Artificial intelligence-based data risk prediction method, device, equipment and medium

Abstract

The present application relates to the technical field of artificial intelligence, financial technology and medical technology, and provides a data risk prediction method and device based on artificial intelligence, equipment and medium, wherein the method comprises the following steps: a target data conversion model extracts semantics from to-be-predicted data and converts the extracted semantics into a string, so as to obtain a string corresponding to the to-be-predicted data; the obtained string is matched with a preset sensitive field; and a risk prediction result of the to-be-predicted data is determined according to a matching result. The present application extracts semantics from unstructured data carrying semantic information, and then converts the unstructured data into a character form for matching with a preset sensitive field, so as to determine whether the semantics carried by the unstructured data include preset sensitive information, whether sensitive information is carried in the to-be-predicted data, and the leakage risk of the to-be-predicted data, so as to carry out security control against leakage for to-be-predicted data with high leakage risk.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence, financial technology, and medical technology, and in particular to a data risk prediction method, apparatus, device, and medium based on artificial intelligence. Background Technology

[0002] With the development of artificial intelligence and digitalization, various industries are paying increasing attention to data security. In insurance and finance scenarios, core data such as policyholder identity information and policy terms, as well as medical privacy data such as patient medical records, audio and video recordings of remote consultations, and medical examination reports, all have significant data security management needs.

[0003] Currently, traditional data loss prevention (DLP) services are commonly used to predict the risk of data breaches in publicly released data. These services leverage the fixed format of structured data and, through pre-defined hit rules, can accurately pinpoint sensitive information within structured data, thus quickly predicting data breach risks. However, for unstructured data without a fixed structure, traditional DLP services struggle to accurately access sensitive content. In financial insurance and healthcare scenarios, they are ill-suited for effective risk prediction of unstructured data carrying semantic information, hindering robust security controls to prevent the leakage of sensitive information such as user insurance policies and medical records. Summary of the Invention

[0004] This invention provides a data risk prediction method, apparatus, device, and medium based on artificial intelligence, which improves the accuracy of predicting the leakage risk of semantic unstructured data and is beneficial for the security management of highly sensitive unstructured data.

[0005] Firstly, an artificial intelligence-based data risk prediction method is provided, including: Obtain the data to be predicted; Determine whether the data to be predicted is semantic unstructured data; If so, the data to be predicted is input into the trained target data transformation model to obtain the string corresponding to the data to be predicted. The trained target data transformation model is used to perform semantic characterization processing on the data to be predicted. The string is matched with preset sensitive fields, and the risk prediction result of the data to be predicted is determined based on the matching result.

[0006] Secondly, an artificial intelligence-based data risk prediction device is provided, comprising: The acquisition module is used to acquire the data to be predicted; The judgment module is used to determine whether the data to be predicted is semantic unstructured data; The conversion module is used to input the data to be predicted into the trained target data conversion model if the condition is met, and obtain the string corresponding to the data to be predicted. The trained target data conversion model is used to perform semantic characterization processing on the data to be predicted. The determination module is used to match the string with preset sensitive fields and determine the risk prediction result of the data to be predicted based on the matching result.

[0007] Thirdly, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the artificial intelligence-based data risk prediction method provided in the first aspect.

[0008] Fourthly, a computer-readable storage medium is provided, which stores a computer program that, when executed by a processor, implements the steps of the data risk prediction method based on artificial intelligence provided in the first aspect.

[0009] In the aforementioned AI-based risk prediction methods, devices, equipment, and media, if the acquired data to be predicted is semantically unstructured data, it is input into a trained target data transformation model. The target data transformation model extracts semantic information from the data to be predicted and converts the extracted semantics into a string, thus obtaining the string corresponding to the data to be predicted. The obtained string is then matched with preset sensitive fields, and the risk prediction result is determined based on the matching result. This application utilizes a target data transformation model to extract semantic information from unstructured data carrying semantic information. The semantic information carried by the unstructured data is then converted into a character form that facilitates matching with preset sensitive fields. This allows for the determination of whether the semantic information carried by the unstructured data includes preset sensitive information, i.e., whether the data to be predicted carries sensitive information, thereby determining the leakage risk of the data to be predicted and implementing security control measures to prevent leakage of data with high leakage risk. Attached Figure Description

[0010] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 This is a schematic diagram of an application environment for a data risk prediction method based on artificial intelligence according to an embodiment of the present invention; Figure 2This is a flowchart illustrating a data risk prediction method based on artificial intelligence in one embodiment of the present invention; Figure 3 This is a flowchart illustrating a data risk prediction method based on artificial intelligence in another embodiment of the present invention; Figure 4 This is a flowchart illustrating a data risk prediction method based on artificial intelligence in another embodiment of the present invention; Figure 5 This is a flowchart illustrating a data risk prediction method based on artificial intelligence in another embodiment of the present invention; Figure 6 This is a flowchart illustrating a data risk prediction method based on artificial intelligence in another embodiment of the present invention; Figure 7 This is a flowchart illustrating a data risk prediction method based on artificial intelligence in another embodiment of the present invention; Figure 8 This is a schematic diagram of a data risk prediction device based on artificial intelligence in another embodiment of the present invention; Figure 9 This is a schematic diagram of the structure of a computer device according to an embodiment of the present invention. Detailed Implementation

[0012] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0013] This invention provides a data risk prediction method based on artificial intelligence, which can be applied to, for example... Figure 1In this application environment, the client communicates with the server via a network. The server can obtain user-sent data as prediction data from the client, determine whether the prediction data is semantically unstructured, and if so, send the prediction data to the server. The server then inputs the prediction data into a trained target data transformation model, which performs semantic characterization processing on the prediction data to obtain the corresponding string. The server matches the string with preset sensitive fields and determines the risk prediction result based on the matching result. The obtained risk prediction result can be sent to the client, allowing the client to initiate security control tasks or adjust access permissions for the prediction data based on the risk prediction result. This method can improve the accuracy of risk prediction for the leakage of semantically unstructured data, providing accurate prediction results for risk control of highly sensitive data in the financial insurance and medical fields, ensuring data security and effectively preventing the leakage of core data. It should be noted that this is only an illustrative example of the interaction process between the server and the client and is not intended to limit it.

[0014] The client can include, but is not limited to, various personal computers, laptops, smartphones, tablets, and portable wearable devices. The server can be implemented using a standalone server or a server cluster consisting of multiple servers. The invention will now be described in detail through specific embodiments.

[0015] Please see Figure 2 As shown, Figure 2 A flowchart illustrating an artificial intelligence-based data risk prediction method provided in an embodiment of the present invention includes the following steps: S201, Obtain the data to be predicted.

[0016] For example, the data to be predicted can be business data requiring risk management in different business scenarios. For instance, in a financial scenario, business data flowing through the insurance application chain often involves confidential information such as the policyholder's identity, intention to apply for insurance, and policy terms. Another example is data stored in a hospital's online consultation system in a medical scenario; this data often involves confidential information such as patient personal information, medical records, medical history, and examination reports. It should be noted that this is merely an illustrative description of the data to be predicted and does not constitute a limitation on the data to be predicted.

[0017] In one example, for business systems such as insurance application systems, claims systems, or customer systems, data generated within these systems can be obtained through interface integration. When a business system interacts with external partner platforms such as banks, the data to be transmitted in the interaction link is collected and sent to the detection process, i.e., the risk prediction method provided in this application embodiment is used to predict the risk of the data to be transmitted.

[0018] In one example, for office equipment used by enterprise employees, data export behavior is captured through device management policies. When data is exported from the internal system to mobile devices and peripherals, a data collection mechanism can be triggered, and the collected data can be used as the data to be predicted in this application embodiment.

[0019] In one example, a lightweight data acquisition plugin is deployed for the hospital's office terminals to monitor the terminal's operational behavior. When a user performs outgoing operations such as sending emails or transmitting instant messages, the data to be sent is automatically captured as the data to be predicted in this application embodiment.

[0020] It should be noted that the above data acquisition methods are merely illustrative examples of how to acquire data to be predicted, and are not intended to limit the scope of such acquisition.

[0021] S202, determine whether the data to be predicted is semantic unstructured data.

[0022] For example, semantic unstructured data can be understood as unstructured data that carries semantic meaning. Unstructured data can be understood as a type of data that does not have a fixed preset structure, has an irregular data arrangement, and cannot be directly stored and parsed using traditional structured methods such as database tables.

[0023] In one embodiment, semantic unstructured data may include, but is not limited to, audio and video data. For example, in a financial scenario, this could include video recordings of insurance agent-policyholder interviews or audio recordings of telephone conversations. Or, in a medical scenario, it could include audio recordings of doctors' follow-up phone calls with patients.

[0024] Furthermore, semantic unstructured data may also include image data, meaning that image data and other semantic unstructured data can also be used for risk prediction using the data risk prediction method provided in the embodiments of this application.

[0025] In one example, it can be first determined whether the data to be predicted has the attributes of structured data, such as whether the data has a fixed storage format, etc. If it does not meet the requirements, a lightweight OCR recognition component or a speech segment recognition component can be called to perform preliminary semantic extraction on the data to be predicted. If the semantics can be extracted, the data to be predicted is determined to be semantic unstructured data.

[0026] In addition, such as Figure 3As shown, in some embodiments, determining whether the data to be predicted is semantic unstructured data may include the following steps: S301, Obtain the attribute information of the data to be predicted. The attribute information includes at least one of the following: file name suffix, storage format, and encoding format.

[0027] For example, for data to be predicted that has a clear file format, a file parsing component can be used to extract file metadata, and the file name suffix and / or storage format and / or encoding format of the data to be predicted can be parsed from the metadata.

[0028] For example, if the data to be predicted is a video file, then the file name extension .mp4, the storage format is streaming, and the encoding format is H.264 can be obtained from the metadata of the video file.

[0029] In one example, for data to be predicted that does not have a clear file format, such as real-time call recordings sent by employees through instant messaging tools, a streaming data parsing component can be used to parse the data to be predicted and obtain the encoding format of the data to be predicted.

[0030] For example, if an employee sends an email with an attachment named "Customer Claim Interview Recording.mp3" via the corporate email client, the terminal will monitor the email sending behavior and call the file parsing component to trigger the attribute extraction process; the file parsing component will extract that the file name has the .mp3 extension, the storage format is streaming audio storage, and the encoding format is MP3 encoding.

[0031] S302, Match the attribute information with a preset feature library of semantic unstructured data. The preset feature library includes the set of filename suffixes, storage format and encoding format of semantic unstructured data.

[0032] For example, attribute information of semantic unstructured data involved in the application scenario can be collected according to the needs of the application scenario and organized into a preset feature library. The preset feature library can store the set of file name suffixes, storage format and encoding format involved in audio, the set of file name, storage format and encoding format involved in video, and so on.

[0033] In one example, after obtaining the attribute information through step S301, the attribute information of the data to be predicted is matched with the preset feature library. If the attribute information of the data to be predicted is stored in the preset feature library, the match is determined to be successful; otherwise, the match is determined to be unsuccessful.

[0034] S303 If a match is successful, the data to be predicted is determined to be semantic unstructured data.

[0035] S304 If a match fails, it is determined that the data to be predicted is not semantic unstructured data.

[0036] This embodiment determines whether the data to be predicted is semantic unstructured data defined by a preset feature library by matching attribute information. This allows for a faster determination of whether the data to be predicted is semantic unstructured data that needs to be used for risk prediction in the application scenario.

[0037] S203, if so, input the data to be predicted into the trained target data transformation model to obtain the string corresponding to the data to be predicted. The trained target data transformation model is used to perform semantic characterization processing on the data to be predicted.

[0038] For example, the target data transformation model is obtained by training the basic data transformation model. By training the basic data transformation model, the basic data transformation model learns how to perform semantic characterization processing on the data input to the model, that is, how to convert the semantics carried by the data into string form.

[0039] In one example, the target data transformation model can first extract features from the data to be predicted input to the model through a feature extraction layer, then parse the semantic information of the data to be predicted based on the extracted features, and finally convert the semantic information into a string through a fully connected layer.

[0040] For example, if the data to be predicted is "Customer Claim Interview Recording.mp3" in the example above, which includes personal information provided by the customer, such as mobile phone number, license plate number, bank card number, etc., then after inputting the data to be predicted into the target data conversion model, strings corresponding to the customer's personal information, ID card number, license plate number, and bank card number can be obtained.

[0041] For example, in a medical setting, if the data to be predicted is video data such as "remote consultation recording.mp4", the model can convert the doctor's voice and the patient's description of their condition in the video into strings. For instance, it can convert content such as "Patient: Coughing and fever for the past week, temperature 38.5℃; Doctor: Recommended to have a blood routine test, prescribed ibuprofen sustained-release capsules, 1 capsule twice a day" into strings.

[0042] Alternatively, if the data to be predicted is audio and video clips of the diagnosis and treatment process provided by a medical institution, the model can extract key medical information such as diagnostic conclusions and treatment plans and convert them into strings.

[0043] In one example, if the data to be predicted is not semantic unstructured data, it can be further determined whether the data to be predicted is structured data. If it is structured data, the Data Leakage Prevention Service (DLP) is invoked to perform leakage prevention processing on the data to be predicted.

[0044] S204 matches the string with the preset sensitive fields and determines the risk prediction result of the data to be predicted based on the matching result.

[0045] For example, preset sensitive fields can be set according to specific application scenarios. For instance, in a financial scenario, a user's ID number, mobile phone number, etc., can be used as preset sensitive fields; in a medical scenario, the patient's department, treatment time, etc., can be used as preset sensitive fields.

[0046] In one example, the string obtained in step S203 can be compared with the content of a preset sensitive field to determine the degree of similarity between the two. The degree of similarity can be used as the matching result. Furthermore, a prediction model can be built and trained, and then the prediction model can predict the sensitivity of the string based on the degree of similarity, which can be used as the risk prediction result of data leakage risk.

[0047] In summary, the AI-based data risk prediction method provided in this application, if the acquired data to be predicted is semantically unstructured data, inputs the data into a trained target data transformation model. The target data transformation model extracts semantic information from the data to be predicted and converts the extracted semantics into a string, thus obtaining the string corresponding to the data to be predicted. Then, the obtained string is matched with preset sensitive fields, and the risk prediction result of the data to be predicted is determined based on the matching result. This application utilizes a target data transformation model to extract semantic information from unstructured data carrying semantic information, and then converts the semantics carried by the unstructured information into a character form that is easy to match with preset sensitive fields. This allows for the determination of whether the semantics carried by the unstructured data includes preset sensitive information, i.e., accurately determining whether the data to be predicted carries sensitive information, thereby determining the leakage risk of the data to be predicted, and enabling security control to prevent leakage of data with high leakage risk.

[0048] In some embodiments, such as Figure 4 As shown, the basic data to be trained can be transformed into a model and trained in the following ways, including the following steps: S401, construct a training set based on semantic unstructured data under a preset business scenario.

[0049] For example, semantically unstructured data related to the same business scenario are collected as samples, and a training set is constructed with a positive to negative sample ratio of 5:1. Positive samples are audio and video data containing sensitive information, while negative samples are audio and video data without sensitive information. All sample data are labeled, and the labeling content may include the sample category (i.e., positive or negative sample), the time segment or keyframe where the sensitive information is located, and the string corresponding to the sensitive information. Simultaneously, the training set is divided into a training subset and a validation subset in an 8:2 ratio.

[0050] For example, if the preset scenario is a financial scenario, the training set can be constructed as follows: Positive examples: video recordings of insurance application interviews, which contain sensitive information such as the policyholder's ID number and bank card number; audio recordings of claims investigations, which contain sensitive information such as the claim amount and the insured's identity information; and video explanations of the policy terms, which contain sensitive information such as the core policy terms and the policyholder's financial information. Negative samples: Insurance product promotional videos, which do not contain sensitive information; internal employee business training recordings, which do not contain sensitive information.

[0051] For example, if the preset scenario is a medical scenario, the training set can be constructed as follows: Positive examples include: remote consultation recordings of patients, which contain sensitive medical information such as descriptions of the patient's condition and diagnostic conclusions; medical follow-up recordings, which contain sensitive information such as medical expenses and treatment details; and audio and video clips of the treatment process provided by medical institutions, which contain sensitive information related to medical records. Negative samples: General medical and health science videos, which do not contain sensitive information; audio recordings explaining medical knowledge that are not related to insurance, which do not contain sensitive information.

[0052] S402 trains the basic data transformation model based on the training set and spatiotemporal attention mechanism until the basic data transformation model reaches the preset convergence condition, thus obtaining the trained target data transformation model. The basic data transformation model includes a keyframe extraction layer, a feature extraction layer, and a long short-term memory network.

[0053] For example, a basic data transformation model can be constructed based on a Long Short-Term Memory (LSTM) network. LSTM is used to learn the temporal and spatial dependencies between features. A Convolutional Neural Network (CNN) is set before the LSTM as a feature extraction layer. The CNN is used to learn and capture local features, such as the time-frequency features of audio and the image features of video keyframes. To facilitate the processing of video data, a keyframe extraction layer can be further set before the CNN. It should be noted that this is only an exemplary illustration of the basic data transformation model structure. Pooling layers and fully connected layers can be added to the basic data transformation model as needed, and this application does not impose any limitations.

[0054] In one example, a cleaned training subset can be input into the base data model, and mixed-precision training can be used to reduce memory usage. A spatiotemporal attention mechanism is introduced during training to improve feature extraction depth. For instance, when training with audio samples, a temporal attention mechanism is introduced to encourage the model to focus on the temporal dependencies of audio during training; when training with video samples, a spatial-temporal dual attention mechanism is introduced to encourage the model to focus on the temporal and spatial dependencies of video during training.

[0055] Before training, set hyperparameters such as initial learning rate, time step, feature dimension, and number of units in the LSTM.

[0056] During training, gradient descent can be used to iteratively update model parameters.

[0057] After each round of training, the model's performance is validated using a validation subset. Once the model reaches a preset convergence condition, training is confirmed as complete, and the trained model is used as the target data transformation model in the above embodiments. The preset convergence condition may include a model loss value less than a preset loss threshold, such as 0.05. This application does not impose limitations on the preset convergence condition.

[0058] In this embodiment, a Long Short-Term Memory (LSTM) network is used to construct a basic data transformation model, which is then trained using a spatiotemporal attention mechanism. This training model learns the temporal and / or spatial dependencies in audio and video, focusing on the semantic relationships between different time segments in the audio and the semantic relationships between different keyframes in the video. Compared to existing technologies that determine the sensitivity of the entire audio and video data by judging whether a segment or a single keyframe contains sensitive information, the target data transformation model trained in this embodiment can more comprehensively consider the contextual content of the audio and video data, obtain the complete semantics expressed by the audio and video, and thus accurately determine the sensitivity of the audio and video and predict the risk of data leakage during subsequent risk detection.

[0059] In some embodiments, the risk prediction result includes a risk level, such as Figure 5 As shown, step S204 above, "matching the string with preset sensitive fields and determining the risk prediction result of the data to be predicted based on the matching result," may include the following steps: S501, according to the preset matching rules, match the string with the preset sensitive fields, and determine the target sensitive fields and the number of target sensitive fields that are successfully matched. The preset matching rules include regular expression scripts or keyword matching.

[0060] For example, preset matching rules may include, but are not limited to, regular expression script matching or keyword matching.

[0061] For sensitive fields with fixed formats, such as mobile phone numbers, ID card numbers, and bank card numbers, regular expression scripts can be pre-set for precise matching; for semantic sensitive fields in medical scenarios, such as specific symptoms, treatment plans, and medical expenses, keyword matching can be used.

[0062] In one example, if the string output by the target number conversion model is: "Insured Zhang San, ID number xxxxxxxxxxxxxxxxxx, Contact number aaaaaaaaaaa, Policy number B20240520001", the corresponding strings are as follows: During the matching process, the regular expression scripts corresponding to each preset sensitive field can be called sequentially to participate in string matching, or the keyword library corresponding to the preset sensitive field can be used to participate in string matching. For example, calling the regular expression script corresponding to the ID card number to participate in the matching will match the target sensitive field "ID card number" with the content "xxxxxxxxxxxxxxxxxx", and the count will be 1; calling the regular expression script corresponding to the mobile phone number to participate in the matching will match the target sensitive field "mobile phone number" with the content "aaaaaaaaaaaa", and the count will be 1; using the keyword library corresponding to the policy number to participate in the matching will match the target sensitive field "policy number" with the content "B20240520001", and the count will be 1. Final matching results: The target sensitive fields are ID card number, mobile phone number, and policy number, with a total of 4 target sensitive fields.

[0063] In one example, if the string output by the target number conversion model is: "Patient Li Si, medical record number M20240521008, has had a cough and fever for the past week, with a body temperature of 38.5℃; doctor's diagnosis: acute bronchitis, recommends a blood routine test, and prescribes ibuprofen sustained-release capsules, 1 capsule twice a day, with an estimated test cost of 5200 yuan" During the matching process, the keyword database corresponding to the medical record number is used. The target sensitive field "medical record number" is matched, with the content "M20240521008" (1 match). The keyword database corresponding to the symptom (containing "cough," "fever," and "acute bronchitis") is used. The target sensitive field "specific symptom name" is matched, with the content "cough," "fever," and "acute bronchitis" (3 matches). The keyword database corresponding to the treatment plan (containing "blood routine examination" and "ibuprofen sustained-release capsules") is used. The target sensitive field "treatment plan" is matched, with the content "blood routine examination" and "ibuprofen sustained-release capsules" (2 matches). The keyword database corresponding to medical expenses is used. The target sensitive field "medical expense items" is matched, with the content "examination fee 5200 yuan" (1 match). Final matching results: The target sensitive fields are medical record number, specific disease name, treatment plan, and medical expenses, with a total of 7 target sensitive fields.

[0064] It should be noted that the above examples are merely illustrative and are not intended to limit the embodiments of this application.

[0065] S502, determine the risk level based on the target sensitive fields and the number of target sensitive fields.

[0066] For example, risk level classification rules can be preset. For example, low sensitivity level: the number of target sensitive fields is less than 5 and does not include high-risk sensitive fields (for example, high-risk sensitive fields are ID card number, medical record number, bank card number, etc.); medium sensitivity level: the number of target sensitive fields is between 5 and 100, or includes 1 to 3 high-risk sensitive fields; high sensitivity level: the number of target sensitive fields is greater than 10, or includes more than 4 high-risk sensitive fields.

[0067] This embodiment uses regular expressions to accurately identify sensitive fields with fixed formats and keyword matching to cover semantically sensitive fields in medical scenarios, solving the problem of difficulty in quantifying sensitive information after semantic extraction of unstructured data. At the same time, it divides risk levels based on the meaning and number of target sensitive fields, breaking through the traditional "one-size-fits-all" interception mode of data leakage prevention services and improving the accuracy of digital risk detection.

[0068] In some embodiments, if the data to be predicted is externally transmitted data, such as... Figure 6 As shown, after "determining the risk prediction result of the data to be predicted based on the matching result" in step S204 above, the method further includes the following steps: S601, based on the risk prediction results, determines whether to initiate a data interception task.

[0069] For example, if the data to be predicted is data that needs to be sent from the terminal to other devices, then after determining the risk prediction result, it can be further determined whether to intercept this data based on the risk prediction result.

[0070] For example, if the risk prediction result for an outgoing email shows that its risk level is high-sensitivity, then the email will be blocked; if the risk level is low-sensitivity, then there is no need to block it.

[0071] In one example, a data interception task can be performed by calling the Data Loss Prevention Service (DLP).

[0072] S602, if it is determined that the data interception task will be started, the data to be predicted will be intercepted, and the approval process for releasing the interception will be triggered according to the risk level in the risk prediction result.

[0073] For example, if it is determined that a data interception task will be initiated, while intercepting the data to be predicted, an approval process for releasing the intercepted data can be triggered according to the risk level corresponding to the data to be predicted, so as to ensure the progress of normal business.

[0074] For example, for data classified as medium sensitive, a notification is sent to the reviewer corresponding to that risk level, and the blocked data is released after the reviewer approves it. For highly sensitive data, joint approval with the security department is required. This approach not only blocks the risk of core sensitive data leakage at the source but also avoids the impact of excessive control on business efficiency, achieving a balance between "security control" and "business efficiency."

[0075] In some embodiments, the notification message sent to the auditor may include the risk prediction result of the intercepted data, the time the data was sent out, the source user account, the target email address, the target sensitive fields involved, the number of target sensitive fields, the source IP address, the target IP address, etc., for subsequent tracing.

[0076] In some embodiments, if the data to be predicted includes audio data and / or video data, such as Figure 7 As shown, before step S203 above, "inputting the data to be predicted into the trained target data transformation model to obtain the string corresponding to the data to be predicted", the method also includes the following steps: S701 uses a hash value verification method to determine the completeness of the data to be predicted.

[0077] For example, after the terminal or business system collects the data to be predicted, a hash calculation is performed on the complete data to be predicted to generate an original hash value; before inputting the target data into the transformation model, the hash value of the data to be predicted is calculated again, and the hash value is compared with the original hash value to determine the completeness of the data to be predicted.

[0078] S702, if the completeness of the data to be predicted reaches the preset completeness, outlier processing is performed on the data to be predicted to remove keyframes that do not reach the preset clarity and / or audio segments without semantic expression in the data to be predicted.

[0079] For example, if the completeness of the data to be predicted reaches a preset completeness, then outlier processing is further performed on the data to be predicted. If the data to be predicted is audio data, outliers can be removed to discard audio segments without semantic expression; if the data to be predicted is video data, outliers can be removed to remove keyframes that do not meet the preset clarity. This reduces the workload of subsequent processes.

[0080] If the completeness of the data to be predicted does not reach the preset completeness, it can be determined that the data to be predicted has been tampered with or lost, which can trigger the anomaly handling mechanism. After the anomaly handling is completed, the data to be predicted will be collected again.

[0081] S703 uses the outlier-processed data to be predicted as the input target data to transform the model's data for prediction.

[0082] In this embodiment, by performing integrity calculation and outlier processing on the data to be predicted, data that cannot express semantics is removed from the data to be predicted, while ensuring that the data to be predicted has not been tampered with or lost. This reduces the workload of subsequent processes and improves processing efficiency.

[0083] In some embodiments, the data to be predicted may also undergo cleaning processes such as deduplication and standardization.

[0084] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0085] In one embodiment, an artificial intelligence-based data risk prediction device is provided, which corresponds one-to-one with the artificial intelligence-based data risk prediction method described in the above embodiments. For example... Figure 8 As shown, the data risk prediction device 800 includes: an acquisition module 801, a judgment module 802, a conversion module 803, and a determination module 804. Detailed descriptions of each functional module are as follows: Module 801 is used to acquire the data to be predicted; The judgment module 802 is used to determine whether the data to be predicted is semantic unstructured data; The conversion module 803 is used to input the data to be predicted into the trained target data conversion model to obtain the string corresponding to the data to be predicted. The trained target data conversion model is used to perform semantic characterization processing on the data to be predicted. The determination module 804 is used to match strings with preset sensitive fields and determine the risk prediction result of the data to be predicted based on the matching results.

[0086] In some embodiments, the determination module 802 is specifically used to: obtain attribute information of the data to be predicted, the attribute information including at least one of file name suffix, storage format and encoding format; The system matches attribute information with a preset feature library of semantic unstructured data. The preset feature library includes a set of filename suffixes, storage format, and encoding format of semantic unstructured data. If the match is successful, the data to be predicted is determined to be semantic unstructured data. If the match fails, the data to be predicted is determined not to be semantic unstructured data.

[0087] In some embodiments, semantic unstructured data includes audio data and video data.

[0088] In some embodiments, the device 800 further includes a model training module, which is used to: construct a training set based on semantic unstructured data under a preset business scenario; train the basic data transformation model based on the training set and a spatiotemporal attention mechanism until the basic data transformation model reaches a preset convergence condition, and obtain a trained target data transformation model; the basic data transformation model includes a keyframe extraction layer, a feature extraction layer and a long short-term memory network.

[0089] In some embodiments, the risk prediction result includes a risk level. The determination module 804 is specifically used to: match the string with preset sensitive fields according to preset matching rules, determine the target sensitive fields and the number of target sensitive fields that are successfully matched, the preset matching rules include regular expression scripts or keyword matching; and determine the risk level based on the target sensitive fields and the number of target sensitive fields.

[0090] In some embodiments, if the data to be predicted is outgoing data, the device 800 further includes an interception module, which is used to: determine whether to start a data interception task based on the risk prediction result; if it is determined to start a data interception task, then intercept the data to be predicted and trigger an approval process for releasing the interception according to the risk level in the risk prediction result.

[0091] In some embodiments, if the data to be predicted includes audio data and / or video data, the device 800 further includes a data cleaning module, which is configured to: determine the completeness of the data to be predicted using a hash value verification method; if the completeness of the data to be predicted reaches a preset completeness, perform outlier processing on the data to be predicted to remove keyframes that do not reach a preset clarity and / or audio segments without semantic expression from the data to be predicted; and use the outlier-processed data to be predicted as the input data to the target data transformation model.

[0092] In summary, the AI-based data risk prediction device provided in this application, if the acquired data to be predicted is semantically unstructured data, inputs the data to be predicted into a trained target data transformation model. The target data transformation model extracts semantics from the data to be predicted and converts the extracted semantics into a string, thereby obtaining the string corresponding to the data to be predicted. Then, the obtained string is matched with preset sensitive fields, and the risk prediction result of the data to be predicted is determined based on the matching result. This application utilizes a target data transformation model to extract semantics from unstructured data carrying semantic information, and then converts the semantics carried by the unstructured information into a character form that is easy to match with preset sensitive fields. This allows for the determination of whether the semantics carried by the unstructured data includes preset sensitive information, that is, whether the data to be predicted carries sensitive information, thereby determining the leakage risk of the data to be predicted, so as to carry out leakage prevention and security management for data to be predicted with high leakage risk.

[0093] Specific limitations regarding the AI-based data risk prediction device can be found in the limitations of the AI-based data risk prediction method described above, and will not be repeated here. Each module in the aforementioned data risk prediction device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0094] In one embodiment, a computer device is provided, such as Figure 9 As shown, the computer device 900 includes a memory 901, a processor 902, and a computer program stored on the memory 901 and executable on the processor 902. When the processor 902 executes the computer program, it implements the steps of the data risk prediction method based on artificial intelligence in any of the above embodiments.

[0095] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps of the artificial intelligence-based data risk prediction method of any of the above embodiments.

[0096] It should be noted that the functions or steps that can be implemented by the computer-readable storage medium or computer device described above can be referred to the description of each step of the data risk prediction method based on artificial intelligence in the foregoing method embodiments. To avoid repetition, they will not be described one by one here.

[0097] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0098] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is used as an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0099] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.

Claims

1. A data risk prediction method based on artificial intelligence, characterized in that, The method includes: Obtain the data to be predicted; Determine whether the data to be predicted is semantic unstructured data; If so, the data to be predicted is input into the trained target data transformation model to obtain the string corresponding to the data to be predicted. The trained target data transformation model is used to perform semantic characterization processing on the data to be predicted. The string is matched with preset sensitive fields, and the risk prediction result of the data to be predicted is determined based on the matching result.

2. The method as described in claim 1, characterized in that, The step of determining whether the data to be predicted is semantic unstructured data includes: Obtain the attribute information of the data to be predicted, wherein the attribute information includes at least one of file name suffix, storage format, and encoding format; The attribute information is matched with a preset feature library of the semantic unstructured data, the preset feature library including the set of filename suffixes, storage format and encoding format of the semantic unstructured data; If the match is successful, the data to be predicted is determined to be the semantic unstructured data; If the match fails, it is determined that the data to be predicted is not the semantic unstructured data.

3. The method as described in claim 1, characterized in that, The semantic unstructured data includes audio data and video data.

4. The method as described in claim 3, characterized in that, The underlying data transformation model is trained using the following methods: A training set is constructed based on semantic unstructured data from a pre-defined business scenario; Based on the training set and the spatiotemporal attention mechanism, the basic data transformation model is trained until the basic data transformation model reaches the preset convergence condition, and the trained target data transformation model is obtained. The basic data transformation model includes a keyframe extraction layer, a feature extraction layer, and a long short-term memory network.

5. The method as described in claim 1, characterized in that, The risk prediction result includes a risk level. The process of matching the string with preset sensitive fields and determining the risk prediction result of the data to be predicted based on the matching result includes: According to the preset matching rules, the string and the preset sensitive fields are matched to determine the target sensitive fields that are successfully matched and the number of target sensitive fields. The preset matching rules include regular expression scripts or keyword matching. The risk level is determined based on the target sensitive fields and the number of target sensitive fields.

6. The method as described in claim 1, characterized in that, If the data to be predicted is outsourced data, after determining the risk prediction result of the data to be predicted based on the matching result, the method further includes: Based on the risk prediction results, determine whether to initiate a data interception task; If it is determined that a data interception task will be initiated, the data to be predicted will be intercepted, and an approval process for releasing the intercepted data will be triggered according to the risk level in the risk prediction result.

7. The method as described in claim 1, characterized in that, If the data to be predicted includes audio data and / or video data, before inputting the data to be predicted into the trained target data conversion model to obtain the string corresponding to the data to be predicted, the method further includes: The completeness of the data to be predicted is determined by using a hash value verification method. If the completeness of the data to be predicted reaches the preset completeness, outlier processing is performed on the data to be predicted to remove keyframes that do not reach the preset clarity and / or audio segments without semantic expression in the data to be predicted. The outlier-processed data to be predicted is used as the input data to the target data transformation model.

8. A data risk prediction device based on artificial intelligence, characterized in that, The device includes: The acquisition module is used to acquire the data to be predicted; The judgment module is used to determine whether the data to be predicted is semantic unstructured data; The conversion module is used to input the data to be predicted into the trained target data conversion model if the condition is met, and obtain the string corresponding to the data to be predicted. The trained target data conversion model is used to perform semantic characterization processing on the data to be predicted. The determination module is used to match the string with preset sensitive fields and determine the risk prediction result of the data to be predicted based on the matching result.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the data risk prediction method based on artificial intelligence as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the data risk prediction method based on artificial intelligence as described in any one of claims 1 to 7.

Images