A dynamic data desensitization method and desensitization system

Abstract

This invention relates to a dynamic data anonymization method and system. The system receives data access requests, parses the requests, and obtains key elements; it collects multi-dimensional contextual information associated with the current request and constructs a feature vector; it inputs the feature vector into a pre-trained machine learning model for real-time inference, outputs a risk score, and updates a continuous score sequence to characterize the risk level of the current request; based on preset risk-policy mapping rules, it determines the anonymization strategy corresponding to the current request and dynamically anonymizes the target data of the request; and it returns the anonymized data. The system includes an API gateway module, a feature acquisition and processing engine, an AI risk assessment module, a policy management module, and an anonymization execution engine. This invention significantly improves the accuracy of risk identification and the refinement of protection, automatically adjusting security protection scales as business changes and threat evolution occur, significantly improving operational efficiency, and continuously optimizing and improving risk identification capabilities.

Description

Technical Field

[0001] This invention relates to the technical field of electronic digital data processing, and in particular to a dynamic data desensitization method and desensitization system in the field of data security processing. Background Technology

[0002] As the value of data becomes increasingly apparent, data security regulations are becoming more stringent, and enterprises are raising their awareness of data privacy protection. Data security and privacy protection have become critical aspects of enterprise operations. Data anonymization, as one of the core methods to protect sensitive information from unauthorized access, is widely used in development testing, data analysis, and third-party sharing scenarios.

[0003] Traditional data masking techniques typically rely on predefined static rules, such as applying fixed masking rules to specific data fields (e.g., ID card numbers, mobile phone numbers). This technique has significant drawbacks: (1) Static rules cannot adapt to complex and ever-changing access scenarios; in order to meet the strictest security requirements, a "one-size-fits-all" strong desensitization strategy is usually adopted, which often leads to the loss of business analysis value of the desensitized data, and it is impossible to achieve a balance between security and availability, resulting in business rigidity and a high probability of conflict. (2) In the face of different user roles, access environments and usage purposes, administrators need to configure and maintain a large number of detailed rules. The rule set is huge and difficult to manage, prone to errors, and has high maintenance costs. (3) Static rules are based on known patterns, making it difficult to identify and defend against new and hidden data access risks or internal threats. They also lack effective risk assessment capabilities for access behaviors that deviate from normal patterns but do not hit any blacklist rules.

[0004] Existing technologies also include dynamic data masking methods based on simple rules. While traditional dynamic data masking techniques can process data in real time as it is accessed, their decision-making logic often relies on predefined, relatively fixed rules. Chinese Patent Publication No. CN119358038A discloses a data masking method and apparatus based on the BERT model. This method uses the BERT model to preprocess business data, identifies key data and sensitive information within the preprocessed business data using the trained BERT model, and selects a corresponding masking strategy from a masking strategy library based on the data type, data sensitivity, and contextual information of the sensitive information. This solution primarily identifies key data in the preprocessed business data using the BERT model, but does not include intelligent dynamic data masking or privacy risk assessment functions; other masking functions are conventional masking methods. Chinese patent CN120750643A discloses a context-aware real-time data anonymization method and system. This method intercepts HTTP / HTTPS requests through a gateway, extracts user authentication tokens, URL parameters, IP addresses, timestamps, and request body data from the request headers, parses user role information based on the authentication token, extracts access environment characteristics based on the IP address and timestamp, and identifies and classifies sensitive fields in the request body data to determine the data sensitivity level. Based on the user role information, access environment characteristics, and data sensitivity level, a rule engine matches predefined anonymization strategy templates to generate a real-time anonymization strategy containing field-level anonymization instructions. Access permissions are verified based on the authentication token, and the anonymization intensity is dynamically adjusted based on access environment characteristics. Real-time anonymization processing is then performed on sensitive fields in the corresponding data according to the real-time anonymization strategy and intensity. While this solution considers user identity and token address information, it still relies on predetermined data rules, using an "IF-THEN" rule engine, and similarly lacks intelligent dynamic data anonymization and privacy risk assessment functions.

[0005] Therefore, there is an urgent need for a more intelligent, dynamic, and precise data anonymization solution to maximize data availability while ensuring data security. Summary of the Invention

[0006] This invention addresses the problems existing in the prior art by providing a dynamic data anonymization method and system. It represents the risk evolution trajectory through a continuous risk scoring sequence and can trigger an adaptive strength dynamic anonymization strategy based on the characteristics of risk mutations. This solves the problems of dynamic alignment of heterogeneous data sources and accurate response to sudden risks, thereby improving the privacy and security protection capabilities of the data anonymization scheme.

[0007] The technical solution adopted in this invention is a dynamic data desensitization method, which includes the following steps: Receive data access requests, parse the requests, and obtain key elements; Collect multi-dimensional contextual information associated with the current request and construct a feature vector; The feature vector is input into a pre-trained machine learning model for real-time inference, outputting a risk score and updating the continuous score sequence to characterize the risk level of the current request. Based on the preset risk-policy mapping rules, the de-identification policy corresponding to the current request is determined, and the target data of the request is dynamically de-identified. Return the anonymized data.

[0008] This invention proposes the concept of a continuous scoring sequence, which differs from a simple set of single-point risk scores. Instead, it serves as the core state carrier driving the adaptive decision-making of the system, with three specific functions: First, it enables the identification of risk mutations by calculating the score increments of the most recent N requests, thus identifying sudden transitions from low to high risk and triggering a step-like policy response. Second, it supports heterogeneous data alignment by dynamically adjusting the credibility weights of various heterogeneous data sources based on the overall stability of the continuous scoring sequence, solving the problems of temporal and confidence misalignment in multi-source data. Third, it drives the closed-loop evolution of the system by achieving baseline health diagnosis and dynamic calibration based on the distribution characteristics of the continuous scoring sequence, continuously optimizing the model inference accuracy and policy thresholds.

[0009] Preferably, the multi-dimensional context information includes request subject information, request operation information, target data information, network environment information, historical behavior baseline information, and data sensitivity tag information; All multi-dimensional contextual information is normalized and standardized to obtain a fixed-dimensional numerical feature vector.

[0010] Preferably, during the user's first visit or system launch phase, the original behavior sequence is collected from all access logs within a preset time period, normalized, and then input into a variational autoencoder for temporal embedding compression. A clustering algorithm is used to identify typical behavior pattern clusters, and the center of each cluster constitutes the initial multidimensional behavior baseline vector of the corresponding user. During system operation, online incremental updates are performed based on continuous scoring sequence feedback. When the risk score falls into the low-risk range and the request is marked as safe, the system determines that the access is a valid behavioral sample and uses an exponentially weighted moving average to incrementally update each dimension of the baseline. The update weight is the risk perception decay coefficient, which is negatively correlated with the risk score.

[0011] Preferably, statistical indicators are calculated based on the collected raw behavioral sequence data, and the statistical indicators include at least one of access frequency characteristics, data volume characteristics, time characteristics, geographical location characteristics, and operation type characteristics.

[0012] Preferably, the risk-strategy mapping rule divides the risk score into multiple consecutive scoring intervals and predefines a corresponding desensitization strategy for each interval, with the strength of the desensitization strategy being positively correlated with the scoring interval.

[0013] Preferably, the multiple consecutive scoring intervals are divided by at least one threshold; the system periodically performs baseline health diagnosis, extracts the low-risk request feature distribution of the user in the most recent preset time period from the audit log, and performs statistical testing with the historical distribution represented by the current baseline; if the test result exceeds the preset threshold, it is determined that behavioral drift has occurred, and the baseline recalibration process is automatically triggered to generate a new baseline to update the historical distribution benchmark, thereby adjusting the value of the threshold.

[0014] Preferably, the alignment of heterogeneous data sources is achieved by collecting multi-dimensional contextual information associated with the current request based on heterogeneous data sources, using continuous scoring sequences as the representation scale, and employing a hybrid alignment strategy.

[0015] Preferably, the dynamic desensitization process includes performing at least one of the following on the target data: replacement, masking, generalization, disordering, and data forgery.

[0016] A dynamic data anonymization system, comprising: The API gateway module is used to receive data access requests and return anonymized data. The feature acquisition and processing engine is used to respond to requests, collect multi-dimensional contextual information, and construct feature vectors. The AI ​​risk assessment module is used to load pre-trained machine learning models, receive feature vectors, output risk scores, and update continuous score sequences. The strategy management module is used to store and manage risk-strategy mapping rules, and determine the corresponding de-identification strategy based on the risk score; The de-identification execution engine is used to dynamically de-identify target data according to the de-identification strategy, and then return the processed data to the API gateway module.

[0017] Preferably, the feature acquisition and processing engine uses a continuous scoring sequence as a representation scale and interfaces with multiple heterogeneous external data sources through a pre-set adapter to obtain multi-dimensional contextual information in real time.

[0018] This invention relates to a dynamic data anonymization method and system. The system receives data access requests, parses the requests, and obtains key elements; collects multi-dimensional contextual information associated with the current request to construct a feature vector; inputs the feature vector into a pre-trained machine learning model for real-time inference, outputs a risk score, and updates a continuous score sequence to characterize the risk level of the current request; based on preset risk-policy mapping rules, determines the anonymization strategy corresponding to the current request and dynamically anonymizes the target data of the request; and returns the anonymized data. The system includes an API gateway module, a feature acquisition and processing engine, an AI risk assessment module, a policy management module, and an anonymization execution engine.

[0019] The beneficial effects of this invention are as follows: (1) By integrating information from multiple dimensions in real time through the feature acquisition engine and constructing feature vectors, the system can accurately profile each data access request, providing a rich basis for subsequent decision-making; by adopting a pre-trained machine learning model, it automatically learns and identifies complex and implicit risk patterns, accurately distinguishes between normal behavior and malicious attacks, significantly reduces false alarms and false negatives, and constructs a continuous scoring sequence with the output risk score, providing a basis for refined strategy control, thereby significantly improving the accuracy of risk identification and the level of refined protection. (2) Based on risk scoring, through the preset risk-policy mapping relationship, perform differentiated de-identification operations that match the risk level to achieve a dynamic balance between security and data availability; the policy mapping relationship is configurable and the model is continuously iterated and optimized, enabling the system to automatically adjust the security protection scale as business changes and threats evolve; (3) The process from receiving a request to returning a response can be completed within milliseconds, which fully meets the performance requirements of high-concurrency API gateways and does not affect the normal access experience of business systems; the intelligent decision-making capability reduces the burden of manually formulating, maintaining and adjusting de-identification rules, and significantly improves operation and maintenance efficiency; (4) The system modules are decoupled, supporting independent upgrades and expansions, which facilitates rapid adaptation to different business needs; the audit log center meets compliance audit requirements and can output high-quality training data, continuously feeding back to the model training process, and promoting the continuous self-optimization and improvement of the system's risk identification capabilities. Attached Figure Description

[0020] Figure 1 This is a flowchart of the method of the present invention; Figure 2 This is a schematic diagram of the system structure of the present invention; Figure 3 This is a diagram illustrating the overall architecture of the present invention in a specific implementation process; Figure 4 This is a schematic diagram illustrating the risk-strategy mapping relationship in the specific implementation process of the present invention. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] This invention relates to a dynamic data anonymization method. The core idea of ​​the method is to introduce an AI-driven "decision-making party" that analyzes the context of each data access request in real time, dynamically calculates the risk level, and generates the optimal, personalized data anonymization strategy accordingly, thereby achieving a dynamic balance between data security and utility.

[0023] The method includes the following steps: (1) Receive data access requests, parse the requests, and obtain key elements; (2) Collect multi-dimensional contextual information associated with the current request and construct a feature vector; (3) Input the feature vector into the pre-trained machine learning model, perform real-time reasoning, output risk score and update the continuous score sequence to characterize the risk level of the current request; (4) Based on the preset risk-policy mapping rules, determine the de-identification policy corresponding to the current request and perform dynamic de-identification processing on the target data of the request; (5) Return the data after desensitization.

[0024] Suppose an enterprise deploys the data anonymization system of this invention in its data center or cloud platform to protect customer personal information stored in its database. Specifically, the API gateway module is exposed to public or intranet applications, while other modules are deployed in the internal network area, with security ensured through firewall policies. The steps for handling data access requests from external applications are explained in conjunction with the specific implementation of the system.

[0025] (1) Receive data access requests, parse the requests, and obtain key elements; In this invention, the API gateway module serves as the unified entry point of the system, receiving data access requests sent by external applications. The request includes at least the following metadata: a unique request identifier (Request ID), a request body (user ID or application ID), a request operation type (such as SELECT or GET), a target data identifier (such as a database table name, primary key, or API endpoint), and a request timestamp. The API gateway module performs preliminary verification on the request, such as format checking and identity authentication. It then parses out the aforementioned metadata as key elements and sends it along with the request content to the internal processing pipeline.

[0026] For example, if the request content is to query a user's personal details, the parsed result is the user ID "user_analyst" and the target data table is "t_customer_pii".

[0027] (2) Collect multi-dimensional contextual information associated with the current request and construct a feature vector; In this invention, the feature acquisition and processing engine is triggered to perform feature acquisition. The engine has multiple built-in adapters that can connect with multiple heterogeneous external data sources in real time to obtain multi-dimensional context information related to the current request.

[0028] The multi-dimensional contextual information includes request subject information, request operation information, target data information, network environment information, historical behavior baseline information, and data sensitivity tag information; among which, (2-1) Request subject information refers to obtaining user roles, departments, permission groups, etc. from the unified identity authentication system (IAM); for example, the query shows that "user_analyst" belongs to the "third-party data analysis team" and has a low permission level; (2-2) Network environment information refers to the source IP address, geographic location, proxy information, etc. obtained from the network monitoring system. For example, the source IP address is located overseas and is not the company's usual office location. (2-3) Historical behavior baseline information refers to the user's historical access patterns obtained from the application log system, such as average access frequency and common operation time periods. The engine calculates the deviation of the current request from the historical baseline in real time. The following is a specific implementation: During the initial user visit or system launch phase (initial stage), instead of relying on preset rules, raw behavioral sequences (including but not limited to request time, operation type, target table, data volume, response latency, IP geographic distribution, etc.) are collected from all user access logs within a preset time period. After normalization, these sequences are input into a variational autoencoder (VAE) for temporal embedding compression. Clustering algorithms, such as DBSCAN, are used to identify typical behavioral pattern clusters. The center of each cluster constitutes the initial multidimensional behavioral baseline vector for the corresponding user. For example, clusters such as "high-frequency query of customer basic information during working hours" and "low-frequency export of reports at night" are used as clusters, and "[time distribution mean μ_t=0.82, operation entropy H_op=1.2, geographic stability σ_geo=0.15]" is used as the initial multidimensional behavioral baseline vector. This avoids manually setting subjective thresholds such as "regular time period" and achieves objectivity and personalization of the baseline. During system operation, online incremental updates are performed based on continuous scoring sequence feedback. When the risk score falls into the low-risk range (e.g., s ∈ [0.0, 0.3)) and the request is marked as safe (e.g., after manual review or no anomalies reported by the business system), the system determines the access as a valid behavioral sample and uses Exponential Weighted Moving Average (EWMA) to incrementally update the baseline dimensions. baseline new = α × feature current + (1-α) × baseline old Among them, feature current The baseline is the real-time feature value extracted from this request, corresponding to each dimension of the baseline vector. old The old baseline is used; the updated weight α is the risk perception decay coefficient, which is negatively correlated with the risk score; the lower s is (the safer), the larger α is (e.g., when s=0.1, α=0.3, quickly absorbing new behaviors); when s is close to the threshold, α automatically decays (e.g., when s=0.29, α=0.05, suppressing noise interference); this design enables the baseline to adapt to real-world scenarios such as changes in user roles (e.g., analysts switching to operations and maintenance) and shifts in business rhythm (e.g., peak access times during promotional periods shifting forward), rather than a mechanical sliding window.

[0029] (2-4) Data sensitivity label information refers to the metadata of target data obtained from the data catalog system, including predefined sensitivity level labels (such as PII, PCI, PHI). For example, the query result “t_customer_pii” is marked as “high sensitivity (PII)”.

[0030] The feature acquisition and processing engine not only collects raw data, but also performs real-time derivative feature calculations. By normalizing and standardizing all multi-dimensional contextual information, it obtains a fixed-dimensional numerical feature vector.

[0031] Statistical indicators are calculated based on the collected raw behavioral sequence data. These indicators include at least one of the following: access frequency characteristics, data volume characteristics, time characteristics, geographic location characteristics, and operation type characteristics. Specifically, they include, but are not limited to, access rate change rate, sensitive data access ratio, deviation of the current access time from the historical average time, deviation of the current requested data volume from the historical average data volume, and deviation of the current access geographic location from historically frequently used geographic locations. Examples include "whether the current access time falls within the user's regular working hours," "whether the current requested data volume is significantly higher than the historical average," and "whether the access geographic location is a common login location." The engine then normalizes and standardizes all collected feature values ​​to eliminate the influence of units, ultimately forming a fixed-dimensional numerical feature vector. This normalization and standardization does not uniformly employ a single traditional method such as Min-Max or Z-score, but rather a hierarchical, semantically driven, and multi-dimensional joint normalization mechanism, including the following steps: (a) Semantic type prediction and path diversion: The engine first identifies the semantic type of the feature based on the feature metadata (from the sensitive semantic graph and adapter annotation) - categorical (such as user role), ordinal (such as geolocation hierarchical coding), Boolean derivative (such as "whether it is regular working time"), and continuous statistical (such as historical deviation). Different semantic types trigger different normalization sub-processes. (b) For categorical / ordinal features, semantic embedding normalization is adopted instead of direct one-hot encoding. Instead, a lightweight VAE latent space mapping is used to compress category labels (such as "third party" and "overseas") into low-dimensional dense vectors, which are then normalized to the unit sphere by L2, so that semantically similar categories are closer in the vector space and have comparability in the [0,1] interval. (c) For Boolean / logic derivative features, a probabilistic calibration is adopted. For example, for binary features such as "whether it belongs to the regular working time", instead of simply assigning 0 / 1, the posterior probability of the time point falling within the typical user behavior cluster is calculated based on the baseline distribution obtained by DBSCAN clustering (e.g., using kernel density estimation KDE to obtain local probability density), and the continuous confidence of [0,1] is output. In essence, the logical judgment is transformed into risk probability estimation. (d) Quantile normalization is used for continuous statistical features. For time outliers and data deviations, the empirical cumulative distribution function (ECDF) is used to map to a uniform distribution U(0,1) instead of linear scaling. This method is robust to outliers and can force different units to align on the same probability scale, ensuring that the model is consistently sensitive to extreme deviations. (e) Cross-source joint constraint normalization: After all features are processed through the above path, they are input into the hidden layer of the pre-trained VAE for joint embedding; Cross-source covariance regularization term is explicitly added to the reconstruction loss function of the VAE latent variables, forcing features from different sources to satisfy the joint statistical constraints of zero mean and unit variance in the latent space, so as to achieve global dimensional uniformity and distribution consistency of the final output feature vector.

[0032] For example, we might obtain a feature vector: [User Role: 0.2 (Third Party), Geographic Location: 0.8 (Overseas), Time Anomaly: 0.9, Data Sensitivity: 0.95], where the values ​​are normalized results.

[0033] Furthermore, based on the multi-dimensional contextual information associated with the current request collected from heterogeneous data sources, and using continuous scoring sequences as the representation scale, a hybrid alignment strategy is adopted to achieve alignment of heterogeneous data sources.

[0034] Specifically, the hybrid alignment strategy includes: Semantic alignment: Construct a cross-source sensitive semantic graph to map heterogeneous data (such as user roles, geographical locations, and data tags) from different heterogeneous data sources (such as IAM, network monitoring, and data catalogs) to a unified risk atomic predicate space, such as permission level, policy violation status, and desensitization strength requirements, so that data from different sources are comparable and interpretable at the risk reasoning level. Timing alignment: Using the unique identifier of the request as the anchor point, a sliding causal window mechanism is adopted to only adopt the context information that the timestamp closely surrounds the moment the request occurs (automatically discarding lagging or leading data), ensuring that the features of all dimensions describe the true state of the same request at that instant, fundamentally solving the timing misalignment problem caused by clock drift and acquisition delay in heterogeneous systems; Statistical alignment: The cross-source joint feature matrix is ​​input into the pre-trained variational autoencoder. The cross-source invariant distribution representation is learned through the hidden layer, and the aligned feature vector is output. This gives the original indicators of different dimensions (such as discrete codes, continuous values, and frequency counts) a unified statistical weight in the latent space, which can be directly used for model calculation. Credibility Alignment: Dynamic credibility weights are assigned to each external data source. These weights are adjusted in real time based on the deviation of the data distribution of the data source from the historical baseline and participate in model inference as explicit features. This enables the model to learn to reduce the weights of low-credibility data sources autonomously, thereby enhancing the system's robustness to data quality fluctuations. Intent alignment: Based on the post-verification results provided by the audit logs (such as manual review labels), when a high-risk score is verified as a false alarm, the contribution of each source feature to the continuous risk score is calculated back, and calibration instructions (such as updating the rule base or adjusting the threshold) are pushed to the data source adapter with high contribution but conflict with the verification results, forming a closed-loop optimization driven by risk scores.

[0035] (3) Input the feature vector into the pre-trained machine learning model, perform real-time reasoning, output risk score and update the continuous score sequence to characterize the risk level of the current request; This step is the intelligent decision-making center of the system. The pre-trained risk assessment model receives the generated feature vector and outputs a continuous score sequence representing the potential risk level of the current request, such as [0.12, 0.15, 0.14, 0.88]. This is the risk evolution trajectory of the user / device / session over time, implying the mutability, cumulativeity, and contextual dependence of the risk.

[0036] Specifically, the constructed feature vectors are sent to the AI ​​risk assessment module, which loads a pre-trained machine learning model, preferably a Gradient Boosting Decision Tree (GBDT) model such as XGBoost or LightGBM. The model is deployed as a microservice, supporting hot updates and A / B testing. The model is trained offline using historical, labeled risk request data to learn the mapping relationship between features and risks. The hot update mechanism preloads the current main version model and keeps it resident in memory when the service starts. After the new model completes loading, verification, and warm-up inference in an independent sandbox environment, the policy management module issues a version switching command through the atomic configuration center, with no connection interruption and no request drop throughout the process. The A / B testing mechanism uses request ID hash bucketing to achieve deterministic traffic splitting, with the old and new versions running in parallel during testing. The system performs inference, outputting continuous score sequences and SHAP interpretation values ​​for each model. Differences are captured in real time and written to the audit log center. The KS test is used to compare the score distribution shifts of the two models on the same sample set. Combined with manual review of labels, indicators such as F1-score and calibration degree (ECE) are calculated to automatically determine the superiority of the models. Both the hot update mechanism and A / B testing use continuous "risk scores" as a unified evaluation benchmark, rather than discrete classification results. The risk-policy mapping rules remain unchanged before and after model switching, with only the score distribution changing. The system automatically adapts to the output characteristics of the new model through a dynamic dual-threshold mechanism (threshold recalibration driven by the KS test) to avoid policy gaps. The audit log center continuously feeds back false positive / false negative samples from the A / B test, triggering a closed loop of incremental model training and forming a positive flywheel of "deployment-validation-optimization".

[0037] Upon receiving the feature vector, each decision tree in the model makes a judgment in turn, and finally the outputs of all trees are weighted and combined to obtain a risk score, such as 0.88, which represents the potential risk level of this request. The higher the score, the greater the risk. The entire inference process is completed in memory and takes milliseconds.

[0038] Each time a request inference is completed, the continuous score sequence is updated once. The sequence length is maintained by a sliding window mechanism, which is the score set of the most recent K requests. K can be configured from 10 to 100 depending on the application scenario. The updated continuous score sequence will be used in the feature acquisition and processing engine to perform updated feature calculations in the next round of processing, and obtain a numerical feature vector that integrates the statistical features of the historical continuous score sequence.

[0039] (4) Based on the preset risk-policy mapping rules, determine the de-identification policy corresponding to the current request and perform dynamic de-identification processing on the target data of the request; The risk-strategy mapping rule divides the risk score into multiple consecutive scoring intervals and predefines a corresponding desensitization strategy for each interval. The strength of the desensitization strategy is positively correlated with the scoring interval.

[0040] The multiple consecutive scoring intervals are divided by at least one threshold. The system periodically performs baseline health diagnosis, extracts the low-risk request feature distribution of the user in the most recent preset time period from the audit log, and performs statistical testing with the historical distribution represented by the current baseline. If the test result exceeds the preset threshold, it is determined that behavioral drift has occurred, and the baseline recalibration process is automatically triggered to generate a new baseline to update the historical distribution benchmark, thereby adjusting the value of the threshold.

[0041] Specifically, the risk score is passed to the strategy management module, which maintains a configurable risk-strategy mapping table. This table uses a design where the risk score range is positively correlated with the desensitization intensity, with the horizontal axis representing the risk score (range 0.0~1.0) and the vertical axis representing the desensitization intensity. Figure 4 As shown, risk scores are divided into multiple intervals (e.g., low-risk, medium-risk, and high-risk) using preset thresholds. Each interval corresponds to a different desensitization strategy, and the strength of the desensitization strategy is positively correlated with the score interval. For example, When the risk score is in the range of [0.0, 0.3), it corresponds to a low-risk area, and a weak desensitization strategy is adopted, such as only partially masking highly sensitive fields; When the risk score is in the range of [0.3, 0.7), it corresponds to the medium-risk zone. The standard desensitization strategy is adopted, such as applying the standard desensitization algorithm to all sensitive fields. When the risk score is in the range of [0.7, 1.0], it corresponds to a high-risk area. A strong de-identification strategy is adopted, such as returning a very small amount of de-identified data or completely falsified data, and triggering an alarm.

[0042] In this embodiment, the score is 0.88, falling into the high-risk zone. Therefore, the policy management module generates the policy instruction {"action": "strong_masking", "alert": true}.

[0043] In actual implementation, to prevent the baseline from becoming invalid due to long-term cumulative deviation, the system performs a baseline health diagnosis every 24 hours. Specifically, this is done through an abnormal baseline warning based on the KS test. The feature distribution of all low-risk requests for the user in the past 7 days is extracted from the audit logs and compared with the historical distribution represented by the current baseline using a Kolmogorov-Smirnov (KS) test. If the KS statistic D > D in any dimension... threshold (D) threshold If a significant behavioral shift occurs in a dimension (dynamically calculated based on a global confidence level of 95%), the system will automatically trigger a baseline recalibration process, freeze the old baseline, call VAE and DBSCAN to re-cluster all behaviors over the past 7 days, generate a new baseline, and archive the old baseline to the audit log center for traceability analysis. This mechanism ensures that the baseline always reflects the user's "current real behavioral paradigm" rather than an outdated historical snapshot.

[0044] In some preferred embodiments, the dual thresholds (e.g., 0.3 and 0.7) used to divide risk zones are not fixed but can be dynamically adjusted based on system feedback. For example, the system can collect actual risk events (such as confirmed data breaches) from audit logs and combine them with the score distribution output by the model to automatically optimize the thresholds, enabling high-risk zones to more accurately cover real attacks while reducing false positives in low-risk zones. Dynamic adjustment of the thresholds can be achieved through online learning algorithms or rule-based feedback mechanisms, further enhancing the system's adaptability.

[0045] In practice, the data masking execution engine receives policy instructions and the target's original data, and performs dynamic data masking. This dynamic masking process includes at least one of the following: replacement, masking, generalization, reordering, and data forgery. Based on the instructions, the engine calls the corresponding algorithm to process the data. For example, under a high-risk policy, the "user name" field might be directly replaced with "**", and the phone number might be replaced with "***-****-****". Simultaneously, based on the alarm requirements in the instructions, an alarm message is generated.

[0046] (5) Return the data after desensitization.

[0047] The anonymized data and potential alerts are encapsulated into a response by the API gateway module and returned to the requester. Simultaneously, the audit log center receives log streams from various modules, recording the entire lifecycle of this request in an immutable audit log. The log content includes the original request ID, feature vector, risk score, anonymization strategy used, execution result, and timestamp. These logs are used not only for compliance auditing but also to provide high-quality training samples for subsequent model iteration and optimization.

[0048] In this embodiment, the audit log center records all details of the event, including the risk score of 0.88 and the characteristics of the decision-making basis, into the database for subsequent review by security analysts.

[0049] This invention also relates to a dynamic data desensitization system, which adopts a modular design.

[0050] The API gateway module is used to receive data access requests and return anonymized data. Located at the front end of the system, the API gateway module serves as a unified entry and exit point. It performs protocol parsing, authentication, and flow control on the received data requests, forwards the requests to the internal processing pipeline, and finally encapsulates the anonymized data into a response and returns it.

[0051] The feature acquisition and processing engine is used to respond to requests, collect multi-dimensional contextual information, and construct feature vectors. The feature acquisition and processing engine uses continuous scoring sequences as a representation scale and interfaces with multiple heterogeneous external data sources through pre-set adapters to obtain multi-dimensional contextual information in real time.

[0052] The AI ​​risk assessment module is used to load pre-trained machine learning models (such as XGBoost models), receive feature vectors, output risk scores, and update continuous score sequences. This module supports hot updates and A / B testing of models, so that models can be upgraded or the effects of different models can be compared without interrupting services.

[0053] The strategy management module is used to store and manage risk-strategy mapping rules and determine the corresponding de-identification strategy based on the risk score. In practical applications, this module allows administrators to perform visual configuration and adjustment through the management interface, and then query the mapping relationship based on the risk score to generate specific de-identification strategy instructions, which are then passed to the de-identification execution engine.

[0054] The data masking execution engine includes an extensible data masking algorithm library, used to dynamically mask target data according to the data masking strategy, and then return the processed data to the API gateway module (e.g., ...). Figure 2 (As shown by the dashed line in the middle). This engine supports plug-in access of custom algorithms, making it convenient to add new de-identification methods according to business needs in the future.

[0055] It also includes an audit log center, which is connected to at least one of the following modules: API gateway module, feature acquisition and processing engine, AI risk assessment module, policy management module, and de-identification execution engine. This audit log center records and stores audit logs including request identifiers, feature vectors, risk scores, the de-identification strategies used, execution results, and timestamps. In practical applications, the audit log center provides powerful query, analysis, and reporting functions to meet the needs of security auditing and troubleshooting, and employs tamper-proof storage technologies (such as blockchain or WORM storage) to ensure the authenticity and integrity of the logs. The audit log center connects to all other modules and receives log streams from each module.

[0056] The modules communicate efficiently with each other through the enterprise's internal network, for example, by using the gRPC protocol or message queues (such as Kafka) to ensure low latency and high reliability in high-concurrency scenarios.

[0057] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0058] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0059] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0060] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0061] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0062] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A dynamic data anonymization method, characterized in that: The method includes the following steps: Receive data access requests, parse the requests, and obtain key elements; Collect multi-dimensional contextual information associated with the current request and construct a feature vector; The feature vector is input into a pre-trained machine learning model for real-time inference, outputting a risk score and updating the continuous score sequence to characterize the risk level of the current request. Based on the preset risk-policy mapping rules, the de-identification policy corresponding to the current request is determined, and the target data of the request is dynamically de-identified. Return the anonymized data. 2.The dynamic data de-sensitization method of claim 1, wherein: The multi-dimensional contextual information includes request subject information, request operation information, target data information, network environment information, historical behavior baseline information, and data sensitivity label information; All multi-dimensional contextual information is normalized and standardized to obtain a fixed-dimensional numerical feature vector.

3. The dynamic data desensitization method according to claim 2, characterized in that: During the initial user visit or system launch phase, raw behavior sequences are collected from all access logs within a preset time period. After normalization, they are input into a variational autoencoder for temporal embedding compression. Clustering algorithms are used to identify typical behavior pattern clusters, and the center of each cluster constitutes the initial multidimensional behavior baseline vector for the corresponding user. During system operation, online incremental updates are performed based on continuous scoring sequence feedback. When the risk score falls into the low-risk range and the request is marked as safe, the system determines that the access is a valid behavioral sample and uses an exponentially weighted moving average to incrementally update each dimension of the baseline. The update weight is the risk perception decay coefficient, which is negatively correlated with the risk score.

4. The dynamic data desensitization method according to claim 2, characterized in that: Statistical indicators are calculated based on the collected raw behavioral sequence data. These statistical indicators include at least one of the following: access frequency characteristics, data volume characteristics, time characteristics, geographical location characteristics, and operation type characteristics.

5. The dynamic data desensitization method according to claim 1, characterized in that: The risk-strategy mapping rule divides the risk score into multiple consecutive scoring intervals and predefines a corresponding desensitization strategy for each interval. The strength of the desensitization strategy is positively correlated with the scoring interval.

6. The dynamic data desensitization method according to claim 5, characterized in that: The multiple consecutive scoring intervals are divided by at least one threshold; the system periodically performs baseline health diagnosis, extracts the low-risk request feature distribution of the user in the most recent preset time period from the audit log, and performs statistical testing with the historical distribution represented by the current baseline; If the test result exceeds the preset threshold, it is determined that behavioral drift has occurred, and the baseline recalibration process is automatically triggered to generate a new baseline to update the historical distribution benchmark, thereby adjusting the value of the threshold.

7. The dynamic data desensitization method according to claim 1, characterized in that: Based on the multi-dimensional contextual information collected from heterogeneous data sources and associated with the current request, and using continuous scoring sequences as the representation scale, a hybrid alignment strategy is adopted to achieve alignment of heterogeneous data sources.

8. The dynamic data desensitization method according to claim 1, characterized in that: The dynamic desensitization process includes performing at least one of the following on the target data: replacement, masking, generalization, disordering, and data forgery.

9. A dynamic data anonymization system, characterized in that: include: The API gateway module is used to receive data access requests and return anonymized data. The feature acquisition and processing engine is used to respond to requests, collect multi-dimensional contextual information, and construct feature vectors. The AI ​​risk assessment module is used to load pre-trained machine learning models, receive feature vectors, output risk scores, and update continuous score sequences. The strategy management module is used to store and manage risk-strategy mapping rules, and determine the corresponding de-identification strategy based on the risk score; The de-identification execution engine is used to dynamically de-identify target data according to the de-identification strategy, and then return the processed data to the API gateway module.

10. A dynamic data desensitization system according to claim 9, characterized in that: The feature acquisition and processing engine uses continuous scoring sequences as a representation scale and interfaces with multiple heterogeneous external data sources through pre-set adapters to obtain multi-dimensional contextual information in real time.

Images