Sensitive information identification method and apparatus, network device, medium, and program product

Abstract

The application provides a sensitive information identification method and device, network equipment, a medium and a program product. The method comprises: performing semantic coding processing on a target text to obtain a global semantic representation of the target text and a context vector representation of a word element; performing classification identification processing on sensitive information in the target text according to the global semantic representation to obtain a category identification result; performing sequence labeling processing on the sensitive information in the target text according to the context vector representation to obtain a first identification result; performing sequence labeling processing on the sensitive information in the target text according to the context vector representation to obtain a first identification result of the sensitive information in the target text; and cross- verifying the category of the sensitive information in the first identification result and the category identification result to update the first identification result. The method provided in the embodiments of the application has high identification accuracy and efficiency for sensitive information.

Description

Technical Field

[0001] This invention relates to the field of data security technology, and in particular to a method, apparatus, network device, medium, and program product for identifying sensitive information. Background Technology

[0002] With the rapid development of the digital economy, the global volume of data is exploding, including a large amount of sensitive information involving personal privacy, trade secrets, and public safety. The identification of sensitive information has a profound impact on the online environment, user psychology, and social order.

[0003] Existing methods for identifying sensitive information improve accuracy through fine-grained identification at the word segmentation level. However, they lack comprehensive coverage of sensitive information categories, only distinguishing between "sensitive information text" and "non-sensitive information text," without fine-grained classification of sensitive information. This makes it impossible to differentiate the processing methods for sensitive information of different sensitivity levels. Furthermore, they lack precise character-level location capabilities, making accurate desensitization difficult; they can only desensitize or retain the entire word segment. Moreover, relying solely on classification methods and lacking sequence labeling makes it impossible to handle entity boundaries and confusion with adjacent entities. Finally, both the accuracy and efficiency of identification are low. Summary of the Invention

[0004] The purpose of this invention is to provide a sensitive information identification method, device, network equipment, medium, and program product to solve the problem that the categories of sensitive information in the prior art are too broad and the positioning is inaccurate, resulting in low accuracy and efficiency in the identification of sensitive information.

[0005] To address the aforementioned technical problems, embodiments of the present invention provide a method for identifying sensitive information, comprising:

[0006] Semantic encoding is performed on the target text to obtain the global semantic representation and the context vector representation of the word units;

[0007] Based on the global semantic representation, sensitive information in the target text is classified and identified to obtain category identification results;

[0008] Based on the context vector representation, the sensitive information in the target text is subjected to sequence labeling processing to obtain the first identification result of the sensitive information in the target text;

[0009] Cross-validate the categories of sensitive information in the first identification result with the category identification result, and update the first identification result.

[0010] Optionally, before cross-validating the category of sensitive information in the first identification result with the category identification result, the method further includes:

[0011] If the category recognition result indicates that the target text contains sensitive information, the sensitive information in the target text is identified and matched according to a pre-set matching rule to obtain a rule matching result;

[0012] The first identification result and the rule matching result are fused and deduplicated according to a pre-set priority order to obtain the second identification result of sensitive information in the target text;

[0013] The process of cross-validating the category of sensitive information in the first identification result with the category identification result, and updating the first identification result, includes:

[0014] Cross-validate the categories of sensitive information in the second identification result with the category identification result, and update the second identification result.

[0015] Optionally, the step of cross-validating the category of sensitive information in the first identification result with the category identification result and updating the first identification result includes:

[0016] Cross-validate the category of sensitive information in the first identification result with the category identification result to obtain the verification result;

[0017] The first identification result is updated based on the verification result and the confidence level of the sensitive information in the first identification result.

[0018] Optionally, the step of classifying and identifying sensitive information in the target text based on the global semantic representation to obtain category identification results includes:

[0019] Based on a number of predefined sensitive information categories, the global semantic representation is regularized and subjected to category dimension mapping to obtain category scores for the various sensitive information categories. The category scores are proportional to the tendency of the target text to include sensitive information of the corresponding category.

[0020] The category scores of each of the sensitive information categories are compared with preset thresholds to generate category recognition results. The category recognition results include recognition results and / or category information. The recognition results are used to indicate whether the target text contains sensitive information, and the category information is used to indicate the categories of sensitive information included in the target text.

[0021] Optionally, the step of performing sequence labeling processing on the sensitive information in the target text based on the context vector representation to obtain a first identification result of the sensitive information in the target text includes:

[0022] Based on the predefined start-inner-outer BIO tags, the context vector representation of the word is linearly mapped to obtain the emission score of each word corresponding to each tag.

[0023] Based on the pre-trained transition matrix and the emission score, the tag sequence corresponding to the target text is determined;

[0024] Based on the tag sequence, entities of sensitive information in the target text are extracted, wherein the entities of sensitive information include at least one of the following: sensitive information type information, text information, start character position, end character position, and confidence level;

[0025] Based on the entities of the sensitive information, a first identification result of the sensitive information in the target text is generated.

[0026] Optionally, the step of identifying and matching sensitive information in the target text according to pre-set matching rules to obtain rule matching results includes:

[0027] According to a pre-set regular expression rule library, sensitive information in the target text is identified and matched to obtain rule matching results. The regular expression rule library includes multiple matching rules and the mapping relationship between the matching rules and the categories of the sensitive information.

[0028] The sensitive information in the rule matching result is verified by a verification algorithm, and the rule matching result is then updated.

[0029] Optionally, the step of fusing and deduplicating the first recognition result and the rule matching result according to a pre-set priority order to obtain a second recognition result of sensitive information in the target text includes:

[0030] According to a pre-set priority order, sensitive information from the first identification result and the rule matching result is written sequentially to obtain the initial identification result;

[0031] Obtain the starting position of the sensitive information in the initial recognition result in the target text;

[0032] Based on the starting position, the overlapping sensitive information in the initial recognition result is deduplicated to obtain the second recognition result of the sensitive information in the target text.

[0033] Optionally, the step of sequentially writing sensitive information from the first identification result and the rule matching result according to a pre-set priority order to obtain an initial identification result includes:

[0034] According to predefined grading rules, the sensitivity level of each sensitive information in the rule matching result is determined, wherein the sensitivity level includes a first sensitivity level and a second sensitivity level, and the grading rules include the mapping relationship between the category of the sensitive information and the sensitivity level;

[0035] The order in which sensitive information is written in the first identification result and the rule matching result is determined according to the order of priority from high to low, wherein the priority of the rule matching result of the first sensitivity level is higher than the priority of the first identification result, and the priority of the first identification result is higher than the priority of the rule matching result of the second sensitivity level.

[0036] According to the writing order, sensitive information from the first identification result and the rule matching result is written sequentially to obtain the initial identification result.

[0037] This invention also provides a sensitive information identification device, comprising:

[0038] The first processing module is used to perform semantic encoding processing on the target text to obtain the global semantic representation and the context vector representation of the word units of the target text;

[0039] The second processing module is used to classify and identify sensitive information in the target text based on the global semantic representation to obtain category identification results;

[0040] The third processing module is used to perform sequence labeling processing on the sensitive information in the target text according to the context vector representation to obtain the first recognition result;

[0041] The first verification module is used to cross-verify the category of sensitive information in the first identification result with the category identification result, and update the first identification result.

[0042] This invention also provides a network device, including: a processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the sensitive information identification method as described in any of the preceding embodiments.

[0043] This invention also provides a readable storage medium, comprising: a program stored on the readable storage medium, wherein when the program is executed by a processor, it implements the steps of the sensitive information identification method as described in any of the preceding claims.

[0044] This invention also provides a computer program product, including computer instructions, which, when executed by a processor, implement the steps of the sensitive information identification method as described in any of the preceding embodiments.

[0045] At least one of the above technical solutions of the present invention has the following beneficial effects:

[0046] The above scheme provides a method for identifying sensitive information. First, the target text is semantically encoded to obtain a global semantic representation and a context vector representation of the word elements. Based on the global semantic representation, sensitive information in the target text is classified and identified to obtain a category identification result. Based on the context vector representation, the sensitive information in the target text is sequence-labeled to obtain a first identification result. The category of the sensitive information in the first identification result is cross-validated with the category identification result to update the first identification result. This method, by performing classification and identification on the global semantic representation and sequence-labeling on the context vector representation of the word elements, can accurately identify the category and location of sensitive information in the target text, effectively ensuring the accuracy and efficiency of sensitive information identification. Furthermore, the cross-validation of the category of the sensitive information in the first identification result with the category identification result further improves the accuracy of sensitive information identification. Attached Figure Description

[0047] Figure 1 This is a flowchart illustrating the sensitive information identification method according to an embodiment of the present invention;

[0048] Figure 2 This is one of the structural schematic diagrams of the multi-label classification model in an embodiment of the present invention;

[0049] Figure 3 This is the second schematic diagram of the structure of the multi-label classification model in this embodiment of the invention;

[0050] Figure 4 This is a schematic diagram of the process for sequence labeling of sensitive information according to an embodiment of the present invention;

[0051] Figure 5 This is a flowchart illustrating the sensitive information identification method according to an embodiment of the present invention;

[0052] Figure 6 This is a schematic diagram of the structure of a sensitive information identification device according to an embodiment of the present invention. Detailed Implementation

[0053] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0054] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0055] like Figure 1 As shown, this embodiment of the invention provides a method for identifying sensitive information, including:

[0056] Step S101: Perform semantic encoding processing on the target text to obtain the global semantic representation and context vector representation of the word units of the target text;

[0057] Step S102: Based on the global semantic representation, perform classification and recognition processing on the sensitive information in the target text to obtain the category recognition result;

[0058] Step S103: Based on the context vector representation, perform sequence labeling processing on the sensitive information in the target text to obtain the first recognition result;

[0059] Step S104: Cross-validate the category of sensitive information in the first identification result with the category identification result, and update the first identification result.

[0060] This invention provides a method for identifying sensitive information. First, the target text is semantically encoded to obtain a global semantic representation and a context vector representation of the word elements. Based on the global semantic representation, sensitive information in the target text is classified and identified to obtain a category identification result. Based on the context vector representation, the sensitive information in the target text is sequence-labeled to obtain a first identification result. The category of the sensitive information in the first identification result is cross-validated with the category identification result to update the first identification result. The method's classification and identification processing of the global semantic representation and the sequence-labeling processing of the context vector representation of the word elements can accurately identify the category and location of sensitive information in the target text, effectively ensuring the accuracy and efficiency of sensitive information identification. Furthermore, the cross-validation of the category of the sensitive information in the first identification result with the category identification result further improves the accuracy of sensitive information identification.

[0061] One optional implementation involves performing semantic encoding on the target text to obtain a global semantic representation and a context vector representation of the word units, including:

[0062] First, the data in the target text is preprocessed to convert the raw text into a format that the model can process. Specifically, the text is segmented to obtain a sequence of tokens. The Bidirectional Encoder Representations from Transformers (BERT) tokenizer is then used to convert the text into a list of tokens, while generating input_ids (vocabulary indices) and attention_masks (effective position markers).

[0063] Then, semantic encoding is performed on the input_ids and attention_mask to extract deep semantic features of the text, providing a foundation for subsequent recognition. Specifically, the obtained input_ids and attention_mask are input into BERT. BERT uses a multi-layer bidirectional transformer (Transformer) structure to capture the contextual semantic information of each token, generating a global semantic representation of the target text and a context vector representation of the token.

[0064] In one embodiment, optionally, before cross-validating the category of sensitive information in the first identification result with the category identification result, the method further includes:

[0065] If the category recognition result indicates that the target text contains sensitive information, the sensitive information in the target text is identified and matched according to a pre-set matching rule to obtain a rule matching result;

[0066] The first identification result and the rule matching result are fused and deduplicated according to a pre-set priority order to obtain the second identification result of sensitive information in the target text;

[0067] The process of cross-validating the category of sensitive information in the first identification result with the category identification result, and updating the first identification result, includes:

[0068] Cross-validate the categories of sensitive information in the second identification result with the category identification result, and update the second identification result.

[0069] In this embodiment of the invention, when the classification and recognition result in step S102 indicates that the target text contains sensitive information, in order to further improve the recognition accuracy of sensitive information and supplement any sensitive information that may be missed in the first recognition result, after step S103 and before step S104, the sensitive information in the target text is identified again using matching rules to obtain rule matching results. Finally, the rule matching results and the first recognition result are fused and deduplicated to generate a second recognition result, ensuring the accuracy of sensitive information recognition. In this case, step S104 is adaptively changed to: cross-validating the category of sensitive information in the second recognition result with the category recognition result, updating the second recognition result, and the updated second recognition result is the final recognition result of sensitive information in the target text. Optionally, in one implementation, the cross-validation of the category of sensitive information in the first recognition result with the category recognition result and updating the first recognition result includes:

[0070] Cross-validate the category of sensitive information in the first identification result with the category identification result to obtain the verification result;

[0071] The first identification result is updated based on the verification result and the confidence level of the sensitive information in the first identification result.

[0072] In this embodiment of the invention, in order to improve the accuracy and reliability of the overall detection, the first identification result is cross-validated with the category identification result of the classification identification. If the entity type in the first identification result is in the category identification result, the confidence of the entity is increased. If the entity type in the first identification result is not in the category identification result but the confidence is high, the entity is retained. If the entity type in the first identification result is not in the category identification result and the confidence is low, the confidence of the entity is reduced or the entity is discarded, thereby updating the first identification result.

[0073] It should be noted that the first identification result is the first identification result directly generated in step S103, or it can be replaced with the second identification result after the above result fusion. The specific decision depends on the actual situation. Specifically, if the above rule matching identification and result fusion method is included after step S103 and before step S104, and a second identification result is generated, then the first identification result in this embodiment needs to be replaced with the second identification result for cross-validation, which can produce the same technical effect.

[0074] In one optional implementation, the present invention categorizes sensitive information into two main categories: personal information and commercial information. Specifically, personal information and commercial information are further subdivided into 27 categories, as shown in Table 1 below:

[0075] Table 1: Category Description of Sensitive Information

[0076]

[0077]

[0078] In one optional implementation, after obtaining the final identification result of the sensitive information in the target text, i.e., after step S104, the method further includes:

[0079] The final identification results output in step S104 are grouped according to entity type. Entities with category codes starting with P are classified as personal information, and entities with category codes starting with B are classified as business information.

[0080] The grouped results are returned to the user. The report contains all identified sensitive information and its details for subsequent auditing, de-identification, risk assessment and other applications.

[0081] In one embodiment, optionally, the step of classifying and identifying sensitive information in the target text based on the global semantic representation to obtain a category identification result includes:

[0082] Based on a number of predefined sensitive information categories, the global semantic representation is regularized and subjected to category dimension mapping to obtain category scores for the various sensitive information categories. The category scores are proportional to the tendency of the target text to include sensitive information of the corresponding category.

[0083] The category scores of each of the sensitive information categories are compared with preset thresholds to generate category recognition results. The category recognition results include recognition results and / or category information. The recognition results are used to indicate whether the target text contains sensitive information, and the category information is used to indicate the categories of sensitive information included in the target text.

[0084] In this embodiment of the invention, a method for identifying sensitive information categories is provided. First, based on predefined categories of sensitive information (such as...),... Figure 1As shown, the global semantic representation is processed to obtain category scores for multiple sensitive information categories. Then, the category scores of each sensitive information category are compared with preset thresholds. Sensitive information categories with category scores greater than the preset thresholds are identified as included in the target text; conversely, sensitive information categories with category scores less than or equal to the preset thresholds are identified as not included in the target text, generating category recognition results. The above sensitive information recognition method has the following advantages: First, it is based on global semantic representation, which consists of sentence-level semantic features. Compared to word-level representation, it has stronger contextual understanding capabilities, thus obtaining more accurate category recognition results. Second, the above method adopts a multi-label classification mechanism, supporting the simultaneous recognition of multiple categories of sensitive information. Third, the preset thresholds can be adjusted; through adaptive threshold adjustment, it can adapt to the security requirements of different industries and scenarios.

[0085] One optional implementation method employs a multi-label classification model to process the global semantic representation, obtaining the category identification results of sensitive information in the target text, wherein, for example... Figure 2 As shown, the structure of the multi-label classification model includes: a regularization layer, a classification layer, an activation layer, a decision layer, and an output layer. The specific implementation methods of each structure are as follows:

[0086] The regularization layer obtains the global semantic representation output in step S101, which has a dimension of 768. The global semantic representation is randomly deactivated (Dropout) and this layer reduces the model's dependence on specific features by randomly deactivating some neuron connections, thereby improving the model's generalization ability and robustness.

[0087] The classification layer maps the 768-dimensional semantic feature vector output by the regularization layer to a multi-dimensional classification space through a fully connected neural network. Taking Table 1 as an example, the 768-dimensional semantic feature vector is mapped to a 27-dimensional classification space. The mapping matrix used for mapping has a dimension of 768×27, and each output dimension corresponds to a sensitive information category. This layer outputs the original scores of 27 categories, reflecting the degree to which the text contains various types of sensitive information.

[0088] The activation layer applies a sigmoid function to the raw scores output by the classification layer, converting the scores into probability values ​​between 0 and 1. The sigmoid function's properties allow the probability of each category to be calculated independently, without affecting each other, making it suitable for multi-label classification scenarios. It should be noted that a piece of text can be simultaneously classified as containing multiple types of sensitive information.

[0089] The decision layer compares the probability values ​​output by the activation layer with a preset threshold to make classification decisions. Categories with probability values ​​exceeding the threshold are classified as positive, while those below the threshold are classified as negative. Positive categories are those containing sensitive information in the target text, and negative categories are those containing sensitive information in the target text. The preset threshold can be dynamically adjusted according to different application scenarios. By adjusting the threshold, accuracy and recall can be balanced to meet the security requirements of different scenarios.

[0090] The output layer generates and outputs category recognition results based on the positive and negative class results generated by the decision layer. The category recognition results include recognition results and / or category information. The recognition results are represented by Boolean values ​​to indicate whether the target text contains sensitive information. The category information is represented by a category list, which includes the categories of sensitive information detected in the target text and their confidence levels. If the category list is empty, it means that the target text does not contain sensitive information.

[0091] The multi-label classification model described above has a simple and efficient structure, fast inference speed, and a single detection time of about 10ms, which meets the requirements of real-time detection.

[0092] In one optional implementation, the multi-label classification model can perform step S101 in addition to step S102. Based on this, as follows: Figure 3 As shown, the structure of the multi-label classification model also includes an input layer and an encoding layer. The specific implementation methods of each structure are as follows:

[0093] The input layer retrieves the target text from the input.

[0094] The word segmentation layer processes the target text through word segmentation and encoding, converting it into a numerical representation that the model can recognize. The tokenizer converts the text into a list of tokens and generates input_ids (vocabulary indexes) and attention_mask (effective position markers) for subsequent semantic encoding.

[0095] The encoding layer uses a pre-trained Chinese BERT model as a feature extractor to semantically encode input_ids and attention_mask. Specifically, the BERT model contains a 12-layer Transformer structure, which captures the deep semantic features of the target text through a bidirectional attention mechanism to obtain the contextual semantic information of each token.

[0096] The pooling layer aggregates the contextual semantic information of the token to obtain a global semantic representation of the entire sentence with a dimension of 768. The output of the pooling layer is used as input to the regularization layer for processing.

[0097] In one embodiment, optionally, the step of performing sequence labeling processing on the sensitive information in the target text based on the context vector representation to obtain a first identification result of the sensitive information in the target text includes:

[0098] Based on the predefined start-inner-outer BIO tags, the context vector representation of the word is linearly mapped to obtain the emission score of each word corresponding to each tag.

[0099] Based on the pre-trained transition matrix and the emission score, the tag sequence corresponding to the target text is determined;

[0100] Based on the tag sequence, entities of sensitive information in the target text are extracted, wherein the entities of sensitive information include at least one of the following: sensitive information type information, text information, start character position, end character position, and confidence level;

[0101] Based on the entities of the sensitive information, a first identification result of the sensitive information in the target text is generated.

[0102] In this embodiment of the invention, an extended BIO annotation system is adopted to support accurate annotation of sensitive information of all categories, achieving precise character-level location of sensitive information and accurately annotating the category and start and end positions of each piece of sensitive information. Specifically, firstly, Begin-Inside-Outside (BIO) label prediction is performed on the context vector representation of the token to obtain the emission score of each tag corresponding to each word. Then, using a Conditional Random Field (CRF) layer and the Viterbi algorithm, the label sequence corresponding to the target text is determined based on the pre-trained transition matrix and the emission scores. The CRF maintains a label transition probability matrix (i.e., the transition matrix) to model the dependencies and transition rules between tags, and the Viterbi algorithm is used to decode the highest-scoring legitimate path, i.e., the globally optimal label sequence. Finally, based on the label sequence, the entities of sensitive information in the target text are extracted to generate the first recognition result.

[0103] In one optional implementation, the BIO labeling system supports 27 categories of sensitive information as shown in Table 1. The label set includes: "O" label to represent non-sensitive information, 30 labels for 15 categories of personal information, and 24 labels for 12 categories of business information. Each category of sensitive information includes two labels, B and I. Therefore, the total number of labels is 55, which is 27 categories multiplied by 2 plus 1. Taking personal information as an example, "B-P01" and "I-P01" represent the beginning and end of a name, "B-P02" and "I-P02" represent the beginning and end of an ID card number, "B-P03" and "I-P03" represent the beginning and end of a mobile phone number, and so on until "B-P15" and "I-P15" represent an IP address; taking business information as an example, "B-B01" and "I-B01" represent trade secrets, "B-B02" and "I-B02" represent financial data, and so on until "B-B12" and "I-B12" represent API keys.

[0104] In one optional implementation, the CRF layer learns a label transition probability matrix with dimensions 55 x 55, representing the transition score from any label to any other label. The CRF layer implements the following constraints: a first type of constraint prohibits illegal label transitions; specifically, illegal label transitions are prohibited according to pre-set prohibited label transition rules. The second type of constraint is a category consistency constraint; specifically, label transitions are allowed according to pre-set legal label transition rules. For allowed transition patterns, a positive score is assigned, with higher scores indicating a greater transition probability; for prohibited transition patterns, a negative score is assigned, indicating that the transition should not occur.

[0105] One alternative implementation method includes the following legal tag transfer rules:

[0106] First, O→O transition, used to indicate the continuation of a non-entity state; second, O→B-Pxx or O→B-Bxx transition, used to indicate the starting position of a new entity from a non-entity state; third, B-Pxx→I-Pxx transition, used to indicate that an entity of the same category moves from the starting position to an internal position; fourth, I-Pxx→I-Pxx transition, used to indicate the continuation of an entity's internal position; fifth, I-Pxx→O transition, used to indicate that an entity ends and returns to a non-entity state; sixth, I-Pxx→B-Pyy transition, used to indicate that an entity of a different category begins immediately after the end of an existing entity.

[0107] In one alternative implementation, to avoid generating illegal tag sequences, the CRF layer also sets prohibited tag transfer rules, including:

[0108] First, O→I-Pxx transfer prohibits direct entry into an entity's internal location from a non-entity state, because entities must start with a B tag; Second, B-P03→I-P01 transfer (example) prohibits B-to-I transfers between different categories, for example, the beginning of a phone number cannot be transferred to the internal location of a name; Third, I-P03→B-P01 transfer (example), although it is possible to transfer to the beginning of a new entity within an entity, in practical applications, there are usually separators or spaces between adjacent entities of different categories, so the score setting for this direct transfer is relatively low.

[0109] like Figure 4 As shown, the sequence labeling process in this invention will be described below through a specific embodiment:

[0110] Step S401, Regularization: Receive the context vector representation of the token, where each token corresponds to a 768-dimensional context representation vector. Input the context vector representation into the Dropout layer, and maintain the output shape as [batch size, sequence length, dimension], i.e., [batch_size, seq_len, 768].

[0111] Step S402: Calculate the emission score for each token corresponding to each tag. The emission score reflects the encoder's (e.g., BERT's) tendency to label the token as a certain tag. The specific method includes: obtaining the output of the Dropout layer and inputting it into a fully connected layer (also known as a linear transformation layer). The weight matrix of the fully connected layer has dimensions [768, 55], and the bias vector has dimensions

[55] . Through matrix multiplication and bias addition, the 768-dimensional vector is mapped to a 55-dimensional vector. Specifically, the 55 dimensions correspond to 55 tags: one O tag, and 27 types of sensitive information each correspond to two tags, B and I (27×2=54), for a total of 55 tags. The shape of the output emission score is [batch size, sequence length, number of tags], i.e., [batch_size, seq_len, 55], representing the emission score of each token corresponding to each tag.

[0112] Step S403: CRF layer modeling. The emission scores obtained in step S402 are input into the CRF layer. The CRF layer combines the emission scores with the current pattern for modeling and analysis. Specifically, the CRF layer maintains a label transition probability matrix with dimensions [55, 55], representing the score for transitioning from any label to any other label. The label transition probability matrix is ​​learned during training and is used to model the dependencies and constraint rules between labels. For example, it prohibits direct transitions from label O to label I, and prohibits transitions from B to I between different categories.

[0113] Step S404: Determine if the current mode is training mode. If it is training mode, proceed to step S405; otherwise, it is inference mode, proceed to step S406.

[0114] Step S405: The CRF layer calculates the CRF loss and outputs the loss value for training the model.

[0115] Step S406: Perform Viterbi decoding calculation. The CRF layer outputs the decoded label sequence, which is the highest-scoring legal path, i.e., the globally optimal sequence. The label sequence output in this step is the label identification (ID) sequence, for example: [0,0,1,2,2,0,...].

[0116] Step S407, tag ID conversion: convert the tag ID sequence into a tag name sequence. For example, ID 0 corresponds to 'O', ID 1 corresponds to 'B-P01', ID 2 corresponds to 'I-P01', ID 3 corresponds to 'B-P02', and so on. The tag ID sequence [0,0,1,2,2,0,...] is converted into the tag name sequence ['O','O','B-P01','I-P01','I-P01','O',...], with the same length as the token sequence.

[0117] Step S408: Extract the entity of sensitive information. Each entity contains type code information (type), text (text), the starting character position (start) in the target text, and the ending character position (end) in the target text.

[0118] Step S409, Position Mapping: Since the tokenizer may perform sub-segmentation on the text (e.g., "13912345678" may be segmented into multiple tokens), it is necessary to map the token-level positions back to the character positions of the original text of the target text. This step ensures that the entity positions correspond precisely to the original text, supporting subsequent precise de-identification operations.

[0119] Step S410: If the location mapping is accurate, output the first recognition result, which contains a list of all recognized sensitive information entities. Each entity contains: a type field (e.g., "P03" represents a mobile phone number), a text field (e.g., "13912345678"), a start field, an end field, and a confidence field. The confidence value is the probability value output by the model by default.

[0120] In one implementation, optionally, the step of identifying and matching sensitive information in the target text according to a pre-set matching rule to obtain a rule matching result includes:

[0121] According to a pre-set regular expression rule library, sensitive information in the target text is identified and matched to obtain rule matching results. The regular expression rule library includes multiple matching rules and the mapping relationship between the matching rules and the categories of the sensitive information.

[0122] The sensitive information in the rule matching result is verified by a verification algorithm, and the rule matching result is then updated.

[0123] In this embodiment of the invention, when the classification and recognition results indicate that the target text contains sensitive information, a rule engine is used for detection. Specifically, a pre-set regular expression rule library is used to perform pattern matching on the target text to obtain rule matching results. The rule library contains matching rules for various sensitive information categories. For successfully matched results, the corresponding verification algorithm is called to verify whether the corresponding sensitive information truly belongs to the sensitive information category, such as ID card verification code verification, bank card Luhn algorithm verification, etc. Only matching results that pass the verification are retained. The above method utilizes the high precision characteristics of rules to supplement the formatted sensitive information that may be missed in step S103.

[0124] The following are examples of matching rules from the regular expression rule base:

[0125] Domestic ID card number rules:

[0126] ^[1-9]\d{5}(18|19|20)\d{2}(0[1-9]|1[0-2])(0[1-9]|

[12] \d|3

[01] )\d{3}[\dXx]$.

[0127] Domestic bank card number rules: ^[1-9]\d{15,18}$.

[0128] Domestic mobile phone number rules: ^1[3-9]\d{9}$.

[0129] Domestic blue-plate civilian vehicle license plate rules:

[0130] ^[Beijing-Tianjin-Hebei-Shanxi-Inner Mongolia-Liaoning-Jilin-Heilongjiang-Shanghai-Suzhou-Zhejiang-Anhui-Fujian-Jiangxi-Shandong-Henan-Hubei-Hunan-Guangdong-Guangxi-Hainan-Sichuan-Guizhou-Yunnan-Tibet-Shaanxi-Gansu-Qinghai-Ningxia-Xinjiang][AZ]\d{5}$.

[0131] The following is an example illustrating the algorithm for verifying ID card numbers:

[0132] First, set the weighting factor for each digit, for example: 7,9,10,5,8,4,2,1,6,3,7,9,10,5,8,4,2;

[0133] Then, multiply the first 17 digits of the ID number by their corresponding weights and sum them up to get the weighted score S;

[0134] Secondly, the index of the last digit of the ID number check digit is calculated based on S, using the following formula: ,in, This represents the modulo operation. Indicates the index of the last check digit;

[0135] Finally, based on the Y lookup mapping table [1,0,X,9,8,7,6,5,4,3,2], it is determined whether the last digit of the ID number is accurate. Only if it is accurate will this sensitive information be retained.

[0136] In one embodiment, optionally, the step of fusing and deduplicating the first recognition result and the rule matching result according to a pre-set priority order to obtain a second recognition result of sensitive information in the target text includes:

[0137] According to a pre-set priority order, sensitive information from the first identification result and the rule matching result is written sequentially to obtain the initial identification result;

[0138] Obtain the starting position of the sensitive information in the initial recognition result in the target text;

[0139] Based on the starting position, the overlapping sensitive information in the initial recognition result is deduplicated to obtain the second recognition result of the sensitive information in the target text.

[0140] In this embodiment of the invention, in order to improve the accuracy of sensitive information identification, multiple identification results are fused and deduplicated. Specifically, firstly, according to a pre-set priority order, sensitive information in the first identification result and the rule matching result are written sequentially to obtain an initial identification result; then, a deduplication operation is performed, the sensitive information in the initial identification result is sorted according to its starting position in the text, and detected one by one to obtain the positional overlap result. The overlap result is deduplicated to obtain a second identification result. Optionally, for the overlap result, priority and confidence are compared, and the result with higher priority or higher confidence is retained to obtain the second identification result.

[0141] In one implementation, optionally, the step of sequentially writing sensitive information from the first identification result and the rule matching result according to a pre-set priority order to obtain an initial identification result includes:

[0142] According to predefined grading rules, the sensitivity level of each sensitive information in the rule matching result is determined, wherein the sensitivity level includes a first sensitivity level and a second sensitivity level, and the grading rules include the mapping relationship between the category of the sensitive information and the sensitivity level;

[0143] The order in which sensitive information is written in the first identification result and the rule matching result is determined according to the order of priority from high to low, wherein the priority of the rule matching result of the first sensitivity level is higher than the priority of the first identification result, and the priority of the first identification result is higher than the priority of the rule matching result of the second sensitivity level.

[0144] According to the writing order, sensitive information from the first identification result and the rule matching result is written sequentially to obtain the initial identification result.

[0145] In this embodiment of the invention, the sensitivity levels marked when using regular expression matching rules are predefined. For example, the sensitivity level of an address is lower than that of a mobile phone number. These are stored in the database, which allows the sensitivity level of each sensitive piece of information in the rule matching result to be determined. The lower the sensitivity level, the lower the priority. In this embodiment of the invention, the first sensitivity level is higher than the second sensitivity level.

[0146] Then, according to the order of priority from high to low, the writing order of sensitive information in the first identification result and the rule matching result is determined. In this embodiment of the invention, the priority of the rule matching result of the first sensitivity level is higher than the priority of the first identification result, and the priority of the first identification result is higher than the priority of the rule matching result of the second sensitivity level.

[0147] Finally, sensitive information from the first recognition result and the rule matching result are written in the order of writing to obtain the initial recognition result. This ensures that information with higher priority is written first, guaranteeing the accuracy and integrity of the data.

[0148] like Figure 5 As shown, the specific process for sensitive information identification using the embodiments of the present invention is as follows:

[0149] Step S501: Preprocess the data in the target text, convert the text into a list of tokens, and generate input_ids and attention_mask;

[0150] Step S502: Semantically encode input_ids and attention_mask to generate a global semantic representation of the target text and a context vector representation of the token;

[0151] Step S503a: Based on the global semantic representation, perform classification and recognition processing on the sensitive information in the target text to obtain the category recognition result;

[0152] Step S503b: Based on the context vector representation, perform sequence labeling processing on the sensitive information in the target text to obtain the first recognition result;

[0153] Step S503c: Based on the category recognition result, determine whether the target text contains sensitive information. If it does, proceed to step S504; otherwise, end the process.

[0154] Step S504: Identify and match sensitive information in the target text according to the pre-set matching rules to obtain the rule matching result;

[0155] Step S505: The first identification result and the rule matching result are fused and deduplicated according to a preset priority order to obtain the second identification result of sensitive information in the target text;

[0156] Step S506: Group the second identification results according to entity type, classify entities with category codes starting with P as personal information, classify entities with category codes starting with B as business information, and obtain the detection report;

[0157] Step S507: Return the detection report to the user. The report contains all identified sensitive information and its details for subsequent auditing, desensitization, risk assessment and other applications.

[0158] As can be seen from the above process, in step S502, the global semantic representation of the target text and the context vector representation of the token are extracted synchronously. In the subsequent inference scheduling stage, steps S503a and S503b are executed in parallel. In one optional implementation, the running speed of step S503a is much faster than that of step S503b. When step S503a ends and proceeds to step S503c, step S503b has just begun. Therefore, if S503c indicates that the target text contains sensitive information, then the process waits for step S503b to complete before proceeding to step S504; if S503c indicates that the target text does not contain sensitive information, then the execution of step S503b needs to be interrupted and terminated directly, significantly improving the overall processing efficiency. Therefore, step S503a can also be considered as a pre-screening step of step S503b, which can effectively improve the processing speed and reduce resource consumption.

[0159] like Figure 6 As shown, embodiments of the present invention also provide a sensitive information identification device, comprising:

[0160] The first processing module 601 is used to perform semantic encoding processing on the target text to obtain the global semantic representation and the context vector representation of the word units of the target text.

[0161] The second processing module 602 is used to classify and identify sensitive information in the target text according to the global semantic representation to obtain the category identification result;

[0162] The third processing module 603 is used to perform sequence labeling processing on the sensitive information in the target text according to the context vector representation to obtain a first recognition result;

[0163] The first verification module 604 is used to cross-verify the category of sensitive information in the first identification result with the category identification result, and update the first identification result.

[0164] Optionally, the device further includes:

[0165] The first matching module is used to identify and match the sensitive information in the target text according to a pre-set matching rule when the category recognition result indicates that the target text contains sensitive information, thereby obtaining a rule matching result;

[0166] The fourth processing module is used to fuse and deduplicate the first recognition result and the rule matching result according to a preset priority order to obtain a second recognition result of sensitive information in the target text;

[0167] The first verification module 604 is further configured to cross-verify the category of sensitive information in the second identification result with the category identification result, and update the second identification result.

[0168] Optionally, the first verification module 604 includes:

[0169] The first verification submodule is used to cross-verify the category of sensitive information in the first identification result with the category identification result to obtain a verification result;

[0170] The first update submodule is used to update the first identification result based on the verification result and the confidence level of sensitive information in the first identification result.

[0171] Optionally, the second processing module 602 includes:

[0172] The first processing submodule is used to perform regularization and category dimension mapping processing on the global semantic representation according to a variety of predefined sensitive information categories to obtain category scores for the various sensitive information categories, wherein the category scores are proportional to the tendency of the target text to include sensitive information of the corresponding category;

[0173] The first comparison submodule is used to compare the category scores of each of the sensitive information categories with a preset threshold to generate a category recognition result. The category recognition result includes recognition result and / or category information. The recognition result is used to indicate whether the target text contains sensitive information, and the category information is used to indicate the sensitive information categories included in the target text.

[0174] Optionally, the third processing module 603 includes:

[0175] The second processing submodule is used to perform linear mapping processing on the context vector representation of the word element according to the predefined start-inner-outer BIO tags to obtain the emission score of each word element corresponding to each tag.

[0176] The third processing submodule is used to determine the tag sequence corresponding to the target text based on the pre-trained transition matrix and the emission score;

[0177] The first extraction submodule is used to extract entities of sensitive information in the target text based on the tag sequence, wherein the entities of sensitive information include at least one of the following: sensitive information type information, text information, start character position, end character position, and confidence level;

[0178] The fourth processing submodule is used to generate a first identification result of the sensitive information in the target text based on the entity of the sensitive information.

[0179] Optionally, the first matching module includes:

[0180] The first matching submodule is used to identify and match sensitive information in the target text according to a pre-set regular expression rule library to obtain rule matching results. The regular expression rule library includes multiple matching rules and a mapping relationship between the matching rules and the categories of the sensitive information.

[0181] The first verification submodule is used to verify sensitive information in the rule matching result through a verification algorithm and update the rule matching result.

[0182] Optionally, the fourth processing module includes:

[0183] The first writing submodule is used to write sensitive information from the first identification result and the rule matching result sequentially according to a pre-set priority order to obtain the initial identification result;

[0184] The first acquisition submodule is used to acquire the starting position of the sensitive information in the initial recognition result in the target text;

[0185] The fifth processing submodule is used to perform deduplication processing on the sensitive information with overlapping positions in the initial recognition result according to the starting position, so as to obtain the second recognition result of the sensitive information in the target text.

[0186] Optionally, the first write submodule includes:

[0187] The first determining unit is configured to determine the sensitivity level of each sensitive information in the rule matching result according to a predefined grading rule, wherein the sensitivity level includes a first sensitivity level and a second sensitivity level, and the grading rule includes a mapping relationship between the category of the sensitive information and the sensitivity level;

[0188] The second determining unit is used to determine the writing order of sensitive information in the first identification result and the rule matching result according to the order of priority from high to low, wherein the priority of the rule matching result of the first sensitivity level is higher than the priority of the first identification result, and the priority of the first identification result is higher than the priority of the rule matching result of the second sensitivity level.

[0189] The first writing unit is used to sequentially write sensitive information from the first identification result and the rule matching result according to the writing order to obtain the initial identification result.

[0190] It should be noted that the embodiments of this device are devices corresponding to the embodiments of the above methods. All implementations in the embodiments of the above methods are applicable to the embodiments of this device and can achieve the same technical effect.

[0191] This invention also provides a network device, including: a processor, a memory, and a program stored in the memory and executable on the processor. When the program is executed by the processor, it implements the sensitive information identification method as described above and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0192] This invention also provides a readable storage medium, comprising: a program stored on the readable storage medium, wherein when the program is executed by a processor, it implements the steps of the sensitive information identification method described in any of the preceding claims, and achieves the same technical effect; to avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc.

[0193] This invention also provides a computer program product, including computer instructions. When the computer instructions are executed by a processor, they implement the steps of the sensitive information identification method described in any of the preceding claims and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0194] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0195] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A method for identifying sensitive information, characterized in that, include: Semantic encoding is performed on the target text to obtain the global semantic representation and the context vector representation of the word units; Based on the global semantic representation, sensitive information in the target text is classified and identified to obtain category identification results; Based on the context vector representation, the sensitive information in the target text is subjected to sequence labeling processing to obtain the first identification result of the sensitive information in the target text; Cross-validate the categories of sensitive information in the first identification result with the category identification result, and update the first identification result.

2. The sensitive information identification method according to claim 1, characterized in that, Before cross-validating the category of sensitive information in the first identification result with the category identification result, the method further includes: If the category recognition result indicates that the target text contains sensitive information, the sensitive information in the target text is identified and matched according to a pre-set matching rule to obtain a rule matching result; The first identification result and the rule matching result are fused and deduplicated according to a pre-set priority order to obtain the second identification result of sensitive information in the target text; The process of cross-validating the category of sensitive information in the first identification result with the category identification result, and updating the first identification result, includes: Cross-validate the categories of sensitive information in the second identification result with the category identification result, and update the second identification result.

3. The sensitive information identification method according to claim 1, characterized in that, The step of cross-validating the category of sensitive information in the first identification result with the category identification result and updating the first identification result includes: Cross-validate the category of sensitive information in the first identification result with the category identification result to obtain the verification result; The first identification result is updated based on the verification result and the confidence level of the sensitive information in the first identification result.

4. The sensitive information identification method according to claim 1, characterized in that, The step of classifying and identifying sensitive information in the target text based on the global semantic representation to obtain category identification results includes: Based on a number of predefined sensitive information categories, the global semantic representation is regularized and subjected to category dimension mapping to obtain category scores for the various sensitive information categories. The category scores are proportional to the tendency of the target text to include sensitive information of the corresponding category. The category scores of each of the sensitive information categories are compared with preset thresholds to generate category recognition results. The category recognition results include recognition results and / or category information. The recognition results are used to indicate whether the target text contains sensitive information, and the category information is used to indicate the categories of sensitive information included in the target text.

5. The sensitive information identification method according to claim 1, characterized in that, The step of performing sequence labeling processing on sensitive information in the target text based on the context vector representation to obtain a first identification result of sensitive information in the target text includes: Based on the predefined start-inner-outer BIO tags, the context vector representation of the word is linearly mapped to obtain the emission score of each word corresponding to each tag. Based on the pre-trained transition matrix and the emission score, the tag sequence corresponding to the target text is determined; Based on the tag sequence, entities of sensitive information in the target text are extracted, wherein the entities of sensitive information include at least one of the following: sensitive information type information, text information, start character position, end character position, and confidence level; Based on the entities of the sensitive information, a first identification result of the sensitive information in the target text is generated.

6. The sensitive information identification method according to claim 2, characterized in that, The step of identifying and matching sensitive information in the target text according to pre-set matching rules to obtain rule matching results includes: According to a pre-set regular expression rule library, sensitive information in the target text is identified and matched to obtain rule matching results. The regular expression rule library includes multiple matching rules and the mapping relationship between the matching rules and the categories of the sensitive information. The sensitive information in the rule matching result is verified by a verification algorithm, and the rule matching result is then updated.

7. The sensitive information identification method according to claim 2, characterized in that, The step of fusing and deduplicating the first recognition result and the rule matching result according to a pre-set priority order to obtain a second recognition result of sensitive information in the target text includes: According to a pre-set priority order, sensitive information from the first identification result and the rule matching result is written sequentially to obtain the initial identification result; Obtain the starting position of the sensitive information in the initial recognition result in the target text; Based on the starting position, the overlapping sensitive information in the initial recognition result is deduplicated to obtain the second recognition result of the sensitive information in the target text.

8. The sensitive information identification method according to claim 7, characterized in that, The step of sequentially writing sensitive information from the first identification result and the rule matching result according to a pre-set priority order to obtain the second identification result includes: According to predefined grading rules, the sensitivity level of each sensitive information in the rule matching result is determined, wherein the sensitivity level includes a first sensitivity level and a second sensitivity level, and the grading rules include the mapping relationship between the category of the sensitive information and the sensitivity level; The order in which sensitive information is written in the first identification result and the rule matching result is determined according to the order of priority from high to low, wherein the priority of the rule matching result of the first sensitivity level is higher than the priority of the first identification result, and the priority of the first identification result is higher than the priority of the rule matching result of the second sensitivity level. According to the writing order, sensitive information from the first identification result and the rule matching result is written sequentially to obtain the initial identification result.

9. A sensitive information identification device, characterized in that, include: The first processing module is used to perform semantic encoding processing on the target text to obtain the global semantic representation and the context vector representation of the word units of the target text; The second processing module is used to classify and identify sensitive information in the target text based on the global semantic representation to obtain category identification results; The third processing module is used to perform sequence labeling processing on the sensitive information in the target text according to the context vector representation, and obtain the first identification result of the sensitive information in the target text; The first verification module is used to cross-verify the category of sensitive information in the first identification result with the category identification result, and update the first identification result.

10. A network device, characterized in that, include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the sensitive information identification method as described in any one of claims 1 to 8.

11. A readable storage medium, characterized in that, include: The readable storage medium stores a program that, when executed by a processor, implements the steps of the sensitive information identification method as described in any one of claims 1 to 8.

12. A computer program product, characterized in that, It includes computer instructions that, when executed by a processor, implement the steps of the sensitive information identification method as described in any one of claims 1 to 8.

Images