Multi-node based label data propagation processing method and apparatus, and electronic device

Abstract

This invention discloses a multi-node-based method, apparatus, and electronic device for processing tag data propagation. The method includes: acquiring target tag data; determining multiple candidate behavioral fingerprints corresponding to the leaked tag sample when a leaked tag sample matching the target tag data is detected in an external environment; matching multiple candidate processing nodes from a node behavioral fingerprint rule base based on the multiple candidate behavioral fingerprints, wherein the node behavioral fingerprint rule base pre-stores behavioral fingerprint templates generated by each compliant processing node in historical propagation events; performing path inversion based on the multiple candidate processing nodes to obtain the target propagation path of the leaked tag sample; and identifying the leaked processing node of the target tag data from the target propagation path. This invention solves the technical problem in related technologies where the lack of behavioral trace records during the flow of data tags through multiple processing nodes leads to the inability to trace the source of leaks.

Description

Technical Field

[0001] This invention relates to the field of data transmission technology, and more specifically, to a method, apparatus, and electronic device for multi-node tag data propagation and processing. Background Technology

[0002] Currently, in scenarios such as AI training, industrial data collaboration, and cross-institutional information sharing, data tags, as key carriers of semantics, permissions, and business logic, frequently circulate among multiple processing nodes, involving multiple stages such as cleaning, mapping, auditing, and distribution. However, related technologies generally rely on access control, digital signatures, or static watermarks for data security protection, failing to record the actual operational behavior of each processing node within the tag itself. This results in the inability to trace which nodes the tag passed through, what operations were performed, and when the abnormal spread occurred once the tag is leaked. Log auditing in related technologies is limited by system heterogeneity and log silos, making cross-domain correlation difficult; while device fingerprinting or asset identification technologies can only identify node identities and cannot reflect "what the node did to the tag." Due to the lack of a mechanism for embedding and accumulating hop-by-hop traces of propagation behavior, tags act like a "black box" during circulation. Once leaked, responsibility is difficult to delineate, and the path cannot be reconstructed, seriously hindering data security auditing and compliance accountability. In summary, the lack of behavioral trace records in the multi-processing node circulation of data tags in related technologies leads to problems such as the inability to trace the source of leaks.

[0003] There is currently no effective solution to the above problems. Summary of the Invention

[0004] This invention provides a multi-node-based tag data propagation and processing method, apparatus, and electronic device to at least solve the technical problem in related technologies where data tags are leaked and cannot be traced due to a lack of behavioral trace records during the flow of data tags across multiple processing nodes.

[0005] According to one aspect of the present invention, a multi-node-based tag data propagation processing method is provided, comprising: acquiring target tag data, wherein the target tag data is obtained by sequentially processing original tag data by multiple processing nodes, the target tag data carrying behavioral fingerprints corresponding to each of the multiple processing nodes, the behavioral fingerprints being used to indicate the behavioral information of the corresponding processing node in the tag data propagation and processing process; determining multiple candidate behavioral fingerprints corresponding to the leaked tag sample when a leaked tag sample matching the target tag data is detected in an external environment; matching multiple candidate processing nodes corresponding to the leaked tag sample from a node behavioral fingerprint rule base based on the multiple candidate behavioral fingerprints, wherein the node behavioral fingerprint rule base pre-stores behavioral fingerprint templates generated by each compliant processing node in historical propagation events; performing path inversion based on the multiple candidate processing nodes to obtain the target propagation path of the leaked tag sample; and identifying the leaked processing node of the target tag data from the target propagation path.

[0006] According to another aspect of the present invention, a multi-node-based tag data propagation and processing apparatus is also provided, comprising: a tag data acquisition module for acquiring target tag data, wherein the target tag data is obtained by sequentially processing original tag data through multiple processing nodes, the target tag data carrying behavioral fingerprints corresponding to each of the multiple processing nodes, the behavioral fingerprints being used to indicate the behavioral information of the corresponding processing node during the tag data propagation and processing process; a candidate behavioral fingerprint determination module for determining multiple candidate behavioral fingerprints corresponding to the leaked tag sample when a leaked tag sample matching the target tag data is detected in an external environment; a candidate processing node matching module for matching multiple candidate processing nodes from a node behavioral fingerprint rule base based on the multiple candidate behavioral fingerprints, wherein the node behavioral fingerprint rule base pre-stores behavioral fingerprint templates generated by each compliant processing node in historical propagation events; a path inversion module for performing path inversion based on the multiple candidate processing nodes to obtain the target propagation path of the leaked tag sample; and a leaked node identification module for identifying the leaked processing node of the target tag data from the target propagation path.

[0007] According to another aspect of the present invention, a non-volatile storage medium is also provided, the non-volatile storage medium storing a plurality of instructions adapted for loading by a processor and executing any one of the multi-node-based tag data propagation processing methods described herein.

[0008] According to another aspect of the present invention, an electronic device is also provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement any of the multi-node-based tag data propagation processing methods described above.

[0009] According to another aspect of the present invention, a computer program product is also provided, including a computer program that, when executed by a processor, implements the steps of any of the multi-node-based tag data propagation processing methods described in the present invention.

[0010] In this embodiment of the invention, target tag data is acquired by sequentially processing original tag data through multiple processing nodes. The target tag data carries behavioral fingerprints corresponding to each of the processing nodes, which indicate the behavior of the corresponding processing node during tag data propagation and processing. When a leaked tag sample matching the target tag data is detected in the external environment, multiple candidate behavioral fingerprints corresponding to the leaked tag sample are determined. Based on these candidate behavioral fingerprints, multiple candidate processing nodes are matched from a node behavioral fingerprint rule base, which pre-stores the behavior of each compliant processing node. The system generates behavioral fingerprint templates from historical propagation events of processing nodes; performs path inversion based on multiple candidate processing nodes to obtain the target propagation path of the leaked label sample; identifies the leaked processing nodes of the target label data from the target propagation path, and achieves the goal of embedding event-type behavioral fingerprints into the data label ontology node by node, and performing link inversion based on rule base and topological constraints to accurately locate the source and responsible node of data label leakage. This achieves the technical effect of automated and high-precision location of the source and responsible node of data label leakage, and solves the technical problem in related technologies where leakage cannot be traced due to the lack of behavioral trace records in the flow of data labels through multiple processing nodes. Attached Figure Description

[0011] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0012] Figure 1 This is a flowchart of a multi-node-based tag data propagation processing method according to an embodiment of the present invention;

[0013] Figure 2 This is a schematic diagram of the structure of an optional fingerprint generation module according to an embodiment of the present invention;

[0014] Figure 3This is a schematic diagram of the structure of an optional leakage forensics and link inversion module according to an embodiment of the present invention;

[0015] Figure 4 This is a flowchart of an optional multi-node-based tag data propagation processing method according to an embodiment of the present invention;

[0016] Figure 5 This is a schematic diagram of a multi-node-based tag data propagation and processing device according to an embodiment of the present invention;

[0017] Figure 6 This is a schematic diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0018] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0019] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0020] According to an embodiment of the present invention, a method embodiment for multi-node tag data propagation processing is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0021] Figure 1 This is a flowchart of a multi-node-based tag data propagation processing method according to an embodiment of the present invention, such as... Figure 1 As shown, the method includes the following steps:

[0022] Step S102: Obtain target label data. The target label data is obtained by processing the original label data sequentially by multiple processing nodes. The target label data carries the behavioral fingerprints of each of the multiple processing nodes. The behavioral fingerprints are used to indicate the behavioral information of the corresponding processing nodes in the process of label data propagation and processing.

[0023] In this step, the target label data can be, but is not limited to, AI training data labels. Multiple processing nodes can include, but are not limited to, cleaning nodes, review nodes, training nodes, and distribution nodes. During the cross-node flow, each processing node, after completing its data processing task, generates a behavioral fingerprint in a structured form, based on its role in this propagation event (e.g., "cleaning node," "review node"), actions performed (e.g., "field normalization," "manual review"), propagation sequence number, time window identifier, and task context parameters. This fingerprint is then embedded into the reserved fields of the label data. Ultimately, the target label data becomes a complete data carrier carrying the behavioral fingerprints of all processing nodes; its essence is the ontology of the behavioral log of the label data propagation process.

[0024] In one optional embodiment, obtaining target label data includes: using the original label data as the current label data; sequentially using multiple processing nodes as current processing nodes; processing the current label data using the current processing node to obtain processed label data, wherein the processed label data carries a behavioral fingerprint corresponding to the current processing node, and the behavioral fingerprint corresponding to the current processing node includes at least: the role identifier of the current processing node, the type of action performed, the sequence position in the propagation path, the time window identifier, and the task context parameters; using the processed label data as the new current label data, and repeating the above operation until the last processing node among the multiple processing nodes is reached; and using the processed label data corresponding to the last processing node as the target label data.

[0025] In this embodiment, the process of acquiring target tag data is achieved through a hop-by-hop enhancement mechanism in the multi-node propagation chain: starting with the original tag data, each compliant processing node is sequentially taken as the current processing node. After a node completes its tag processing task (such as cleaning, mapping, review, or distribution), a unique behavioral fingerprint binding the node's operation behavior is generated based on its role identifier in this propagation event, the type of action performed, the propagation sequence number in the chain, the time window identifier, and the task context parameters. This fingerprint is then embedded in the reserved extended fields of the tag data in a controlled manner without changing its original business semantics. The processed tag data is then used as the input for the next round of processing and continues to be passed to the next node. This process iterates hop-by-hop according to the propagation order, ensuring that the behavioral traces of each participating node are recorded in an orderly manner without omissions. When the tag data finally reaches the end node of the propagation chain, the set of behavioral fingerprints it carries has fully reflected all the processing nodes it has experienced and their operational characteristics. At this point, the tag data is the target tag data—essentially an extractable, verifiable, and self-contained digital archive of propagation behavior. This mechanism transforms tags from passive transmission carriers into active evidence carriers that dynamically record the history of dissemination, providing a structured, standardized, and machine-identifiable raw data foundation for tracing behavior in subsequent leaks, and ensuring the integrity and repeatability of the tracing process.

[0026] In one optional embodiment, the current processing node processes the current tag data to obtain processed tag data, including: processing the current tag data using the current processing node to obtain intermediate tag data; determining the fingerprint detectability and tag semantic deviation corresponding to the current tag data, wherein the fingerprint detectability is used to quantify the residual integrity of the preceding behavioral fingerprint in the current tag data during the propagation process, and the tag semantic deviation is used to indicate the degree of content difference between the intermediate tag data and the current tag data in terms of business semantic expression; when the fingerprint detectability is greater than or equal to a preset minimum detectable threshold, and the tag semantic deviation is less than or equal to a preset deviation threshold, embedding the behavioral fingerprint corresponding to the current processing node into a specified area of ​​the intermediate tag data to obtain processed tag data.

[0027] In this embodiment, content differences may include, but are not limited to, changes in field values, structural reconstruction, format conversion, or semantic mapping relationships. When processing the current tag data using the current processing node, behavioral fingerprints are not embedded unconditionally. Instead, the current state of the tag is first subjected to dual compliance verification: on the one hand, the residual integrity of the preceding behavioral fingerprints already embedded in the current tag data is calculated, i.e., fingerprint detectability, to assess whether historical propagation traces can still be reliably extracted; on the other hand, the degree of content difference between the intermediate tag data and the original current tag data in terms of business semantic expression is assessed, i.e., tag semantic deviation, to determine whether operations such as format conversion, field mapping, and value domain redefinition have caused unacceptable distortion of the core semantics of the tag. Only when the fingerprint detectability is not lower than a preset minimum detectable threshold, ensuring that the preceding behavioral evidence has not been destroyed, and the tag semantic deviation does not exceed a preset deviation threshold, ensuring that the tag still meets the normal usage requirements of the downstream system, is it allowed to embed the behavioral fingerprint of the current node into the specified extended area of ​​the intermediate tag data to generate processed tag data. This mechanism, by introducing dual constraints of "detectability" and "semantic fidelity," achieves intelligent decision-making through behavioral trace embedding. This prevents the source chain from breaking due to the loss of previous traces and avoids damaging the usability of the tag business due to excessive modification. Thus, it maintains a balance between traceability and usability in the dynamic process of tag data flow, providing a key guarantee for building a stable, reliable, and engineering-implementable tag dissemination and evidence collection system.

[0028] Optionally, in this embodiment, the behavioral fingerprint is not generated based on the inherent hardware parameters, network traffic characteristics, or static identity attributes of the node device. Instead, it is generated based on the processing node's role information, processing action type, link location information, time window identifier, and task context parameters in the current tag propagation event. For any propagation event, it can be described as an event vector composed of node role, action type, propagation sequence number, time slice, and context set, and the corresponding event-type behavioral fingerprint is obtained through a preset mapping function. Its expression can be written as: ;in, This indicates the role of the current processing node in the propagation chain. Indicates the type of action being processed. Indicates the propagation location (i.e., link location information). Indicates the time window identifier. Indicates task context parameters, This represents the behavioral fingerprint generation function. The generated behavioral fingerprint reflects the processing traces performed by this processing node on the tag in the current propagation event, rather than the static identity of this processing node itself. Optionally, this fingerprint generation function may, but is not limited to, employ a hash-based variable-length encoding function (such as SHA-3 combined with role-action-time sequence fields for concatenation hashing), a lightweight encryption-based uniqueness mapping (such as key-driven encoding of structured event vectors using AES-CTR mode), or a semantic embedding-based vector quantization method (such as mapping roles, actions, and context to low-dimensional dense vectors and quantizing them into fixed-length fingerprint strings through a pre-trained lightweight graph neural network), while ensuring irreversibility and collision resistance, and meeting the requirements of small embedding space, low computational overhead, and compatibility with existing tag formats. Preferably, but not limited to, this function may also support configurable seed keys and version identifiers, enabling different fingerprint generation strategies to be used for propagation links with different security levels, achieving flexible adaptation and security hierarchical control of the fingerprint generation process.

[0029] At the tag generation end or initial registration node, a unique identifier is first established for the tag data object, and embeddable regions, embedding versions, detection thresholds, and compatibility constraint parameters are configured as the raw tag data. When the raw tag data enters the propagation chain, each intermediate processing node, while performing operations such as receiving, processing, mapping, reviewing, forwarding, synchronizing, and distributing, parses the current propagation event and generates a behavioral fingerprint corresponding to that processing node. This behavioral fingerprint is then written into the controllable area of ​​the tag object according to predetermined rules. The writing method can employ redundant bit encoding, index mapping, auxiliary feature writing, controlled perturbation encoding, or other methods that do not significantly disrupt the tag's interpretable functionality. For example, for the first... The tag state after fingerprint embedding can be represented as follows: ;in, This is for the pre-embedded tag state (i.e., the processed tag data). This is the behavior fingerprint corresponding to the current tag node. This refers to the position or channel parameters corresponding to the fingerprint embedding in this document. This represents the embedding mapping function. This embedding mapping function... It is possible, but not limited to, using an extensible field appending mechanism based on structured tag formats (such as adding specified fields to JSON tags and accumulating historical fingerprints in array form), writing bitmasks into reserved redundant bit fields in binary tags (such as embedding fingerprint encoding by XOR overlay using unused or reserved metadata bit fields), or inserting hidden semantically irrelevant comments / attributes into text-type tags (such as CSV, XML, etc.) to achieve interference-free embedding; in systems that support structured data models, metadata channel separation technology can also be used to write behavioral fingerprints into a dedicated extension area decoupled from the main business fields (such as specified extension columns or custom attribute fields in the database). The embedding process strictly follows the preset channel allocation strategy. This ensures that fingerprint writing on different nodes does not overlap or overwrite, and compatibility management is achieved through version numbers. It can also be configured with built-in conflict detection and adaptive compression logic. When the embedding space is close to saturation, it automatically triggers fingerprint merging or hash digest strategies to maintain the tag size controllable while ensuring the extractability of previous traces. This enables multi-hop, traceable, and low-disturbance dynamic behavior imprint accumulation without interfering with the original business semantics of the tag.

[0030] To ensure that tags retain traces (i.e., behavioral fingerprints) left by multiple processing nodes after multi-hop propagation, this embodiment implements a fingerprint state management mechanism. This mechanism maintains the embedding version, channel occupancy, previous trace boundaries, and compatibility status, enabling subsequent processing nodes to read the embedding state in the current tag data before writing new traces (i.e., behavioral fingerprints), thus completing incremental writing without compromising the detectability of previous traces. The condition for pre-order trace retention can be expressed as: ;in, This represents the fingerprint detectability metric function, which can be understood as a fingerprint detectability metric function based on field matching rate, that is, by extracting the preceding behavior fingerprint embedded in the current tag data. The encoded structure is compared field by field with the original template to calculate the semantic matching rate of key fields such as role, action, time window, and propagation sequence number. The recoverability is comprehensively evaluated by combining the integrity verification of the embedding position (such as whether redundant bits are covered, whether the index offset is abnormal, and whether the additional comments are truncated). This indicates a preset minimum detectable threshold. Meanwhile, to ensure that the processed tag data obtained after embedding the behavioral fingerprint still meets the requirements for normal business use, this embodiment also requires that the semantic perturbation of the tags does not exceed a preset range, namely: ;in, Indicates the semantic deviation between the preceding and following tags. This represents the maximum perturbation threshold allowed (i.e., the preset deviation threshold). Through these constraints, hop-by-hop trace accumulation can be achieved while maintaining business availability.

[0031] Step S104: If a leaked label sample matching the target label data is detected in the external environment, determine multiple candidate behavioral fingerprints corresponding to the leaked label sample.

[0032] In this step, when a leaked sample is discovered, its data structure is analyzed to extract residual, identifiable behavioral fingerprint fragments. These fingerprints are the original evidence for tracing the propagation path.

[0033] Step S106: Based on multiple candidate behavioral fingerprints, match multiple candidate processing nodes from the node behavioral fingerprint rule base. The node behavioral fingerprint rule base pre-stores behavioral fingerprint templates generated by each compliant processing node in historical propagation events.

[0034] In this step, the extracted candidate fingerprints are compared with the compliance node behavior fingerprint templates that have been pre-established and stored in the fingerprint rule base. The system can identify the set of compliance nodes (i.e., multiple candidate processing nodes) that have participated in the propagation of the tag by matching fields (such as roles, actions, time windows, etc.), thereby realizing a traceable mapping from fingerprints to processing nodes.

[0035] Optionally, the node behavior fingerprint rule base can be uniformly generated and distributed to each processing node by the trusted management platform during the tag registration phase, and its content cannot be tampered with by unauthorized nodes. Each behavior fingerprint template is associated with a node identifier, node role, allowed action type, and corresponding spatiotemporal context features; the spatiotemporal context features include: the sequence position of the propagation event in the link, the time window of the batch to which it belongs, and the project identifier to which the task belongs.

[0036] Step S108: Path inversion is performed based on multiple candidate processing nodes to obtain the target propagation path of the leaked label sample.

[0037] In this step, based on the embedding order and logical association of each candidate processing node in the tag, their sequential relationship in the propagation chain is reconstructed, restoring the complete node access sequence of the tag from its initial generation to before leakage.

[0038] In one optional embodiment, path inversion is performed based on multiple candidate processing nodes to obtain the target propagation path of the leaked label sample, including: performing path inversion based on multiple candidate processing nodes to obtain multiple candidate propagation paths; determining the path score corresponding to each of the multiple candidate propagation paths based on the fingerprint matching strength score, topology compliance score, temporal consistency score, and path continuity score corresponding to each of the multiple candidate propagation paths, wherein the fingerprint matching strength score is used to indicate the comprehensive content matching degree between the behavioral fingerprint corresponding to each processing node in the corresponding candidate propagation path and the behavioral fingerprint extracted from the leaked label sample in a predetermined field; the topology compliance score is used to indicate the matching degree between the corresponding candidate propagation path and a preset compliance propagation topology graph; the temporal consistency score is used to indicate the matching degree between the time window identifier of the behavioral fingerprint corresponding to each processing node in the corresponding candidate propagation path and a preset propagation temporal constraint; the path continuity score is used to indicate whether there is a directed edge in the compliance propagation topology graph between adjacent processing nodes in the candidate propagation path; and determining the target propagation path from the multiple candidate propagation paths according to the path scores corresponding to each of the multiple candidate propagation paths.

[0039] In this embodiment, the predetermined fields include at least role identifier, action type, and task context parameters. The overall content matching degree can be obtained by averaging the node fingerprint matching degrees of each node on the corresponding candidate propagation path. The temporal consistency score is used to indicate the matching degree between the time window identifier of the behavior fingerprint corresponding to each processing node in the corresponding candidate propagation path and the preset propagation temporal constraints. This matching degree can be measured by the average of the matching degrees corresponding to each processing node. When performing path inversion based on multiple candidate processing nodes, the path is not simply pieced together according to the order of fingerprint appearance. Instead, a multi-dimensional scoring mechanism is constructed to comprehensively evaluate all possible propagation paths: First, multiple candidate propagation paths are generated, each composed of candidate processing nodes combined in different temporal sequences. Then, for each candidate propagation path, its fingerprint matching strength score, topology compliance score, temporal consistency score, and path continuity score are calculated. Among them, the fingerprint matching strength score measures the semantic consistency and coding similarity between the behavioral fingerprints of each node in the path and the fingerprints extracted from the leaked sample in key fields such as roles, actions, and time windows. The topology compliance score reflects whether the overall structure of the path conforms to the preset compliant propagation topology graph, i.e., whether it is only allowed to flow from predefined links such as "annotation → cleaning → review → training". The temporal consistency score is used to determine whether the time window identifiers carried by the behavioral fingerprints of each processing node in the path meet the sequential constraints agreed upon by the business, such as "review node" must precede "quality inspection node". The path continuity score verifies whether there are directed edges defined in the compliant propagation topology graph between any adjacent nodes in the path, preventing cross-level jumps or non-compliant direct connections. Ultimately, a path score is obtained for each candidate propagation path based on a comprehensive evaluation of the four types of scores, and the path with the highest score is selected as the target propagation path. This mechanism significantly improves the accuracy and anti-interference capability of path reconstruction by integrating behavioral evidence, structural constraints, temporal logic, and topological association for verification. It ensures that even in the presence of disturbances such as missing fingerprints, temporal misalignment, or node forgery, it can still output a unique and credible propagation link that best conforms to business logic and historical behavior patterns, providing a solid and auditable reasoning basis for subsequent responsibility determination.

[0040] Optionally, when tag data (such as target tag data) is leaked and discovered in the external environment, the leaked tag samples are first analyzed to extract a composite trace set. Then, candidate behavioral fingerprint components are obtained through a multi-layer separation mechanism and matched with a behavioral fingerprint rule base to obtain a set of candidate processing nodes that may have participated in the tag's propagation (this set includes multiple candidate processing nodes). Further, combining the compliance propagation topology, node role constraints, and timing rules (i.e., propagation timing constraints increasing in propagation sequence number), path reconstruction is performed on the candidate processing node set to recover the propagation path the tag may have experienced. Let the compliance propagation topology be... The candidate path can then be obtained using the path scoring function: ;in, This represents the set of candidate traces extracted from the leaked sample (i.e., the set of candidate propagation paths, which includes multiple candidate propagation paths). This represents a path scoring function that comprehensively considers the degree to which fingerprint matching strength score, path continuity score (i.e., historical trace integrity), role action consistency score (e.g., temporal consistency score), and topological constraints (e.g., topological compliance score) are satisfied. This formula is the core mathematical expression of link inversion, and its physical meaning is: within the path space defined by the compliance propagation topology graph G, find a set of candidate behavioral fingerprints that best explains the leaked samples. transmission path This path is the optimal path that maximizes the overall score S.

[0041] In one optional embodiment, the path score for each of the multiple candidate propagation paths is determined based on their respective fingerprint matching strength score, topology compliance score, temporal consistency score, and path continuity score. This includes: determining the weight values ​​for each of the fingerprint matching strength score, topology compliance score, temporal consistency score, and path continuity score; and performing a weighted summation operation based on the fingerprint matching strength score, topology compliance score, temporal consistency score, path continuity score, and their respective weight values ​​to obtain the path score for each of the multiple candidate propagation paths.

[0042] In this embodiment, when determining the path score based on the fingerprint matching strength score, topological compliance score, temporal consistency score, and path continuity score corresponding to multiple candidate propagation paths, the weight values ​​of the four types of scores can be dynamically configured according to the credibility and priority of each dimension in the actual business scenario. Among them, the fingerprint matching strength score has a higher weight because it directly reflects the original reliability of the evidence; the topological compliance score is second, used to constrain the business rationality of the propagation path; and the temporal consistency score and path continuity score serve as key support for logical consistency verification. The four scores of each candidate propagation path are multiplied by their corresponding preset weight values ​​and then weighted and summed to obtain the comprehensive path score of the path, thereby achieving a quantitative fusion of the four dimensions of "evidence strength," "structural compliance," "temporal rationality," and "topological connectivity." This weighting mechanism makes the path evaluation flexible and adjustable. For example, in the medical data scenario, the temporal consistency weight can be increased to meet compliance audit requirements, and in the industrial data scenario, topological compliance can be strengthened to adapt to fixed process flows. This weighted scoring method can accurately identify the optimal path from multiple candidate paths that best reflects real communication behavior, aligns most closely with business rules, and is supported by the best evidence. This significantly improves the accuracy and interpretability of path inversion, providing a scientific and quantifiable basis for liability determination.

[0043] Step S110: Identify the leakage processing node of the target tag data from the target propagation path.

[0044] In this step, by analyzing the anomalies in node behavior patterns within the reconstructed propagation path (such as abnormal outgoing events from end nodes or disordered timing), the processing node most likely to have committed unauthorized propagation behavior is located, thereby achieving precise delineation of responsibility for the leak. This process does not rely on external logs, but only on behavioral evidence carried by the tag itself to complete closed-loop tracing.

[0045] In one optional embodiment, identifying leakage processing nodes of target tag data from the target propagation path includes: determining the node fingerprint matching strength, abnormal branch contribution, and link constraint violation degree corresponding to each processing node included in the target propagation path, wherein the node fingerprint matching strength is used to indicate the content matching degree between the behavioral fingerprint of the corresponding processing node and the behavioral fingerprint extracted from the leaked tag sample in a predetermined field; the abnormal branch contribution degree is used to indicate whether the corresponding processing node is the first processing node in the target propagation path that does not exist in the preset compliance propagation topology; the link constraint violation degree is used to indicate whether the processing of the tag data by the corresponding processing node destroys the integrity of the preceding behavioral fingerprint in the target propagation path; and determining the leakage processing node from the processing nodes included in the target propagation path based on the node fingerprint matching strength, abnormal branch contribution, and link constraint violation degree corresponding to each processing node included in the target propagation path.

[0046] In this embodiment, the predetermined fields include at least role identifier, action type, and task context parameters; the preceding behavioral fingerprint is the behavioral fingerprint obtained based on the processing nodes preceding the corresponding processing node in the propagation path. When identifying leaked processing nodes from the target propagation path, the node at the end of the path is not simply identified as the responsible party. Instead, the abnormal behavior of each node is comprehensively evaluated through three risk dimensions: First, the node fingerprint matching strength of each processing node is calculated to measure the semantic consistency between the behavioral fingerprint embedded in the label and the fingerprint extracted from the leaked sample in key fields such as role, action, and time window. The lower the matching degree, the more likely it is to be a forged or tampered node. Second, the contribution of abnormal branches is identified, that is, whether the node is the first node in the path to appear outside the compliant propagation topology - this node can be regarded as the "breakthrough point" where the propagation link deviates from the preset trajectory for the first time, and has the highest potential leakage risk. At the same time, the degree of link constraint violation is evaluated to analyze whether the node has destroyed the detectability of the behavioral fingerprint embedded in the preceding node through operations such as format rewriting, field overwriting, or metadata clearing during the processing, resulting in the break of the traceability evidence chain. Based on the above three indicators, each processing node is evaluated, and nodes exhibiting a combination of "weak fingerprint matching + first violation of regulations + destruction of prior traces" are prioritized as leakage processing nodes. This mechanism can accurately locate key nodes in the propagation path that actually carry out unauthorized dissemination or evidence erasure, upgrading liability determination from "location inference" to intelligent judgment driven by "behavioral evidence," significantly improving the accuracy and legal admissibility of evidence conclusions.

[0047] In one optional embodiment, determining the leakage handling node from the processing nodes included in the target propagation path based on the node fingerprint matching strength, abnormal branch contribution, and link constraint violation degree corresponding to each processing node included in the target propagation path includes: determining the weight values ​​corresponding to the node fingerprint matching strength, abnormal branch contribution, and link constraint violation degree respectively; performing a weighted summation operation based on the node fingerprint matching strength, abnormal branch contribution, and link constraint violation degree corresponding to each processing node included in the target propagation path, as well as the weight values ​​corresponding to the node fingerprint matching strength, abnormal branch contribution, and link constraint violation degree respectively, to obtain the responsibility score corresponding to each processing node included in the target propagation path; and determining the leakage handling node from the processing nodes included in the target propagation path based on the responsibility scores corresponding to each processing node included in the target propagation path.

[0048] In this embodiment, when determining the leakage processing node based on the node fingerprint matching strength, abnormal branch contribution, and link constraint violation degree of each processing node in the target propagation path, a single dimension or threshold judgment is not used. Instead, a dynamic weighted responsibility assessment model is constructed. For example, for each indicator, a corresponding weight value is set according to the security level and evidence collection priority of the business scenario. Among them, the node fingerprint matching strength has the highest weight because it directly reflects the authenticity of the association between the node's behavior and the leaked sample evidence; the abnormal branch contribution is the second highest, used to identify the "key breakthrough point" that first breaks through the compliance topology in the propagation path, providing a logical anchor point for the source of the leak; the link constraint violation degree weight reflects whether the node actively destroys the traces of previous behaviors, which is a high-risk behavior of covering up responsibility and interfering with tracing. The three indicators of each processing node are multiplied by their corresponding weights and then weighted and summed to generate the comprehensive responsibility score of the node. This scoring system not only quantifies the comprehensive risk of nodes across three dimensions—evidence consistency, path anomaly, and destructive behavior—but also possesses adjustability. For example, in financial data scenarios, the weight of link constraint violation can be increased to strictly control evidence tampering, while in medical data scenarios, the contribution of abnormal branches can be strengthened to prevent unauthorized distribution. Ultimately, the node with the highest responsibility score is selected from the target propagation path as the leakage handling node, achieving a precise leap from "behavioral trace analysis" to "quantitative responsibility judgment."

[0049] Optionally, during the responsibility determination phase, a responsibility score is calculated for each candidate processing node based on the strength of its fingerprint residue, the contribution of abnormal branches, the degree of link interruption, and the degree of topology deviation (i.e., the degree of link constraint violation). A candidate processing node can be defined. The responsibility score is obtained in the following way:

[0050] ;

[0051] in, Indicates the node fingerprint matching strength. Indicates the contribution of abnormal branches. Indicates the degree of link constraint violation. These are the corresponding weight parameters. Based on the responsibility score, suspected responsibility nodes, high-risk responsibility sections, and evidence collection conclusions are output. The abnormal branch contribution B(v) characterizes whether candidate node v is the first access point for the label to spread from the compliant propagation path to the unauthorized environment. Its quantification is as follows: if v is the first non-compliant node that appears in the extracted fingerprint and does not belong to the compliant topology G, then B(v) = 1.0; otherwise, it is 0 or decreases according to its position in the path. The link constraint violation degree C(v) characterizes whether candidate node v has damaged the integrity of the preceding behavioral fingerprint in the propagation chain. Its quantification may be, but is not limited to, as follows: if v is the first node to cause the compliant fingerprint to be missing, then C(v) = 1.0; if v is located at a subsequent position of the missing fingerprint, then it is assigned a value decreasing according to its relative position in the path to reflect the temporal responsibility for evidence destruction. B(v) and C(v) quantify the responsibility of nodes for their subjective malicious behavior in the leakage incident from the two dimensions of "external transmission" and "internal destruction," respectively. This upgrades the determination of responsibility from "passive participation" to "active violation," which is significantly different from existing technologies that are based solely on existence judgment.

[0052] Through the above steps S102 to S110, event-type behavioral fingerprints can be embedded node by node in the data tag ontology, and link inversion can be performed based on the rule base and topology constraints to achieve the purpose of accurately locating the source and responsible node of data tag leakage. This achieves the technical effect of automated and high-precision location of the source and responsible node of data tag leakage, thereby solving the technical problem in related technologies that data tags cannot be traced due to the lack of behavioral trace records during the flow of data tags through multiple processing nodes.

[0053] It should be noted that the method in this embodiment supports structured analysis of suspected leaked data samples in uncontrolled external collaborative environments through automated scanning, data probing, or third-party reports. This allows for the extraction of behavioral fingerprint embedding fields and semantic matching and source identification based on a pre-built node behavioral fingerprint rule base. This enables the automatic discovery and tracing of tagged objects that have deviated from authorized paths. This mechanism overcomes the limitations of related technologies that rely on access logs or system auditing, freeing the discovery of data leaks from internal system permissions or log integrity, and significantly improving security response capabilities in cross-domain scenarios.

[0054] With the development of AI training data flow, cross-institutional data sharing, industrial internet collaborative processing, medical information exchange, and multi-level data governance systems, the role of data tagging in the data processing chain is constantly increasing. Data tags are no longer just auxiliary descriptive information, but are gradually becoming important bases influencing data interpretation, access control logic, model training quality, business routing strategies, and subsequent decision-making results. In data environments involving multiple nodes, platforms, and systems, data tags typically undergo multiple processing stages such as generation, cleaning, review, mapping, synchronization, forwarding, aggregation, and redistribution. They are characterized by frequent dissemination, long chains, numerous participating nodes, convenient replication and derivation, and unclear responsibility boundaries. Once a tag is leaked, illegally spread, or leaked outside the chain during the flow process, it will not only cause data security risks, but also affect the credibility of training samples, the accuracy of status judgment, the integrity of access boundaries, and subsequent auditing and compliance handling.

[0055] Data security technologies in related fields mainly revolve around access control, identity authentication, encrypted transmission, digital signatures, log auditing, watermarking, and data traceability. These solutions can, to some extent, prevent unauthorized access, reduce the risk of direct content tampering, record platform operation processes, or prove the original source. However, they still have significant shortcomings in the evidence collection and accountability for data tag leaks under multi-node propagation conditions. First, access control, authentication, and encryption mechanisms primarily address issues such as "whether access is allowed," "whether transmission is secure," and "whether access is compliant." After a leak has occurred, it is often difficult to determine which intermediate nodes the tag passed through, at which hop the abnormal propagation occurred, and which node is most likely to bear responsibility. Second, while log auditing in related technologies can record system-side operational behavior, log evidence relies on the credibility of the nodes themselves and the ability to interoperate logs across platforms. In scenarios involving cross-domain transfers, fragmented links, offline copying, and secondary distribution, problems such as discontinuous evidence, inconsistent records, and difficulty in closing the loop on liability boundaries can easily arise. Third, watermarking and fingerprinting technologies in related fields are mostly focused on images, audio and video, documents, or database records. They are mainly used to prove ownership, confirm the original source, or prevent piracy. They are difficult to directly adapt to data carriers such as tagged objects, which are small in size, compact in structure, short in expression, and frequently re-reconstructed. They are even more difficult to continuously retain node-by-node link evidence under multi-hop propagation conditions.

[0056] Meanwhile, some existing "fingerprint"-related technologies mainly focus on device detection, asset identification, terminal access control, and identity authentication. Their fingerprint generation methods are typically based on device hardware parameters, network protocol characteristics, communication behavior characteristics, or terminal static attributes, used to identify device types, determine asset ownership, or complete access authentication. The technical focus of these solutions is identifying "what the node is," resulting in a static identity-based fingerprint. However, for forensic investigation of leaked tags, the key lies in depicting "what the node did to the tag during the current propagation process," i.e., forming behavioral traces bound to the propagation event. Device fingerprints, asset identification fingerprints, and access authentication fingerprints in these technologies cannot be directly used to recover the propagation behavior sequence of the tag, nor can they effectively support link-level liability determination.

[0057] Furthermore, tags often undergo field mapping, format conversion, rule changes, batch updates, and permission derivations during their transmission, potentially altering their external form. However, the propagation behavior itself still needs to be traced. Relying solely on external logs or single, fixed-source tags makes it difficult to establish a stable, detectable, and traceable chain of evidence under complex transmission conditions, leading to untraceable leaks of tag data. Therefore, a technical solution is urgently needed to ensure that each propagation and processing of a tag leaves a behavioral trace of the corresponding node. After a leak, the extraction, separation, and analysis of these residual traces can reconstruct the propagation path the tag has traversed, identify abnormal diffusion segments, and pinpoint suspected responsible nodes, thereby constructing a traceable and secure transmission and evidence collection system for data tag identification.

[0058] To address the aforementioned problems, based on the above embodiments and optional embodiments, this invention proposes an optional implementation method. This embodiment proposes a multi-node-based tag data propagation processing scheme, which can be understood as a node-by-node behavioral fingerprint embedding and link inversion scheme for forensic analysis of data tag identification leakage. The core idea of ​​this scheme is not to generate static identity fingerprints for the device, terminal, or asset itself, but to generate event-type behavioral fingerprints for each processing event of the tag in the propagation link. These behavioral fingerprints are then embedded hop-by-hop into the tag data object in a controlled, low-disturbance, and cumulative manner, so that the tag data forms a detectable, separable, and invertible combination of link traces after flowing through multiple processing nodes. When a leaked sample, an abnormally spreading sample, or an unauthorized leaked tag object (i.e., a leaked tag sample) is discovered externally, the residual traces in the leaked tag sample are extracted, separated, matched, and the path is reconstructed to output candidate propagation paths, suspected responsible processing nodes, and responsibility scoring results.

[0059] The system in this embodiment includes a tag registration module, a propagation event analysis module, a behavioral fingerprint generation module, a node-by-node fingerprint embedding module, a fingerprint status management module, a leakage sample extraction module, a multi-layer fingerprint separation module, a link inversion module, a responsibility determination module, and a report output module. These modules work collaboratively through standardized interfaces to form a complete closed loop from initial tag registration and hop-by-hop trace embedding to post-leakage evidence collection and responsibility output. Overall, this embodiment provides a technical solution different from static fingerprint routes on devices, enabling the tag object itself to continuously carry node-by-node propagation behavioral evidence, thereby achieving link-level leakage evidence collection and responsibility inversion based on data tag identification.

[0060] Figure 2 This is a schematic diagram of the structure of an optional fingerprint generation module according to an embodiment of the present invention, such as... Figure 2 As shown, in this embodiment, the behavior fingerprint generation module includes a role extraction unit, an action parsing unit, a location information acquisition unit, a time window acquisition unit, a context fusion unit, and an encoding output unit. After the tag data enters a processing node, the system first reads the context information of the current propagation event, and the role extraction unit determines the role of the processing node in the current link, such as a cleaning node, review node, training node, or distribution node. The action parsing unit identifies the specific operation performed on the tag data, such as field normalization, manual review, quality confirmation, synchronous forwarding, or external distribution. The location information acquisition unit extracts the sequential position of the current propagation event in the overall link and its association with upstream and downstream processing nodes. The time window acquisition unit acquires the batch, time window identifier, or task window information to which the event belongs. The context fusion unit combines the above information, and the encoding output unit outputs an event-type behavior fingerprint according to a preset mapping rule. This behavior fingerprint describes the operational traces of the corresponding processing node in this propagation event, rather than the static identity characteristics of the node device, thus distinguishing it from device fingerprints or asset identification fingerprints in related technologies.

[0061] In this embodiment, taking the flow of AI training data labels as an example, after the AI ​​training data labels are generated on the labeling platform, the label registration module first establishes a unique identifier and configures the embeddable region, embedding version, and threshold parameters. The result is used as the original data label. The original data label then enters the data cleaning platform. After receiving the original data label, the cleaning platform parses the current propagation event, determines that the role of the processing node is a cleaning node, the current action type is field normalization processing, the propagation position is the second hop, the time window identifier is the window corresponding to the current batch, and the task context parameters include information such as project number, data batch, and rule version. The system inputs the above parameters into the behavior fingerprint generation module to form a behavior fingerprint bound to the current propagation event, and writes it into the controllable region of the label data object through the node-by-node fingerprint embedding module (the operable, dynamically managed storage space actually used by the current node to write the behavior fingerprint during the propagation process). During the writing process, the fingerprint status management module synchronously records the position, version, and compatibility status occupied by this behavior fingerprint embedding to ensure that subsequent processing nodes will not overwrite the current trace when continuing to write.

[0062] Figure 3 This is a schematic diagram of the structure of an optional leakage forensics and link inversion module according to an embodiment of the present invention, as shown below. Figure 3 As shown, this module includes a trace extraction unit, a trace separation unit, a node matching unit, a path reconstruction unit, and a responsibility assessment unit, and is connected to the node behavior fingerprint rule base and the compliance propagation topology constraint module. In this embodiment, the tag continues to flow from the cleaning platform to the review platform, the quality inspection platform, and the training platform. Each processing node parses the current propagation event according to the same logic and generates its own event-type behavior fingerprint, which is then superimposed and written to the tag in a controlled manner, so that the tag carries a composite link trace formed by multiple nodes after the flow is completed.

[0063] When a leaked tag sample is subsequently discovered in an external collaborative environment, the system sends the leaked sample to the leakage forensics and link inversion module. The trace extraction unit first extracts a composite trace representation from the sample, and the trace separation unit separates the extracted results, identifying several candidate behavioral trace components (i.e., candidate behavioral fingerprints). Subsequently, the node matching unit matches the candidate behavioral fingerprints according to the node behavioral fingerprint rule base, forming a set of nodes suspected of participating in propagation (i.e., a set of candidate propagation nodes). The path reconstruction unit further combines compliant propagation topology, role constraints, and timing rules to recover the propagation path most likely to be experienced by the tag. If the reconstruction results show that the tag should have flowed along the compliant path of "labeling-cleaning-review-quality inspection-training," but an additional distribution path outside the compliant topology appears after the training node in the actual sample, the system determines that there is an abnormal propagation risk after that training node. The responsibility assessment unit calculates a responsibility score based on the node fingerprint matching strength, abnormal branch contribution, and link constraint violation degree of each processing node, and outputs suspected responsible nodes and high-risk responsibility sections.

[0064] Figure 4 This is a flowchart of an optional multi-node-based tag data propagation processing method according to an embodiment of the present invention, such as... Figure 4 As shown, the method includes steps such as tag registration, propagation event analysis, behavioral fingerprint generation, incremental embedding, multi-hop accumulation, abnormal sample discovery, trace extraction and separation, link inversion and responsibility determination, and report output. In a normal link, tags are processed sequentially by multiple processing nodes, and behavioral traces are accumulated hop by hop. After an abnormal event occurs, the system analyzes and collects evidence from the residual traces in the leaked tag samples to reconstruct the possible propagation behavior sequence. Finally, the report output module generates evidence collection results containing the tag's unique identifier, candidate propagation paths, suspected responsible nodes, responsibility scores, and evidence summaries, which are used for subsequent responsibility determination, authorization rectification, and audit review. The system corresponding to this embodiment includes a tag registration module, a propagation event analysis module, a behavioral fingerprint generation module, a node-by-node fingerprint embedding module, a fingerprint status management module, a leaked sample extraction module, a multi-layer fingerprint separation module, a link inversion module, a responsibility determination module, and a report output module. Each module works collaboratively through standardized interfaces to form a complete closed loop from initial tag registration and hop-by-hop trace embedding to post-leak evidence collection and responsibility output. Overall, this embodiment provides a technical solution that differs from the static fingerprinting approach of devices, enabling the tag object itself to continuously carry evidence of node-by-node propagation behavior, thereby achieving link-level leakage evidence collection and accountability reversal oriented towards data tag identification.

[0065] As can be seen from the above implementation methods, this embodiment does not identify the device or classify static assets. Instead, it generates an event-type fingerprint for each node processing behavior during tag propagation and attaches this fingerprint hop-by-hop to the tag object. This allows the propagation chain to be reconstructed and responsibility traced based on the residual traces carried by the tag itself after a leak occurs. This solution is applicable to AI training data tags, industrial status tags, medical classification tags, and other tag objects that require leakage evidence collection and responsibility tracing under multi-node flow conditions. It can achieve at least one of the following effects: 1) This embodiment transforms the data tag object from a passive transmission carrier into an actively traceable object carrying propagation evidence. Compared with solutions relying on external logs or single-source marking, this embodiment significantly enhances the evidence collection capabilities in cross-system, cross-domain, external propagation, and offline replication scenarios by inherently carrying node-by-node behavioral traces within the tag itself. 2) The behavioral fingerprint in this embodiment is not a static device identity fingerprint, asset identification fingerprint, or access authentication fingerprint, but rather an event-based behavioral fingerprint generated for tag propagation events. Its technical mechanism differs from related technologies such as device detection, asset identification, and security access control, effectively avoiding the risk of overlapping device fingerprint directions in related technologies. 3) This embodiment employs a hop-by-hop overlay and multi-layer separable design, enabling the tag to retain behavioral traces left by multiple processing nodes after it flows through multiple processing nodes. After leakage, candidate propagation paths can be recovered through trace extraction and link reconstruction, achieving an improvement in the ability to reverse-engineer responsibility from single-point source identification. 4) This embodiment sets semantic perturbation constraints and prior trace retention constraints during the embedding process, ensuring that the writing of behavioral fingerprints does not significantly disrupt the normal parsing and usage of the tag. It balances forensic capabilities and engineering feasibility, facilitating integration and deployment with tag circulation platforms, sample management platforms, and data governance platforms in related technologies. 5) The final output of this embodiment is not only the judgment result of whether there is abnormal spread, but also the candidate propagation path, suspected responsible node and responsibility score, which can directly support the subsequent responsibility identification, authorization rectification and security accountability, and has high practical application value.

[0066] This embodiment also provides a multi-node-based tag data propagation and processing apparatus, which is used to implement the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the terms "module" and "apparatus" can refer to a combination of software and / or hardware that performs a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0067] According to an embodiment of the present invention, an apparatus embodiment for implementing the above-described multi-node-based tag data propagation processing method is also provided. Figure 5This is a schematic diagram of the structure of a multi-node-based tag data propagation and processing device according to an embodiment of the present invention, as shown below. Figure 5 As shown, the above-mentioned multi-node-based tag data propagation and processing device includes: a tag data acquisition module 500, a candidate behavior fingerprint determination module 502, a candidate processing node matching module 504, a path inversion module 506, and a leak node identification module 508, wherein:

[0068] The tag data acquisition module 500 is used to acquire target tag data. The target tag data is obtained by processing the original tag data sequentially by multiple processing nodes. The target tag data carries the behavioral fingerprints of each of the multiple processing nodes. The behavioral fingerprints are used to indicate the behavioral information of the corresponding processing nodes in the process of tag data propagation and processing.

[0069] The candidate behavior fingerprint determination module 502 is connected to the tag data acquisition module 500 and is used to determine multiple candidate behavior fingerprints corresponding to the leaked tag sample when a leaked tag sample that matches the target tag data is detected in the external environment.

[0070] The candidate processing node matching module 504 is connected to the candidate behavior fingerprint determination module 502. It is used to match multiple candidate processing nodes from the node behavior fingerprint rule base based on multiple candidate behavior fingerprints. The node behavior fingerprint rule base pre-stores behavior fingerprint templates generated by each compliant processing node in historical propagation events.

[0071] The path inversion module 506 is connected to the candidate processing node matching module 504 and is used to perform path inversion based on multiple candidate processing nodes to obtain the target propagation path of the leaked label sample.

[0072] The leakage node identification module 508 is connected to the path inversion module 506 and is used to identify the leakage processing node of the target label data from the target propagation path.

[0073] It should be noted that the above modules can be implemented by software or hardware. For example, for the latter, it can be implemented in the following ways: the above modules can be located in the same processor; or the above modules can be located in different processors in any combination.

[0074] It should be noted that the tag data acquisition module 500, candidate behavior fingerprint determination module 502, candidate processing node matching module 504, path inversion module 506, and leakage node identification module 508 mentioned above correspond to steps S102 to S110 in the embodiments. The instances and application scenarios implemented by the above modules and corresponding steps are the same, but are not limited to the content disclosed in the above embodiments. It should be noted that the above modules, as part of the device, can run in a computer terminal.

[0075] It should be noted that the optional or preferred implementation methods of this embodiment can be found in the relevant descriptions in the embodiments, and will not be repeated here.

[0076] The aforementioned multi-node-based tag data propagation and processing device may further include a processor and a memory. The tag data acquisition module 500, the candidate behavior fingerprint determination module 502, the candidate processing node matching module 504, the path inversion module 506, and the leakage node identification module 508 are all stored in the memory as program modules. The processor executes the aforementioned program modules stored in the memory to realize the corresponding functions.

[0077] The processor contains a core that retrieves the corresponding program modules from memory. One or more cores may be configured. Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory includes at least one memory chip.

[0078] According to an embodiment of this application, an embodiment of a non-volatile storage medium is also provided. Optionally, in this embodiment, the non-volatile storage medium includes a stored program, wherein, when the program runs, it controls the device where the non-volatile storage medium is located to execute any of the above-mentioned multi-node-based tag data propagation processing methods.

[0079] Optionally, in this embodiment, the non-volatile storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals, and the non-volatile storage medium includes stored programs.

[0080] Optionally, a program that controls the device containing the non-volatile storage medium to execute any of the steps of the multi-node-based tag data propagation processing method described above during program execution.

[0081] According to an embodiment of this application, an embodiment of a processor is also provided. Optionally, in this embodiment, the processor is used to run a program, wherein the program executes any of the above-described multi-node-based tag data propagation processing methods.

[0082] According to an embodiment of this application, an embodiment of a computer program product is also provided, which, when executed on a data processing device, is adapted to execute a program that initializes the multi-node-based tag data propagation processing method steps described above.

[0083] like Figure 6 As shown, an embodiment of the present invention provides an electronic device 10, which includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, it implements the steps of any of the above-described multi-node tag data propagation processing methods.

[0084] The order of the above embodiments of the present invention is merely for description and does not represent the superiority or inferiority of the embodiments.

[0085] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0086] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of modules described above can be a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, or indirect coupling or communication connection between modules, and may be electrical or other forms.

[0087] The modules described above as separate components may or may not be physically separate. Similarly, the components shown as modules may or may not be physical modules; they may be located in one place or distributed across multiple modules. Some or all of the modules can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0088] Furthermore, the functional modules in the various embodiments of the present invention can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0089] If the aforementioned integrated modules are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable non-volatile storage medium. Based on this understanding, the technical solution of this invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a non-volatile storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned non-volatile storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0090] The above are merely preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A multi-node-based tag data propagation and processing method, characterized in that, include: The target label data is obtained by processing the original label data sequentially by multiple processing nodes. The target label data carries the behavioral fingerprints corresponding to each of the multiple processing nodes. The behavioral fingerprints are used to indicate the behavioral information of the corresponding processing node in the process of label data propagation and processing. If a leaked tag sample matching the target tag data is detected in the external environment, multiple candidate behavioral fingerprints corresponding to the leaked tag sample are determined; Based on the multiple candidate behavioral fingerprints, multiple candidate processing nodes are matched from the node behavioral fingerprint rule base, wherein the node behavioral fingerprint rule base pre-stores behavioral fingerprint templates generated by each compliant processing node in historical propagation events. Based on the multiple candidate processing nodes, path inversion is performed to obtain the target propagation path of the leaked tag sample; Identify the leakage processing nodes of the target tag data from the target propagation path.

2. The method according to claim 1, characterized in that, The acquisition of target tag data includes: Use the original label data as the current label data; The plurality of processing nodes are sequentially designated as the current processing node; The current processing node processes the current tag data to obtain processed tag data. The processed tag data carries a behavioral fingerprint corresponding to the current processing node. This behavioral fingerprint includes at least: the current processing node's role identifier, the type of action performed, its position in the propagation path, its time window identifier, and task context parameters. The processed tag data is then used as the new current tag data, and the above operation is repeated until the last processing node among the plurality of processing nodes is reached. The processed tag data corresponding to the last processing node is used as the target tag data.

3. The method according to claim 2, characterized in that, The step of processing the current tag data using the current processing node to obtain processed tag data includes: The current tag data is processed using the current processing node to obtain intermediate tag data; Determine the fingerprint detectability and label semantic deviation corresponding to the current label data, wherein the fingerprint detectability is used to quantify the residual integrity of the preceding behavior fingerprint in the current label data during the propagation process, and the label semantic deviation is used to indicate the degree of content difference between the intermediate label data and the current label data in terms of business semantic expression; When the detectability of the fingerprint is greater than or equal to a preset minimum detectable threshold, and the semantic deviation of the label is less than or equal to a preset deviation threshold, the behavioral fingerprint corresponding to the current processing node is embedded into a specified area of ​​the intermediate label data to obtain the processed label data.

4. The method according to claim 1, characterized in that, The step of performing path inversion based on the multiple candidate processing nodes to obtain the target propagation path of the leaked tag sample includes: Multiple candidate propagation paths are obtained by performing path inversion based on multiple candidate processing nodes. Based on the fingerprint matching strength score, topology compliance score, temporal consistency score, and path continuity score corresponding to each of the multiple candidate propagation paths, a path score is determined for each of the multiple candidate propagation paths. The fingerprint matching strength score indicates the comprehensive content matching degree between the behavioral fingerprints corresponding to each processing node in the corresponding candidate propagation path and the behavioral fingerprints extracted from the leaked tag sample in predetermined fields. The topology compliance score indicates the matching degree between the corresponding candidate propagation path and a preset compliance propagation topology graph. The temporal consistency score indicates the matching degree between the time window identifier of the behavioral fingerprints corresponding to each processing node in the corresponding candidate propagation path and a preset propagation temporal constraint. The path continuity score indicates whether there are directed edges in the compliance propagation topology graph between adjacent processing nodes in the candidate propagation path. The target propagation path is determined from the multiple candidate propagation paths based on the path scores corresponding to each of the multiple candidate propagation paths.

5. The method according to claim 4, characterized in that, The step of determining the path score for each of the multiple candidate propagation paths based on their respective fingerprint matching strength score, topology compliance score, temporal consistency score, and path continuity score includes: Determine the weight values ​​for the fingerprint matching strength score, the topology compliance score, the temporal consistency score, and the path continuity score; Based on the fingerprint matching strength score, topology compliance score, temporal consistency score, path continuity score, and the weight values ​​corresponding to the fingerprint matching strength score, topology compliance score, temporal consistency score, and path continuity score for each of the multiple candidate propagation paths, a weighted summation operation is performed to obtain the path score corresponding to each of the multiple candidate propagation paths.

6. The method according to claim 1, characterized in that, The step of identifying the leakage processing node of the target tag data from the target propagation path includes: The node fingerprint matching strength, abnormal branch contribution, and link constraint violation degree of each processing node included in the target propagation path are determined. The node fingerprint matching strength indicates the content matching degree between the behavioral fingerprint of the corresponding processing node and the behavioral fingerprint extracted from the leaked tag sample in a predetermined field. The abnormal branch contribution degree indicates whether the corresponding processing node is the first processing node in the target propagation path that does not exist in the preset compliance propagation topology. The link constraint violation degree indicates whether the processing node's processing of the tag data disrupts the integrity of the preceding behavioral fingerprint in the target propagation path. Based on the node fingerprint matching strength, abnormal branch contribution, and link constraint violation degree of each processing node included in the target propagation path, the leakage processing node is determined from the processing nodes included in the target propagation path.

7. The method according to claim 6, characterized in that, The step of determining the leakage processing node from the processing nodes included in the target propagation path based on the node fingerprint matching strength, the contribution of the abnormal branch, and the degree of link constraint violation of each processing node included in the target propagation path includes: Determine the weight values ​​corresponding to the node fingerprint matching strength, the contribution of the abnormal branch, and the degree of link constraint violation; Based on the node fingerprint matching strength, abnormal branch contribution, and link constraint violation degree of each processing node included in the target propagation path, as well as the weight values ​​corresponding to the node fingerprint matching strength, abnormal branch contribution, and link constraint violation degree, a weighted summation operation is performed to obtain the responsibility score corresponding to each processing node included in the target propagation path. Based on the responsibility score corresponding to each processing node included in the target propagation path, the leakage processing node is determined from the processing nodes included in the target propagation path.

8. A tag data propagation and processing device based on multiple nodes, characterized in that, include: The tag data acquisition module is used to acquire target tag data, wherein the target tag data is obtained by processing the original tag data sequentially by multiple processing nodes. The target tag data carries the behavioral fingerprints corresponding to each of the multiple processing nodes. The corresponding behavioral fingerprints are used to indicate the behavioral information of the corresponding processing node in the process of tag data propagation and processing. The candidate behavior fingerprint determination module is used to determine multiple candidate behavior fingerprints corresponding to the leaked tag sample when a leaked tag sample matching the target tag data is detected in the external environment. The candidate processing node matching module is used to match multiple candidate processing nodes from the node behavior fingerprint rule base based on the multiple candidate behavior fingerprints. The node behavior fingerprint rule base pre-stores behavior fingerprint templates generated by each compliant processing node in historical propagation events. The path inversion module is used to perform path inversion based on the multiple candidate processing nodes to obtain the target propagation path of the leaked label sample. The leakage node identification module is used to identify the leakage processing node of the target tag data from the target propagation path.

9. A non-volatile storage medium, characterized in that, The non-volatile storage medium stores multiple instructions, which are adapted to be loaded by a processor and executed by the multi-node-based tag data propagation processing method according to any one of claims 1 to 7.

10. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the multi-node-based tag data propagation processing method according to any one of claims 1 to 7.

Images