A method and system for global perception and coordinated handling of data circulation risks

Abstract

This invention discloses a method and system for global perception and coordinated handling of data circulation risks, belonging to the field of data security and data element circulation technology. The method collects full lifecycle lineage events to incrementally construct a data lineage graph; performs real-time risk perception from four dimensions: abnormal behavior, policy violations, environmental threats, and related propagation; infers risk propagation paths and impact ranges based on graph traversal and graph neural network models; distributes differentiated handling instructions to multiple entities using a handling token mechanism; and finally, automatically verifies and stores handling records on the blockchain. The system includes a data lineage graph engine, a multi-dimensional risk perception engine, a risk propagation analyzer, a coordinated handling coordinator, and a handling effect verification module to implement the corresponding steps in the method. This invention solves problems such as the lack of global perception of cross-domain risks, the lack of correlation between lineage and risk propagation, and the lack of multi-entity coordinated handling mechanisms, achieving global visibility, analyzability, and manageability of data circulation risks.

Description

Technical Field

[0001] This invention belongs to the field of data security and data element circulation technology, specifically relating to a method and system for global perception and coordinated handling of data circulation risks. Background Technology

[0002] As the market-oriented reform of data elements continues to deepen, the flow of data among multiple entities and at multiple levels has become the norm. However, the complexity of the data flow chain has brought unprecedented challenges to risk perception. Once data enters the circulation network, its risks are no longer limited to a single node, but may spread and diffuse among multiple entities along data lineages, forming a "risk contagion effect."

[0003] The current mainstream data circulation risk management models mainly include the following:

[0004] Single-point security audit model: Each participant deploys security audit tools within its own system boundary to detect data entering and leaving its domain. This model can only perceive risks within its own domain and cannot obtain a global view. When risks spread across domains, each party acts independently and cannot form a collaborative defense.

[0005] Static rule-based inspection mode: This mode performs compliance checks on data operations using a predefined set of security rules, such as sensitive field detection and access frequency restrictions. However, it relies on the completeness of the rules and lacks the ability to detect new or combined risks, and it cannot perceive the dynamic propagation of risks along the data flow path.

[0006] Post-event log analysis mode: Collect operation logs from each node and perform offline analysis periodically to detect abnormal behavior. This mode has a delayed response, and risks are often only discovered after the fact. It cannot support real-time intervention, and the log data is scattered across various participants, making it difficult to form cross-domain correlation analysis.

[0007] Centralized risk control platform model: This model involves building a centralized risk management platform that requires all participating parties to report data to a central node for unified analysis. This model suffers from serious data sovereignty issues, as parties are unwilling to upload data to the central node, and the central node itself carries a high risk of single-point failure.

[0008] In summary, existing technologies have the following four prominent problems:

[0009] 1) Lack of global risk perception capability across domains: Existing technologies can only perceive risks within a single node or domain, and cannot build a global risk view of data flow across multiple participating entities. When risks propagate among multiple entities, each entity can only see a local fragment and cannot determine the source, propagation path, and scope of impact of the risk.

[0010] 2) Lack of correlation between data lineage and risk propagation: Existing risk detection technologies fail to combine data lineage relationships with risk propagation patterns. The data derivation relationship from raw data to processed data to secondary use data determines the risk propagation path, but existing tools cannot automatically infer the upstream and downstream impact range of risks based on lineage maps.

[0011] 3) Lack of a multi-entity collaborative response mechanism: When cross-domain risks occur, multiple affected entities need to coordinate their response actions, but existing technologies lack a coordination mechanism for multi-entity collaborative response. The response actions of each entity are independent of each other, failing to form a synergistic effect of "one-point trigger, full-chain response". The risk may re-spread to entities that have not completed their response even after one entity has completed its response.

[0012] 4) Disconnect between risk perception and data flow control: The existing risk perception system and data flow control system are independent of each other, and risk perception results cannot be automatically translated into control actions. When a risk is identified, manual intervention is required to adjust the control strategy, resulting in slow response speed and reliance on the accuracy of human judgment. Summary of the Invention

[0013] The purpose of this invention is to propose a method and system for global perception and coordinated handling of data circulation risks. By adopting a closed-loop architecture of "graph construction → risk perception → propagation analysis → coordinated handling → effect verification", it uses a data lineage knowledge graph as the basis for risk propagation analysis, multi-dimensional risk perception as the core of risk identification, and a multi-entity coordinated handling framework as the guarantee for collaborative response. This addresses the problems existing in the prior art, such as the lack of global perception capability for cross-domain risks, the lack of correlation between data lineage and risk propagation, the lack of multi-entity coordinated handling mechanisms, and the separation of risk perception and control. It achieves global visibility, analyzability, and manageability of data circulation risks.

[0014] To achieve the above objectives, the present invention adopts the following technical solution:

[0015] A method for global perception and coordinated handling of data circulation risks includes the following steps:

[0016] Step 1, Incremental Construction and Maintenance of Data Lineage Graph: Collect lineage events during the entire lifecycle of data flow, and construct and incrementally update a directed data lineage graph (DLG) with data entities as nodes and flow relationships as edges based on the lineage events.

[0017] Step 2, Multi-dimensional Real-time Risk Perception: For each node in the data circulation network, conduct real-time risk monitoring from four dimensions: abnormal behavior, policy violation, environmental threat, and related propagation, and trigger risk events;

[0018] Step 3: Risk propagation path analysis based on data lineage graph: Taking the node where the risk event is located as the risk source node, perform graph traversal on the data lineage graph, use the graph neural network (GNN) model to calculate the risk propagation probability along the data flow direction, stop traversal when the preset conditions are met, and output the risk impact range;

[0019] Step 4: Generation and distribution of multi-entity joint response instructions: Based on the risk propagation path analysis results, generate differentiated response instructions, distribute the response instructions to each affected entity using a response token mechanism, and receive corresponding response confirmation signals;

[0020] Step 5, Verification of the handling effect and full-chain evidence storage: After receiving the handling confirmation signal from all affected entities, perform automated handling effect verification, hash the verification result together with the complete risk handling process record, and upload it to the consortium blockchain for evidence storage, forming an immutable risk handling evidence chain.

[0021] Furthermore, in step 2, behavioral anomaly perception employs a temporal anomaly detection model based on Long Short-Term Memory (LSTM) networks to extract and analyze behavioral features in real time, including data access frequency, access time distribution, access data volume, and access path. When behavioral features deviate from the normal baseline, a behavioral anomaly risk event is triggered.

[0022] The system detects policy violations and verifies in real time whether usage behavior complies with the constraints of related contracts, including at least the scope of use, duration of use, and type of operation; it immediately generates a policy violation risk event when a violation is detected.

[0023] Environmental threat perception involves continuously assessing the security status of the data usage environment, including: equipment security status, network environment, and operating environment; scoring each separately and then weighting and summing the results to obtain a comprehensive environmental threat score; when the comprehensive environmental threat score falls below a preset threshold, an environmental threat risk event is triggered.

[0024] The system is designed to detect the propagation of risk events. For nodes where risk events occur, it automatically queries the data lineage map to find upstream and downstream nodes that are related to the node. Based on the lineage distance between nodes and the type of risk event, it assesses the probability of risk propagation and exposure, and pushes early warning notifications to nodes whose probability of risk propagation and exposure is higher than a preset threshold.

[0025] For each node, risk signals from three dimensions—abnormal behavior, policy violation, and environmental threat—are weighted and aggregated to calculate the node's own risk score, which is then compared with a preset grading threshold to determine the risk level.

[0026] Furthermore, in step 3, the graph traversal adopts the breadth-first search (BFS) algorithm, starting from the risk source node and traversing along the outgoing edges of the data lineage graph, which is the data flow direction, and sets the maximum propagation depth and minimum propagation probability threshold as the stopping traversal; when the propagation path exceeds the maximum propagation depth or the propagation probability is lower than the minimum propagation probability threshold, the traversal stops and the risk impact range is output; the risk impact range includes the set of affected nodes, the risk exposure probability of each node, and the complete propagation path graph.

[0027] Furthermore, in step 3, a propagation attenuation mechanism is introduced. After each hop, the propagation probability is multiplied by an attenuation factor to simulate the natural attenuation of risk as the propagation distance increases.

[0028] Furthermore, the risk propagation path analysis also includes: starting from the risk source node, tracing back along the incoming edge direction of the data lineage graph to identify the upstream lineage node of the risk source data, and sending a risk tracing notification to the data holder corresponding to the upstream lineage node to trigger its review of the compliance of the original data release.

[0029] Furthermore, in step 4, for each affected node, a weighted fusion of factors including its own risk score, risk exposure probability, data sensitivity and node importance is performed to obtain a comprehensive risk score for each node, and the final risk level is determined according to a preset grading threshold.

[0030] The handling priority is determined according to the final risk level from high to low, and within the same level, it is sorted according to the risk exposure probability from high to low; then, based on the risk type and node role, historical handling plans are matched from the risk knowledge base to generate differentiated handling instructions.

[0031] The handling instructions are divided into three levels, each corresponding to a risk level: Level 1 instructions are early warning notifications, Level 2 instructions are operation restrictions, and Level 3 instructions are mandatory isolation.

[0032] The disposal token includes a token identifier, a target entity identifier, a disposal action, an execution deadline, and a confirmation callback address;

[0033] If the disposal token does not receive a confirmation signal within the execution deadline, the disposal level will be automatically escalated and redistributed, while triggering a manual intervention notification.

[0034] Furthermore, the risk management status of each data circulation node includes: normal, warning, restricted, isolated, under management verification, and recovered; the transition between each status is triggered by risk score or management token level.

[0035] Furthermore, in step 5, the verification of the automated processing effect includes:

[0036] For data access blocking, a test request is sent to verify whether the data access channel has been closed.

[0037] For sandbox destruction, the sandbox status is verified by querying the trusted execution environment management interface to determine whether the sandbox has been destroyed.

[0038] For actions involving the revocation of permissions, the access permissions of the corresponding account are verified by querying the permission management system to confirm whether the access permissions have been cleared.

[0039] This invention also protects a data circulation risk global perception and coordinated response system, comprising:

[0040] The data lineage graph engine is used to collect and maintain the lineage relationships of data throughout the entire data flow process, and to construct and incrementally update a directed data lineage graph with data entities as nodes and flow relationships as edges; the node attributes include at least data identifier, data holder, sensitivity level, creation time, and lifecycle status; the edge attributes include at least flow time, flow direction, associated contract identifier, and data transformation type.

[0041] The multi-dimensional risk perception engine is used to perform real-time risk perception of the entire data flow chain from four dimensions: abnormal behavior, policy violation, environmental threat and related propagation, and generate risk events.

[0042] The risk propagation analyzer is used to deduce the propagation path of identified risk events based on the data lineage map and graph neural network model, and output the scope of risk impact.

[0043] The coordinated response coordinator is used to generate collaborative response instructions for multiple affected entities based on the risk propagation analysis results, and distributes the instructions and receives confirmation signals using a response token mechanism.

[0044] Risk situation awareness dashboard is used to present the overall risk situation of the data circulation network in a visual way in real time;

[0045] The disposal effect verification module is used to automatically verify whether the disposal effect meets expectations after each subject completes the disposal action, and write the verification result into the consortium blockchain for evidence storage;

[0046] A risk knowledge base is used to accumulate historical risk events, propagation patterns, response plans, and their effectiveness evaluations, and to continuously learn and optimize risk identification and propagation prediction models.

[0047] Furthermore, the data circulation risk global awareness and coordinated response system adopts a four-layer architecture design, including:

[0048] The participating entities include data providers, data users, and regulators; wherein the regulators have read-only access to the global data lineage graph for compliance auditing.

[0049] The kinship collection layer's core component is the kinship event collector, which is deployed on each participating entity's node and is responsible for automatically capturing and reporting kinship events when key events, including data release, transfer, processing, use, and destruction, occur.

[0050] The data lineage graph service layer includes a data lineage graph engine, a risk perception engine, a risk propagation analyzer, and a coordinated response coordinator.

[0051] The infrastructure layer includes a graph database, a streaming computing framework, a consortium blockchain evidence storage module, and a risk knowledge base. The graph database is used to store data lineage graphs and supports efficient graph traversal queries. The streaming computing framework supports preprocessing of real-time lineage events. The consortium blockchain evidence storage module is used to record risk events and their handling processes in an immutable manner. The risk knowledge base is used to accumulate historical risk events and handling experience.

[0052] Each participating entity's lineage collector reports lineage events in real time, and the data lineage graph engine of the graph service layer incrementally updates the data lineage graph; the risk perception engine continuously monitors the risk status of each node, and triggers the risk propagation analyzer to perform graph traversal analysis after a risk is detected; the risk propagation analysis results drive the linkage response coordinator to generate response tokens and distribute them to the affected entities; after each entity completes the response and sends back confirmation, the response results along with the complete process record are written to the consortium blockchain.

[0053] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0054] Achieving global visibility of cross-domain data flow risks: By constructing a global view of data flow across multiple entities through a data lineage knowledge graph, the limitations of single-point security awareness are broken. Any participant can query the data lineage path and risk status related to them within the authorized scope, realizing a leap from "local blindness" to "global awareness".

[0055] The system enables automatic projection of risk propagation paths: Based on the combination of graph neural networks and lineage graphs, the system can complete the projection of propagation paths within seconds after a risk event occurs, identify the set of affected downstream nodes, and transform the work of manually analyzing the scope of risk impact into automatic projection by the system, improving the analysis speed from hours to seconds.

[0056] Multi-entity collaborative response significantly improves efficiency: The response token mechanism enables orderly coordination of the actions of various entities, and the end-to-end response time from risk identification to the completion of the entire response chain does not exceed 30 seconds, which is a significant improvement in efficiency compared to the traditional manual coordination mode that usually takes several hours.

[0057] Verifiability of handling results: Through an automated handling results verification mechanism, ensure that the actual effect of the handling actions is consistent with the expectations, and avoid the problem of "handling but not handling well";

[0058] Complete and traceable risk management: The complete risk management process—perception → analysis → management → verification—is recorded on the consortium blockchain after being hashed, forming an immutable risk management file that can serve as the basis for post-event arbitration and compliance audits;

[0059] Meanwhile, this invention provides "out-of-the-box" cross-domain risk perception services for small and medium-sized data circulation participants, provides security infrastructure for the data element market, and provides technical support for data processors to strengthen risk monitoring. Attached Figure Description

[0060] Figure 1 The system architecture diagram provided for this invention;

[0061] Figure 2 The multidimensional risk perception and propagation analysis flowchart provided for this invention;

[0062] Figure 3 The timing diagram for the coordinated processing provided by this invention;

[0063] Figure 4 This is a schematic diagram illustrating the risk propagation of the data kinship map provided by the present invention;

[0064] Figure 5 The risk management status diagram provided for this invention. Detailed Implementation

[0065] To make the technical solution of the present invention clearer, the technical solution of the present invention will be described in further detail below with reference to the accompanying drawings and specific embodiments.

[0066] This invention provides a method for global perception and coordinated handling of data circulation risks, comprising the following steps:

[0067] Step 1: Incremental Construction and Maintenance of Data Lineage Map: Collect and record lineage events throughout the entire data lifecycle, including key nodes such as data publishing, data receiving, data processing, data usage, and data destruction. The data structure for lineage events adopts JSON format, including:

[0068] {

[0069] "event_id": "Unique event identifier",

[0070] "event_type": "PUBLISH / TRANSFER / TRANSFORM / USE / DESTROY",

[0071] "source_data_id": "Source data identifier",

[0072] "target_data_id": "Target data identifier, applicable to processing or derivative scenarios",

[0073] "operator": "Operator identifier",

[0074] "timestamp": "Event timestamp",

[0075] "contract_id": "Identifier of the associated contract",

[0076] "transform_type": "ORIGINAL / PROCESSED / AGGREGATED / DERIVED"

[0077] };

[0078] Based on the aforementioned lineage events, a directed data lineage graph is constructed and incrementally updated, with data entities as nodes and flow relationships as edges, to ensure the real-time nature of the graph. At the same time, the data lineage graph is periodically compressed and snapshots are stored to support retrospective queries of historical data lineage graphs.

[0079] Step 2, Multi-dimensional Real-time Risk Perception: Real-time risk monitoring is conducted on each node in the data circulation network from four dimensions: abnormal behavior, policy violation, environmental threat, and related propagation.

[0080] The behavior anomaly detection employs a temporal anomaly detection model based on long short-term memory networks to extract and analyze behavioral features in real time, including data access frequency, access time distribution, access data volume, and access path. When a behavioral feature is detected to deviate from the normal baseline, i.e., the deviation exceeds 3 times the standard deviation, a behavior anomaly risk event is triggered.

[0081] The system detects policy violations and verifies in real time whether usage behavior complies with the constraints of associated contracts. These constraints include at least the scope of use, the duration of use, and the type of operation. Upon detecting a violation, a policy violation risk event is immediately generated.

[0082] Environmental threat perception involves continuously assessing the security status of the data usage environment, including: determining device security status by assessing the presence of malware; determining network environment status by assessing whether it is within an authorized network range; and determining the runtime environment status by assessing whether it is a compliant container or a trusted execution environment. These individual scores are then weighted and summed to obtain a comprehensive environmental threat score. The comprehensive environmental threat score uses a 0-1 normalized scoring system, and an environmental threat risk event is triggered when the score is below 0.6.

[0083] The system is designed to detect the propagation of risk events. For nodes where risk events occur, it automatically queries the data lineage graph to find upstream and downstream nodes that are related to the node. Based on the lineage distance between nodes and the type of risk event, it assesses the probability of risk propagation exposure and pushes early warning notifications to nodes with a risk propagation exposure probability higher than 0.5.

[0084] For each node, risk signals from three dimensions—abnormal behavior, policy violation, and environmental threat—are weighted and aggregated to calculate the node's own risk score, which is then compared with a preset grading threshold to determine the risk level.

[0085] Step 3: Risk propagation path analysis based on data lineage graph: A breadth-first search algorithm is used, with the node where the risk event is located as the risk source node, to perform graph traversal on the data lineage graph; for each propagation path, a graph neural network model is used to calculate the risk propagation probability along the data flow direction, and the risk propagation probability is expressed as:

[0086] ,in, Indicates the source node, Indicates the target node. The source node feature vector includes risk level, data sensitivity, and historical risk frequency. and These are the parameters of the trained model. It is the sigmoid activation function;

[0087] During graph traversal, a maximum propagation depth and a minimum propagation probability threshold are set, with the maximum propagation depth defaulting to 3 hops and the minimum propagation probability threshold defaulting to 0.3. A propagation attenuation mechanism is also introduced; after each hop, the propagation probability is multiplied by an attenuation factor, simulating the natural attenuation of risk as propagation distance increases. The attenuation factor is expressed as... ,and ,default When the propagation path exceeds the maximum propagation depth or the propagation probability is lower than the minimum propagation probability threshold, the traversal stops and the risk impact range is output; the risk impact range includes the set of affected nodes, the risk exposure probability of each node, and the complete propagation path diagram;

[0088] Step 4: Generation and distribution of multi-entity joint response instructions: For each affected node, a weighted fusion of factors including its own risk score, risk exposure probability, data sensitivity and node importance is used to obtain a comprehensive risk score for each node, and the final risk level is determined according to the preset classification threshold.

[0089] The handling priority is determined according to the final risk level from high to low, and within the same level, it is sorted according to the probability of risk exposure from high to low. Then, based on the risk type and node role, historical handling plans are matched from the risk knowledge base to generate differentiated handling instructions. The handling instructions are divided into three levels, corresponding one-to-one with the risk level: the first level instruction is an early warning notification, suggesting enhanced monitoring; the second level instruction is a restriction on operation, suspending access to some data; the third level instruction is a mandatory isolation, that is, immediately terminating data access and destroying the sandbox.

[0090] The disposal token mechanism is used to distribute the disposal instructions to each affected entity and receive disposal confirmation signals. The disposal token includes a token identifier, a target entity identifier, a disposal action, an execution deadline, and a confirmation callback address. If the disposal token does not receive a confirmation signal within the execution deadline, the disposal level is automatically upgraded and redistributed, and a manual intervention notification is triggered.

[0091] Step 5, Verification of Handling Effects and End-to-End Evidence Storage: After receiving confirmation signals from all affected entities, perform automated verification of handling effects, including:

[0092] For data access blocking, a test request is sent to verify whether the data access channel has been closed.

[0093] For sandbox destruction, the sandbox status is verified by querying the trusted execution environment management interface to determine whether the sandbox has been destroyed.

[0094] For actions involving the revocation of permissions, the access permissions of the corresponding account are verified by querying the permission management system to see if they have been cleared.

[0095] Finally, the verification results, along with the complete risk management process record, are hashed and uploaded to the consortium blockchain for evidence storage, forming an immutable risk management evidence chain.

[0096] This invention provides a data circulation risk global perception and coordinated response system, comprising:

[0097] The data lineage graph engine is used to collect and maintain the lineage relationships of data throughout the entire data flow process, and to construct and incrementally update a directed data lineage graph with data entities as nodes and flow relationships as edges. The node attributes include at least data identifier, data holder, sensitivity level, creation time, and lifecycle status. The edge attributes include at least flow time, flow direction, associated contract identifier, and data transformation type, wherein the data transformation type includes original, processed, aggregated, and derived.

[0098] The multi-dimensional risk perception engine is used to perform real-time risk perception on the entire data flow chain from four dimensions: abnormal behavior, policy violation, environmental threat, and related propagation, and generate risk events. Among them, abnormal behavior perception detects abnormal access patterns through a long short-term memory network model; policy violation perception monitors the compliance of contract terms; environmental threat perception assesses the security status of the data usage environment; and related propagation perception analyzes the propagation potential of risks based on data lineage graph analysis.

[0099] The risk propagation analyzer is used to deduce the propagation path of identified risk events based on the data lineage graph and graph neural network model. The input is the risk source node and the data lineage graph, and the output is the risk impact range, including the set of affected nodes, the propagation path, and the risk exposure probability of each node.

[0100] The coordinated response mechanism generates collaborative response instructions for multiple affected entities based on risk propagation analysis results. It uses a response token mechanism to distribute instructions and receive confirmation signals to ensure that the response actions of each entity are executed in an orderly manner and mutually confirmed, preventing duplicate or missed responses.

[0101] The risk situation awareness dashboard is used to present the overall risk situation of the data circulation network in a visual way in real time, including: a list of active risk events, a risk propagation chain diagram, the handling status of each entity, and historical risk trend analysis.

[0102] The disposal effect verification module is used to automatically verify whether the disposal effect meets expectations after each subject completes the disposal action, including whether data access has been blocked, whether the sandbox has been destroyed, and whether the alarms have been eliminated, and writes the verification results into the consortium blockchain for evidence storage.

[0103] A risk knowledge base is used to accumulate historical risk events, propagation patterns, response plans, and their effectiveness evaluations, and to continuously learn and optimize risk identification and propagation prediction models.

[0104] like Figure 1 As shown, the system adopts a four-layer architecture design, from top to bottom as follows:

[0105] The participating entities include data providers, data users, and regulators; the data providers are responsible for publishing data and declaring lineage data; the data users process and use the data to generate new lineage relationships; the regulators have read-only access to the global lineage graph for compliance auditing.

[0106] The kinship collection layer's core component is the kinship event collector, which is deployed on each participating entity's node and is responsible for automatically capturing and reporting kinship events when key events, including data release, transfer, processing, use, and destruction, occur.

[0107] The data lineage graph service layer includes a data lineage graph engine, a risk perception engine, a risk propagation analyzer, and a coordinated response coordinator.

[0108] The infrastructure layer includes a graph database, a streaming computing framework, a consortium blockchain evidence storage module, and a risk knowledge base. The graph database is used to store data lineage graphs and support efficient graph traversal queries. The streaming computing framework supports real-time lineage event processing. The consortium blockchain evidence storage module is used to record risk events and their handling processes in an immutable manner. The risk knowledge base is used to accumulate historical risk events and handling experience.

[0109] The specific collaborative relationships between the layers are as follows: the lineage collectors of each participating entity report lineage events in real time, and the data lineage graph engine of the graph service layer incrementally updates the data lineage graph; the risk perception engine continuously monitors the risk status of each node, and triggers the risk propagation analyzer to perform graph traversal analysis after discovering a risk; the risk propagation analysis results drive the joint response coordinator to generate a response token and distribute it to the affected entities; after each entity completes the response and sends back confirmation, the joint response coordinator calls the consortium blockchain evidence storage module of the infrastructure layer to write the response result and the complete process record into the consortium blockchain.

[0110] like Figure 2 As shown, the specific process of performing multi-dimensional risk perception and propagation analysis based on the system takes data flow logs, API call records, database change events, and contract execution trajectories as inputs, and outputs risk scores, risk levels, and handling recommendations. It is specifically divided into the following six stages:

[0111] ① Data Acquisition and Preprocessing: The lineage event collector captures lineage events in real time from each participating entity node and sends them to the streaming computing framework for preprocessing, including noise filtering and normalization; ② Multidimensional Feature Extraction: The risk perception engine continuously monitors each data flow node 24 / 7, extracting risk features from four dimensions: abnormal behavior, policy violations, environmental threats, and related propagation; the extracted multidimensional risk features of each node are weighted and aggregated to calculate its own risk score. When the score exceeds a preset threshold, subsequent processes are triggered; ③ Data Lineage Map Construction: The data lineage map engine incrementally constructs and updates the data lineage map based on the preprocessed lineage events; ④ Risk Propagation Analysis: Risk propagation... The propagation analyzer queries the first to Nth order neighbor nodes of the risk source node from the data lineage graph to extract the candidate set of propagation paths; it calculates the risk propagation probability of each propagation path based on the graph neural network model, filters low-probability paths, and outputs the set of affected nodes, the risk exposure probability of each node, and the set of high-risk propagation paths; ⑤ Risk classification: taking into account factors including propagation probability, data sensitivity, and node importance, it determines the set of affected nodes that need to be coordinated and dealt with, and determines the final risk level based on the analysis results; ⑥ Warning issuance and handling: the coordinated handling coordinator matches handling plans from the risk knowledge base based on the risk classification results, generates differentiated handling tokens, and distributes them to each affected entity.

[0112] like Figure 3 As shown, the complete interactive process of joint handling from risk identification to the completion of the entire chain involves five core participating roles, namely the risk perception engine, the joint coordination center, the data control node, the supervision platform, and the blockchain evidence storage module. Figure 3 Solid arrows represent request / instruction messages, dashed arrows represent response / confirmation messages, and activation bars represent the role's processing time window. The specific time-series interaction process between roles is as follows: At time T1, the risk perception engine detects a risk event and triggers a risk event notification to the coordination center; at time T2, the coordination center issues a restriction instruction to the data control node; at time T3, after executing the restriction operation, the data control node reports the risk details to the regulatory platform; at time T4, the data control node returns an execution confirmation signal to the coordination center; at time T5, the regulatory platform issues a disposal instruction to the data control node based on the risk details; at time T6, the coordination center forwards the execution disposal instruction to the data control node; at time T7, the data control node submits the disposal evidence to the blockchain evidence storage module for on-chain storage; at time T8, the blockchain evidence storage module returns the evidence storage hash to the coordination center, completing the closed loop of the entire disposal evidence storage process. Figure 3 The entire coordinated response process shown is completed within 30 seconds.

[0113] like Figure 4As shown, in a typical cross-domain data flow scenario, the risk propagation process along the lineage is as follows: the risk source dataset D0 is directly associated with D1a (dataset A) and D1b (dataset B), with propagation probabilities P of 0.85 and 0.9, respectively; D1a further spreads to D2a (derived set A1) and D2b (derived set B1), with propagation probabilities P of 0.65 and 0.95, respectively; D1b spreads to D2b (derived set B1) and D2c (derived set B2), with propagation probabilities P of 0.5 and 0.7, respectively; D2a and D2b ultimately affect D3 (report set C1), with propagation probabilities P of 0.45 and 0.4, respectively; D2c affects D4 (analysis set C2), with a propagation probability P of 0.6. The propagation probabilities at each edge are learned by the graph neural network model on the training set, reflecting the risk transmission strength under different data operation types, including direct referencing, aggregation calculation, association analysis, and data processing. The risk propagation analyzer starts with D0 and uses a breadth-first traversal algorithm to propagate layer by layer along the outgoing edges of the bloodline. Nodes with a probability below the threshold of 0.30 stop propagating further. Figure 4 The size of the nodes in the graph reflects the degree of risk impact. After the propagation analysis is completed, the system issues differentiated handling instructions to directly related nodes and downstream nodes: the risk source is subject to the highest level of isolation, with a propagation probability range of 1; directly related nodes are subject to high-level restriction, with a propagation probability range of 0.85 to 0.90; general diffusion nodes are subject to medium-level monitoring, with a propagation probability range of 0.50 to 0.65; and third-level terminal nodes are subject to early warning, with a propagation probability range of 0.40 to 0.60. Simultaneously, the risk propagation analyzer traces back to D0, notifying entity A to review the compliance of the original data release. Figure 4 It intuitively presents the coordinated handling effect of "one point trigger, whole chain response".

[0114] like Figure 5 As shown, the risk management process for each data circulation node includes six states, and the states and their transition conditions are as follows:

[0115] [Normal] Status: The node is operating normally, the risk score is below the Level 1 threshold, and there are no active risk events; the Level 1 risk score range is... ;

[0116] [Warning] Status: The node's risk score exceeds the Level 1 threshold, meaning it falls within the Level 2 risk score range. Or receive a Level 1 handling token from the joint handling coordinator; the node increases the monitoring frequency and pushes early warning notifications to the administrator, but does not restrict normal data access; trigger condition: the risk score exceeds the Level 1 threshold, or a Level 1 handling token is received.

[0117] [Restriction] Status: The node's risk score exceeds the level 2 threshold, i.e., it falls within the level 3 risk score range. Or receive a Level 2 handling token from the coordinated handling unit; the node suspends some high-risk data operations, such as batch export and data copying, but allows basic data query access; trigger condition: the risk score exceeds the Level 2 threshold, or a Level 2 handling token is received;

[0118] [Isolation] Status: The node has experienced a serious violation, i.e., it falls within the level four risk score range. Or receive a Level 3 disposal token; the node immediately terminates all data access, destroys the data sandbox, and notifies associated entities to suspend data interaction with this node; trigger condition: risk score is within the Level 4 risk score range or a Level 3 disposal token is received;

[0119] [In Progress] Status: The node has executed the action and sent back confirmation. The action effect verification module is performing automated verification. Triggering condition: The action token is executed and a confirmation signal is sent back.

[0120] [Restored] Status: The handling effect has been verified as effective, the risk has been eliminated, the node has returned to normal operation, and the complete risk handling record has been written to the consortium blockchain for evidence storage; Triggering condition: The handling effect verification module confirms that the handling is effective;

[0121] The six states together constitute the risk management state machine of the data circulation node, and the risk status of any node at any time is within a perceptible, traceable and controllable range.

[0122] Example 1

[0123] A scenario for risk perception in the multi-entity data circulation of the steel supply chain is as follows: A core enterprise in the steel supply chain has shared its production data with upstream raw material suppliers (Entity A), downstream logistics companies (Entity B), and financial service institutions (Entity C). One day, the system detects abnormal batch query behavior by Entity A, requiring analysis to determine if the risk has spread to other entities and to take coordinated action.

[0124] The specific steps of the data circulation risk global perception and coordinated response method provided by this invention are as follows:

[0125] Step 1, Lineage Map Status: The data lineage map has recorded the complete data flow relationship - the original production data D0 held by the core enterprise of a certain steel supply chain → the de-identified supply price data D1 used by subject A → the procurement suggestion report D2 generated by subject A based on D1 and referenced by subject B and subject C;

[0126] Step 2, Risk Perception Trigger: The Behavioral Anomaly Perception Engine detects that Subject A made an abnormally high-frequency query to D1 between 2:00 and 3:00 AM, which is more than 15 times the normal frequency, thus triggering a Level 2 risk event.

[0127] Step 3, Propagation Path Analysis: The risk propagation analyzer uses node D1 as the source node and performs a breadth-first traversal: The first hop identifies D2, with a propagation probability of 0.72, which exceeds the threshold; the second hop identifies references to subject B and subject C, with propagation probabilities of 0.50 and 0.51 respectively, both exceeding the threshold.

[0128] Step 4, Joint Response Execution: The joint response coordinator generates and distributes response tokens: a Level 3 response token is issued to Entity A, immediately suspending access to D1 and awaiting verification; a Level 2 response token is issued to Entity B, suspending the generation of new reports based on D2; a Level 1 response token is issued to Entity C, strengthening monitoring and reviewing D2 citations; and a risk notification is pushed to the aforementioned core enterprise in the steel supply chain.

[0129] Step 5, Verification and Evidence Storage of Disposal Effects: After each entity completes the disposal, it sends back confirmation. The verification module confirms that: Entity A's D1 access has been blocked, Entity B's report generation function has been suspended, and Entity C's monitoring frequency has been increased; the complete disposal record is written to the consortium blockchain, and a risk disposal certificate number is generated.

[0130] Example 2

[0131] The risk perception scenario for a multi-source data collaboration in a virtual power plant is as follows: A virtual power plant operator aggregates power generation data from dozens of distributed photovoltaic (PV) power plants, processes it, and provides it to the power grid company and a carbon trading platform. These dozens of distributed PV power plants constitute entity group A, the power grid company constitutes entity B, and the carbon trading platform constitutes entity C. The system needs to perform global risk perception on this complex multi-source, multi-direction data flow network.

[0132] The specific steps of the data circulation risk global perception and coordinated response method provided by this invention are as follows:

[0133] Step 1: Data lineage graph construction: The data lineage graph engine automatically collects and constructs the complete lineage relationship of each photovoltaic power station's original power generation data (D_station_1~D_station_N) → aggregated power generation curve (D_aggregated) → grid dispatch data (D_grid) and carbon emission accounting data (D_carbon), forming a data lineage graph containing N+3 data nodes;

[0134] Step 2, Risk Perception: The strategy violation perception engine detected periodic and regular anomalies in the power generation data reported by the photovoltaic power station with the ID Station_7, which is suspected to be a data injection attack, that is, injecting false power generation data into the aggregated power generation curve, triggering a strategy violation risk event;

[0135] Step 3, Propagation Analysis: The risk propagation analyzer identifies that the aggregated power generation curve has been used to generate grid dispatch data and carbon emission accounting data. If false data contaminates the aggregated power generation curve, both grid dispatch data and carbon emission accounting data face the risk of data contamination, thereby affecting grid dispatch decisions and carbon trading accounting. After assessment, the propagation probability is: the probability of contamination of grid dispatch data is 0.65, and the probability of contamination of carbon emission accounting data is 0.65.

[0136] Step 4, Joint Response: Issue a Level 3 response token to the virtual power plant operator to suspend Station_7 data entry and initiate the data verification process; issue a Level 2 response token to the power grid company to suspend the use of current power grid dispatch data for dispatch decisions and switch to a backup data source; issue a Level 2 response token to the carbon trading platform to suspend carbon credit calculation based on carbon emission accounting data.

[0137] Step 5, Root Cause Tracing: The system simultaneously traces upstream, performing retrospective analysis on the historical reported data of Station_7 to determine the starting point of data pollution, providing support for subsequent data repair.

[0138] Example 3

[0139] The data security test range scenario involves cross-institutional data sharing risks. Specifically, a digital security company undertakes a provincial-level data security exercise task, requiring the simulation of a real-world cross-institutional data flow risk propagation scenario within the test range environment to verify the risk perception and coordinated response capabilities of the system of this invention. The exercise scenario is set as follows: a financial institution's customer data is leaked, and the leaked data may have flowed to two partner institutions. The financial institution is entity A, and the two partner institutions are entities B and C. Risk identification and coordinated response need to be completed in the shortest possible time.

[0140] The specific steps of the data circulation risk global perception and coordinated response method provided by this invention are as follows:

[0141] Step 1: Initialize the exercise scenario: Pre-build a data lineage map containing 5 subjects and 12 data nodes in the test range environment; Preset risk trigger: At time T=0, inject a simulated leakage event into the customer data node of subject A, and the leakage event is an abnormal data outflow behavior with an outflow volume exceeding the normal value by 100 times;

[0142] Step 2, Risk Perception Timing: The system detects abnormal external behavior of subject A at T=0+2.3 seconds, triggering a Level 3 risk event;

[0143] Step 3, Propagation Analysis Timing: The risk propagation analyzer completes the graph traversal at T=0+4.1 seconds, identifying subject B and subject C as high-risk affected nodes, with the propagation probability of subject B being 0.78 and the propagation probability of subject C being 0.78.

[0144] Step 4, Coordinated Response Timing: The coordinated response coordinator generates and distributes the response token at T=0+5.8 seconds; Subject A blocks data access and sends back confirmation at T=0+8.2 seconds; Subject B restricts operations and sends back confirmation at T=0+12.6 seconds; Subject C deploys the early warning and sends back confirmation at T=0+14.3 seconds.

[0145] Step 5, End-to-End Processing Verification: The processing effect verification module completes all verifications in T=0+18.7 seconds, and the risk processing proof is written to the consortium blockchain. The entire process takes 18.7 seconds.

[0146] The results of the exercise show that, based on the system of the present invention, the global perception and coordinated handling of data circulation risks can meet the design goal of less than 30 seconds for end-to-end handling response time in complex cross-organizational scenarios.

[0147] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Any modifications, equivalent substitutions, or improvements made by those skilled in the art within the scope of the technology disclosed in this invention, based on the technical solution and inventive concept of the present invention, should be covered within the protection scope of this invention. Therefore, the protection scope of this invention should be determined by the scope of the claims.

Claims

1. A method for global perception and linkage treatment of data flow risk, characterized in that, Includes the following steps: Step 1, Incremental Construction and Maintenance of Data Lineage Graph: Collect lineage events during the entire lifecycle of data circulation, and construct and incrementally update a directed data lineage graph with data entities as nodes and circulation relationships as edges based on the lineage events; Step 2, Multi-dimensional Real-time Risk Perception: For each node in the data circulation network, conduct real-time risk monitoring from four dimensions: abnormal behavior, policy violation, environmental threat, and related propagation, and trigger risk events; Step 3: Risk propagation path analysis based on data lineage graph: Taking the node where the risk event is located as the risk source node, perform graph traversal on the data lineage graph, use a graph neural network model to calculate the risk propagation probability along the data flow direction, stop traversal when the preset conditions are met, and output the risk impact range. Step 4: Generation and distribution of multi-entity coordinated response instructions: Based on the scope of risk impact, generate differentiated response instructions, distribute the response instructions to each affected entity using a response token mechanism, and receive response confirmation signals; Step 5, Verification of the handling effect and full-chain evidence storage: After receiving the handling confirmation signal from all affected entities, the automated handling effect verification is performed. The verification result, together with the complete risk handling process record, is hashed and uploaded to the consortium blockchain for evidence storage, forming an immutable risk handling evidence chain.

2. The data flow risk global perception and linkage treatment method according to claim 1, characterized in that, In step 2, behavioral anomaly perception adopts a temporal anomaly detection model based on long short-term memory network to extract and analyze behavioral features in real time, including data access frequency, access time distribution, access data volume, and access path. When a behavioral characteristic deviates from the normal baseline, a behavioral abnormality risk event is triggered. The system detects policy violations and verifies in real time whether usage behavior complies with the constraints of related contracts, including at least the scope of use, duration of use, and type of operation; it immediately generates a policy violation risk event when a violation is detected. Environmental threat perception involves continuously assessing the security status of the data usage environment, including: equipment security status, network environment, and operating environment; scoring each separately and then weighting and summing the results to obtain a comprehensive environmental threat score; when the comprehensive environmental threat score falls below a threshold, an environmental threat risk event is triggered. In terms of the related propagation dimension, for nodes where risk events occur, the system automatically queries the data lineage graph to find upstream and downstream nodes that are related to the node; it assesses the risk propagation exposure probability based on the lineage distance between nodes and the type of risk event, and pushes early warning notifications to nodes whose risk propagation exposure probability is higher than a threshold. For each node, risk signals from three dimensions—abnormal behavior, policy violation, and environmental threat—are weighted and aggregated to calculate the node's own risk score, which is then compared with a preset grading threshold to determine the risk level. 3.The data flow risk global perception and linkage treatment method according to claim 1, characterized in that, In step 3, the graph traversal adopts the breadth-first traversal algorithm, starting from the risk source node and traversing along the outgoing edge direction of the data lineage graph, which is the data flow direction, and sets the maximum propagation depth and the minimum propagation probability threshold. When the propagation path exceeds the maximum propagation depth or the propagation probability is lower than the minimum propagation probability threshold, the traversal stops and the risk impact range is output; the risk impact range includes the set of affected nodes, the risk exposure probability of each node, and the complete propagation path diagram.

4. The data flow risk global perception and linkage treatment method according to claim 3, characterized in that, In step 3, a propagation attenuation mechanism is introduced. After each hop, the propagation probability is multiplied by an attenuation factor to simulate the natural attenuation of risk as the propagation distance increases.

5. The data flow risk global perception and linkage treatment method according to claim 4, characterized in that, The risk propagation path analysis also includes: starting from the risk source node, tracing back along the incoming edge direction of the data lineage graph to identify the upstream lineage node of the risk source data, and sending a risk tracing notification to the data holder corresponding to the upstream lineage node to trigger its review of the compliance of the original data release.

6. The data flow risk global perception and linkage treatment method according to claim 3, characterized in that, In step 4, for each affected node, a weighted fusion of factors including its own risk score, risk exposure probability, data sensitivity and node importance is performed to obtain a comprehensive risk score for each node, and the final risk level is determined according to the preset classification threshold. The handling priority is determined according to the final risk level from high to low, and within the same level, it is sorted according to the risk exposure probability from high to low; then, based on the risk type and node role, historical handling plans are matched from the risk knowledge base to generate differentiated handling instructions. The handling instructions are divided into three levels, each corresponding to a risk level: Level 1 instructions are early warning notifications, Level 2 instructions are operation restrictions, and Level 3 instructions are mandatory isolation. The disposal token includes a token identifier, a target entity identifier, a disposal action, an execution deadline, and a confirmation callback address; If the disposal token does not receive a confirmation signal within the execution deadline, the disposal level will be automatically escalated and redistributed, while triggering a manual intervention notification.

7. The data flow risk global perception and linkage treatment method according to claim 6, characterized in that, The risk management status of each data circulation node includes: normal, warning, restricted, isolated, management verification in progress, and recovered; the transition between each status is triggered by the comprehensive risk score or management token level. 8.The data flow risk global perception and linkage treatment method according to claim 1, characterized in that, Step 5, the verification of the automated processing effect includes: For data access blocking, a test request is sent to verify whether the data access channel has been closed. For sandbox destruction, the sandbox status is verified by querying the trusted execution environment management interface to determine whether the sandbox has been destroyed. For actions involving the revocation of permissions, the access permissions of the corresponding account are verified by querying the permission management system to confirm whether the access permissions have been cleared.

9. A data circulation risk global perception and coordinated response system, characterized in that, The method for global perception and coordinated handling of data circulation risks as described in any one of claims 1 to 8 includes: The data lineage graph engine is used to collect and maintain the lineage relationships of data throughout the entire data flow process, and to construct and incrementally update a directed data lineage graph with data entities as nodes and flow relationships as edges; the node attributes include at least data identifier, data holder, sensitivity level, creation time, and lifecycle status; the edge attributes include at least flow time, flow direction, associated contract identifier, and data transformation type. The multi-dimensional risk perception engine is used to perform real-time risk perception of the entire data flow chain from four dimensions: abnormal behavior, policy violation, environmental threat, and related propagation, and generate risk events. The risk propagation analyzer is used to deduce the propagation path of identified risk events based on the data lineage map and graph neural network model, and output the scope of risk impact. The coordinated response coordinator is used to generate collaborative response instructions for multiple affected entities based on the risk propagation analysis results, and distributes the instructions and receives confirmations using a response token mechanism; Risk situation awareness dashboard is used to present the overall risk situation of the data circulation network in a visual way in real time; The disposal effect verification module is used to automatically verify whether the disposal effect meets expectations after each subject completes the disposal action, and write the verification result into the consortium blockchain for evidence storage; A risk knowledge base is used to accumulate historical risk events, propagation patterns, response plans, and their effectiveness evaluations, and to continuously learn and optimize risk identification and propagation prediction models.

10. A data circulation risk global perception and coordinated response system according to claim 9, characterized in that, The system adopts a four-layer architecture design, including: The participating entities include data providers, data users, and regulators; wherein the regulators have read-only access to the global data lineage graph for compliance auditing. The kinship collection layer's core component is the kinship event collector, which is deployed on each participating entity's node and is responsible for automatically capturing and reporting kinship events when key events, including data release, transfer, processing, use, and destruction, occur. The data lineage graph service layer includes a data lineage graph engine, a risk perception engine, a risk propagation analyzer, and a coordinated response coordinator. The infrastructure layer includes a graph database, a streaming computing framework, a consortium blockchain evidence storage module, and a risk knowledge base. The graph database is used to store data lineage graphs and supports efficient graph traversal queries. The streaming computing framework supports preprocessing of real-time lineage events. The consortium blockchain evidence storage module is used to record risk events and their handling processes in an immutable manner. The risk knowledge base is used to accumulate historical risk events and handling experience. Each participating entity's lineage collector reports lineage events in real time, and the data lineage graph engine of the graph service layer incrementally updates the data lineage graph; the risk perception engine continuously monitors the risk status of each node, and triggers the risk propagation analyzer to perform graph traversal analysis after a risk is detected; the risk propagation analysis results drive the linkage response coordinator to generate response tokens and distribute them to the affected entities; after each entity completes the response and sends back confirmation, the response results along with the complete process record are written to the consortium blockchain.

Images