceability, business monitoring indicators reflecting system load (such as response latency and error rate), and the anonymization strategy execution logs.

[0119] Then, the phased processing includes the following three stages:

[0120] Phase 1: Dual-dimensional verification of security and availability. To ensure that the de-identification process achieves the expected results in terms of both security and business availability, the system can perform dual-dimensional verification:

[0121] Dimension 1: Information Entropy Detection. The core logic of this dimension is to verify whether the "information density" of the anonymized data has been reduced to a safe threshold. The execution steps include: (1) extracting the anonymized data (such as the masked bank card number); (2) using the Shannon entropy formula to calculate the information entropy value of the anonymized data, such as... ,in, Represents information entropy. Indicates the first The probability of a character appearing in the data; (3) Compare the calculated information entropy value with the preset threshold. For example, the entropy value of core financial data is below 3.5 to be considered qualified, and the entropy value of non-core data is below 4.0 to be considered qualified. This information entropy detection step is helpful to directly verify whether the desensitization process effectively reduces the sensitive information content of the data.

[0122] Dimension Two: Differential Attack Simulation. The core logic of this dimension two is to simulate the risk of attackers using correlation analysis and other methods to reverse-engineer the original information. The execution steps include: (1) training financial data features (such as the combination feature of "name + de-identified ID number") using a long short-term memory network model; (2) generating a large number of adversarial samples (such as "Zhang San + 3101"). 1234”); (3) The calculation model successfully reverse-engineers the original information using the desensitized data, and sets the success rate ≤0.1% as the security standard. This differential attack simulation step can verify the ability of the desensitization strategy to resist complex reasoning attacks.

[0123] Phase 2: Business Continuity Monitoring. The core logic of Phase 2 is to ensure that the masking operation does not affect normal business operations. The execution steps include: First, monitoring the masking processing nodes through application performance management tools. Key metrics include single-request masking time (≤5ms is acceptable), business error rate (≤0.1% is acceptable), and P99 response latency (≤50ms is acceptable). Then, if any metric exceeds the limit, the current strategy is flagged as potentially causing "over-masking," impacting business availability.

[0124] Phase 3: Self-evolutionary optimization based on proximal policy optimization reinforcement learning.

[0125] Based on the security and availability scores obtained in the verification phase of Phase 1, the system enters the self-evolution optimization phase. Its core logic is to dynamically adjust the desensitization decision parameters to reduce manual intervention and continuously optimize. The execution steps may include: (1) Defining the state space: Define the current desensitization intensity, business scenario weight, and verification score (combined security score and availability score) output in the verification phase as the state space of reinforcement learning. (2) Designing the reward function: Construct a reward function, for example, Reward = 0.6 × security score + 0.4 × availability score, where the maximum availability score is 10 points, to guide the optimization direction to take into account both security and performance. (3) Training and adjustment: Use the near-end policy optimization reinforcement learning algorithm to train the policy network. Through multiple iterative interactions between the agent and the environment, the policy network learns and automatically adjusts the parameters in the three-dimensional decision model. For example, dynamically adjust the first coefficient corresponding to the sensitivity level from 0.5 to 0.4, which is conducive to the autonomous optimization and continuous evolution of the desensitization strategy.

[0126] This application constructs a lineage dependency graph based on the data processing link, extracts sensitive field features and uses Bloom filters and preset data caches for collaborative identification, calculates the desensitization strength and determines the desensitization strategy based on a three-dimensional decision model of sensitivity level, lineage dependency strength and business scenario weight, verifies the desensitized data and performs self-evolution optimization through near-end strategy optimization reinforcement learning, which is conducive to achieving full lifecycle protection of sensitive data.

[0127] This application embodiment quantifies the strength of lineage dependency as the core parameter for desensitization decisions. By calculating the lineage dependency strength of derived data on the original sensitive data and incorporating this strength into the desensitization strength calculation model, it accurately identifies and covers derived sensitive data generated by data transformation and splicing, thus reducing the chance of missing desensitization of derived data in traditional methods. A combined feature vector is generated by extracting the business attributes, format features, and verification features of sensitive fields, and a feature fingerprint is generated using dual hash operations. A dual-channel matching mechanism is constructed by combining a preset data cache and a Bloom filter. This dual-channel matching mechanism prioritizes matching high-frequency fields through the cache, and when a match is not found, a Bloom filter cluster performs efficient batch matching. This facilitates achieving a single match performance of ≤1ms at higher throughput, adapting to the high-concurrency real-time desensitization requirements of financial businesses, and is suitable for a collaborative identification mechanism of Bloom filters and cache in high-concurrency financial scenarios. After the desensitization strategy is executed, this application embodiment performs dual security verification of the desensitization effect through information entropy detection and differential attack simulation, while monitoring business continuity indicators to ensure business availability. Based on the verification results, a near-end policy optimization reinforcement learning algorithm is used to dynamically adjust the parameters in the three-dimensional decision model, enabling the desensitization strategy to optimize autonomously and continuously. This significantly shortens the cycle of traditional manual verification and strategy iteration to about 1 hour, which is conducive to achieving rapid adaptation and closed-loop optimization of the desensitization strategy and to building a closed-loop self-evolutionary mechanism that includes automated verification and reinforcement learning optimization.

[0128] See Figure 2 According to another aspect of the embodiments of this application, a data desensitization device is also provided, including: a first processing unit 201, a second processing unit 202, a third processing unit 203 and a fourth processing unit 204.

[0129] The system comprises the following components: a first processing unit 201, used to construct a lineage dependency graph based on the data processing chain, wherein the lineage dependency graph records the dependency relationship and transformation path between the original sensitive data and the derived data in the data processing chain; a second processing unit 202, used to determine the lineage dependency strength of the derived data on the original sensitive data based on the lineage dependency graph, wherein the lineage dependency strength characterizes the probability of obtaining the original sensitive data after the derived data is leaked; a third processing unit 203, used to determine the desensitization strength of the target business data based on the sensitive fields in the target business data, the scenario identifier and sensitivity level of the target business data, and the lineage dependency strength, and then determine the desensitization strategy based on the desensitization strength, wherein the desensitization strength is used to select the corresponding desensitization strategy from the preset mapping relationship; and a fourth processing unit 204, used to perform desensitization processing on the target business data according to the desensitization strategy and output the desensitized target business data.

[0130] Optionally, the first processing unit 201 includes: a first processing subunit, used to generate a lineage dependency record based on the data processing link, wherein the lineage dependency record includes the processing steps of data collected by multiple data acquisition units and the structured mapping relationship between data input and output fields; a second processing subunit, used to construct a directed acyclic graph based on the lineage dependency record, wherein nodes in the directed acyclic graph represent data fields and edges in the directed acyclic graph represent data processing functions; and a third processing subunit, used to construct a lineage dependency graph based on the directed acyclic graph.

[0131] Optionally, the first processing subunit includes multiple data acquisition units, and the data processing link corresponds to the multiple data acquisition units. The multiple data acquisition units include a virtual machine monitoring interface probe, a gateway interceptor, and a database auditing plugin. The virtual machine monitoring interface probe is used to collect sensitive data in the application's memory, the gateway interceptor is used to collect parameters in the Hypertext Transfer Protocol request, and the database auditing plugin is used to collect structured query operation logs.

[0132] Optionally, the second processing unit 202 includes: a fourth processing subunit, used to determine the basic dependency strength of each derived field in the directed acyclic graph based on the number and type of the original sensitive fields that the derived field depends on; and a fifth processing subunit, used to perform attenuation calculation on the basic dependency strength of the derived field based on a preset attenuation coefficient and the number of data processing layers to obtain the lineage dependency strength of the derived field, wherein, for a derived field generated by a single-layer processing, the number of data processing layers and the preset attenuation coefficient are both 1.

[0133] Optionally, the fourth processing subunit includes: a first processing module, used to determine the basic dependency strength as 1 when the derived field depends on a single original sensitive field; a second processing module, used to determine the basic dependency strength as 0 when the derived field does not depend on any original sensitive field; and a third processing module, used to assign a first weight to the original sensitive field among the multiple fields and a second weight to the non-sensitive fields among the multiple fields when the derived field depends on multiple fields, and then determine the basic dependency strength based on the ratio of the sum of the weights of all fields among the multiple fields to the sum of the weights of the original sensitive field.

[0134] Optionally, the fifth processing subunit includes: a first acquisition module, used to acquire the number of data processing layers that the derived field passes through in the directed acyclic graph; a fourth processing module, used to perform an exponential operation on the preset attenuation coefficient to obtain an attenuation factor, wherein the exponent of the exponential operation is the number of data processing layers; and a fifth processing module, used to multiply the basic dependency strength by the attenuation factor to obtain the lineage dependency strength.

[0135] Optionally, the third processing unit 203 includes: a sixth processing subunit, used to extract sensitive field features based on the lineage dependency graph, and to collaboratively identify sensitive fields in the target business data using a Bloom filter and a preset data cache; a seventh processing subunit, used to obtain the business scenario weight, sensitivity level, and lineage dependency strength corresponding to the scenario identifier of the sensitive field; an eighth processing subunit, used to multiply the sensitivity level by a first coefficient to obtain a first product, multiply the lineage dependency strength by a second coefficient to obtain a second product, and multiply the business scenario weight corresponding to the scenario identifier by a third coefficient to obtain a third product, wherein the sum of the first, second, and third coefficients is 1; and a ninth processing subunit, used to add the first, second, and third products to obtain the desensitization strength.

[0136] Optionally, the seventh processing subunit includes: a sixth processing module, used to acquire the business attributes, format features, and verification features of sensitive fields, as well as scene identifiers, and generate a combined feature vector; a seventh processing module, used to perform a double hash operation on the combined feature vector to generate a fixed-length feature fingerprint, wherein the double hash operation includes a cascaded processing of a first round of unencrypted hash operation and a second round of anti-collision encrypted hash operation; an eighth processing module, used to query the feature fingerprint in a preset data cache, and if the feature fingerprint is not found in the preset data cache, input the feature fingerprint into a Bloom filter for batch matching, wherein the preset data cache stores the feature fingerprints of sensitive fields whose call frequency exceeds a preset frequency threshold; the Bloom filter is used to determine whether the feature fingerprint exists in the preset set of sensitive field feature fingerprints based on a probability model; and a ninth processing module, used to output the sensitivity level, lineage dependency strength, and business scene weight of the scene identifier corresponding to the sensitive field when the Bloom filter returns a successful matching result.

[0137] Optionally, the data desensitization device further includes: a fifth processing unit, used to store the feature fingerprints of sensitive fields whose number of matches exceeds a preset threshold within a preset time period into a preset data cache; a sixth processing unit, used to generate an unidentified alarm signal when the Bloom filter returns a result of no successful match; and a seventh processing unit, used to trigger a feature fingerprint update process based on the unidentified alarm signal.

[0138] Optionally, the third processing unit 203 includes: a tenth processing subunit, configured to determine a first strategy as a desensitization strategy when the desensitization strength is greater than or equal to a first threshold, wherein the first strategy is used to perform irreversible encryption transformation on the original data for desensitization processing; an eleventh processing subunit, configured to determine a second strategy as a desensitization strategy when the desensitization strength is greater than or equal to a second threshold and less than the first threshold, wherein the second threshold is less than the first threshold; the second strategy is used to replace the remaining bit information in the original data, excluding some key bit information, with obfuscated characters while retaining some key bit information in the original data; a twelfth processing subunit, configured to determine a third strategy as a desensitization strategy when the desensitization strength is greater than or equal to a third threshold and less than the second threshold, wherein the third threshold is less than the second threshold; the third strategy is used to replace the middle part of the field information with placeholders while retaining the fixed start and end positions of the field; and a thirteenth processing subunit, configured to determine a fourth strategy as a desensitization strategy when the desensitization strength is less than the third threshold, wherein the fourth strategy is used to perform partial obfuscation processing on the field or keep the field as is.

[0139] Optionally, the data anonymization device further includes: an eighth processing unit, used to perform security verification and availability verification on the anonymized target business data to obtain a security score and an availability score, wherein the security verification includes information entropy detection and differential attack simulation, and the availability verification includes business continuity monitoring; and a ninth processing unit, used to dynamically adjust the first coefficient, the second coefficient, and the third coefficient based on the security score and the availability score using a near-end strategy optimization reinforcement learning algorithm to optimize the anonymization strategy.

[0140] According to another aspect of the embodiments of this application, a computer-readable storage medium is also provided, which stores a computer program, wherein when the computer program is executed, the device where the computer-readable storage medium is located performs the above-described data desensitization method.

[0141] According to another aspect of the embodiments of this application, an electronic device is also provided, including one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors perform the data desensitization method described above.

[0142] According to another aspect of the embodiments of this application, a computer program product is also provided, including a computer program or instructions, which implement the above-described data desensitization method when executed by a processor.

[0143] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0144] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0145] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0146] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0147] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0148] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0149] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A data anonymization method, characterized in that, include: A lineage dependency graph is constructed based on the data processing chain, wherein the lineage dependency graph is used to record the dependency relationship and transformation path between the original sensitive data and the derived data in the data processing chain; The bloodline dependence strength of the derived data on the original sensitive data is determined based on the bloodline dependence map, wherein the bloodline dependence strength characterizes the probability of obtaining the original sensitive data by reverse inference after the derived data is leaked; Based on the sensitive fields in the target business data, the scenario identifier and sensitivity level of the target business data, and the bloodline dependence strength, the de-identification strength of the target business data is determined, and then a de-identification strategy is determined based on the de-identification strength, wherein the de-identification strength is used to select the corresponding de-identification strategy from a preset mapping relationship; The target business data is de-identified according to the de-identification strategy, and the de-identified target business data is output.

2. The data anonymization method according to claim 1, characterized in that, A lineage dependency graph is constructed based on the data processing chain, including: A lineage dependency record is generated based on the data processing link, wherein the lineage dependency record includes the processing steps of data collected by multiple data acquisition units and the structured mapping relationship between data input and output fields; A directed acyclic graph is constructed based on the bloodline dependency records, wherein the nodes in the directed acyclic graph represent data fields, and the edges in the directed acyclic graph represent data processing functions; The kinship dependency graph is constructed based on the directed acyclic graph.

3. The data anonymization method according to claim 2, characterized in that, The data processing link corresponds to the plurality of data acquisition units, which include a virtual machine monitoring interface probe, a gateway interceptor, and a database auditing plugin. The virtual machine monitoring interface probe is used to collect sensitive data in the application's memory, the gateway interceptor is used to collect parameters in Hypertext Transfer Protocol requests, and the database auditing plugin is used to collect structured query operation logs.

4. The data anonymization method according to claim 2, characterized in that, Determining the kinship dependency strength of the derived data on the original sensitive data based on the kinship dependency map includes: For each derived field in the directed acyclic graph, the basic dependency strength of the derived field is determined based on the number and type of the original sensitive fields that the derived field depends on. The basic dependency strength of the derived field is calculated by attenuating it according to the preset attenuation coefficient and the number of data processing layers to obtain the lineage dependency strength of the derived field. For a derived field generated by a single layer of processing, both the number of data processing layers and the preset attenuation coefficient are 1.

5. The data anonymization method according to claim 4, characterized in that, The basic dependency strength of the derived field is determined based on the number and type of the original sensitive fields it depends on, including: When the derived field depends on a single original sensitive field, the basic dependency strength is determined to be 1; If the derived field does not depend on any original sensitive field, the basic dependency strength is determined to be 0; When the derived field depends on multiple fields, a first weight is assigned to the original sensitive field among the multiple fields, a second weight is assigned to the non-sensitive field among the multiple fields, and then the basic dependency strength is determined according to the ratio of the sum of the weights of all fields among the multiple fields to the sum of the weights of the original sensitive field.

6. The data desensitization method according to claim 4, characterized in that, The attenuation strength of the derived field is calculated by attenuating the basic dependency strength of the derived field based on a preset attenuation coefficient and the number of data processing layers, resulting in the lineage dependency strength of the derived field, including: Obtain the number of data processing layers that the derived field passes through in the directed acyclic graph; The attenuation factor is obtained by performing an exponential operation on the preset attenuation coefficient, wherein the exponent in the exponential operation is the number of data processing layers. The bloodline dependence strength is obtained by multiplying the basic dependence strength by the decay factor.

7. The data anonymization method according to claim 1, characterized in that, The anonymization strength of the target business data is determined based on sensitive fields in the target business data, the scenario identifier and sensitivity level of the target business data, and the strength of bloodline dependence, including: Based on the bloodline dependency graph, sensitive field features are extracted, and a Bloom filter and a preset data cache are used to collaboratively identify sensitive fields in the target business data. Obtain the business scenario weight, sensitivity level, and lineage dependency strength corresponding to the scenario identifier of the sensitive field; The sensitivity level is multiplied by the first coefficient to obtain the first product, the bloodline dependence strength is multiplied by the second coefficient to obtain the second product, and the business scenario weight corresponding to the scenario identifier is multiplied by the third coefficient to obtain the third product, wherein the sum of the first coefficient, the second coefficient and the third coefficient is 1; The first product, the second product, and the third product are added together to obtain the desensitization intensity.

8. The data anonymization method according to claim 7, characterized in that, Obtain the business scenario weight, sensitivity level, and lineage dependency strength corresponding to the scenario identifier of the sensitive field, including: Obtain the business attributes, format features, validation features, and scenario identifiers of the sensitive fields, and generate a combined feature vector; A double hash operation is performed on the combined feature vector to generate a fixed-length feature fingerprint, wherein the double hash operation includes a cascaded process of a first round of unencrypted hash operation and a second round of collision-resistant encrypted hash operation; The feature fingerprint is queried in the preset data cache. If the feature fingerprint is not found in the preset data cache, the feature fingerprint is input into the Bloom filter for batch matching. The preset data cache stores feature fingerprints of sensitive fields whose call frequency exceeds a preset frequency threshold. The Bloom filter is used to determine whether the feature fingerprint exists in the preset sensitive field feature fingerprint set based on a probability model. If the Bloom filter returns a successful match, the sensitivity level, lineage dependency strength, and business scenario weight of the scenario identifier corresponding to the sensitive field are output.

9. The data desensitization method according to claim 8, characterized in that, The correspondence between the numerical range of the desensitization intensity and the desensitization strategy is a preset mapping relationship. The desensitization strategy is determined based on the desensitization intensity, including: When the desensitization strength is greater than or equal to the first threshold, the first strategy is determined as the desensitization strategy, wherein the first strategy is used to perform desensitization processing on the original data by irreversible encryption transformation; When the desensitization intensity is greater than or equal to the second threshold and less than the first threshold, the second strategy is determined as the desensitization strategy, wherein the second threshold is less than the first threshold; the second strategy is used to replace the remaining bit information in the original data except for the partial key bit information with obfuscated characters while retaining some key bit information in the original data. If the desensitization intensity is greater than or equal to the third threshold and less than the second threshold, the third strategy is determined as the desensitization strategy, wherein the third threshold is less than the second threshold; the third strategy is used to replace the field information in the middle part with placeholders while retaining the fixed first and last positions of the field. If the desensitization intensity is less than the third threshold, the fourth strategy is determined as the desensitization strategy, wherein the fourth strategy is used to partially obfuscate the field or keep the field as is.

10. The data desensitization method according to claim 7, characterized in that, After performing de-identification processing on the target business data according to the aforementioned de-identification strategy and outputting the de-identified target business data, the data de-identification method further includes: The de-identified target business data is subjected to security verification and availability verification to obtain security score and availability score. The security verification includes information entropy detection and differential attack simulation, and the availability verification includes business continuity monitoring. Based on the security score and the available score, a near-end strategy optimization reinforcement learning algorithm is used to dynamically adjust the first coefficient, the second coefficient, and the third coefficient to optimize the desensitization strategy.

11. A data anonymization device, characterized in that, include: The first processing unit is used to construct a lineage dependency graph based on the data processing link, wherein the lineage dependency graph is used to record the dependency relationship and transformation path between the original sensitive data and the derived data in the data processing link; The second processing unit is used to determine the bloodline dependence strength of the derived data on the original sensitive data based on the bloodline dependence map, wherein the bloodline dependence strength characterizes the probability of obtaining the original sensitive data after the derived data is leaked. The third processing unit is used to determine the desensitization strength of the target business data based on the sensitive fields in the target business data, the scenario identifier and sensitivity level of the target business data, and the bloodline dependence strength, and then determine the desensitization strategy based on the desensitization strength, wherein the desensitization strength is used to select the corresponding desensitization strategy from the preset mapping relationship; The fourth processing unit is used to perform de-identification processing on the target business data according to the de-identification strategy and output the de-identified target business data.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein when the computer program is executed, the device containing the computer-readable storage medium performs the data desensitization method according to any one of claims 1 to 10.

13. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to perform the data desensitization method according to any one of claims 1 to 10.

14. A computer program product, characterized in that, It includes a computer program or instructions that, when executed by a processor, implement the data desensitization method of any one of claims 1 to 10.

Images