A union platform sensitive data violation outbound automatic detection and blocking method

Abstract

The application relates to the technical field of data processing, in particular to a trade union platform sensitive data violation automatic detection and blocking method. The method comprises the following steps: collecting to-be-sent data and preprocessing the to-be-sent data; constructing a database to obtain entities and their word lists; determining corresponding entities by the similarity of the word list and the entities in the to-be-sent data, and determining sensitive words by the corresponding entities after the interference words are screened out; determining sensitive feature values by the similarity of the sensitive words, the adjacent sensitive words of the sensitive words and the context word vectors; updating a preset sensitive threshold lower limit by the sensitive feature values, and screening a batch of to-be-sent data based on the updated sensitive threshold lower limit; for the remaining data, further judgment is carried out by the proportion of the sensitive words, and the detection and blocking are completed. The application improves the accuracy of automatic detection and blocking of data with different sensitive degrees.

Description

Technical Field

[0001] This application relates to the field of data processing technology, specifically to a method for automatically detecting and blocking the unauthorized outward transmission of sensitive data from a trade union platform. Background Technology

[0002] In the current era of digital transformation, trade unions are increasingly accumulating massive amounts of core data, such as member files, salary negotiation records, hardship assistance ledgers, and labor dispute documents, through information platforms. This data is often highly sensitive, directly linked to employee privacy and internal organizational secrets. However, current data security protection for trade union platforms primarily focuses on external attack defense, lacking effective control over unauthorized outflows of sensitive data due to internal personnel errors, weak security awareness, or abuse of privileges. Traditional auditing methods are often reactive, only addressing accountability after data breaches have occurred, failing to meet real-time protection requirements. Based on this, this paper proposes an automatic detection and blocking mechanism for unauthorized outflows of sensitive data from trade union platforms. This mechanism aims to use deep content perception and behavioral context analysis to provide real-time alerts and proactive blocking for unauthorized operations involving key information such as member identity and the privacy of vulnerable groups, thereby moving the data security defense line forward to the data exit point.

[0003] In the process of sending data out of the trade union platform, the automatic detection and blocking of sensitive data violations typically requires terminal extraction and analysis of the information to be sent from the trade union platform. At the terminal, further analysis is conducted on cases containing sensitive data. Clearly high-risk leaks are directly blocked and warned. For violations that can be corrected (due to unclear user intent or operational errors), a reminder is issued, and the data is sent out only after secondary confirmation and review. However, during the analysis of the information to be sent, considering that some sensitive words in the outgoing information may exhibit different compliance and data sensitivity interpretations depending on the context, uniformly blocking any sensitive words could lead to misjudgments in the subsequent automatic detection and blocking of sensitive data violations from the trade union platform. This increases the burden on subsequent review processes and could have serious consequences. Summary of the Invention

[0004] To address the technical issue of false positives in data interception, this application provides a method for automatic detection and blocking of unauthorized outgoing sensitive data from a trade union platform. The specific technical solution adopted is as follows: This application proposes a method for automatic detection and blocking of unauthorized outgoing sensitive data from a labor union platform. The method includes the following steps: Collect data to be sent out and preprocess it; For historical outbound data, a database is constructed, and entity recognition is performed to obtain each entity type and its corresponding vocabulary; for the text portion of the data to be outbound, word segmentation is performed to obtain its vocabulary; the similarity between the vocabulary in the data to be outbound and the vocabulary corresponding to the entity type is calculated to determine the entity corresponding to the vocabulary; the threshold is determined by the similarity of the vocabulary of the previous day to filter out interfering words in the real-time outbound data, and sensitive words are determined by the entity corresponding to the vocabulary; sensitive feature values ​​are determined by the similarity between the sensitive words and their context-related word vectors and the similarity between the sensitive words and their neighboring sensitive words. The preset lower limit of the sensitivity threshold is updated by comparing the maximum and minimum values ​​of the sensitive feature values ​​of all data to be sent out the previous day with the lower limit of the sensitivity threshold. A batch of data is sent out based on the updated lower limit of the sensitivity threshold. For data that was not sent out in the first batch the previous day, the feedback discrimination threshold is determined by the proportion of its sensitive words. The proportion of sensitive words in the real-time data to be sent out is compared with the feedback discrimination threshold to determine the data release, thus completing the detection and blocking.

[0005] In the aforementioned solution, this application analyzes the differences in entity similarity features between encrypted data and original sensitive data that may cause interference in the automatic detection and blocking of sensitive data from the trade union platform. It also examines the differences in word vector distribution and correlation between sensitive words in the outgoing information and those that violate regulations, under different expression scenarios. This allows for feature differentiation of the compliance level of different sensitive word data in different contexts. Furthermore, it optimizes and adjusts the automatic detection operation for sensitive data violations, improving the accuracy of automatic detection and blocking of data with different levels of sensitivity, while avoiding misjudgment and blocking when encrypted data is sent as compliant data.

[0006] In one embodiment, the entity type is member information, sensitive information for hardship assistance, contact information, organizational and labor relations information, information release time, public notice marker, and address information.

[0007] In one embodiment, the method for determining the entity corresponding to a word by calculating the similarity between words in the data to be sent out and words corresponding to entity types is as follows: For each word in the data to be sent out, the cosine similarity is calculated between it and the word vectors of all entity types. The entity word with the highest cosine similarity to each word is then obtained, and the entity type corresponding to that entity word is used as the entity to match each word.

[0008] In one embodiment, the method of determining a threshold based on the similarity of words from the previous day to filter out interfering words in the real-time data to be sent out, and determining sensitive words based on the entities corresponding to the words, is as follows: Obtain the maximum cosine similarity for each word in all data to be sent out the previous day, and calculate the mean of all the maximum cosine similarities as the segmentation threshold. Calculate the cosine similarity between each word in the real-time outgoing data and the corresponding word of the entity type, obtain the maximum value of the cosine similarity of each word, filter out words whose maximum cosine similarity is less than or equal to the segmentation threshold, and among the remaining words, words corresponding to the three entity types of member information, sensitive information on assistance for the needy, and contact information are designated as sensitive words.

[0009] In one embodiment, the sensitive feature values ​​are negatively correlated with the first absolute mean and the second absolute mean, respectively.

[0010] In one embodiment, the first absolute mean is the absolute mean of the cosine similarity between all sensitive words in the data to be sent and their context-related word vectors.

[0011] In one embodiment, the second absolute mean is the absolute mean of the nearest neighbor cosine similarity obtained for all sensitive words in the data to be sent out; the nearest neighbor cosine similarity is the cosine similarity between each sensitive word and its left and right nearest neighbor sensitive words in the data to be sent out.

[0012] In one embodiment, the method for updating the preset sensitivity threshold lower limit by comparing the maximum and minimum values ​​of the sensitive feature values ​​of all data to be sent out the previous day with a preset sensitivity threshold lower limit is as follows: When the maximum value of the sensitive feature of all data to be sent out in the current day is less than the lower limit of the preset sensitive threshold, the lower limit of the preset sensitive threshold will be set to the preset empirical value. When the maximum value of all sensitive feature values ​​of all data to be sent out on a given day is greater than the preset lower limit of the sensitivity threshold, the difference between the maximum and minimum values ​​of the corresponding sensitive feature values ​​of all data to be sent out is calculated. When the difference is less than or equal to 0.2 times the maximum value of the sensitive feature value, the minimum value of the sensitive feature value of all data to be sent out is set as the lower limit of the sensitivity threshold. When the difference between the maximum and minimum values ​​of all sensitive feature values ​​of a given day is greater than 0.2 times the maximum value of the sensitive feature value, the mean value of the corresponding sensitive feature values ​​of all data to be sent out is calculated as the lower limit of the sensitivity threshold.

[0013] In one embodiment, the method for determining the feedback discrimination threshold based on the proportion of sensitive words in data that was not released in the first batch the previous day is as follows: For the remaining data to be sent out the previous day, the number of corresponding sensitive words is obtained, and the ratio of sensitive words in each piece of data to the total number of words after word segmentation is calculated. All the ratios are arranged in descending order, and curve fitting is performed using the least squares method. The inflection point of the curve is obtained by calculating the inflection point method. The ratio of the sensitive words at the inflection point to the total number of words after word segmentation in the data is used as the feedback discrimination threshold.

[0014] In one embodiment, the method of sending out a batch of data by updating the lower limit of the sensitivity threshold is as follows: Calculate the sensitive feature value of the real-time data to be sent out. Send out the data that is less than or equal to the lower limit of the updated sensitive threshold. Record the data to be sent out at this time as the first data to be sent out.

[0015] The beneficial effects of this application are as follows: This application analyzes the differences in entity similarity features between encrypted data and original sensitive data that may cause interference in the automatic detection and blocking of sensitive data from trade union platforms. It also examines the differences in word vector distribution and correlation between sensitive words in the outgoing information and those that violate regulations, under different contextual influences. By distinguishing the compliance levels of different sensitive word data in different contexts, this application further optimizes and adjusts the automatic detection operation for illegal outgoing sensitive data, improving the accuracy of automatic detection and blocking of data with different levels of sensitivity, while avoiding misjudgment and blocking when encrypted data is sent as compliant data. Attached Figure Description

[0016] Figure 1 This is a flowchart illustrating an embodiment of a method for automatically detecting and blocking the unauthorized outward transmission of sensitive data from a trade union platform. Detailed Implementation

[0017] Please see Figure 1 The diagram illustrates a flowchart of an automatic detection and blocking method for the unauthorized outward transmission of sensitive data from a trade union platform, provided in one embodiment of this application. The method includes the following steps: Step S001: Collect the data to be sent out and preprocess it.

[0018] When automatically detecting and blocking the unauthorized outgoing transmission of sensitive data from the trade union platform, the first step is to acquire the outgoing data at the terminal monitoring level. At the terminal, Hook technology is used to obtain data from the clipboard, print jobs, file copying, and application sending queues. Simultaneously, the service entry point of the trade union platform is changed to the API gateway address, ensuring all requests pass through the gateway first, and then the gateway collects the data to be sent. Data detection and analysis are implemented using an asynchronous architecture with edge-cloud separation. After the terminal Hook probe intercepts an outgoing event, it suspends the data to be processed and asynchronously sends it to the analysis server. The terminal sets a preset waiting time threshold; in this embodiment, the waiting time threshold is 10 seconds, ensuring that the data can be effectively analyzed at the terminal. If the server completes the subsequent analysis and returns a judgment result within the waiting time threshold, the terminal executes either allow or block based on the result. If no feedback is received after the waiting time threshold, the terminal, for security reasons, defaults to a "warning to approval" process.

[0019] After setting up asynchronous communication and timeout protection mechanisms, all acquired data to be sent is preprocessed at the terminal. Specifically, real-time acquired image data is used as input, and Tesseract OCR is used to convert the text in the images, outputting editable text. Further, the OCR-extracted work order text is used as input, and a publicly available Chinese error correction tool (pycorrector) is used to correct the text, outputting the corrected text data. Tesseract OCR and the Chinese error correction tool (pycorrector) are well-known technologies for image text extraction and text error correction processing in the field of art; the specific operation steps will not be elaborated further. The extracted text data and the plain text data to be sent are used for subsequent word segmentation and deduplication operations. All text processing processes use the UTF-8 encoding standard to avoid garbled characters.

[0020] At this point, the preprocessed data to be sent out has been obtained.

[0021] Step S002: Construct a database to obtain entities and their vocabulary; determine the corresponding entities by the similarity between the vocabulary and entity vocabulary in the data to be sent out, and determine the sensitive vocabulary by the corresponding entities after filtering out the interfering vocabulary; determine the sensitive feature values ​​by the similarity between the sensitive vocabulary and its neighboring sensitive vocabulary and context vocabulary vectors.

[0022] The knowledge database in this application is constructed using outgoing data from historical system logs. Specifically, historical outgoing data collected through Hook technology is used as input, and named entity recognition technology is used to identify entity types, outputting named entity types. Named entity recognition technology is a well-known technology, and the specific process will not be elaborated further. In this application, the entity types are member information, sensitive information for hardship assistance, contact information, organizational and labor relations information, information outgoing time, public notice markers, and address information.

[0023] Furthermore, each piece of data to be sent is used as input, and a regular expression algorithm is used to extract fixed-format fields (such as employee ID, mobile phone number, ID card number, etc.) from the message. Further, the remaining text data is used as input, and jieba word segmentation is used to segment and remove stop words from the text. The stop word removal part uses the Harbin Institute of Technology stop word list as the standard, and the output is the vocabulary after segmentation and stop word removal.

[0024] Subsequent analysis and detection are performed on each piece of content to be sent out after word segmentation. All words after word segmentation and all words in the constructed entity types are used as separate inputs. The BERT model is used to calculate word vectors. The BERT model uses existing publicly available models and outputs a static word vector corresponding to each word. The regular expressions, jieba word segmentation, and BERT model are well-known techniques for text processing operations, and the specific operation steps will not be elaborated further. Furthermore, cosine similarity is calculated between each word in the data to be sent and the word vectors of all words in all entity types. The entity word with the highest cosine similarity to each word is obtained, and the entity type corresponding to this entity word is used as the entity for matching each word for subsequent analysis.

[0025] Considering that the trade union platform normally encrypts personal privacy information when sending data out, the acquired data to be sent may contain encrypted words. Sensitive words in the encrypted data (such as names changed to "XXX" or ID numbers encrypted with "xxxx") often have their integrity compromised by the masking, preventing them from forming high-density semantic clusters in the vector space. Therefore, after entity matching, their correlation with the unencrypted sensitive words is low. Furthermore, considering that entities such as member information, assistance information for those in need, and contact information are usually members' personal privacy, analysis and blocking of these entity types are implemented during data outreach.

[0026] Therefore, it is necessary to categorize the vocabulary. To avoid misjudgment and interference in subsequent processing due to encrypted words, words that have weak relevance to various entities after encryption need to be filtered out. Simultaneously, text containing potentially unprocessed sensitive words should undergo further analysis. Considering that the words in normally sent information typically belong to one of the entity types constructed from historical data—meaning that under normal circumstances, each word has a very high cosine similarity to a certain entity in the historically constructed entity type, usually approaching 1—when sensitive words in the sent data are encrypted, the masking destroys the integrity of the words, leading to a decrease in the correlation between these words and entities that originally had a very high cosine similarity, and consequently, a decrease in the maximum cosine similarity.

[0027] Based on the above analysis, the first step is to determine whether the quantity of all data to be sent out the previous day is zero. If the quantity is zero, a preset security constant is directly used as the segmentation threshold. In this embodiment, the preset constant is 0.5. If the quantity is not zero, the maximum cosine similarity corresponding to each word in all data to be sent out the previous day is obtained and used as input to calculate the mean of all the maximum cosine similarities. Since the maximum cosine similarity corresponding to the words with encrypted sensitive words is generally small and lower than the mean, while the maximum cosine similarity corresponding to normal words is generally large, close to 1, and generally higher than the mean, this mean is set as the segmentation threshold to remove words in the data to be sent out that are less than or equal to the segmentation threshold, thereby reducing the interference of words with generally low entity relevance to subsequent sensitive data blocking.

[0028] It is worth noting that when the difference between the maximum and minimum values ​​of the maximum cosine similarity for all words is less than 0.1 times the maximum cosine similarity, that is, when the differences in the maximum cosine similarity are small, it indicates that there were no sensitive words encrypted in all the data to be sent out the previous day. In this case, no further filtering is required, and all words can be processed.

[0029] For real-time acquired data to be sent out, the cosine similarity between each word and the corresponding word of the entity type is obtained, and the maximum value is obtained. The maximum value is compared with the segmentation threshold to filter out words in the real-time acquired data to be sent out. The remaining words in the data to be sent out are further processed. When the data to be sent out does not contain the entity type words corresponding to the above-mentioned member information, sensitive information on assistance for the needy, and contact information, it indicates that this type of data to be sent out usually does not contain sensitive words, and such data to be sent out is allowed. When the real-time acquired data to be sent out contains entity type words such as the above-mentioned member information, sensitive information on assistance for the needy, and contact information, the words in the above-mentioned entity types in each piece of data to be sent out in real-time are regarded as sensitive words, and location analysis is performed simultaneously.

[0030] Furthermore, a further analysis was conducted on all sensitive words and their corresponding violations. Considering that sensitive words in the data to be released may have different meanings in different contexts; for example, the descriptions "The trade union will hold a health lecture on 'Early Cancer Screening and Prevention' next week. Please organize your members to participate to learn about the early characteristics and prevention measures of cancer" and "Our employee, [name], has been diagnosed with cancer, and his / her spouse is also undergoing long-term treatment for uremia, resulting in financial difficulties for the family. Therefore, we are applying for serious illness assistance." Both descriptions contain the sensitive word "cancer," but the meaning of this sensitive word differs greatly in the two different contexts. The former sentence conforms to conventional rules... The standard format allows for normal outbound distribution. When unions issue announcements such as science popularization or lectures, they typically don't associate these with specific individuals, usually retaining the general meaning of sensitive words and concentrating on one type of entity, closely resembling the meanings of conventional sensitive words. However, in the latter case, which involves employee personal privacy information, interception and feedback are required during outbound distribution. In this case, sensitive words are usually associated with specific individuals, and the outbound data often shows sensitive words alternating between different entities. Furthermore, because sensitive words are strongly bound to individuals, their meanings deviate from their original meanings due to contextual influences, resulting in a significant semantic similarity to static sensitive words. For example, in disease lectures, information such as personal details or contact information is usually not linked, so sensitive words in the data are typically of the same entity type, and different entity-specific sensitive words do not frequently appear.

[0031] Based on the above analysis, it can be seen that when sensitive words are expressed in different ways, the target sensitive words will usually undergo changes in part-of-speech features due to the influence of adjacent words. When not bound to a specific natural person, the corresponding word meaning is quite different from the regular word meaning; while when bound to a natural person, it will represent the regular word meaning.

[0032] Therefore, for each piece of data to be sent out, the data is used as input, and the BERT model is used to obtain context-related word vectors for sensitive words in the data. The output is the context-related word vector for each sensitive word. The BERT model is a well-known technology, and will not be described in detail here.

[0033] Furthermore, the cosine similarity between the static word vector obtained by the BERT model and the context-related word vector obtained by the BERT model for each sensitive word in the data to be sent is calculated; the absolute mean of the cosine similarities of all sensitive words in the data to be sent is recorded as the first absolute mean. Simultaneously, the cosine similarity between each sensitive word and its left and right nearest neighbor sensitive words in the data to be sent is calculated, recorded as the nearest neighbor cosine similarity for each sensitive word; the absolute mean of the nearest neighbor cosine similarities obtained for all sensitive words in the data to be sent is recorded as the second absolute mean. It is worth noting that the word vectors are obtained using BERT's static vocabulary embedding layer, and the same BERT model is used for training both types of word vectors to ensure that the output vector dimensions are the same. When the target sensitive word does not have one nearest neighbor sensitive word on each side, if only one side has a nearest neighbor sensitive word, then only the cosine similarity between the target sensitive word and the existing nearest neighbor sensitive word is calculated; if there is no nearest neighbor sensitive word, that is, there is only one sensitive word in the data to be sent, it indicates that the sentence will not contain both natural person information and sensitive words associated with natural persons. Therefore, even if a sensitive word appears, it is impossible to form a situation where a sensitive word and a natural person coexist, and its corresponding sensitivity is relatively low. For this case, the second absolute mean is directly set to 1.

[0034] Sensitive feature values ​​are constructed using the first absolute mean and the second absolute mean.

[0035] The sensitive feature values ​​are negatively correlated with the first absolute mean and the second absolute mean, respectively.

[0036] It should be noted that positive correlation means that when one variable increases, the other variable also increases, and the two variables change in the same direction. When one variable changes from large to small or from small to large, the other variable also changes from large to small or from small to large. The specific relationship is determined by the actual application, and this application does not impose any special restrictions.

[0037] It should be noted that negative correlation means that when one variable increases, the other variable decreases accordingly, and the two variables change in opposite directions. When one variable changes from large to small or from small to large, the other variable also changes from small to large or from large to small. The specific relationship is determined by practical application, and this application does not impose any special restrictions.

[0038] Preferably, in this embodiment, the expression for the sensitive feature value is: , This represents the first absolute mean of the data 'a' to be sent out. This represents the second absolute mean of the data 'a' to be sent out. This represents the sensitive feature value of the data 'a' to be sent out.

[0039] The larger the sensitivity feature value, the more severe the sensitivity of the corresponding word. The smaller the obtained sensitivity feature value, the more likely it is that the sensitive word usually does not coexist with a natural person, there is no specific semantic bias, and the target sensitive word is highly similar to adjacent sensitive words. This usually means that the sensitive words in the data to be sent out may exist in a specific compliant form (such as popular science, lectures, etc.), retaining the general meaning of the sensitive words, resulting in the sensitive words being similar to the regular meanings. In addition, the data is more likely to show that the sensitive words are mainly of the same entity type and there is no alternating distribution of sensitive words of different entity types.

[0040] At this point, the sensitive feature values ​​of the data to be sent out have been obtained.

[0041] Step S003: Update the preset lower limit of the sensitivity threshold through the sensitivity feature value, and filter a batch of outgoing data based on the updated lower limit of the sensitivity threshold; for the remaining data, make further judgments based on the proportion of sensitive words to complete the detection and blocking.

[0042] After analyzing and processing the real-time acquired data to be sent out through the above operations, in this embodiment, all sensitive feature values ​​in all data to be sent out within the previous 24 hours are obtained. To avoid the situation where there is no sensitive data at all in the data sent out the previous day, a lower limit of the sensitivity threshold is set. Specifically, the lower limit of the sensitivity threshold is set to the median value of the sensitive feature value range, 0.5. When the maximum value of the corresponding sensitive feature value of all data to be sent out the previous day is less than the lower limit of the sensitivity threshold, it means that there is no sensitive data at all in the data sent out the previous day. At this time, the lower limit of the sensitivity threshold is updated to an empirical value of 0.85 for the detection and blocking of sensitive data on the same day, so as to avoid the situation where the detection and blocking of sensitive information data is missed due to the threshold being too low, resulting in the abnormal outgoing of sensitive data.

[0043] If the maximum value of the sensitive feature value corresponding to all data to be sent out on a given day is greater than 0.5 times the lower limit of the sensitivity threshold, it indicates that the sensitivity of all data to be sent out is high. Calculate the difference between the maximum and minimum values ​​of the sensitive feature values ​​corresponding to all data to be sent out. If the difference is less than or equal to 0.2 times the maximum value of the sensitive feature value, it indicates that the sensitive words in all data to be sent out are of high risk. In this case, the minimum value of the sensitive feature value in all data to be sent out is set as the lower limit of the sensitivity threshold. Considering the presence of both compliant and non-compliant sensitive keywords, the overall sensitivity feature value of the data to be sent containing compliant sensitive keywords is relatively small, while the sensitivity feature value of the data containing non-compliant sensitive keywords is relatively large. The difference in sensitivity feature values ​​between these two scenarios is significant. Therefore, if the difference between the maximum and minimum values ​​of all sensitivity feature values ​​for a given day is greater than 0.2 times the maximum value of the maximum sensitivity feature value, it indicates a large difference in sensitivity feature values. The mean of the sensitivity feature values ​​corresponding to all data to be sent is calculated and used as the lower limit of the sensitivity threshold. Sensitive data detection is then performed on the real-time acquired data to be sent.

[0044] Calculate the sensitive feature value of the real-time data to be sent out. Send out the data that is less than or equal to the lower limit of the updated sensitive threshold. Record the data to be sent out at this time as the first data to be sent out.

[0045] Furthermore, for the remaining data to be sent out the previous day, the number of corresponding sensitive words is obtained, and the ratio of sensitive words in each piece of data to the total number of words after word segmentation is calculated. All ratios are arranged in descending order, and curve fitting is performed using the least squares method. The inflection point of the curve is obtained by calculating the inflection point, and the ratio of the sensitive words at the inflection point to the total number of words after word segmentation is used as the feedback discrimination threshold. In this embodiment, the descending sequence index number is used as the horizontal axis, and the ratio is used as the vertical axis. The Logistic function is used for least squares fitting, and the second derivative of the fitted curve function is calculated to determine the curvature change point as the inflection point.

[0046] Considering that clearly high-risk data leaks usually involve the outward transmission of a large amount of sensitive privacy data, the ratio of the number of words in the data to be transmitted is relatively large. However, violations that can be corrected (unclear user intent or operational errors) usually involve the unintentional inclusion of sensitive data, and the number of words in the data to be transmitted is relatively small. Therefore, the ratio of the data to be transmitted that is acquired in real time is calculated. When the ratio is greater than the feedback distinction threshold, the data to be transmitted is judged as a serious violation of sensitive data transmission, and is directly blocked and the outgoing network address is marked and fed back. When the ratio of the real-time acquired data to be sent out is less than or equal to the feedback distinction threshold, the data to be sent out is judged as a violation that can be corrected (due to unclear user intent or operational error). In such cases, a warning is issued. If the user still chooses to send the data, the operation is automatically converted into an approval request and pushed to the immediate supervisor or data security officer, who decides whether to approve or reject it. This completes the automatic detection and blocking of the illegal outgoing of sensitive data from the union platform.

[0047] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

Claims

1. A method for automatically detecting and blocking the unauthorized outward transmission of sensitive data from a trade union platform, characterized in that, The method includes the following steps: Collect data to be sent out and preprocess it; For historical outbound data, a database is constructed, and entity recognition is performed to obtain each entity type and its corresponding vocabulary; for the text portion of the data to be outbound, word segmentation is performed to obtain its vocabulary; the similarity between the vocabulary in the data to be outbound and the vocabulary corresponding to the entity type is calculated to determine the entity corresponding to the vocabulary; the threshold is determined by the similarity of the vocabulary of the previous day to filter out interfering words in the real-time outbound data, and sensitive words are determined by the entity corresponding to the vocabulary; sensitive feature values ​​are determined by the similarity between the sensitive words and their context-related word vectors and the similarity between the sensitive words and their neighboring sensitive words. The preset lower limit of the sensitivity threshold is updated by comparing the maximum and minimum values ​​of the sensitive feature values ​​of all data to be sent out the previous day with the lower limit of the sensitivity threshold. A batch of data is sent out based on the updated lower limit of the sensitivity threshold. For data that was not sent out in the first batch the previous day, the feedback discrimination threshold is determined by the proportion of its sensitive words. The proportion of sensitive words in the real-time data to be sent out is compared with the feedback discrimination threshold to determine the data release, thus completing the detection and blocking.

2. The method for automatic detection and blocking of unauthorized outgoing sensitive data from a trade union platform as described in claim 1, characterized in that, The entity types include member information, sensitive information for assistance to those in need, contact information, organizational and labor relations information, information release time, public notice markings, and address information.

3. The method for automatic detection and blocking of unauthorized outgoing sensitive data from a trade union platform as described in claim 1, characterized in that, The method for calculating the similarity between words in the data to be sent out and words corresponding to entity types to determine the entities corresponding to the words is as follows: For each word in the data to be sent out, the cosine similarity is calculated between it and the word vectors of all entity types. The entity word with the highest cosine similarity to each word is then obtained, and the entity type corresponding to that entity word is used as the entity to match each word.

4. The method for automatic detection and blocking of unauthorized outgoing sensitive data from a trade union platform as described in claim 2, characterized in that, The method for determining a threshold based on the similarity of words from the previous day to filter out interfering words in the real-time data to be sent out, and for determining sensitive words based on the entities corresponding to those words, is as follows: Obtain the maximum cosine similarity for each word in all data to be sent out the previous day, and calculate the mean of all the maximum cosine similarities as the segmentation threshold. Calculate the cosine similarity between each word in the real-time outgoing data and the corresponding word of the entity type, obtain the maximum value of the cosine similarity of each word, filter out words whose maximum cosine similarity is less than or equal to the segmentation threshold, and among the remaining words, words corresponding to the three entity types of member information, sensitive information on assistance for the needy, and contact information are designated as sensitive words.

5. The method for automatic detection and blocking of unauthorized outgoing sensitive data from a trade union platform as described in claim 1, characterized in that, The sensitive feature values ​​are negatively correlated with the first absolute mean and the second absolute mean, respectively.

6. The method for automatic detection and blocking of unauthorized outgoing sensitive data from a trade union platform as described in claim 5, characterized in that, The first absolute mean is the absolute mean of the cosine similarity between all sensitive words in the data to be sent and their context-related word vectors.

7. The method for automatic detection and blocking of unauthorized outgoing sensitive data from a trade union platform as described in claim 5, characterized in that, The second absolute mean is the absolute mean of the nearest neighbor cosine similarity obtained for all sensitive words in the data to be sent out; the nearest neighbor cosine similarity is the cosine similarity between each sensitive word and its left and right nearest neighbor sensitive words in the data to be sent out.

8. The method for automatic detection and blocking of unauthorized outgoing sensitive data from a trade union platform as described in claim 1, characterized in that, The method for updating the preset sensitivity threshold lower limit by comparing the maximum and minimum values ​​of the sensitive feature values ​​of all data to be sent out the previous day with the preset sensitivity threshold lower limit is as follows: When the maximum value of the sensitive feature of all data to be sent out in a given day is less than the lower limit of the preset sensitivity threshold, the lower limit of the preset sensitivity threshold will be set to a preset empirical value. When the maximum value of the sensitive feature value of all data to be sent out on a given day is greater than the lower limit of the preset sensitive threshold, calculate the difference between the maximum and minimum values ​​of the sensitive feature values ​​of all data to be sent out. When the difference is less than or equal to 0.2 times the maximum value of the sensitive feature value, set the minimum value of the sensitive feature value of all data to be sent out as the lower limit of the sensitive threshold. When the difference between the maximum and minimum values ​​of all sensitive feature values ​​in a given day is greater than 0.2 times the maximum value of the sensitive feature value, the mean of the sensitive feature values ​​corresponding to all data to be sent out is calculated as the lower limit of the sensitivity threshold.

9. The method for automatic detection and blocking of unauthorized outgoing sensitive data from a trade union platform as described in claim 1, characterized in that, The method for determining the feedback discrimination threshold based on the proportion of sensitive words in data that was not released in the first batch the previous day is as follows: For the remaining data to be sent out the previous day, the number of corresponding sensitive words is obtained, and the ratio of sensitive words in each piece of data to the total number of words after word segmentation is calculated. All the ratios are arranged in descending order, and curve fitting is performed using the least squares method. The inflection point of the curve is obtained by calculating the inflection point method. The ratio of the sensitive words at the inflection point to the total number of words after word segmentation in the data is used as the feedback discrimination threshold.

10. The method for automatic detection and blocking of unauthorized outgoing sensitive data from a trade union platform as described in claim 1, characterized in that, The method for sending out a batch of data by updating the lower limit of the sensitivity threshold is as follows: Calculate the sensitive feature value of the real-time data to be sent out. Send out the data that is less than or equal to the lower limit of the updated sensitive threshold. Record the data to be sent out at this time as the first data to be sent out.

Images