Sensitive data intelligent desensitization and anonymization analysis method, system, device and medium

Abstract

The application provides a sensitive data intelligent desensitization and anonymization analysis method, system, device and medium, wherein the method comprises the following steps: collecting metadata and data content features, automatically identifying and classifying based on a hybrid model, and determining the sensitive level of the data; dynamically generating an optimal protection strategy according to the user access context and the corresponding sensitive level; analyzing the query statement of the access request, and converting it into a safe query according to the optimal protection strategy; performing real-time desensitization or privacy calculation processing on the original data, and outputting safe data; collecting the use feedback and processing effect evaluation data of the safe data, and iteratively updating the protection strategy, so as to solve the problems of data islands and process fragmentation inherent in the existing static desensitization and pipeline processing mode.

Description

Technical Field

[0001] This invention relates to the field of data security and privacy computing technology, and in particular to a method, system, device and medium for intelligent desensitization and anonymization analysis of sensitive data. Background Technology

[0002] In the fields of data security and privacy computing, desensitizing and anonymizing sensitive data is crucial for balancing data utilization and privacy protection. Currently, the industry mainly relies on two models: static desensitization and pipeline processing. Static desensitization, achieved by creating data copies, suffers from three inherent drawbacks: severe data lag, high storage costs, and the spread of security risks. While pipeline processing integrates the desensitization process, its rigid workflow, requiring analysis requests to wait for batch processing to complete, severely restricts analytical efficiency and flexibility. Furthermore, its reliance on fixed desensitization rules makes it unsuitable for diverse analytical scenarios, easily leading to over-desensitization that renders data invalid, or under-desensitization that triggers compliance risks.

[0003] Ultimately, current technologies treat data protection as a separate, upfront data preparation step, rather than an embedded security service deeply integrated with the data analysis process. This paradigm of separating protection from analysis is the root cause of data timeliness loss, inefficient processes, and poor flexibility.

[0004] Therefore, there is an urgent need for an intelligent desensitization and anonymization analysis method for sensitive data to solve the technical problems of data silos and process fragmentation inherent in the existing static desensitization and pipeline processing modes. Summary of the Invention

[0005] To overcome the problems existing in related technologies, this disclosure provides a method, system, device and medium for intelligent desensitization and anonymization analysis of sensitive data, so as to solve the technical problems of data silos and process fragmentation inherent in the existing static desensitization and pipeline processing modes in related technologies.

[0006] This specification provides one or more embodiments of a method for intelligent desensitization and anonymization analysis of sensitive data, including the following steps: Collect metadata and data content features, automatically identify and classify them based on a hybrid model, and determine the sensitivity level of the data; Dynamically generate the optimal protection strategy based on the user access context and the corresponding sensitivity level; Parse the query statement of the access request and convert it into a secure query according to the optimal protection strategy; Perform real-time anonymization or privacy-preserving computation on raw data to output secure data; Collect security data, feedback on its use, and evaluation of processing effectiveness to iteratively update protection strategies.

[0007] Preferably, the collection of metadata and data content features, based on a hybrid model for automatic identification and classification, and determination of the data sensitivity level, specifically includes the following steps: Metadata and data content characteristics are collected by connecting to heterogeneous data sources via side connectors; A reservoir sampling algorithm is used to extract data samples, and the data content characteristics of the data samples are analyzed from multiple dimensions to construct a relationship graph between data entities. By matching patterned sensitive data through a predefined regular expression library, information entropy is introduced to quantify the sensitivity of non-patterned data. Metadata attributes, statistical features, entropy values, and semantic entities are fused into a feature vector, which is then input into a machine learning ensemble classifier to determine the sensitivity level of the data and generate a dynamically updated list of sensitive data.

[0008] Preferably, the step of dynamically generating the optimal protection strategy based on the user access context and the corresponding sensitivity level specifically includes the following steps: Transform user identity and role, data sensitivity level, access time, IP address, query operation type, and client tool into numerical context feature vectors; The context feature vector is matched with predefined strategies in the matching strategy rule base, and the cosine similarity between the vectors is calculated to generate the optimal protection strategy.

[0009] Preferably, the query statement of the parsed access request is converted into a secure query according to the optimal protection strategy, specifically including the following steps: The parser parses the query statement of the access request and transforms it into an abstract syntax tree; Sensitive data nodes are marked according to the optimal protection strategy and abstract syntax tree transformation is performed to generate semantically equivalent secure queries.

[0010] Preferably, the real-time de-identification or privacy computation processing of the original data specifically includes the following steps: For sensitive data with distinctive characteristics, a salted hash algorithm, format-preserving encryption, and partial masking algorithm are used for real-time desensitization. For dataset publishing scenarios that require preventing identity re-identification, a k-anonymity model is used to generalize to the aligner identifier to achieve privacy-preserving computation; For statistical query scenarios involving privacy protection boundaries, a Laplace mechanism is employed to achieve differential privacy.

[0011] Preferably, the use feedback and processing effect evaluation data of the collected security data are used to iteratively update the protection strategy, specifically including the following steps: Collect downstream query citation frequency and user satisfaction scores, and calculate the overall utility score of the implemented strategies; Using the overall utility score as the reward signal, the multi-armed gambling machine algorithm is used to dynamically adjust the strategy priority and algorithm parameters.

[0012] Preferably, the method further includes the following steps: The data utility of the k-anonymity model is evaluated by normalized deterministic penalty, and the differential privacy effect is evaluated by the trade-off curve between data utility and privacy protection strength. Record the original query, security query, user information, policy ID, and algorithm parameters, and incorporate governance events into the data lineage graph to mark data derivation relationships.

[0013] This specification provides one or more embodiments of a sensitive data intelligent de-identification and anonymization analysis system, including a sensitivity level classification module, a dynamic strategy reasoning module, a query rewriting module, a de-identification module, and an optimization module; The sensitivity level classification module is used to collect metadata and data content features, automatically identify and classify based on a hybrid model, and determine the sensitivity level of the data. The dynamic policy reasoning module is used to dynamically generate the optimal protection policy based on the user access context and the corresponding sensitivity level. The query rewriting module is used to parse the query statement of the access request and convert it into a secure query according to the optimal protection strategy. The desensitization module is used to perform desensitization or privacy calculation processing on the original data in real time and output secure data; The optimization module is used to collect feedback on the use of security data and evaluation data on the processing effect, and to iteratively update the protection strategy.

[0014] This specification provides one or more embodiments of a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the above-described intelligent desensitization and anonymization analysis method for sensitive data.

[0015] This specification provides one or more embodiments of a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the above-described intelligent desensitization and anonymization analysis method for sensitive data.

[0016] This disclosure provides a method, system, device, and medium for intelligent desensitization and anonymization analysis of sensitive data. Its advantages lie in its ability to automatically identify and classify data based on a hybrid model by collecting metadata and data content features, thereby determining the data's sensitivity level. This achieves automated and accurate classification and sensitivity level determination of sensitive data, avoiding the problems of missed or false judgments caused by traditional single-feature identification. It significantly reduces the cost of manual intervention and provides a precise and reliable grading basis for the differentiated formulation of subsequent protection strategies, ensuring that protection measures are accurately matched to the data's sensitivity. Furthermore, it dynamically generates the optimal protection strategy based on the user's access context and the corresponding sensitivity level, breaking through the rigid limitations of fixed protection strategies. The generated optimal protection strategy can specifically resist privacy leakage risks in different scenarios while avoiding the impact of over-protection on data usability, achieving a dynamic balance between privacy security and data usage efficiency. Finally, it parses the query statement of the access request and converts it into a secure format according to the optimal protection strategy. Full query ensures the faithful transformation of query intent, guaranteeing that the transformed secure query does not deviate from the core requirements of the original query while blocking the direct exposure path of sensitive data at the query layer. This establishes the first security barrier for subsequent data processing and output, ensuring privacy compliance during the query process. Real-time anonymization or privacy computation processing of the original data outputs secure data, meeting the real-time requirements of dynamic data access scenarios while ensuring the original data is usable but not visible. The output secure data eliminates the risk of sensitive information leakage and directly supports legitimate and compliant data analysis needs, balancing data security and practicality. Feedback on the use of secure data and evaluation data on processing effectiveness are collected to iteratively update protection strategies. This allows for dynamic adaptation to changes in data characteristics, adjustments to access scenarios, and updates to privacy compliance requirements, continuously correcting shortcomings in protection strategies and ensuring that protection measures remain highly adaptable to actual needs, achieving long-term optimization and continuous improvement of privacy protection effectiveness. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in one or more embodiments of this specification or in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 A flowchart illustrating a method for intelligent desensitization and anonymization analysis of sensitive data provided in one or more embodiments of this specification; Figure 2 A schematic diagram of the structure of a sensitive data intelligent desensitization and anonymization analysis system provided in one or more embodiments of this specification; Figure 3This is a schematic diagram of the structure of a computer device provided for one or more embodiments of this specification. Detailed Implementation

[0019] To enable those skilled in the art to better understand the technical solutions in one or more embodiments of this specification, the technical solutions in one or more embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this specification, and not all of the embodiments. Based on one or more embodiments of this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of this invention.

[0020] The present invention will now be described in detail with reference to specific embodiments and accompanying drawings.

[0021] Method Implementation Examples According to embodiments of the present invention, a method for intelligent desensitization and anonymization analysis of sensitive data is provided. This technical solution is implemented through nine steps: data preprocessing and feature extraction, knowledge fusion strategy, hierarchical grouping network structure, parameter sharing and dynamic adjustment, combination of pruning and quantization techniques, dynamic learning rate adjustment, flexible batch size control, and multi-task collaborative training. Figure 1 The diagram shown is a flowchart of the intelligent desensitization and anonymization analysis method for sensitive data provided in this embodiment. The intelligent desensitization and anonymization analysis method for sensitive data according to this embodiment includes the following steps: S110: Collect metadata and data content characteristics to achieve comprehensive and in-depth perception of the data environment. Based on a hybrid model, automatically identify and classify the data, determine the sensitivity level of the data, and persist the results to a dynamically updated data classification and grading list.

[0022] S120. Dynamically generate the optimal protection strategy based on the user access context and the corresponding sensitivity level, and assign an appropriate protection strategy to each specific data access request.

[0023] S130. Parse the query statement of the access request and convert it into a secure query according to the optimal protection strategy. S140. Perform de-identification or privacy calculations on the raw data in real time and output secure data, thereby converting the advanced protection intent into instructions that the data manipulation engine can understand.

[0024] S150: Collect security data usage feedback and processing effect evaluation data, iteratively update protection strategies, thereby enabling the system to continuously self-adjust and improve performance during long-term operation.

[0025] The method provided in this embodiment automatically identifies and classifies data based on a hybrid model by collecting metadata and data content features, determining the sensitivity level of the data. This achieves automated and accurate classification and sensitivity level determination of sensitive data, avoiding the problems of missed or false judgments caused by traditional single-feature identification. It not only significantly reduces the cost of manual intervention but also provides a precise and reliable hierarchical basis for the differentiated formulation of subsequent protection strategies, ensuring that protection measures are accurately matched with the data sensitivity. The method dynamically generates the optimal protection strategy based on the user access context and the corresponding sensitivity level, breaking through the rigid limitations of fixed protection strategies. The generated optimal protection strategy can specifically resist the privacy leakage risks in different scenarios while avoiding the impact of over-protection on data usability, achieving a dynamic balance between privacy security and data usage efficiency. Finally, the method parses the query statement of the access request and converts it into a secure query according to the optimal protection strategy, achieving faithful conversion of the query intent. The system employs several methods: First, it ensures the transformed secure query doesn't deviate from the core requirements of the original query, while simultaneously blocking direct exposure of sensitive data at the query layer. This establishes the first line of defense for subsequent data processing and output, guaranteeing privacy compliance during the query process. Second, it performs real-time anonymization or privacy computation on the original data, outputting secure data. This satisfies the real-time requirements of dynamic data access scenarios while ensuring the original data is usable but invisible. The output secure data eliminates the risk of sensitive information leakage and directly supports legitimate and compliant data analysis needs, balancing data security and practicality. Third, it collects feedback on the use of secure data and evaluates the processing effectiveness, iteratively updating protection strategies. This allows for dynamic adaptation to changes in data characteristics, adjustments to access scenarios, and updates to privacy compliance requirements, continuously correcting shortcomings in the protection strategy. This ensures that protection measures remain highly adaptable to actual needs, achieving long-term optimization and continuous improvement in privacy protection effectiveness.

[0026] In one embodiment, metadata and data content features are collected, and the data is automatically identified and classified based on a hybrid model to determine the sensitivity level of the data. This includes the following steps: Data Link: Automatically connects to heterogeneous data sources, such as relational databases, data warehouses, and big data platforms, through connectors deployed on the side. It extensively collects metadata and data content characteristics. This process not only obtains basic table structures, field names, and data types, but also extracts advanced metadata such as comments and constraints, thereby building an initial data map covering the entire domain.

[0027] Metadata Awareness: Understanding the data's substance—its actual content—employs a reservoir sampling algorithm to efficiently and unbiasedly sample massive amounts of data, extracting data samples that ensure the analysis samples represent the overall data distribution. It performs multi-dimensional analysis of the data sample's content characteristics, including: calculating the proportion of unique values, maximum and minimum values ​​for each field to understand its value range; generating histograms of data distribution to visualize its patterns; and constructing a relational graph between data entities by analyzing foreign key constraints and query logs. This directly and automatically provides the definition of quasi-identifier sets, laying a solid statistical and relational foundation for accurately identifying sensitive information.

[0028] A hybrid approach of "rules + statistics" is used for initial screening. A predefined regular expression library is used to match sensitive data with fixed patterns, such as ID card numbers and credit card numbers. For non-patterned data, information entropy is introduced to quantify the sensitivity of non-patterned data. The formula for calculating information entropy is as follows:

[0029] Here, P(x_i) represents the probability of the value x_i occurring. An excessively high entropy value for a field may indicate that it is close to a unique identifier, while an excessively low entropy value may indicate that it is a state field; both of these situations can be sensitive signals.

[0030] Metadata attributes, statistical features, entropy values, and semantic entities extracted from annotations and text content through a pre-trained natural language processing model are fused into a feature vector. This vector is then input into a machine learning ensemble classifier, such as a random forest or gradient boosting tree. The classifier's task is to output a probability vector describing the likelihood P(C_k|Features) that the field belongs to each predefined sensitivity category C_k (e.g., "personal identification information," "financial information," "health information"). The system ultimately determines the sensitivity level and classification of the data based on the maximum probability and a preset threshold, and generates a dynamically updated list of sensitive data.

[0031] The method provided in this embodiment connects to heterogeneous data sources through a side connector, ensuring full compatibility of metadata and data content feature collection. The reservoir sampling algorithm efficiently extracts samples, and combined with multi-dimensional feature analysis and entity association graphs, it reduces the omission of sensitive information and lowers computing costs. The regular expression library matches patterned data, and information entropy quantifies the sensitivity of non-patterned data, covering all types of sensitive data and breaking through the limitations of traditional identification. Multi-dimensional feature vector fusion and machine learning integrated classifier improve the accuracy and generalization ability of sensitivity level determination, and generate a dynamically updated list of sensitive data, providing accurate and timely support for subsequent differentiated protection.

[0032] In one embodiment, the optimal protection policy is dynamically generated based on the user access context and the corresponding sensitivity level, specifically including the following steps: The system models and quantifies rich contextual information, transforming user identity and roles, data sensitivity levels, access times, IP addresses, query operation types, and client tools into numerical contextual feature vectors. The data sensitivity levels include: L1: Public Data The data does not contain any personal, commercial, or sensitive information, and can be freely shared and made public without causing any harm to any individual or organization.

[0033] L2: Internal General Data The data is used for internal business operations and does not directly identify individuals or entities, but its leakage may cause minor inconvenience or limited financial loss. Basic access controls are required.

[0034] L3: Sensitive Data It contains information that could be used to indirectly identify individuals or entities, or private information that, if disclosed, could lead to financial loss, reputational damage, discrimination, or inconvenience. Strong protective measures are required.

[0035] L4: Core Sensitive / High-Risk Data Data is protected by strict laws and regulations, and its leakage may lead to extremely serious consequences, such as identity theft, significant financial losses, legal proceedings, and threats to personal life or safety.

[0036] The core task of the policy matching engine is to match the context vector of the real-time request with predefined policies in the policy rule base. Each rule in the policy base also corresponds to a context vector. The engine matches these context feature vectors with the predefined policies in the policy rule base, calculates the cosine similarity between the vectors, and generates the optimal protection policy. The cosine similarity calculation method is as follows: similarity(A,B)=(A·B) / (||A||·||B||).

[0037] Where A (the context vector of the real-time request) represents all the context features of the data access request that is currently occurring; B (the context vector of a certain policy in the policy rule base) represents the ideal context conditions to which a certain predefined policy in the policy rule base applies; A·B represents the dot product of the vectors; ||A|| and ||B|| represent the magnitude of the vectors; and similarity(A,B) represents the cosine similarity value.

[0038] This algorithm can effectively measure the directional similarity between contexts, thereby ensuring that the system can match an intern who initiates a detailed query from an unfamiliar network outside of working hours with a much stricter de-identification or blocking strategy than internal analysts perform aggregation analysis, thus achieving truly granular dynamic access control.

[0039] The method provided in this embodiment transforms multi-dimensional access context information into numerical feature vectors, achieving standardization and comprehensive capture of context features; through a cosine similarity matching strategy rule base, it efficiently and accurately selects the optimal protection strategy, ensuring that protection measures are precisely adapted to user access scenarios and data sensitivity levels, balancing data security protection with usage flexibility.

[0040] In one embodiment, parsing the query statement of the access request and converting it into a secure query according to the optimal protection strategy specifically includes the following steps: The query statement of the access request is lexically, syntactically, and semantically parsed by a parser built on ANTLR or Calcite, and transformed into a structured abstract syntax tree. This tree precisely describes the logical structure of the query, including the data source, filtering conditions, projection fields, and join relationships.

[0041] After obtaining the Abstract Syntax Tree (AST), all sensitive data nodes requiring processing are traversed and marked according to the optimal protection strategy, and abstract syntax tree transformation operations are performed. For example, for a node that selects a sensitive field, it is replaced with a specific function call; for a node that uses a sensitive field for filtering, a noise interval is superimposed on it. The entire rewriting process must guarantee semantic equivalence, that is, it does not change the original intent of the query, but only embeds protection logic at the data exit point to generate a secure query that is semantically equivalent to the original query intent in terms of security and functionality.

[0042] The method provided in this embodiment transforms the query statement into an abstract syntax tree through a parser, accurately captures the core intent of the query, marks sensitive data nodes based on the optimal protection strategy and performs syntax tree transformation. Under the premise of ensuring that the security query is semantically equivalent to the original query, it specifically blocks the exposure path of sensitive data, and achieves a precise balance between query layer security protection and data usage needs.

[0043] In one embodiment, the raw data undergoes real-time de-identification or privacy-preserving computation processing, specifically including the following steps: Lightweight data masking: This feature employs computationally inefficient and fast-response masking algorithms, suitable for immediate protection of identifiable data. It includes a rich library of lightweight algorithms, ideal for scenarios requiring data uniqueness and referential integrity, such as data connections used in test environments without exposing the truth. Identifiable data refers to data fields that uniquely and accurately point to or identify a specific individual, entity, or resource. It can be considered the data's "identity card"; once leaked, it directly pinpoints the specific target and represents the highest risk. Typical examples include: ID card numbers, mobile phone numbers, bank card numbers, primary key IDs, and precise names. For sensitive identifiable data, it uses salted hashing algorithms, format-preserving encryption, and partial masking algorithms for real-time masking. The salted hashing algorithm is expressed as: `Hashed_Value = SHA256(CONCAT(field_value, salt))`, where `salt` is a confidential random string. This effectively prevents rainbow table attacks and ensures that the same input produces the same output. Format preservation encryption ensures that the encrypted ciphertext retains the original data's format (such as length and character set), facilitating integration into legacy systems. For scenarios involving direct display, partial masking rules are applied, such as processing the email address "abc@example.com" as "a**c@example.com". These algorithms are designed to be stateless and efficient, enabling real-time masking of sensitive data with minimal impact on query latency, meeting the needs of high-concurrency, low-latency interactive analysis.

[0044] Privacy-preserving computation: When data analysis tasks require releasing the entire dataset or performing deep aggregation analysis, and demand strict, quantifiable privacy guarantees, this step initiates an advanced privacy-preserving computation model. For dataset release scenarios requiring protection against identity re-identification, a k-anonymity model is used to generalize quasi-identifiers to achieve privacy-preserving computation. Its core objective is to generalize or suppress quasi-identifiers such as zip codes, age, and gender, ensuring that in the final released dataset, the size of the equivalence group (i.e., the set of records with identical values ​​on these quasi-identifiers) is no less than k. This is typically achieved by finding an optimal solution on the data generalization lattice, aiming to minimize information loss while satisfying k-anonymity requirements.

[0045] For statistical query scenarios with privacy protection boundaries, a Laplace mechanism is employed, particularly for numerical queries, to achieve differential privacy. This mechanism injects carefully calibrated noise into the actual query result f(D), with the output being Y = f(D) + Lap(Δf / ε). Here, Lap(b) represents random noise sampled from a Laplace distribution with a scaling parameter of b = Δf / ε, Δf is the global sensitivity of the query function f (the maximum difference between query results on any two adjacent datasets), and ε is the privacy budget, controlling the strength of privacy protection. A smaller ε value results in more noise and stronger privacy protection, but also reduces data utility.

[0046] The method provided in this embodiment precisely adapts to different privacy protection scenarios. Sensitive data with identifiable characteristics is de-identified in real time through algorithms such as salted hashing and format-preserving encryption. Dataset publishing scenarios use k-anonymity generalization to prevent identity re-identification. Statistical query scenarios use the Laplace mechanism to achieve differential privacy. This ensures real-time security protection of sensitive data while also taking into account data availability through adaptive processing, achieving precise and efficient privacy protection.

[0047] In one embodiment, collecting security data usage feedback and processing effectiveness evaluation data, and iteratively updating the protection strategy, specifically includes the following steps: To evolve the system from a static automation tool into a dynamic self-optimizing platform, a feedback-based reinforcement learning loop is introduced. Feedback signals are collected through multiple channels: indirect signals include downstream query citation frequency and count; direct signals include user satisfaction ratings and analyst ratings of query result usability. This feedback is aggregated to calculate the overall utility score of the implemented strategies.

[0048] Based on the collected feedback, the system periodically calculates a comprehensive utility score U_i for each policy P_i. This score can be a weighting function, such as... Where Usage_Freq is the frequency of use, Avg_NCP is the average information loss, Satisfaction_Score is the user satisfaction, and α, β, γ are weighting coefficients.

[0049] Using the overall utility score as the reward signal, a multi-armed gambling machine algorithm is adopted to dynamically adjust the selection probability and algorithm parameters of the strategy priority in similar contexts.

[0050] The method provided in this embodiment constructs a quantitative comprehensive utility evaluation system by collecting downstream query citation frequency and user satisfaction scores. This system accurately reflects the actual application effect of the protection strategy. The comprehensive utility score serves as a reward signal. Combined with the multi-armed gambling machine algorithm, the strategy priority and algorithm parameters are dynamically adjusted to achieve intelligent and adaptive strategy optimization. This avoids the lag of manual adjustments and forms a closed-loop iterative mechanism of feedback-evaluation-optimization. This continuously improves the adaptability of the protection strategy to the actual scenario, balances the strength of privacy protection with the utility of data use, and achieves long-term dynamic optimization.

[0051] In one embodiment, the following steps are also included: To scientifically measure and compare the advantages and disadvantages of different data protection schemes and provide a basis for system optimization, a quantitative evaluation mechanism is introduced. Based on a generalized k-anonymity model, the data utility of the k-anonymity model is evaluated through normalized deterministic penalty. For a generalized record, its NCP value is calculated as follows: That is, for each generalized quasi-identifier, calculate the ratio of the width of its generalized interval to the width of the entire value range of the attribute, and then sum the ratios for all quasi-identifiers. The lower the average NCP value of the entire dataset, the better the data utility is preserved.

[0052] For differential privacy, the strength of privacy protection is directly quantified by the privacy budget ε; the smaller ε is, the stronger the protection. By executing typical query sets at different ε values ​​and observing the mean squared error or mean absolute error between the query results and the actual results, the system can plot a trade-off curve between data utility (error) and privacy protection strength (ε). Evaluating the effectiveness of differential privacy through this trade-off curve, this Pareto front curve provides administrators with intuitive and quantitative decision support for selecting the optimal privacy budget based on the risk tolerance and data accuracy requirements of specific business scenarios.

[0053] As a key requirement for compliance and accountability, audit logs meticulously record the entire lifecycle of every data access and governance operation. The information captured in audit logs includes not only the original query, security query, user information, timestamps, and source IP address, but more importantly, it precisely records the triggered policy ID, the name of the specific application's anonymization or de-identification algorithm, and its key runtime parameters, such as the actual implemented k-value and the consumed ε-value.

[0054] Beyond traditional auditing, this approach incorporates governance events into a data lineage graph to mark data derivation relationships. Specifically, it dynamically constructs data derivation relationships by overlaying runtime audit information onto the relationship graph. This clearly records the data derivation relationships: identifying the upstream source(s) of the anonymized dataset output, specifying which original sensitive data tables it originated from, and indicating the governance rules used to generate it, such as "differential privacy with ε=0.1 was applied." This enhanced lineage of governance information makes the source and transformation history of data fully traceable, providing unprecedented transparency for data quality analysis, impact analysis, and compliance auditing.

[0055] The method provided in this embodiment accurately quantifies the data utility of the k-anonymity model through normalized deterministic penalties, and intuitively evaluates the balance between the privacy protection strength and data utility of differential privacy using a trade-off curve. This provides a scientific quantitative basis for the effectiveness of privacy computing, ensuring that protection measures are both compliant and non-redundant. It records key information such as original queries and security queries and incorporates governance events into the data lineage graph, clearly marking data derivation relationships. This enables full-chain traceability and auditability of privacy governance, providing support for compliance verification and problem tracing, and further improving the practicality and compliance of the technical solution.

[0056] System Implementation Examples According to embodiments of the present invention, a sensitive data intelligent desensitization and anonymization analysis system is provided, such as... Figure 2 The diagram shown is a structural schematic of the intelligent desensitization and anonymization analysis system for sensitive data provided in this embodiment. The intelligent desensitization and anonymization analysis system for sensitive data according to this embodiment includes a sensitivity level classification module 21, a dynamic strategy reasoning module 22, a query rewriting module 23, a desensitization module 24, and an optimization module 25.

[0057] The sensitivity level classification module 21 is used to collect metadata and data content features, automatically identify and classify based on a hybrid model, and determine the sensitivity level of the data.

[0058] The dynamic policy reasoning module 22 is used to dynamically generate the optimal protection policy based on the user access context and the corresponding sensitivity level.

[0059] The query rewriting module 23 is used to parse the query statement of the access request and convert it into a secure query according to the optimal protection strategy.

[0060] The desensitization module 24 is used to perform desensitization or privacy calculation processing on the original data in real time and output secure data.

[0061] The optimization module 25 is used to collect feedback on the use of security data and evaluation data on the processing effect, and to iteratively update the protection strategy.

[0062] The system provided in this embodiment collects metadata and data content features through the sensitivity level classification module 21, automatically identifies and classifies data based on a hybrid model, and determines the sensitivity level of the data. This achieves automated and accurate classification and sensitivity level determination of sensitive data, avoiding the problems of missed or false judgments caused by traditional single feature identification. It not only significantly reduces the cost of manual intervention but also provides accurate and reliable hierarchical basis for the differentiated formulation of subsequent protection strategies, ensuring that protection measures are accurately matched with the sensitivity of the data. The dynamic strategy reasoning module 22 dynamically generates the optimal protection strategy based on the user access context and the corresponding sensitivity level, breaking through the rigidity of fixed protection strategies. The generated optimal protection strategy can not only specifically resist the privacy leakage risks in different scenarios but also avoid the impact of over-protection on data availability, achieving a dynamic balance between privacy security and data usage efficiency. The query rewriting module 23 parses the query statement of the access request and converts it into a secure query according to the optimal protection strategy, realizing... The system performs a faithful transformation of query intent, ensuring that the transformed secure query does not deviate from the core requirements of the original query while blocking the direct exposure path of sensitive data at the query layer. This establishes the first security barrier for subsequent data processing and output, guaranteeing the privacy compliance of the query process. The desensitization module 24 performs real-time desensitization or privacy calculation processing on the original data, outputting secure data. This satisfies the real-time requirements of dynamic data access scenarios while ensuring that the original data is usable but not visible. The output secure data eliminates the risk of sensitive information leakage and directly supports legitimate and compliant data analysis needs, balancing data security and practicality. The optimization module 25 collects feedback on the use of secure data and evaluation data on processing effects, iteratively updating the protection strategy. It can dynamically adapt to dynamic factors such as changes in data characteristics, adjustments to access scenarios, and updates to privacy compliance requirements, continuously correcting the shortcomings of the protection strategy. This ensures that the protection measures always maintain a high degree of adaptability to actual needs, achieving long-term optimization and continuous improvement of privacy protection effectiveness.

[0063] The embodiments of the present invention are system embodiments corresponding to the above method embodiments. The specific operations of each module processing step can be understood by referring to the description of the method embodiments, and will not be repeated here.

[0064] like Figure 3 As shown, the present invention also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it implements the intelligent desensitization and anonymization analysis method for sensitive data in the above embodiments, or when the computer program is executed by a processor, it implements the intelligent desensitization and anonymization analysis method for sensitive data in the above embodiments.

[0065] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0066] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, for apparatus or system embodiments, since they are basically similar to method embodiments, the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments. The apparatus and system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0067] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features. These modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention, and the contents not described in detail in the specification of the present invention are known to those skilled in the art.

Claims

1. A method for intelligent desensitization and anonymization analysis of sensitive data, characterized in that, Includes the following steps: Collect metadata and data content features, automatically identify and classify them based on a hybrid model, and determine the sensitivity level of the data; Dynamically generate the optimal protection strategy based on the user access context and the corresponding sensitivity level; Parse the query statement of the access request and convert it into a secure query according to the optimal protection strategy; Perform real-time anonymization or privacy-preserving computation on raw data to output secure data; Collect security data, feedback on its use, and evaluation of processing effectiveness to iteratively update protection strategies.

2. The intelligent desensitization and anonymization analysis method for sensitive data as described in claim 1, characterized in that, The collected metadata and data content features are automatically identified and classified based on a hybrid model to determine the sensitivity level of the data, specifically including the following steps: Metadata and data content characteristics are collected by connecting to heterogeneous data sources via side connectors; A reservoir sampling algorithm is used to extract data samples, and the data content characteristics of the data samples are analyzed from multiple dimensions to construct a relationship graph between data entities. By matching patterned sensitive data through a predefined regular expression library, information entropy is introduced to quantify the sensitivity of non-patterned data. Metadata attributes, statistical features, entropy values, and semantic entities are fused into a feature vector, which is then input into a machine learning ensemble classifier to determine the sensitivity level of the data and generate a dynamically updated list of sensitive data.

3. The intelligent desensitization and anonymization analysis method for sensitive data as described in claim 1, characterized in that, The step of dynamically generating the optimal protection strategy based on the user access context and the corresponding sensitivity level specifically includes the following steps: Transform user identity and role, data sensitivity level, access time, IP address, query operation type, and client tool into numerical context feature vectors; The context feature vector is matched with predefined strategies in the matching strategy rule base, and the cosine similarity between the vectors is calculated to generate the optimal protection strategy.

4. The intelligent desensitization and anonymization analysis method for sensitive data as described in claim 1, characterized in that, The query statement for parsing the access request is converted into a secure query according to the optimal protection strategy, specifically including the following steps: The parser parses the query statement of the access request and transforms it into an abstract syntax tree; Sensitive data nodes are marked according to the optimal protection strategy and abstract syntax tree transformation is performed to generate semantically equivalent secure queries.

5. The intelligent desensitization and anonymization analysis method for sensitive data as described in claim 1, characterized in that, The real-time de-identification or privacy-preserving computation processing of the original data specifically includes the following steps: For sensitive data with distinctive characteristics, a salted hash algorithm, format-preserving encryption, and partial masking algorithm are used for real-time desensitization. For dataset publishing scenarios that require preventing identity re-identification, a k-anonymity model is used to generalize to the aligner identifier to achieve privacy-preserving computation; For statistical query scenarios involving privacy protection boundaries, a Laplace mechanism is employed to achieve differential privacy.

6. The intelligent desensitization and anonymization analysis method for sensitive data as described in claim 1, characterized in that, The collection of security data, along with feedback on its use and evaluation of processing effectiveness, is used to iteratively update the protection strategy. This process includes the following steps: Collect downstream query citation frequency and user satisfaction scores, and calculate the overall utility score of the implemented strategies; Using the overall utility score as the reward signal, the multi-armed gambling machine algorithm is used to dynamically adjust the strategy priority and algorithm parameters.

7. The intelligent desensitization and anonymization analysis method for sensitive data as described in claim 1, characterized in that, It also includes the following steps: The data utility of the k-anonymity model is evaluated by normalized deterministic penalty, and the differential privacy effect is evaluated by the trade-off curve between data utility and privacy protection strength. Record the original query, security query, user information, policy ID, and algorithm parameters, and incorporate governance events into the data lineage graph to mark data derivation relationships.

8. A sensitive data intelligent desensitization and anonymization analysis system, characterized in that, It includes a sensitivity level classification module, a dynamic strategy reasoning module, a query rewriting module, a desensitization module, and an optimization module; The sensitivity level classification module is used to collect metadata and data content features, automatically identify and classify based on a hybrid model, and determine the sensitivity level of the data. The dynamic policy reasoning module is used to dynamically generate the optimal protection policy based on the user access context and the corresponding sensitivity level. The query rewriting module is used to parse the query statement of the access request and convert it into a secure query according to the optimal protection strategy. The desensitization module is used to perform desensitization or privacy calculation processing on the original data in real time and output secure data; The optimization module is used to collect feedback on the use of security data and evaluation data on the processing effect, and to iteratively update the protection strategy.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the intelligent desensitization and anonymization analysis method for sensitive data as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the intelligent desensitization and anonymization analysis method for sensitive data as described in any one of claims 1 to 7.

Images