A data leakage risk identification method and system based on access behavior analysis

Abstract

The present application relates to the technical field of data access security, and particularly relates to a data leakage risk identification method and system based on access behavior analysis, the method comprising: S1: obtaining access logs of a target user, data object attribute information, post information, permission source information, a controlled data object set and a protection control state in a current detection period, generating an access behavior chain and constructing a data object diffusion graph comprising data object nodes and multi-relation diffusion edges; S2: determining a permission coverage boundary according to the permission source information. The present application can improve the identification capability of access behaviors that are apparently legal but have diffusion tendencies, reduce lagging identification and misjudgment caused by relying only on frequency, sensitive fields or static permission rules, and can improve the coherence and pertinence between data leakage risk identification and access protection control without simply adopting a unified interception strategy.

Description

Technical Field

[0001] This invention relates to the field of data access security technology, specifically to a method and system for identifying data leakage risks based on access behavior analysis. Background Technology

[0002] In scenarios involving government and enterprise big data resource services, business system collaboration, and internal data sharing, users typically access different data objects based on their job positions, roles, project authorizations, or temporary authorizations. Because big data resource services involve multi-source data aggregation, cross-business system calls, and internal data sharing, and because data objects differ in business affiliation, associated calls, historical shared access, and sensitivity levels, data leakage risks often manifest not only as a single instance of unauthorized access, but also as the gradual access, combination, acquisition, and external output of multiple data objects during continuous access.

[0003] Existing methods for identifying data breach risks largely rely on access permission verification, sensitive field matching, anomaly frequency statistics, or fixed rule alerts. While these methods can identify obvious unauthorized access, bulk downloads, or high-frequency access, they struggle to determine whether user access is shifting from normal business use to potential breaches, especially in cases where access sources are complex, access actions appear legitimate, or data objects have implicit relationships. This can lead to delayed or misjudgments in risk identification.

[0004] Meanwhile, existing access control strategies typically focus on pre-emptive permission configuration or post-event auditing, resulting in insufficient connection between risk identification results and subsequent access constraints. When a user exhibits a tendency towards cross-domain access, sensitivity level jumps, or controlled data output within a detection cycle, continuing to use static permission scopes in subsequent controls may lead to further risk propagation; conversely, directly adopting a unified blocking strategy could easily disrupt normal business access. Therefore, it is necessary to improve the accuracy of identifying changes in data leakage risk during continuous access behavior and ensure that the identification results can support more targeted access protection controls. Summary of the Invention

[0005] To address the aforementioned shortcomings of existing technologies, this invention provides a data leakage risk identification method and system based on access behavior analysis. This method effectively solves the problems in existing technologies, such as the difficulty in identifying leakage tendencies in continuous access when access appears legitimate and data objects have implicit relationships, and the lack of dynamic linkage between identification results and access control.

[0006] To achieve the above objectives, the present invention provides the following technical solution:

[0007] In a first aspect, the present invention provides a data leakage risk identification method based on access behavior analysis, comprising:

[0008] S1: Obtain the target user's access logs, data object attribute information, job information, permission source information, controlled data object set and protection control status within the current detection period, generate access behavior chain and construct a data object diffusion graph including data object nodes and multi-relation diffusion edges;

[0009] S2: Determine the permission coverage boundary based on the permission source information, and determine the protection control boundary based on the protection control status and the path risk status transition result of the previous detection cycle;

[0010] S3: Map the access behavior chain to the data object diffusion graph, determine the access diffusion path and the path multi-relation diffusion edge that the path passes through, and generate a conflict evidence vector including high-risk evidence and low-risk evidence based on the path multi-relation diffusion edge.

[0011] S4: Generate a dual-boundary coupling gating factor based on the first boundary distance of the path multi-relation diffusion edge relative to the permission coverage boundary, the second boundary distance relative to the protection control boundary, and the current protection control state;

[0012] S5: Perform nonlinear gated modulation on high-risk evidence based on the dual-boundary coupling gated factor, calculate the gated conflict degree based on the low-risk evidence and the modulated high-risk evidence, and generate a normalized state support vector of the path multi-relation diffusion edge on multiple mutually exclusive edge states based on the gated conflict degree, and determine the edge state sequence of the access diffusion path.

[0013] S6: Based on the edge state sequence, the path risk state of the access diffusion path is transferred, and the protection control state, the set of controlled data objects and the protection control boundary are updated in conjunction to generate the data leakage risk identification and protection control result, and the subsequent access behavior of the target user is constrained in the next detection cycle.

[0014] Secondly, the present invention also provides a data breach risk identification system based on access behavior analysis, applied to the data breach risk identification method based on access behavior analysis as described in the first aspect; the system includes:

[0015] The graph construction module obtains the target user's access logs, data object attribute information, job information, permission source information, controlled data object set and protection control status within the current detection period, generates access behavior chain and constructs a data object diffusion graph including data object nodes and multi-relation diffusion edges;

[0016] The boundary determination module determines the permission coverage boundary based on the permission source information and the protection control boundary based on the protection control status and the path risk status transition result of the previous detection cycle.

[0017] The evidence generation module maps the access behavior chain to a data object diffusion graph, determines the access diffusion path and the path multi-relation diffusion edges that the path passes through, and generates a conflict evidence vector including high-risk evidence and low-risk evidence based on the path multi-relation diffusion edges.

[0018] The gating factor generation module generates a dual-boundary coupling gating factor based on the first boundary distance of the path multi-relation diffusion edge relative to the permission coverage boundary, the second boundary distance relative to the protection control boundary, and the current protection control state.

[0019] The edge state determination module performs nonlinear gated modulation on high-risk evidence based on the dual-boundary coupling gate factor, calculates the gated conflict degree based on the low-risk evidence and the modulated high-risk evidence, and generates a normalized state support vector of the path multi-relation diffusion edge on multiple mutually exclusive edge states based on the gated conflict degree, thereby determining the edge state sequence of the access diffusion path.

[0020] The transfer control module transfers the path risk status of the access diffusion path according to the edge state sequence, and updates the protection control status, the set of controlled data objects and the protection control boundary in a coordinated manner, generating data leakage risk identification and protection control results, and restricting the subsequent access behavior of the target user in the next detection cycle.

[0021] The technical solution provided by this invention has the following beneficial effects:

[0022] This invention maps the continuous access behavior of target users to a data object diffusion graph, enabling data leakage risk identification to move beyond single access permission checks or fixed rule alerts. It combines business affiliation relationships, historical co-access relationships, and sensitivity level changes between data objects to analyze access diffusion paths formed during continuous access. By having both permission coverage boundaries and protection control boundaries participate in the generation of dual-boundary coupled gating factors, the risk assessment of multi-relationship diffusion edges of paths simultaneously considers the authorized access edge, the personalized protection control edge, and the current protection control status, improving the identification of seemingly legitimate but diffusion-prone access behaviors. Capabilities: By applying nonlinear gating modulation to high-risk evidence and combining it with low-risk evidence to calculate gating conflict degree and normalized state support vector, the edge state sequence in the access diffusion path can be determined more precisely, reducing the lag in identification and misjudgment caused by relying solely on frequency, sensitive fields, or static permission rules. At the same time, by updating the protection control state, the set of controlled data objects, and the protection control boundary in conjunction with the path risk state transition, the risk identification results can enter the next detection cycle and constrain subsequent access behavior. Thus, without simply adopting a unified interception strategy, the connection and targeting between data leakage risk identification and access protection control can be improved. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are merely some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without any creative effort.

[0024] Figure 1 A flowchart illustrating the data leakage risk identification method based on access behavior analysis provided in this embodiment of the invention;

[0025] Figure 2 This is a schematic diagram of the structure of a data leakage risk identification system based on access behavior analysis provided in an embodiment of the present invention. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0027] See Figure 1 , Figure 1 This is a flowchart illustrating the data leakage risk identification method based on access behavior analysis provided by the present invention. In this embodiment of the invention, the executing entity of the data leakage risk identification method based on access behavior analysis is the data leakage risk identification system based on access behavior analysis. Therefore, the data leakage risk identification method based on access behavior analysis includes...

[0028] S1: Obtain the target user's access logs, data object attribute information, job information, permission source information, controlled data object set and protection control status within the current detection period, generate access behavior chain and construct a data object diffusion graph including data object nodes and multi-relation diffusion edges.

[0029] S1 forms the foundation for identifying the basic data object relationships and access behaviors required for data breach risk identification. The current detection period is a time unit for centralized analysis of target user access behavior. Access logs include the data object identifiers accessed by the target user, the type of access operation, and the access time. Data object attribute information is used to determine the business affiliation, sensitivity level, and attribute relationships between data objects. Job position information and access source information are used to determine the authorization basis for the target user's access to data objects. The controlled data object set and protection control status reflect the scope and degree of protection control of data objects that the target user has already implemented at the start of the current detection period.

[0030] In S1, the system organizes access logs according to the access time, forming a chain of access behavior of the target user within the current detection period. Simultaneously, it determines data object nodes based on data object attribute information and forms multi-relationship diffusion edges based on the business affiliation, historical co-access relationships, and sensitivity level changes between data object nodes, constructing a data object diffusion graph. Thus, continuous access behavior can be correlated with the diffusion relationships between data objects, providing a graph structure foundation for subsequent access diffusion path determination. See the descriptions in S101-S104 for details.

[0031] S2: Determine the permission coverage boundary based on the permission source information, and determine the protection control boundary based on the protection control status and the path risk status transition result of the previous detection cycle.

[0032] S2 is used to form the boundary references required for subsequent path risk analysis in the data object diffusion graph. The permission coverage boundary is determined based on the permission source information, which includes the data access basis obtained by the target user based on position, role, project authorization, and temporary authorization. After the system maps the permission source information to the data object nodes and multi-relationship diffusion edges in the data object diffusion graph, it can determine the data object nodes and multi-relationship diffusion edges that the target user has access to in the current detection period, and the permission coverage boundary is formed by the data object nodes and multi-relationship diffusion edges with access permissions.

[0033] The protection control boundary is determined based on the protection control status and the path risk state transition results of the previous detection period. The path risk state transition results of the previous detection period reflect the changes in risk status formed by the target user during historical continuous access, while the protection control status reflects the current level of protection control received by the target user. The system determines the protection control boundary in the data object diffusion graph based on the data object nodes that need to be included in protection control, the set of controlled data objects, and the protection control status in the previous detection period. Through the permission coverage boundary and the protection control boundary, subsequent steps can simultaneously analyze the impact of authorized access edges and personalized protection control edges on the risk judgment of path multi-relationship diffusion edges. See the descriptions in S201-S203 for details.

[0034] S3: Map the access behavior chain to the data object diffusion graph, determine the access diffusion path and the path multi-relation diffusion edges that the path passes through, and generate a conflict evidence vector including high-risk evidence and low-risk evidence based on the path multi-relation diffusion edges.

[0035] S3 is used to convert time-ordered access behaviors into path analysis objects in the data object diffusion graph. The system matches the data object identifiers in the access behavior chain with the data object nodes in the data object diffusion graph to obtain the data object nodes that the target user sequentially encounters within the current detection period, and forms an access node sequence according to the access order in the access behavior chain. When there are multi-relation diffusion edges between adjacent data object nodes in the access node sequence, the system determines the access diffusion path based on the multi-relation diffusion edges between adjacent data object nodes, and identifies the multi-relation diffusion edges actually traversed by the access diffusion path as path multi-relation diffusion edges.

[0036] Furthermore, the system generates high-risk and low-risk evidence based on the business affiliation, historical co-access relationships, sensitivity level changes, permission source information, access operation type, controlled data object set, and protection control status corresponding to the multi-relationship diffusion edges along the path. High-risk evidence reflects risk factors such as sensitivity level transitions, proximity of permission boundaries, increased contact with controlled objects, and enhanced output tendencies along the multi-relationship diffusion edges. Low-risk evidence reflects normal business factors such as conformity with business affiliation, historical co-access habits, and authorized access criteria. The system combines high-risk and low-risk evidence into a conflict evidence vector according to the order of the multi-relationship diffusion edges in the access diffusion path, as described in S301-S304.

[0037] S4: Generate a dual-boundary coupling gating factor based on the first boundary distance of the path multi-relation diffusion edge relative to the permission coverage boundary, the second boundary distance relative to the protection control boundary, and the current protection control state.

[0038] S4 is used to provide gating criteria for the subsequent modulation strength of high-risk evidence based on the boundary position of the multi-relation diffusion edge along the path and the current protection control state of the target user. The system determines the first boundary distance based on the number of multi-relation diffusion edges traversed between the multi-relation diffusion edge along the path and the permission coverage boundary; determines the second boundary distance based on the number of multi-relation diffusion edges traversed between the multi-relation diffusion edge along the path and the protection control boundary; and determines the risk value of the current protection control state based on the current protection control state. The first boundary distance reflects the degree to which the multi-relation diffusion edge along the path approaches the authorized access edge, the second boundary distance reflects the degree to which the multi-relation diffusion edge along the path approaches the personalized protection control edge, and the risk value of the current protection control state reflects the protection control strength of the target user at the start of the current detection period.

[0039] Furthermore, the system generates a dual-boundary coupling gating factor based on the first boundary distance, the second boundary distance, and the current protection control state risk value. The dual-boundary coupling gating factor increases when the first boundary distance decreases; it also increases when the second boundary distance decreases; and it increases when the current protection control state risk value increases. When both the first and second boundary distances decrease, the proximity values ​​of both boundaries increase, and the dual-boundary coupling gating factor reflects the coupling effect between the two boundary position factors: the access control boundary and the protection control boundary. See descriptions in S401-S404 for details.

[0040] S5: Perform nonlinear gated modulation on high-risk evidence based on the dual-boundary coupling gate factor, calculate the gated conflict degree based on the low-risk evidence and the modulated high-risk evidence, and generate a normalized state support vector of the path multi-relation diffusion edge on multiple mutually exclusive edge states based on the gated conflict degree, and determine the edge state sequence of the access diffusion path.

[0041] S5 is used to convert risk evidence on multi-relation diffusion edges of a path into edge state expressions that can be used for path risk state transitions. The system performs nonlinear gating modulation on high-risk evidence based on a dual-boundary coupling gating factor, giving stronger modulation to high-risk evidence on multi-relation diffusion edges of paths that are close to permission coverage boundaries, close to protection control boundaries, and associated with higher protection control states. The modulated high-risk evidence and low-risk evidence jointly participate in the gating conflict degree calculation. The gating conflict degree reflects the degree of conflict between normal business access criteria and risk escalation criteria on the same multi-relation diffusion edge of a path.

[0042] Furthermore, based on low-risk evidence, modulated high-risk evidence, and gating conflict degree, the system determines the state support degree of the path multi-relation diffusion edge corresponding to the stable business edge, the business domain low co-access edge, the sensitive transition edge, the permission out-of-bounds edge, the controlled output edge, and the hidden diffusion edge, respectively, and normalizes each state support degree to obtain the normalized state support degree vector.

[0043] The system determines the mutually exclusive edge state corresponding to the state with the largest value in the normalized state support vector as the edge state of the corresponding path multi-relation diffusion edge, and obtains the edge state sequence of the access diffusion path according to the arrangement order of the path multi-relation diffusion edges in the access diffusion path. See the description in S501-S507 for details.

[0044] S6: Based on the edge state sequence, the path risk state of the access diffusion path is transferred, and the protection control state, the set of controlled data objects and the protection control boundary are updated in conjunction to generate the data leakage risk identification and protection control result, and the subsequent access behavior of the target user is constrained in the next detection cycle.

[0045] S6 is used to convert the edge state sequence within the current detection period into path risk state transition results, forming the basis for protection control for the next detection period. The system traverses the edge state sequence along the access diffusion path direction, and based on the stable business edges, low-common-access edges within the same business domain, sensitive transition edges, permission overreach edges, controlled output edges, and hidden diffusion edges appearing in the edge state sequence, it transitions the path risk state of the access diffusion path. The path risk state transition results are used to characterize the degree to which the target user's access behavior changes from normal business access to an increased risk of data leakage within the current detection period.

[0046] During the path risk state transition, the system updates the controlled data object set based on the data object nodes associated with sensitive transition edges, permission out-of-bounds edges, controlled output edges, and hidden diffusion edges, and improves the protection control state based on situations such as the continuous occurrence of permission out-of-bounds edges and the alternating occurrence of hidden diffusion edges and permission out-of-bounds edges in the edge state sequence.

[0047] Subsequently, the system redetermines the protection control boundary based on the updated protection control status and the set of controlled data objects, and generates data leakage risk identification and protection control results. The updated protection control status, set of controlled data objects, and protection control boundary are carried over to the next detection cycle, where they are used to constrain the scope of data objects accessed by the target user, the allowed operation types, and the data output methods in the next detection cycle. See the descriptions in S601-S607 for details.

[0048] Compared with related technologies, the present invention has at least the following beneficial effects:

[0049] Firstly, by generating access behavior chains based on access logs and constructing a data object diffusion graph including data object nodes and multi-relation diffusion edges based on data object attribute information, it is possible to correlate the continuous access behavior of target users with the business affiliation relationship, historical co-access relationship, and sensitivity level change relationship between data objects, which is beneficial for analyzing changes in data leakage risk during continuous access.

[0050] Secondly, by determining the permission coverage boundary through permission source information and by determining the protection control boundary through the protection control status and the path risk status transition results of the previous detection cycle, the authorized access boundary and the personalized protection control boundary can be introduced simultaneously in the access diffusion path analysis, which is conducive to identifying access behaviors that appear to have access basis but are close to the risk boundary.

[0051] Third, by generating a dual-boundary coupling gating factor based on the first boundary distance, the second boundary distance, and the current protection control state, and performing nonlinear gating modulation on high-risk evidence based on the dual-boundary coupling gating factor, the influence of boundary proximity state and protection control state on high-risk evidence can be enhanced, making the processing of risk evidence more consistent with the diffusion characteristics in continuous access behavior.

[0052] Fourth, by calculating the gating conflict degree based on low-risk evidence and modulated high-risk evidence, and generating a normalized state support vector of the multi-relation diffusion edge on multiple mutually exclusive edge states, the risk performance of the multi-relation diffusion edge can be converted into an edge state sequence, which helps to reduce the recognition lag and misjudgment caused by matching only static permission rules, access frequency or sensitive fields.

[0053] Fifth, by performing path risk state transitions based on edge state sequences and updating protection control states, controlled data object sets, and protection control boundaries in a coordinated manner, the data leakage risk identification results within the current detection cycle can be carried over to the next detection cycle. This is used to constrain the scope of data objects accessed by target users, the types of operations allowed, and the data output methods, thereby improving the connection between risk identification results and access protection controls.

[0054] In one embodiment, S101-S104 are described as follows:

[0055] S101: Obtain the target user's access logs, data object attribute information, job information, permission source information, controlled data object set, and protection control status within the current detection period.

[0056] In S101, the system uses the target user and the current detection period as data extraction conditions to read the access logs generated by the target user within the current detection period from the access record storage area. The access logs include at least the data object identifier, access operation type, and access time. The data object identifier is used to correspond to subsequent data object nodes, the access operation type is used to distinguish whether the target user performed access actions such as viewing, downloading, copying, exporting, forwarding, and modifying the data object, and the access time is used to determine the order of these access actions within the current detection period.

[0057] The system further reads data object attribute information, job information, permission source information, controlled data object set, and protection control status. Data object attribute information includes the data object's business affiliation information, sensitivity level information, and attribute association information, used to determine the basis for identifying data object nodes and the relationships between them. Job information is used to determine the scope of business responsibilities undertaken by the target user. Permission source information records the basis for the target user's access permissions, including job permissions, role permissions, project authorization, and temporary authorization. The controlled data object set records data objects that have been included in protection control before the start of the current detection cycle. Protection control status indicates the degree of data access protection control currently applied to the target user.

[0058] After retrieval, the system performs a field integrity check on the data object identifier, access operation type, and access time in the access log. For access records lacking a data object identifier, whose access operation type cannot be determined, or whose access time cannot be determined, the system marks the access record as unsuitable for participating in the generation of the access behavior chain and excludes it during the generation of the access behavior chain. For access records where the target user, data object identifier, access operation type, and access time can be determined, the system retains the access record and proceeds to S102.

[0059] S102: Sort the access logs according to the access time, and generate an access behavior chain based on the data object identifier, access operation type and access time in the access logs.

[0060] In S102, the system sorts the access logs retained in S101 according to their access time from earliest to latest, thus obtaining the access order of the target user within the current detection period. For access logs with the same access time, the system determines the sorting order based on the order in which the access logs enter the access record storage area, ensuring that the access actions of the same target user within the current detection period form a unique sequential relationship.

[0061] After sorting, the system generates access behavior units based on the data object identifier, access operation type, and access time in each access log. An access behavior unit includes the type of access operation performed by the target user on a data object at a given time. The system sequentially connects multiple access behavior units according to the access occurrence time, forming an access behavior chain. Each access behavior unit in the access behavior chain retains its corresponding data object identifier, access operation type, and access time, enabling subsequent steps to map data object nodes based on the data object identifier and determine the source of risk evidence corresponding to the access behavior based on the access operation type.

[0062] Furthermore, when a target user accesses the same data object multiple times consecutively within the current detection period, the system retains the temporal position of each access behavior unit in the access behavior chain and records the access operation type corresponding to each access behavior unit. By retaining the multiple access positions of the same data object, the access behavior chain can express the target user's repeated contact with the same data object and the changes in access operation types, providing a temporal sequence basis for subsequently determining the access diffusion path.

[0063] S103: Determine the data object nodes based on the data object attribute information, and generate multi-relationship diffusion edges based on the business affiliation relationship, historical co-access relationship and sensitivity level change relationship between the data object nodes.

[0064] In S103, the system uses the data object identifier in the data object attribute information as the basis for node generation, generating a data object node for each data object that can be accessed and referenced by the target user during the analysis process. Each data object node is associated with corresponding data object attribute information, including business affiliation information and sensitivity level information. Business affiliation information is used to determine whether different data object nodes belong to the same business domain, the same business process, or have upstream and downstream business relationships. Sensitivity level information is used to determine whether there are changes in sensitivity levels between different data object nodes.

[0065] The system generates multi-relationship diffusion edges based on the business affiliation, historical co-access relationships, and sensitivity level change relationships among data object nodes. For data object nodes sharing the same business affiliation, upstream / downstream business connections, or the same business process, the system generates multi-relationship diffusion edges reflecting business affiliation. For data object nodes continuously accessed by users of the same job type in historical access logs, the system generates multi-relationship diffusion edges reflecting historical co-access relationships. For data object nodes with different sensitivity levels that can form a contact change from low-sensitivity to high-sensitivity data objects, the system generates multi-relationship diffusion edges reflecting sensitivity level change relationships.

[0066] Furthermore, when multiple relationships exist simultaneously among the same group of data object nodes, including business affiliation, historical co-access, and sensitivity level change relationships, the system retains multiple relationship markers in the corresponding multi-relationship diffusion edge. This allows a single multi-relationship diffusion edge to simultaneously express the business connections, historical access connections, and sensitivity level change connections between multiple data object nodes. Through multi-relationship diffusion edges, subsequent access diffusion paths can express the business diffusion, co-access diffusion, and sensitivity level transitions that may occur between data objects due to the target user's access behavior.

[0067] S104: Associate the data object nodes and multi-relation diffusion edges to obtain a data object diffusion graph including data object nodes and multi-relation diffusion edges.

[0068] In S104, the system uses the data object nodes generated in S103 as node elements in the data object diffusion graph, and the multi-relation diffusion edges generated in S103 as edge elements in the data object diffusion graph. It then establishes the association relationships between node elements and edge elements based on the data object nodes connected by the multi-relation diffusion edges. Each multi-relation diffusion edge records the starting data object node, the ending data object node, and the corresponding business affiliation relationship, historical co-access relationship, and sensitivity level change relationship, enabling the data object diffusion graph to express the multi-relation connection structure between data objects.

[0069] After the system completes the association of data object nodes and multi-relation diffusion edges, it obtains a data object diffusion graph that includes data object nodes and multi-relation diffusion edges. In the data object diffusion graph, each data object node can be matched with the access behavior unit in the access behavior chain based on the data object identifier, and each multi-relation diffusion edge can participate in the determination of subsequent access diffusion paths based on the connected data object nodes.

[0070] Through S101 to S104, the access behavior of the target user within the current detection period is organized into an access behavior chain, and the business ownership relationship, historical co-access relationship and sensitivity level change relationship between data objects are organized into a data object diffusion graph, thereby providing an executable data foundation for determining the subsequent permission coverage boundary, protection control boundary, access diffusion path and path multi-relationship diffusion edge.

[0071] In one embodiment, S201-S203 are described as follows:

[0072] S201: Map the permission source information to the data object nodes and multi-relationship diffusion edges in the data object diffusion graph, determine the data object nodes and multi-relationship diffusion edges that the target user has access to in the current detection period, and determine the permission coverage boundary based on the data object nodes and multi-relationship diffusion edges that have access to the data object nodes.

[0073] In S201, the system reads the permission source information corresponding to the target user and extracts permission fields from the permission source information that can establish a corresponding relationship with the data object diffusion graph. Permission fields include permission source type, data object identifier associated with the permission, business scope associated with the permission, permitted access operation types, and permission effective time. Based on the data object identifier associated with the permission, the system maps the permission source information to data object nodes in the data object diffusion graph; based on the business scope associated with the permission and the permitted access operation types, it maps the permission source information to multi-relationship diffusion edges between data object nodes; the system determines whether the permission record has taken effect within the current detection period based on the permission effective time and excludes permission records that have not taken effect within the current detection period, ensuring that the data object nodes and multi-relationship diffusion edges involved in the mapping all originate from permission records that have taken effect within the current detection period.

[0074] After mapping, the system identifies the data object nodes matching the permission source information as those that the target user has access to within the current detection period. For multi-relationship diffusion edges, the system determines whether the edge falls within the business scope and allowed access relationships corresponding to the permission source information based on the data object nodes connected to it, business affiliation, historical co-access relationships, and sensitivity level change relationships. When all data object nodes connected to the multi-relationship diffusion edge have access permissions, and the corresponding relationships of the multi-relationship diffusion edge can be supported by the permission source information, the system identifies the multi-relationship diffusion edge as one that the target user has access to within the current detection period.

[0075] Furthermore, the system determines the permission coverage boundary in the data object diffusion graph based on the data object nodes with access permissions and the multi-relation diffusion edges. Specifically, the system forms an authorized access region from the data object nodes with access permissions and the multi-relation diffusion edges, and then searches for data object nodes adjacent to unauthorized data object nodes and multi-relation diffusion edges adjacent to unauthorized multi-relation diffusion edges within the authorized access region. The system defines the data object nodes and multi-relation diffusion edges located at the outer edge of the authorized access region as the permission coverage boundary. The permission coverage boundary represents the authorized access boundary for the target user as determined by the permission source information and provides a reference object for determining the subsequent first boundary distance.

[0076] S202: Based on the path risk state transition results of the previous detection cycle, determine the data object nodes that need to be included in protection control.

[0077] In S202, the system reads the path risk state transition results generated by the target user in the previous detection period. The path risk state transition results include the edge state sequence corresponding to the access diffusion path in the previous detection period, the path risk state change record, and the data object node record that has triggered protection control. Based on the path risk state transition results, the system finds the path multi-relationship diffusion edges corresponding to sensitive transition edges, permission out-of-bounds edges, controlled output edges, and hidden diffusion edges in the previous detection period, and determines the data object nodes associated with the path multi-relationship diffusion edges.

[0078] For sensitive transition edges, the system identifies data object nodes whose sensitivity level has changed and which are accessed by the target user as data object nodes that need to be included in protection control. For permission overreach edges, the system identifies data object nodes that are accessed after crossing the permission coverage boundary as data object nodes that need to be included in protection control. For controlled output edges, the system identifies data object nodes that show output tendency and belong to the associated range of the controlled data object set as data object nodes that need to be included in protection control. For hidden diffusion edges, the system identifies data object nodes that are associated with the hidden diffusion path and participated in the path risk state increase in the previous detection cycle as data object nodes that need to be included in protection control.

[0079] If the path risk state transition results of the previous detection cycle do not show any sensitive transition edges, permission out-of-bounds edges, controlled output edges, or hidden diffusion edges, the system will not add any new data object nodes that need to be included in protection control, and will retain the existing set of controlled data objects to participate in S203. Through S202, data object nodes that have shown an increased risk tendency in the previous detection cycle can enter the protection control boundary determination process of the current detection cycle.

[0080] It should be noted that if the current detection period is the first detection period for the target user, and the system has not read the path risk state transition result for the target user in the previous detection period, the system will not add any new data object nodes that need to be included in the protection control, and will use the set of controlled data objects and the protection control status obtained at the beginning of the current detection period as input for determining the protection control boundary in S203. Through the input processing of the first detection period, the data leakage risk identification method based on access behavior analysis can start even when there is no path risk state transition result from the previous detection period, and generate the path risk state transition result, the set of controlled data objects, and the protection control status that can be read by the next detection period after the first detection period ends.

[0081] S203: Determine the protection control boundary in the data object diffusion diagram as needed, including the data object nodes, protection control states, and controlled data object sets under protection control.

[0082] In S203, the system merges the data object nodes that need to be included in protection control as determined in S202 with the data objects in the controlled data object set to obtain the range of data object nodes used to determine the protection control boundary in the current detection cycle. For the merged range of data object nodes, the system searches for multi-relationship diffusion edges connected to the corresponding data object nodes in the data object diffusion graph, and determines whether the multi-relationship diffusion edges enter the protection control analysis range based on the protection control status.

[0083] Specifically, when the protection control status indicates that the target user is at a low level of protection control, the system mainly selects multi-relationship diffusion edges that are directly connected to the data object nodes that need to be included in the protection control, forming a protection control boundary that is closer to the set of controlled data objects. When the protection control status indicates that the target user is at a high level of protection control, the system searches for data object nodes and multi-relationship diffusion edges that are continuously connected to the data object nodes that need to be included in the protection control along business affiliation, historical co-access relationship, and sensitivity level change relationship, so that the protection control boundary can cover the outer edge of the data object nodes that have diffusion association with the set of controlled data objects.

[0084] After determining the range of data object nodes and the range of multi-relationship diffusion edges in the data object diffusion graph, the system defines the data object nodes and multi-relationship diffusion edges at the outer edge of the protection control range as the protection control boundary. The protection control boundary represents the personalized protection control boundary formed by the target user's protection control state, the set of controlled data objects, and the path risk state transition results of the previous detection cycle. Through steps S201 to S203, both the permission coverage boundary and the protection control boundary within the current detection cycle are determined. Subsequent steps can generate a dual-boundary coupling gating factor based on the positional relationship between the path multi-relationship diffusion edges and the permission coverage boundary and the protection control boundary.

[0085] In one embodiment, S301-S304 are described as follows:

[0086] S301: Match the data object identifiers in the access behavior chain with the data object nodes in the data object diffusion graph to obtain the access node sequence.

[0087] In S301, the system reads the data object identifiers contained in each access behavior unit in the access behavior chain, and uses the data object identifiers as a matching field to find the corresponding data object nodes in the data object diffusion graph. For access behavior units that can find corresponding data object nodes in the data object diffusion graph, the system uses the corresponding data object nodes as access nodes, and retains the access operation type and access time in the access behavior unit, so that the access nodes can correspond to the access actions in the access behavior chain.

[0088] For access behavior units for which the corresponding data object node cannot be found in the data object diffusion graph, the system marks the corresponding access behavior unit as an unmappable access behavior unit and excludes it during the access diffusion path determination process.

[0089] After matching is complete, the system arranges multiple access nodes sequentially according to the order of access behavior units in the access behavior chain, resulting in an access node sequence. Each access node in the access node sequence corresponds to a data object node and is associated with the corresponding access operation type and access time. Through the access node sequence, the continuous contact relationships of the target user with different data objects within the current detection period can be analyzed in the data object diffusion graph.

[0090] S302: Determine the access diffusion path based on the multi-relation diffusion edges between adjacent data object nodes in the access node sequence, and determine the multi-relation diffusion edges that the access diffusion path actually passes through in the data object diffusion graph as path multi-relation diffusion edges.

[0091] In S302, the system sequentially reads adjacent data object nodes according to the order of the access node sequence and searches the data object diffusion graph for multi-relationship diffusion edges between adjacent data object nodes. When there is one multi-relationship diffusion edge between adjacent data object nodes, the system includes the corresponding multi-relationship diffusion edge in the access diffusion path. When there are multiple multi-relationship diffusion edges between adjacent data object nodes, the system retains the multi-relationship diffusion edges that reflect the current continuous access relationship based on the business affiliation relationship, historical co-access relationship, and sensitivity level change relationship recorded by the multi-relationship diffusion edges, combined with the access operation type corresponding to the adjacent access nodes.

[0092] When there are no multi-relation diffusion edges between adjacent data object nodes, the system marks the continuous access relationships between adjacent data object nodes as not forming intra-graph diffusion connections and does not include the relationships between the corresponding adjacent data object nodes in the access diffusion path. For identified multi-relation diffusion edges, the system arranges adjacent data object nodes according to their order in the access node sequence to form an access diffusion path. The multi-relation diffusion edges that the access diffusion path actually traverses in the data object diffusion graph are determined as path multi-relation diffusion edges. Each path multi-relation diffusion edge retains the corresponding starting data object node, ending data object node, relationship type, access operation type, and access time order, enabling subsequent high-risk and low-risk evidence to be generated based on the same path multi-relation diffusion edge.

[0093] It should be noted that for continuous access relationships between adjacent data object nodes marked as not forming intra-graph diffusion connections, the system does not determine the corresponding continuous access relationship as a path multi-relation diffusion edge, but records the corresponding continuous access relationship as a record of not forming intra-graph diffusion connections. Records of not forming intra-graph diffusion connections include adjacent data object nodes, corresponding access operation types, and access times. Records of not forming intra-graph diffusion connections do not participate in the generation of double-boundary coupling gating factors, calculation of gating conflict degrees, generation of normalized state support vectors, and determination of edge state sequences.

[0094] S303: Based on the business affiliation relationship, historical co-access relationship, sensitivity level change relationship, permission source information, access operation type, controlled data object set and protection control status corresponding to the multi-relation diffusion edge of the path, generate high-risk evidence and low-risk evidence.

[0095] In S303, the system generates high-risk evidence and low-risk evidence for each multi-relationship diffusion edge along a path. High-risk evidence is used to record the evidence content of the multi-relationship diffusion edge along the path that supports the judgment of increased data leakage risk.

[0096] The system determines whether the access diffusion path points from a low-sensitivity data object to a high-sensitivity data object based on the sensitivity level changes corresponding to the multi-relationship diffusion edges of the path; it also determines whether the multi-relationship diffusion edges of the path are close to the permission coverage boundary and whether there are access relationships beyond the scope supported by the permission source information based on the permission source information; it further determines whether the target user has performed access operations with data output characteristics, such as downloading, copying, exporting, or forwarding, on the data objects associated with the multi-relationship diffusion edges of the path based on the access operation type; and it determines whether the data object nodes associated with the multi-relationship diffusion edges of the path are already within the scope of protection control based on the set of controlled data objects and the protection control status, and whether the target user's current protection control level constitutes evidence of increased risk for this access. When any of the above judgments supports an increase in risk, the system writes the corresponding judgment result into high-risk evidence.

[0097] Low-risk evidence is used to record the evidence supporting normal business access for multi-relationship diffusion edges along a path. The system determines whether adjacent data object nodes belong to the same business affiliation, the same business process, and have upstream / downstream business connections based on the business affiliation corresponding to the multi-relationship diffusion edges; it also determines whether adjacent data object nodes have been continuously accessed by users of the same role type in historical access logs based on historical access relationships; and it determines whether the data object nodes associated with the multi-relationship diffusion edges and the access operation type can be supported by job permissions, role permissions, project authorization, and temporary authorization based on permission source information. When any of the above determinations supports normal business access, the system writes the corresponding determination result into the low-risk evidence.

[0098] Furthermore, when generating high-risk and low-risk evidence, the system ensures that both high-risk and low-risk evidence correspond to the same multi-relation diffusion edge along the same path. For multi-relation diffusion edges along a path that simultaneously have both risk-increasing evidence and normal business evidence, the system retains both high-risk and low-risk evidence, allowing subsequent gating conflict degrees to be calculated based on the modulated high-risk and low-risk evidence. For multi-relation diffusion edges along a path that only have normal business evidence, the system retains low-risk evidence and records high-risk evidence as not forming risk-increasing evidence.

[0099] S304: According to the order of the multi-relation diffusion edges in the access diffusion path, combine high-risk evidence and low-risk evidence into a conflict evidence vector.

[0100] In S304, the system reads the high-risk and low-risk evidence corresponding to each path multi-relation diffusion edge sequentially according to the order in which the path multi-relation diffusion edges are arranged in the access diffusion path. For the first path multi-relation diffusion edge, the system uses the corresponding high-risk and low-risk evidence as the first evidence unit in the conflict evidence vector; for subsequent path multi-relation diffusion edges, the system adds the corresponding high-risk and low-risk evidence sequentially according to the order in which the access diffusion path is opened, until all path multi-relation diffusion edges in the access diffusion path have been combined.

[0101] After combination, the conflict evidence vector includes high-risk and low-risk evidence that correspond one-to-one with the multi-relation diffusion edges of each path. The order of the conflict evidence vector is consistent with the order of the multi-relation diffusion edges in the access diffusion path, enabling subsequent steps to read the evidence content of each multi-relation diffusion edge in the direction of the access diffusion path.

[0102] Through S301 to S304, the access behavior chain is mapped into an access diffusion path. The multi-relation diffusion edges along the access diffusion path are determined. The high-risk and low-risk evidence corresponding to each multi-relation diffusion edge are organized into conflict evidence vectors, providing an evidentiary basis for subsequent generation of dual-boundary coupling gating factors, execution of nonlinear gating modulation, and calculation of gating conflict degree.

[0103] In one embodiment, S401-S404 are described as follows:

[0104] S401: Determine the first boundary distance based on the number of multi-relation diffusion edges traversed between the path multi-relation diffusion edge and the permission coverage boundary; determine the second boundary distance based on the number of multi-relation diffusion edges traversed between the path multi-relation diffusion edge and the protection control boundary.

[0105] In S401, for each multi-relationship diffusion edge in the access diffusion path, the system determines the first boundary distance between the multi-relationship diffusion edge and the permission coverage boundary, and the second boundary distance between the multi-relationship diffusion edge and the protection control boundary. The first boundary distance represents the number of multi-relationship diffusion edges that the multi-relationship diffusion edge needs to traverse to reach the permission coverage boundary, and the second boundary distance represents the number of multi-relationship diffusion edges that the multi-relationship diffusion edge needs to traverse to reach the protection control boundary.

[0106] Specifically, the system uses the current path's multi-relation diffusion edge as the starting point, searches for connecting paths leading to the permission coverage boundary in the data object diffusion graph, and counts the number of multi-relation diffusion edges traversed in each connecting path. If multiple connecting paths exist, the system selects the path with the fewest multi-relation diffusion edges and determines the corresponding number of multi-relation diffusion edges as the first boundary distance. The system then searches for connecting paths from the current path's multi-relation diffusion edge to the protection control boundary in the same manner, and determines the number of multi-relation diffusion edges corresponding to the path with the fewest multi-relation diffusion edges as the second boundary distance. By determining the boundary distance using the minimum number of multi-relation diffusion edges, the first and second boundary distances directly reflect the graph structure proximity between the path's multi-relation diffusion edge and its corresponding boundary.

[0107] Furthermore, when the path multi-relation diffusion edge is already located on the permission coverage boundary, the system records the first boundary distance as 0; when the path multi-relation diffusion edge is already located on the protection control boundary, the system records the second boundary distance as 0. A first boundary distance of 0 indicates that the path multi-relation diffusion edge is already at the outer edge of the permission coverage boundary, and a second boundary distance of 0 indicates that the path multi-relation diffusion edge is already at the outer edge of the protection control boundary. When generating the dual-boundary coupling gating factor subsequently, a first boundary distance of 0 or a second boundary distance of 0 allows the corresponding boundary proximity values ​​to achieve higher values.

[0108] S402: Determine the risk value of the current protection control status based on the protection control status.

[0109] In S402, the system reads the protection control status of the target user at the start of the current detection cycle and determines the current protection control status risk value based on the protection control status. The protection control status reflects the degree of data access protection control already imposed on the target user, and the current protection control status risk value is the numerical result corresponding to the protection control status, which is used to participate in the generation of the dual-boundary coupling gating factor.

[0110] Specifically, the system converts the protection control levels recorded in the protection control status into risk values ​​for the current protection control status in ascending order. In one specific implementation, the risk value for the protection control status can be directly obtained from the protection control status through mapping. For example, low protection control status, medium protection control status, and high protection control status correspond to low protection control status risk values, medium protection control status risk values, and high protection control status risk values, respectively. The risk values ​​for low protection control status, medium protection control status, and high protection control status increase sequentially from low to high according to the protection control level. A higher protection control level indicates that the target user already had a higher level of risk concern in the previous detection cycle and at the beginning of the current detection cycle, and the risk value for the current protection control status increases accordingly. For the same protection control level, the system uses a consistent conversion rule in different current detection cycles, so that the risk value for the current protection control status can remain comparable across different detection cycles.

[0111] Once the current protection control state risk value is determined, the system uses the current protection control state risk value, along with the first boundary distance and the second boundary distance obtained in S401, as inputs to the dual-boundary coupling gating factor. Therefore, whether the path multi-relation diffusion edge is close to the permission coverage boundary, whether it is close to the protection control boundary, and the target user's current protection control state risk value, can collectively influence the nonlinear gating modulation strength of subsequent high-risk evidence.

[0112] S403: Generate a first boundary proximity value based on the first boundary distance, generate a second boundary proximity value based on the second boundary distance, perform multiplicative coupling based on the first boundary proximity value and the second boundary proximity value to obtain a multiplicative coupling result, and fuse the multiplicative coupling result with the current protection control state risk value to generate a dual-boundary coupling gating factor corresponding to the path multi-relationship diffusion edge.

[0113] In S403, the system first converts the first boundary distance into a first boundary proximity value and the second boundary distance into a second boundary proximity value. The first boundary proximity value increases as the first boundary distance decreases, and the second boundary proximity value increases as the second boundary distance decreases. Subsequently, the system multiplicatively couples the first and second boundary proximity values ​​to obtain a multiplicative coupling result. The multiplicative coupling result is used to represent the degree to which the path multi-relation diffusion edge simultaneously approaches the permission coverage boundary and the protection control boundary.

[0114] After obtaining the multiplicative coupling result, the system fuses the multiplicative coupling result with the current protection control state risk value to generate a dual-boundary coupling gating factor corresponding to the path multi-relation diffusion edge. The dual-boundary coupling gating factor is used to control the nonlinear gating modulation intensity of the high-risk evidence in step 50.

[0115] For example, the system generates the dual-boundary coupling gating factor according to the following formula:

[0116]

[0117] in, Indicates the first in the access diffusion path Multiple paths with multiple relationships diffuse edge;

[0118] Represents a path with multiple relation diffusion edges The corresponding double-boundary coupling gating factor.

[0119] Represents a path with multiple relation diffusion edges The first boundary distance relative to the permission coverage boundary;

[0120] Represents a path with multiple relation diffusion edges The distance from the second boundary relative to the protection control boundary;

[0121] Indicates the value close to the first boundary;

[0122] Indicates the value close to the second boundary;

[0123] This represents the multiplicative coupling result corresponding to the first boundary proximity value and the second boundary proximity value;

[0124] This indicates the current risk value of the protection and control status;

[0125] This represents the influence coefficient of the first boundary proximity value on the double-boundary coupling gating factor;

[0126] This represents the influence coefficient of the second boundary proximity value on the double-boundary coupling gating factor;

[0127] This represents the influence coefficient of the multiplicative coupling result on the double-boundary coupling gating factor;

[0128] This represents the modulation coefficient of the multiplicative coupling result to the current protection and control state risk value.

[0129] In the dual-boundary coupling gating factor generation formula, the first boundary proximity value reflects the gating enhancement basis when the path multi-relationship diffusion edge approaches the permission coverage boundary, and the second boundary proximity value reflects the gating enhancement basis when the path multi-relationship diffusion edge approaches the protection control boundary. The multiplicative coupling result only increases significantly when both the first and second boundary proximity values ​​are high, thus reflecting the coupling effect between the permission coverage boundary and the protection control boundary. The current protection control state risk value is determined through... The modulation of the multiplicative coupling result by the term participates in the gating effect brought about by the dual boundary approach when the target user is in a higher protection and control state.

[0130] S404: When the first boundary distance decreases and the second boundary distance decreases, the multiplicative coupling result increases. When the risk value of the current protection control state increases, the dual-boundary coupling gating factor is increased.

[0131] In S404, when the distance to the first boundary decreases, the proximity value of the first boundary increases; when the distance to the second boundary decreases, the proximity value of the second boundary increases; the multiplicative coupling result increases accordingly. When the risk value of the current protection control state increases, As the term increases, the dual-boundary coupling gating factor increases accordingly.

[0132] In one embodiment, S501-S507 are described as follows:

[0133] S501: When the dual-boundary coupling gating factor corresponding to the multi-relation diffusion edge of the path increases, the high-risk evidence is enhanced exponentially to obtain modulated high-risk evidence.

[0134] In S501, the system reads the double-boundary coupling gating factor corresponding to the multi-relationship diffusion edge of the path generated in step 40, and reads the high-risk evidence corresponding to the multi-relationship diffusion edge of the same path in the conflict evidence vector. The high-risk evidence is generated by S303 based on the sensitivity level change relationship, permission source information, access operation type, controlled data object set, and protection control status, and includes the risk increase judgment result obtained by S303.

[0135] In one specific implementation, the system converts high-risk evidence into high-risk evidence strength for calculation, enabling the high-risk evidence to participate in nonlinear gating modulation. Specifically, the system determines the corresponding evidence assignment based on the sensitivity level transition judgment result, the permission edge proximity judgment result, the controlled object contact judgment result, and the output tendency judgment result contained in the high-risk evidence. When the corresponding judgment result is true, the evidence assignment of the corresponding judgment result is adopted; when the corresponding judgment result is false, the evidence assignment of the corresponding judgment result is recorded as 0. The system performs weighted summation based on each evidence assignment and its corresponding evidence weight to obtain the high-risk evidence strength. Each of the sensitivity level transition judgment result, permission edge proximity judgment result, controlled object contact judgment result, and output tendency judgment result corresponds to an evidence weight, which represents the degree of contribution of the corresponding judgment result to the high-risk evidence strength. Within the same detection period, the evidence weights corresponding to the same type of judgment result remain consistent. The high-risk evidence strength is used as the high-risk evidence calculation value for subsequent nonlinear gating modulation calculations. The high-risk evidence corresponding to the multi-relation diffusion edge of the path in subsequent calculations refers to the strength of the high-risk evidence obtained after numerical processing of the high-risk evidence corresponding to the multi-relation diffusion edge of the path.

[0136] The system utilizes a dual-boundary coupling gating factor to perform exponential enhancement on high-risk evidence, resulting in modulated high-risk evidence.

[0137] For example, the system determines the modulated high-risk evidence according to the following formula:

[0138]

[0139] in, Indicates the first in the access diffusion path Multiple paths with multiple relationships diffuse edge;

[0140] Represents a path with multiple relation diffusion edges Corresponding high-risk evidence;

[0141] Represents a path with multiple relation diffusion edges Corresponding modulated high-risk evidence;

[0142] Represents a path with multiple relation diffusion edges The corresponding double-boundary coupling gating factor;

[0143] This represents the gated modulation intensity coefficient, which controls the modulation amplitude of high-risk evidence by the dual-boundary coupling gate factor;

[0144] This represents the power-law enhancement index, which is used to show how the enhancement of high-risk evidence changes in a power-law relationship when the dual-boundary coupling gating factor is increased.

[0145] According to this formula, the larger the dual-boundary coupling gating factor, the better. The amplification effect is stronger for high-risk evidence. Paths with multiple relation diffusion edges that are close to the permission coverage boundary, close to the protection control boundary, and associated with a high protection control state will receive a stronger modulation effect on the corresponding high-risk evidence. The modulated high-risk evidence enters S502 and is used to jointly calculate the gating conflict degree with low-risk evidence.

[0146] S502: Determine the gating conflict degree corresponding to the path multi-relation diffusion edge based on the difference between the low-risk evidence and the modulated high-risk evidence.

[0147] In S502, the system reads the low-risk evidence corresponding to the multi-relation diffusion edge of the same path in the conflict evidence vector, and reads the modulated high-risk evidence obtained in S501. The low-risk evidence is generated by S303 based on the business affiliation relationship, historical co-access relationship, and permission source information. It is used to express the evidence content that the multi-relation diffusion edge of the path supports the judgment of normal business access, including the normal business access judgment result obtained by S303.

[0148] In one specific implementation, the system converts low-risk evidence into low-risk evidence strength for calculation, enabling a difference comparison between the low-risk evidence and the modulated high-risk evidence. Specifically, the system determines the corresponding evidence assignment based on the business affiliation support judgment result, historical co-access support judgment result, and permission source support judgment result contained in the low-risk evidence. When the corresponding judgment result is true, the evidence assignment of the corresponding judgment result is adopted; when the corresponding judgment result is false, the evidence assignment of the corresponding judgment result is recorded as 0. The system performs a weighted summation based on each evidence assignment and its corresponding evidence weight to obtain the low-risk evidence strength. Each of the business affiliation support judgment result, historical co-access support judgment result, and permission source support judgment result corresponds to an evidence weight, which represents the degree of contribution of the corresponding judgment result to the low-risk evidence strength. Within the same detection period, the evidence weights corresponding to the same type of judgment result remain consistent. The low-risk evidence strength is used as the low-risk evidence calculation value in the subsequent gating conflict degree calculation. The low-risk evidence corresponding to the multi-relationship diffusion edge of the path mentioned in the subsequent calculation refers to the low-risk evidence strength obtained after numerical processing of the low-risk evidence corresponding to the multi-relationship diffusion edge of the path.

[0149] The system determines the gating conflict degree corresponding to the multi-relation diffusion edge of the path based on the difference between low-risk evidence and modulated high-risk evidence.

[0150] For example, the system calculates the gating conflict degree according to the following formula:

[0151]

[0152] in, Represents a path with multiple relation diffusion edges Corresponding gating conflict level;

[0153] Represents a path with multiple relation diffusion edges Corresponding modulated high-risk evidence;

[0154] Represents a path with multiple relation diffusion edges Corresponding low-risk evidence;

[0155] This indicates the difference between low-risk evidence and modulated high-risk evidence.

[0156] This represents a stable term used to maintain the computability of the denominator.

[0157] This formula characterizes the degree of deviation between risk-increasing evidence and normal business access evidence in a multi-relation diffusion edge along the same path, after modulation by a double-boundary coupling gating factor. The numerator expresses the intensity difference between modulated high-risk and low-risk evidence, while the denominator normalizes this intensity difference based on the modulated high-risk evidence, low-risk evidence, and the calculated stability term, making the gating conflict degrees between different multi-relation diffusion edges comparable. Therefore, the gating conflict degree does not merely indicate whether high-risk and low-risk evidence coexist, but rather the degree of deviation between risk-increasing evidence and normal business access evidence after double-boundary coupling gating modulation. The gating conflict degree obtained in S502 is then used in S503 and S505 to determine the state support of each mutually exclusive edge state corresponding to the multi-relation diffusion edge along the path.

[0158] S503: When the difference between the low-risk evidence and the modulated high-risk evidence increases, increase the gating conflict degree corresponding to the multi-relation diffusion edge of the path.

[0159] In S503, the system determines the direction of change in the gating conflict degree based on the calculation results in S502. When the difference between the modulated high-risk evidence and the low-risk evidence increases... As the threshold increases, the gating conflict degree corresponding to the multi-relation diffusion edge of the path increases. An increased gating conflict degree indicates that on the same multi-relation diffusion edge of the path, the deviation between the risk-increasing basis after gating modulation and the basis of normal business access is enhanced.

[0160] Furthermore, when the difference between low-risk evidence and modulated high-risk evidence is small, the gating conflict degree decreases, indicating a weaker degree of deviation conflict on the multi-relation diffusion edge of the same path. Through S503, the system can convert changes in evidence differences into changes in gating conflict degree, providing a basis for conflict degree allocation for subsequent mutual exclusion edge states.

[0161] S504: The multiple mutually exclusive edge states include stable service edge, service domain low-access edge, sensitive transition edge, permission out-of-bounds edge, controlled output edge, and hidden diffusion edge.

[0162] In S504, the system restricts the edge states of multi-relationship diffusion edges to multiple mutually exclusive edge states. These mutually exclusive edge states include stable business edges, low-common-access edges within the same business domain, sensitive transition edges, permission out-of-bounds edges, controlled output edges, and hidden diffusion edges. Stable business edges indicate that multi-relationship diffusion edges have strong support for normal business access; low-common-access edges within the same business domain indicate that multi-relationship diffusion edges have a business domain relationship but weak historical common-access support; sensitive transition edges indicate that multi-relationship diffusion edges involve changes in sensitivity levels; permission out-of-bounds edges indicate that multi-relationship diffusion edges deviate from the scope supported by the permission source information; controlled output edges indicate that the data objects or access operation types associated with multi-relationship diffusion edges have a tendency for controlled output; and hidden diffusion edges indicate that multi-relationship diffusion edges create implicit diffusion risks between business affiliation relationships, historical common-access relationships, and sensitivity level change relationships.

[0163] Multiple mutually exclusive edge states are used to ensure that each path's multi-relation diffusion edge corresponds to only one final edge state in subsequent processing. Through these mutually exclusive edge states, the system enables the edge state sequence to clearly express the risk behavior type of each path's multi-relation diffusion edge within the diffusion path.

[0164] Furthermore, for hidden diffusion edges, the system determines the state support corresponding to the hidden diffusion edge based on the business affiliation support judgment result, historical co-visit support judgment result, sensitivity level change relationship judgment result, modulated high-risk evidence, low-risk evidence, and gating conflict degree. When at least one of the business affiliation support judgment result and the historical co-visit support judgment result is false, and the sensitivity level change relationship judgment result is true, and the modulated high-risk evidence is greater than the low-risk evidence, the system increases the state support corresponding to the hidden diffusion edge; when the gating conflict degree increases, the system further increases the state support corresponding to the hidden diffusion edge. If the state support corresponding to the hidden diffusion edge has the largest value in the normalized state support vector after normalization, the system determines the edge state of the corresponding path multi-relation diffusion edge as a hidden diffusion edge.

[0165] S505: Based on the low-risk evidence, the modulated high-risk evidence, and the gating conflict degree, determine the state support degree of each mutually exclusive edge state corresponding to the multi-relation diffusion edge of the path, and normalize each state support degree to obtain a normalized state support degree vector.

[0166] In S505, for each path-multiple-relation diffusion edge, the system calculates the state support corresponding to stable business edges, low-access business-domain edges, sensitive transition edges, permission out-of-bounds edges, controlled output edges, and hidden diffusion edges. State support is jointly determined by low-risk evidence, modulated high-risk evidence, and gating conflict degree. When low-risk evidence is enhanced, the state support of stable business edges and low-access business-domain edges is more easily improved; when modulated high-risk evidence and gating conflict degree are enhanced, the state support of sensitive transition edges, permission out-of-bounds edges, controlled output edges, and hidden diffusion edges is more easily improved.

[0167] For example, the system generates a normalized state support vector according to the following formula and determines the edge state corresponding to the multi-relation diffusion edge of the path:

[0168]

[0169]

[0170]

[0171] in, Indicates the state number of the mutual exclusion edge. This represents the state number used to traverse all mutually exclusive edge states in the normalized calculation.

[0172] Represents a path with multiple relation diffusion edges Corresponding to the Normalized state support of a mutually exclusive edge state;

[0173] This represents the total number of mutually exclusive edge states. In this embodiment, The total number of corresponding stable business edges, low-access business-domain edges, sensitive transition edges, permission out-of-bounds edges, controlled output edges, and hidden diffusion edges;

[0174] Represents a path with multiple relation diffusion edges Corresponding modulated high-risk evidence;

[0175] Represents a path with multiple relation diffusion edges Corresponding low-risk evidence;

[0176] Represents a path with multiple relation diffusion edges Corresponding gating conflict level;

[0177] Indicates the first The influence coefficient of a mutually exclusive edge state on the state of modulated high-risk evidence;

[0178] Indicates the first The influence coefficient of a mutually exclusive edge state on the state of low-risk evidence;

[0179] Indicates the first The state influence coefficient of each mutually exclusive edge state on the gating conflict degree;

[0180] , , They represent the first The state influence coefficients of each mutually exclusive edge state on the modulated high-risk evidence, low-risk evidence, and gated conflict degree are used to traverse all mutually exclusive edge states in the denominator and form a normalized benchmark.

[0181] Represents a path with multiple relation diffusion edges The corresponding normalized state support vector;

[0182] Represents a path with multiple relation diffusion edges The corresponding edge state.

[0183] Specifically, the influence coefficients of each state , , The influence coefficients of the state of mutually exclusive edges are determined based on the correspondence between the modulated high-risk evidence, low-risk evidence, and gating conflict degree. Among them, the influence coefficients of the state of low-risk evidence corresponding to stable business edges and low co-access edges in the same business domain are higher than the influence coefficients of the state of high-risk evidence. The influence coefficients of the state of high-risk evidence and the state of gating conflict degree corresponding to sensitive transition edges, permission overstepping edges, controlled output edges, and hidden diffusion edges are higher than the influence coefficients of the state of low-risk evidence.

[0184] This formula allows the system to transform modulated high-risk evidence, low-risk evidence, and gated conflict degrees into normalized state support over multiple mutually exclusive edge states. The normalization process creates a comparable state support distribution for multiple state support values ​​corresponding to multi-relation diffusion edges along the same path, thus providing a basis for S506 to determine edge states.

[0185] S506: The mutually exclusive edge state corresponding to the state with the largest value in the normalized state support vector is determined as the edge state of the corresponding path multi-relation diffusion edge.

[0186] In S506, the system reads the normalized state support vector obtained in S505 and compares the values ​​of the support for each state in the normalized state support vector. The system determines the edge state corresponding to the mutex edge with the largest support value as the edge state of the corresponding path multi-relation diffusion edge. For example, when the state support value corresponding to the stable business edge is the largest, the system determines the edge state of the corresponding path multi-relation diffusion edge as the stable business edge; when the state support value corresponding to the permission out-of-bounds edge is the largest, the system determines the edge state of the corresponding path multi-relation diffusion edge as the permission out-of-bounds edge.

[0187] When the normalized state support vector contains the same maximum state support, the system selects the mutually exclusive edge state that appears later in the list of mutually exclusive edge states in S504 as the edge state of the corresponding path multi-relation diffusion edge. This ensures that mutually exclusive edge states with stronger risk performance are prioritized for output under the same state support condition. Through S506, each path multi-relation diffusion edge is assigned a specific edge state.

[0188] S507: According to the arrangement order of the multi-relation diffusion edges in the access diffusion path, determine the edge state of each multi-relation diffusion edge in turn to obtain the edge state sequence.

[0189] In S507, the system executes S501 to S506 sequentially according to the order of the multi-relation diffusion edges in the access diffusion path, obtaining the edge state corresponding to each multi-relation diffusion edge. Subsequently, the system arranges the edge states corresponding to each multi-relation diffusion edge in the order of the access diffusion path direction, obtaining the edge state sequence of the access diffusion path.

[0190] Each edge state in the edge state sequence corresponds to a multi-relation diffusion edge in the access diffusion path, and the order of arrangement is consistent with the access diffusion path formed by the target user in the current detection period. Through S501 to S507, high-risk evidence and low-risk evidence in the conflict evidence vector are converted into gated conflict degree and normalized state support vector, and further form an edge state sequence. After reading the edge state sequence in step 60, the path risk state of the access diffusion path is transferred, and the protection control state, the set of controlled data objects, and the protection control boundary are updated in conjunction.

[0191] In one embodiment, S601-S607 are described as follows:

[0192] S601: Traverse the edge state sequence along the direction of the access diffusion path. When a sensitive transition edge, permission out-of-bounds edge, controlled output edge, or hidden diffusion edge is identified, update the controlled data object set according to the data object nodes associated with the corresponding path multi-relation diffusion edge, and transfer the path risk state of the access diffusion path according to the identified edge state.

[0193] In S601, the system reads the edge states sequentially from the edge state sequence according to the order in which the multi-relationship diffusion edges are arranged in the access diffusion path. The edge state sequence is obtained from S507, and each edge state in the edge state sequence corresponds to a multi-relationship diffusion edge in the access diffusion path. During the traversal, the system maps the currently read edge state to stable business edges, low-common-access edges within the same business domain, sensitive transition edges, permission out-of-bounds edges, controlled output edges, and hidden diffusion edges to determine the impact of the current multi-relationship diffusion edge on the path risk state.

[0194] When the system identifies a stable business edge, it indicates that the current path's multi-relationship diffusion edge primarily supports normal business access, and the system maintains a smooth transition of path risk status. When the system identifies a low-common-access edge within the same business domain, it indicates that although the current path's multi-relationship diffusion edge has a business domain relationship, historical common-access support is weak, and the system records a slight risk change in the path risk status. When the system identifies a sensitive transition edge, an edge with out-of-bounds permissions, a controlled output edge, or a hidden diffusion edge, the system uses the starting and ending data object nodes associated with the current path's multi-relationship diffusion edge as update objects in the controlled data object set, and transitions the path risk status based on the identified edge status.

[0195] For example, the system transfers the path risk status of the access propagation path according to the following formula, and updates the controlled data object set, protection control status, and protection control boundary accordingly:

[0196]

[0197]

[0198]

[0199]

[0200] in, This indicates the sequence number of the multi-relation diffusion edge in the access diffusion path;

[0201] Indicates the first in the access diffusion path Multiple paths with multiple relationships diffuse edge;

[0202] Represents a path with multiple relation diffusion edges The corresponding edge state is determined by S506 based on the normalized state support vector;

[0203] Represents a path with multiple relation diffusion edges The corresponding gating conflict level is obtained by S502 based on the difference between low-risk evidence and modulated high-risk evidence.

[0204] Indicates traversing to the th The path risk status after multi-relation diffusion edges along a path;

[0205] Representing edge state The corresponding path risk state transition coefficient is used to characterize the degree of influence of different edge states on the path risk state;

[0206] Indicates traversing to the th A controlled set of data objects after multi-relation diffusion edges along a path;

[0207] This represents the set merging operation;

[0208] Represents a path with multiple relation diffusion edges The associated start and end data object nodes;

[0209] This indicates that the edge state is included in the control decision value. When it is a sensitive transition edge, a permission out-of-bounds edge, a controlled output edge, or a hidden diffusion edge, make Entering the controlled data object set, when the edge state To ensure stable business edges or low-access edges within the same business domain, Do not Enter the controlled data object collection;

[0210] Indicates traversing to the th The risk value of the protection control state is updated after the multi-relation diffusion edge of the path;

[0211] Indicates traversing to the th Risk value of protection and control state after multi-relationship diffusion edge along a path;

[0212] Representing edge state The corresponding protection control state adjustment coefficient is used to characterize the degree of influence of different edge states on the protection control state;

[0213] This indicates that the edge state sequence has been traversed to the th... When multiple relationships spread along a path, the resulting continuous or alternating boundary overflow judgment results are considered. This applies when consecutive boundary overflow edges appear, or when hidden spread edges and boundary overflow edges alternate. Corresponds to a higher state adjustment effect;

[0214] This represents the influence coefficient of the continuous boundary crossing or alternating diffusion determination results on the protection control status.

[0215] Indicates traversing to the th The protection control boundary is updated after multi-relation diffusion edges along a path;

[0216] Indicates based on the updated set of controlled data objects and protection control status The boundary update function redefines the protection control boundary in the data object diffusion graph.

[0217] In the above formula, Used to transition the path risk state based on the edge state and the gating conflict degree; This is used to include the data object nodes associated with the corresponding path multi-relationship diffusion edge into the controlled data object set when sensitive transition edges, permission out-of-bounds edges, controlled output edges, or hidden diffusion edges are identified. Used to update the protection control status based on edge status, gating conflict degree, and the results of continuous boundary crossing or alternating diffusion determination; This is used to redetermine the protection control boundary based on the updated set of controlled data objects and the protection control status. Through the above formula, the path risk state transition result can directly affect the linked updates of the set of controlled data objects, the protection control status, and the protection control boundary.

[0218] S602: When the permission over-boundary edge appears consecutively in the edge state sequence, or when the hidden diffusion edge and the permission over-boundary edge appear alternately in the edge state sequence, the protection control state is improved.

[0219] In S602, the system records the order in which permission-out-of-bounds edges and hidden diffusion edges appear while traversing the edge state sequence. When multiple permission-out-of-bounds edges are read consecutively, the system determines that the target user is continuously approaching or exceeding the range supported by the permission source information in the access diffusion path, thereby improving the protection control state. When the system identifies that hidden diffusion edges and permission-out-of-bounds edges alternate in adjacent edge states, the system determines that the target user's access behavior simultaneously has implicit diffusion tendency and permission edge deviation characteristics, thereby improving the protection control state.

[0220] After the protection control state is improved, the system continues to use the updated protection control state to redetermine the protection control boundary during subsequent traversals. Therefore, continuous boundary crossings and alternating diffusion patterns in the edge state sequence can be promptly fed back to the protection control state, rather than being retained merely as static identification results within the current detection cycle.

[0221] S603: Redetermine the protection control boundary based on the updated protection control state and the set of controlled data objects.

[0222] In S603, the system reads the updated protection control status and controlled data object set from S601 and S602, and redefines the protection control boundary in the data object diffusion graph. The system first maps the data objects in the controlled data object set to data object nodes in the data object diffusion graph, and then determines the data object nodes covered by the protection control boundary and the multi-relationship diffusion edges based on the protection control status.

[0223] When the protection control status is raised, the system searches outwards along the data object nodes corresponding to the controlled data object set for multi-relationship diffusion edges with business affiliation, historical co-access relationships, and sensitivity level change relationships, and includes data object nodes with diffusion associations to the controlled data object set in the protection control boundary determination process. When the protection control status is not raised, the system mainly determines the protection control boundary based on the existing data object nodes in the controlled data object set. The redefined protection control boundary is used to represent the personalized protection control outer edge formed after the current path risk state transition, and serves as one of the inputs for determining the access diffusion path in the next detection cycle.

[0224] S604: Generate the data leakage risk identification result of the target user in the current detection period based on the path risk state transition result.

[0225] In S604, the system generates a data leakage risk identification result for the target user within the current detection period based on the path risk state transition result formed after traversing the complete edge state sequence. The path risk state transition result includes the edge state corresponding to each path multi-relation diffusion edge in the access diffusion path, the change in gating conflict degree, the path risk state change, and the path multi-relation diffusion edge record that triggers the update of the controlled data object set.

[0226] The system determines whether a target user exhibits sensitivity level transitions, permission deviations, controlled data output tendencies, or hidden diffusion tendencies within the current detection period based on the path risk state transition results, and writes the corresponding judgments into the data leakage risk identification results. The data leakage risk identification results characterize the risk manifestation type and degree of risk change of the target user's continuous access behavior within the current detection period, providing a basis for generating protection control results.

[0227] Furthermore, the system reads records that do not form intra-graph diffusion connections and writes the adjacent data object nodes, corresponding access operation types, and access times in the records that do not form intra-graph diffusion connections into the data leakage risk identification results. This is used to indicate that there are continuous access relationships within the current detection period that are not carried by multi-relation diffusion edges in the data object diffusion graph.

[0228] S605: Generate protection control results based on the updated protection control state, the set of controlled data objects, and the protection control boundary.

[0229] In S605, the system generates protection control results based on the updated protection control status, the set of controlled data objects, and the protection control boundary. The protection control results describe the data object range constraints, permitted operation type constraints, and data output method constraints that subsequent access actions must be subject to. The system designates data objects in the set of controlled data objects as key protection objects, uses the updated protection control boundary as the outer edge constraint of the access diffusion path, and determines the constraint strength of the protection control results based on the protection control status.

[0230] When the protection control status is low, the protection control results can primarily limit high-risk access operation types to data objects within the controlled data object set. When the protection control status is high, the protection control results can further limit access propagation paths that cross the protection control boundary and impose stricter constraints on data output methods. The protection control results, together with the data leakage risk identification results, constitute the data leakage risk identification and protection control results for the current detection cycle.

[0231] S606: The updated protection control state, the set of controlled data objects, and the protection control boundary are used as inputs for determining the protection control boundary and access diffusion path in the next detection cycle.

[0232] In S606, the system writes the protection control status, the set of controlled data objects, and the protection control boundary obtained at the end of the current detection cycle into the status record corresponding to the target user. The status record is read at the beginning of the next detection cycle to determine the protection control boundary of the next detection cycle and participate in the determination of the access diffusion path in the next detection cycle.

[0233] Specifically, after acquiring new access logs in the next detection cycle, the system still generates access behavior chains and constructs a data object diffusion graph. Simultaneously, it reads the updated protection control status, controlled data object set, and protection control boundary from the current detection cycle. The updated protection control status influences the protection control boundary range in the next detection cycle, the updated controlled data object set determines the key protected data objects in the next detection cycle, and the updated protection control boundary determines whether the access diffusion path in the next detection cycle crosses the personalized protection control boundary. Through the continuation of status records, the path risk state transition results of the current detection cycle can influence subsequent access behavior analysis.

[0234] S607: When a target user accesses a data object in the controlled data object set during the next detection cycle, or when the access diffusion path formed by the target user during the next detection cycle crosses the updated protection control boundary, the scope of data objects accessed by the target user, the allowed operation type, or the data output method shall be constrained according to the protection control result.

[0235] In S607, the system continuously reads the target user's access behavior during the next detection cycle. When the target user accesses a data object in the controlled data object set, the system constrains the scope of data objects accessed by the target user, the allowed operation types, or the data output methods based on the protection control results. When the access diffusion path formed by the target user in the next detection cycle crosses the updated protection control boundary, the system also executes access constraints based on the protection control results.

[0236] Access constraints can include restricting target users from continuing to access data objects that have a diffusion relationship with the controlled data object set; restricting target users from performing access operations such as downloading, copying, exporting, and forwarding on controlled data objects; or restricting target users from processing data objects through data output methods such as external transmission, batch output, and cross-system transmission. After the system executes access constraints, it writes the constraint execution status into the access log of the next detection cycle, enabling subsequent detection cycles to continue to identify and protect against data leakage risks based on access behavior chains, data object diffusion graphs, edge state sequences, and path risk state transition results.

[0237] Reference Figure 2 , Figure 2 This is a schematic diagram of the data leakage risk identification system based on access behavior analysis provided by the present invention. The system includes:

[0238] The graph construction module 210 obtains the target user's access logs, data object attribute information, job information, permission source information, controlled data object set and protection control status within the current detection period, generates access behavior chain and constructs a data object diffusion graph including data object nodes and multi-relation diffusion edges;

[0239] The boundary determination module 220 determines the permission coverage boundary based on the permission source information and the protection control boundary based on the protection control status and the path risk status transition result of the previous detection cycle.

[0240] The evidence generation module 230 maps the access behavior chain to a data object diffusion graph, determines the access diffusion path and the path multi-relation diffusion edges that the path passes through, and generates a conflict evidence vector including high-risk evidence and low-risk evidence based on the path multi-relation diffusion edges.

[0241] The gating factor generation module 240 generates a dual-boundary coupling gating factor based on the first boundary distance of the path multi-relation diffusion edge relative to the permission coverage boundary, the second boundary distance relative to the protection control boundary, and the current protection control state.

[0242] The edge state determination module 250 performs nonlinear gated modulation on high-risk evidence based on the dual-boundary coupling gate factor, calculates the gated conflict degree based on the low-risk evidence and the modulated high-risk evidence, and generates a normalized state support vector of the path multi-relation diffusion edge on multiple mutually exclusive edge states based on the gated conflict degree, thereby determining the edge state sequence of the access diffusion path.

[0243] The transfer control module 260 transfers the path risk status of the access diffusion path according to the edge state sequence, and updates the protection control status, the set of controlled data objects and the protection control boundary in conjunction with it, generating data leakage risk identification and protection control results, and constraining the subsequent access behavior of the target user in the next detection cycle.

[0244] The system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0245] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0246] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions will not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for identifying data leakage risks based on access behavior analysis, characterized in that, Includes the following steps: S1: Obtain the target user's access logs, data object attribute information, job information, permission source information, controlled data object set and protection control status within the current detection period, generate access behavior chain and construct a data object diffusion graph including data object nodes and multi-relation diffusion edges; S2: Determine the permission coverage boundary based on the permission source information, and determine the protection control boundary based on the protection control status and the path risk status transition result of the previous detection cycle; S3: Map the access behavior chain to the data object diffusion graph, determine the access diffusion path and the path multi-relation diffusion edge that the path passes through, and generate a conflict evidence vector including high-risk evidence and low-risk evidence based on the path multi-relation diffusion edge. S4: Generate a dual-boundary coupling gating factor based on the first boundary distance of the path multi-relation diffusion edge relative to the permission coverage boundary, the second boundary distance relative to the protection control boundary, and the current protection control state; S5: Perform nonlinear gated modulation on high-risk evidence based on the dual-boundary coupling gated factor, calculate the gated conflict degree based on the low-risk evidence and the modulated high-risk evidence, and generate a normalized state support vector of the path multi-relation diffusion edge on multiple mutually exclusive edge states based on the gated conflict degree, and determine the edge state sequence of the access diffusion path. S6: Based on the edge state sequence, the path risk state of the access diffusion path is transferred, and the protection control state, the set of controlled data objects and the protection control boundary are updated in conjunction to generate the data leakage risk identification and protection control result, and the subsequent access behavior of the target user is constrained in the next detection cycle.

2. The data leakage risk identification method based on access behavior analysis according to claim 1, characterized in that, The process of generating access behavior chains and constructing a data object diffusion graph including data object nodes and multi-relation diffusion edges specifically involves: The access logs are sorted according to the access time, and an access behavior chain is generated based on the data object identifier, access operation type, and access time in the access logs. Data object nodes are determined based on the data object attribute information, and multi-relationship diffusion edges are generated based on the business affiliation, historical co-access, and sensitivity level change relationships among the data object nodes. The data object nodes and multi-relation diffusion edges are associated to obtain a data object diffusion graph that includes data object nodes and multi-relation diffusion edges.

3. The data leakage risk identification method based on access behavior analysis according to claim 1, characterized in that, The step of determining the permission coverage boundary based on the permission source information and determining the protection control boundary based on the protection control status and the path risk status transition result of the previous detection cycle specifically involves: The permission source information is mapped to the data object nodes and multi-relationship diffusion edges in the data object diffusion graph to determine the data object nodes and multi-relationship diffusion edges that the target user has access to in the current detection period, and the permission coverage boundary is determined based on the data object nodes and multi-relationship diffusion edges that have access to the data object nodes. Based on the path risk state transition results of the previous detection cycle, determine the data object nodes that need to be included in protection control; Based on the data object nodes, protection control states, and controlled data object sets to be included in the protection control as needed, the protection control boundaries are determined in the data object diffusion diagram.

4. The data leakage risk identification method based on access behavior analysis according to claim 1, characterized in that, The step of mapping the access behavior chain to a data object diffusion graph, determining the access diffusion path and the path multi-relation diffusion edges traversed by the path, and generating a conflict evidence vector including high-risk evidence and low-risk evidence based on the path multi-relation diffusion edges, specifically involves: The data object identifiers in the access behavior chain are matched with the data object nodes in the data object diffusion graph to obtain the access node sequence; The access diffusion path is determined based on the multi-relation diffusion edges between adjacent data object nodes in the access node sequence, and the multi-relation diffusion edges that the access diffusion path actually passes through in the data object diffusion graph are determined as path multi-relation diffusion edges. Based on the business affiliation relationship, historical co-access relationship, sensitivity level change relationship, permission source information, access operation type, controlled data object set and protection control status corresponding to the multi-relation diffusion edge of the path, high-risk evidence and low-risk evidence are generated. According to the order of the multi-relation diffusion edges in the access diffusion path, high-risk evidence and low-risk evidence are combined into a conflict evidence vector.

5. The data leakage risk identification method based on access behavior analysis according to claim 1, characterized in that, The generation of the dual-boundary coupling gating factor specifically involves: The first boundary distance is determined based on the number of multi-relation diffusion edges traversed between the path multi-relation diffusion edge and the permission coverage boundary; the second boundary distance is determined based on the number of multi-relation diffusion edges traversed between the path multi-relation diffusion edge and the protection control boundary. Determine the current protection control status risk value based on the protection control status; A first boundary proximity value is generated based on the first boundary distance, and a second boundary proximity value is generated based on the second boundary distance. Multiplicative coupling is performed based on the first boundary proximity value and the second boundary proximity value to obtain a multiplicative coupling result. The multiplicative coupling result is then fused with the risk value of the current protection control state to generate a dual-boundary coupling gating factor corresponding to the multi-relationship diffusion edge of the path. Specifically, when the distance between the first boundary and the distance between the second boundary decrease, the multiplicative coupling result increases; when the risk value of the current protection control state increases, the dual-boundary coupling gating factor is increased.

6. The data leakage risk identification method based on access behavior analysis according to claim 5, characterized in that, The step of performing nonlinear gated modulation on high-risk evidence based on a dual-boundary coupling gate factor, and calculating the gated conflict degree based on the low-risk evidence and the modulated high-risk evidence, specifically involves: When the dual-boundary coupling gate factor corresponding to the multi-relation diffusion edge of the path increases, the high-risk evidence is enhanced exponentially to obtain modulated high-risk evidence. Based on the difference between the low-risk evidence and the modulated high-risk evidence, the gating conflict degree corresponding to the multi-relation diffusion edge of the path is determined; When the difference between the low-risk evidence and the modulated high-risk evidence increases, the gating conflict degree corresponding to the multi-relation diffusion edge of the path is increased.

7. The data leakage risk identification method based on access behavior analysis according to claim 6, characterized in that, The step of generating a normalized state support vector for the multi-relation diffusion edge of the path based on the gated conflict degree in multiple mutually exclusive edge states, and determining the edge state sequence of the access diffusion path, specifically involves: The multiple mutually exclusive edge states include stable business edge, business domain low-access edge, sensitive transition edge, permission out-of-bounds edge, controlled output edge, and hidden diffusion edge. Based on the low-risk evidence, the modulated high-risk evidence, and the gating conflict degree, the state support degree of each mutually exclusive edge state corresponding to the multi-relation diffusion edge of the path is determined, and the state support degree is normalized to obtain the normalized state support degree vector. The mutex edge state corresponding to the state with the largest value in the normalized state support vector is determined as the edge state of the corresponding path multi-relation diffusion edge. According to the order in which the multi-relation diffusion edges of the path are arranged in the access diffusion path, the edge states of each multi-relation diffusion edge of the path are determined in sequence to obtain the edge state sequence.

8. The data leakage risk identification method based on access behavior analysis according to claim 7, characterized in that, The step of transitioning the path risk state of the access diffusion path based on the edge state sequence, and simultaneously updating the protection control state, the set of controlled data objects, and the protection control boundary, specifically involves: Traverse the edge state sequence along the direction of the access diffusion path; When sensitive transition edges, permission out-of-bounds edges, controlled output edges, or hidden diffusion edges are identified, the controlled data object set is updated according to the data object nodes associated with the corresponding multi-relation diffusion edge, and the path risk status of the access diffusion path is transferred according to the identified edge status. When the permission out-of-bounds edge appears consecutively in the edge state sequence, or when the hidden diffusion edge and the permission out-of-bounds edge appear alternately in the edge state sequence, the protection control state is improved. The protection control boundary is redefined based on the updated protection control state and the set of controlled data objects.

9. The data leakage risk identification method based on access behavior analysis according to claim 8, characterized in that, The generation of data leakage risk identification and protection control results, and the constraint of target users' subsequent access behavior in the next detection cycle, specifically includes: Based on the path risk state transition results, generate the data leakage risk identification results for the target user within the current detection period; The protection control result is generated based on the updated protection control state, the set of controlled data objects, and the protection control boundary. The updated protection control state, the set of controlled data objects, and the protection control boundary are used as inputs for determining the protection control boundary and access diffusion path in the next detection cycle; When a target user accesses a data object in the controlled data object set during the next detection cycle, or when the access diffusion path formed by the target user during the next detection cycle crosses the updated protection control boundary, the scope of data objects accessed by the target user, the allowed operation types, or the data output methods are constrained according to the protection control results.

10. A data breach risk identification system based on access behavior analysis, characterized in that, The system for implementing the data leakage risk identification method based on access behavior analysis as described in any one of claims 1 to 9, the system comprising: The graph construction module obtains the target user's access logs, data object attribute information, job information, permission source information, controlled data object set and protection control status within the current detection period, generates access behavior chain and constructs a data object diffusion graph including data object nodes and multi-relation diffusion edges; The boundary determination module determines the permission coverage boundary based on the permission source information and the protection control boundary based on the protection control status and the path risk status transition result of the previous detection cycle. The evidence generation module maps the access behavior chain to a data object diffusion graph, determines the access diffusion path and the path multi-relation diffusion edges that the path passes through, and generates a conflict evidence vector including high-risk evidence and low-risk evidence based on the path multi-relation diffusion edges. The gating factor generation module generates a dual-boundary coupling gating factor based on the first boundary distance of the path multi-relation diffusion edge relative to the permission coverage boundary, the second boundary distance relative to the protection control boundary, and the current protection control state. The edge state determination module performs nonlinear gated modulation on high-risk evidence based on the dual-boundary coupling gate factor, calculates the gated conflict degree based on the low-risk evidence and the modulated high-risk evidence, and generates a normalized state support vector of the path multi-relation diffusion edge on multiple mutually exclusive edge states based on the gated conflict degree, thereby determining the edge state sequence of the access diffusion path. The transfer control module transfers the path risk status of the access diffusion path according to the edge state sequence, and updates the protection control status, the set of controlled data objects and the protection control boundary in a coordinated manner, generating data leakage risk identification and protection control results, and restricting the subsequent access behavior of the target user in the next detection cycle.

Images