Sensitive data identification method and device based on auxiliary information, and storage medium

Abstract

The application discloses a sensitive data identification method and device based on auxiliary information and a storage medium, relates to the technical field of data processing, and comprises the following steps: determining a sensitive data label dictionary according to a preset data security policy; for each sensitive data label in the sensitive data label dictionary, collecting a corresponding unstructured file from a preset data source, performing text positioning and slicing processing, extracting target sensitive data and a corresponding context segment, and extracting target sensitive data ontology features, context auxiliary features and negative filtering features to generate a sensitive data multi-dimensional feature graph; based on the sensitive data multi-dimensional feature graph, an enhanced regular expression is constructed according to a preset structure skeleton; unstructured data to be detected is acquired, an enhanced regular expression library is called to perform stream matching on the unstructured data to be detected, and a corresponding sensitive data identification result is generated after successful matching, thereby improving the identification accuracy of sensitive data in unstructured data.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a method, device and storage medium for sensitive data identification based on auxiliary information. Background Technology

[0002] Currently, the most widely used unstructured data sensitivity identification technology is the rule-based identification scheme, which relies on predefined simple string matching patterns (such as basic regular expressions) to achieve data identification. While this scheme has advantages such as high speed, transparent rules, low computational resource consumption, and low deployment threshold, making it suitable for large-scale enterprise applications, it has a fundamental flaw. Due to the lack of judgment on the semantic environment of the data context, it relies solely on the format characteristics of the data itself for matching, resulting in a high false positive rate for noise information that resembles sensitive data, and it is prone to missing detection of truly sensitive data in specific contexts. The accuracy of identification is insufficient to meet the high-precision requirements of enterprise compliance and security protection.

[0003] The above content is only used to help understand the technical solution of this application and does not represent an admission that the above content is prior art. Summary of the Invention

[0004] The main objective of this application is to provide a sensitive data identification method, device, and storage medium based on auxiliary information, aiming to solve the technical problem that existing sensitive data identification methods rely solely on the format characteristics of the data itself and lack contextual semantic association judgment, resulting in low accuracy of sensitive data identification in unstructured data.

[0005] To achieve the above objectives, this application proposes a sensitive data identification method based on auxiliary information, the sensitive data identification method based on auxiliary information comprising: Based on the preset data security policy, the sensitive data types to be identified are determined, and corresponding sensitive data tags are configured for each type of sensitive data type to form a sensitive data tag dictionary; For each sensitive data tag in the sensitive data tag dictionary, collect the corresponding unstructured file from a preset data source; Sensitive data in each of the unstructured files is located and sliced ​​to extract target sensitive data and corresponding context fragments, and a sample set is constructed. Extract the target sensitive data ontology features, contextual auxiliary features, and negative filtering features from each associated sample pair in the sample set to generate a multidimensional feature map of sensitive data; Based on the multidimensional feature map of the sensitive data, an enhanced regular expression is constructed according to a preset structural skeleton, and the enhanced regular expression is associated with the corresponding sensitive data label and stored to form an enhanced regular expression rule library; The unstructured data to be detected is acquired, and the unstructured data to be detected is preprocessed to obtain a standardized text stream. The enhanced regular expression rule library is called to perform streaming matching on the standardized text stream. After successful matching, the corresponding sensitive data identification result is generated.

[0006] In one embodiment, the step of determining the sensitive data types to be identified according to a preset data security policy, and configuring corresponding sensitive data tags for each type of sensitive data type to form a sensitive data tag dictionary includes: Based on the preset data security policy, enumerate the sensitive data types to be identified; Configure a corresponding sensitive data label for each type of sensitive data type, and bind corresponding association information to the sensitive data label. The association information includes data category, data classification, and standard specification information. The sensitive data tags and their corresponding associated information are summarized to form the sensitive data tag dictionary.

[0007] In one embodiment, the step of collecting corresponding unstructured files from a preset data source for each sensitive data tag in the sensitive data tag dictionary includes: Unstructured data in various file formats, including text, portable document, office document, and spreadsheet formats, are obtained from the preset data source through an application programming interface. For each of the sensitive data tags in the sensitive data tag dictionary, the unstructured data is filtered using the sensitive data tag to obtain the unstructured file corresponding to each sensitive data tag.

[0008] In one embodiment, the step of performing text localization and slicing processing on sensitive data in each of the unstructured files, extracting target sensitive data and corresponding context fragments, and constructing a sample set includes: Text content is extracted from each of the unstructured files to obtain the corresponding plain text content; Determine the target regular expression corresponding to each of the plain text contents, wherein the target regular expression is the base regular expression whose sensitive data tags are the same as the sensitive data tags of the plain text contents; The target regular expression is used to perform a preliminary match on the corresponding plain text content to determine the starting character index and ending character index of the target sensitive data in the plain text content; Centered on the starting character index and the ending character index, a text segment of a predetermined number of characters is extracted forward and backward respectively to form an initial associated sample pair containing the target sensitive data and the corresponding context segment; Metadata tags are added to each of the initial associated sample pairs. The metadata tags include the sample source, file format, and business scenario. A sample set including multiple associated sample pairs is constructed. The associated sample pairs include the target sensitive data, the context fragment, and the metadata tags.

[0009] In one embodiment, the step of extracting target sensitive data ontology features, contextual auxiliary features, and negative filtering features from each associated sample pair in the sample set to generate a multidimensional feature map of sensitive data includes: Using a regular expression inductive algorithm, pattern abstraction is performed on the target sensitive data in the sample set, the format constraints of the target sensitive data are identified, and the ontological features of the target sensitive data are obtained. The format constraints include at least one of length distribution, character type composition, and check bit algorithm. Using natural language recognition technology, the context fragments and target sensitive data in the sample set are parsed to extract non-explicit semantic features and obtain the context auxiliary features; Using natural language processing semantic analysis techniques, noisy entities in the sample set are identified, and the contextual lexical features and sentence position features of the noisy entities are extracted to obtain the negative filtering features; The target sensitive data ontology features, the context auxiliary features, and the negative filtering features are organized according to the corresponding sensitive data labels to form the sensitive data multidimensional feature map.

[0010] In one embodiment, the step of using natural language recognition technology to parse context fragments and target-sensitive data in the sample set, extracting non-explicit semantic features, and obtaining the context auxiliary features includes: Using the position of the target sensitive data in the corresponding associated sample pair as the boundary, the context fragment of each associated sample pair is separated into the prefix text before the target sensitive data and the suffix text after the target sensitive data; The prefix and suffix texts of all related sample pairs are segmented using a word segmentation tool to determine the frequency of each word in all the prefix texts and the frequency of each word in all the suffix texts. Words whose frequency of occurrence is greater than or equal to a preset frequency threshold are selected as high-frequency words. Semantic weights are assigned to each of the high-frequency words, and prefix semantic weight tables and suffix semantic weight tables are constructed respectively. The context fragment is subjected to templated abstraction to summarize the sentence structure pattern between the target sensitive data and the context fragment. The sentence structure pattern includes the separation pattern between the tag name and the target sensitive data and the enclosing pattern between the target sensitive data and the annotation. Each word in each of the aforementioned context segments is matched with a preset domain terminology dictionary. The words that are successfully matched are marked as domain-related words, and the domain-related words are included in a prefix auxiliary feature set or a suffix auxiliary feature set. The frequency and positional relationship of preset punctuation marks before and after the target sensitive data are statistically analyzed, and the semantic positioning features of the punctuation marks are extracted. The preset punctuation marks include colons, parentheses, quotation marks, and commas. The prefix semantic weight table, the suffix semantic weight table, the sentence structure pattern, the domain-related words, and the punctuation semantic positioning features are merged and encapsulated into the context auxiliary features.

[0011] In one embodiment, the step of constructing an enhanced regular expression based on the multidimensional feature map of the sensitive data according to a preset structural skeleton includes: Read the prefix auxiliary feature set corresponding to each sensitive data label from the context auxiliary feature in the sensitive data multidimensional feature map, rewrite the prefix auxiliary feature set into prefix grouping through logical OR relation, and append the spacing quantifier after the prefix grouping; Read the ontology format features corresponding to each of the sensitive data tags from the ontology features of the target sensitive data in the multidimensional feature map of the sensitive data, and rewrite the ontology format features into a combination of regular character classes and quantifiers as mandatory matching items; Read the suffix auxiliary feature set corresponding to each sensitive data label from the context auxiliary features in the multidimensional feature map of the sensitive data, rewrite the suffix auxiliary feature set into suffix groups through logical OR relation, and set the suffix groups as optional matching items; Read the negative semantic feature set corresponding to each sensitive data label from the sensitive data multidimensional feature map, transcribe the negative semantic feature set into an exclusive matching logic embedding expression, and append it to the ontology format feature; The enhanced regular expression corresponding to each of the sensitive data tags is generated by concatenating the prefix grouping, the spacing quantifier, the ontology format feature, the suffix grouping, and the exclusive matching logic embedding expression in that order.

[0012] In one embodiment, the step of acquiring the unstructured data to be detected and preprocessing the unstructured data to be detected to obtain a standardized text stream includes: Obtain the unstructured data to be detected, and identify the format of the unstructured data to be detected based on the file header suffix of the unstructured data to be detected, thereby obtaining the file format of the unstructured data to be detected; According to the file format, the corresponding parsing engine is called to extract the plain text content of the unstructured data to be detected; The plain text content is preprocessed, including removing newline characters, carriage returns and tabs, merging consecutive whitespace characters into a single space, and concatenating multiple text segments into a continuous standardized text stream.

[0013] In one embodiment, the step of calling the enhanced regular expression rule library to perform streaming matching on the standardized text stream, and generating the corresponding sensitive data identification result after successful matching includes: Load the enhanced regular expression rule library; The standardized text stream is divided into segments according to a preset character length, and each segment is matched by sequentially traversing all the enhanced regular expressions in the enhanced regular expression rule library. When a match is successful, the target data content, the matched context fragment, and the corresponding sensitive data tags are extracted, and the file metadata of the unstructured data to be detected and the text position of the target data content are associated to generate a structured sensitive data identification result. The file metadata includes the file name, file size, and creation time.

[0014] Furthermore, to achieve the above objectives, this application also proposes a sensitive data identification device based on auxiliary information, the sensitive data identification device based on auxiliary information comprising: The data tag system definition module is used to determine the sensitive data types to be identified according to the preset data security policy, and to configure corresponding sensitive data tags for each type of sensitive data type to form a sensitive data tag dictionary; An unstructured file acquisition module is used to acquire corresponding unstructured files from a preset data source for each of the sensitive data tags in the sensitive data tag dictionary. The data sample construction module is used to perform text localization and slicing processing on sensitive data in each of the unstructured files, extract target sensitive data and corresponding context fragments, and construct a sample set; The multi-dimensional feature extraction module is used to extract target sensitive data ontology features, context auxiliary features, and negative filtering features from each associated sample pair in the sample set, and generate a multi-dimensional feature map of sensitive data. The feature rule mapping and transformation module is used to construct an enhanced regular expression based on the multidimensional feature map of the sensitive data according to a preset structural skeleton, and to associate and store the enhanced regular expression with the corresponding sensitive data label to form an enhanced regular rule library; The rule invocation module is used to acquire unstructured data to be detected, preprocess the unstructured data to be detected to obtain a standardized text stream, call the enhanced regular expression rule library to perform streaming matching on the standardized text stream, and generate the corresponding sensitive data identification result after successful matching.

[0015] In addition, to achieve the above objectives, this application also proposes a sensitive data identification device based on auxiliary information, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the sensitive data identification method based on auxiliary information as described above.

[0016] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the sensitive data identification method based on auxiliary information as described above.

[0017] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the sensitive data identification method based on auxiliary information as described above.

[0018] The one or more technical solutions proposed in this application have at least the following technical effects: Based on a preset data security strategy, the sensitive data types to be identified are determined, and corresponding sensitive data tags are configured for each type of sensitive data, forming a sensitive data tag dictionary to define the boundaries for subsequent context sample collection. Next, for each sensitive data tag in the sensitive data tag dictionary, corresponding unstructured files are collected from a preset data source. Text localization and slicing are performed on the sensitive data in each unstructured file to extract the target sensitive data and corresponding context fragments, forming associated sample pairs containing the target sensitive data and corresponding context fragments. This constructs a sample set, realizing the transformation from simply looking at the data itself to analyzing data and context in pairs, providing a data foundation for semantic discrimination. Then, the target sensitive data ontology features, contextual auxiliary features, and negative filtering features are extracted from each associated sample pair in the sample set to generate a multi-dimensional feature map of sensitive data. Based on the multidimensional feature map of sensitive data, an enhanced regular expression is constructed according to a pre-defined structural skeleton. The context, the target sensitive data ontology, and negative constraints are embedded into the regular expression skeleton, enabling a single enhanced regular expression to simultaneously verify data format and contextual information. This addresses the deficiency of traditional solutions that lack contextual discrimination. The enhanced regular expressions are then associated with their corresponding sensitive data tags, forming an enhanced regular expression rule base. Finally, unstructured data to be detected is acquired, preprocessed to obtain a standardized text stream, and the enhanced regular expression rule base is used to perform streaming matching on the standardized text stream. Successful matching generates the corresponding sensitive data identification result, while noise from failed matches is filtered out by negative features. This solves the technical problem of existing sensitive data identification methods relying solely on the format features of the data itself, lacking contextual semantic association judgment, leading to low accuracy in identifying sensitive data in unstructured data. It reduces the false positives and false negatives of traditional regular expressions, improving the accuracy of sensitive data identification. Attached Figure Description

[0019] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0020] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a flowchart illustrating an embodiment of the sensitive data identification method based on auxiliary information provided in this application. Figure 2 This is a schematic diagram of the module structure of the sensitive data identification device based on auxiliary information according to an embodiment of this application; Figure 3 This is a schematic diagram of the device structure of the hardware operating environment involved in the sensitive data identification method based on auxiliary information in the embodiments of this application. Detailed Implementation

[0022] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0023] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0024] The main solution of this application embodiment is as follows: Based on a preset data security policy, determine the sensitive data types to be identified, and configure corresponding sensitive data tags for each type of sensitive data to form a sensitive data tag dictionary; for each sensitive data tag in the sensitive data tag dictionary, collect corresponding unstructured files from a preset data source; perform text localization and slicing processing on the sensitive data in each unstructured file, extract the target sensitive data and corresponding context fragments, and construct a sample set; extract the target sensitive data ontology features, context auxiliary features, and negative filtering features from each associated sample pair in the sample set to generate a multi-dimensional feature map of sensitive data; based on the multi-dimensional feature map of sensitive data, construct an enhanced regular expression according to a preset structural skeleton, and associate and store the enhanced regular expression with the corresponding sensitive data tag to form an enhanced regular expression rule library; acquire the unstructured data to be detected, preprocess the unstructured data to be detected to obtain a standardized text stream, call the enhanced regular expression rule library to perform streaming matching on the standardized text stream, and generate the corresponding sensitive data identification result after successful matching.

[0025] In this embodiment, for ease of description, the following description will focus on a sensitive data identification system based on auxiliary information.

[0026] With the acceleration of enterprise digitalization, massive amounts of unstructured data have become a core component of enterprise information assets. This type of data commonly contains sensitive data at the field level, covering critical content such as personal information, trade secrets, financial data, R&D data, and production data. Any leakage, loss, alteration, or damage to this data can pose risks to both enterprise and user interests. Therefore, achieving accurate identification, classification, and full lifecycle monitoring of unstructured data and its sensitive field-level data is of significant practical importance.

[0027] Currently, in the traditional technical system for identifying sensitive unstructured data, the most widely used approach is rule-based identification, which relies on predefined simple string matching patterns (such as basic regular expressions) to achieve data identification. While this approach offers advantages such as high speed, transparent rules, low computational resource consumption, and low deployment threshold, making it suitable for large-scale enterprise applications, it suffers from a fundamental flaw: due to the lack of contextual semantic judgment, it relies solely on the format characteristics of the data itself for matching, resulting in a high false positive rate for noise information resembling sensitive data and a tendency to miss genuinely sensitive data in specific contexts. Consequently, the accuracy rate fails to meet the high-precision requirements of enterprise compliance and security protection.

[0028] While emerging technologies such as machine learning and deep learning can improve recognition accuracy through semantic understanding, they have problems such as requiring a large amount of high-quality labeled data, long model development and training cycles, high deployment costs, and opaque decision-making processes. These make it difficult to popularize their application in scenarios with strict requirements for cost, efficiency, and interpretability. Furthermore, they are not optimizations or upgrades of traditional rule-based solutions; rather, they belong to different technical paths.

[0029] In summary, there is a lack of existing technologies that can iteratively upgrade traditional recognition frameworks, retaining the core advantages of traditional rule-based solutions such as high speed, low cost, and high transparency, while also addressing their insufficient accuracy.

[0030] This application provides a solution. First, based on a preset data security policy, all sensitive data types are defined and a unified sensitive data tag dictionary is generated. This accurately identifies the target range that requires contextual recognition, setting standards for subsequent collection of corresponding business text. Next, unstructured files from real business operations are collected according to each sensitive data tag in the sensitive data tag dictionary, obtaining actual business contextual materials for various types of sensitive data. Then, through text localization and slicing, the target sensitive data is bound to its surrounding context as associated sample pairs, breaking the limitation of traditional methods that only extract isolated strings and retaining analyzable contextual auxiliary information. Next, from each associated sample pair in the sample set, data ontology format features, positive contextual auxiliary features distinguishing real sensitive data, and negative filtering features filtering noisy text are simultaneously extracted and integrated into a multi-dimensional feature map of sensitive data, transforming abstract semantic context into quantifiable constraints. Based on the multi-dimensional feature map of sensitive data, an enhanced regular expression that integrates contextual constraints is built and stored in the database. This allows the regular expression to not only verify data format but also simultaneously perform dual contextual verification, resulting in an enhanced regular expression rule library. Finally, after standardizing the files to be detected, a streaming matching rule base is used. Only data that meets both the format and matching context conditions is judged as sensitive data. Positive context is used to reduce the omission of real sensitive data, while negative context is used to filter out noise misjudgments that resemble sensitive data. This realizes the engineering implementation of the sensitive data identification scheme, solves the technical defects of low recognition accuracy caused by relying solely on format features and lacking contextual judgment, and improves the recognition accuracy of sensitive data in unstructured data.

[0031] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, or mobile phone, or a sensitive data identification device based on auxiliary information capable of performing the above functions. The following description uses a sensitive data identification system based on auxiliary information as an example to illustrate this embodiment and the subsequent embodiments.

[0032] Based on this, embodiments of this application provide a sensitive data identification method based on auxiliary information, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the sensitive data identification method based on auxiliary information in this application.

[0033] In this embodiment, the sensitive data identification method based on auxiliary information includes steps 101-106: Step 101: Based on the preset data security policy, determine the sensitive data types to be identified, and configure corresponding sensitive data tags for each type of sensitive data to form a sensitive data tag dictionary.

[0034] In some embodiments, based on the enterprise's pre-defined data security policies and compliance requirements, all data assets involved in the enterprise's business scenarios are reviewed to identify sensitive data types that need to be identified. Then, a sensitive data tag with a unique identifier and clear business meaning is configured for each type of sensitive data, and each sensitive data tag is associated with the corresponding data classification, data level, and the standard specifications on which it is based.

[0035] For example, for name-related data, its sensitive data label can be defined as: "Label Name: Name", and the corresponding associated information can be: "Data Classification: Personal Identity Information; Data Grading: Level 3; Standard Specification Information: 《XXX Data Classification and Grading Rules》". Finally, all defined sensitive data labels and their associated information are summarized to form a structured sensitive data label dictionary, which serves as the target index for subsequent targeted collection of sample files from preset data sources, ensuring the targeting and comprehensiveness of sample collection. By establishing a unified benchmark coordinate system, namely the sensitive data label dictionary, for the entire sensitive data identification process, it is ensured that all subsequent sample collection, feature mining, rule construction, and result output revolve around the sensitive data labels in this sensitive data label dictionary, avoiding problems such as ambiguous identification targets or inconsistent standards.

[0036] Optionally, the steps of determining the sensitive data types to be identified according to a preset data security policy, and configuring corresponding sensitive data tags for each type of sensitive data to form a sensitive data tag dictionary include: Based on the preset data security policy, enumerate the sensitive data types to be identified; Configure corresponding sensitive data tags for each type of sensitive data, and bind corresponding associated information to the sensitive data tags. The associated information includes data category, data classification, and standard specification information. A dictionary of sensitive data tags is formed by summarizing each sensitive data tag and its corresponding associated information.

[0037] Specifically, a pre-defined data security strategy can refer to a strategy document prepared in advance based on national laws and regulations and industry regulatory requirements, combined with the company's internal data governance system. This strategy document lists, in the form of clauses, the scope, classification system, grading standards, and compliance obligations of sensitive data that the organization needs to identify and control, serving as the legal basis input for the entire identification process. Sensitive data types are the specific types of data that need to be identified and protected, such as names. Sensitive data tags are unique identifiers assigned to each type of sensitive data, used to uniformly refer to this type of data in subsequent processes, facilitating rule association and result labeling. Associated information is the attribute description bound to the sensitive data tags, including at least the data category (e.g., personal identification information), data grade (e.g., Level 3), and the standard and specification information on which it is based (e.g., "XXX Data Classification and Grading Rules"). The sensitive data tag dictionary is a structured list compiled from all sensitive data tags and their associated information, serving as the baseline configuration file for the entire sensitive identification method.

[0038] For example, based on preset data security policies, business process characteristics, and compliance requirements, a comprehensive review of unstructured data assets involved in all business scenarios is conducted to enumerate all sensitive data types to be identified, including but not limited to personal information (such as name, ID number, mobile phone number), financial account information (such as bank card number), trade secret information (such as contract amount, R&D code), communication contact information, and biometric information, ensuring coverage of the sensitive data scope defined in the preset data security policy. Secondly, a sensitive data label with a unique identifier and clear business meaning is configured for each enumerated sensitive data type, and corresponding associated information is bound to each sensitive data label. This associated information includes data category, data classification, and the standard specification information on which it is based. For example, for name data, the sensitive data label is configured as "Name," the bound data category is "Personal Identity Information," the data classification is "Level 3," and the standard specification information is "XXX Data Classification and Grading Rules"; for bank card number data, the sensitive data label is configured as "Bank Card Number," the bound data category is "Financial Account Information," the data classification is "Level 4," and the standard specification is the same as above. Finally, all configured sensitive data tags and their associated information are compiled into a structured sensitive data tag dictionary. This dictionary uses sensitive data tags as the primary key and attributes such as classification and grading as fields, and is stored in a configuration file or database. It serves as an index for targeted sample file collection in subsequent steps. The sensitive data tag dictionary provides a unified identification list for the entire sensitive data identification method, ensuring a clear target when collecting samples from various data sources. This avoids sample loss or redundancy caused by indiscriminate collection. Furthermore, the binding relationship between tags and classification / grading provides a standard basis for the tagged output of the final identification results, enabling the identification results to be directly integrated with the enterprise's existing data classification, grading, and compliance auditing systems, achieving a seamless connection from identification to control.

[0039] Step 102: For each sensitive data tag in the sensitive data tag dictionary, collect the corresponding unstructured file from the preset data source.

[0040] In some embodiments, for each sensitive data tag in the sensitive data tag dictionary, corresponding unstructured files are collected in parallel from multiple preset data sources. Preset data sources can include various collection channels: first, unstructured data circulating within the enterprise's core business system can be obtained through application programming interfaces (APIs); second, archived historical contracts, R&D reports, financial vouchers, and email records can be retrieved from the enterprise's historical document library, and sample files related to the current sensitive data tag can be selected; third, for low-frequency or special business scenarios, typical samples can be provided by business personnel for manual supplementary collection. During the collection process, it is necessary to ensure that the sample files corresponding to each sensitive data tag cover multiple mainstream file formats such as text, portable document, office document, and spreadsheet formats, while also covering all different business scenarios. This ultimately forms a scenario-based sample source stored according to sensitive data tags, providing sufficient sample support for the subsequent accurate extraction of context-target sensitive data pairs for various types of sensitive data. By collecting unstructured files corresponding to each sensitive data tag from multiple channels, a sample foundation derived from real business corpora is provided for subsequent context feature mining, ensuring that the extracted prefix and suffix auxiliary features have business representativeness and scenario coverage, thereby avoiding insufficient rule generalization ability due to sample bias.

[0041] Optionally, for each sensitive data tag in the sensitive data tag dictionary, the step of collecting the corresponding unstructured file from a preset data source includes: Unstructured data in various file formats can be obtained from preset data sources through the application programming interface. These file formats include text, portable document, office document, and spreadsheet formats. For each sensitive data tag in the sensitive data tag dictionary, the unstructured data is filtered using the sensitive data tag to obtain the unstructured file corresponding to each sensitive data tag.

[0042] Specifically, the preset data source refers to pre-configured data source channels, including but not limited to the enterprise's core business systems (connected via application programming interfaces), historical document archives (including contracts, reports, emails, etc.), and manually supplemented channels. Application programming interfaces (APIs) are used to supplement data. Multiple file formats refer to the various file forms that unstructured data may present, including at least: text formats (such as txt, csv), portable document formats (such as pdf), office document formats (such as docx, pptx), and spreadsheet formats (such as xlsx).

[0043] For example, firstly, multi-source, multi-format data collection is performed. Unstructured data in various file formats is obtained from preset data sources via application programming interfaces (APIs). These preset data sources include at least three collection channels: API integration with the enterprise's core business systems to obtain unstructured data circulating within them; retrieval of archived historical contracts, R&D reports, financial vouchers, and email records from the enterprise's historical document library; and manual supplementary collection based on typical samples provided by business personnel for low-frequency or special business scenarios. The multiple file formats include at least text formats (e.g., txt, csv), portable document formats (e.g., pdf), office document formats (e.g., docx, pptx), and spreadsheet formats (e.g., xlsx), ensuring that the collected data covers all mainstream formats and all business scenarios, forming an initial file set. Next, the initial file set is filtered and categorized according to sensitive data tags. For each sensitive data tag in the sensitive data tag dictionary, that sensitive data tag is used as a filtering condition to filter the initial file set one by one. For example, unstructured files semantically related to or matching fields of the current sensitive data tag can be filtered out through filename keyword matching, file content keyword retrieval, or metadata-based classification tags, and then categorized and stored according to the sensitive data tag. Specifically, for the "ID number" tag, approval form files containing the ID number field are retrieved from the business system via API. Simultaneously, contract and onboarding registration form files containing the keywords "ID number" or "citizen identification number" are retrieved from the historical document library, filtered, and then included in the sample directory corresponding to this tag. For the "bank card number" tag, payment voucher files are retrieved from the financial system API, and email attachments containing the keyword "receiving account" are retrieved from the historical email library, filtered, and then included in the sample directory corresponding to this tag. This forms an unstructured file sample set for each sensitive data tag, ensuring that the sample set for each sensitive data tag covers multiple file formats and multiple business scenarios, guaranteeing the comprehensiveness and stability of subsequent feature extraction. Through multi-source collection and tag filtering mechanisms, the diversity (covering multiple formats and scenarios) and targeting (precise classification by tag) of samples are ensured during subsequent feature mining, providing a high-quality data foundation for extracting stable and reliable context-target data pairs from unstructured files. At the same time, API integration automates data collection, reducing manual intervention costs and laying the foundation for the large-scale industrial application of sensitive data identification methods.

[0044] Step 103: Perform text localization and slicing on the sensitive data in each unstructured file, extract the target sensitive data and the corresponding context fragments, and construct a sample set.

[0045] In some embodiments, for each unstructured file, the starting and ending character indices of sensitive data in the corresponding text of the unstructured file are first preliminarily located using basic regular expressions. Using the coordinates corresponding to the starting and ending character indices as the center, a preset number (50–100) characters are extracted forward and backward (if the boundaries are insufficient, the characters are extracted to the text edge), resulting in associated sample pairs containing the target sensitive data and its context fragments. Metadata such as sample source, file format, and business scenario are labeled for each associated sample pair. All associated sample pairs under all tags are summarized to construct a sample set covering the entire scenario of context-target data pairs. By forcibly binding the isolated sensitive data in the original unstructured file with its surrounding context, structured associated sample pairs are formed, providing training material containing both target data and complete context for subsequent multi-dimensional feature mining, and providing the original basis for extracting contextual auxiliary information and distinguishing between true and false sensitive data.

[0046] Optionally, the steps of locating and slicing sensitive data in each unstructured file to extract target sensitive data and corresponding context fragments, and constructing a sample set, include: Extract the text content from each unstructured file to obtain the corresponding plain text content; Determine the target regular expression for each plain text content. The target regular expression is the base regular expression that is the same as the sensitive data tags of the plain text content. The target regular expression is used to perform a preliminary match on the corresponding plain text content to determine the starting and ending character indices of the target sensitive data in the plain text content. Centered on the start character index and the end character index, a predetermined number of text segments are extracted forward and backward respectively to form an initial associated sample pair containing the target sensitive data and the corresponding context segment; Add metadata tags to each initial associated sample pair. The metadata tags include the sample source, file format and business scenario. Construct a sample set that includes multiple associated sample pairs. The associated sample pairs include target sensitive data, context fragments and metadata tags.

[0047] Specifically, the basic regular expressions are pre-built and stored in the regular expression library, each corresponding to a sensitive data tag. Each basic regular expression encodes the ontology format features of the corresponding type of sensitive data. For example, the regular expression for an ID card number is [1-9]\d{5}(19|20)\d{2}(0[1-9]|1[0-2])(0[1-9]|

[12] \d|3

[01] )\d{3}[\dXx], and the regular expression for a mobile phone number is 1[3-9]\d{9}, etc. The target sensitive data are the specific substring instances in the plain text content that are matched by the target regular expression after the initial matching operation. The preset quantity is a pre-set slice character length, preferably 50 to 100 characters before and after, used to control the truncation range of the context segment and ensure that complete contextual information is included. The sample source is the source information of the original unstructured file corresponding to the sample, recorded in the metadata tag. This can include: source data source identifier (e.g., "OA document library," "contract management system"), original file identifier (globally unique file ID), file position offset (start / end character index), and collection timestamp. The business scenario is the business context classification of the sensitive data appearing in the sample, recorded in the metadata tag, such as customer account opening, contract signing, employee onboarding, financial reimbursement, customer service work orders, etc. Business scenario information can come from the business attribute annotations of the original file's data source or the scenario classification field in the file's metadata.

[0048] For example, firstly, the corresponding parsing engine is called to extract the text content for each unstructured file. For instance, the text content is directly read for text or spreadsheet format files, the portable document format parsing engine is called to extract text for portable document format files, and the office document parsing engine is called to extract the main text content for office document format files. All types of files are uniformly converted into plain text format, and metadata such as file name, file size, and creation time are recorded to obtain the corresponding plain text content. Secondly, the sensitive data tag dictionary is traversed to determine the target regular expression corresponding to each plain text content. Specifically, the sensitive data tags associated with the current plain text content are obtained, and the basic regular expression that matches the sensitive data tag is searched in the pre-built regular expression library. The regular expression library stores a one-to-one correspondence between each sensitive data tag and the basic regular expression. The basic regular expression is constructed using traditional regular expression syntax and only relies on the format characteristics of the target data itself for matching without any contextual constraints. Specifically, if the current plain text content originates from a sample file associated with the "phone number" tag, the target regular expression is the basic regular expression used to match the phone number format, such as "1[3-9]\d{9}"; if it originates from a sample file associated with the "ID number" tag, the target regular expression is the basic regular expression used to match the ID number format, such as "[1-9]\d{5}(19|20)\d{2}(0[1-9]|1[0-2])(0[1-9]|

[12] \d|3

[01] )\d{3}[\dXx]". Next, the target regular expression is used to perform a preliminary match on the corresponding plain text content. A global matching mode is used to search for all occurrences of the target sensitive data in the text, obtaining the starting and ending character indices of each match in the text. For example, for the plain text content "The customer's phone number is 138..." "Please contact us promptly," and after applying the basic regular expression for mobile phone numbers, it matched "138". The starting and ending character indices are recorded. Then, using the starting and ending character indices as centers, a preset number of text segments are extracted forward and backward, preferably 50-100 characters. If the preset number is insufficient, the segments are taken up to the text boundary, forming an initial associated sample pair containing the target sensitive data and corresponding context fragments. The located mobile phone number "138" is used as an example. For example, taking the character "" as an example, extracting 50 characters forward from its starting index and 50 characters backward from its ending index, we get the result containing "customer's mobile number is 138". Please contact us promptly. Ensure the complete context of the text fragment is obtained to prevent loss of contextual information due to improper boundary truncation. Finally, add metadata tags to each initial associated sample pair. These tags include sample source, file format (e.g., PDF, DOCX), and business scenario (e.g., procurement, approval). Finally, summarize all labeled associated sample pairs to construct a sample set covering all scenarios. Each associated sample pair contains three elements: target sensitive data, context fragment, and metadata tags, providing high-quality and structured data input for subsequent automated analysis of multi-dimensional features based on diverse scenarios.

[0049] By using coordinate positioning and directional slicing, sensitive data scattered in various unstructured files is precisely bound to its context, constructing a structured sample set that includes target sensitive data, context fragments, and metadata tags. This provides high-quality input data for subsequent ontology feature extraction, auxiliary semantic feature mining, and negative filtering feature recognition, fundamentally solving the dilemma in traditional solutions where semantic enhancement rules cannot be constructed due to the lack of context-target data association samples.

[0050] Step 104: Extract the target sensitive data ontology features, contextual auxiliary features, and negative filtering features from each associated sample pair in the sample set to generate a multidimensional feature map of sensitive data.

[0051] In some embodiments, firstly, regular expression inductive algorithms can be used to abstract patterns in the target sensitive data of each associated sample pair, automatically identifying the inherent ontology format features of the target sensitive data, such as length distribution, character type composition, and checksum algorithm. Next, natural language processing techniques are introduced to segment the context fragments, perform word frequency statistics, and sentence structure analysis, extracting contextual auxiliary features such as prefix keywords, suffix keywords, sentence structure patterns, domain terms, and punctuation semantic boundaries. Simultaneously, semantic analysis techniques are used to identify noisy entities that resemble the target sensitive data but do not match its semantic attributes, extracting their contextual features as negative filtering features. Finally, all the above features (target sensitive data ontology features, contextual auxiliary features, and negative filtering features) are summarized according to sensitive data labels to form a multidimensional feature map of sensitive data containing positive matching features and negative filtering features.

[0052] Step 105: Based on the multidimensional feature map of sensitive data, construct an enhanced regular expression according to the preset structural skeleton, and associate and store the enhanced regular expression with the corresponding sensitive data label to form an enhanced regular expression rule library.

[0053] Specifically, the multidimensional feature map of sensitive data includes the target sensitive data ontology features, contextual auxiliary features, and negative filtering features corresponding to each sensitive data label. The contextual auxiliary features include prefix auxiliary features and suffix auxiliary features.

[0054] In some embodiments, based on the feature parameters corresponding to each sensitive data label in the multidimensional feature map of sensitive data, each auxiliary feature in the prefix auxiliary feature set is combined with a logical OR connector, the target sensitive data ontology feature is used as the core mandatory matching item, and each auxiliary feature in the suffix auxiliary feature set is combined with a logical OR connector; then, it is assembled according to the preset structural skeleton of "(prefix auxiliary feature set)(spacing constraint)(target sensitive data ontology feature)(spacing constraint)(suffix auxiliary feature set)"; at the same time, the negative filtering feature is integrated into the expression with zero-width negative assertion syntax to generate an enhanced regular expression; finally, the generated enhanced regular expression is associated and stored with its corresponding sensitive data label, data classification and data hierarchy to form an enhanced regular rule library.

[0055] Furthermore, after constructing and initially storing the enhanced regular expressions, two rounds of verification and iterative optimization are required to ensure that the rule base's recognition performance meets the high-precision requirements of the business. First, test set verification is performed. Ten percent of the associated sample pairs are extracted from the sample set to form an independent test set. The initially generated enhanced regular expression rules are called one by one for recognition testing, and the recognition accuracy and sample coverage corresponding to each enhanced regular expression rule are statistically calculated. Then, iterative optimization is implemented based on the indicator thresholds. For rules with a recognition accuracy below 90%, auxiliary features such as prefix and suffix context constraints are added, and exclusive negative filtering conditions are added to reduce false positives. For rules with a sample coverage below 85%, the feature matching range is appropriately expanded to include low-frequency but business-discriminatory key prefix and suffix expressions to reduce the omission of truly sensitive data. The testing and optimization process is continuously iterated until all rule indicators meet the standards, ultimately resulting in a stable, highly adaptable enhanced regular expression rule base that can be directly called by online detection processes.

[0056] Step 106: Obtain the unstructured data to be detected, preprocess the unstructured data to be detected to obtain a standardized text stream, call the enhanced regular expression rule library to perform streaming matching on the standardized text stream, and generate the corresponding sensitive data identification result after successful matching.

[0057] In some embodiments, unstructured data to be detected can be received via application programming interface (API), file upload, or server directory monitoring. The unstructured data is then subjected to format recognition and text extraction. The corresponding parsing engine is invoked to convert various format files into plain text content, removing format specifiers and whitespace characters, and merging them into a standardized text stream. Next, an enhanced regular expression rule library is invoked to perform streaming matching on the standardized text stream. The standardized text stream is segmented according to a preset length and then matched sequentially with various enhanced regular expressions in the rule library. Upon successful matching, the target sensitive data content and corresponding sensitive data tags are extracted. The source file's filename, file format, and matching location information are associated, generating a structured recognition result containing sensitive data tags, matching content, context snapshot, and source file metadata, which is then output. Through automated recognition and annotation of the unstructured data to be detected, a complete closed loop from rule construction to recognition application is achieved.

[0058] Based on the sensitive data identification method based on auxiliary information provided in this application, the sensitive data types to be identified are determined according to a preset data security policy, and corresponding sensitive data tags are configured for each type of sensitive data to form a sensitive data tag dictionary, which defines the boundaries for subsequent context sample collection. Next, for each sensitive data tag in the sensitive data tag dictionary, corresponding unstructured files are collected from a preset data source. Text localization and segmentation are performed on the sensitive data in each unstructured file to extract the target sensitive data and its corresponding context fragments, forming associated sample pairs containing the target sensitive data and its corresponding context fragments. This constructs a sample set, realizing the transformation from simply looking at the data itself to analyzing data and context in pairs, providing a data foundation for semantic discrimination. Then, the target sensitive data ontology features, context auxiliary features, and negative filtering features are extracted from each associated sample pair in the sample set to generate a multi-dimensional feature map of sensitive data. Based on the multidimensional feature map of sensitive data, an enhanced regular expression is constructed according to a pre-defined structural skeleton. The context, the target sensitive data ontology, and negative constraints are embedded into the regular expression skeleton, enabling a single enhanced regular expression to simultaneously verify data format and contextual information. This addresses the deficiency of traditional solutions that lack contextual discrimination. The enhanced regular expressions are then associated with their corresponding sensitive data tags, forming an enhanced regular expression rule base. Finally, unstructured data to be detected is acquired, preprocessed to obtain a standardized text stream, and the enhanced regular expression rule base is used to perform streaming matching on the standardized text stream. Successful matching generates the corresponding sensitive data identification result, while noise from failed matches is filtered out by negative features. This solves the technical problem of existing sensitive data identification methods relying solely on the format features of the data itself, lacking contextual semantic association judgment, leading to low accuracy in identifying sensitive data in unstructured data. It reduces the false positives and false negatives of traditional regular expressions, improving the accuracy of sensitive data identification.

[0059] In some embodiments, the step of extracting target sensitive data ontology features, contextual auxiliary features, and negative filtering features from each associated sample pair in the sample set to generate a multidimensional feature map of sensitive data includes: Using regular expression induction algorithm, pattern abstraction is performed on target sensitive data in sample set, the format constraints of target sensitive data are identified, and the ontological features of target sensitive data are obtained. The format constraints include at least one of length distribution, character type composition and check bit algorithm. By using natural language recognition technology, we analyze context fragments and target-sensitive data in the sample set, extract non-explicit semantic features, and obtain context-aided features. Using natural language processing semantic analysis techniques, noisy entities in the sample set are identified, and the contextual lexical features and sentence position features of the noisy entities are extracted to obtain negative filtering features. The target sensitive data ontology features, contextual auxiliary features, and negative filtering features are organized according to the corresponding sensitive data labels to form a multidimensional feature map of sensitive data.

[0060] Specifically, regular expression induction algorithms are algorithms that automatically identify common structural patterns by performing pattern analysis and abstraction on multiple target sensitive data samples. They can extract general format constraint expressions from specific numerical values. Format constraints are inherent rules that target sensitive data must satisfy at the character composition level, including length distribution (e.g., a mobile phone number is 11 digits), character type composition (e.g., an ID card number is numbers or numbers plus an X), and checksum algorithms (e.g., the last digit check rule for an ID card number). Natural language recognition technology uses techniques from the field of natural language processing, such as word frequency statistics, part-of-speech tagging, entity boundary recognition, and dependency parsing, to perform semantic-level parsing and feature extraction on text. Non-explicit semantic features are semantic information hidden in the context text that is not directly represented as sensitive data itself but plays an important auxiliary role in identification, including but not limited to prefix keywords, suffix keywords, high-frequency sentence templates, domain terms, and punctuation boundary patterns. Noisy entities are strings that are highly similar to target sensitive data in terms of format features but whose actual semantic attributes do not match the target data type, such as a string of numbers that conforms to the format of a mobile phone number but is actually an order number. Negative filtering features are semantic features extracted from the context of noisy entities to distinguish between real and pseudo-sensitive data. These features include specific words appearing around the noisy entity (such as order numbers and serial numbers) and their sentence positions. The sensitive data multidimensional feature map is a structured set of feature parameters organized by sensitive data labels. It includes three main categories: target sensitive data ontology features, contextual auxiliary features, and negative filtering features. It serves as an intermediate result connecting sample analysis and rule generation.

[0061] As an example, firstly, a regular expression induction algorithm is used to abstract patterns from the target sensitive data of each associated sample pair in the sample set, automatically identifying the inherent format constraints of the target sensitive data to obtain the target sensitive data ontology features. Format constraints include at least one of length distribution, character type composition, and checksum algorithm. For example, for the "ID number" tag, the regular expression induction algorithm automatically induces its structural feature of being 18 characters long and consisting of 17 digits plus a last digit or an X; for the "phone number" tag, the regular expression induction algorithm induces its format constraint of being 11 characters long, with the first digit being 1 and the second digit between 3 and 9, obtaining the target sensitive data ontology features. These target sensitive data ontology features are used as mandatory matching items in the subsequent enhanced regular expression structure construction step.

[0062] Secondly, using natural language processing (NLP) technology, the contextual fragments of each associated sample pair in the sample set are deeply analyzed to extract non-explicit semantic features, thus obtaining contextual auxiliary features. Specifically, text segmentation can be performed on the contextual fragments based on word segmentation technology (such as Jieba segmentation). The frequency of words appearing in the text before and after the target sensitive data is statistically analyzed, and prefix and suffix keywords with a frequency higher than a preset threshold (such as 30%) are automatically selected to construct a semantic weight table. For example, for the "name" tag, statistics show that the prefix patterns such as "name:", "contact person:", "legal representative:", and "handler:" appear frequently before the target data, as well as suffix patterns such as "(signature)" and "(stamp)". These prefix and suffix patterns are assigned corresponding semantic weights according to their frequency and then extracted as contextual auxiliary features. Simultaneously, high-frequency sentence templates are summarized, such as patterns like "[Label Name]: [Target Sensitive Data]" or "[Target Sensitive Data] ([Annotation])"; a domain-specific terminology dictionary is constructed (e.g., "account" and "card number" in the financial field, and "medical record number" and "diagnosis" in the medical field), and matched with contextual fragments; the semantic boundary function of punctuation marks such as colons, parentheses, and quotation marks is analyzed. These features collectively constitute contextual auxiliary features, used to provide positive matching constraints in enhanced regular expressions.

[0063] Next, natural language processing semantic analysis techniques are introduced to perform semantic disambiguation on candidate entities in the sample set. Specifically, based on the extracted ontology features, all strings conforming to the target data format features are recalled from the full text as candidate entities. Then, the semantic attributes of each entity are determined in its context to identify noisy entities (i.e., pseudo-sensitive data) that do not conform to the semantics of the target data type. For example, for strings conforming to the format of a person's name, if they are immediately followed by an organization suffix such as "Ministry of Commerce" or "Limited Company," or are in a non-personal context such as "Going to..." or "Located at...", they are excluded from the list of person's name entities. Similarly, for numeric strings conforming to the format of a mobile phone number, if they are preceded by modifiers such as "Order Number:" or "Serial Number:", they are determined not to be real mobile phone numbers. The negative filtering features obtained through semantic analysis will be transcribed into exclusive matching conditions in the subsequent regular expression construction stage, thereby pre-shielding noise interference at the matching logic level and reducing the false positive rate of sensitive data identification from the root.

[0064] Finally, the target sensitive data ontology features, context-aided features, and negative filtering features are organized according to their corresponding sensitive data labels to form a multi-dimensional feature map of sensitive data that includes positive matching features (ontology, prefix, suffix) and negative filtering features (semantic disambiguation). This multi-dimensional feature map of sensitive data clarifies the specific content, semantic weights, and logical relationships of various features, serving as complete input data for the subsequent structured construction steps of enhanced regular expressions. This ensures that the generated rules simultaneously possess multiple verification capabilities, including ontology format matching, positive auxiliary constraints, and negative exclusion filtering. Through a three-track parallel strategy of target sensitive data ontology abstraction, context-aided mining, and negative recognition, the sample information of natural language morphology is comprehensively transformed into quantifiable and rule-based feature parameters, constructing a multi-dimensional feature map covering positive matching and negative filtering. This solves the core bottleneck in traditional sensitive data identification methods where contextual semantics cannot be directly consumed by regular expressions, providing sufficient and accurate data-driven basis for the automated construction of enhanced regular expressions.

[0065] In some embodiments, the step of using natural language recognition technology to parse context fragments and target-sensitive data in the sample set, extracting non-explicit semantic features, and obtaining context-aided features includes: Using the position of the target sensitive data in the corresponding associated sample pair as the boundary, the context fragment of each associated sample pair is separated into the prefix text before the target sensitive data and the suffix text after the target sensitive data; The prefix and suffix texts of all related sample pairs were segmented using a word segmentation tool to determine the frequency of each word in all prefix texts and the frequency of each word in all suffix texts. Words that appear at a frequency greater than or equal to a preset frequency threshold are selected as high-frequency words. Semantic weights are assigned to each high-frequency word, and prefix semantic weight tables and suffix semantic weight tables are constructed respectively. Templated abstraction is performed on context fragments to summarize the sentence structure patterns between target sensitive data and context fragments. The sentence structure patterns include the separation pattern between tag names and target sensitive data and the enclosing pattern between target sensitive data and annotations. Each word in each context segment is matched with a pre-defined domain terminology dictionary. Words that match successfully are marked as domain-related words and included in the prefix auxiliary feature set or suffix auxiliary feature set. The frequency and positional relationship of preset punctuation marks before and after the target sensitive data are statistically analyzed, and semantic positioning features of punctuation marks are extracted. The preset punctuation marks include colons, parentheses, quotation marks, and commas. The prefix semantic weight table, suffix semantic weight table, sentence structure pattern, domain-related words, and punctuation semantic positioning features are merged and encapsulated into contextual auxiliary features.

[0066] Specifically, the sentence structure pattern refers to the typical sentence organization forms presented between the target sensitive data and context fragments, including separation patterns (such as "Label Name: Data") and enclosing patterns (such as "Data (Note)"). The domain terminology dictionary is a pre-constructed structured vocabulary containing specific terms from various business domains (such as finance, healthcare, and government affairs), used to identify domain-related words in the context. Domain-related words are terms strongly associated with the business domain to which the target sensitive data belongs, such as accounts and card numbers in the financial field, and medical record numbers and diagnoses in the medical field. Pre-selected punctuation marks are pre-selected punctuation marks, including colons (:), parentheses (()), quotation marks (""), and commas (、). Punctuation semantic location features are feature parameters that can be used to indicate the boundaries and types of the target sensitive data by statistically analyzing the frequency and positional distribution of various punctuation marks before and after the target sensitive data.

[0067] As an example, firstly, using the position of the target sensitive data within the corresponding associated sample pair as a boundary, the context fragments of each associated sample pair are separated into prefix text before the target sensitive data and suffix text after the target sensitive data. Specifically, the start character index and end character index of the target sensitive data in the context fragment are obtained. All text before the start character index is classified as prefix text, and all text after the end character index is classified as suffix text. For example, for the context fragment "Customer Name: Zhang San, Contact Number: 138..." When the target sensitive data is "Zhang San", the prefix text is "Customer Name:" and the suffix text is "Contact Number: 138". ".

[0068] Next, a word segmentation tool (such as Jieba) is used to perform word segmentation on the prefix and suffix texts of all associated sample pairs, dividing the continuous Chinese text into word sequences with independent semantic units. The frequency of each word in all prefix texts and all suffix texts is then calculated. The frequency of a word in the prefix text is calculated by dividing the number of times a word appears in the prefix text by the total number of prefix texts; the frequency of the suffix text is calculated similarly. For example, for all associated sample pairs under the "Name" tag, the statistics show that "Name:" appears in 85% of the prefix text, "Contact Person:" appears in 12%, and "Respected" appears in 8%.

[0069] Simultaneously, words with a frequency greater than or equal to a preset frequency threshold (preferably 30%) are selected as high-frequency words. Semantic weights are assigned to each high-frequency word, constructing prefix and suffix semantic weight tables respectively. The semantic weight assignment method for each word can be as follows: normalize the frequency to the range of 0 to 1 as the initial weight, and then determine the final weight value after expert knowledge calibration. For example, for the "name" tag, the prefix semantic weight table can record "Name:" as 0.95, "Contact Person:" as 0.60, "Legal Representative:" as 0.45, and "Agent:" as 0.40. The completed prefix and suffix semantic weight tables are passed to subsequent processing along with the contextual auxiliary features. At the same time, templated abstraction is performed on the context fragments to summarize the sentence structure patterns between the target sensitive data and the context fragments. The sentence structure pattern includes at least the separation pattern between the tag name and the target sensitive data (such as "[Tag Name]:[Target Sensitive Data]", "[Tag Name] is [Target Sensitive Data]", "[Tag Name] — [Target Sensitive Data]", etc.) and the enclosing pattern between the target sensitive data and the comment (such as "[Target Sensitive Data] ([Comment])", "[Target Sensitive Data], [Comment]", etc.). For example, for the tag "Bank Card Number", the sentence structure patterns that can be summarized include typical patterns such as "Receiving Account:[Target Sensitive Data]", "Opening Bank: XX Bank, Account Number:[Target Sensitive Data]", and "Please remit to [Target Sensitive Data]". The sentence structure pattern also incorporates contextual auxiliary features for the subsequent construction of enhanced regular expressions.

[0070] Next, each word in each context fragment is matched against a pre-defined domain terminology dictionary. Successfully matched words are marked as domain-relevant words and included in either a prefix auxiliary feature set or a suffix auxiliary feature set. The domain terminology dictionary is pre-constructed according to different business domains. In the financial domain, it includes terms such as account, card number, bank, payee, and payer; in the medical domain, it includes terms such as medical record number, diagnosis, hospitalization number, and medical insurance card number. For example, when the term "bank" appears in a context fragment, it is strongly correlated with the "bank card number" label in the financial domain and is marked and included in the prefix auxiliary feature set.

[0071] Furthermore, the frequency and positional relationship of preset punctuation marks before and after the target sensitive data are statistically analyzed to extract semantic positioning features of punctuation. Preset punctuation marks include colons (:), parentheses (), quotation marks (""), and commas (、). Specifically, the probability of each punctuation mark appearing in a preset window (e.g., the first 10 characters) before and after the target sensitive data is calculated, forming a punctuation distribution feature vector. Taking the "Name" tag as an example, the statistical results show that the probability of a colon appearing before the target sensitive data is 92%, the probability of parentheses appearing after the target sensitive data is 35%, and the probability of double quotation marks appearing before and after the target sensitive data is 18%. These punctuation distribution features reflect the semantic boundary indication role of different punctuation marks in the context of specific sensitive data types, providing a punctuation-level constraint basis for subsequently constructing enhanced regular expressions.

[0072] Finally, the prefix semantic weight table, suffix semantic weight table, sentence structure patterns, domain-related words, and punctuation semantic localization features are merged and encapsulated into contextual auxiliary features. These contextual auxiliary features, as an important component of the positive matching features in the multi-dimensional feature map of sensitive data, are used in the subsequent enhanced regular expression structuring steps to construct the prefix auxiliary feature set and the suffix auxiliary feature set. This provides quantifiable and ruleable contextual constraints for the regular expression, successfully transforming contextual semantic information that was originally not directly consumed by the regular expression into computable matching conditions.

[0073] By employing a multi-dimensional semantic mining strategy that combines word frequency statistics, sentence pattern induction, domain matching, and punctuation analysis, the contextual information of natural language morphology is comprehensively transformed into structured auxiliary feature parameters. This transforms the contextual semantics, which were originally not directly consumed by regular expressions, into quantifiable constraints. This solves the core bottleneck of traditional methods where there is context but it cannot be expressed by rules, and provides sufficient positive matching constraints for the automated construction of enhanced regular expressions.

[0074] In some embodiments, the step of constructing an enhanced regular expression based on a multidimensional feature map of sensitive data according to a preset structural skeleton includes: Read the prefix auxiliary feature set corresponding to each sensitive data label from the context auxiliary features in the multidimensional feature map of sensitive data, rewrite the prefix auxiliary feature set into prefix grouping through logical OR relation, and append the spacing quantifier after the prefix grouping; Read the ontology format features corresponding to each sensitive data label from the ontology features of the target sensitive data in the multidimensional feature map of sensitive data, and rewrite the ontology format features into a combination of regular character classes and quantifiers as mandatory matching items; Read the suffix auxiliary feature set corresponding to each sensitive data label from the context auxiliary features in the multidimensional feature map of sensitive data, rewrite the suffix auxiliary feature set into suffix grouping through logical OR relation, and set the suffix grouping as optional matching item; Read the negative semantic feature set corresponding to each sensitive data label from the multidimensional feature map of sensitive data, transcribe the negative semantic feature set into an exclusive matching logic embedding expression, and append it to the ontology format feature; The enhanced regular expressions for each sensitive data tag are generated by concatenating the prefix grouping, spacing quantifier, ontology format features, suffix grouping, and exclusive matching logic embedding expressions in sequence.

[0075] Specifically, the prefix auxiliary feature set is a set of semantic keywords extracted from context auxiliary features that appear before the target sensitive data, such as names and contact persons, to provide preliminary evidence for positive matching. The logical OR relation is the "|" operator in regular expressions, used to connect multiple optional matching patterns; matching is performed if any one of these patterns is satisfied. Prefix grouping is a regular expression capture group formed by combining multiple features from the prefix auxiliary feature set through logical OR relations. Spacing quantifiers are quantifiers in regular expressions used to limit the number of allowed spacing characters between auxiliary features and target sensitive data, avoiding overmatching due to excessive spacing. Ontology format features are the format rules of the target sensitive data, including length distribution, character type composition, and checksum algorithms. The combination of regular expression character classes and quantifiers is the basic matching unit for converting ontology format features into regular expressions; character classes (e.g., "\d") limit character types, and quantifiers (e.g., "{11}") limit the number of repetitions. Required matches are the core parts that must be matched in the enhanced regular expression, corresponding to the target sensitive data ontology; if the ontology does not match, the entire expression fails to match. The suffix auxiliary feature set is a set of semantic keywords extracted from context auxiliary features that appear after the target sensitive data. Optional matching terms refer to syntactic segments in the regular expression that are allowed to exist or be omitted without affecting the overall matching; in this application, suffix grouping is set as optional matching terms. The negative semantic feature set is a set of semantic features extracted from negative filtering features to exclude falsely sensitive data. The exclusive matching logic uses exclusion conditions constructed with zero-width negative assertion syntax to ensure that the target data is not in a specific interfering context during matching.

[0076] As an example, firstly, the prefix auxiliary feature set corresponding to each sensitive data label is read from the context auxiliary features in the multidimensional feature map of sensitive data. The prefix auxiliary feature set is then converted into prefix groups using logical OR relations, and a spacing quantifier is appended after the prefix group. For example, the feature strings in the prefix auxiliary feature set are connected with the "|" operator and enclosed in parentheses "()" to form a capture group. A spacing quantifier (preferably "{0,2}") is appended after the group to allow a limited number of spacing characters between the auxiliary features and the target data, avoiding omissions due to formatting differences. For example, for the "Name" label, if the prefix auxiliary feature set contains features such as "Name:", "Contact Person:", "Legal Representative:", and "Agent:", it is converted into the prefix group "(Name:|Contact Person:|Legal Representative:|Agent:)" and the spacing quantifier "{0,2}" is appended to form "(Name:|Contact Person:|Legal Representative:|Agent:){0,2}".

[0077] Secondly, the ontology format features corresponding to each sensitive data label are read from the ontology features of the target sensitive data in the multidimensional feature map of sensitive data. The ontology format features are then transcribed into a combination of regular character classes and quantifiers as mandatory matching items. For example, for the "ID number" label, the ontology format feature is "18 digits, 17 digits plus the last digit or X", which is transcribed as "\d{17}[\dXx]"; for the "mobile phone number" label, the ontology format feature is "11 digits, the first digit is 1 and the second digit is 3 to 9", which is transcribed as "1[3-9]\d{9}"; for the "name" label, the ontology format feature is "2 to 4 Chinese characters", which is transcribed as "[\u4e00-\u9fa5]{2,4}".

[0078] Simultaneously, the suffix auxiliary feature set corresponding to each sensitive data label is read from the contextual auxiliary features in the sensitive data multidimensional feature map. This suffix auxiliary feature set is then rewritten into suffix groups using logical OR relations, and these suffix groups are set as optional matching terms (with the quantifier "?") to allow for the presence or absence of auxiliary features behind the target data, avoiding omissions due to missing suffixes. For example, for the "Name" label, if the suffix auxiliary feature set contains features such as "(signature)", "(stamp)", "Mr", "Ms", or "Teacher", it is rewritten as "((signature)|(stamp)|Mr|Ms|Teacher)?". Next, the negative semantic feature set corresponding to each sensitive data label is read from the sensitive data multidimensional feature map. This negative semantic feature set is rewritten into an exclusive matching logical embedding expression and appended to the ontology format features to exclude noisy entities that are similar in format to the target data but do not match the semantic attributes. For example, for the "Mobile Number" label, if the negative semantic feature set contains interfering prefixes such as "Order Number:" or "Serial Number:", it is rewritten into an exclusive matching logical embedding expression.

[0079] Finally, the enhanced regular expressions for each sensitive data tag are generated by concatenating the prefix grouping, spacing quantifiers, ontology format features, suffix grouping, and exclusive matching logic embedding expressions in that order. For example, for the "Name" tag, the final enhanced regular expression is: "(Name:|Contact Person:|Legal Representative:|Agent:){0,2}([\u4e00-\u9fa5]{2,4})((Signature)|(Seal)|Mr|Ms|Teacher)?". When performing a match, this enhanced regular expression first checks for the existence of prefix auxiliary features and the reasonableness of the spacing; secondly, it verifies whether the core part conforms to the target sensitive data ontology format; then, it checks for the existence of suffix auxiliary features; and simultaneously excludes semantically inconsistent noisy entities. This achieves dual verification of format and context, thereby solving the problem of misjudgment and missed judgment caused by isolated matching in traditional regular expressions. Through multi-stage transcription and splicing operations, the ontology features, auxiliary features, and negative features in the multi-dimensional feature map are fully transformed into regular expression syntax, generating an enhanced regular expression that simultaneously possesses the triple verification capabilities of ontology format matching, positive auxiliary constraints, and negative exclusive filtering. This fundamentally solves the defect of traditional regular expressions that can only perform isolated format matching and cannot perceive the context.

[0080] In some embodiments, the steps of acquiring unstructured data to be detected and preprocessing the unstructured data to be detected to obtain a standardized text stream include: The unstructured data to be detected is obtained, and the format of the unstructured data to be detected is identified based on the file header suffix of the unstructured data to be detected, thus obtaining the file format of the unstructured data to be detected. The corresponding parsing engine is called according to the file format to extract the plain text content of the unstructured data to be detected; Perform preprocessing operations on plain text content, including removing newline characters, carriage returns, and tabs, merging consecutive whitespace characters into a single space, and concatenating multiple text segments into a continuous normalized text stream.

[0081] Specifically, the unstructured data to be detected refers to the raw data that needs to be identified and detected. The sources of this unstructured data can include documents circulating in business systems, email attachments, historical files stored on servers, etc., and the formats cover portable document formats, office document formats, spreadsheet formats, and text formats. The parsing engine is a dedicated text extraction tool called for different file formats; for example, portable document formats use a portable document format parsing engine, office document formats use an office document parsing engine, and text formats are read directly.

[0082] As an example, the system acquires unstructured data to be detected, which can be received via application programming interface (API), file upload, or server directory monitoring. The file format is determined through a double check using the file extension and hexadecimal header characteristics, effectively identifying and filtering disguised files whose extensions do not match the actual format. For instance, for portable document format files, if the file extension is ".pdf" and the header is "%PDF-1.", it is confirmed as a genuine portable document format. For office document format files, the system confirms the true format by recognizing the file extension ".docx" and the corresponding compressed file header characteristics. Based on the identified file format, the system calls the corresponding parsing engine to extract the plain text content of the unstructured data. For example, for text or spreadsheet format files, the text content is read directly; for portable document format files, the portable document format parsing engine is used to extract text; and for office document format files, the office document parsing engine is used to extract the main text content. Meta-information such as file name, file size, and creation time is recorded. Finally, preprocessing operations are performed on the plain text content. These operations include removing format control characters such as newlines, carriage returns, and tabs to prevent these typographical symbols from interfering with the regular expression's spacing quantifier matching; merging consecutive whitespace characters into single spaces to eliminate redundant whitespace caused by formatting; and concatenating the cleaned text segments into a continuous, standardized text stream. Double formatting checks ensure parsing security, format routing calls to a dedicated parsing engine ensure the accuracy of text extraction, and preprocessing eliminates typographical noise interference with regular expression matching, providing clean input data for the streaming matching step and avoiding matching failures due to file format differences or typographical noise.

[0083] In some embodiments, the step of calling an enhanced regular expression rule base to perform streaming matching on a standardized text stream, and generating corresponding sensitive data identification results after successful matching includes: Load the enhanced regular expression rule library; The standardized text stream is divided into segments based on a preset character length. For each segment, all enhanced regular expressions in the enhanced regular expression rule library are traversed sequentially for matching. When a match is successful, the target data content, the matched context fragments, and the corresponding sensitive data tags are extracted. The file metadata of the unstructured data to be detected and the text position of the target data content are associated to generate a structured sensitive data recognition result. The file metadata includes the file name, file size, and creation time.

[0084] As an example, an enhanced regular expression rule library is loaded. Upon program startup, the rule library file is automatically read, and a memory index is established between each sensitive data tag and its corresponding enhanced regular expression. Dynamic hot updates of the rules are supported; when the rule library file changes, the system can automatically reload and refresh the memory index. The standardized text stream is segmented into units of a preset character length, preferably 1024 characters. A segment-by-segment scanning method is used to sequentially traverse all enhanced regular expressions in the enhanced regular expression rule library for matching, ensuring smooth matching even for very large files (such as GB-level log files) within limited memory. When a match is successful, the target data content, the matched context fragment, and the corresponding sensitive data tag are extracted. This is then associated with the file metadata of the unstructured data to be detected and the text position information of the target data content in the source file (such as paragraph numbers, line numbers, etc.) to generate a structured sensitive data identification result. The file metadata includes the file name, file size, and creation time. Finally, the structured recognition results are output in JSON or Excel format for direct integration with existing data breach prevention systems, classification and grading systems, or storage on a data security platform for subsequent compliance audits and analysis, achieving seamless integration of the recognition results with the enterprise's existing security management system. By deploying the constructed enhanced regular expression rule library into an online business environment, the standardized text stream to be detected is matched and labeled with sensitive data efficiently and with high accuracy, thus completing a complete closed loop from rule construction to recognition application.

[0085] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the sensitive data identification method based on auxiliary information in this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0086] This application also provides a sensitive data identification device based on auxiliary information; please refer to [reference needed]. Figure 2 Sensitive data identification devices based on auxiliary information include: The data tag system definition module 201 is used to determine the sensitive data types to be identified according to the preset data security policy, and to configure corresponding sensitive data tags for each type of sensitive data to form a sensitive data tag dictionary; The unstructured file acquisition module 202 is used to acquire the corresponding unstructured file from a preset data source for each sensitive data tag in the sensitive data tag dictionary; The data sample construction module 203 is used to perform text location and slicing processing on sensitive data in each unstructured file, extract target sensitive data and corresponding context fragments, and construct a sample set; The multi-dimensional feature extraction module 204 is used to extract the target sensitive data ontology features, context auxiliary features and negative filtering features from each associated sample pair in the sample set, and generate a multi-dimensional feature map of sensitive data. The feature rule mapping and transformation module 205 is used to construct enhanced regular expressions based on the multidimensional feature map of sensitive data according to a preset structural skeleton, and to associate and store the enhanced regular expressions with the corresponding sensitive data labels to form an enhanced regular rule library; The rule invocation module 206 is used to acquire unstructured data to be detected, preprocess the unstructured data to be detected to obtain a standardized text stream, call the enhanced regular rule library to perform streaming matching on the standardized text stream, and generate the corresponding sensitive data identification result after successful matching.

[0087] The sensitive data identification device based on auxiliary information provided in this application, employing the sensitive data identification method based on auxiliary information in the above embodiments, can solve the technical problem that existing sensitive data identification methods rely solely on the format characteristics of the data itself, lacking contextual semantic association judgment, resulting in low accuracy in identifying sensitive data in unstructured data. Compared with the prior art, the beneficial effects of the sensitive data identification device based on auxiliary information provided in this application are the same as those of the sensitive data identification method based on auxiliary information provided in the above embodiments, and other technical features in the sensitive data identification device based on auxiliary information are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0088] This application provides a sensitive data identification device based on auxiliary information. The sensitive data identification device based on auxiliary information includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the sensitive data identification method based on auxiliary information in the above embodiment 1.

[0089] The following is for reference. Figure 3 The diagram illustrates a structural schematic of a sensitive data identification device based on auxiliary information suitable for implementing embodiments of this application. The sensitive data identification device based on auxiliary information in the embodiments of this application may include, but is not limited to, mobile terminals such as laptops, tablets (Portable Application Description, PADs), and in-vehicle terminals (e.g., in-vehicle navigation terminals), as well as fixed terminals such as digital TVs and desktop computers. Figure 3 The sensitive data identification device based on auxiliary information shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0090] like Figure 3As shown, the sensitive data identification device based on auxiliary information may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 1002 or a program loaded from storage device 1003 into random access memory (RAM) 1004. The random access memory 1004 also stores various programs and data required for the operation of the sensitive data identification device based on auxiliary information. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the input / output interface 1006: input devices 1007 including, for example, touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. Communication device 1009 allows the sensitive data identification device based on auxiliary information to communicate wirelessly or wiredly with other devices to exchange data. Although the figures show sensitive data identification devices based on auxiliary information with various systems, it should be understood that it is not required to implement or possess all the systems shown. More or fewer systems can be implemented alternatively.

[0091] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from read-only memory 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0092] The sensitive data identification device based on auxiliary information provided in this application, employing the sensitive data identification method based on auxiliary information in the above embodiments, can solve the technical problem that existing sensitive data identification methods rely solely on the format characteristics of the data itself, lacking contextual semantic association judgment, resulting in low accuracy in identifying sensitive data in unstructured data. Compared with the prior art, the beneficial effects of the sensitive data identification device based on auxiliary information provided in this application are the same as those of the sensitive data identification method based on auxiliary information provided in the above embodiments, and other technical features in this sensitive data identification device based on auxiliary information are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0093] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0094] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0095] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, the computer-readable program instructions being used to execute the sensitive data identification method based on auxiliary information in the above embodiments.

[0096] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatuses, or devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0097] The aforementioned computer-readable storage medium may be included in a sensitive data identification device based on auxiliary information; or it may exist independently and not assembled into a sensitive data identification device based on auxiliary information.

[0098] The aforementioned computer-readable storage medium carries one or more programs. When these programs are executed by a sensitive data identification device based on auxiliary information, the device performs the following actions: Based on a preset data security policy, it determines the sensitive data types to be identified and configures corresponding sensitive data tags for each type, forming a sensitive data tag dictionary; for each sensitive data tag in the sensitive data tag dictionary, it collects corresponding unstructured files from a preset data source; it performs text localization and slicing processing on the sensitive data in each unstructured file, extracting the target sensitive data and corresponding context fragments to construct a sample set; it extracts the target sensitive data ontology features, context auxiliary features, and negative filtering features from each associated sample pair in the sample set, generating a multi-dimensional feature map of sensitive data; based on the multi-dimensional feature map of sensitive data, it constructs an enhanced regular expression according to a preset structural skeleton, and associates and stores the enhanced regular expression with the corresponding sensitive data tag, forming an enhanced regular rule library; it acquires the unstructured data to be detected, preprocesses the unstructured data to be detected to obtain a standardized text stream, calls the enhanced regular rule library to perform streaming matching on the standardized text stream, and generates the corresponding sensitive data identification result upon successful matching.

[0099] Computer program products for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0100] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation that may be implemented in systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0101] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0102] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the aforementioned sensitive data identification method based on auxiliary information. This addresses the technical problem that existing sensitive data identification methods rely solely on the format characteristics of the data itself, lacking contextual semantic association judgment, resulting in low accuracy in identifying sensitive data in unstructured data. Compared to the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the sensitive data identification method based on auxiliary information provided in the above embodiments, and will not be elaborated upon here.

[0103] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the sensitive data identification method based on auxiliary information as described above.

[0104] The computer program product provided in this application can solve the technical problem that existing sensitive data identification methods rely solely on the format characteristics of the data itself and lack contextual semantic association judgment, resulting in low accuracy in identifying sensitive data in unstructured data. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the sensitive data identification method based on auxiliary information provided in the above embodiments, and will not be repeated here.

[0105] The above description is only a part of the embodiments of this application and does not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. A method for identifying sensitive data based on auxiliary information, characterized in that, The sensitive data identification method based on auxiliary information includes: Based on the preset data security policy, the sensitive data types to be identified are determined, and corresponding sensitive data tags are configured for each type of sensitive data type to form a sensitive data tag dictionary; For each sensitive data tag in the sensitive data tag dictionary, collect the corresponding unstructured file from a preset data source; Sensitive data in each of the unstructured files is located and sliced ​​to extract target sensitive data and corresponding context fragments, and a sample set is constructed. Extract the target sensitive data ontology features, contextual auxiliary features, and negative filtering features from each associated sample pair in the sample set to generate a multidimensional feature map of sensitive data; Based on the multidimensional feature map of the sensitive data, an enhanced regular expression is constructed according to a preset structural skeleton, and the enhanced regular expression is associated with the corresponding sensitive data label and stored to form an enhanced regular expression rule library; The unstructured data to be detected is acquired, and the unstructured data to be detected is preprocessed to obtain a standardized text stream. The enhanced regular expression rule library is called to perform streaming matching on the standardized text stream. After successful matching, the corresponding sensitive data identification result is generated. The step of constructing an enhanced regular expression based on the multidimensional feature map of the sensitive data according to a preset structural skeleton includes: Read the prefix auxiliary feature set corresponding to each sensitive data label from the context auxiliary feature in the sensitive data multidimensional feature map, rewrite the prefix auxiliary feature set into prefix grouping through logical OR relation, and append the spacing quantifier after the prefix grouping; Read the ontology format features corresponding to each of the sensitive data tags from the ontology features of the target sensitive data in the multidimensional feature map of the sensitive data, and rewrite the ontology format features into a combination of regular character classes and quantifiers as mandatory matching items; Read the suffix auxiliary feature set corresponding to each sensitive data label from the context auxiliary features in the multidimensional feature map of the sensitive data, rewrite the suffix auxiliary feature set into suffix groups through logical OR relation, and set the suffix groups as optional matching items; Read the negative semantic feature set corresponding to each sensitive data label from the sensitive data multidimensional feature map, transcribe the negative semantic feature set into an exclusive matching logic embedding expression, and append it to the ontology format feature; The enhanced regular expression corresponding to each of the sensitive data tags is generated by concatenating the prefix grouping, the spacing quantifier, the ontology format feature, the suffix grouping, and the exclusive matching logic embedding expression in that order.

2. The sensitive data identification method based on auxiliary information as described in claim 1, characterized in that, The steps of determining the sensitive data types to be identified according to a preset data security policy, and configuring corresponding sensitive data tags for each type of sensitive data to form a sensitive data tag dictionary include: Based on the preset data security policy, enumerate the sensitive data types to be identified; Configure a corresponding sensitive data label for each type of sensitive data type, and bind corresponding association information to the sensitive data label. The association information includes data category, data classification, and standard specification information. The sensitive data tags and their corresponding associated information are summarized to form the sensitive data tag dictionary.

3. The sensitive data identification method based on auxiliary information as described in claim 1, characterized in that, The step of collecting corresponding unstructured files from a preset data source for each sensitive data tag in the sensitive data tag dictionary includes: Unstructured data in various file formats, including text, portable document, office document, and spreadsheet formats, are obtained from the preset data source through an application programming interface. For each of the sensitive data tags in the sensitive data tag dictionary, the unstructured data is filtered using the sensitive data tag to obtain the unstructured file corresponding to each sensitive data tag.

4. The sensitive data identification method based on auxiliary information as described in claim 1, characterized in that, The steps of performing text localization and slicing processing on sensitive data in each of the unstructured files, extracting target sensitive data and corresponding context fragments, and constructing a sample set include: Text content is extracted from each of the unstructured files to obtain the corresponding plain text content; Determine the target regular expression corresponding to each of the plain text contents, wherein the target regular expression is the base regular expression whose sensitive data tags are the same as the sensitive data tags of the plain text contents; The target regular expression is used to perform a preliminary match on the corresponding plain text content to determine the starting character index and ending character index of the target sensitive data in the plain text content; Centered on the starting character index and the ending character index, a text segment of a predetermined number of characters is extracted forward and backward respectively to form an initial associated sample pair containing the target sensitive data and the corresponding context segment; Metadata tags are added to each of the initial associated sample pairs. The metadata tags include the sample source, file format, and business scenario. A sample set including multiple associated sample pairs is constructed. The associated sample pairs include the target sensitive data, the context fragment, and the metadata tags.

5. The sensitive data identification method based on auxiliary information as described in claim 1, characterized in that, The step of extracting target sensitive data ontology features, contextual auxiliary features, and negative filtering features from each associated sample pair in the sample set to generate a multidimensional feature map of sensitive data includes: Using a regular expression inductive algorithm, pattern abstraction is performed on the target sensitive data in the sample set, the format constraints of the target sensitive data are identified, and the ontological features of the target sensitive data are obtained. The format constraints include at least one of length distribution, character type composition, and check bit algorithm. Using natural language recognition technology, the context fragments and target sensitive data in the sample set are parsed to extract non-explicit semantic features and obtain the context auxiliary features; Using natural language processing semantic analysis techniques, noisy entities in the sample set are identified, and the contextual lexical features and sentence position features of the noisy entities are extracted to obtain the negative filtering features; The target sensitive data ontology features, the context auxiliary features, and the negative filtering features are organized according to the corresponding sensitive data labels to form the sensitive data multidimensional feature map.

6. The sensitive data identification method based on auxiliary information as described in claim 5, characterized in that, The step of using natural language recognition technology to parse context fragments and target-sensitive data in the sample set, extracting non-explicit semantic features, and obtaining the context auxiliary features includes: Using the position of the target sensitive data in the corresponding associated sample pair as the boundary, the context fragment of each associated sample pair is separated into the prefix text before the target sensitive data and the suffix text after the target sensitive data; The prefix and suffix texts of all related sample pairs are segmented using a word segmentation tool to determine the frequency of each word in all the prefix texts and the frequency of each word in all the suffix texts. Words whose frequency of occurrence is greater than or equal to a preset frequency threshold are selected as high-frequency words. Semantic weights are assigned to each of the high-frequency words, and prefix semantic weight tables and suffix semantic weight tables are constructed respectively. The context fragment is subjected to templated abstraction to summarize the sentence structure pattern between the target sensitive data and the context fragment. The sentence structure pattern includes the separation pattern between the tag name and the target sensitive data and the enclosing pattern between the target sensitive data and the annotation. Each word in each of the aforementioned context segments is matched with a preset domain terminology dictionary. The words that are successfully matched are marked as domain-related words, and the domain-related words are included in a prefix auxiliary feature set or a suffix auxiliary feature set. The frequency and positional relationship of preset punctuation marks before and after the target sensitive data are statistically analyzed, and the semantic positioning features of the punctuation marks are extracted. The preset punctuation marks include colons, parentheses, quotation marks, and commas. The prefix semantic weight table, the suffix semantic weight table, the sentence structure pattern, the domain-related words, and the punctuation semantic positioning features are merged and encapsulated into the context auxiliary features.

7. The sensitive data identification method based on auxiliary information as described in claim 1, characterized in that, The steps of acquiring the unstructured data to be detected and preprocessing the unstructured data to obtain a standardized text stream include: Obtain the unstructured data to be detected, and identify the format of the unstructured data to be detected based on the file header suffix of the unstructured data to be detected, thereby obtaining the file format of the unstructured data to be detected; According to the file format, the corresponding parsing engine is called to extract the plain text content of the unstructured data to be detected; Preprocessing operations are performed on the plain text content, including removing newline characters, carriage returns and tabs, merging consecutive whitespace characters into a single space, and concatenating multiple text segments into a continuous standardized text stream. The step of calling the enhanced regular expression rule base to perform streaming matching on the standardized text stream, and generating the corresponding sensitive data identification result after successful matching includes: Load the enhanced regular expression rule library; The standardized text stream is divided into segments according to a preset character length, and each segment is matched by sequentially traversing all the enhanced regular expressions in the enhanced regular expression rule library. When a match is successful, the target data content, the matched context fragment, and the corresponding sensitive data tags are extracted, and the file metadata of the unstructured data to be detected and the text position of the target data content are associated to generate a structured sensitive data identification result. The file metadata includes the file name, file size, and creation time.

8. A sensitive data identification device based on auxiliary information, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the sensitive data identification method based on auxiliary information as described in any one of claims 1 to 7.

9. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the sensitive data identification method based on auxiliary information as described in any one of claims 1 to 7.

Images