Global data flow intelligent tracing management and control platform for full-service scenarios

Abstract

This invention discloses a comprehensive intelligent data flow traceability and control platform for all business scenarios, comprising: a traffic engine module that intercepts initial data access requests, initializes lineage beacons in the application layer protocol header using user identity and asset characteristics, and transmits them transparently; a security plug-in module that extracts environmental feature vectors during data processing, performs orthogonal projection and deterministic nonlinear mapping evolution calculations in conjunction with input beacons, generates evolutionary beacons, and reports logs; and a central control center module that parses logs, constructs a micro-operational context time-series flow graph in a graph database, extracts residual beacon feature components after obtaining leaked samples, performs forward traversal and forward evolutionary inference calculations along the time-series flow graph, locates leaked nodes by distance difference comparison, and outputs the responsibility flow topology link. This invention achieves continuous recording of data flow status and leak tracing and location without business intrusion.

Description

Technical Field

[0001] This invention relates to the field of data security and data asset protection technology, specifically to an intelligent traceability and control platform for full-domain data flow across all business scenarios. Background Technology

[0002] As enterprise network environments expand, the flow of data between different business systems and microservice architectures increases. Data flow tracing and control platforms are primarily used to monitor data interaction behavior within the network environment, record the data flow paths between various business nodes, and provide a tracing link in the event of a data breach.

[0003] In the existing network communication architecture, in order to achieve cross-node data tracking, the common approach is to deploy probes in the business system or modify the transmitted data ontology. Specifically, developers need to modify the source code of each business system, insert tracking tags into the payload of the business data flow, and when each microservice node receives and sends data, the business system actively parses and passes additional fields downstream, and reconstructs the data flow path based on the log information actively reported by each node.

[0004] In recent years, although non-intrusive traffic tracing solutions based on service mesh sidecar proxies or network layer eBPF probes have emerged, capable of attaching identification information without altering business data load, these solutions typically only embed simple session or tracing identifiers in the protocol header. They lack the ability to deeply integrate and dynamically evolve the characteristics of the data operation context (such as operation nodes, operator types, timestamps, user profiles, etc.). When data flows through multi-source fusion, fission, or complex transformation nodes, existing non-intrusive solutions cannot map the environmental feature vectors to a high-dimensional orthogonal space and participate in the nonlinear evolution calculation of beacons. This makes it difficult to determine the source of data leakage based on distance in the high-dimensional vector space after the data breach occurs. To effectively trace the source of data leaks, existing technologies face the following technical challenges in data asset protection: During cross-node data flow, code-intrusion-based data protection schemes require modifications to the data structure of core business data loads to embed data identity tag information, or force various heterogeneous business systems to modify their underlying data access code to be compatible with additional identifiers. This increases the maintenance costs of business systems, interferes with the original business processing logic, and makes it difficult to guarantee the integrity and confidentiality of data assets. On the other hand, non-intrusive data identification schemes struggle to integrate operational context information for dynamic evolution, making it impossible to build a foundation for data leak tracing that supports high-dimensional feature comparison, resulting in insufficient data security protection capabilities. Summary of the Invention

[0005] To address the problems mentioned in the background, this invention provides an intelligent traceability and control platform for full-domain data flow across all business scenarios, comprising: a central control center module, a traffic engine module, and a security plugin module;

[0006] The central control module is communicatively connected to the traffic engine module. It receives data access log packets reported by the traffic engine module and sends data protection and control policies to the traffic engine module. It is also used to parse metadata logs from the security plug-in module and generate or update a micro-operation context time-series flow graph containing vertices and directed edges in the graph database to construct a complete protection archive for data asset flow. After receiving a suspected leakage sample reported by an external data leakage detection system, the central control module extracts residual beacon feature components. Starting from the source vertex in the micro-operation context time-series flow graph, it performs a forward traversal along the directed edges and combines the environmental feature vectors stored in the corresponding vertices to perform forward evolutionary inference calculations to obtain the inference beacon result. It calculates the distance between the inference beacon result and the residual beacon feature components. When the Euclidean distance difference is less than or equal to a preset distance threshold, it outputs the target node where the data leakage occurred and the corresponding responsibility flow topology link.

[0007] The traffic engine module, deployed at the data access boundary, is used to intercept initial data access requests, parse data access protocols to obtain the data carrier to be protected, acquire the user identity characteristics and asset sensitivity level characteristics of the data session corresponding to the initial data access request, initialize an initial lineage beacon with orthogonal spatial dimensions in the application layer protocol header based on a preset data protection strategy using the user identity characteristics and the asset sensitivity level characteristics. The initial lineage beacon serves as a data identity identifier for data asset protection, and the serialized initial lineage beacon is written into the application layer protocol extension field so that the initial lineage beacon is transmitted between network nodes along with the business data stream; it is also used to route the business data stream to the security plug-in module.

[0008] The security plugin module, connected to the traffic engine module and deployed inside the data processing node, is used to extract the current device identifier, operation timestamp, and operator type when executing data operation instructions. It combines these elements into a data operation environment feature vector. It reads the current lineage beacon recorded in the input protocol header and performs orthogonal projection and deterministic nonlinear mapping evolution calculations in conjunction with the data operation environment feature vector to generate an evolutionary lineage beacon. This continuously records the data operation context, ensuring the continuity of data identity and the traceability of data assets throughout the entire data flow. The evolutionary lineage beacon is used to overwrite protocol header fields, and the data security audit log data packet containing the evolutionary lineage beacon summary and the data operation environment feature vector is asynchronously reported to the central control center module.

[0009] Preferably, the traffic engine module utilizes the user identity features and the asset sensitivity level features to initialize an initial lineage beacon with orthogonal spatial dimensions in the application layer protocol header. Specifically, this is used for: parsing the intercepted initial data access request using the data access protocol to obtain the data carrier to be protected; extracting the Uniform Resource Identifier, request header, and content payload of the data carrier to be protected; inputting the content payload into a preset asset classification and grading model to obtain the asset category identifier and data sensitivity level features output by the asset classification and grading model; extracting the source network address and session token of the initial data access request; and parsing the session token to obtain the user identity that triggered the initial data access request. The system identifies asset class identifiers and account role permissions; it uses a hash mapping algorithm to numerically encode the asset class identifier, data sensitivity level feature, user identity identifier, and account role permissions, generating multiple independent feature scalars; it loads a pre-defined set of orthogonal basis vectors based on the Schmitt orthogonalization method into memory space, and uses the feature scalars to perform linear mapping on the set of orthogonal basis vectors to generate orthogonal state vectors with specific dimensions, setting the orthogonal state vectors as initial lineage beacons; it performs byte serialization on the initial lineage beacons, adds a custom extension field to the application layer protocol header of the initial data access request, and writes the serialized initial lineage beacon into the custom extension field.

[0010] Preferably, the traffic engine module writes the serialized initial lineage beacon into the application layer protocol extension field so that the initial lineage beacon is transmitted between network nodes along with the service data stream. Specifically, it is used for: receiving the original service data access request packet at the data access layer, parsing the original service data access request packet to separate the application layer protocol header and the core service data payload; allocating a preset custom header field in the application layer protocol header, and writing the serialized and encoded initial lineage beacon into the custom header field to generate an extended protocol header; keeping the original data structure of the core service data payload unchanged, concatenating and encapsulating the extended protocol header and the core service data payload to generate a transparent transmission data packet, and routing the transparent transmission data packet to the backend service system; intercepting the service response data packet output by the backend service system and extracting the application layer protocol header of the service response data packet, reading the transparently transmitted lineage beacon status from the application layer protocol header, and removing the custom header field according to the communication protocol specification to restore the original application layer protocol header structure, and forwarding the service response data packet after restoring the original application layer protocol header structure to the original requesting end.

[0011] Preferably, the security plugin module extracts the current device identifier, operation timestamp, and operator type to form an environmental feature vector, specifically used for: obtaining fine-grained asset tags containing data tags and classification / grading results obtained by the traffic engine module from parsing business data streams, as well as user and account identification results; extracting the node device identifier, operation timestamp, and execution operator type of the current data operation, and sending a profile query request containing user and account identification results to the central control center module, obtaining the user panoramic profile information returned by the central control center module, which includes user behavior trajectory tracking data and risk assessment status; collecting the fine-grained asset tags, user panoramic profile information, and node device identifiers. The system identifies and operates on timestamps and operator types, performs structured alignment on feature data, and uses a pre-defined encoding mapping dictionary to numerically transform the structured aligned discrete category features to obtain a set of numerical features. The set of numerical features is then normalized and concatenated into a one-dimensional feature array according to a pre-defined dimensional order. This one-dimensional feature array is then used as the environmental feature vector. An environmental feature projection matrix is ​​extracted from memory, and the environmental feature vector is aligned to the orthogonal space of the initial lineage beacon using this matrix. The aligned environmental variables are then input into a deterministic nonlinear mapping function for computation.

[0012] Preferably, the security plug-in module combines the environmental feature vector with orthogonal projection and deterministic nonlinear mapping evolution calculation to generate evolutionary lineage beacons. Specifically, it is used for: when determining that the currently executed operator category is a multi-source data fusion operator, extracting multiple input lineage beacons contained in the application layer protocol header, and parsing the multi-source data fusion operator parameters to determine the data feature weight coefficients corresponding to different input data sources; using the data feature weight coefficients to perform feature weighted summation calculation on multiple input lineage beacons to generate a fused beacon vector; and using a preset environmental feature projection matrix to perform... Orthogonal space mapping calculation is performed to generate an environment projection vector. The fused state beacon vector and the environment projection vector are added and merged, and the merged result is input into a deterministic nonlinear mapping function to perform nonlinear mapping calculation and output an evolutionary lineage beacon. When the current operator category is determined to be a single-source data fission operator, a unique input lineage beacon is extracted, and a dimensionality reduction projection parameter indicating the target retained dimension length is extracted according to the size ratio of the split data blocks. The input lineage beacon is truncated using the dimensionality reduction projection parameter to retain the target retained dimension length, thereby generating a dimensionality reduction evolutionary beacon.

[0013] Preferably, the security plugin module asynchronously reports data security audit log packets containing evolutionary lineage beacon summaries and data operation environment feature vectors. The traffic engine module and the central control center module centrally aggregate these data packets. Specifically, the security plugin module extracts the feature summaries and associated environment feature vectors of the evolutionary lineage beacons and obtains the currently executed security policy type. It encapsulates the feature summaries, environment feature vectors, and security policy type into standardized metadata logs and writes these standardized metadata logs into a local memory buffer pool allocated by the traffic engine module, configured with preset time window thresholds and queue depth thresholds. The traffic engine module detects the current fill status of the local memory buffer pool, and when the current fill status reaches the queue depth threshold or meets the time window threshold, it reads the standardized metadata logs in batches from the local memory buffer pool and sends the batch-read standardized metadata logs to the central control center module via an asynchronous non-blocking communication interface. The central control center module receives the asynchronously reported standardized metadata logs and performs format validation on them. After verifying the field integrity and data structure consistency of the standardized metadata logs, it writes the validated standardized metadata logs into a distributed message queue.

[0014] Preferably, the central control module parses the metadata logs from the security plugin module and generates or updates a micro-operation context time-series flow graph containing vertices and directed edges in the graph database. Specifically, this involves: reading the centralized and aggregated standardized metadata logs from the distributed message queue and parsing and separating the input beacon digest set, evolutionary lineage beacon digest, environmental feature vector, and node device identifier; retrieving the vertex record corresponding to the evolutionary lineage beacon digest in the graph database; if no corresponding vertex record is found, creating a target vertex using the evolutionary lineage beacon digest as the primary key identifier and writing the environmental feature vector and node device identifier into the feature attribute field of the target vertex; if a corresponding vertex record is found, appending the environmental feature vector and node device identifier to the feature attribute field of the corresponding vertex record; traversing the input beacon digest set in the standardized metadata logs and searching for the source vertex corresponding to the input beacon digest in the graph database; constructing directed edges between the source vertex and the target vertex to indicate the topological connectivity state of data flow; extracting the operation timestamp, execution operator type, and security policy type from the standardized metadata logs and writing them into the association attribute field of the directed edges.

[0015] Preferably, the central control module extracts residual beacon feature components from suspected leak samples, specifically for: acquiring suspected leak sample data and cleaning the suspected leak sample data to remove format control characters and redundant characters; scanning data carrier features in the cleaned suspected leak sample data according to preset regular expression matching rules; extracting the recorded beacon byte sequence when the target region of the data carrier features is located, decoding and parsing the beacon byte sequence according to a preset byte deserialization protocol, separating discrete residual beacon feature components and corresponding dimension index identifiers; loading a preset set of orthogonal basis vectors in memory, determining the dimension index distribution of the standard high-dimensional orthogonal space based on the set, mapping the residual beacon feature components to the corresponding dimension index positions in the standard high-dimensional orthogonal space according to the dimension index identifiers, completing high-dimensional space feature alignment; performing zero-value padding operations on the missing dimensions during the high-dimensional space feature alignment process, generating target residual beacon vectors of uniform dimension scale for use in the forward evolutionary deduction calculation process.

[0016] Preferably, the central control module performs a forward traversal along directed edges starting from the source vertex in the micro-operation context temporal flow graph, and performs forward evolutionary inference calculations based on the environment feature vectors stored at the corresponding vertices to obtain the inference beacon results. Specifically, it is used to: extract the micro-operation context temporal flow graph, determine the set of source vertices with no in-degree in the micro-operation context temporal flow graph, and write the vertices in the source vertex set as traversal starting points into the topology traversal queue; extract the currently visited vertex from the topology traversal queue, and read the environment feature vector and execution operator type associated with the currently visited vertex; when it is determined that the currently visited vertex is a vertex in the source vertex set, read the initial lineage beacon associated with the currently visited vertex as the pre-input beacon; when it is determined that the currently visited vertex is not a source vertex, obtain the pre-input beacon of the currently visited vertex in the micro-operation context temporal flow graph according to the execution operator type; and perform environment feature mapping and deterministic nonlinear mapping transformation calculations based on the environment feature vector of the currently visited vertex and the pre-input beacon to generate the inference beacon results of the currently visited vertex.

[0017] Preferably, the central control module calculates the distance between the inferred beacon result and the residual beacon feature component, and outputs the target node where the data leakage occurred and the corresponding responsibility flow topology link. Specifically, it is used to: calculate the Euclidean distance difference between the inferred beacon result and the residual beacon feature component, and compare the Euclidean distance with a preset distance judgment threshold; when the Euclidean distance difference is less than or equal to the distance judgment threshold, it determines that a feature collision has occurred and locks the currently accessed vertex as the target leakage node; using the target leakage node as the reference point, it performs a reverse topology traversal along the directed edges of the micro-operation context temporal flow graph to extract the connected branches between the source vertex and the target leakage node; and combines the node device identifier, operation timestamp, and execution operator type covered by the connected branches to generate responsibility flow topology link data and output it.

[0018] This invention achieves accurate tracing of data breaches and secure protection of data assets by classifying and protecting data access requests and continuously recording data identity and operational context information throughout the entire data flow chain.

[0019] The present invention, by adopting the above technical solution, can bring the following beneficial effects:

[0020] 1. This invention parses the data access protocol at the data access boundary through a traffic engine module. It initializes an initial lineage beacon with orthogonal spatial dimensions in the application layer protocol header using user identity features and asset sensitivity level features. The serialized initial lineage beacon is then written into the application layer protocol extension field for transparent transmission. At the same time, the original data structure of the core business data load remains unchanged. This enables data identity identifiers to be stably transmitted between different business processing nodes based on the data access protocol without modifying or intruding on the original backend business system. This establishes a basic identification system for the full lifecycle protection of data assets, thereby creating an initial perception foundation for global data flow tracking.

[0021] 2. This invention extracts the device identifier, operation timestamp, and operator type to form an environmental feature vector when executing data processing instructions through a security plug-in module. It also reads the current lineage beacon in the protocol header and performs orthogonal projection and deterministic nonlinear mapping calculations to generate an evolutionary lineage beacon by combining the environmental feature vector with the protocol fields. This enables the deep mapping of the operation context environment into the data identity identifier for dynamic evolution in multi-source data fusion or fission scenarios, ensuring the continuous and accurate recording of state feature information throughout the entire data flow chain.

[0022] 3. This invention generates a micro-operation context time-series flow graph in a graph database by parsing asynchronously reported metadata logs through the central control module. After obtaining suspected leakage samples, residual beacon feature components are extracted, and forward traversal and forward evolutionary deduction calculations are performed along directed edges to obtain the deduced beacon results. The Euclidean distance difference is calculated to compare feature collisions. This enables the accurate location of the target node where data leakage occurs in complex data asset transfer leakage events based on the distance judgment condition of high-dimensional vectors, and outputs the responsibility transfer topology link, thereby completing the source tracing and responsibility determination of data leakage events and defining the scope of data asset damage. Attached Figure Description

[0023] Figure 1 This is an architecture diagram of the intelligent traceability and control platform for full-domain data flow, applicable to all business scenarios, as described in this invention.

[0024] Figure 2 This is a flowchart of the intelligent traceability and control method for full-domain data flow according to the present invention;

[0025] Figure 3 This is a flowchart of the multidimensional asset identification and initial orthogonal space mapping process of the present invention;

[0026] Figure 4 This is a flowchart illustrating the transparent protocol layer transmission and non-intrusive business logic design of this invention.

[0027] Figure 5 This is a flowchart illustrating the environmental context coding process for integrating user and asset profiles in this invention.

[0028] Figure 6 This is a flowchart of the multi-source beacon evolution algorithm driven by the plug-in processing chain of the present invention;

[0029] Figure 7 This is a flowchart illustrating the asynchronous aggregation and high-concurrency reporting process of heterogeneous plugin logs in this invention.

[0030] Figure 8 This is a flowchart illustrating the dynamic update logic of the global behavior link visualization graph of this invention.

[0031] Figure 9 This is a flowchart of the leakage clue extraction and high-dimensional feature alignment process of the present invention;

[0032] Figure 10 This is a flowchart of the forward modeling and leak point location process of this invention. Detailed Implementation

[0033] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0034] Example 1

[0035] Please refer to the appendix. Figure 1 The present invention provides an intelligent traceability and control platform for full-domain data flow in all business scenarios, including a central control center module 10, a traffic engine module 20 and a security plug-in module 30.

[0036] The central control center module 10 is deployed on the management plane and serves as the centralized control and decision-making hub of the platform. The central control center module 10 is connected to the traffic engine module 20 to receive data packets reported by the traffic engine module 20 and to issue data protection control policies to the traffic engine module 20. The central control center module 10 is also used to parse metadata logs from the security plug-in module 30, generate or update a micro-operation context time-series flow graph containing vertices and directed edges in the graph database, and perform forward traversal and forward evolution inference calculations after receiving suspected leakage samples reported by the external data leakage detection system in order to locate the target node and responsibility flow topology link where the data leakage occurred.

[0037] The traffic engine module 20 is deployed on the data access control plane and connected in series in the business data access link. As the central hub for data access request interception and data forwarding of the platform, the traffic engine module 20 is used to intercept the initial data access request at the data access boundary, parse the data access protocol to obtain the data carrier to be protected, and extract user identity features and asset sensitivity level features to initialize lineage beacons. The traffic engine module 20 is also used to route business data streams to the security plug-in module 30, intercept business response data packets output by the backend business system, manage the local memory buffer pool, and send standardized metadata logs in batches to the central control module 10 through the asynchronous non-blocking communication interface when the buffer pool reaches the threshold.

[0038] The security plug-in module 30 is deployed inside the traffic engine module 20 and is connected to the traffic engine module 20 through a local inter-process communication interface. The security plug-in module 30 is used to extract environmental feature vectors when executing data fusion or data fission processing instructions, read the current lineage beacon recorded in the input protocol header and perform orthogonal projection and deterministic nonlinear mapping evolution calculations to generate evolutionary lineage beacons, overwrite the evolutionary lineage beacons to the protocol header fields, and asynchronously report the data security audit log data packets containing the evolutionary lineage beacon summary and data operation environment feature vectors.

[0039] In this embodiment, the central control center module 10, the traffic engine module 20, and the security plug-in module 30 work together to achieve intelligent traceability and control of data flow across all business scenarios.

[0040] Example 2

[0041] Please refer to the appendix. Figure 2 Based on Embodiment 1, this embodiment provides a method for intelligent traceability and control of data flow across the entire domain. This method operates on the intelligent traceability and control platform for data flow across the entire business scenario described in Embodiment 1. The method specifically includes the following steps:

[0042] In step S100, the traffic engine module 20 intercepts the initial data access request, parses the data carrier to be protected in the initial data access request, obtains the user identity characteristics and asset sensitivity level characteristics of the data session corresponding to the initial data access request, and, according to the preset data asset protection strategy, the traffic engine module 20 initializes an initial lineage beacon with orthogonal spatial dimensions in the application layer protocol header using the user identity characteristics and asset sensitivity level characteristics, and writes the serialized initial lineage beacon into the application layer protocol extension field. The initial lineage beacon is transmitted between network nodes along with the business data stream.

[0043] In step S200, the business data to be protected flows through the traffic engine module 20, triggering the security plug-in modules 30 arranged along the business data flow direction. The security plug-in modules 30 act as data protection proxy components for data processing nodes. Business data requests flow sequentially through multiple security plug-in modules 30 within the traffic engine module 20. When executing data fusion or data fission processing instructions, the security plug-in modules 30 extract the current device identifier, operation timestamp, and operator type, combining them into an environmental feature vector. The security plug-in modules 30 read the current lineage beacon recorded in the input protocol header and, in conjunction with the environmental feature vector, perform orthogonal projection and deterministic nonlinear mapping evolution calculations to generate an evolved lineage beacon. The calculation formula for the evolved lineage beacon is as follows:

[0044]

[0045] in, Indicates evolutionary lineage beacon. Indicates the first The current bloodline beacon is input. Indicates the first The feature weight coefficients of the current bloodline beacon input. This indicates the total number of input data sources. Represents the environmental feature vector. Represents the projection matrix of environmental features. This represents a deterministic nonlinear mapping function that produces a deterministic output under the same input and satisfies the Lipshitz continuity condition to maintain the local distance structure. The security plug-in module 30 uses the evolutionary lineage beacon to overwrite the protocol header field.

[0046] In step S300, the security plug-in module 30 asynchronously reports the data security audit log data packet containing the evolutionary lineage beacon summary and data operation environment feature vector to the central control center module 10 through the asynchronous communication channel. The central control center module 10 parses the log data packet, generates or updates the micro-operation context temporal flow graph containing vertices and directed edges in the graph database, and dynamically adds vertices and directed edges to the micro-operation context temporal flow graph according to the continuously received metadata logs. The vertices store the operation events and the environmental feature information associated with the operation events, and the directed edges indicate the topological connectivity status of the data flow.

[0047] In step S400, after receiving a suspected data leakage sample reported by the external data leakage prevention system, the central control module 10 extracts residual beacon feature components from the suspected leakage sample and performs data leakage tracing and deduction. Starting from the source vertex in the micro-operation context time-series flow graph, the central control module 10 performs a forward traversal along the directed edges and performs forward evolution deduction calculations in conjunction with the environmental feature vectors stored at the corresponding vertices to obtain the deduction beacon result. The central control module 10 calculates the Euclidean distance difference between the deduction beacon result and the residual beacon feature components. The calculation formula is as follows:

[0048]

[0049] in, This represents the difference in Euclidean distance. This indicates the results of the beacon simulation. Representing the residual beacon feature components, when the Euclidean distance difference is less than or equal to the preset distance threshold, the central control module 10 outputs the target node that caused the data leakage and the corresponding responsibility flow topology link, and extracts the corresponding connected branch in the micro-operation context time sequence flow graph as the target tracing link.

[0050] Example 3

[0051] Please refer to the appendix. Figure 3 Based on Embodiment 1 and Embodiment 2, in step S100, the traffic engine module 20 initializes an initial lineage beacon with orthogonal spatial dimensions in the application layer protocol header using user identity features and asset sensitivity level features. To implement this initialization process, the traffic engine module 20 performs the following steps:

[0052] In step S110, the traffic engine module 20 intercepts the initial data access request, performs data access protocol parsing on the initial data access request, obtains the data carrier to be protected, and extracts the Uniform Resource Identifier, request header and content payload of the data carrier to be protected.

[0053] In step S120, the traffic engine module 20 inputs the content load into the preset asset classification and grading model. The traffic engine module 20 obtains the asset category identifier and data sensitivity level characteristics output by the asset classification and grading model. The traffic engine module 20 extracts the source network address and session token of the initial data access request. The traffic engine module 20 parses the session token to obtain the user identity identifier and account role permissions that triggered the initial data access request.

[0054] In step S130, the traffic engine module 20 uses a hash mapping algorithm to numerically encode the asset category identifier, data sensitivity level feature, user identity identifier, and account role permissions, generating multiple independent feature scalars. The traffic engine module 20 loads a pre-defined set of orthogonal basis vectors based on the Schmitt orthogonalization method into memory space. The traffic engine module 20 uses the feature scalars to perform a linear mapping on the set of orthogonal basis vectors, generating orthogonal state vectors with specific dimensions. The traffic engine module 20 sets the orthogonal state vectors as initial lineage beacons. The generation formula for the orthogonal state vectors is as follows:

[0055]

[0056] in, Indicates the initial lineage beacon. This represents the total number of dimensions of the preset orthogonal space. This represents the first generation generated by encoding asset characteristics and user characteristics. A feature scalar, Describes the first element in the set of orthogonal basis vectors. 3 orthogonal basis vectors;

[0057] In step S140, the traffic engine module 20 performs byte serialization on the initial lineage beacon, adds a custom extension field to the application layer protocol header of the initial data access request, writes the serialized initial lineage beacon into the custom extension field, and forwards the initial data access request carrying the custom extension field to the downstream business processing node. The initial lineage beacon is attached to the data access protocol and maintains stable transmission between different business processing nodes.

[0058] In this embodiment, the total number of orthogonal space dimensions d is dynamically selected based on the maximum allowable extension length of the application layer protocol header, and the initial lineage beacon is serialized using a compact binary encoding format to ensure that the length of the extended protocol header does not exceed a preset network transmission threshold.

[0059] Please refer to the appendix. Figure 4 In step S100, the traffic engine module 20 also writes the serialized initial lineage beacon into the application layer protocol extension field, so that the initial lineage beacon is transmitted between network nodes along with the service data stream. To ensure that this transmission process does not intrude on the original service, the traffic engine module 20 further performs the following steps:

[0060] In step S150, the traffic engine module 20 is configured to proxy mode or transparent mode according to the network topology. The traffic engine module 20 receives the original business data access request packet at the data access layer and performs protocol parsing on the original business data access request packet to separate the application layer protocol header and the core business data payload.

[0061] In step S160, the traffic engine module 20 allocates a preset custom header field in the application layer protocol header and writes the serialized and encoded initial lineage beacon into the custom header field to generate an extended protocol header. The traffic engine module 20 keeps the original data structure of the core business data load unchanged, splices the extended protocol header with the core business data load, and encapsulates it to generate a transparent transmission data packet.

[0062] In step S170, the traffic engine module 20 routes the transparent transmission data packet to the backend business system. The backend business system parses the core business data load and performs business function calculations. At the same time, the backend business system forwards the extended protocol header in the internal microservice call chain according to the communication protocol specification. The initial lineage beacon is transmitted between each business processing node along with the extended protocol header.

[0063] In step S180, the traffic engine module 20 intercepts the business response data packets output by the backend business system and extracts the application layer protocol header of the business response data packets. The traffic engine module 20 reads the transparent lineage beacon status from the application layer protocol header and removes the custom header fields according to the communication protocol specification to restore the original application layer protocol header structure. The traffic engine module 20 forwards the business response data packets after restoring the original application layer protocol header structure to the original requesting end.

[0064] Further details are provided in the appendix. Figure 5 In step S200, the security plug-in module 30 extracts the current device identifier, operation timestamp, and operator type, and combines the current device identifier, operation timestamp, and operator type into an environment feature vector. To generate this environment feature vector, the security plug-in module 30 performs the following steps:

[0065] In step S210, the traffic engine module 20 receives the business data stream and parses the payload characteristics of the business data stream to obtain fine-grained asset tags containing data tags and classification and grading results. The traffic engine module 20 extracts the access connection information of the business data stream and obtains user and account identification results.

[0066] In step S220, the traffic engine module 20 routes the business data stream to the security plug-in module 30. The security plug-in module 30 obtains the node device identifier, operation timestamp and execution operator type of the current data operation, and sends a profile query request containing user and account identification results to the central control center module 10. The central control center module 10 returns a panoramic user profile information containing user behavior trajectory tracking data and risk assessment status according to the profile query request.

[0067] In step S230, the security plug-in module 30 collects asset fine-grained tags, user panoramic profile information, node device identifiers, operation timestamps and execution operator types, and performs structured alignment processing on the feature data. The security plug-in module 30 uses a preset encoding mapping dictionary to perform numerical conversion on the discrete category features after structured alignment processing to obtain a set of numerical features.

[0068] In step S240, the security plug-in module 30 normalizes the numerical feature set and concatenates the normalized numerical feature set into a one-dimensional feature array according to a preset dimensional order. The security plug-in module 30 determines the one-dimensional feature array as the environmental feature vector. The security plug-in module 30 extracts the environmental feature projection matrix in memory, uses the environmental feature projection matrix to align the environmental feature vector to the orthogonal space of the initial lineage beacon, and inputs the aligned environmental variables into the deterministic nonlinear mapping function for calculation.

[0069] Please refer to the appendix. Figure 6 In step S200, the security plug-in module 30 reads the current lineage beacon recorded in the input protocol header, performs orthogonal projection and deterministic nonlinear mapping evolution calculations in combination with environmental feature vectors, and generates an evolutionary lineage beacon. Depending on the type of operator currently being executed, this evolutionary calculation specifically includes:

[0070] In step S250, the traffic engine module 20 routes the business data flow to the orchestration processing chain composed of multiple security plug-in modules 30 connected in series. When executing data desensitization, data encryption or data access control instructions, the security plug-in module 30 determines the type of operator currently being executed. The preset operator types are divided into single-source linear transformation operator, multi-source data fusion operator and single-source data fission operator.

[0071] In step S260, when the security plug-in module 30 determines that the current execution operator category is a multi-source data fusion operator, it extracts multiple input lineage beacons contained in the application layer protocol header, parses the multi-source data fusion operator parameters, determines the data feature weight coefficients corresponding to different input data sources, and uses the data feature weight coefficients to perform feature weighted summation calculation on multiple input lineage beacons to generate a fused beacon vector.

[0072] In step S270, the security plug-in module 30 extracts the environmental feature vector generated by the current operation, and performs orthogonal spatial mapping calculation on the environmental feature vector using the preset environmental feature projection matrix to generate an environmental projection vector. The security plug-in module 30 adds and merges the fused state beacon vector and the environmental projection vector, and inputs the merging result into the one-way hash transformation function to perform nonlinear mapping calculation, and outputs the evolutionary lineage beacon.

[0073] In step S280, when the security plug-in module 30 determines that the current execution operator category is a single-source data fission operator, it extracts a unique input lineage beacon and extracts dimensionality reduction projection parameters according to the size ratio of the split data blocks. The dimensionality reduction projection parameters indicate the target retained dimension length. The security plug-in module 30 uses the dimensionality reduction projection parameters to perform vector component truncation processing on the input lineage beacon, retaining it to the target retained dimension length, and generating a dimensionality reduction evolution beacon.

[0074] In step S290, when the security plug-in module 30 determines that the current execution operator category is a single-source linear transformation operator, it keeps the feature weight coefficient at one, directly performs the addition and merging of the environment projection vector and the calculation of the deterministic nonlinear mapping function to generate an evolutionary lineage beacon. The security plug-in module 30 uses the generated evolutionary lineage beacon or the dimensionality-reduced evolutionary beacon to replace the old beacon field in the application layer protocol header, and passes the updated application layer protocol header's business data stream to the next security plug-in module 30 in the orchestration processing chain. After the business data stream traverses all security plug-in modules 30, it is output to the downlink communication interface of the traffic engine module 20.

[0075] Please refer to the appendix. Figure 7 In step S300, the security plug-in module 30 asynchronously reports the log data packet containing the evolutionary lineage beacon summary and environmental feature vector to the central control module 10 through an asynchronous communication channel. The asynchronous reporting process specifically includes the following steps:

[0076] In step S310, after completing the lineage beacon evolution calculation, the security plug-in module 30 extracts the feature summary of the evolved lineage beacon and the associated environmental feature vector, and obtains the currently executed security policy type. The preset data protection policy types include data access control, data operation auditing, data leakage protection and data anomaly interception types.

[0077] In step S320, the security plug-in module 30 encapsulates the feature summary, environmental feature vector and security policy type into a standardized metadata log, and writes the standardized metadata log into the local memory buffer pool allocated by the traffic engine module 20. The local memory buffer pool is configured with a preset time window threshold and a queue depth threshold.

[0078] In step S330, the traffic engine module 20 detects the current filling status of the local memory buffer pool, and when the current filling status reaches the queue depth threshold or meets the time window threshold, it reads standardized metadata logs in batches from the local memory buffer pool. The traffic engine module 20 sends the batch-read standardized metadata logs to the central control center module 10 through an asynchronous non-blocking communication interface.

[0079] In step S340, the central control module 10 receives standardized metadata logs asynchronously reported from multiple traffic engine modules 20 and performs format verification on the standardized metadata logs. After verifying the field integrity and data structure consistency of the standardized metadata logs, the central control module 10 writes the verified standardized metadata logs into a distributed message queue, thus completing the centralized aggregation of multi-source heterogeneous plugin logs.

[0080] Please refer to the appendix. Figure 8 In step S300, the central control module 10 parses the log data packet and generates or updates a micro-operation context temporal flow graph containing vertices and directed edges in the graph database. The dynamic construction and updating process of this graph specifically includes the following steps:

[0081] In step S350, the central control module 10 reads the centralized aggregated standardized metadata logs from the distributed message queue, and parses the standardized metadata logs to separate the input beacon digest set, evolutionary lineage beacon digest, environmental feature vector, and node device identifier.

[0082] In step S360, the central control module 10 retrieves the vertex record corresponding to the evolutionary lineage beacon digest in the graph database. When the central control module 10 does not find the corresponding vertex record, it creates a target vertex using the evolutionary lineage beacon digest as the primary key identifier and writes the environmental feature vector and node device identifier into the feature attribute field of the target vertex. When the central control module 10 finds the corresponding vertex record, it appends the environmental feature vector and node device identifier to the feature attribute field of the corresponding vertex record.

[0083] In step S370, the central control module 10 traverses the set of input beacon digests in the standardized metadata log and searches for the source vertex corresponding to the input beacon digest in the graph database. The central control module 10 constructs a directed edge between the source vertex and the target vertex and uses the directed edge to indicate the topological connectivity state of the data flow.

[0084] In step S380, the central control module 10 extracts the operation timestamp, execution operator type, and security policy type from the standardized metadata log, and writes the operation timestamp, execution operator type, and security policy type into the association attribute field of the directed edge. The central control module 10 repeatedly executes the reading of the standardized metadata log and the updating of the graph database to complete the dynamic construction and storage of the global behavior link visualization graph.

[0085] Please refer to the appendix. Figure 9 In step S400, the central control module 10 extracts residual beacon feature components from the suspected leaked sample. In this embodiment, the suspected leaked sample is network layer packet capture data containing application layer protocol extension fields or a data copy obtained through network mirroring. The residual beacon feature components are discrete beacon fragments extracted from the application layer protocol extension fields. This extraction and high-dimensional feature alignment process specifically includes the following steps:

[0086] In step S410, the central control module 10 acquires suspected leaked sample data and performs data format cleaning on the suspected leaked sample data, removing format control characters and redundant characters from the suspected leaked sample data, and scanning data carrier features in the cleaned suspected leaked sample data according to preset regular expression matching rules.

[0087] In step S420, when the central control module 10 locates the target area of ​​the data carrier feature, it extracts the beacon byte sequence recorded in the target area and decodes and parses the beacon byte sequence according to the preset byte deserialization protocol to separate the discrete residual beacon feature components and the corresponding dimension index identifier.

[0088] In step S430, the central control module 10 loads a preset set of orthogonal basis vectors into memory and determines the dimension index distribution of the standard high-dimensional orthogonal space based on the set of orthogonal basis vectors. The central control module 10 maps the residual beacon feature components to the corresponding dimension index positions in the standard high-dimensional orthogonal space according to the dimension index identifier, thus completing the high-dimensional space feature alignment.

[0089] In step S440, the central control module 10 performs zero-value padding on the missing dimensions during the high-dimensional space feature alignment process, generates a target residual beacon vector of uniform dimension scale, and writes the target residual beacon vector into the cached alignment queue for use by the forward evolutionary inference calculation process.

[0090] Please refer to the appendix. Figure 10In step S400, the central control module 10 starts from the source vertex in the micro-operation context time-series flow graph, performs a forward traversal along the directed edges, and performs forward evolutionary inference calculations in combination with the environmental feature vectors stored at the corresponding vertices to obtain the inference beacon results. It also calculates the distance between the inference beacon results and the residual beacon feature components. To complete this forward simulation and leak point location process, the central control module 10 performs the following steps:

[0091] Step S450: The central control module 10 extracts the micro-operation context time-series flow graph, determines the set of source vertices with no in-degree in the micro-operation context time-series flow graph, and writes the vertices in the source vertex set as the traversal starting point into the topology traversal queue.

[0092] In step S460, the central control module 10 extracts the currently visited vertex from the topology traversal queue and reads the environment feature vector and execution operator type associated with the currently visited vertex. When the central control module 10 determines that the currently visited vertex is a vertex in the source vertex set, it reads the initial lineage beacon associated with the currently visited vertex as a pre-input beacon. When the central control module 10 determines that the currently visited vertex is not a source vertex, it obtains the pre-input beacon of the currently visited vertex in the micro-operation context time sequence flow graph according to the execution operator type.

[0093] In step S470, the central control module 10 combines the environmental feature vector with the previous input beacon to perform environmental feature mapping and deterministic nonlinear mapping transformation calculation, generate the inference beacon result of the currently visited vertex, and read the target residual beacon vector from the cache comparison queue;

[0094] In step S480, the central control module 10 calculates the Euclidean distance difference between the inferred beacon result and the target residual beacon vector, and compares the Euclidean distance difference with a preset distance judgment threshold. When the Euclidean distance difference is less than or equal to the distance judgment threshold, the central control module 10 determines that a feature collision has occurred.

[0095] In step S490, when the central control module 10 determines that a feature collision has occurred, it locks the currently accessed vertex as the target leak node, and uses the target leak node as the reference point to perform a reverse topological traversal along the directed edges of the micro-operation context temporal flow graph to extract the connected branches between the source vertex and the target leak node.

[0096] In step S4100, the central control module 10 combines the node device identifiers, operation timestamps, and execution operator types covered by the connected branches to generate responsibility flow topology link data and outputs the responsibility flow topology link data.

Claims

1. A comprehensive data flow intelligent traceability and control platform for all business scenarios, characterized in that, include: The system includes a central control module (10), a traffic engine module (20), and a security plug-in module (30). The central control module (10) is communicatively connected to the traffic engine module (20) and is used to receive data packets reported by the traffic engine module (20) and send data protection and control strategies to the traffic engine module (20). It is also used to parse the metadata logs from the security plug-in module (30), generate or update the micro-operation context time-series flow graph containing vertices and directed edges in the graph database; after receiving the suspected leakage sample reported by the external data leakage detection system, the central control module (10) extracts the residual beacon feature components, performs forward traversal along the directed edges starting from the source vertex in the micro-operation context time-series flow graph, reads the environmental feature vector and the pre-input beacon saved by each vertex, obtains the inference beacon result by using the same orthogonal projection and deterministic nonlinear mapping evolution calculation method as the security plug-in module (30) corresponding to each vertex, calculates the Euclidean distance difference between the inference beacon result and the residual beacon feature components, and outputs the target node of the data leakage and the corresponding responsibility flow topology link when the Euclidean distance difference is less than or equal to the preset distance threshold condition; The traffic engine module (20) is used to intercept the initial data access request at the data access boundary, parse the data access protocol to obtain the data carrier to be protected, obtain the user identity characteristics and asset sensitivity level characteristics of the data session corresponding to the initial data access request, use the user identity characteristics and asset sensitivity level characteristics to initialize an initial lineage beacon with orthogonal spatial dimensions in the application layer protocol header, and write the serialized initial lineage beacon into the application layer protocol extension field so that the initial lineage beacon is transmitted between network nodes along with the business data stream; it is also used to route the business data stream to the security plug-in module (30). The security plug-in module (30) is connected to the traffic engine module (20) and is used to extract the current device identifier, operation timestamp and operator type when executing data processing instructions, and combine the current device identifier, operation timestamp and operator type into an environmental feature vector; read the current lineage beacon recorded in the input protocol header, and perform orthogonal projection and deterministic nonlinear mapping evolution calculation in combination with the environmental feature vector to generate an evolutionary lineage beacon; use the evolutionary lineage beacon to overwrite the protocol header field, and asynchronously report the data security audit log data packet containing the evolutionary lineage beacon summary and data operation environment feature vector to the central control center module (10).

2. The intelligent traceability and control platform for full-domain data flow oriented to all business scenarios as described in claim 1, characterized in that, The traffic engine module (20) uses the user identity features and the asset sensitivity level features to initialize an initial lineage beacon with orthogonal spatial dimensions in the application layer protocol header, specifically for: The intercepted initial data access request is parsed using the data access protocol to obtain the data carrier to be protected, and the Uniform Resource Identifier, request header, and content payload of the data carrier to be protected are extracted. The content load is input into a preset asset classification and grading model to obtain the asset category identifier and data sensitivity level characteristics output by the asset classification and grading model; Extract the source network address and session token of the initial data access request, and parse the session token to obtain the user identity and account role permissions that triggered the initial data access request; The asset category identifier, data sensitivity level feature, user identity identifier, and account role permissions are numerically encoded using a hash mapping algorithm to generate multiple independent feature scalars; Load a set of orthogonal basis vectors based on the Schmitt orthogonalization method into memory space, use the feature scalar to perform a linear mapping on the set of orthogonal basis vectors to generate orthogonal state vectors with specific dimensions, and set the orthogonal state vectors as the initial lineage beacons; Perform byte serialization on the initial lineage beacon, add a custom extension field to the application layer protocol header of the initial data access request, and write the serialized initial lineage beacon into the custom extension field.

3. The intelligent traceability and control platform for full-domain data flow oriented to all business scenarios as described in claim 1, characterized in that, The traffic engine module (20) writes the serialized initial lineage beacon into the application layer protocol extension field so that the initial lineage beacon is transmitted between network nodes along with the service data stream, specifically for: The data access layer receives raw business data access request packets and performs protocol parsing on the raw business data access request packets to separate the application layer protocol header and the core business data payload. A preset custom header field is allocated in the application layer protocol header, and the serialized and encoded initial lineage beacon is written into the custom header field to generate the extended protocol header; Keeping the original data structure of the core business data payload unchanged, the extended protocol header is concatenated and encapsulated with the core business data payload to generate a transparent transmission data packet, and the transparent transmission data packet is routed to the backend business system; The system intercepts the business response data packets output by the backend business system and extracts the application layer protocol header of the business response data packets. It reads the transparent lineage beacon status from the application layer protocol header and removes the custom header fields according to the communication protocol specification to restore the original application layer protocol header structure. The business response data packets after restoring the original application layer protocol header structure are then forwarded to the original requesting end.

4. The intelligent traceability and control platform for full-domain data flow across all business scenarios as described in claim 1, characterized in that, The security plug-in module (30) extracts the current device identifier, operation timestamp, and operator type and combines them into an environment feature vector, specifically used for: Get the asset fine-grained tags containing data tags and classification and grading results obtained by the traffic engine module (20) from parsing the business data stream, as well as the user and account identification results; extract the node device identifier, operation timestamp and execution operator type of the current data operation, and send a portrait query request containing user and account identification results to the central control center module (10) to get the user panoramic portrait information containing user behavior trajectory tracking data and risk assessment status returned by the central control center module (10); Collect the asset fine-grained tags, user panoramic profile information, node device identifiers, operation timestamps and execution operator types, and perform structured alignment processing on the feature data. Use a preset encoding mapping dictionary to perform numerical conversion on the discrete category features after structured alignment processing to obtain a set of numerical features. The numerical feature set is normalized, and the normalized numerical feature set is concatenated into a one-dimensional feature array according to a preset dimensional order. The one-dimensional feature array is determined as the environmental feature vector. The environmental feature projection matrix in memory is extracted, and the environmental feature vector is aligned to the orthogonal space of the initial lineage beacon using the environmental feature projection matrix. The aligned environmental variables are then input into a deterministic nonlinear mapping function for computation.

5. The intelligent traceability and control platform for full-domain data flow oriented to all business scenarios as described in claim 1, characterized in that, The security plug-in module (30) combines the environmental feature vectors to perform orthogonal projection and deterministic nonlinear mapping evolution calculations to generate evolutionary lineage beacons, specifically used for: When determining that the current operator category is a multi-source data fusion operator, multiple input lineage beacons contained in the application layer protocol header are extracted, and the multi-source data fusion operator parameters are parsed to determine the data feature weight coefficients corresponding to different input data sources. The data feature weight coefficients are used to perform feature weighted summation calculation on multiple input lineage beacons to generate a fused beacon vector. The environmental feature vector is orthogonally mapped using a preset environmental feature projection matrix to generate an environmental projection vector. The fused beacon vector and the environmental projection vector are added and merged, and the merging result is input into a deterministic nonlinear mapping function to perform nonlinear mapping calculation and output the evolutionary lineage beacon. When the current operator category is determined to be a single-source data fission operator, a unique input lineage beacon is extracted, and a dimension reduction projection parameter indicating the target retained dimension length is extracted according to the size ratio of the split data blocks. The input lineage beacon is then truncated using the dimension reduction projection parameter to retain the target retained dimension length, thereby generating a dimension reduction evolution beacon.

6. The intelligent traceability and control platform for full-domain data flow oriented to all business scenarios as described in claim 1, characterized in that, The security plug-in module (30) asynchronously reports the data security audit log data packet containing the evolutionary lineage beacon digest and the data operation environment feature vector. The traffic engine module (20) and the central control center module (10) achieve centralized aggregation, specifically for: The security plug-in module (30) extracts the feature summary and associated environmental feature vector of the evolutionary lineage beacon, and obtains the type of security policy currently being executed; it encapsulates the feature summary, environmental feature vector and security policy type into a standardized metadata log, and writes the standardized metadata log into the local memory buffer pool allocated by the traffic engine module (20) which is configured with a preset time window threshold and a queue depth threshold; The traffic engine module (20) detects the current filling status of the local memory buffer pool, and when the current filling status reaches the queue depth threshold or meets the time window threshold, it reads standardized metadata logs in batches from the local memory buffer pool and sends the batch-read standardized metadata logs to the central control center module (10) through an asynchronous non-blocking communication interface. The central control module (10) receives the asynchronously reported standardized metadata logs and performs format verification on the standardized metadata logs. After verifying the field integrity and data structure consistency of the standardized metadata logs, it writes the verified standardized metadata logs into the distributed message queue.

7. The intelligent traceability and control platform for full-domain data flow oriented to all business scenarios as described in claim 1, characterized in that, The central control module (10) parses the metadata logs from the security plug-in module (30) and generates or updates a micro-operation context time-series flow graph containing vertices and directed edges in the graph database, specifically for: Read the centralized and standardized metadata logs from the distributed message queue, and parse and separate the input beacon digest set, evolutionary lineage beacon digest, environmental feature vector, and node device identifier; Retrieve vertex records corresponding to evolutionary lineage beacon summaries from the graph database. If no corresponding vertex record is found, create a target vertex using the evolutionary lineage beacon summary as the primary key identifier, and write the environmental feature vector and node device identifier into the feature attribute field of the target vertex. If a corresponding vertex record is found, append the environmental feature vector and node device identifier to the feature attribute field of the corresponding vertex record. Traverse the set of input beacon digests in the standardized metadata log, find the source vertex corresponding to the input beacon digest in the graph database, and construct a directed edge between the source vertex and the target vertex to indicate the topological connectivity state of data flow. Extract the operation timestamp, execution operator type, and security policy type from the standardized metadata log and write them into the associated attribute field of the directed edge.

8. The intelligent traceability and control platform for full-domain data flow in all business scenarios as described in claim 1, characterized in that, The central control module (10) extracts residual beacon feature components from suspected leaked samples, specifically for: Acquire suspected leaked sample data, and perform data format cleaning to remove format control characters and redundant characters from the suspected leaked sample data. Scan the data carrier characteristics in the cleaned suspected leaked sample data according to the preset regular expression matching rules. When the target region of the data carrier features is located, the recorded beacon byte sequence is extracted, and the beacon byte sequence is decoded and parsed according to the preset byte deserialization protocol to separate the discrete residual beacon feature components and the corresponding dimension index identifiers. A preset set of orthogonal basis vectors is loaded in memory. The dimensional index distribution of the standard high-dimensional orthogonal space is determined based on this set. The residual beacon feature components are mapped to the corresponding dimensional index positions in the standard high-dimensional orthogonal space according to the dimensional index identifier, thus completing the high-dimensional space feature alignment. Zero-value padding is performed on the missing dimensions during the high-dimensional space feature alignment process to generate target residual beacon vectors of uniform dimension size for use in the forward evolutionary deduction calculation process.

9. The intelligent traceability and control platform for full-domain data flow oriented to all business scenarios as described in claim 1, characterized in that, The central control module (10) performs a forward traversal along the directed edges starting from the source vertex in the micro-operation context temporal flow graph, and performs forward evolutionary inference calculations in conjunction with the environmental feature vectors stored at the corresponding vertices to obtain the inference beacon results, specifically used for: Extract the micro-operation context temporal flow graph, determine the set of source vertices with no in-degree in the micro-operation context temporal flow graph, and write the vertices in the source vertex set as the traversal starting point into the topology traversal queue. Extract the currently visited vertex from the topology traversal queue, and read the environment feature vector and the type of the operator associated with the currently visited vertex; When determining that the currently visited vertex is a vertex in the source vertex set, the initial lineage beacon associated with the currently visited vertex is read as the preceding input beacon; When determining that the currently visited vertex is not the source vertex, the preceding input beacon of the currently visited vertex is obtained in the micro-operation context sequence flow graph based on the type of the executed operator. By combining the environmental feature vector of the currently visited vertex with the previous input beacon, environmental feature mapping and deterministic nonlinear mapping transformation calculations are performed to generate the inference beacon result of the currently visited vertex.

10. The intelligent traceability and control platform for full-domain data flow in all business scenarios according to claim 1, characterized in that, After calculating the Euclidean distance between the inferred beacon result and the residual beacon feature components, the central control module (10) outputs the target node where the data leakage occurred and the corresponding responsibility transfer topology link, specifically for: Calculate the Euclidean distance difference between the inferred beacon result and the residual beacon feature components, and compare the Euclidean distance difference with a preset distance determination threshold. When the Euclidean distance difference is less than or equal to the distance determination threshold, a feature collision is determined to have occurred, and the currently accessed vertex is locked as the target leak node; Using the target leak node as the reference point, perform a reverse topological traversal along the directed edges of the micro-operation context temporal flow graph to extract the connected branches between the source vertex and the target leak node. The node device identifiers, operation timestamps, and execution operator types covered by the connected branches are combined to generate responsibility flow topology link data and output it.

Images