A knowledge graph-based method and system for protecting financial data privacy

Abstract

This application provides a knowledge graph-based method and system for protecting financial data privacy. It constructs a dynamic risk knowledge graph when a user accesses financial data. For the current access request, it extracts historical behavioral deviations associated with the current user, anomaly indices associated with the current access context, and sensitivity levels associated with the target data asset from the dynamic risk knowledge graph, and then integrates these to generate a dynamic risk score for the current access request. It calculates the deviation between the dynamic risk score and a set risk baseline. When the deviation consistently exceeds a scenario-adaptive threshold, a privacy risk warning is triggered. Based on the risk contribution weights of associated paths in the dynamic risk knowledge graph and the current risk deviation characteristics, a dynamic privacy protection intervention strategy is determined and implemented. This solution enables dynamic evolution modeling of financial data access risks based on knowledge graphs, thereby improving the real-time response capability for privacy risk identification.

Description

Technical Field

[0001] This application relates to the field of data security technology, and more specifically, to a method and system for protecting financial data privacy based on knowledge graphs. Background Technology

[0002] With the comprehensive digital development of financial services, user identity information, transaction data, and risk control data are frequently transferred between multiple systems. The data access subjects are diverse and the access scenarios are complex, posing continuous challenges to financial data security and privacy protection. In particular, in the context of data sharing and remote access, how to effectively manage data access risks while ensuring business efficiency has become an important fundamental issue for financial information systems.

[0003] Existing financial data privacy protection technologies largely rely on static access control or rule-based risk assessment mechanisms. These typically rely solely on user roles or single-access attributes for authorization, failing to capture the risk characteristics of evolving user behavior over time. When user access behavior gradually deviates from its historical patterns in a short period, existing technologies often cannot promptly identify the risk accumulation process, only passively triggering alerts after significant risk exposure. Furthermore, traditional methods lack the ability to comprehensively model the relationships between users, data assets, and access behavior, failing to analyze risk formation paths at a structural level. This results in coarse-grained risk identification and delayed response, making it difficult to support refined privacy protection. Therefore, how to achieve dynamic evolution modeling of financial data access risks based on knowledge graphs, thereby improving the real-time response capability for privacy risk identification, has become a challenge for the industry. Summary of the Invention

[0004] This application provides a knowledge graph-based method and system for protecting financial data privacy, which can realize dynamic evolution modeling of financial data access risks based on knowledge graphs, thereby improving the real-time response capability for privacy risk identification.

[0005] Firstly, this application provides a knowledge graph-based method for protecting financial data privacy, including: A dynamic risk knowledge graph is constructed when users access financial data. The dynamic risk knowledge graph uses users and data assets as entity nodes and access operation events as associated edges. The node association relationship is dynamically and incrementally updated based on real-time generated user behavior sequences and access context. For the current access request, the dynamic risk knowledge graph extracts the historical behavior deviation associated with the current user, the anomaly index associated with the current access context, and the sensitivity level associated with the target data asset, and then integrates them to generate a dynamic risk score for the current access request. A risk baseline is set based on the user's identity and current business scenario. The deviation between the dynamic risk score of the current access request and the risk baseline is calculated. When the deviation exceeds the scenario adaptive threshold derived from historical statistics, a privacy risk warning is triggered. When a privacy risk warning is triggered, a dynamic privacy protection intervention strategy is determined and executed based on the risk contribution weight of the associated paths in the dynamic risk knowledge graph and the current risk deviation characteristics.

[0006] Preferably, constructing a dynamic risk knowledge graph when users access financial data specifically includes: Extract user entities, data asset entities, and access operation events from user access logs. User entities and data asset entities constitute graph nodes, and access operation events serve as relational edges connecting the nodes. Access time, source address, and business scenario information are used as attributes and associated with corresponding relationship edges to construct an initial risk knowledge graph; The new access logs are parsed in real time by a stream processing engine and converted into entities and relational events in a knowledge graph. The nodes, edges and their attributes are updated incrementally to achieve the dynamic evolution of the risk knowledge graph.

[0007] Preferably, extracting historical behavior deviations associated with the current user, anomaly indices associated with the current access context, and sensitivity levels associated with the target data assets from the dynamic risk knowledge graph, and then fusing them to generate a dynamic risk score for the current access request, specifically includes: By querying the graph structure, we can obtain the pattern subgraph of the current user's historical access behavior, and calculate the degree of difference between the current request and the pattern in terms of time, asset type and operation sequence, as the deviation degree of historical behavior. Retrieve a set of historical access events that are similar to the current context attributes in the dynamic knowledge graph, and generate an anomaly index by calculating the statistical distance between the current context feature vector and the feature distribution of the set; Read the predefined sensitivity level from the attributes of the target data asset node; The historical behavior deviation, anomaly index, and sensitivity level are weighted and fused to obtain the dynamic risk score of the current access request.

[0008] Preferably, setting a risk baseline based on the user's role and the current business scenario specifically includes: Based on the user's role, query the pre-configured role-risk baseline table to obtain the basic risk value; Identify the business scenario to which the current access request belongs, and obtain the risk adjustment coefficient corresponding to that scenario; The risk baseline applicable to the current business scenario is calculated by multiplying the basic risk value by the risk adjustment coefficient.

[0009] Preferably, the deviation between the dynamic risk score of the current access request and the risk baseline is calculated. When the deviation continuously exceeds the scenario adaptive threshold derived from historical statistics, a privacy risk warning is triggered. Specifically, this includes: Calculate the absolute difference between the dynamic risk score and the risk baseline as the instantaneous deviation value; The instantaneous deviation value is continuously monitored within the set time window; When the instantaneous deviation value is detected to exceed the comparison threshold in N consecutive calculations, it is determined that the deviation value continuously exceeds the scene adaptive threshold, where N≥2.

[0010] Preferably, determining and implementing a dynamic privacy protection intervention strategy based on the risk contribution weights of associated paths in the dynamic risk knowledge graph and the current risk deviation characteristics specifically includes: Identify the core risk factors that cause deviations in dynamic risk scores; In the dynamic knowledge graph, all associated paths from the current user node to the target data asset node are searched and enumerated, and the risk contribution weight of each associated path is calculated. Based on the type of the core risk factor and the associated path corresponding to the highest risk contribution weight, the corresponding intervention strategy is matched and triggered from the strategy mapping rules. The intervention strategy includes data anonymization, access blocking, enhanced authentication, and audit trail. The strategy execution results are then treated as structured events and updated in the dynamic risk knowledge graph.

[0011] Preferably, the scene adaptive threshold setting includes: For a given business scenario, collect the dynamic risk score of its historical access requests and the deviation value sequence of the corresponding risk baseline, and calculate the mean and standard deviation of the deviation value sequence. Obtain the preset risk tolerance parameters for a specified business scenario; Based on the mean and standard deviation, as well as the risk tolerance parameter, set the scenario-adaptive dynamic threshold for the specified business scenario.

[0012] Secondly, this application provides a knowledge graph-based financial data privacy protection system, including: The knowledge graph construction module is used to build a dynamic risk knowledge graph when users access financial data. The risk scoring determination module is used to extract, for the current access request, the historical behavior deviation degree associated with the current user, the anomaly index associated with the current access context, and the sensitivity level associated with the target data asset from the dynamic risk knowledge graph, and then integrate them to generate a dynamic risk score for the current access request. The privacy risk warning module is used to set a risk baseline based on the user's identity role and the current business scenario, calculate the deviation value between the dynamic risk score of the current access request and the risk baseline, and determine that a privacy risk warning is triggered when the deviation value continuously exceeds the scenario adaptive threshold derived from historical statistics. The privacy protection execution module is used to determine and execute dynamic privacy protection intervention strategies based on the risk contribution weights of associated paths in the dynamic risk knowledge graph and the current risk deviation characteristics when a privacy risk warning is triggered.

[0013] Thirdly, this application provides a computer device including a memory and a processor, the memory storing code, and the processor being configured to acquire the code and execute the above-described knowledge graph-based financial data privacy protection method.

[0014] Fourthly, this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the aforementioned knowledge graph-based financial data privacy protection method.

[0015] The technical solutions provided by the embodiments disclosed in this application have the following beneficial effects: In this embodiment, firstly, a dynamic risk knowledge graph is constructed with user entities and data asset entities as core nodes and access operation events as associated edges. Based on real-time generated user behavior sequences and access contexts, the node relationships are dynamically and incrementally updated. This transforms financial data access behavior from discrete log records into a sustainably evolving structured risk model, effectively solving the problem in existing technologies where risk perception remains static and fails to reflect behavioral trends. Secondly, at the risk assessment level, historical behavior deviation, context anomaly index, and data asset sensitivity level are simultaneously extracted from the dynamic risk knowledge graph. These multi-dimensional risk features are then fused and calculated, enabling the risk score to simultaneously reflect long-term user behavior characteristics, current access environment changes, and the sensitive attributes of the data itself, thereby improving the accuracy of privacy risk quantification assessment. The solution prioritizes real-time performance to ensure rapid detection of potential risks. Then, by introducing a risk baseline and scenario-adaptive threshold mechanism based on identity roles and business scenarios, it continuously compares dynamic risk scores with acceptable risk ranges, effectively distinguishing between normal business fluctuations and genuine privacy risks. This reduces false alarm rates while enhancing real-time monitoring of risk accumulation, enabling rapid and scenario-specific privacy risk warnings. Finally, at the risk management level, the solution leverages the association paths between user nodes and data asset nodes in the dynamic risk knowledge graph. It calculates path-level risk contribution weights based on current risk deviation characteristics, structurally identifying key paths and core factors contributing to risks. Based on this, it matches and executes differentiated privacy protection intervention strategies, while simultaneously writing the results back into the knowledge graph for continuous iteration and dynamic optimization of risk awareness. In summary, this solution organically combines risk modeling, dynamic scoring, real-time monitoring, and closed-loop intervention to achieve dynamic evolution modeling of financial data access risks based on knowledge graphs, thereby improving the real-time response capability for privacy risk identification. Attached Figure Description

[0016] Figure 1 This is an exemplary flowchart illustrating a knowledge graph-based financial data privacy protection method according to some embodiments of this application; Figure 2 This is a schematic diagram of the process for determining a dynamic risk score according to some embodiments of this application; Figure 3 This is a schematic diagram of the process for setting adaptive thresholds for a scenario, according to some embodiments of this application; Figure 4 This is a schematic diagram of the structure of a knowledge graph-based financial data privacy protection system according to some embodiments of this application; Figure 5 This is a schematic diagram of the structure of a computer device implementing a knowledge graph-based financial data privacy protection method according to some embodiments of this application. Detailed Implementation

[0017] To better understand the technical solution of this application, the technical solution of this application will be described in detail below with reference to the accompanying drawings and specific embodiments.

[0018] refer to Figure 1 The figure is an exemplary flowchart of a knowledge graph-based financial data privacy protection method according to some embodiments of this application. The knowledge graph-based financial data privacy protection method mainly includes the following steps: In step 101, a dynamic risk knowledge graph is constructed when a user accesses financial data. The dynamic risk knowledge graph uses users and data assets as entity nodes and access operation events as associated edges. The node association relationships are dynamically and incrementally updated based on real-time generated user behavior sequences and access contexts.

[0019] In some embodiments, constructing a dynamic risk knowledge graph when a user accesses financial data can be achieved through the following steps: Extract user entities, data asset entities, and access operation events from user access logs. User entities and data asset entities constitute graph nodes, and access operation events serve as relational edges connecting the nodes. Access time, source address, and business scenario information are used as attributes and associated with corresponding relationship edges to construct an initial risk knowledge graph; The new access logs are parsed in real time by a stream processing engine and converted into entities and relational events in a knowledge graph. The nodes, edges and their attributes are updated incrementally to achieve the dynamic evolution of the risk knowledge graph.

[0020] To aid in understanding this application, it is now explained that: the dynamic risk knowledge graph uses users and data assets as entity nodes, access operation events as associated edges, and dynamically and incrementally updates the node relationships based on real-time generated user behavior sequences and access contexts; graph nodes are structured risk-bearing units used to represent the financial data access subjects and access objects; relationship edges are risk connection units used to represent the access behavior relationships between user entities and data asset entities; dynamic evolution is used to reflect the state update process of entity relationships in the risk knowledge graph as access behavior changes.

[0021] In the specific implementation of this application, firstly, the user access logs generated by the financial system are parsed. According to pre-defined field rules, user identification information is identified as user entities, and accessed data identification information is identified as data asset entities. Each access behavior is abstracted as an access operation event. Then, user entities and data asset entities are written into a graph database as graph nodes, and access operation events are written into the graph database as relational edges connecting the corresponding user entity nodes and data asset entity nodes. This transforms the raw log data into a data representation with a relational structure. Finally, user entities and data asset entities are used as graph nodes, and access operation events are used as relational edges. Then, based on the established relational edges, the access time information, source address information, and business scenario information corresponding to the access logs are extracted and bound as attribute fields to the corresponding access operation event relational edges. In this process, each relation edge carries a complete access context description. This method unifies user entities, data asset entities, access operation events, and access context attributes within the same graph structure, forming a graph data set that reflects basic access relationships and risk elements, thus constructing an initial risk knowledge graph. Finally, a stream processing engine is deployed to continuously receive new user access logs. Following the same entity extraction and attribute association rules as in steps one and two, the new logs are parsed in real time. The parsed user entities, data asset entities, and access operation events are converted into graph nodes and relation edges, respectively. For existing nodes and relationships, their attribute values ​​are updated; for new nodes and relationships, they are directly written to the graph database. This incremental update of nodes, edges, and their attributes enables continuous changes in the risk knowledge graph's state, ultimately achieving dynamic evolution and resulting in a dynamic risk knowledge graph.

[0022] In step 102, for the current access request, the historical behavior deviation associated with the current user, the anomaly index associated with the current access context, and the sensitivity level associated with the target data asset are extracted from the dynamic risk knowledge graph, and then fused to generate a dynamic risk score for the current access request.

[0023] In some embodiments, reference Figure 2 As shown in the figure, this is a flowchart illustrating the process of determining a dynamic risk score in some embodiments of this application. In this embodiment, the following steps can be used to extract the historical behavior deviation associated with the current user, the anomaly index associated with the current access context, and the sensitivity level associated with the target data asset from the dynamic risk knowledge graph, and then fuse them to generate a dynamic risk score for the current access request: In step 1021, a pattern subgraph of the current user's historical access behavior is obtained through graph structure query, and the difference between the current request and the pattern in terms of time, asset type and operation sequence is calculated as the deviation of historical behavior. In step 1022, a set of historical access events similar to the current context attributes is retrieved from the dynamic knowledge graph, and an anomaly index is generated by calculating the statistical distance between the current context feature vector and the feature distribution of the set. In step 1023, the predefined sensitivity level is read from the attributes of the target data asset node; In step 1024, the historical behavior deviation, anomaly index and sensitivity level are weighted and fused to obtain the dynamic risk score of the current access request.

[0024] To aid in understanding this application, the following is explained: Historical Behavior Deviation is a behavioral anomaly indicator used to characterize the degree of deviation of the current access request from the user's existing access behavior patterns; Anomaly Index is an environmental risk indicator used to characterize the degree of anomaly of the current access context compared to similar historical access contexts; Sensitivity Level is a data attribute indicator used to characterize the importance of the target data asset in terms of privacy protection; Dynamic Risk Score is a risk indicator that comprehensively reflects the overall privacy risk level of the current access request.

[0025] In the specific implementation of this application, firstly, in the dynamic risk knowledge graph, starting from the user entity node corresponding to the current user, a graph structure query is performed to extract the set of access relationships formed by the user during historical access. The set of access relationships includes the data asset entity nodes associated with it and the access operation event relationship edges, thereby constructing a subgraph of the user's historical access behavior pattern. Then, for the current access request, the behavioral characteristics of the current access request are compared with the statistical characteristics in the historical access behavior pattern subgraph from three dimensions: access time distribution, access data asset type distribution, and access operation sequence. The degree of difference between the two is calculated, and this degree of difference is used as the historical behavior deviation degree to characterize abnormal behavior. By comparing it with the user's own historical behavior pattern, access risks that deviate from the user's normal behavioral habits can be effectively identified. Secondly, in the dynamic risk knowledge graph, based on the access time and source address carried by the current access request... The system retrieves historical access operation event relationships similar to the context attributes, including business scenarios, and aggregates them into a historical access event set. Based on this, the context attributes of the current access request are converted into corresponding feature descriptions, and statistical differences are calculated between these descriptions and the context feature distribution reflected in the historical access event set. This yields a numerical result reflecting the degree of anomaly in the current context, which is used as an anomaly index. By comparing this index with historical behaviors in similar access scenarios, it avoids misjudging normal, high-frequency business behaviors as anomalies. Then, the system locates the target data asset entity node corresponding to the current access request in the dynamic risk knowledge graph and directly reads pre-configured data sensitivity level information from the attribute fields of this data asset entity node. This data sensitivity level information reflects the potential risk impact of the data asset in the event of privacy breaches, thereby obtaining the sensitivity level corresponding to the target data asset.Finally, after obtaining the historical behavior deviation, anomaly index, and sensitivity level, normalization is performed. Then, based on the importance of each risk indicator in the overall privacy risk assessment, a preset weighting coefficient is used to assign corresponding weights to the historical behavior deviation, anomaly index, and sensitivity level, and linear calculation is performed to obtain a numerical result that uniformly reflects the comprehensive risk level of the current access request, thus forming a dynamic risk score for the current access request. It should be further noted that in this scheme, the weighting coefficients of each risk indicator need to be reasonably allocated according to the actual business scenario, historical access behavior characteristics, and data sensitivity requirements. Typically, this can be achieved by... The following method is used to determine the risk score: First, statistical analysis is performed on historical access logs to assess the contribution of historical behavior deviation, anomaly index, and sensitivity level to triggering past risk events, thus obtaining the initial impact weight of each indicator. Then, based on the privacy protection requirements of financial businesses, the weight of the sensitivity level can be appropriately adjusted to give a higher proportion of access to highly sensitive data in the risk score. Finally, to ensure the consistency of weights and the overall risk score, the weight coefficients are normalized so that their sum equals 1. This ensures that each indicator contributes proportionally to the risk score in the fusion calculation. This method can take into account historical behavior patterns, contextual anomalies, and data sensitivity, ensuring that the dynamic risk score accurately reflects the comprehensive privacy risk level of the access request.

[0026] In step 103, a risk baseline is set according to the user's identity role and the current business scenario. The deviation value between the dynamic risk score of the current access request and the risk baseline is calculated. When the deviation value continues to exceed the scenario adaptive threshold derived from historical statistics, a privacy risk warning is triggered.

[0027] In some embodiments, setting a risk baseline based on the user's role and the current business scenario can be achieved through the following steps: Based on the user's role, query the pre-configured role-risk baseline table to obtain the basic risk value; Identify the business scenario to which the current access request belongs, and obtain the risk adjustment coefficient corresponding to that scenario; The risk baseline applicable to the current business scenario is calculated by multiplying the basic risk value by the risk adjustment coefficient.

[0028] To aid in understanding this application, the following is provided: the basic risk value is an indicator used to characterize the default risk level of different user roles under standard business conditions; the risk adjustment coefficient is an adjustable coefficient reflecting the degree of impact of the current business scenario on the risk of access requests; and the risk baseline is a comprehensive indicator used to determine the tolerable risk reference value of the current access request under a specific role and business scenario.

[0029] In the specific implementation of this application, firstly, a role-risk baseline table is pre-established, mapping all user roles in the financial system to their corresponding default risk levels. Each record in the table includes a role identifier and a basic risk value field. When an access request arrives, the system queries the table based on the current user's role to obtain the corresponding basic risk value, which serves as the starting point for subsequent risk calculations. Secondly, the system identifies the business scenario of the current access request. By parsing the business identifier, operation type, or application module information carried in the access request, it matches a pre-defined business scenario classification table to obtain the risk adjustment coefficient for the corresponding scenario. The risk adjustment coefficient reflects the risk amplification or reduction effect of the access request under the business scenario. Then, the obtained basic risk value and the risk adjustment coefficient are mathematically calculated, typically using multiplication, to amplify or reduce the basic risk value according to the scenario coefficient, thereby obtaining a risk baseline that meets the requirements of the current user's role and business scenario. This risk baseline is used for subsequent deviation comparison with dynamic risk scoring.

[0030] Preferably, in some embodiments, reference is made to Figure 3 As shown in the figure, this is a flowchart illustrating the process of setting a scene adaptive threshold in some embodiments of this application. In this embodiment, the scene adaptive threshold setting can be implemented using the following steps: In step 1031, for a specified business scenario, the deviation sequence of the dynamic risk score of its historical access requests and the corresponding risk baseline is collected, and the mean and standard deviation of the deviation sequence are calculated. In step 1032, the preset risk tolerance parameters for the specified business scenario are obtained; In step 1033, a scenario-adaptive dynamic threshold for a specified business scenario is set based on the mean and standard deviation and the risk tolerance parameter.

[0031] To aid in understanding this application, it is hereby explained that: the deviation value sequence is a data set used to reflect the continuous deviation of the dynamic risk score of historical access requests from the risk baseline under a specified business scenario; the risk tolerance parameter is an adjustable numerical indicator reflecting the acceptable risk level under a specified business scenario.

[0032] In the specific implementation of this application, firstly, for a specified business scenario, the dynamic risk score of the corresponding access request is extracted from the historical access log, and the deviation value of each access record is calculated using the pre-set risk baseline, forming a time-sorted sequence of deviation values. Then, the mean and standard deviation of this sequence are calculated to characterize the central tendency and fluctuation range of access risk in the business scenario. Secondly, for a specified business scenario, the system calls the pre-configured business risk strategy table to obtain the risk tolerance parameter for the corresponding scenario. This parameter reflects the allowable risk fluctuation range of the business. It should be further noted that the specific setting of the risk tolerance parameter can be based on the risk distribution of historical access behavior. For example, a lower tolerance ratio, such as 0.3, can be set for highly sensitive scenarios, and a higher tolerance ratio, such as 1.0, can be set for low-sensitivity scenarios. This is only an example and is not intended to limit the specific scope of the invention. Then, based on the deviation... The mean and standard deviation of the difference sequence, along with a risk tolerance parameter, are used to calculate a scenario-adaptive dynamic threshold through a linear combination. The mean is used as a basic reference value, the standard deviation reflects the fluctuation range, and the risk tolerance parameter is used to amplify or narrow the threshold range, thereby obtaining an adaptive threshold that conforms to the current business scenario. In other words, the calculation result is used as the scenario-adaptive dynamic threshold. The risk tolerance parameter is used to adjust the standard deviation. This is because the mean of the historical deviation value sequence can quantify the concentration level of access request risk in a specified business scenario, the standard deviation can characterize the risk fluctuation range, and the risk tolerance parameter is used to adjust the standard deviation according to the acceptable risk level of the business. This precisely controls the sensitivity of the threshold, enabling it to cover normal fluctuations while having a timely response capability to continuous abnormal deviations. This achieves dynamic adaptation and scenario differentiation of the threshold, improving the accuracy and technical reliability of privacy risk warnings.

[0033] In some embodiments, the deviation between the dynamic risk score of the current access request and the risk baseline is calculated. When the deviation continuously exceeds a scenario adaptive threshold derived from historical statistics, triggering a privacy risk warning can be achieved through the following steps: Calculate the absolute difference between the dynamic risk score and the risk baseline as the instantaneous deviation value; The instantaneous deviation value is continuously monitored within the set time window; When the instantaneous deviation value is detected to exceed the comparison threshold in N consecutive calculations, it is determined that the deviation value continuously exceeds the scene adaptive threshold, where N≥2.

[0034] To aid in understanding this application, it is hereby explained that: the instant deviation value is a numerical indicator that quantifies the degree of deviation of the dynamic risk score of the current access request from the risk baseline; the time window is a fixed observation period used to limit the continuous monitoring of the instant deviation value; and the scenario adaptive threshold is an adjustable reference value used to determine whether continuous deviation behavior meets the conditions for triggering a privacy risk warning.

[0035] In the specific implementation of this application, firstly, after receiving the dynamic risk score of the current access request, the system compares the dynamic risk score with the risk baseline set based on the user's identity role and business scenario. By calculating the absolute value of the difference between the two, an instantaneous deviation value is obtained to quantify the degree of risk deviation of the access request. Secondly, a predetermined time window is set, and the instantaneous deviation values ​​of all access requests generated within this time window are continuously recorded and monitored in real time, and stored in time series for subsequent analysis. The time window is defined as the observation period for continuously monitoring the instantaneous deviation value. Then, when the instantaneous deviation value is detected to exceed the comparison threshold, the system determines whether the threshold condition is met in N consecutive calculations, where N is preset to be no less than 2 to ensure the persistence of the deviation. When the condition is met, the continuous deviation behavior is identified as the deviation value continuously exceeding the scenario adaptive threshold, which is used to trigger a privacy risk warning.

[0036] In step 104, when a privacy risk warning is triggered, a dynamic privacy protection intervention strategy is determined and executed based on the risk contribution weight of the associated paths in the dynamic risk knowledge graph and the current risk deviation characteristics.

[0037] In some embodiments, determining and implementing a dynamic privacy protection intervention strategy based on the risk contribution weights of associated paths in the dynamic risk knowledge graph and the current risk deviation characteristics can be achieved through the following steps: Identify the core risk factors that cause deviations in dynamic risk scores; In the dynamic knowledge graph, all associated paths from the current user node to the target data asset node are searched and enumerated, and the risk contribution weight of each associated path is calculated. Based on the type of the core risk factor and the associated path corresponding to the highest risk contribution weight, the corresponding intervention strategy is matched and triggered from the strategy mapping rules. The intervention strategy includes data anonymization, access blocking, enhanced authentication, and audit trail. The strategy execution results are then treated as structured events and updated in the dynamic risk knowledge graph.

[0038] To aid in understanding this application, the following explanation is provided: Core risk factors are risk characterization elements used to depict the anomaly types in the current access request that contribute the most to the deviation of the dynamic risk score; Risk contribution weights are path-level risk measures that quantify the impact of each associated path from the user node to the data asset node on the current privacy risk; Intervention strategies are control and enforcement measures used to suppress risks and protect privacy in real time for high-risk access requests, including data anonymization, access blocking, enhanced authentication, and audit trails; Structured events refer to standardized graph update units that record risk analysis results and intervention processes.

[0039] In the specific implementation of this application, firstly, after triggering a privacy risk warning, the contribution analysis of each risk indicator involved in the risk scoring calculation is performed based on the deviation between the dynamic risk score of the current access request and the risk baseline. This identifies the source of the indicator causing the largest deviation in the current score, such as an abnormally high abnormal index, a significant increase in historical behavior deviation, or a high sensitivity level. Then, the risk source categories corresponding to the indicators with the largest contribution are categorized to form core risk factors that directly reflect the root cause of the current risk anomaly, thus providing a clear direction for subsequent path analysis and strategy matching. Secondly, after determining the core risk factors, all related paths between the current user node and the target data asset node are retrieved and enumerated in the dynamic risk knowledge graph. For each related path, the sensitivity attributes of the nodes included in the path, the abnormal indicators carried by the relational edges in the path, and the amplification effect of the path length on risk propagation are comprehensively evaluated. Corresponding numerical results are generated according to a unified path risk calculation rule, making different paths comparable on the same scale, thereby highlighting the most influential factors on the current risk. The path of influence is calculated, and the calculated results are used as risk contribution weights. Then, after obtaining the risk contribution weights of each associated path, the associated path with the highest risk contribution weight is selected as the key analysis object. Combined with the core risk factor type corresponding to the path, a matching judgment is made against the pre-configured strategy mapping rules. When the core risk factor reflects the risk of sensitive data exposure, the data desensitization strategy is triggered first. When the risk manifests as abnormal access behavior, the enhanced authentication or access blocking strategy is triggered. When the risk needs to be traced back afterward, the audit trail strategy is triggered, thereby ensuring that the intervention method directly corresponds to the risk cause and achieves precise handling. The matched and executed control measures are used as intervention strategies. Finally, after the intervention strategy is executed, the key analysis results of this privacy risk warning are structured and encapsulated, including the identified core risk factors, the corresponding high-risk associated paths, the path risk contribution weights, and the actual triggered intervention strategy type and execution results. The above information is then written into the dynamic risk knowledge graph as a new event entity or relationship attribute, so that the graph can continuously accumulate risk evolution and handling experience, providing historical basis for subsequent risk assessment and strategy optimization.

[0040] It should also be noted that this embodiment further maps the dynamic risk scoring results to the knowledge graph structure level, realizing a closed-loop transformation from risk identification to risk management. Its function is to accurately locate the path of privacy risk based on the current risk deviation characteristics and implement targeted intervention. Specifically, by first identifying the core risk factors that cause the dynamic risk score deviation, the source of risk is transformed from an abstract score into an interpretable risk type. Then, the risk contribution weight is calculated by combining the association path between user nodes and data asset nodes in the dynamic risk knowledge graph. This highlights the key path with the greatest impact on the current risk when multiple paths coexist, avoiding relying solely on a single threshold to trigger coarse-grained control. On this basis, differentiated intervention strategies are matched according to the core risk factor type and the characteristics of the highest risk contribution path, ensuring that the intervention measures are consistent with the risk causes. This reduces unnecessary access blocking and improves the effectiveness of privacy protection. Finally, by writing the management results back to the dynamic risk knowledge graph, the risk cognition and intervention experience are continuously accumulated, thereby improving the adaptability and stability of the entire financial data privacy protection mechanism.

[0041] On the other hand, in some embodiments, this application provides a knowledge graph-based financial data privacy protection system, referencing... Figure 4 The figure is a schematic diagram of the structure of a knowledge graph-based financial data privacy protection system according to some embodiments of this application. The knowledge graph-based financial data privacy protection system 400 includes: a knowledge graph construction module 401, a risk scoring determination module 402, a privacy risk early warning module 403, and a privacy protection execution module 404, which are described below: Knowledge graph construction module 401, in this application, is used to construct a dynamic risk knowledge graph when a user accesses financial data; Risk scoring determination module 402, in this application, is used to extract, for the current access request, the historical behavior deviation degree associated with the current user, the abnormal index associated with the current access context, and the sensitivity level associated with the target data asset from the dynamic risk knowledge graph, and then fuse them to generate a dynamic risk score for the current access request. Privacy risk warning module 403: In this application, privacy risk warning module 403 is used to set a risk baseline based on the user's identity role and the current business scenario, calculate the deviation value between the dynamic risk score of the current access request and the risk baseline, and determine that a privacy risk warning is triggered when the deviation value continuously exceeds the scenario adaptive threshold derived from historical statistics. Privacy protection execution module 404, in this application, is used to determine and execute a dynamic privacy protection intervention strategy based on the risk contribution weight of the associated path in the dynamic risk knowledge graph and the current risk deviation characteristics when a privacy risk warning is triggered.

[0042] In addition, this application also provides a computer device, the computer device including a memory and a processor, the memory storing code, and the processor being configured to acquire the code and execute the above-described knowledge graph-based financial data privacy protection method.

[0043] In some embodiments, reference Figure 5 The figure is a schematic diagram of the structure of a computer device implementing a knowledge graph-based financial data privacy protection method according to some embodiments of this application. The knowledge graph-based financial data privacy protection method in the above embodiments can... Figure 5 The computer device shown is used to implement this, and the computer device 500 includes at least one processor 501, a communication bus 502, a memory 503, and at least one communication interface 504.

[0044] Processor 501 can be a general-purpose central processing unit (CPU) or an application-specific integrated circuit (ASIC).

[0045] The communication bus 502 can be used to transmit information between the aforementioned components.

[0046] Memory 503 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CDROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital versatile optical discs, Blu-ray discs, etc.), magnetic disks or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto. Memory 503 may exist independently and be connected to processor 501 via communication bus 502. Memory 503 may also be integrated with processor 501.

[0047] The memory 503 stores program code that executes the scheme of this application, and its execution is controlled by the processor 501. The processor 501 executes the program code stored in the memory 503. The program code may include one or more software modules. The knowledge graph-based financial data privacy protection method in the above embodiments can be implemented by the processor 501 and one or more software modules in the program code in the memory 503.

[0048] Communication interface 504 uses any transceiver-like device to communicate with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), etc.

[0049] In a specific implementation, as one example, a computer device may include multiple processors, each of which may be a single-core (single CPU) processor or a multi-core (multi CPU) processor. Here, a processor may refer to one or more devices, circuits, and / or processing cores used to process data (e.g., computer program instructions).

[0050] The aforementioned computer device can be a general-purpose computer device or a special-purpose computer device. In specific implementations, the computer device can be a desktop computer, a portable computer, a network server, a handheld digital assistant (PDA), a mobile phone, a tablet computer, a wireless terminal device, a communication device, or an embedded device. This application does not limit the type of computer device.

[0051] In addition, this application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described knowledge graph-based financial data privacy protection method.

[0052] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0053] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A knowledge graph-based method for protecting the privacy of financial data, characterized in that, include: A dynamic risk knowledge graph is constructed when users access financial data. The dynamic risk knowledge graph uses users and data assets as entity nodes and access operation events as associated edges. The node association relationship is dynamically and incrementally updated based on real-time generated user behavior sequences and access context. For the current access request, the dynamic risk knowledge graph extracts the historical behavior deviation associated with the current user, the anomaly index associated with the current access context, and the sensitivity level associated with the target data asset, and then integrates them to generate a dynamic risk score for the current access request. A risk baseline is set based on the user's identity and current business scenario. The deviation between the dynamic risk score of the current access request and the risk baseline is calculated. When the deviation exceeds the scenario adaptive threshold derived from historical statistics, a privacy risk warning is triggered. When a privacy risk warning is triggered, a dynamic privacy protection intervention strategy is determined and executed based on the risk contribution weight of the associated paths in the dynamic risk knowledge graph and the current risk deviation characteristics.

2. The method as described in claim 1, characterized in that, Constructing a dynamic risk knowledge graph based on user access to financial data specifically includes: Extract user entities, data asset entities, and access operation events from user access logs. User entities and data asset entities constitute graph nodes, and access operation events serve as relational edges connecting the nodes. Access time, source address, and business scenario information are used as attributes and associated with corresponding relationship edges to construct an initial risk knowledge graph; The new access logs are parsed in real time by a stream processing engine and converted into entities and relational events in a knowledge graph. The nodes, edges and their attributes are updated incrementally to achieve the dynamic evolution of the risk knowledge graph.

3. The method as described in claim 1, characterized in that, Extracting historical behavioral deviations associated with the current user, anomaly indices associated with the current access context, and sensitivity levels associated with the target data assets from the dynamic risk knowledge graph, and then fusing them to generate a dynamic risk score for the current access request, specifically includes: By querying the graph structure, we can obtain the pattern subgraph of the current user's historical access behavior, and calculate the degree of difference between the current request and the pattern in terms of time, asset type and operation sequence, as the deviation degree of historical behavior. Retrieve a set of historical access events that are similar to the current context attributes in the dynamic knowledge graph, and generate an anomaly index by calculating the statistical distance between the current context feature vector and the feature distribution of the set; Read the predefined sensitivity level from the attributes of the target data asset node; The historical behavior deviation, anomaly index, and sensitivity level are weighted and fused to obtain the dynamic risk score of the current access request.

4. The method as described in claim 1, characterized in that, Setting risk baselines based on user roles and current business scenarios specifically includes: Based on the user's role, query the pre-configured role-risk baseline table to obtain the basic risk value; Identify the business scenario to which the current access request belongs, and obtain the risk adjustment coefficient corresponding to that scenario; The risk baseline applicable to the current business scenario is calculated by multiplying the basic risk value by the risk adjustment coefficient.

5. The method as described in claim 1, characterized in that, Calculate the deviation between the dynamic risk score of the current access request and the risk baseline. When the deviation continuously exceeds the scenario adaptive threshold derived from historical statistics, a privacy risk warning is triggered, specifically including: Calculate the absolute difference between the dynamic risk score and the risk baseline as the instantaneous deviation value; The instantaneous deviation value is continuously monitored within the set time window; When the instantaneous deviation value is detected to exceed the comparison threshold in N consecutive calculations, it is determined that the deviation value continuously exceeds the scene adaptive threshold, where N≥2.

6. The method as described in claim 1, characterized in that, Based on the risk contribution weights of the associated paths in the dynamic risk knowledge graph and the current risk deviation characteristics, a dynamic privacy protection intervention strategy is determined and implemented, specifically including: Identify the core risk factors that cause deviations in dynamic risk scores; In the dynamic knowledge graph, all associated paths from the current user node to the target data asset node are searched and enumerated, and the risk contribution weight of each associated path is calculated. Based on the type of the core risk factor and the associated path corresponding to the highest risk contribution weight, the corresponding intervention strategy is matched and triggered from the strategy mapping rules. The intervention strategy includes data anonymization, access blocking, enhanced authentication, and audit trail. The strategy execution results are then treated as structured events and updated in the dynamic risk knowledge graph.

7. The method as described in claim 1, characterized in that, The scene adaptive threshold setting includes: For a given business scenario, collect the dynamic risk score of its historical access requests and the deviation value sequence of the corresponding risk baseline, and calculate the mean and standard deviation of the deviation value sequence. Obtain the preset risk tolerance parameters for a specified business scenario; Based on the mean and standard deviation, as well as the risk tolerance parameter, set the scenario-adaptive dynamic threshold for the specified business scenario.

8. A knowledge graph-based financial data privacy protection system, characterized in that, include: The knowledge graph construction module is used to build a dynamic risk knowledge graph when users access financial data. The risk scoring determination module is used to extract, for the current access request, the historical behavior deviation degree associated with the current user, the anomaly index associated with the current access context, and the sensitivity level associated with the target data asset from the dynamic risk knowledge graph, and then integrate them to generate a dynamic risk score for the current access request. The privacy risk warning module is used to set a risk baseline based on the user's identity role and the current business scenario, calculate the deviation value between the dynamic risk score of the current access request and the risk baseline, and determine that a privacy risk warning is triggered when the deviation value continuously exceeds the scenario adaptive threshold derived from historical statistics. The privacy protection execution module is used to determine and execute dynamic privacy protection intervention strategies based on the risk contribution weights of associated paths in the dynamic risk knowledge graph and the current risk deviation characteristics when a privacy risk warning is triggered.

9. A computer device comprising a memory and a processor, the memory storing code, characterized in that, The processor is configured to acquire the code and execute the knowledge graph-based financial data privacy protection method as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the knowledge graph-based financial data privacy protection method as described in any one of claims 1 to 7.

Images