A data space based data usage dynamic control method and system

Abstract

This application provides a dynamic control method and system for data usage based on a data space, belonging to the field of network security technology. The method includes: acquiring access requests from data users and storing them in a preset data space, which includes control logic, access requests, and policies; acquiring environmental information of the access requests through a preset context-aware engine; evaluating the environmental information based on a preset blocking rule base and a preset security policy baseline to obtain a risk assessment coefficient; allowing data access when the risk assessment coefficient is less than a preset first threshold, and inputting the interaction pattern generated by the data access into a pre-trained access anomaly detection model to obtain a detection result; generating and outputting a denial information report if the detection result is abnormal behavior; and verifying the normal behavior against the access request and access policy if the verification fails, generating and outputting an alarm message. This application improves data security.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a dynamic control method and system for data usage based on data space. Background Technology

[0002] Currently, data has become a core production factor for enterprises, and cross-departmental and cross-organizational data sharing and collaboration are becoming increasingly frequent. In the process of data use, existing technologies mostly adopt static and fixed access control mechanisms, achieving control through pre-configured rule sets containing fixed parameters such as user identity, access IP, and permission levels. This access control mechanism only compares the identity and access IP in the access request with the rule set once; if they match, it allows access; if they don't, it rejects it, thus completing basic static protection. However, with the widespread adoption of remote work and multi-terminal collaboration, access scenarios are becoming more dynamic and complex. Verifying only fixed attributes without incorporating dynamic environmental information such as device security, network encryption, and access habits, and performing verification only at the entry point, lacks continuous tracking and control over subsequent read, copy, and modification operations. This can lead to the interception, cracking, leakage, and illegal tampering of encrypted data, failing to meet data security requirements. Summary of the Invention

[0003] To address the aforementioned technical problems, this application provides a dynamic control method and system for data usage based on data space.

[0004] A first aspect of this application provides a dynamic data usage control method based on a data space, comprising: The system acquires access requests from data users and stores them in a preset data space, which includes metadata of the data assets, control logic, access requests, and access policies. The context-aware engine in the control logic obtains the environmental information of the access request; The environmental information is risk-assessed based on a preset blocking rule base and a preset security policy baseline to obtain a risk assessment coefficient. When the risk assessment coefficient is less than a preset first threshold, the data user is allowed to access the data, and a pre-trained access anomaly detection model is input based on the interaction mode between the data user and the metadata to obtain the detection result, which includes normal behavior, abnormal behavior and anomaly type. If the detection result is abnormal behavior, an access denial information report will be generated and output based on the type of abnormality. If the detection result is normal behavior, then the normal behavior is verified to be consistent with the access request and the access policy to obtain the verification result; If the verification result is unsuccessful, an alert message indicating a policy violation will be generated and output based on the type of policy conflict.

[0005] A second aspect of this application provides a dynamic control system for data utilization based on a data space, comprising: The access request module is used to obtain access requests from data users and store them in a preset data space, which includes metadata of data assets, control logic, access requests and access policies. The environment awareness module is used to obtain the environment information of the access request through the context awareness engine in the control logic; The risk assessment module is used to assess the environmental information based on a preset blocking rule base and a preset security policy baseline, and obtain a risk assessment coefficient. The access determination module is used to allow the data user to access the data when the risk assessment coefficient is less than a preset first threshold, and to input a pre-trained access anomaly detection model based on the interaction mode between the data user and the metadata to obtain the detection result, which includes normal behavior, abnormal behavior and anomaly type. An anomaly handling module is used to generate and output an access denial information report based on the anomaly type if the detection result is an abnormal behavior. The behavior verification module is used to verify the consistency between the normal behavior and the access request and the access policy if the detection result is normal behavior, and to obtain the verification result. The alarm generation module is used to generate and output alarm information for policy violation based on the type of policy conflict when the verification result is unsuccessful.

[0006] A third aspect of this application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the processor executes the computer program to implement the steps of the above-described dynamic data usage control method based on data space.

[0007] A fourth aspect of this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the above-described dynamic data usage control method based on data space.

[0008] The beneficial effects of the data usage dynamic control method and system based on data space provided in this application are as follows: This application achieves closed-loop management of the entire data usage control process by constructing a data space that integrates data asset metadata, control logic, access requests, and access policies. It overcomes the limitations of static access control by capturing environmental information of access requests using a context-aware engine, conducting risk assessments with the blocking rule base and security policy baseline, and filtering high-risk access behaviors at the source. Simultaneously, a pre-trained access anomaly detection model monitors the interaction between data users and metadata in real time, identifying normal behavior, abnormal behavior, and their specific types. Furthermore, consistency verification between access policies and access requests further strengthens the security defense, effectively improving the protection level and control accuracy of data security. Attached Figure Description

[0009] Figure 1 A flowchart illustrating a dynamic control method for data usage based on data space, provided as an embodiment of this application; Figure 2 A structural block diagram of a data usage dynamic control system based on a data space provided in an embodiment of this application; Figure 3 This is a schematic block diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0010] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0011] To make the purpose, technical solution, and advantages of this application clearer, the following will be described in conjunction with the appendix. Figure 1-3 The following is an explanation using specific examples.

[0012] Please refer to Figure 1 , Figure 1 A flowchart illustrating a data usage dynamic control method based on data space, provided as an embodiment of this application, is shown below. The method includes: S101: Obtain the access request from the data user and store it in the preset data space. The data space includes the metadata of the data asset, control logic, access request and access policy.

[0013] In this embodiment, the access request initiated by the data user is obtained, the request information in the access request is verified for integrity and standardized in format, and then stored in a preset data space.

[0014] In this context, "data user" refers to the entity that initiates the data access request and is the executor of the data access behavior; "access request" refers to the application instruction submitted by the data user to obtain or manipulate specific data, including access entity identifier (user ID, organization code, device unique identifier), target data identifier, operation type (read, copy, modify, delete, export), request timestamp, and other request information; "preset data space" refers to an integrated management and control carrier specifically built for data usage control, possessing functions such as information integration, real-time updates, and retrieval association, used for centralized management of various types of information required for data control; "data asset metadata" is structured information describing its data type, storage location, and other attributes; "control logic" refers to the execution rules built into the data space and is equipped with a context-aware engine; and "access policy" is the basis for judging whether access behavior is compliant.

[0015] S102: Obtain the environment information of the access request through the context-aware engine in the control logic.

[0016] In this embodiment, after receiving and storing the access request from the data user, the context-aware engine in the control logic is triggered to initiate multi-dimensional environmental information collection. This context-aware engine uses integrated technologies such as terminal detection, network sniffing, and behavior log analysis to perceive the environment associated with the access request.

[0017] Specifically, the context-aware engine collects environmental data related to access requests. This environmental data includes hardware-level device information, network-level connection information, and behavioral-level scenario information. Device information includes device model, operating system version, security patch installation status, whether encryption protection is enabled, and unique device identifier; connection information includes access IP address, network protocol type, encrypted transmission status, link stability, and access network type; scenario information includes access time, geographical location, historical access records of the operating terminal, and the data user's usual access habits.

[0018] During the environmental data collection process, the context-aware engine performs real-time verification and format standardization of various environmental information, eliminating invalid data and interference information.

[0019] S103: Based on the preset blocking rule base and the preset security policy baseline, perform risk assessment on environmental information to obtain risk assessment coefficients.

[0020] In this embodiment, based on a preset blocking rule base and security policy baseline, and through the logic of first blocking screening and then gradient evaluation, the environmental information is subjected to multi-dimensional and hierarchical risk assessment.

[0021] Specifically, the assessment process first uses a blocking rule base as the primary judgment standard, performing a full match between the collected environmental information and the high-risk rules in the blocking rule base. The blocking rule base includes known malicious access characteristics. If the environmental information matches any blocking rule, it is directly judged as extremely high risk, and the subsequent assessment process is terminated. If no blocking rule is matched, the environmental threat level is determined based on the deviation between the environmental information and the preset security policy baseline. A risk matrix is ​​then constructed based on the data exposure impact level and the environmental threat level. Finally, the matrix element values ​​corresponding to the data exposure impact level and the environmental threat level are obtained from the risk matrix as risk assessment coefficients. The blocking rule base is built on a pre-constructed set of high-risk judgment rules, which includes security-verified malicious access characteristics and absolutely prohibited access conditions (high-risk IP, illegal device identifier, and non-compliant network type). The security policy baseline is determined by standardized security benchmarks based on data security compliance requirements and business scenario needs, including minimum security requirements and compliance standards for each dimension of the access environment (device security status, network encryption level, and access time and space constraints). The risk assessment coefficient is used to characterize the risk status of the access request; the higher the risk assessment coefficient, the greater the risk.

[0022] S104: When the risk assessment coefficient is less than the preset first threshold, the data user is allowed to access the data, and the pre-trained access anomaly detection model is input based on the interaction mode between the data user and the metadata to obtain the detection results. The detection results include normal behavior and abnormal behavior as well as the type of anomaly.

[0023] In this embodiment, the risk assessment coefficient is compared with a preset first threshold. This first threshold is an admission threshold pre-defined based on factors such as data security level and business scenario risk threshold, used to define the scope of low-risk access requests. When the risk assessment coefficient is less than the first threshold, it indicates that the environmental risk of the access request is within a controllable range, and the data user will be allowed to initiate data access operations. The hierarchical structure of the access anomaly detection model includes: an interaction feature embedding layer, responsible for vectorizing and normalizing discrete and continuous features such as operation type, execution sequence, access frequency, data range, and interaction duration; a temporal feature learning layer, which extracts operation sequences and temporal dependency features through recurrent neural networks or Transformer structures, outputting behavioral pattern encoding; and an anomaly classification layer, which uses a fully connected network and Softmax to output normal / abnormal probabilities and specific anomaly categories such as batch export, non-routine period operations, and tampering attempts.

[0024] The access anomaly detection model is trained using labeled historical interaction logs as the dataset. The training set and validation set are divided into an 8:2 ratio, and the cross-entropy loss function is used for joint optimization. Discrete features are encoded using one-hot or embedding, while continuous features are linearly normalized to [0,1]. The temporal step size is set according to the length of a typical interaction session. The learning rate, batch size, and number of iterations are adaptively adjusted based on the validation set AUC and F1 score. The final output includes normal and abnormal behaviors and the types of anomalies.

[0025] During the process of allowing data users to access and manipulate data, the interaction patterns between data users and metadata are captured and recorded in real time. Next, the interaction pattern data is input into a pre-trained access anomaly detection model. This model extracts features from the interaction patterns, matches dimensions, and calculates probabilities to output detection results. The detection results not only determine whether the current behavior is normal or abnormal, but also further pinpoint the specific type of abnormal behavior, such as unauthorized access, high-frequency batch exports, operations outside of normal time periods, and data tampering attempts.

[0026] In this embodiment, data access refers to various operations performed by a data user on the metadata of a data asset based on approved permissions, including specific interactive actions such as reading, copying, modifying, and exporting; the interaction mode is a multi-dimensional set of behaviors formed when a data user interacts with the metadata of a data asset, including behavioral characteristics such as operation type, execution sequence, access frequency, data range, and interaction duration; the anomaly type refers to the specific risky behavior types identified by the access anomaly detection model, such as operations during unusual time periods and attempts to tamper with data.

[0027] S105: If the detection result is abnormal behavior, generate and output an access denial information report based on the type of abnormality.

[0028] In this embodiment, when the access anomaly detection model determines the behavior as abnormal, a structured access denial information report is generated based on the anomaly type identified by the model. This report is organized by anomaly type and records information about the access, including the data user's identity, target data identifier, anomaly occurrence time, abnormal behavior characteristics, environmental information summary, and risk level determination criteria.

[0029] After the information report is generated, it is synchronously output to the corresponding management terminal, security control platform or audit log system. At the same time, different levels of response actions can be triggered according to the severity of the anomaly, such as sending real-time alarms to security administrators, forcibly disconnecting the current session, and temporarily locking the relevant accounts.

[0030] S106: If the detection result is normal behavior, then verify the consistency between the normal behavior and the access request and the access policy to obtain the verification result.

[0031] In this embodiment, when the access anomaly detection model determines that the current interaction mode is normal behavior, it compares the real-time generated normal behavior data with the operation intent declared in the access request and the permission boundaries specified by the access policy in multiple dimensions to determine whether the three are consistent.

[0032] Specifically, behavioral feature vectors for normal behavior, request intent feature vectors for access requests, and policy rule feature vectors for access policies are extracted. Consistency verification is then performed based on operations, time, space, and behavior to obtain verification results. Normal behavior refers to interactions between the data user and metadata that do not deviate from historical habits and do not trigger model anomaly judgment rules. Consistency verification refers to a compliance check process that compares real-time normal behavior with access requests and access policies from multiple dimensions to determine whether the three match and are conflict-free. Verification results refer to the output conclusions of the consistency verification process, used to indicate whether normal behavior is consistent with access requests and access policies.

[0033] S107: When the verification result is unsuccessful, generate and output a policy violation alarm message based on the type of policy conflict.

[0034] In this embodiment, when the verification result is "failed," it indicates that although the actual access behavior of the data user did not trigger the anomaly detection model, it conflicted with the original intent of the access request or the constraints of the access policy, posing a potential compliance risk. At this point, the content of the policy conflict is categorized, and the type of policy conflict is determined. The types of policy conflicts include unauthorized operation conflicts, data scope out-of-bounds conflicts, access time limit violation conflicts, and operation frequency exceeding limits conflicts.

[0035] After determining the conflict type, structured and tiered policy violation alerts are generated based on that type. These alerts are then output to the security management platform, corresponding administrator terminals, and the audit log system according to preset routes. High-level violations can trigger real-time notifications via pop-ups, SMS, and emails. The alert information includes the data user's identity, target data identifier, description of the violation, conflict policy terms, timestamp of occurrence, environmental information, and risk assessment coefficient. High-level violations refer to situations where the data user's access behavior did not trigger the anomaly detection model but failed multi-dimensional consistency verification, and falls under policy conflict types such as unauthorized operation or data scope exceeding limits, posing a serious threat to data security and compliance. Preset routes are configured and determined based on the policy conflict type, alert level, data sensitivity level, and administrator responsibilities, combined with preset distribution rules and notification channel priorities.

[0036] As can be seen from the above, this application achieves closed-loop management of the entire data usage control process by constructing a data space that integrates data asset metadata, control logic, access requests, and access policies. It overcomes the limitations of static access control by using a context-aware engine to capture environmental information of access requests and conducting risk assessments against the blocking rule base and security policy baseline, filtering high-risk access behaviors at the source. Simultaneously, a pre-trained access anomaly detection model monitors the interaction between data users and metadata in real time, identifying normal, abnormal, and specific behaviors. Furthermore, consistency verification between access policies and access requests further strengthens the security defense, effectively improving the protection level and control accuracy of data security.

[0037] In one embodiment of this application, a risk assessment coefficient is obtained by performing a risk assessment on environmental information based on the attributes of the data itself and a preset security policy baseline, including: Match the metadata attributes and environmental information with the preset blocking rule base; If any blocking rule in the blocking rule base is matched, the risk assessment process is terminated. If no blocking rule is matched in the blocking rule base, the data exposure impact level is determined based on the attributes of the metadata through the preset impact mapping rules; The environmental threat level is determined based on the deviation between environmental information and the preset security strategy baseline. A risk matrix is ​​constructed based on the data exposure impact level and the environmental threat level; The risk matrix is ​​used to obtain the matrix element values ​​corresponding to the data exposure impact level and environmental threat level as risk assessment coefficients.

[0038] In this embodiment, firstly, the attributes of the metadata and environmental information are combined into a unified feature vector, and then matched against a preset blocking rule base one by one. If the feature vector hits any high-risk blocking rule in the base, such as involving top-secret data, originating from a blacklisted IP, or using unhardened equipment, it is immediately determined to be an unacceptable risk, and the subsequent risk assessment process is terminated, blocking the access. If no blocking rule in the blocking rule base is triggered, the attributes of the metadata are input into a preset impact mapping rule to obtain the data exposure impact level. The data exposure impact level is used to characterize the degree of harm caused by data leakage; the attributes of the metadata include sensitivity level, importance, and business impact scope. The impact mapping rule is used to map metadata attributes to impact levels, for example, mapping sensitivity level and business impact scope to four levels: low, medium, high, and extremely high; the data exposure impact level is a level value characterizing the degree of business, compliance, and reputational impact caused by the unauthorized access and leakage of target data.

[0039] Simultaneously, environmental information is compared item by item with the security policy baseline. Based on the degree of deviation from dimensions such as device compliance, network encryption strength, access geographical location, and time period legitimacy, the environmental threat level is determined. The environmental threat level indicates the degree of insecurity of the current access environment.

[0040] Specifically, a risk matrix is ​​constructed with data exposure impact as rows and environmental threat level as columns. Each cell in the matrix is ​​pre-configured with a quantified value corresponding to the risk level. Based on the intersection of the two levels in the matrix, the corresponding matrix element value is read and used as the risk assessment coefficient for this visit.

[0041] Before constructing the risk matrix based on the data exposure impact level and environmental threat level, this embodiment further includes: obtaining historical access records of the metadata required by the access request from the data space, and extracting the historical exposure frequency and historical exposure environment of the metadata from the historical access records. Simultaneously, the data exposure impact level is dynamically attenuated based on the historical exposure frequency, and the environmental threat level is dynamically corrected based on the historical exposure environment. The corrected data exposure impact level and environmental threat level are used to construct the risk matrix.

[0042] Among them, metadata historical access records are the log information of all historical access behaviors for the metadata of the data asset to be accessed, stored in the data space, including historical access time, access subject, access environment, access result, etc.; historical exposure frequency indicates how frequently the metadata is exposed in the historical access records; historical exposure environment is the set of environmental information of the metadata in the historical access records.

[0043] As can be seen from the above, this embodiment improves the accuracy of determining access risks from qualitative to quantitative by constructing a risk matrix based on the impact of data exposure and the threat level of the environment. Furthermore, it introduces historical exposure frequency and historical exposure environment to dynamically attenuate and correct the impact level of data exposure and the threat level of the environment, thereby improving the accuracy and scenario adaptability of risk assessment while effectively avoiding misjudgments and omissions caused by static assessment.

[0044] In one embodiment of this application, a data usage dynamic control method based on data space further includes: Based on a preset time period, obtain the adjustment factor of the risk matrix; When a single adjustment factor is obtained, the first adjustment step size is determined based on the type and value of the single adjustment factor, and the risk matrix is ​​adjusted based on the first adjustment step size. When multiple regulatory factors are obtained, each regulatory factor is analyzed to obtain the numerical correlation and changing trend among the various regulatory factors. Based on numerical correlations and trends, adjustment strategies for the risk matrix are determined.

[0045] In this embodiment, adjustment factors are collected and updated based on a preset time period. These adjustment factors include data asset value quantification data corresponding to metadata, real-time monitored changes in environmental threat forms, and historical trust data of data users. The preset time period is configured at three levels: hourly, daily, and weekly, based on data sensitivity level, frequency of environmental threat changes, and real-time business requirements.

[0046] Specifically, when only a single adjustment factor is collected, a first adjustment step size is calculated and determined based on the type and specific value of that adjustment factor. Then, the corresponding element values ​​in the risk matrix are adjusted based on this first adjustment step size. The first adjustment step size is calculated based on the type and normalized value of the adjustment factor, combined with a preset type mapping relationship and a piecewise mapping function. Different types of adjustment factors are matched and calculated using independent piecewise intervals and step size benchmarks. The type mapping relationship maps data on the quantification of data asset value, data on changes in the environmental threat situation, and data on the historical behavior and trust levels of data users to mapping benchmark coefficients and piecewise benchmarks, respectively.

[0047] The formula for calculating the first adjustment step size of a single adjustment factor is: S1 = Ki × f(X) The piecewise mapping function is: Wherein, S1 is the first adjustment step size, used to quantify the increase or decrease of risk matrix element values; Ki is the factor type benchmark coefficient, determined by the type mapping relationship, i=1,2,3 corresponding to the three dimensions of data asset value quantification data, environmental threat situation change data, and data user historical behavior trust data factors respectively; f(X) is the piecewise mapping function, which outputs piecewise coefficients according to the interval where the factor normalized value is located; X is the standard value of the current adjustment factor after normalization processing; The adjustment factor segmentation benchmark is determined by the type mapping relationship; , and The piecewise coefficients for the low, medium, and high intervals satisfy the following conditions: The adjustment direction is positive for data asset value quantification data and environmental threat situation change data factors (the first adjustment step is a positive upward adjustment of the matrix value), and negative for data user historical behavior trust data factors (the first adjustment step is a negative downward adjustment of the matrix value).

[0048] When multiple moderating factors are collected, statistical methods are used to calculate the numerical correlations (positive correlation, negative correlation, independent correlation) between the factors, and the changing trends (rising, falling, fluctuating, stabilizing) of each factor over a continuous period are analyzed to distinguish whether the factors synergistically enhance each other, conflict with each other, or have independent effects. Based on this, corresponding moderating strategies are selected to make differentiated and refined adjustments to the risk matrix.

[0049] As can be seen from the above, this embodiment achieves dynamic adaptive optimization of the risk matrix by collecting adjustment factors of the risk matrix based on a preset time period and adopting a differentiated adjustment method according to the adjustment factors. This effectively improves the timeliness and accuracy of risk assessment, while avoiding the assessment bias caused by the static risk matrix and enhancing the flexibility and reliability of data access security management.

[0050] In one embodiment of this application, a strategy for adjusting the risk matrix is ​​determined based on numerical correlation and changing trends, including: Calculate the covariance or correlation coefficient between any two of the multiple moderating factors to obtain a numerical correlation index that characterizes the consistency of their change direction. Calculate the coefficient of variation of the standardized values ​​of all the multiple moderating factors to obtain a trend index characterizing the consistency of their changes. Based on numerical correlation indicators and trend indicators, the corresponding adjustment strategies are determined.

[0051] In this embodiment, firstly, the linkage relationship between different regulating factors is determined. For example, the covariance or correlation coefficient of any two regulating factors in the sample sequence within a continuous time period is calculated to obtain the calculation result. The calculation result is used as a numerical correlation index, which is used to characterize the consistency of the change direction between factors and determine whether each factor is mutually reinforcing, mutually canceling, or relatively independent.

[0052] Secondly, all adjustment factors are standardized to eliminate the influence of dimensions. Then, the coefficient of variation is calculated based on the standardized values ​​and used as a trend indicator. The trend indicator represents the degree of concentration or dispersion of the fluctuation amplitude of each factor, judging whether the overall trend is towards synchronous stability or sharp differentiation. The trend indicator is the ratio of the standard deviation to the mean, which is used to represent the relative dispersion of the data. Here, it is used to describe the difference in the magnitude of the changes of each adjustment factor after standardization.

[0053] Finally, numerical correlation indicators and trend indicators are used as the basis for dual decision-making, and preset adjustment strategies are matched and executed.

[0054] As can be seen from the above, this embodiment determines the adjustment strategy based on numerical correlation indicators and trend indicators as dual quantitative indicators. This can characterize the linkage relationship and overall change trend among multiple adjustment factors, avoid the deviation caused by subjective experience-based adjustments, realize the scientific decision-making and refined adaptation of risk matrix adjustment strategies, and further improve the accuracy and dynamic adaptation capability of risk assessment.

[0055] In one embodiment of this application, determining a corresponding adjustment strategy based on numerical correlation indicators and trend indicators includes: If the trend indicator is less than the preset consistency threshold and all numerical correlation indicators are positive, then the synergistic enhancement strategy is selected to adjust the matrix element values ​​in the risk matrix upwards. If at least one numerical correlation indicator is negative and its absolute value is greater than the preset conflict threshold, then the conflict balancing strategy is selected to make local compensatory adjustments to the risk items in the risk matrix dominated by negatively correlated factors. If any condition is not met, an independent weighted strategy is selected, and the impact of each adjustment factor on different dimensions of the risk matrix is ​​calculated based on the preset weights of each adjustment factor, and then weighted and superimposed adjustment is performed.

[0056] In this embodiment, a three-tiered decision-making mechanism is used to match and execute corresponding risk matrix adjustment strategies based on numerical correlation indicators and trend indicators. Specifically, when the trend indicator is less than a preset consistency threshold, it indicates that the changes in the adjustment factors are highly similar, and all numerical correlation indicators are positive, further indicating that the factors exhibit a unidirectional relationship. In this case, a synergistic enhancement strategy is selected to uniformly and adaptively adjust the matrix element values ​​in the risk matrix upwards. The consistency threshold is set based on the statistical distribution of the coefficient of variation of the standardized values ​​of historical multi-period adjustment factors, combined with the data sensitivity level.

[0057] If at least one set of moderating factors is detected to have negative numerical correlation indicators, and their absolute values ​​are greater than a preset conflict threshold, it indicates that there is an inverse conflict relationship between the factors. Some factors drive risk upward, while others drive risk downward. In this case, a conflict balancing strategy is adopted to perform local compensatory adjustments on the risk items in the risk matrix dominated by negatively correlated factors, thereby offsetting the impact of the conflict while retaining effective risk signals. The preset conflict threshold is based on the distribution characteristics of the correlation coefficients between historical moderating factors and is modified according to sensitive data scenarios.

[0058] For conventional scenarios that do not meet the above two conditions, an independent weighting strategy is adopted. Based on the pre-configured weight coefficients of each adjustment factor, its independent impact on different dimensions of the risk matrix is ​​calculated separately, and then the matrix adjustment is completed by weighted superposition. The method for determining the pre-configured weight coefficients of each adjustment factor includes: firstly, constructing the factor impact contribution distribution through historical risk adjustment factors, and taking the variance contribution rate corresponding to each adjustment factor as the initial weight; secondly, using the analytic hierarchy process to construct a judgment matrix of data value-environmental threat-behavioral trust for scoring and calibration; and finally, setting correction coefficients based on metadata sensitivity level, access scenario risk level, and compliance rigor. After normalization, the final weight coefficients are obtained, and the sum of the weights is 1.

[0059] As can be seen from the above, this embodiment selects a differentiated adjustment strategy based on trend indicators and numerical correlation indicators, which improves the accuracy, rationality and adaptability of risk assessment, while effectively avoiding the problems of over-adjustment or insufficient response caused by a single adjustment method.

[0060] In one embodiment of this application, if the detection result is normal behavior, then the normal behavior is verified to be consistent with the access request and the access policy to obtain a verification result, including: Extract the behavioral feature vector of normal behavior, extract the request intent feature vector of access request, and extract the policy rule feature vector of access policy. Calculate the multidimensional consistency distance between the behavioral feature vector, the request intent feature vector, and the policy rule feature vector; If the multidimensional consistency distance is less than the corresponding preset tolerance threshold, the verification result is considered to be passed. If the consistency distance of at least one dimension is greater than or equal to its corresponding preset tolerance threshold, the verification result is determined to be unsuccessful.

[0061] In this embodiment, firstly, behavioral feature vectors are extracted from normal behavior, request intent feature vectors are extracted from access requests, and policy rule feature vectors are extracted from access policies, transforming these three types of unstructured information into a unified format that can be quantified and computed. The behavioral feature vector is a set of structured features extracted from the actual access behavior of the data user, including features such as operation type, operation sequence, access frequency, data range, time, and geographical location. The request intent feature vector is a set of structured intent features extracted from access requests, including the type of operation requested, the time of access requested, the range of data requested, and the geographical location requested. The policy rule feature vector is a constraint-type feature vector parsed from the access policy, including the list of allowed operations, the permitted access time period, the permitted area, the maximum operation frequency, and the authorized data range.

[0062] Subsequently, the multidimensional consistency distance between the three types of feature vectors is calculated in multiple dimensions. This distance is used to quantify the degree of deviation between the actual behavior, request intent and policy rules, and the multidimensional consistency distance is obtained. The smaller the multidimensional consistency distance, the higher the consistency.

[0063] Secondly, the consistency distance for each dimension is compared item by item with a pre-set tolerance threshold. Only when the distances for all dimensions are less than the corresponding pre-set tolerance threshold is the verification result considered passed, and access is allowed to continue. The pre-set tolerance threshold is the maximum acceptable deviation value set for different dimensions; anything exceeding this pre-set tolerance threshold is considered inconsistent and non-compliant. The pre-set tolerance threshold is set based on historical samples from three dimensions: operational consistency, spatiotemporal consistency, and behavioral pattern consistency.

[0064] If the consistency distance of any dimension is greater than or equal to its corresponding tolerance threshold, it indicates that there is a substantial deviation between the actual behavior and the request intent or policy rules. Even if the anomaly detection model is not triggered, the verification result is still determined to be unsuccessful.

[0065] As can be seen from the above, this embodiment extracts normal behavior, access requests, and access policies separately to obtain behavior feature vectors, request intent feature vectors, and policy rule feature vectors. By calculating the multidimensional consistency distance between the three and comparing it with the preset tolerance thresholds of each dimension, the verification results can be judged and verified in a quantitative way. This can represent the degree of matching between the actual behavior and the intent and policy constraints in the access request, realizing an upgrade from qualitative judgment to quantitative verification. It can effectively identify hidden violations such as exceeding authority, exceeding scope, and deviating from the application intent, even if the abnormal model is not triggered, and further strengthen the compliance control and security protection capabilities of the entire data access process.

[0066] In one embodiment of this application, calculating the multidimensional consistency distance between the behavior feature vector, the request intent feature vector, and the policy rule feature vector includes: The behavioral feature vector, request intent feature vector, and policy rule feature vector are divided into operation consistency dimension, spatiotemporal consistency dimension, and behavioral pattern consistency dimension according to their attribute dimensions. In terms of operational consistency, the intersection matching degree between the operation type in the behavior feature vector and the list of allowed operations in the policy rule feature vector is calculated to obtain the first distance; In the spatiotemporal consistency dimension, the second distance is obtained by calculating the degree of conformity between the timestamp and geographic location information in the request intent feature vector and the access time period and permitted area constraints in the policy rule feature vector. In the behavioral pattern consistency dimension, the third distance is obtained by comparing the pattern similarity based on the operation sequence and frequency in the behavioral feature vector and the data usage scope in the request intent feature vector with the operation frequency constraints and data usage scope in the policy rule feature vector. The first, second, and third distances are weighted to generate a multidimensional consistent distance.

[0067] In this embodiment, multidimensional consistency verification is decomposed and classified into dimensions. Based on feature attributes, the behavioral feature vector, request intent feature vector, and policy rule feature vector are uniformly divided into three dimensions: operational consistency, spatiotemporal consistency, and behavioral pattern consistency. The operational consistency dimension is used to evaluate whether the actual behavior is within the scope allowed by the access policy, focusing on the compliance of the actual behavior. The spatiotemporal consistency dimension is used to verify whether the access time and geographical location comply with the access policy constraints, focusing on the compliance of the access scenario. The behavioral pattern consistency dimension is used to verify whether the operation sequence, access frequency, and data usage scope comply with the access policy and request intent, focusing on the rationality of the behavioral pattern.

[0068] Specifically, in the dimension of operational consistency, the first distance is obtained by calculating the intersection matching degree between the actual operation type in the behavior feature vector and the list of allowed operations in the policy rule feature vector. The first distance is used to determine whether the actual operation is within the authorized scope. In the dimension of spatiotemporal consistency, the access timestamp and geographic location information in the request intent feature vector are compared with the allowed access time period and permitted geographic area specified in the policy rule feature vector to calculate the degree of conformity and generate the second distance. The second distance is used to verify whether the access behavior conforms to the spatiotemporal constraints. In the dimension of behavioral pattern consistency, the actual behavior is matched with the policy restrictions based on the pattern similarity of features such as operation sequence, execution frequency, and data usage scope to obtain the third distance. The third distance is used to identify hidden risks of abnormal patterns such as batch export and high-frequency access, even if the operation is legal.

[0069] In this embodiment, corresponding weights are assigned according to the security importance of each dimension, and the first distance, the second distance, and the third distance are weighted and fused to generate a comprehensive quantitative multidimensional consistency distance.

[0070] As can be seen from the above, this embodiment divides the extracted feature vector into three consistency dimensions: operation, spatiotemporal, and behavioral pattern. The first, second, and third distances are calculated respectively, and a weighted fusion is performed to generate a multi-dimensional consistency distance. This can achieve refined and multi-dimensional verification of access behavior from three levels: operation legality, scenario compliance, and behavior rationality. This not only improves the comprehensiveness of violation identification, but also adapts to different security level business scenarios through weight configuration, effectively improving the accuracy and coverage of compliance judgment.

[0071] In one embodiment of this application, a weighted average is applied to the first distance, the second distance, and the third distance to generate a multidimensional consistent distance, including: The importance of the first distance, the second distance, and the third distance in the access request are calculated respectively to obtain the importance coefficients; Based on the importance coefficient, determine the baseline weight coefficients for the first distance, the second distance, and the third distance; The first, second, and third distances are weighted and summed based on the baseline weight coefficients to calculate the multidimensional consistency distance.

[0072] In this embodiment, based on factors such as the business scenario, data sensitivity level, and access permissions of the current access request, the impact of the first distance (operational consistency), the second distance (spatiotemporal consistency), and the third distance (behavioral pattern consistency) on the compliance determination of this access is first assessed, and the corresponding importance coefficients are calculated. These importance coefficients represent the risk level of each dimension in the current access request. The formula for calculating the importance coefficient is as follows: in, Let be the importance coefficient of the j-th consistency dimension; j=1,2,3 correspond to the three dimensions of operational consistency, spatiotemporal consistency, and behavioral pattern consistency, respectively. The risk contribution value of the metadata sensitivity level corresponding to the current access in the j-th dimension; The risk contribution value of the current business scenario type in the j-th dimension; The risk contribution value of the access subject's permission level in the j-th dimension; , , These are the global weighting coefficients for sensitivity level, business scenario, and permission level, respectively, preset by the security policy baseline, and satisfying the following conditions: =1.

[0073] Secondly, the importance coefficients are mapped and normalized to generate a baseline weight coefficient that fits the current access request, where the sum of the weights of the three dimensions is 1.

[0074] Finally, using the baseline weighting coefficients, a weighted summation operation is performed on the first distance, the second distance, and the third distance to integrate the scattered multidimensional difference values ​​into a unified multidimensional consistency distance.

[0075] As can be seen from the above, this embodiment dynamically calculates the importance coefficients of the three dimensions of distance based on the scenario of access requests, and generates a benchmark weight coefficient accordingly. The multidimensional consistency distance is obtained by weighted summation. The contribution ratio of each verification dimension can be flexibly adjusted according to different businesses and different data sensitivities, so that the multidimensional comprehensive distance is more in line with the actual security needs, effectively improving the pertinence, rationality and scenario adaptability of consistency verification, and avoiding the evaluation bias caused by fixed weights.

[0076] In one embodiment of this application, a data usage dynamic control method based on data space further includes: The baseline weighting coefficients are adjusted based on metadata sensitivity and access scenarios, including: When an upward trend is detected in the sensitivity level of metadata associated with an access request, the weight of the first distance is increased based on a preset first gain coefficient, and the weight of the third distance is decreased accordingly. When the access scenario is detected to be in a preset high-risk period or geographical location, the weight of the second distance is increased based on a preset second gain coefficient; When the detection result indicates that the probability of an anomaly in the third distance of the current data user is greater than the preset anomaly threshold, the weight of the third distance is increased based on the preset third gain coefficient.

[0077] In this embodiment, dynamic weight adjustment is performed based on metadata sensitivity and real-time access scenarios, building upon the baseline weight coefficient. Specifically, changes in the metadata sensitivity level associated with access requests are continuously monitored. When an upward trend in the sensitivity level is detected, it indicates an increased potential risk of data leakage. At this point, a preset first gain coefficient is used to increase the weight of the operational consistency dimension (first distance) while correspondingly decreasing the weight of the behavioral pattern consistency dimension (third distance), thereby strengthening the verification of operational permission compliance. Metadata sensitivity describes the sensitivity of the data assets corresponding to the metadata; the preset first gain coefficient is set based on the magnitude of the upward trend in the sensitivity level, and the first gain coefficient is positively correlated with the upward trend in the sensitivity level.

[0078] When the current access scenario is identified as falling within a preset high-risk time period or high-risk geographical location, such as outside working hours, sensitive overseas areas, or regions with high attack frequency, a preset second gain coefficient is activated to increase the weight of the spatiotemporal consistency dimension (second distance) to strengthen the verification of the access scenario's legitimacy. The access scenario is an access context environment composed of access time, access geographical location, network environment, and terminal type. The preset second gain coefficient is configured differently based on the historical risk frequency of the access time period and geographical location, the network attack incidence rate, and regional security controls.

[0079] If, through historical behavior and real-time feature analysis, the probability of an anomaly in the behavioral pattern consistency dimension of the current data user is determined to be greater than a preset anomaly threshold, it indicates a higher risk that the data user's operation sequence, access frequency, and data usage scope deviate from the normal pattern. In this case, a preset third gain coefficient is used to increase the weight of the third distance, thereby achieving precise and enhanced verification of the behavioral patterns of high-risk entities. The preset anomaly threshold is obtained based on the historical behavioral baseline of the same data user, the normal behavioral distribution of similar user groups, and statistical fitting of the data asset's security level. The preset third gain coefficient is set segmented based on the data user's anomaly probability range, the data asset's sensitivity level, and the operational risk level.

[0080] This embodiment also includes dynamically adjusting the judgment threshold of the pre-trained access anomaly detection model based on multidimensional consistency distance. Specifically, the distribution of multidimensional consistency distances corresponding to access verification results that failed within a preset time window is statistically analyzed. For example, if the distribution indicates that the distance in a certain dimension is consistently high, the anomaly sensitivity threshold of the behavioral features related to that dimension in the access anomaly detection model is increased based on the data user. Simultaneously, the sensitivity parameters of the access anomaly detection model are adjusted according to the risk assessment coefficient. The higher the risk assessment coefficient, the higher the sensitivity parameters are adjusted, making the access anomaly detection model more stringent in judging abnormal behavior.

[0081] As can be seen from the above, this embodiment dynamically adjusts the baseline weight coefficients of the three dimensions based on the changing trend of metadata sensitivity, the risk level of the access scenario, and the probability of abnormal behavior of the data user. This can strengthen the verification of operation permissions when the data sensitivity increases, enhance the verification of access location and time in high-risk spatiotemporal scenarios, and increase the verification strength of behavior patterns when user behavior is abnormal. This achieves precise matching between weight allocation and real-time risk situation, effectively improving the pertinence, flexibility, and defense effectiveness of multi-dimensional consistency verification, avoiding the verification imbalance problem caused by fixed weights, and further improving the accuracy of data access compliance judgment and security protection level.

[0082] Corresponding to the data-space-based dynamic control method in the above embodiments, Figure 2 This is a structural block diagram of a data utilization dynamic control system based on a data space, provided as an embodiment of this application. For ease of explanation, only the parts relevant to the embodiment of this application are shown. Reference Figure 2 The data use dynamic control system 20 based on data space includes: a request access module 21, an environment perception module 22, a risk assessment module 23, an access determination module 24, an anomaly handling module 25, a behavior verification module 26, and an alarm generation module 27.

[0083] The access request module 21 is used to obtain the access request from the data user and store it in a preset data space. The data space includes the metadata of the data asset, control logic, access request and access policy. The environment awareness module 22 is used to obtain the environment information of the access request through the context awareness engine in the control logic; Risk assessment module 23 is used to assess environmental information based on a preset blocking rule base and a preset security policy baseline, and obtain risk assessment coefficients. The access determination module 24 is used to allow the data user to access the data when the risk assessment coefficient is less than the preset first threshold, and to input the pre-trained access anomaly detection model based on the interaction mode between the data user and the metadata to obtain the detection results, which include normal behavior, abnormal behavior and anomaly type. The exception handling module 25 is used to generate and output an access denial information report based on the exception type if the detection result is an abnormal behavior. The behavior verification module 26 is used to verify the consistency between the normal behavior and the access request and access policy if the detection result is normal behavior, and obtain the verification result. The alarm generation module 27 is used to generate and output alarm information for policy violation based on the type of policy conflict when the verification result is unsuccessful.

[0084] See Figure 3 , Figure 3 This is a schematic block diagram of an electronic device provided according to an embodiment of this application. Figure 3 The electronic device 300 in this embodiment may include one or more processors 301, one or more input devices 302, one or more output devices 303, and one or more memories 304. The processors 301, input devices 302, output devices 303, and memories 304 communicate with each other via a communication bus 305. The memories 304 store computer programs, including program instructions. The processors 301 execute the program instructions stored in the memories 304. Specifically, the processors 301 are configured to invoke the program instructions to perform the functions of the modules in the aforementioned device embodiments, for example... Figure 2 The functions of the request access module 21, environment perception module 22, risk assessment module 23, access determination module 24, anomaly handling module 25, behavior verification module 26, and alarm generation module 27 are shown.

[0085] It should be understood that, in the embodiments of this application, the processor 301 may be a central processing unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.

[0086] Input device 302 may include a touchpad, a fingerprint sensor (for collecting the user's fingerprint information and fingerprint orientation information), a microphone, etc., and output device 303 may include a display (LCD, etc.), a speaker, etc.

[0087] The memory 304 may include read-only memory and random access memory, and provides instructions and data to the processor 301. A portion of the memory 304 may also include non-volatile random access memory. For example, the memory 304 may also store device type information.

[0088] In specific implementations, the processor 301, input device 302, and output device 303 described in the embodiments of this application can execute the implementation methods described in any embodiment of the data usage dynamic control method based on data space provided in the embodiments of this application, or they can execute the implementation methods of the electronic devices described in the embodiments of this application, which will not be repeated here.

[0089] In another embodiment of this application, a computer-readable storage medium is provided. This computer-readable storage medium stores a computer program, which includes program instructions. When executed by a processor, the program instructions implement all or part of the processes in the methods described above. Alternatively, the computer program can instruct related hardware to complete the process. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include any entity or device capable of carrying computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium, etc.

[0090] The computer-readable storage medium can be an internal storage unit of the electronic device in any of the foregoing embodiments, such as a hard disk or memory of the electronic device. The computer-readable storage medium can also be an external storage device of the electronic device, such as a plug-in hard disk, smart media card (SMC), secure digital card (SD), flash card, etc., equipped on the electronic device. Furthermore, the computer-readable storage medium can include both internal and external storage units of the electronic device. The computer-readable storage medium is used to store computer programs and other programs and data required by the electronic device. The computer-readable storage medium can also be used to temporarily store data that has been output or will be output.

[0091] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this application.

[0092] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the electronic devices and units described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0093] In the several embodiments provided in this application, it should be understood that the disclosed electronic devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces or units, or it may be an electrical, mechanical, or other form of connection.

[0094] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of the embodiments of this application, depending on actual needs.

[0095] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0096] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A dynamic control method for data usage based on data space, characterized in that, include: The system acquires access requests from data users and stores them in a preset data space, which includes metadata of the data assets, control logic, access requests, and access policies. The context-aware engine in the control logic obtains the environmental information of the access request; The environmental information is risk-assessed based on a preset blocking rule base and a preset security policy baseline to obtain a risk assessment coefficient. When the risk assessment coefficient is less than a preset first threshold, the data user is allowed to access the data, and a pre-trained access anomaly detection model is input based on the interaction mode between the data user and the metadata to obtain the detection result, which includes normal behavior, abnormal behavior and anomaly type. If the detection result is abnormal behavior, an access denial information report will be generated and output based on the type of abnormality. If the detection result is normal behavior, then the normal behavior is verified to be consistent with the access request and the access policy to obtain the verification result; If the verification result is unsuccessful, an alert message indicating a policy violation will be generated and output based on the type of policy conflict.

2. The data usage dynamic control method based on data space according to claim 1, characterized in that, The risk assessment of the environmental information based on the data's inherent attributes and a preset security policy baseline yields a risk assessment coefficient, including: The attributes of the metadata and the environmental information are matched with a preset blocking rule base. If a blocking rule in any of the blocking rule bases is matched, the risk assessment process is terminated. If no blocking rule is matched in the blocking rule base, the data exposure impact level is determined based on the attributes of the metadata through a preset impact mapping rule; The environmental threat level is determined based on the deviation between the environmental information and the preset security strategy baseline. Based on the data exposure impact level and the environmental threat level, a risk matrix is ​​constructed; The risk matrix is ​​used to obtain matrix element values ​​corresponding to the data exposure impact level and environmental threat level as the risk assessment coefficients.

3. The data usage dynamic control method based on data space according to claim 1, characterized in that, Also includes: Based on a preset time period, the adjustment factor of the risk matrix is ​​obtained; When a single adjustment factor is obtained, a first adjustment step size is determined based on the type and value of the single adjustment factor, and the risk matrix is ​​adjusted based on the first adjustment step size. When multiple regulation factors are obtained, each regulation factor is analyzed to obtain the numerical correlation and changing trend among the multiple regulation factors; Based on the numerical correlation and the changing trend, an adjustment strategy for the risk matrix is ​​determined.

4. The data usage dynamic control method based on data space according to claim 3, characterized in that, The step of determining the adjustment strategy for the risk matrix based on the numerical correlation and the changing trend includes: Calculate the covariance or correlation coefficient between any two of the multiple adjustment factors to obtain a numerical correlation index characterizing the consistency of their change direction; Calculate the coefficient of variation of the standardized values ​​of all the multiple regulation factors to obtain a trend index characterizing the consistency of their change magnitudes; Based on the numerical correlation indicators and the trend indicators, the corresponding adjustment strategies are determined.

5. The data usage dynamic control method based on data space according to claim 4, characterized in that, The step of determining the corresponding adjustment strategy based on the numerical correlation indicator and the trend indicator includes: If the trend indicator is less than the preset consistency threshold and all numerical correlation indicators are positive, then the collaborative enhancement strategy is selected to adjust the matrix element values ​​in the risk matrix upwards. If at least one numerical correlation indicator is negative and its absolute value is greater than a preset conflict threshold, then a conflict balancing strategy is selected to locally compensate for the risk items in the risk matrix dominated by negatively correlated factors. If any condition is not met, an independent weighted strategy is selected, and the impact of each adjustment factor on different dimensions of the risk matrix is ​​calculated based on the preset weights of each adjustment factor, and then weighted and superimposed adjustment is performed.

6. The data usage dynamic control method based on data space according to claim 1, characterized in that, If the detection result is normal behavior, then the normal behavior is verified to be consistent with the access request and the access policy to obtain a verification result, including: Extract the behavioral feature vector of the normal behavior, extract the request intent feature vector of the access request, and extract the policy rule feature vector of the access policy. Calculate the multidimensional consistency distance between the behavior feature vector, the request intent feature vector, and the policy rule feature vector; If all the multidimensional consistency distances are less than the corresponding preset tolerance thresholds, the verification result is determined to be passed. If the consistency distance of at least one dimension is greater than or equal to its corresponding preset tolerance threshold, the verification result is determined to be unsuccessful.

7. The data usage dynamic control method based on data space according to claim 6, characterized in that, The calculation of the multidimensional consistency distance between the behavior feature vector, the request intent feature vector, and the policy rule feature vector includes: The behavioral feature vector, the request intent feature vector, and the policy rule feature vector are divided into operation consistency dimension, spatiotemporal consistency dimension, and behavioral pattern consistency dimension according to their attribute dimensions. In the operational consistency dimension, the intersection matching degree between the operation type in the behavior feature vector and the list of allowed operations in the policy rule feature vector is calculated to obtain the first distance; In the spatiotemporal consistency dimension, the degree of conformity between the timestamp and geographic location information in the request intent feature vector and the access time period and permitted area constraints in the policy rule feature vector is calculated to obtain the second distance; In the behavioral pattern consistency dimension, based on the operation sequence and frequency in the behavioral feature vector and the data usage range in the request intent feature vector, a pattern similarity comparison is performed with the operation frequency constraints and data usage range in the policy rule feature vector to obtain the third distance; The first distance, the second distance, and the third distance are weighted to generate the multidimensional consistency distance.

8. The data usage dynamic control method based on data space according to claim 7, characterized in that, The step of weighting the first distance, the second distance, and the third distance to generate the multidimensional consistent distance includes: The importance of the first distance, the second distance, and the third distance in the access request is calculated respectively to obtain the importance coefficients; Based on the importance coefficient, a baseline weight coefficient is determined for the first distance, the second distance, and the third distance; The first distance, the second distance, and the third distance are weighted and summed based on the benchmark weight coefficients to calculate the multidimensional consistency distance.

9. The data usage dynamic control method based on data space according to claim 8, characterized in that, Also includes: The baseline weight coefficient is adjusted based on the sensitivity and access scenario of the metadata, including: When an upward trend is detected in the sensitivity level of the metadata associated with the access request, the weight of the first distance is increased based on a preset first gain coefficient, and the weight of the third distance is decreased accordingly. When the access scenario is detected to be in a preset high-risk period or geographical location, the weight of the second distance is increased based on a preset second gain coefficient; When the detection result indicates that the probability of an anomaly in the third distance for the current data user is greater than a preset anomaly threshold, the weight of the third distance is increased based on a preset third gain coefficient.

10. A dynamic control system for data utilization based on data space, characterized in that, include: The access request module is used to obtain access requests from data users and store them in a preset data space, which includes metadata of data assets, control logic, access requests and access policies. The environment awareness module is used to obtain the environment information of the access request through the context awareness engine in the control logic; The risk assessment module is used to assess the environmental information based on a preset blocking rule base and a preset security policy baseline, and obtain a risk assessment coefficient. The access determination module is used to allow the data user to access the data when the risk assessment coefficient is less than a preset first threshold, and to input a pre-trained access anomaly detection model based on the interaction mode between the data user and the metadata to obtain the detection result, which includes normal behavior, abnormal behavior and anomaly type. An anomaly handling module is used to generate and output an access denial information report based on the anomaly type if the detection result is an abnormal behavior. The behavior verification module is used to verify the consistency between the normal behavior and the access request and the access policy if the detection result is normal behavior, and to obtain the verification result. The alarm generation module is used to generate and output alarm information for policy violation based on the type of policy conflict when the verification result is unsuccessful.

Images