A data classification and dynamic desensitization method based on adaptive sensitivity identification

Abstract

This invention discloses an adaptive sensitivity identification data classification and dynamic desensitization method and system, comprising: acquiring field value sequences, inter-field mutual information coefficient sequences, and field modification timestamp sequences; extracting local anomaly density features from the field value sequences and fluctuation amplitude features from the mutual information coefficient sequences, and cross-validating them to generate anomaly coupling strength values; extracting jump clustering features from the modification timestamp sequences and pattern drift features from the field value sequences, and cross-validating them to generate mutation correlation values; performing propagation impact analysis based on historical decryption statistics of secret categories, combined with anomaly coupling strength values ​​and mutation correlation values, predicting the degree of confidentiality impact of the current field's decryption on subsequent fields, and mapping it to a desensitization benchmark level; performing corresponding strength desensitization operations on subsequent fields; and updating the historical statistical information with the actual decryption leakage results. This invention achieves adaptive sensitivity classification and dynamic desensitization without manual annotation.

Description

Technical Field

[0001] This invention relates to the field of data security and privacy protection technology, specifically to a data classification and dynamic desensitization method and system with adaptive sensitivity identification. Background Technology

[0002] With the rapid development of big data and cloud computing, data security and privacy protection have become significant challenges for enterprises and institutions. Data classification and dynamic anonymization are core technologies for data security protection, aiming to implement differentiated anonymization measures based on the sensitivity of the data to prevent the leakage of sensitive information. Current technologies primarily rely on predefined sensitive word libraries, regular expression matching, or static rule bases for data sensitivity identification. These methods have fixed rules and are difficult to adapt to dynamic changes in data distribution and usage patterns. Furthermore, existing methods typically perform single-dimensional matching based only on field names or content, neglecting multi-dimensional dynamic information such as the temporal anomalies of field values, the fluctuation characteristics of relationships between fields, the clustering and jumping characteristics of modification behaviors, and the pattern drift characteristics of value sequences. These characteristics often reflect the actual sensitivity of the data from different perspectives.

[0003] Furthermore, existing methods lack an assessment mechanism for the potential diffusion risk of a single-field decryption leak to other fields within the same type of secret when determining desensitization strategies. They also fail to adaptively adjust subsequent desensitization intensity based on the actual occurrence of historical decryption events. Therefore, a method is needed that integrates multi-dimensional dynamic feature extraction and verification, combines historical decryption leakage trends for propagation impact analysis, and continuously and adaptively adjusts the desensitization strategy based on feedback results. Summary of the Invention

[0004] To overcome the aforementioned deficiencies in existing technologies, this invention provides a data classification and dynamic desensitization method and system for adaptive sensitivity identification, aiming to achieve adaptive identification of sensitivity levels and dynamic evolution of the rule base through multi-dimensional feature extraction and cross-verification.

[0005] To achieve the above objectives, the present invention adopts the following technical solution.

[0006] In a first aspect, the present invention provides a data hierarchical classification and dynamic desensitization method with adaptive sensitivity identification, comprising the following steps: S1: Obtain the sequence of field values, the sequence of mutual information coefficients between fields, and the sequence of field modification timestamps from the data table; S2: Extract local anomaly density features from the field value sequence, extract fluctuation amplitude features from the inter-field mutual information coefficient sequence, cross-validate the local anomaly density features and fluctuation amplitude features, and generate anomaly coupling strength values ​​for the fields. S3: Extract jump clustering features from the field modification timestamp sequence, extract pattern drift features from the field value sequence, cross-validate the jump clustering features and pattern drift features, and generate a mutation correlation value for the field. S4: Based on the historical decryption event statistics of the current field's secret category, as well as the abnormal coupling strength value and mutation correlation value of the current field, predict the degree of confidentiality impact of the current field's decryption on subsequent fields in the same secret category, and generate the sensitivity level of subsequent fields. S5: Use the sensitivity level of the subsequent fields as the desensitization benchmark for the secret category to which the current field belongs, and use it to perform desensitization operations of corresponding desensitization strength on the subsequent fields in the corresponding secret category; S6: Store the result of whether an actual decryption and leakage occurred after this desensitization operation in the historical decryption event statistics information.

[0007] According to the above technical solution, obtaining the field value sequence, the inter-field mutual information coefficient sequence, and the field modification timestamp sequence from the data table includes: S110: The field is sampled in segments according to the preset time window length and sliding step size. The field values ​​collected in each time window are arranged in chronological order and then concatenated to obtain a field value sequence. S120: Calculate the mutual information coefficient of the field pairs within each time window, arrange the mutual information coefficients of all time windows in window order, and obtain the sequence of mutual information coefficients between fields; S130: Extract the modification operation timestamps of the fields from the audit logs, sort the modification operation timestamps in ascending order of time, and obtain the field modification timestamp sequence.

[0008] According to the above technical solution, the steps of extracting local anomaly density features from the field value sequence, extracting fluctuation amplitude features from the inter-field mutual information coefficient sequence, and cross-validating the local anomaly density features and fluctuation amplitude features to generate anomaly coupling strength values ​​for the fields include: S210: After normalizing the field value sequence, construct a delayed embedding vector sequence. Calculate the local anomaly factor of each vector in the delayed embedding vector sequence through local neighborhood. Perform time-decay weighted averaging on the local anomaly factors to obtain the local anomaly density feature of the current field. S220: Perform multi-level discrete wavelet transform on the mutual information coefficient sequence between fields, extract the energy of high-frequency detail sequences at each level, calculate the energy distribution entropy, multiply the energy distribution entropy by the energy proportion of the first layer to obtain the pairwise fluctuation amplitude feature, and accumulate the pairwise fluctuation amplitude features between the current field and all other fields in the data table to obtain the fluctuation amplitude feature of the current field. S230: Normalize the local anomaly density features of the current field to obtain a normalized anomaly density value, and normalize the fluctuation amplitude features of the current field to obtain a normalized fluctuation amplitude value; determine the coordinates of the current point corresponding to the current field using the normalized anomaly density value as the x-axis and the normalized fluctuation amplitude value as the y-axis; set the initial value of the resonance intensity to 0, and set the number of iterations to a preset value; in each iteration, calculate the Manhattan distance from the current point coordinates to the ideal point, calculate the resonance step size based on the Manhattan distance, update the current point coordinates, calculate the resonance increment, and accumulate the resonance increment to the resonance intensity; after the iteration ends, divide the resonance intensity by the number of iterations to obtain the average resonance intensity; normalize the average resonance intensity to obtain the anomaly coupling intensity value.

[0009] According to the above technical solution, the steps of extracting jump clustering features from the field modification timestamp sequence, extracting pattern drift features from the field value sequence, and cross-validating the jump clustering features and pattern drift features to generate a mutation correlation value for the field include: S310: Take the difference between adjacent timestamps in the modification timestamp sequence of the current field as the time interval to obtain the time interval sequence; divide each time interval in the time interval sequence by the median of the time interval sequence to obtain the interval ratio sequence; compare each ratio in the interval ratio sequence with a preset threshold. If the ratio is less than the threshold, mark the corresponding time interval as a dense symbol; otherwise, mark it as a sparse symbol to obtain the symbol sequence; calculate the clustering tendency index based on the ratio of the length of the continuous dense symbol subsequence to the length of the continuous sparse symbol subsequence in the symbol sequence; calculate the coefficient of variation based on the dispersion of the interval ratio sequence; multiply the clustering tendency index by the coefficient of variation to obtain the skip clustering feature. S320: Convert the field value sequence into a pattern sequence, calculate the transition probability of adjacent patterns, calculate the pattern uniformity and transition concentration, and subtract the product of the transition concentration and the pattern uniformity from the value 1 to obtain the pattern drift feature. S330: Normalize the jump clustering features to obtain normalized jump values, and normalize the pattern drift features to obtain normalized drift values; extract jump event time points from the field modification timestamp sequence; extract drift event time points from the pattern sequence; determine the cross-recurrence rate between jump event time points and drift event time points; divide the smaller of the normalized jump value and the normalized drift value by the larger value to obtain the intensity ratio; combine the normalized jump value, normalized drift value, cross-recurrence rate, and intensity ratio to obtain the mutation association degree value.

[0010] According to the above technical solution, the step of predicting the confidentiality impact of the current field's decryption on subsequent fields in its corresponding confidentiality category based on historical decryption event statistics of the current field's secret category, as well as the abnormal coupling strength value and mutation correlation degree value of the current field, and generating the sensitivity level of subsequent fields, includes: S410: Determine the secret category to which the current field belongs by using a preset secret category rule base; S420: Calculate the occurrence rate, impact range diffusion coefficient, and time decay factor of the leakage event corresponding to the secret category from the historical declassification event statistics; S430: Using the abnormal coupling strength value and mutation correlation value of the current field, combined with the leakage event occurrence rate, influence range diffusion coefficient and time decay factor, a propagation impact analysis is performed to obtain the degree of confidentiality impact on subsequent fields after the current field is decrypted. S440: Map the confidentiality impact level to the sensitivity level of subsequent fields.

[0011] According to the above technical solution, the step of using the sensitivity level of subsequent fields as the desensitization benchmark for the secret category to which the current field belongs, and performing desensitization operations with corresponding desensitization strengths on subsequent fields in the corresponding secret category, includes: S510: Use the sensitivity level of subsequent fields as the desensitization benchmark for the secret category to which the current field belongs; S520: Based on the level of the desensitization benchmark, perform desensitization operation on subsequent fields in the secret category to which the current field belongs: if the desensitization benchmark is the first level, then directly output the original value of the subsequent field; if it is the second level, then perform partial masking desensitization; if it is the third level, then perform generalized desensitization; if it is the fourth level, then perform full masking operation.

[0012] According to the above technical solution, storing the result of whether an actual decryption leak occurred after this desensitization operation in the historical decryption event statistics information includes: S610: After completing the sensitivity identification of the field, store the field identifier, identification timestamp, subsequent field sensitivity level, whether actual decryption leakage occurred after this desensitization operation, and the scope of the leakage impact into the historical decryption event statistics information; S620: Periodically perform statistics on all decryption event records of the same secret category, and update the leakage event occurrence rate, impact range diffusion coefficient, and time decay factor in the historical decryption event statistics.

[0013] Secondly, the present invention provides an adaptive sensitivity identification data hierarchical classification and dynamic desensitization system for implementing the above method, the system comprising: The data acquisition module is used to obtain the field value sequence, the inter-field mutual information coefficient sequence, and the field modification timestamp sequence from the data table; The anomaly coupling module is used to extract local anomaly density features from the field value sequence, extract fluctuation amplitude features from the mutual information coefficient sequence between fields, and cross-validate the local anomaly density features and fluctuation amplitude features to generate anomaly coupling strength values ​​for the fields. The mutation association module is used to extract jump clustering features from the field modification timestamp sequence, extract pattern drift features from the field value sequence, cross-validate the jump clustering features and pattern drift features, and generate a mutation association degree value for the field. The decryption analysis module is used to predict the degree of confidentiality impact of the current field being decrypted on subsequent fields in the same confidential category based on the historical decryption event statistics of the current field's secret category, as well as the abnormal coupling strength value and mutation correlation value of the current field, and to generate the sensitivity level of subsequent fields. The dynamic desensitization module is used to use the sensitivity level of subsequent fields as the desensitization benchmark for the secret category to which the current field belongs, and to perform desensitization operations with corresponding desensitization strength on subsequent fields in the corresponding secret category; The log update module is used to store the result of whether an actual decryption and leakage occurred after this de-identification operation into the historical decryption event statistics information.

[0014] Thirdly, the present invention provides an electronic device, including a processor and a memory, wherein the memory stores a computer program, and the processor executes the above-described adaptive sensitivity identification data classification and dynamic desensitization method by calling the computer program stored in the memory.

[0015] Fourthly, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the above-described adaptive sensitivity identification data classification and dynamic desensitization method.

[0016] Compared with the prior art, the present invention has the following advantages and beneficial effects: Compared with existing technologies, this invention has the following advantages and beneficial effects: By extracting local anomaly density, fluctuation amplitude, jump clustering, and pattern drift features from field value sequences, mutual information coefficient sequences, and modification timestamp sequences respectively, and using resonance iteration and cross-recursion rate for mutual verification, the robustness and accuracy of the expression of inherent sensitive features of fields are significantly improved; by constructing a field association network within secret categories and driving risk propagation iteration with anomaly coupling strength values ​​and mutation association degree values, and combining historical decryption statistical parameters to quantitatively predict the confidentiality impact of subsequent fields of the same type after decryption, the shortcomings of existing methods in assessing the risk of decryption diffusion are effectively made up for; by continuously feeding back the actual decryption leakage results after desensitization to historical statistical information and periodically updating statistical parameters, the confidentiality impact prediction model adaptively evolves with the real security situation, avoiding the problem that static thresholds cannot adapt to dynamic changes in the data environment; the entire process does not require manual labeling of sensitivity, secret categories are automatically divided, and the desensitization level is completely determined by the inherent characteristics of the data and historical leakage patterns, forming a complete adaptive closed loop from data collection, feature extraction, propagation analysis, dynamic desensitization to feedback updates. Attached Figure Description

[0017] Other features, objects, and advantages of this application will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings: Figure 1 This is a schematic diagram of the overall process of an adaptive sensitivity identification data classification and dynamic desensitization method provided in an embodiment of this application; Figure 2 This is a detailed flowchart of the data acquisition and sequence construction process provided in the embodiments of this application; Figure 3 This is a detailed diagram of the abnormal coupling strength calculation process provided in the embodiments of this application; Figure 4 This is a detailed diagram of the mutation association degree calculation process provided in the embodiments of this application; Figure 5 This is a detailed flowchart of the decryption impact prediction and sensitivity analysis process provided in the embodiments of this application; Figure 6 This is a detailed diagram of the desensitization benchmark application and desensitization operation process provided in the embodiments of this application; Figure 7 This is a detailed diagram of the historical decryption event information update process provided in the embodiments of this application; Figure 8 This is a schematic diagram of the structure of an adaptive sensitivity identification data classification and dynamic desensitization system provided in an embodiment of this application. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be described in detail and completely below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the scope of this invention.

[0019] Please see Figure 1 , Figure 1 This is a schematic diagram of the overall process of an adaptive sensitivity identification data classification and dynamic desensitization method provided in an embodiment of this application, which specifically includes the following steps: S1: Obtain the sequence of field values, the sequence of mutual information coefficients between fields, and the sequence of field modification timestamps from the data table; In this embodiment, step S1 includes the following specific contents, and the process can be found in the attached document. Figure 2 , Figure 2 This is a detailed flowchart of the data acquisition and sequence construction process provided in the embodiments of this application; S110: Retrieve the sequence of field values ​​in the data table; The system reads the data table to be processed, which contains multiple fields and several records. For each field in the data table, it performs segmented sampling according to a preset time window length and a preset sliding step size. Starting from the earliest timestamp of all records in the data table, it collects all values ​​of the field within each time window and arranges these values ​​in the order of the records' creation time to form a window value sequence. Finally, it concatenates the value sequences of all time windows in chronological order to obtain the field value sequence of the data table. S120: Obtain the sequence of mutual information coefficients between fields in the data table; For each pair of fields in the data table, perform the following operations within each time window: The first step is to perform equal-frequency binning discretization on the values ​​of the fields in the field pair within the current time window. All values ​​of the first field in the field pair within the current time window are sorted in ascending order of numerical value. The sorted sequence is divided into m equal segments, where m is a preset positive integer. Each segment contains the same number of values, and the boundary value of each segment serves as a discretization interval for that field. The same operation is performed on the second field in the field pair. All values ​​of the second field in the field pair within the current time window are sorted in ascending order of numerical value. The sorted sequence is divided into n equal segments, where n is a preset positive integer. Each segment contains the same number of values, and the boundary value of each segment serves as a discretization interval for that field.

[0020] The second step is to map each original value of the two fields to the corresponding interval number based on the discretized intervals; traverse each record in the current time window, obtain the values ​​of the two fields in the record, determine the interval number to which they belong, and form a two-dimensional discrete pair consisting of the interval number of the first field and the interval number of the second field. The third step is to calculate the joint frequency distribution. An m-row, n-column counting matrix is ​​established, with all elements initialized to 0. The row indices of the matrix correspond to the m intervals of the first field, and the column indices correspond to the n intervals of the second field. The two-dimensional discrete pairs of all records are traversed. For each discrete pair encountered, the count at the corresponding position in the matrix is ​​incremented by 1. After traversal, each count in the matrix is ​​divided by the total number of records to obtain the joint probability distribution matrix. Each element in the matrix represents the joint probability that the first field falls into a certain interval and the second field falls into a certain interval. The fourth step is to calculate the marginal frequencies. For the first field, the sum of the probabilities in each row of the joint probability distribution matrix is ​​calculated. Specifically, for the i-th row (i from 1 to m), the probability values ​​of all columns in that row are summed, and the sum is the marginal probability that the first field falls into the i-th interval, denoted as [missing information]. Perform the above summation operation on all rows of the joint probability matrix to obtain marginal probability values ​​equal to the number of interval numbers in the first field. These marginal probability values ​​constitute the marginal probability distribution of the first field. For the second field, calculate the sum of each column of the joint probability distribution matrix. Specifically, for the j-th column (j from 1 to n), sum the probability values ​​of all rows in that column. The sum is the marginal probability of the second field falling into the j-th interval, denoted as [equation missing]. Perform the above addition operation on all columns of the joint probability matrix to obtain marginal probability values ​​that are equal to the number of interval numbers in the second field. These marginal probability values ​​constitute the marginal probability distribution of the second field. Step 5: Calculate the mutual information coefficient; iterate through all non-zero elements in the joint probability distribution matrix; for each non-zero joint probability P(i,j), perform the following calculation: ; Where MI is the mutual information coefficient of the current time window; m is the total number of discretized intervals of the first field; n is the total number of discretized intervals of the second field; i is the interval number of the first field, ranging from 1 to m; j is the interval number of the second field, ranging from 1 to n; P(i,j) is the joint probability that the first field falls into the i-th interval and the second field falls into the j-th interval. Let be the marginal probability that the first field falls into the i-th interval; The marginal probability that the second field falls into the j-th interval; The sixth step is to arrange the mutual information coefficient values ​​calculated for each time window in the order of the time windows to form a sequence of mutual information coefficients between fields in the data table. S130: Retrieve the timestamp sequence of field modifications in the data table; Read the audit log table of the database and filter out all modification operation records for each field in the data table; extract the timestamp of the operation from each modification operation record, with the timestamp accurate to milliseconds; sort all the extracted timestamps in ascending order of time to form the field modification timestamp sequence of the data table.

[0021] S2: Extract local anomaly density features from the field value sequence, extract fluctuation amplitude features from the inter-field mutual information coefficient sequence, cross-validate the local anomaly density features and fluctuation amplitude features, and generate anomaly coupling strength values ​​for the fields. In this embodiment, step S2 includes the following specific details, which can be found in the flowchart below. Figure 3 , Figure 3 This is a detailed diagram of the abnormal coupling strength calculation process provided in the embodiments of this application.

[0022] S210: Extract local anomaly density features from the field value sequence; This step measures the degree of anomaly in local patterns by constructing a local pattern self-similarity matrix of field value sequences and calculating the similarity distribution between each local window and historical windows; the specific operations are as follows: The first step is to normalize the current field value sequence; extract the maximum value of all values ​​in the field value sequence, and denot it as the sequence maximum value; extract the minimum value of all values ​​in the field value sequence, and denot it as the sequence minimum value; subtract the sequence minimum value from each value in the sequence, and then divide by the difference between the sequence maximum value and the sequence minimum value to obtain the normalized value sequence. All values ​​in the normalized value sequence fall within the range of 0 to 1. The second step is to construct a delayed embedding vector sequence. A preset embedding dimension and preset delay are set. For example, in this embodiment, the embedding dimension is set to 5 and the delay to 1. Starting from the first value in the normalized value sequence, five consecutive values ​​are sequentially taken to form a 5-dimensional vector. The first vector consists of the 1st, 2nd, 3rd, 4th, and 5th values; the second vector consists of the 2nd, 3rd, 4th, 5th, and 6th values; and so on, with the last vector consisting of the (N-4th), (N-3rd), (N-2nd), (N-1st), and Nth values, where N is the sequence length. A total of N minus 4 vectors are obtained. These vectors are arranged in order to form the delayed embedding vector sequence. The third step is to determine the local neighborhood for each vector. For the i-th vector in the delayed embedding vector sequence, the vectors before and after it are taken as the local neighborhood by a preset number of vectors. If there are not enough vectors at the beginning or end of the sequence, the actual existing vectors are taken. Fourth step: For the i-th vector, calculate its Euclidean distance with each vector in its local neighborhood to obtain a distance list; sort the obtained Euclidean distance values ​​from smallest to largest, and take the Euclidean distance of the preset order as the core distance of the vector. Step 5: Calculate the local reachability density of each vector. For the i-th vector, iterate through every vector in its local neighborhood. For the currently traversed vector, calculate the Euclidean distance between the i-th vector and the current vector, denoted as the direct distance. Take the larger of the direct distance and the core distance of the i-th vector as the reachability distance from the i-th vector to the current vector. Take the reciprocal of the reachability distance to obtain the reachability density contribution from the i-th vector to the current vector. Sum the reachability density contributions of all vectors in the local neighborhood of the i-th vector, and then divide by the number of vectors in the local neighborhood of the i-th vector to obtain the local reachability density of the i-th vector. Step 6: Calculate the local anomaly factor for each vector. For the i-th vector, iterate through every vector in its local neighborhood. For the currently traversed vector, calculate the ratio of the local reachability density of the i-th vector to the local reachability density of the current vector. Sum the ratios corresponding to all vectors in the local neighborhood of the i-th vector, and then divide by the number of vectors in the local neighborhood of the i-th vector to obtain the local anomaly factor of the i-th vector. A local anomaly factor greater than 1 for the i-th vector indicates that the local pattern represented by the i-th vector is anomalous relative to its local neighborhood. Step 7: Arrange the vectors in the delayed embedding vector sequence in chronological order, with the first vector corresponding to the earliest time window and the last vector corresponding to the latest time window. Using the last vector as a reference, set its time decay weight to 1. Starting from the last vector and moving forward, for each vector forward, multiply the time decay weight by a preset decay factor (exemplarily 0.95). That is, the weight of the last vector is 1, the weight of the second to last vector is 0.95, the weight of the third to last vector is 0.9025, and so on. This yields a time decay weight sequence equal to the number of delayed embedding vectors. Step 8: Calculate the local anomaly density feature; multiply the local anomaly factor of each vector by the time decay weight at the corresponding position to obtain the weighted anomaly factor; sum all the weighted anomaly factors and then divide by the sum of all time decay weights to obtain the local anomaly density feature of the current field; the larger the feature value, the higher the degree of anomaly in the recent local window of the field.

[0023] S220: Extracting fluctuation amplitude features from the inter-field mutual information coefficient sequence; For the mutual information coefficient sequence between field pairs, let the length of the sequence be L; multiply each coefficient in the mutual information coefficient sequence by an amplification factor, for example, in this embodiment the amplification factor is 100, to obtain an amplified sequence, where each value in the amplified sequence is between 0 and 100; The amplified sequence is subjected to multi-level discrete wavelet transform using a preset wavelet basis function; for example, the Daubechies4 wavelet basis function is used in this embodiment. First, a first-level discrete wavelet transform is performed, resulting in a low-frequency approximate sequence and a high-frequency detail sequence. The length of the low-frequency approximate sequence is equal to the integer part of L divided by 2, and the length of the high-frequency detail sequence is the same as that of the low-frequency approximate sequence. The energy of the high-frequency detail sequence is calculated by squaring each value in the high-frequency detail sequence and summing the results to obtain the first layer of high-frequency energy. Then, the low-frequency approximation sequence obtained from the first-level transform is used as input to perform the second-level discrete wavelet transform to obtain the second-level low-frequency approximation sequence and the second-level high-frequency detail sequence; the energy of the second-level high-frequency detail sequence is calculated to obtain the second-level high-frequency energy; and so on, the third-level and fourth-level discrete wavelet transforms are performed in sequence to obtain the third-level high-frequency energy and the fourth-level high-frequency energy. Calculate the sum of high-frequency energies from the first to the fourth layer as the total high-frequency energy; calculate the proportion of high-frequency energy in each layer to the total high-frequency energy to obtain the energy proportions of the first, second, third, and fourth layers; then calculate the energy distribution entropy: for each layer, multiply the energy proportion of that layer by the logarithm of the energy proportion to the base 2, and then take the negative value to obtain the contribution of that layer; add the contributions of the four layers to obtain the energy distribution entropy; if the energy proportion of a certain layer is 0, then the contribution of that layer is 0; The pairwise fluctuation amplitude characteristic between the current field and another field is equal to the energy distribution entropy multiplied by the energy proportion of the first layer; the larger the value of this pairwise fluctuation amplitude characteristic, the more concentrated the high-frequency fluctuations of the mutual information coefficient sequence are at the finest scale and the energy distribution is dispersed, and the more complex the fluctuations are. Finally, for the current field, iterate through all other fields in the data table, calculate the pairwise fluctuation amplitude features between the current field and each other field using the method described above, and sum all the pairwise fluctuation amplitude features. The sum is then used as the fluctuation amplitude feature of the current field.

[0024] S230: Cross-validate the local anomaly density features with the fluctuation amplitude features to generate an anomaly coupling strength value for the field; The normalized anomaly density value, denoted as x, is obtained by dividing the local anomaly density feature value of the current field by the maximum value of the local anomaly density feature values ​​of all fields in the data table; the normalized fluctuation amplitude value, denoted as y, is obtained by dividing the fluctuation amplitude feature value of the current field by the maximum value of the fluctuation amplitude feature values ​​of all fields in the data table; (x,y) is regarded as a point on a two-dimensional plane; the ideal point is set as (1,1), indicating that both features reach the global maximum value; To measure the synergistic effect of the current point approaching the ideal point, the following iterative calculations are performed; the initial value of the resonance intensity is set to 0, and the number of iterations is a preset value (exemplarily 10 times); in each iteration, the Manhattan distance d from the current point to the ideal point is first calculated: d = |x-1| + |y-1|; then the resonance step size s is calculated: Next, update the coordinates of the current point: the new x-coordinate. for: The new ordinate for: The resonance increment in this iteration is the product of the x-coordinate and y-coordinate before the update, multiplied by the resonance step size; that is, the resonance increment. for: This increment is added to the resonance intensity; after this iteration, the coordinates of the current point are updated to ( , ), used for the next iteration; Repeat the above process until the preset number of iterations is completed; after the iteration is completed, divide the resonance intensity by the number of iterations to obtain the average resonance intensity; find the maximum value of the average resonance intensity of all fields in the data table, and divide the average resonance intensity of the current field by the maximum value to obtain the abnormal coupling intensity value; the abnormal coupling intensity value falls in the range of 0 to 1. The larger the value, the closer the local abnormal density and fluctuation amplitude of the current field are to the ideal point after resonance iteration, that is, the two features are high at the same time and promote each other, and the abnormal coupling intensity is high.

[0025] S3: Extract jump clustering features from the field modification timestamp sequence, extract pattern drift features from the field value sequence, cross-validate the jump clustering features and pattern drift features, and generate a mutation correlation value for the field. In this embodiment, step S3 includes the following specific details, which can be found in the flowchart below. Figure 4 , Figure 4 This is a detailed flowchart of the mutation association degree calculation process provided in the embodiments of this application.

[0026] S310: Extract jump clustering features from field modification timestamp sequences; The first step is to modify the timestamp sequence of the current field. If the number of modifications is less than the preset minimum number, the jump clustering feature is set to 0; otherwise, the interval sequence is obtained by subtracting two adjacent timestamps, with the interval unit being milliseconds. The length of the interval sequence is 1 less than the length of the timestamp sequence. The second step is to extract the median of the interval sequence, which is denoted as the baseline interval; divide each interval by the baseline interval to obtain the ratio sequence; this operation converts the original intervals into multiples of the median, making the sequence independent of the time unit; values ​​in the ratio sequence greater than 1 indicate that the interval is greater than the median, and values ​​less than 1 indicate that the interval is less than the median. The third step is to compare each ratio in the ratio sequence with the value 1; if the ratio is less than the value 1, it is marked as a dense symbol D; if the ratio is greater than or equal to the value 1, it is marked as a sparse symbol S; thus, a symbol sequence consisting of D and S is obtained. The fourth step is to scan the symbol sequence, find all subsequences composed of consecutive dense symbols D, record the length of each subsequence, and denote it as the dense length sequence; at the same time, find all subsequences composed of consecutive sparse symbols S, record the length of each subsequence, and denote it as the sparse length sequence. The fifth step is to calculate the sum of squares of the dense length sequence, denoted as the dense sum of squares; and to calculate the sum of squares of the sparse length sequence, denoted as the sparse sum of squares. First, calculate the sum of the dense and sparse sums of squares; then divide the dense sum of squares by the sum above to obtain the clustering tendency index. This index is between 0 and 1. The larger the value, the longer and more concentrated the dense subsequences are, meaning that the modification behavior tends to break out continuously in a short period of time. The sixth step is to calculate the coefficient of variation of the ratio sequence. The coefficient of variation is equal to the standard deviation of the ratio sequence divided by the mean of the ratio sequence; the coefficient of variation reflects the relative fluctuation of the interval. Step 7: The jump clustering characteristic is equal to the clustering tendency index multiplied by the coefficient of variation; the larger the jump clustering characteristic, the more it indicates that the modified events exhibit both local bursts of clustering and a highly uneven interval distribution overall.

[0027] S320: Extracting pattern shift features from a sequence of field values; Obtain the normalized value sequence of the current field; preset the pattern length, for example, in this embodiment, the pattern length is 3; starting from the first value of the normalized value sequence, slide one value at a time, and take out three consecutive values ​​to form a triplet; the first triplet consists of the 1st value, the 2nd value, and the 3rd value; the second triplet consists of the 2nd value, the 3rd value, and the 4th value; and so on, the last triplet consists of the (N-2)th value, the (N-1)th value, and the Nth value, where N is the sequence length; a total of N-2 triplets are obtained; Convert each triplet into an ordinal pattern; for the three values ​​in the triplet, sort them in ascending order and record the position number of each value in the original triplet; the position numbers are 1, 2, and 3, representing the first, second, and third positions respectively; the resulting sequence of three numbers is the ordinal pattern of the triplet; there are 6 possible ordinal patterns, numbered 1 to 6 respectively; arrange the ordinal patterns of all triplets in order to obtain the pattern sequence; To count the total number of occurrences of each pattern in the pattern sequence, create an array of length 6, denoted as the pattern count array, where the k-th element represents the total number of occurrences of pattern k. Initialize all elements to 0. Iterate through each pattern in the pattern sequence, and if the current pattern number is p, increment the p-th element of the pattern count array by 1. After the iteration is complete, each element in the pattern count array represents the total number of occurrences of the corresponding pattern. Count the number of transitions between adjacent patterns and construct a transition counting matrix. For example, in this embodiment, the ordinal pattern is 6, so a 6-row, 6-column matrix is ​​created, denoted as the transition counting matrix, where the row number represents the current pattern number and the column number represents the next pattern number. Initialize all elements to 0. Traverse the pattern sequence from the first pattern to the second-to-last pattern. Let the current pattern number be p and the next pattern number be q, and increment the element in the p-th row and q-th column of the transition counting matrix by 1. After the traversal, the element values ​​in the transition counting matrix represent the total number of transitions from one pattern to another. Calculate the pattern uniformity of the ordinal pattern; sum all elements in the pattern count array to get the total number of patterns, i.e., N-2; for each element in the pattern count array, divide the element by the total number of patterns to get the probability of the occurrence of the pattern; for each probability of occurrence, calculate the square of the probability; sum all the squares to get the pattern uniformity of the ordinal pattern. Calculate the transition concentration; sum all elements in the transition count matrix to get the total number of transitions, which is the pattern sequence length minus 1; for each non-zero element in the transition count matrix, divide the element by the total number of transitions to get the transition probability; for each transition probability, calculate the square of the probability; sum all the squares to get the transition concentration. The mode drift characteristic is calculated as 1 minus the product of the transition concentration and the mode uniformity.

[0028] S330: Cross-validate the jump clustering feature and the pattern drift feature to generate a value for the degree of mutation association of the field; The normalized jump value is obtained by dividing the jump clustering feature of the current field by the maximum value of the jump clustering features of all fields in the data table; the normalized drift value is obtained by dividing the pattern drift feature of the current field by the maximum value of the pattern drift feature of all fields in the data table. Extract jump event timestamps from the modification timestamp sequence; take the timestamp of the next modification event corresponding to the interval less than 1 in the ratio sequence as the jump event timestamp, and obtain the jump event timestamp list; calculate the total number of jump event timestamps, and record it as the total number of jumps; Extract drift event time points from the pattern sequence; the specific steps are as follows: First, obtain the transition count matrix; then, calculate the conditional transition probability matrix based on the transition count matrix; for each row of the transition count matrix, calculate the sum of all elements in that row; divide each element in that row by the sum of all elements in that row to obtain the conditional transition probability of transitioning from that mode to each of the next modes; after performing this operation on all rows, the conditional transition probability matrix is ​​obtained. Next, calculate the average of all non-zero conditional transition probabilities in the conditional transition probability matrix, denoted as the average conditional transition probability. Traverse the pattern sequence from the first pattern to the second-to-last pattern, extract the current pattern number and the next pattern number, and retrieve the corresponding conditional transition probability from the conditional transition probability matrix. If the conditional transition probability is less than half of the average conditional transition probability, then the time of the middle position of the triplet corresponding to that pattern is taken as the drift event point. The middle position of the triplet corresponds to the timestamp of the (i+1)th value in the original normalized value sequence. Obtain the list of drift event times. Calculate the total number of drift event points, denoted as the total number of drifts. Calculate the cross recursion rate of two event time lists; preset the time matching threshold; create a matrix with the total number of jumps and the total number of drifts, with all elements initially set to 0; iterate through each jump event time point and each drift event time point, and calculate the absolute difference between the jump event time point and the drift event time point; if the absolute difference is less than the preset time matching threshold, set the element at the corresponding position in the matrix to 1; after the iteration is complete, count the number of all 1s in the matrix, and record it as the number of matching pairs; Calculate the cross recursion rate, which is equal to the number of matching pairs divided by the square root of the product of the total number of jumps and the total number of drifts; this value is between 0 and 1, indicating the degree of synchronization between the two types of events in time. Calculate the intensity ratio of the cluster strength of jump events to the cluster strength of drift events; the cluster strength of jump events is the normalized jump value of the current field; the cluster strength of drift events is the normalized drift value of the current field; divide the smaller normalized value by the larger normalized value to obtain the intensity ratio, which is between 0 and 1. The mutation association degree value is calculated as the normalized jump value multiplied by the normalized drift value multiplied by the cross recursion rate multiplied by the intensity ratio. All four factors are between 0 and 1, and the product naturally falls within the 0 to 1 range. The closer the value is to 1, the more synchronous and matched the jump clustering and pattern drift are in terms of occurrence time, that is, the field modification behavior and value change are closely coupled, and the mutation association degree is high.

[0029] S4: Based on the historical decryption event statistics of the current field's secret category, as well as the abnormal coupling strength value and mutation correlation value of the current field, predict the degree of confidentiality impact of the current field's decryption on subsequent fields in the same secret category, and generate the sensitivity level of subsequent fields. In this embodiment, step S4 includes the following specific details, which can be found in the flowchart below. Figure 5 , Figure 5 This is a detailed flowchart of the decryption impact prediction and sensitivity analysis process provided in the embodiments of this application.

[0030] S410: Determine the secret category to which the current field belongs; A pre-defined secret category rule base is established. The construction process of the secret category rule base is as follows: Collect the field names of all existing historical fields; for each field name, segment it by underscore, hyphen, and case conversion to obtain one or more words; count all words segmented from all field names, and treat each word as an independent semantic unit; Calculate the semantic similarity between any two field names. The semantic similarity is equal to the number of elements in the intersection of the word sets segmented from the two field names divided by the number of elements in the union. Sort all fields by the semantic similarity between each pair of fields from largest to smallest, and take the value corresponding to the preset percentile after sorting as the grouping threshold; treat each field as a node, and establish an edge between two fields whose semantic similarity is greater than the grouping threshold; after all edges are established, the set of nodes connected by edges is taken as a secret category; fields that have not established edges with any nodes are assigned to the default category. For each secret category, count the occurrence count of all words segmented from all field names within that secret category, and take the word with the highest occurrence count as the category label of that secret category; calculate the semantic similarity between each pair of fields within that secret category, and take the minimum value as the judgment threshold of that secret category; store the category label, word set, and judgment threshold of each secret category accordingly to form a secret category rule base; For the current field to be identified, extract the field name and segment it in the same way to obtain a word set; calculate the semantic similarity between the word set of the current field and the word sets of each secret category in the secret category rule base; select the secret category with the highest semantic similarity. If the highest semantic similarity is greater than the judgment threshold corresponding to the secret category, then the secret category is determined as the secret category to which the current field belongs; otherwise, it is classified into the default category.

[0031] S420: Query the decryption event records corresponding to the current secret category from the historical decryption event statistics information, and obtain the leakage event occurrence rate, impact range diffusion coefficient and time decay factor; Decryption event records are accumulated in the following way: After each sensitivity identification and desensitization operation of a field is completed, it is monitored whether the field is actually decrypted and leaked in subsequent use; actual decryption leakage is defined as an unauthorized user obtaining the original sensitive data before desensitization through unauthorized access, SQL injection, or data export; when a decryption leakage is detected, a decryption event record is recorded, which includes the following information: the secret category to which the field belongs, the timestamp of the event, and the number of leaked records, i.e., the number of original data records that were illegally accessed; all decryption event records are stored in the historical decryption event statistics information; in addition, for the field identification process where no leakage occurred, the number of leakage records is 0, which is used to count the total number of identifications.

[0032] Perform the following statistical operations based on the secret category to which the current field belongs: For the secret category to which the current field belongs, extract all decryption event records whose secret category is equal to the current secret category from the historical decryption event statistics information, and count the total number of records; count the number of records with a leakage record count greater than 0; the leakage event occurrence rate is equal to the number of records with a leakage record count greater than 0 divided by the total number of records; if the total number of records is 0, the leakage event occurrence rate is set to 0; Extract the number of leaked records from the decryption event records where the number of leaked records is greater than 0; sum up all the number of leaked records, and then divide by the number of records where the number of leaked records is greater than 0 to obtain the influence range diffusion coefficient; if the number of records where the number of leaked records is greater than 0 is 0, then the influence range diffusion coefficient is set to 0; Using the current time as a reference, for each decryption event record, calculate the time difference between the current time and the event's timestamp; then calculate the time decay factor, which is calculated as follows: ; In the formula, λ represents the time decay factor; N represents the total number of decryption event records, which is obtained by counting all decryption event records in the historical decryption event statistics that have a secret category equal to the current secret category; i represents the sequence number of the decryption event record, which is an integer from 1 to N; This represents the time difference between the current time and the event timestamp of the i-th decryption event record; e is a natural constant; T is a preset time constant, determined by: extracting all decryption event records of all secret categories from the historical decryption event statistics, filtering out records whose actual decryption leakage field value has occurred after this desensitization operation, calculating the time difference between the event timestamp of each record and the current time, and taking the arithmetic mean of all time differences as the value of T.

[0033] S430: Through propagation impact analysis, using the abnormal coupling strength value and mutation correlation value of the current field, combined with the leakage event occurrence rate, impact range diffusion coefficient and time decay factor, calculate the degree of confidentiality impact of the current field being decrypted on subsequent fields; Extract all fields belonging to the current secret category from the data table to form a set of fields to be analyzed; if the total number of fields in this set is less than or equal to 1, it indicates that no other subsequent fields under the current secret category will be affected by decryption, and the secrecy impact level is directly set to 0, thus ending the propagation impact analysis; If the total number of fields in the field set is greater than 1, begin constructing the field association network; iterate through all possible field combinations in the field set, with each combination containing two different fields; for any field combination, extract the sequence of mutual information coefficients generated for that field combination during the calculation of mutual information coefficients; calculate the median of all mutual information coefficient values ​​in this sequence, and use the median of all mutual information coefficient values ​​as the association strength between this field combination; construct an undirected weighted network with each field in the field set as a node, and the association strength between two fields as the weight of the edge connecting the nodes; for field combinations with an association strength of 0, no edges are established between the corresponding nodes; After the undirected weighted network is constructed, a risk value is assigned to each node in the network; except for the node corresponding to the current field, the risk values ​​of all other nodes are set to 0; the risk value of the node corresponding to the current field is set to the abnormal coupling strength value of the current field; this abnormal coupling strength value is the initial risk source of this propagation process, representing the risk energy carried when the current field itself is decrypted; Set the maximum number of iterations to a preset number, and the convergence threshold to 0.001; in each iteration, perform the following propagation update operation: Process each node in the undirected weighted network sequentially. If the risk value of a node is greater than 0, obtain all neighboring nodes connected to that node and the weights of the corresponding edges; calculate the sum of the weights of the edges connected to that node and all neighboring nodes; for each neighboring node, calculate the amount of propagation risk that the node needs to propagate to the neighboring nodes. The method for calculating the amount of propagation risk is: multiply the risk value of the node by the weight of the edge connected to the neighboring node, and then divide by the sum of the edge weights of the node; temporarily store the calculated amount of propagation risk in the list of risks to be received by the neighboring node. After calculating the risk of each node, risk attenuation is performed on each node in the network. Each node in the network is processed in turn, and the risk value of the node is multiplied by the value of 1 minus the difference between the current field mutation correlation value. The resulting product replaces the original risk value of the node. The larger the mutation correlation value, the more unstable the field itself is, and the lower the retention rate of the node risk value after each round of propagation. After the self-risk attenuation process is completed, background risk is injected into each node in the network. Each node in the network is processed in turn, and the amount of background risk to be injected into the node in this round is calculated. The method for calculating the amount of background risk injected is: the leakage event occurrence rate multiplied by a value of 1 plus the effect range diffusion coefficient. The calculated amount of background risk injected is directly added to the risk value of the node. The higher the leakage event occurrence rate, the higher the basic risk level of this type of secret; the larger the effect range diffusion coefficient, the more obvious the amplification effect of background risk. Next, each node in the network is processed sequentially. All propagation risk quantities temporarily stored in the node's list of risks to be received are summed, and the summation result is added to the node's own risk value. After the addition operation of all nodes is completed, the list of risks to be received of all nodes is cleared to prepare for the next round of propagation calculation. The risk value of each node in the network is multiplied by the time decay factor, and the product is used to replace the original risk value of that node. The time decay factor reflects the characteristic that historical statistical regularities gradually become invalid over time. After each round of propagation, the risk energy of all nodes in the network will decay as a whole in this proportion. After completing all update operations in this iteration, calculate the sum of the absolute values ​​of the differences between the risk values ​​of all nodes after the end of this iteration and the risk values ​​of all nodes after the end of the previous iteration; if the sum of the absolute values ​​of the differences is less than the convergence threshold, stop the iteration; otherwise, continue to the next iteration until the maximum number of iterations is reached. After the iteration process is completed, all other nodes except the node corresponding to the current field are extracted from the undirected weighted network; the final risk value of each other node and the correlation strength between the node and the node corresponding to the current field are obtained; the weighted average of the final risk values ​​of all other nodes is calculated using the correlation strength between each node and the node corresponding to the current field as the weight; if the sum of all weights is 0, the arithmetic mean of the final risk values ​​of all other nodes is used as the calculation result; the average calculation result is the degree of confidentiality impact on subsequent fields after the current field is decrypted.

[0034] S440: Map the level of confidentiality impact to the sensitivity level of subsequent fields; The calculated confidentiality impact value is used as the input value to be mapped; a first threshold, a second threshold, and a third threshold are preset, and the three thresholds are determined as follows: a preset number of historical field samples that have been processed are collected, and the corresponding confidentiality impact value is calculated for each historical field sample according to the aforementioned steps; the preset number of confidentiality impact values ​​are sorted in ascending order, and the value corresponding to the 30th percentile is taken as the first threshold, the value corresponding to the 60th percentile is taken as the second threshold, and the value corresponding to the 90th percentile is taken as the third threshold; Compare the value of the confidentiality impact to be mapped with the three thresholds mentioned above; If the confidentiality impact value is less than the first threshold, the sensitivity level of the subsequent fields will be determined as the first level; If the confidentiality impact value is greater than or equal to the first threshold and less than the second threshold, then the sensitivity level of the subsequent fields will be determined as the second level. If the confidentiality impact value is greater than or equal to the second threshold and less than the third threshold, then the sensitivity level of the subsequent field will be determined as the third level. If the confidentiality impact value is greater than or equal to the third threshold, the sensitivity level of the subsequent fields will be determined as the fourth level.

[0035] The determined sensitivity levels of subsequent fields are used as output and passed to subsequent steps.

[0036] S5: Use the sensitivity level of the subsequent fields as the desensitization benchmark for the secret category to which the current field belongs, and use it to perform desensitization operations of corresponding desensitization strength on the subsequent fields in the corresponding secret category; In this embodiment, step S5 includes the following specific details, which can be found in the flowchart below. Figure 6 , Figure 6 This is a detailed diagram of the desensitization benchmark application and desensitization operation process provided in the embodiments of this application; S510: Use the sensitivity level of subsequent fields as the desensitization benchmark for the secret category to which the current field belongs; Obtain the sensitivity level of the subsequent field; bind this level to the secret category to which the current field belongs, and use it as the desensitization baseline level for that secret category; if the secret category has been bound to a desensitization baseline level before, replace the original level with the level output this time; S520: Based on the level of the desensitization benchmark, perform desensitization operations on subsequent fields in the secret category to which the current field belongs; When it is necessary to de-identify subsequent fields belonging to a certain secret category, the bound de-identification baseline level is obtained according to the secret category; if the secret category has not yet been bound to any de-identification baseline level, the first level is used as the default de-identification baseline level. Based on the obtained desensitization baseline level, perform desensitization operations of corresponding strength on subsequent fields: If the desensitization baseline level is Level 1, no desensitization operation will be performed, and the original values ​​of subsequent fields will be output directly. If the desensitization baseline level is Level 2, then perform partial masking desensitization. For integer type field values, first convert the integer to a decimal string, keep the first and last characters of the string, replace all characters in the middle with asterisks, and return the replaced string. If the length of the original string is less than or equal to 2, then directly return the original string. For string type field values, keep the first two and last two characters of the original string, replace all characters in the middle with asterisks, and return the replaced string. If the length of the original string is less than or equal to 4, then only keep the first and last characters, and replace the middle part with asterisks. For date type field values, extract the year and month parts of the date, force the date part to be changed to 01, and return a string in the format "year-month-01". For floating-point type field values, first round the floating-point number to the nearest integer, and then process it according to the partial masking rules for integer types. If the desensitization baseline level is level three, then perform generalized desensitization. For numeric field values, first scan all records of that field in the current data table to find the global maximum and global minimum values; calculate the interval step size as the difference between the global maximum and global minimum values ​​divided by ten; divide the range from the global minimum to the global maximum into 10 consecutive intervals that are left-closed and right-open; for the current field value, determine the interval index it falls into and return the string representation of that interval in the format "from the left endpoint to the right endpoint of the interval"; if the global maximum equals the global minimum, then directly return the string representation of that value; for string field values, use a pre-built generalized dictionary for mapping; the generalized dictionary is constructed as follows: Collect all values ​​for this field from historical data, count the frequency of each value, and group values ​​with a frequency greater than or equal to a preset frequency and a common prefix into one category, naming the category with the common prefix string. If the current field value has a corresponding key in the generalization dictionary, return the corresponding generalization class name; otherwise, calculate the edit distance between the current field value and all keys in the generalization dictionary, and return the generalization class name corresponding to the key with the smallest edit distance; if the smallest edit distance is greater than 5, return the string "Other"; for date type field values, extract the year part of the date, force the month part to be changed to 01, force the date part to be changed to 01, and return a string in the format "year-01-01"; If the desensitization baseline level is level four, a full masking operation is performed. For string-type field values ​​with a length greater than or equal to 20 bytes, a random salt value of 16 bytes is generated. The original string is concatenated with the salt value, and the SHA-256 hash value is calculated. The hexadecimal string representation of the hash value is returned. For string-type field values ​​with a length less than 20 bytes, the AES-256 encryption algorithm is called, and the original string is encrypted using a preset fixed key. The encrypted ciphertext is then Base64 encoded. For numeric field values, the value is first converted to a string, then the AES-256 encryption algorithm is called to encrypt the string, and the Base64 encoded string is output. For binary field values, the AES-256-GCM mode is used for authentication encryption, and the Base64 encoded string is output after concatenating the ciphertext and the authentication label.

[0037] S6: Store the result of whether an actual decryption and leakage occurred after this desensitization operation in the historical decryption event statistics information; In this embodiment, step S6 includes the following specific details, which can be found in the flowchart below. Figure 7 , Figure 7 This is a detailed diagram of the historical decryption event information update process provided in the embodiments of this application; S610: After completing the sensitivity identification of the field, store the field identifier, identification timestamp, subsequent field sensitivity level, whether actual decryption leakage occurred after this desensitization operation, and the scope of the leakage impact into the historical decryption event statistics information; After the desensitization operation is completed, a historical decryption event record to be written is generated; this historical decryption event record contains the following content: Field identifier: Retrieves the fully qualified name of the field being processed in the data table, in the format of "database name dot table name dot field name"; Identify the timestamp: Retrieve the current system timestamp, accurate to the second, when the sensitivity level of subsequent fields is determined; Subsequent field sensitivity level: Get the sensitivity level of the subsequent field, with values ​​of first level, second level, third level, and fourth level; Did actual decryption leakage occur after this desensitization operation? The initial value of this field is set to 0, indicating that no leakage occurred. Scope of impact of the leak: This field is initially set to 0; Write the above records into the historical decryption event statistics; after successful writing, start the preset monitoring period; the monitoring task continuously listens to the database audit log; if any record in the audit log meets the following two conditions during the monitoring period: first, the field operated on belongs to the secret category to which the current field belongs; second, the operation type is illegal data export and the original data before desensitization is obtained, then update the value of the field "Whether actual decryption and leakage occurred after this desensitization operation" to one; at the same time, count the total number of illegally exported original data records that meet the above conditions during the monitoring period, and add this number to the leakage impact scope field; after the preset monitoring period ends, the monitoring task automatically ends.

[0038] S620: Periodically perform statistical analysis on all decryption event records of the same secret category, and update the leakage event occurrence rate, impact range diffusion coefficient, and time decay factor in the historical decryption event statistics; Set up a scheduled statistics task, and the task execution process is as follows: Read all records from the historical decryption event statistics to form a complete record set; retrieve a list of all defined secret category tags from the stored secret category tags; Iterate through each secret category label; for the currently iterated secret category, perform the following operations: Select all records whose secret category is equal to the currently traversed category from the full record set, forming a subset of the category records; count the total number of records in the subset of the category records; Update the leakage event occurrence rate; filter out records from the category record subset that have actually been decrypted and leaked after this de-identification operation, and count the total number of these records; if the total number of records in the category record subset is greater than 0, the leakage event occurrence rate is equal to the total number of leaked records divided by the total number of records; if the total number of records is equal to 0, the leakage event occurrence rate is set to 0; update the subsequent leakage event occurrence rate to the calculated value. Update the impact range diffusion coefficient; filter out records from the category record subset that have actually been decrypted and leaked after this de-identification operation, and extract the leakage impact range field value of these records; calculate the arithmetic mean of these leakage impact range values; if the total number of leaked records is equal to 0, the impact range diffusion coefficient is set to 0; if the total number of leaked records is greater than 0, the impact range diffusion coefficient is equal to the arithmetic mean of the leakage impact range values; update the impact range diffusion coefficient used subsequently to the value calculated this time; Update the time decay factor; for each record in the category record subset, obtain the identification timestamp; calculate the time difference between the current time and the identification timestamp, in hours; calculate the time decay weight for each record, which is equal to a power of the negative time difference divided by a preset time constant, with the natural constant e as the base; sum the time decay weights of all records to obtain the total weight; the time decay factor is equal to the total weight divided by the total number of records; if the total number of records is 0, the time decay factor is set to 0; the time decay factor used subsequently is updated to the value calculated in this step. The updated leakage event occurrence rate, impact range diffusion coefficient, and time decay factor are persistently stored for later use. Through the above steps, a complete closed loop is formed, from sensitivity identification, desensitization execution, leakage monitoring to parameter feedback and updates. As the system runs longer, the statistical information of historical decryption events accumulates, and the three parameters of leakage event occurrence rate, impact range diffusion coefficient and time decay factor will increasingly accurately reflect the true risk situation of each secret category, thereby making the subsequent prediction of the degree of confidentiality impact more accurate and realizing adaptive sensitivity identification.

[0039] Please see Figure 8 , Figure 8 This is a schematic diagram of the structure of an adaptive sensitivity identification data classification and dynamic desensitization system provided in an embodiment of this application; This embodiment demonstrates the overall system architecture for implementing the above method. Through the collaborative work of six core functional modules, a complete technical chain is constructed, from data acquisition to dynamic de-identification output. The functions of each module are described below: The data acquisition module is used to obtain the field value sequence, the inter-field mutual information coefficient sequence, and the field modification timestamp sequence from the data table; The anomaly coupling module is used to extract local anomaly density features from the field value sequence, extract fluctuation amplitude features from the mutual information coefficient sequence between fields, and cross-validate the local anomaly density features and fluctuation amplitude features to generate anomaly coupling strength values ​​for the fields. The mutation association module is used to extract jump clustering features from the field modification timestamp sequence, extract pattern drift features from the field value sequence, cross-validate the jump clustering features and pattern drift features, and generate a mutation association degree value for the field. The decryption analysis module is used to predict the degree of confidentiality impact of the current field being decrypted on subsequent fields in the same confidential category based on the historical decryption event statistics of the current field's secret category, as well as the abnormal coupling strength value and mutation correlation value of the current field, and to generate the sensitivity level of subsequent fields. The dynamic desensitization module is used to use the sensitivity level of subsequent fields as the desensitization benchmark for the secret category to which the current field belongs, and to perform desensitization operations with corresponding desensitization strength on subsequent fields in the corresponding secret category; The log update module is used to store the result of whether an actual decryption and leakage occurred after this de-identification operation into the historical decryption event statistics information.

[0040] Embodiments of the present invention also provide an electronic device, including a memory, a processor, and a communication bus; the memory and the processor are connected via the communication bus. The memory stores a data hierarchical classification and dynamic desensitization method for adaptive sensitivity identification, as provided in the above embodiments, which can be loaded and executed by the processor.

[0041] The memory can be used to store instructions, programs, code, code sets, or instruction sets. The memory may include a program storage area and a data storage area. The program storage area may store instructions for implementing an operating system, instructions for at least one function, and instructions for implementing the adaptive sensitivity identification data classification and dynamic desensitization method provided in the above embodiments. The data storage area may store data involved in the adaptive sensitivity identification data classification and dynamic desensitization method provided in the above embodiments.

[0042] The processor may include one or more processing cores. The processor executes instructions, programs, code sets, or instruction sets stored in memory, and calls data stored in memory to perform various functions and process data as described in this application. The processor may be at least one of the following: Application-Specific Integrated Circuit (ASIC), Digital Signal Processor (DSP), Digital Signal Processing Device (DSPD), Programmable Logic Device (PLD), Field Programmable Gate Array (FPGA), Central Processing Unit (CPU), controller, microcontroller, and microprocessor. It is understood that, for different devices, the electronic devices used to implement the above-described processor functions may also be other types, and the embodiments of this application do not specifically limit this.

[0043] A communication bus can include a pathway for transmitting information between the aforementioned components. The communication bus can be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. Communication buses can be categorized as address buses, data buses, control buses, etc.

[0044] This application provides a computer-readable storage medium storing a computer program that can be loaded by a processor and executed as described in the above embodiments, a data classification and dynamic desensitization method based on adaptive sensitivity identification.

[0045] In this embodiment, a computer-readable storage medium can be a tangible device that holds and stores instructions used by an instruction execution device. A computer-readable storage medium can be, but is not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any combination thereof. Specifically, a computer-readable storage medium can be a portable computer disk, a hard disk, a USB flash drive, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), spoofing random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory stick, floppy disk, optical disk, magnetic disk, mechanical encoding device, or any combination thereof.

[0046] The terms “comprising,” “including,” or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0047] The above description is merely a preferred embodiment of this application and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of this application is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the foregoing application concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions claimed in this application.

Claims

1. A data grading classification and dynamic desensitization method of adaptive sensitivity identification, characterized in that, Includes the following steps: S1: Obtain the sequence of field values, the sequence of mutual information coefficients between fields, and the sequence of field modification timestamps from the data table; S2: Extract local anomaly density features from the field value sequence, extract fluctuation amplitude features from the inter-field mutual information coefficient sequence, cross-validate the local anomaly density features and fluctuation amplitude features, and generate anomaly coupling strength values ​​for the fields. S3: Extract jump clustering features from the field modification timestamp sequence, extract pattern drift features from the field value sequence, cross-validate the jump clustering features and pattern drift features, and generate a mutation correlation value for the field. S4: Based on the historical decryption event statistics of the current field's secret category, as well as the abnormal coupling strength value and mutation correlation value of the current field, predict the degree of confidentiality impact of the current field's decryption on subsequent fields in the same secret category, and generate the sensitivity level of subsequent fields. S5: Use the sensitivity level of the subsequent fields as the desensitization benchmark for the secret category to which the current field belongs, and use it to perform desensitization operations of corresponding desensitization strength on the subsequent fields in the corresponding secret category; S6: Store the result of whether an actual decryption and leakage occurred after this desensitization operation in the historical decryption event statistics information; The steps of extracting local anomaly density features from the field value sequence, extracting fluctuation amplitude features from the inter-field mutual information coefficient sequence, and cross-validating the local anomaly density features and fluctuation amplitude features to generate anomaly coupling strength values ​​for the fields include: S210: After normalizing the field value sequence, construct a delayed embedding vector sequence. Calculate the local anomaly factor of each vector in the delayed embedding vector sequence through local neighborhood. Perform time-decay weighted averaging on the local anomaly factors to obtain the local anomaly density feature of the current field. S220: Perform multi-level discrete wavelet transform on the mutual information coefficient sequence between fields, extract the energy of high-frequency detail sequences at each level, calculate the energy distribution entropy, multiply the energy distribution entropy by the energy proportion of the first layer to obtain the pairwise fluctuation amplitude feature, and accumulate the pairwise fluctuation amplitude features between the current field and all other fields in the data table to obtain the fluctuation amplitude feature of the current field. S230: Normalize the local anomaly density feature of the current field to obtain a normalized anomaly density value, and normalize the fluctuation amplitude feature of the current field to obtain a normalized fluctuation amplitude value; determine the coordinates of the current point corresponding to the current field using the normalized anomaly density value as the x-axis and the normalized fluctuation amplitude value as the y-axis; set the initial value of the resonance intensity to 0, and set the number of iterations to a preset value; in each iteration, calculate the Manhattan distance from the current point coordinates to the ideal point, calculate the resonance step size based on the Manhattan distance, update the current point coordinates, calculate the resonance increment, and accumulate the resonance increment to the resonance intensity; after the iteration ends, divide the resonance intensity by the number of iterations to obtain the average resonance intensity; normalize the average resonance intensity to obtain the anomaly coupling strength value; The process of extracting jump clustering features from the field modification timestamp sequence, extracting pattern drift features from the field value sequence, and cross-validating the jump clustering features and pattern drift features to generate a mutation correlation value for the field includes: S310: Take the difference between adjacent timestamps in the modification timestamp sequence of the current field as the time interval to obtain the time interval sequence; divide each time interval in the time interval sequence by the median of the time interval sequence to obtain the interval ratio sequence; compare each ratio in the interval ratio sequence with a preset threshold. If the ratio is less than the threshold, mark the corresponding time interval as a dense symbol; otherwise, mark it as a sparse symbol to obtain the symbol sequence; calculate the clustering tendency index based on the ratio of the length of the continuous dense symbol subsequence to the length of the continuous sparse symbol subsequence in the symbol sequence; calculate the coefficient of variation based on the dispersion of the interval ratio sequence; multiply the clustering tendency index by the coefficient of variation to obtain the skip clustering feature. S320: Convert the field value sequence into a pattern sequence, calculate the transition probability of adjacent patterns, calculate the pattern uniformity and transition concentration, and subtract the product of the transition concentration and the pattern uniformity from the value 1 to obtain the pattern drift feature. S330: Normalize the jump clustering features to obtain normalized jump values, and normalize the pattern drift features to obtain normalized drift values; extract jump event time points from the field modification timestamp sequence; extract drift event time points from the pattern sequence; determine the cross-recurrence rate between jump event time points and drift event time points; divide the smaller of the normalized jump value and the normalized drift value by the larger value to obtain the intensity ratio; combine the normalized jump value, normalized drift value, cross-recurrence rate, and intensity ratio to obtain the mutation association degree value.

2. The method of adaptive sensitivity-aware data triage and dynamic de- sensitization of claim 1, wherein, The process of obtaining the field value sequence, the inter-field mutual information coefficient sequence, and the field modification timestamp sequence from the data table includes: S110: The field is sampled in segments according to the preset time window length and sliding step size. The field values ​​collected in each time window are arranged in chronological order and then concatenated to obtain a field value sequence. S120: Calculate the mutual information coefficient of the field pairs within each time window, arrange the mutual information coefficients of all time windows in window order, and obtain the sequence of mutual information coefficients between fields; S130: Extract the modification operation timestamps of the fields from the audit logs, sort the modification operation timestamps in ascending order of time, and obtain the field modification timestamp sequence.

3. The method of adaptive sensitivity-aware data triage and dynamic de- sensitization of claim 1, wherein, The process of predicting the impact of decryption on the confidentiality of subsequent fields in the same category after the current field is decrypted, based on historical decryption event statistics of the current field's secret category, as well as the abnormal coupling strength and mutation correlation values ​​of the current field, and generating the sensitivity level of subsequent fields includes: S410: Determine the secret category to which the current field belongs by using a preset secret category rule base; S420: Calculate the occurrence rate, impact range diffusion coefficient, and time decay factor of the leakage event corresponding to the secret category from the historical declassification event statistics; S430: Using the abnormal coupling strength value and mutation correlation value of the current field, combined with the leakage event occurrence rate, influence range diffusion coefficient and time decay factor, a propagation impact analysis is performed to obtain the degree of confidentiality impact on subsequent fields after the current field is decrypted. S440: Map the confidentiality impact level to the sensitivity level of subsequent fields.

4. The method of adaptive sensitivity-aware data triage and dynamic de- sensitization of claim 3, wherein, The method of using the sensitivity level of subsequent fields as the desensitization benchmark for the current field's secret category is used to perform desensitization operations of corresponding strength on subsequent fields in the corresponding secret category: S510: Use the sensitivity level of subsequent fields as the desensitization benchmark for the secret category to which the current field belongs; S520: Based on the level of the desensitization benchmark, perform desensitization operation on subsequent fields in the secret category to which the current field belongs: if the desensitization benchmark is the first level, then directly output the original value of the subsequent field; If it is the second level, partial masking will be performed; if it is the third level, generalized masking will be performed. If it is level four, then a full mask operation is performed.

5. The adaptive sensitivity identification data classification and dynamic desensitization method according to claim 4, characterized in that, The process of storing the result of whether an actual decryption leak occurred after this desensitization operation in the historical decryption event statistics includes: S610: After completing the sensitivity identification of a field, store the field identifier, identification timestamp, subsequent field sensitivity level, whether actual decryption leakage occurred after this desensitization operation, and the scope of the leakage impact in the historical decryption event statistics information; S620: Periodically perform statistics on all decryption event records of the same secret category, and update the leakage event occurrence rate, impact range diffusion coefficient, and time decay factor in the historical decryption event statistics.

6. A data hierarchical classification and dynamic desensitization system with adaptive sensitivity identification, characterized in that, For implementing the method of any one of claims 1 to 5, comprising: The data acquisition module is used to obtain the field value sequence, the inter-field mutual information coefficient sequence, and the field modification timestamp sequence from the data table; The anomaly coupling module is used to extract local anomaly density features from the field value sequence, extract fluctuation amplitude features from the mutual information coefficient sequence between fields, and cross-validate the local anomaly density features and fluctuation amplitude features to generate anomaly coupling strength values ​​for the fields. The mutation association module is used to extract jump clustering features from the field modification timestamp sequence, extract pattern drift features from the field value sequence, cross-validate the jump clustering features and pattern drift features, and generate a mutation association degree value for the field. The decryption analysis module is used to predict the degree of confidentiality impact of the current field being decrypted on subsequent fields in the same confidential category based on the historical decryption event statistics of the current field's secret category, as well as the abnormal coupling strength value and mutation correlation value of the current field, and to generate the sensitivity level of subsequent fields. The dynamic desensitization module is used to use the sensitivity level of subsequent fields as the desensitization benchmark for the secret category to which the current field belongs, and to perform desensitization operations with corresponding desensitization strength on subsequent fields in the corresponding secret category; The log update module is used to store the result of whether an actual decryption and leakage occurred after this de-identification operation into the historical decryption event statistics information.

7. An electronic device, characterized in that, It includes a processor and a memory, wherein the memory stores a computer program, and the processor executes the adaptive sensitivity identification data classification and dynamic desensitization method as described in any one of claims 1 to 5 by calling the computer program stored in the memory.

8. A computer-readable storage medium, characterized in that, It stores a computer program, which, when executed by a processor, implements the adaptive sensitivity identification data classification and dynamic desensitization method as described in any one of claims 1 to 5.

Images