A sensitive data flow transfer path reconstruction and completion method based on a graph neural network and time coding

Abstract

The application discloses a sensitive data flow transfer path reconstruction and completion method based on a graph neural network and time coding, and belongs to the field of data security and time sequence graph deep learning. The application collects multiple types of flow transfer logs to construct a continuous time data flow transfer graph with timestamps; a time sequence constraint random walk is used to generate a candidate path, and a Span-Mask is used to construct a missing sample; a data set is divided according to time, and only historical time sequence edges are used to construct a GCN training graph to prevent future information leakage. The application extracts node topological features through a GCN, encodes time differences through Time2Vec, and sends the features into a Transformer after being fused through a gate to predict missing nodes of a mask and reconstruct complete flow transfer links. The application scheme fuses global topological, time sequence and path context information, solves the problems of incomplete logs and broken links, improves the completion accuracy of missing continuous nodes, and can be used for data leakage tracing and security auditing.

Description

Technical Field

[0001] This invention relates to the fields of data security auditing, data breach tracing, and time-series graph deep learning, specifically a method for reconstructing and completing sensitive data flow paths based on graph neural networks and time coding. Background Technology

[0002] In scenarios involving cross-enterprise business collaboration, data platforms, cloud-edge-device integration, and multi-organizational data exchange, sensitive data is continuously transmitted and interacted between user terminals, business services, databases, files, processes, network devices, and security gateways. To meet network security compliance, data breach tracing, and internal security audit requirements, operations and maintenance personnel need to rely on various operation logs to reconstruct the complete data flow chain and locate the source of the breach and abnormal propagation nodes.

[0003] In real-world business environments, incomplete data flow is a common problem: network fluctuations lead to incomplete log collection, attackers maliciously delete operation traces, inconsistent log granularity across multiple platforms, and system failures result in the loss of historical records. Ultimately, the data flow path suffers from missing nodes, broken flow edges, and discontinuous timing. Existing technologies exhibit three significant drawbacks: Traditional static graph analysis methods only depict the static relationships between devices and systems, ignoring the causal relationships of data flow and failing to distinguish between sequential interactions. Pure sequence prediction models (LSTM / Transformer): focus only on the order of a single path, cannot utilize global network topology, and are difficult to uncover potential flow relationships between nodes; Statistical completion schemes (shortest path, high-frequency neighbors, highest frequency nodes): relying solely on simple statistical rules, the completion effect is extremely poor in scenarios with multiple missing nodes, easily affected by high-frequency devices, and the reliability of the traceability results is low.

[0004] Current technologies cannot simultaneously integrate three types of information: global graph topology, event timing patterns, and the context of the entire path. In scenarios with incomplete logs, path completion accuracy is insufficient, making it difficult to support accurate data leak tracing and auditing. Therefore, there is an urgent need for a sensitive data flow path reconstruction and completion solution that can take into account graph structure, temporal dynamics, and path context. Summary of the Invention

[0005] To address the aforementioned issues, this invention proposes a method for reconstructing and completing sensitive data flow paths based on graph neural networks and time coding. This method simultaneously integrates three types of information: global graph topology, temporal evolution patterns, and path context. It can resolve issues of incomplete flow links caused by log loss, attacker wiping of traces, and cross-domain record breaks, significantly improving the accuracy of path completion in scenarios with missing single nodes and multiple consecutive nodes. It can be used for data leakage tracing, security auditing, and cross-domain data compliance verification scenarios.

[0006] To achieve the above objectives, the technical solution of the present invention is implemented as follows: A method for reconstructing and completing sensitive data flow paths based on graph neural networks and time coding, comprising: Acquire records related to the flow of sensitive data, and construct a continuous time data flow graph based on the records. The continuous time data flow graph includes several flow nodes and flow edges connecting the flow nodes, and the flow edges have timestamps. Based on the continuous time data flow diagram, candidate flow paths are generated according to the time increment constraint; At least one intermediate flow node in the candidate flow path is masked to obtain the masked path, the real label path, the time series, and the sample time; the masking process includes span-masking the continuous flow node segments. The path completion samples are divided into time sequences according to the sample time, and a graph neural network training graph is constructed based on the flow edges within the time range of the training phase. The training graph of the graph neural network is input into the graph convolutional network (GCN) to obtain the node structure representation of each transition node; Based on the mask path, the node structure representation, and the time series, a path context representation is obtained; wherein, the time representation is obtained using a Time2Vec encoder, the node structure representation and the time representation are fused through a gated fusion network, and the path context representation is output through a Transformer path encoder. Based on the path context representation, the missing flow nodes corresponding to the mask positions in the mask path are predicted to obtain the reconstructed sensitive data flow path.

[0007] Furthermore, the generation of candidate flow paths according to the time-incrementing constraint includes: For any flow node in the continuous time data flow graph, obtain the adjacent flow edges of the flow node and sort them by timestamp; start a random walk from the flow node, and select only flow edges whose timestamps are greater than the timestamp of the end of the current path as candidate edges for the next hop; the candidate edge set satisfies:

[0008] If the set is empty, relax the constraints:

[0009] By concatenating the candidate paths, we obtain the sequentially increasing candidate paths: ; in, Indicates the current end node In time The next set of candidate edges to choose from; the system prioritizes excluding those that immediately return to the previous node. The candidate edges are set, and backtracking edges that satisfy the time-incrementing constraint are allowed only when the set is empty. P represents the candidate flow path that satisfies the time-incrementing constraint.

[0010] Furthermore, when selecting the next hop edge during a random walk, edges that immediately return the path to the previous hop node are excluded; only when there are no compliant candidate edges are back-off edges that satisfy the time-incrementing constraint allowed to be selected.

[0011] Furthermore, the span-mask processing includes: retaining the first and last nodes of the candidate path as context; determining the start position of the mask and the length of the mask segment at the intermediate nodes, and replacing consecutive intermediate nodes with mask identifiers; for the real label path, only the mask positions retain the real node labels, and the remaining positions are set to ignore identifiers; Training uses labeled smooth cross-entropy loss:

[0012] Where s is the starting position of the mask, and r is the length of the mask segment. This is the set of mask locations participating in supervised training; only the mask locations are used in loss calculation.

[0013] Furthermore, the step of dividing the path completion samples into temporal sequences based on the sample time, and constructing a graph neural network training graph based on the flow edges within the training phase time range, includes: The sample time is determined based on the maximum value of the valid original timestamps in each path completion sample; The path completion samples are divided into training samples, validation samples, and test samples according to the sample time from morning to evening. The maximum sample time corresponding to the training sample is determined, and the transition edges with timestamps less than or equal to the maximum sample time are used as transition edges within the training phase time range to construct the graph neural network training graph and isolate future time sequence information.

[0014] Furthermore, the graph convolutional network (GCN) adopts a two-layer neighborhood aggregation node extraction structure, and the core normalized convolution calculation formula is:

[0015]

[0016]

[0017] Where A is the adjacency matrix of the training graph, I is the self-loop matrix, and X is the initial node embedding. For the trainable parameters of the l-th layer, Z is a non-linear activation function, and Z is the node structure representation of the output of a two-layer graph convolutional network.

[0018] Furthermore, the Time2Vec time encoder will measure the time difference between adjacent events. The time representation is mapped to a concatenation of linear trend components and periodic components:

[0019]

[0020] in, For linear trend components, It is a periodic component; This is the trainable position embedding matrix, corresponding to position_embedding in the code.

[0021] Furthermore, the gated fusion network generates a gate coefficient to dynamically control the time feature fusion strength, and the fusion path representation is calculated as follows:

[0022] In the formula Represented as path nodes. For position encoding, For time representation, The gating coefficient, This is for element-wise multiplication.

[0023] Furthermore, the Transformer path encoder captures long-distance path dependencies through multi-head self-attention, with the core attention calculation formula being:

[0024] Where Q, K, and V are the query, key, and value vectors, respectively, and M is the attention masking matrix, used to mask invalid placeholder positions in the path.

[0025] Furthermore, when predicting missing transition nodes, the path context representation is fed into the classifier to output the probability of each node, and the optimal mask position is used to fill in the missing node while satisfying the following conditions:

[0026] The output prediction nodes are filled into the mask positions to generate a complete reconstruction of the sensitive data flow path; candidate nodes can be filtered by combining asset, business domain, and access permission rules.

[0027] Beneficial effects: Multi-dimensional information collaborative modeling: By integrating GCN global topology, Time2Vec temporal features, and Transformer path context, the coupling effect of these three types of information significantly improves the accuracy of continuous missing segment completion compared to a single model; Adapted to real-world security log corruption scenarios: The Span-Mask training method can simultaneously learn single-point and continuous multi-point missing repair, solving the problem of long-fragment breakage failure in traditional methods; Time-constrained random walk sample generation: strictly follows the causal time of data flow, avoids meaningless back-and-forth jumps, and the training samples closely match the real business process; Temporal isolation training mechanism: Training is conducted using only historical time series graphs to eliminate interference from future information, and the model evaluation results have the credibility for engineering application. Adaptive gating fusion: dynamically adjusts the weight of time information at different path locations to distinguish between short-term high-frequency interactions and long-term periodic flow patterns; Highly adaptable to engineering applications: It is compatible with all types of security logs, outputs a complete workflow, and can be directly used for data leakage tracing, compliance auditing, and cross-domain data risk investigation.

[0028] Ablation experiments demonstrate that removing the Time2Vec or GCN module significantly reduces the model's Hits@1 and Span Exact Match metrics, proving that topological and temporal features are indispensable, and that the combination of multiple modules produces unexpected synergistic effects. Attached Figure Description

[0029] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an undue limitation of the invention. In the drawings: Figure 1 This is a flowchart of the sensitive data flow path reconstruction and completion method based on graph neural networks and time coding as described in an embodiment of the present invention; Figure 2 This is a schematic diagram of the Span-Mask sample construction of the present invention; Figure 3 This is a schematic diagram of the overall structure of the model of the present invention; Figure 4 This is a schematic diagram showing the comparison results of the ablation experiment and the baseline of the present invention; Figure 5 This is a schematic diagram of the convergence curve of the model training in this invention. Detailed Implementation

[0030] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other.

[0031] The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0032] This embodiment can be deployed on data security audit platforms, leak tracing servers, and cross-domain data supervision systems. The steps of this invention will be described in detail below with reference to the accompanying drawings and complete calculation formulas.

[0033] See Figure 1 This embodiment of a method for reconstructing and completing sensitive data flow paths based on graph neural networks and time coding specifically includes the following steps: Step 101: Obtain sensitive data flow related records, and construct a continuous time data flow graph G=(V,E,T) based on the sensitive data flow related records.

[0034] Records related to sensitive data flow can include at least one of the following: sensitive data flow logs, access logs, network flow logs, host behavior logs, security identification records, cross-domain exchange records, process call records, and file access records. Each record must include at least the source object, the target object, and the event timestamp, and may optionally include information such as interaction type, exception label, node attributes, edge attributes, security identification, business domain, device type, or data type.

[0035] The system maps source and target objects as flow nodes, and maps a single access, transmission, call, read, write or cross-domain exchange behavior as a flow edge with a timestamp, thereby constructing a continuous time data flow graph G=(V,E,T).

[0036] In one optional implementation, for flow scenarios of approximate bipartite graphs or heterogeneous graphs, the system counts the occurrence frequency of source objects and target objects respectively, and retains source objects and target objects whose occurrence frequency meets preset conditions, so as to adapt to flow forms such as user to resource, host to service, process to file or business system to database.

[0037] Step 102: Based on the continuous time data flow diagram, generate candidate flow paths according to the time increment constraint.

[0038] The system performs multiple random walks starting from nodes with adjacent edges. For the terminal node in the current path, the system obtains the adjacent edges of that terminal node and selects adjacent edges with timestamps greater than the timestamp of the current path's terminal node as candidate edges. To reduce meaningless short-period oscillations, the system prioritizes excluding candidate edges that would immediately return the path to the previous node; if no candidate edges are found after exclusion, backtracking edges that satisfy the time-incrementing constraint are allowed. The resulting candidate paths preserve the temporal order of flow events while obtaining a sufficient number of training samples.

[0039] The time-increasing constraint of the candidate flow path and the candidate edge set can be expressed by the following formula:

[0040]

[0041]

[0042] in, Indicates the current end node In time The next set of candidate edges to choose from; the system prioritizes excluding those that immediately return to the previous node. The candidate edges are set, and backtracking edges that satisfy the time-incrementing constraint are allowed only when the set is empty. P represents the candidate flow path that satisfies the time-incrementing constraint.

[0043] Step 103: Mask at least one intermediate flow node in the candidate flow path to obtain the masked path, the real label path, the time series, and the sample time.

[0044] like Figure 2 As shown, the system retains the first and last nodes of the candidate transition path as context nodes, determines the mask start position and mask segment length from the intermediate nodes, and replaces the continuous transition nodes between the mask start position and the mask end position with the [MASK] identifier. In the real label path, the real transition node label is only retained at the mask position, and the IGNORE identifier is set at the non-mask position, so that the model training loss is calculated only by the mask position. This span-mask processing method can simultaneously cover path completion scenarios with a single missing node and multiple consecutive missing nodes.

[0045] The span-mask sample construction and the real label path can be represented as:

[0046]

[0047]

[0048] Where s is the starting position of the mask, and r is the length of the mask segment. This is the set of mask locations for participating in supervised training.

[0049] The model training loss function can be expressed as:

[0050]

[0051] Among them, z i ε is the classifier output at position i, V is the set of transition node categories, and ε is the label smoothing coefficient; IGNORE positions are not included in the loss calculation.

[0052] Step 104: Divide the path completion samples into time sequences according to the sample time, and construct a graph neural network training graph based on the flow edges within the training phase time range.

[0053] The system determines the maximum valid original timestamp in each path completion sample as the sample time, and divides the samples into training samples, validation samples, and test samples according to the sample time from earliest to latest. For example, in the experiment, a division ratio of 70%, 10%, and 20% was used. Furthermore, the system determines the maximum sample time corresponding to the training sample, and only uses the flow edges with timestamps less than or equal to this maximum sample time to construct the graph neural network training graph, thereby avoiding the introduction of future edges from the validation or testing phases during the node structure encoding stage.

[0054] Step 105: Input the graph neural network training graph into the graph neural network to obtain the node structure representation of each flow node.

[0055] In one alternative implementation, the graph neural network is a graph convolutional network. The graph convolutional network includes a node embedding layer, a first graph convolutional layer, a non-linear activation layer, and a second graph convolutional layer. The node embedding layer maps the transit node numbers to initial node vectors, and the graph convolutional layer fuses neighborhood structure information, outputting a node structure representation of the transit node. For PAD and MASK identifiers, the system uses trainable embeddings projected to the same dimension as the node structure representation to share the input path encoding model with the real transit nodes.

[0056] The GCN neighborhood aggregation update formula can be expressed as:

[0057]

[0058]

[0059] Where A is the adjacency matrix of the training graph, I is the self-loop matrix, and X is the initial node embedding. Let Z be the trainable parameters of the l-th layer, and Z be the node structure representation of the output of the two-layer graph convolutional network.

[0060] Step 106: Obtain the path context representation based on the mask path, the node structure representation, and the time series.

[0061] like Figure 3 As shown, the system obtains the path node representation of each position in the mask path based on the node structure representation, and obtains the position code based on the path position number. The system further converts the time series into a time difference sequence between adjacent flow events, and inputs the time difference sequence into the Time2Vec time encoder. The Time2Vec time encoder maps each time difference into a time representation containing a linear trend component and a periodic component, where the linear trend component is used to capture the time evolution trend, and the periodic component is used to capture potential periodic flow patterns.

[0062] Time difference sequences, Time2Vec time codes, and position codes can be represented as:

[0063]

[0064]

[0065] in, For linear trend components, It is a periodic component; This is the trainable position embedding matrix, corresponding to position_embedding in the code.

[0066] After obtaining the path node representation and time representation, the system generates gating coefficients through a gated fusion network. Specifically, the gated fusion network generates gating coefficients based on the concatenated vector of the path node representation and time representation, and applies these gating coefficients to the time representation. Then, the gated time representation is added to the path node representation and the position encoding to obtain the fused path representation. Finally, the system inputs the fused path representation into the Transformer path encoder to capture long-range contextual dependencies in the path and outputs the path context representation.

[0067] The generation of gated fusion weights and the feature addition fusion can be represented as:

[0068]

[0069]

[0070] Among them, h i v Let h be the path node representation at position i. i t p is the time representation directly output by Time2Vec. i For trainable positional encoding, g i is the gating coefficient, and ⊙ represents element-wise multiplication.

[0071] The calculation formula for the Transformer path encoder is:

[0072]

[0073]

[0074]

[0075] Where X=[ , ,..., ] represents the fusion path, Q, K, and V are the query, key, and value vectors, respectively, M is the attention masking matrix used to mask invalid placeholder positions in the path, and C is the path context representation.

[0076] Step 107: Based on the path context representation, predict the missing flow node corresponding to the mask position in the mask path to obtain the reconstructed sensitive data flow path.

[0077] The system inputs the path context representation into the classifier, which outputs the node class probability for each position in the masked path. During inference, the system obtains the Top-1 or Top-k candidate nodes corresponding to the masked positions and fills the missing positions with these candidate nodes to obtain the reconstructed sensitive data flow path. Furthermore, the system can filter and sort candidate nodes by combining security identifiers, asset attributes, business domains, alarm contexts, or access permission rules.

[0078] The classifier output and Top-k completion results can be represented as:

[0079]

[0080]

[0081]

[0082] Among them, C i Let W1, b1, W2, and b2 be the context representation of the i-th path position, and let W1, b1, W2, and b2 be the parameters of a two-layer MLP classifier. Complete the nodes for Top-1, TopK i This is the set of Top-k candidate nodes.

[0083] Data verification: To verify the effectiveness of the method of this invention, this embodiment conducted experiments based on publicly available time-series graph data. The experiments used 200,000 original edges, which were filtered to obtain 77,834 edges and 19,170 nodes, generating 233,605 candidate paths and 570,376 span-mask samples; the training samples were 399,263, the validation samples were 57,037, and the test samples were 114,076. During model training, cross-entropy loss, label smoothing, gradient pruning, and cosine annealing strategies were employed. Evaluation metrics included Hits@1, Hits@5, and Span Exact Match, where Span Exact Match indicates that all masked nodes in the same sample are correctly predicted.

[0084] Experimental results are as follows Figure 4-5 As shown, when the complete model is optimal on the validation set Hits@5, the test set Hits@1 is 0.2107, Hits@5 is 0.3239, and Span Exact Match is 0.1699. The expected values ​​of the random baseline are Hits@1 and Hits@5 are 0.000059 and 0.000297, respectively; the highest frequency baseline has Hits@1 of 0.000351 and Hits@5 of 0.007394; and the neighbor frequency baseline has Hits@1 of 0.080235, Hits@5 of 0.263623, and Span Exact Match of 0.075581. Therefore, this invention significantly improves the completion capability for missing flow nodes compared to a simple statistical baseline.

[0085] Furthermore, when evaluating by mask fragment length, the complete model achieves Hits@1 of 0.2425, Hits@5 of 0.3440, and Span Exact Match of 0.2425 in the single-node missing scenario; and Hits@1 of 0.1840, Hits@5 of 0.3075, and Span Exact Match of 0.0474 in the scenario of two consecutive missing nodes. Ablation experiments show that after removing Time2Vec, the test set Hits@1 is 0.1606, Hits@5 is 0.2689, and Span Exact Match is 0.1319; when using only the Transformer with Time2Vec without GCN structure encoding, the test set Hits@1 is 0.1473, Hits@5 is 0.2333, and Span Exact Match is 0.1123. These results indicate that both time encoding and graph structure encoding contribute to the completion of sensitive data flow paths.

[0086] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for reconstructing and completing sensitive data flow paths based on graph neural networks and time coding, characterized in that, include: Acquire records related to the flow of sensitive data, and construct a continuous time data flow graph based on the records. The continuous time data flow graph includes several flow nodes and flow edges connecting the flow nodes, and the flow edges have timestamps. Based on the continuous time data flow diagram, candidate flow paths are generated according to the time increment constraint; At least one intermediate flow node in the candidate flow path is masked to obtain the masked path, the real label path, the time series, and the sample time; the masking process includes span-masking the continuous flow node segments. The path completion samples are divided into time sequences according to the sample time, and a graph neural network training graph is constructed based on the flow edges within the time range of the training phase. The training graph of the graph neural network is input into the graph convolutional network (GCN) to obtain the node structure representation of each transition node; Based on the mask path, the node structure representation, and the time series, a path context representation is obtained; wherein, the time representation is obtained using a Time2Vec encoder, the node structure representation and the time representation are fused through a gated fusion network, and the path context representation is output through a Transformer path encoder. Based on the path context representation, the missing flow nodes corresponding to the mask positions in the mask path are predicted to obtain the reconstructed sensitive data flow path.

2. The method for reconstructing and completing sensitive data flow paths based on graph neural networks and time coding according to claim 1, characterized in that, The generation of candidate flow paths according to the time-incrementing constraint includes: For any flow node in the continuous time data flow graph, obtain the adjacent flow edges of the flow node and sort them by timestamp; start a random walk from the flow node, and select only flow edges whose timestamps are greater than the timestamp of the end of the current path as candidate edges for the next hop; the candidate edge set satisfies: If the set is empty, relax the constraints: By concatenating the candidate paths, we obtain the sequentially increasing candidate paths: ; in, Indicates the current end node In time The next set of candidate edges to choose from; the system prioritizes excluding those that immediately return to the previous node. The candidate edges are set, and backtracking edges that satisfy the time-incrementing constraint are allowed when the set is empty. P represents the candidate flow path that satisfies the time-incrementing constraint.

3. The method for reconstructing and completing sensitive data flow paths based on graph neural networks and time coding according to claim 2, characterized in that, When selecting the next hop edge during a random walk, edges that immediately return the path to the previous hop node are excluded; only when there are no compliant candidate edges are back-off edges that satisfy the time-incrementing constraint allowed.

4. The method for reconstructing and completing sensitive data flow paths based on graph neural networks and time coding according to claim 1, characterized in that, The span-mask processing includes: retaining the first and last nodes of the candidate path as context; determining the start position and length of the mask at the intermediate nodes, and replacing consecutive intermediate nodes with mask identifiers; for the real label path, only the mask positions retain the real node labels, and the remaining positions are set to ignore identifiers; Training uses labeled smooth cross-entropy loss: Where s is the starting position of the mask, and r is the length of the mask segment. This is the set of mask locations participating in supervised training; only the mask locations are used in loss calculation.

5. The method for reconstructing and completing sensitive data flow paths based on graph neural networks and time coding according to claim 1, characterized in that, The step of dividing the path completion samples into temporal sequences based on the sample time, and constructing a graph neural network training graph based on the flow edges within the training phase time range, includes: The sample time is determined based on the maximum value of the valid original timestamps in each path completion sample; The path completion samples are divided into training samples, validation samples, and test samples according to the sample time from morning to evening. The maximum sample time corresponding to the training sample is determined, and the transition edges with timestamps less than or equal to the maximum sample time are used as transition edges within the training phase time range to construct the graph neural network training graph and isolate future time sequence information.

6. The method for reconstructing and completing sensitive data flow paths based on graph neural networks and time coding according to claim 1, characterized in that, The graph convolutional network (GCN) uses a two-layer neighborhood aggregation node extraction structure, and its core normalized convolution calculation formula is: Where A is the adjacency matrix of the training graph, I is the self-loop matrix, and X is the initial node embedding. For the trainable parameters of the l-th layer, Z is a non-linear activation function, and Z is the node structure representation of the output of a two-layer graph convolutional network.

7. The method for reconstructing and completing sensitive data flow paths based on graph neural networks and time coding according to claim 1, characterized in that, The Time2Vec time encoder will measure the time difference between adjacent events. The time representation is mapped to a concatenation of linear trend components and periodic components: in, For linear trend components, It is a periodic component; This is the trainable position embedding matrix, corresponding to position_embedding in the code.

8. The method for reconstructing and completing sensitive data flow paths based on graph neural networks and time coding according to claim 7, characterized in that, The gated fusion network generates a gate coefficient to dynamically control the fusion intensity based on time characteristics. The fusion path representation is calculated as follows: In the formula Represented as path nodes. For position encoding, For time representation, The gating coefficient, This is for element-wise multiplication.

9. The method for reconstructing and completing sensitive data flow paths based on graph neural networks and time coding according to claim 1, characterized in that, The Transformer path encoder captures long-distance path dependencies through multi-head self-attention, with the core attention calculation formula being: Where Q, K, and V are the query, key, and value vectors, respectively, and M is the attention masking matrix, used to mask invalid placeholder positions in the path.

10. The method for reconstructing and completing sensitive data flow paths based on graph neural networks and time coding according to claim 9, characterized in that, When predicting missing transition nodes, the path context representation is fed into the classifier to output the probability of each node. The optimal mask position is used to fill in the missing node, satisfying the following conditions: The output prediction nodes are filled into the mask positions to generate a complete reconstruction of the sensitive data flow path; candidate nodes can be filtered by combining asset, business domain, and access permission rules.

Images