Dynamic forbidden word and security word detection system

Abstract

The application discloses a dynamic forbidden word and security word detection system and particularly relates to the field of data security and content detection. The multi-agent scheduling engine intelligently analyzes the format and business label of task data, dynamically and concurrently calls special detection units such as documents, forms or corpus based on the mapping relationship of "data type-scene-agent", and the system switching adaptive matching module uses a standardized interface layer to connect multiple source systems and loads corresponding rule subsets in real time by a rule adaptive unit. The dynamic rule base visual editing module supports the whole life cycle management and version backtracking of forbidden words, matching modes and risk levels. The multi-level authentication module links identity, task and result verification, combines the field-level data authority control module, realizes fine-grained dynamic desensitization and access control according to the "user role-field level" mapping, and forms a closed-loop security protection of detection and authority.

Description

Technical Field

[0001] This invention relates to the field of data security and content detection technology, and more specifically, to a dynamic prohibited and safe word detection system. Background Technology

[0002] As enterprises deepen their digital transformation, data assets are becoming increasingly diversified, encompassing knowledge documents, AI training corpora, business forms, and API interface data. During data flow and sharing, the detection of prohibited words (such as sensitive political terms and illegal marketing language) and security terms (such as core technical terms and corporate confidentiality identifiers) has become a crucial step in ensuring data security and meeting compliance requirements.

[0003] Currently, mainstream data security word detection solutions in the industry have significant flaws: Static rule fixation: Traditional systems mostly use static rule bases. Rule updates rely on technical personnel to manually modify configuration files and restart the system, which cannot quickly respond to dynamic changes in policies, regulations and business scenarios, resulting in low detection coverage and delayed response.

[0004] Weak system adaptability: Existing detection tools are often customized for specific systems (such as a single knowledge management platform). When the detection target is switched to corpus data or business forms, the detection module needs to be redeployed or modified. Deployment across multiple systems is costly and has poor compatibility.

[0005] High configuration threshold: Rule configuration relies on coding, and business personnel who are not involved in security operations cannot directly participate in rule iteration, which limits the flexibility and efficiency of rule adjustment.

[0006] The system suffers from a lack of robust access control: the detection process is disconnected from access authentication. While the system can identify prohibited words, it cannot effectively manage data access permissions, leading to the risk of data leaks where "detection passes but access is exceeded." Furthermore, access control is often limited to the document or table level, failing to provide precise protection for critical sensitive fields such as ID numbers and core technical parameters.

[0007] Therefore, there is an urgent need for a data security detection system that can achieve "intelligent scheduling, dynamic adaptation, and precise control" to address the shortcomings of existing technologies. Summary of the Invention

[0008] To overcome the aforementioned deficiencies of the prior art, embodiments of the present invention provide a dynamic prohibited and safe word detection system to address the problems mentioned in the background art.

[0009] To achieve the above objectives, the present invention provides the following technical solution: Multi-agent scheduling engine module: used to receive data detection tasks, identify the data types and business scenarios in the tasks, and dynamically schedule one or more specialized detection agents to perform concurrent data detection according to the preset "data type - business scenario - agent" mapping relationship; the specialized detection agents include dedicated detection units encapsulated for different data formats and detection logic; The system switching adaptive matching module includes a standardized adaptation interface layer and a rule adaptive unit. The standardized adaptation interface layer is used to interface with different external data source systems (such as knowledge management platforms, data middleware, AI corpus platforms, etc.) and parse their data formats. The rule adaptive unit is used to automatically load and apply the corresponding rule subset from the dynamic rule base according to the type of the currently connected external data source system. The dynamic rule base visual editing module provides a visual operation interface, allowing users to add, delete, modify, and query dynamic rule bases that store prohibited and / or safe words online, and record version information for each rule change; The multi-level authentication module is integrated with enterprise identity authentication systems (such as IAM) to perform identity authentication, task authentication, and result authentication before, during, and after a data detection task is initiated, thereby enabling the linkage between the detection process and permission verification. The field-level data access control module is used to identify fields in the data and mark their sensitivity levels. Based on the preset "user role - field level - operation permission" mapping relationship and combined with the verification results of the multi-level authentication module, it performs field-level access control or de-identification processing on sensitive fields that hit security words.

[0010] Preferably, in the multi-agent scheduling engine module, when a detection task enters the system, the scheduling engine first performs intelligent parsing of the task data. By analyzing the format characteristics of the data file, metadata information, and business tags carried by the task initiator, it automatically identifies the data type of the current task and determines whether it is a knowledge document in PDF / Word format, dialogue data in an AI training corpus, a structured business form, or a data stream transmitted in real time through an API interface. At the same time, it combines information such as the task initiating department, target system, and sharing scope to comprehensively determine whether its business scenario belongs to internal circulation, cross-departmental collaboration, or external sharing and release. Based on a pre-defined multi-dimensional mapping table of "data type - business scenario - intelligent agent", the scheduling engine dynamically matches the optimal combination of detection intelligent agents. For example, for a PDF technical document containing embedded forms and belonging to an externally shared scenario, the engine will simultaneously schedule a document detection intelligent agent to parse the text and image content in the PDF and perform semantic-level prohibited word recognition, and a form detection intelligent agent to extract the structured fields in the embedded forms and perform accurate matching of sensitive data. For AI corpus training tasks belonging to internal use scenarios, the corpus detection intelligent agent will be scheduled to combine a large language model to perform contextual association analysis and implicit violation expression recognition.

[0011] Preferably, in the system switching adaptive matching module, the standardized adaptation interface layer adopts a microkernel architecture design, and has built-in adapter kernels including mainstream enterprise-level data interaction protocols, including an HTTP / HTTPS adapter supporting RESTful API calls, a JDBC adapter for direct connection to relational databases, an FTP / SFTP adapter compatible with traditional file transfer scenarios, and an HDFS adapter and a Kafka adapter for big data platforms and message queues. Based on this interface layer, when the system needs to connect to a new data source, such as an enterprise knowledge management platform, it only needs to fill in the platform's API endpoint, authentication method, and data retrieval strategy through a visual configuration interface, and the interface layer can automatically call the corresponding HTTP adapter to establish a connection without writing any code. For each connected system, the module dynamically loads the corresponding data parsing adapter, which is a set of pre-set or customizable adapters. The parsing plugin can deeply understand the data organization logic of different systems: For knowledge management platforms, the parsing adapter automatically calls its API to obtain the binary stream, metadata tags, and version information of documents; for data middleware platforms, the adapter reverse-engineers the table structure (Schema) through JDBC to extract field names, field types, and relationships between databases and tables; for AI corpus platforms, the adapter can identify dialogue formats, text paragraph divisions, and annotation information to accurately extract the content of the corpus to be detected; through a two-layer mechanism of protocol adaptation and format parsing, the standardized adaptation interface layer unifies data from different sources and with different formats into standard data objects within the system for subsequent detection processes.

[0012] Preferably, in the dynamic rule base visual editing module, at the basic rule configuration level, the interface provides a concise and clear term management function area. Security operations personnel can click the "Add Term" button and enter specific prohibited or safe terms in the pop-up form, such as "core technical parameters" or relevant clauses of the Data Security Law. While entering terms, the interface provides matching mode options: exact matching is suitable for sensitive data with fixed formats such as ID card numbers and bank card numbers; fuzzy matching is suitable for synonyms, variant words, or illegal expressions with interfering characters; semantic matching calls the built-in NLP engine in the background, suitable for identifying implicit illegal content with similar contexts but different literal meanings. For each term, operations personnel can configure its risk level (high / medium / low) via a slider or radio button. Different levels correspond to different handling strategies: high-risk terms are directly blocked from access, medium-risk terms trigger a manual review process, and low-risk terms are only logged for auditing. At the level of association rule configuration, the module provides a visual logic orchestration canvas, where users can connect multiple term nodes by dragging and dropping and set logical relationships such as "AND," "OR," and "NOT." For example, a rule can be created that stipulates "when both internal code and unpublished version numbers are matched, a high-risk alarm is triggered." Hierarchical rule management allows users to classify and manage the term library according to business scenarios, such as establishing multiple rule sets such as "financial compliance," "technical secrets," and "personal privacy." Each rule set contains corresponding terms and handling strategies, facilitating rapid application in different business scenarios.

[0013] Preferably, the multi-level authentication module adopts a plug-in architecture design, which is deeply integrated with the enterprise's existing identity authentication and authorization management system through standard protocol interfaces. It is compatible with and supports mainstream authentication protocols such as LDAP, OAuth2.0, and SAML2.0, and can also be customized to connect with various domestic identity authentication platforms, ensuring seamless embedding in the enterprise's existing IT architecture. At the identity authentication level, when a user initiates a data access or detection task request, the multi-level authentication module first intercepts the request and calls the enterprise IAM interface to verify the authenticity of the user's identity. Simultaneously, it obtains the user's complete attribute information, including their organizational department, job role, rank, and temporary authorization security tag. This process goes beyond simple username and password verification; it constructs a multi-dimensional user identity vector space. Let the user... Identity features can be represented as vectors:

[0014] Where org represents the organization code, role represents the set of roles, level represents the security level, and tags represent the set of dynamic tags; The module uses a preset access control matrix. Determine if the user has basic system access permissions, if Identity If the identity is matched with any of the permission rules in the matrix, the authentication is successful and the user proceeds to the next stage.

[0015] Preferably, the field-level data access control module is architecturally composed of three parts: a sensitive field intelligent identification engine, a field-role access control matrix, and a dynamic desensitization executor. These components work together to achieve precise and automated control of sensitive data. The sensitive field intelligent identification engine adopts a dual-track identification strategy, combining user-initiated labeling with automatic system identification to build a comprehensive and dynamically updated list of sensitive fields. At the manual labeling level, the module provides a visual data asset organization interface. Data administrators can browse the table structure of various data sources like operating a spreadsheet. Through simple checkboxes and level settings, they can label fields with sensitivity levels, marking ID numbers, bank account numbers, and core technical parameters as "core fields," customer mobile phone numbers, home addresses, and order amounts as important fields, and product names and publicly disclosed policy terms as "ordinary fields." At the automatic identification level, the module and the form detection agent form a closed-loop linkage: when the form detection agent finds content that matches the sensitive data pattern in an unlabeled field during scanning, such as 18 consecutive digits resembling an ID number or technical code in a specific format resembling core technical parameters, the engine will trigger an automatic identification algorithm to calculate the sensitivity confidence level of that field. Set the field The sensitivity confidence is based on its content feature vector. Matching degree calculation with the pre-trained sensitive pattern library:

[0016] in, For feature extraction function, This is the weight matrix. For bias terms, The sigmoid function maps the result to the interval [0,1]; when Exceeding the preset threshold At that time, the engine automatically suggests marking the segment as having the corresponding sensitivity level and pushes it to the data administrator for confirmation, forming a closed-loop optimization mechanism of "detection and discovery - intelligent suggestion - manual confirmation"; Let the user role set be... The field level set is Core, important, ordinary The set of operation permissions is No permission required. View anonymized text, view plaintext, edit. Mapping matrix Define a from arrive The mapping function.

[0017] The technical effects and advantages of this invention are as follows: This invention achieves dynamic and intelligent detection rules. The system can automatically switch detection strategies and rule sets according to data sources and business scenarios, significantly improving the accuracy and adaptability of detection. It constructs a three-level authentication linkage mechanism of identity-task-result, integrating access control throughout the entire detection process, effectively preventing abuse of permissions and unauthorized access. It achieves field-level sensitive data control, minimizing the risk of sensitive information leakage while ensuring data availability through intelligent identification and refined desensitization. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of the overall structure of the present invention. Detailed Implementation

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] Please see Figure 1 As shown, this invention provides a dynamic prohibited and safe word detection system, including: Multi-agent scheduling engine module: used to receive data detection tasks, identify the data types and business scenarios in the tasks, and dynamically schedule one or more specialized detection agents to perform concurrent data detection according to the preset "data type - business scenario - agent" mapping relationship; the specialized detection agents include dedicated detection units encapsulated for different data formats and detection logic; In the multi-agent scheduling engine module, when a detection task enters the system, the scheduling engine first performs intelligent parsing of the task data. By analyzing the format characteristics of the data file, metadata information, and business tags carried by the task initiator, it automatically identifies the data type of the current task and determines whether it is a knowledge document in PDF / Word format, dialogue data in an AI training corpus, a structured business form, or a data stream transmitted in real time through an API interface. At the same time, it combines information such as the task initiating department, the target system, and the scope of sharing to comprehensively determine whether the business scenario belongs to internal circulation, cross-departmental collaboration, or external sharing and release. Based on a pre-defined multi-dimensional mapping table of "data type - business scenario - intelligent agent", the scheduling engine dynamically matches the optimal combination of detection intelligent agents: for example, for a PDF technical document containing embedded forms and belonging to an external sharing scenario, the engine will simultaneously schedule the document detection intelligent agent to be responsible for parsing the text and image content in the PDF and performing semantic-level prohibited word recognition, and the form detection intelligent agent to be responsible for extracting the structured fields in the embedded forms and performing accurate matching of sensitive data; for AI corpus training tasks belonging to internal use scenarios, the corpus detection intelligent agent will be scheduled to combine a large language model to perform contextual association analysis and implicit violation expression recognition. The scheduling engine supports a multi-agent parallel detection mechanism, which can simultaneously call multiple specialized detection agents to work together for complex data, ensuring the comprehensiveness and accuracy of detection; at the same time, it has built-in load balancing and priority scheduling strategies, which dynamically allocate computing resources according to the urgency of the task and the system resource usage, ensuring detection efficiency in high-concurrency scenarios. Furthermore, each specialized detection agent is not a static and fixed detection unit, but rather has built-in adaptive learning capabilities. It can continuously iterate and optimize its internal detection model and matching algorithm based on feedback data from historical detection results. The document detection agent can optimize the OCR recognition accuracy and semantic understanding model based on the user's correction of false alarm results, while the corpus detection agent can continuously strengthen its ability to identify implicit violations through manual review of results, thereby achieving dynamic improvement and closed-loop optimization of detection accuracy.

[0022] The system switching adaptive matching module includes a standardized adaptation interface layer and a rule adaptive unit. The standardized adaptation interface layer is used to interface with different external data source systems (such as knowledge management platforms, data middleware, AI corpus platforms, etc.) and parse their data formats. The rule adaptive unit is used to automatically load and apply the corresponding rule subset from the dynamic rule base according to the type of the currently connected external data source system. In the system switching adaptive matching module, the standardized adaptation interface layer adopts a microkernel architecture design, which incorporates adapter kernels for mainstream enterprise-level data interaction protocols, including an HTTP / HTTPS adapter supporting RESTful API calls, a JDBC adapter for direct connections to relational databases, an FTP / SFTP adapter compatible with traditional file transfer scenarios, and an HDFS adapter and a Kafka adapter for big data platforms and message queues. Based on this interface layer, when the system needs to connect to a new data source, such as an enterprise knowledge management platform, it only needs to fill in the platform's API endpoint, authentication method, and data retrieval strategy through a visual configuration interface, and the interface layer can automatically call the corresponding HTTP adapter to establish a connection without writing any code. For each connected system, the module dynamically loads the corresponding data parsing adapter, which is a set of pre-built or customizable adapters. The parsing plugin can deeply understand the data organization logic of different systems: For knowledge management platforms, the parsing adapter automatically calls its API to obtain the binary stream, metadata tags, and version information of documents; for data middleware platforms, the adapter reverse-engineers the table structure (Schema) through JDBC to extract field names, field types, and relationships between databases and tables; for AI corpus platforms, the adapter can identify dialogue formats, text paragraph divisions, and annotation information to accurately extract the content of the corpus to be detected; through a two-layer mechanism of protocol adaptation and format parsing, the standardized adaptation interface layer unifies data from different sources and with different formats into standard data objects within the system for subsequent detection processes.

[0023] Upon successful data source connection and data parsing, the rule adaptive unit immediately initiates intelligent rule matching logic. This unit maintains a dynamically updated "system type - rule subset" mapping table internally. This table includes the system's preset industry best practices (e.g., the knowledge management platform defaults to the "confidential terminology + violation policy terms" rule subset, and the AI ​​corpus platform defaults to the "implicit violation expressions + copyright-sensitive words" rule subset), and also allows security administrators to customize adjustments and weight configurations according to the company's actual needs.

[0024] Once the standardized adaptation interface layer identifies and confirms that the currently active data source is a specific system, the rule adaptation unit immediately triggers the rule loading action: First, it queries the association mapping table to determine one or more rule subsets that match the system type. Then, it loads the corresponding terms, matching patterns, risk levels, and handling strategies from the dynamic rule base into the memory space of the detection engine in real time. This process is dynamic and real-time. When the user switches the data source on the front-end interface, such as switching from document detection to API interface detection, the rule adaptation unit can complete the unloading of the old rule set and the loading of the new rule set within milliseconds, and simultaneously adjust the working mode of the detection agent. That is, the document system automatically enables the batch deep scanning mode, while the API system seamlessly switches to the low-latency real-time streaming detection mode. The entire process requires no manual intervention and no service restart.

[0025] The dynamic rule base visual editing module provides a visual operation interface, allowing users (such as security operations and maintenance personnel) to perform online operations such as adding, deleting, modifying, and querying on the dynamic rule base that stores prohibited words and / or safe words, and record the version information of each rule change, supporting version backtracking and comparison; In the dynamic rule base visual editing module, at the basic rule configuration level, the interface provides a concise and clear term management function area. Security operations personnel can click the "Add Term" button and enter specific prohibited or safe terms in the pop-up form, such as "core technical parameters" or relevant clauses of the Data Security Law. While entering terms, the interface provides matching mode options: exact matching is suitable for sensitive data with fixed formats such as ID card numbers and bank card numbers; fuzzy matching is suitable for synonyms, variant words, or expressions containing distracting characters; semantic matching calls the built-in NLP engine in the background, suitable for identifying implicit violations with similar contexts but different literal meanings. For each term, operations personnel can configure its risk level (high / medium / low) via a slider or radio button. Different levels correspond to different handling strategies: high-risk terms are directly blocked from access, medium-risk terms trigger a manual review process, and low-risk terms are only logged for auditing. At the level of association rule configuration, the module provides a visual logic orchestration canvas, where users can connect multiple term nodes by dragging and dropping and set logical relationships such as "AND," "OR," and "NOT." For example, a rule can be created that stipulates "when both internal code and unpublished version numbers are matched, a high-risk alarm is triggered." Hierarchical rule management allows users to classify and manage the term library according to business scenarios, such as establishing multiple rule sets such as "financial compliance," "technical secrets," and "personal privacy." Each rule set contains corresponding terms and handling strategies, facilitating rapid application in different business scenarios.

[0026] Every rule change—whether it's adding a new term, modifying the matching mode, adjusting the risk level, or deleting an expired rule—automatically generates a new version record. This record details the version number, change time, operator, description of the changes, and a complete rule snapshot. The sidebar provides a version history list, allowing users to easily compare differences between versions by clicking on any historical version, such as highlighting newly added terms or modified configuration items. If a new rule version causes an increase in false positives or other issues, operations personnel can simply click the "Rollback" button to restore the entire rule base to any previous stable version within seconds, ensuring uninterrupted business continuity.

[0027] The multi-level authentication module is integrated with enterprise identity authentication systems (such as IAM) to perform identity authentication, task authentication, and result authentication before, during, and after a data detection task is initiated, thereby enabling the linkage between the detection process and permission verification. The multi-level authentication module adopts a plug-in architecture design and is deeply integrated with the enterprise's existing identity authentication and authorization management system through standard protocol interfaces. It is compatible with mainstream authentication protocols such as LDAP, OAuth2.0, and SAML2.0, and can also be customized to connect with various domestic identity authentication platforms, ensuring seamless embedding in the enterprise's existing IT architecture. At the identity authentication level, when a user initiates a data access or detection task request, the multi-level authentication module first intercepts the request and calls the enterprise IAM interface to verify the authenticity of the user's identity. Simultaneously, it obtains the user's complete attribute information, including their organizational department, job role, rank, and temporary authorization security tag. This process goes beyond simple username and password verification; it constructs a multi-dimensional user identity vector space. Let the user... Identity features can be represented as vectors:

[0028] Where org represents the organization code, role represents the set of roles, level represents the security level, and tags represent the set of dynamic tags; The module uses a preset access control matrix. Determine if the user has basic system access permissions, if Identity If the identity is matched with any of the permission rules in the matrix, the authentication is successful and the user proceeds to the next stage. At the task authentication level, the module further verifies whether the detection task initiated by the user is within the scope of their business permissions; different types of detection tasks have different risk weights. For example, although internal viewing and "external sharing" may involve the same document, the latter obviously has a higher security risk; the module introduces a task risk function. and user permission threshold function For a detection task, its characteristics can be represented as task type (type) and target data sensitivity level (level). And the composite function of the scope of operation, the specific calculation method is as follows:

[0029] in, Represented as weighting coefficients; User permission thresholds are dynamically calculated based on their identity characteristics and historical behavior:

[0030] The core of task authentication is the judgment inequality. Whether it is valid; the detection task is only allowed to execute if the task risk value does not exceed the user's permission threshold; otherwise, the system will directly block the request and return a message indicating insufficient task permissions. For example, when an ordinary R&D staff member attempts to initiate a detection task to share core technical documents externally, the risk value of the task... Greater than its permission threshold Therefore, it was automatically blocked; At the result authentication level, the module extends permission verification to after the detection task is completed, forming a closed-loop control. The result authentication logic is triggered after the detection agent completes scanning the data content and outputs the detection results. Let the detection result vector be:

[0031] Here, `hitWords` represents the list of prohibited or safe words detected, `A` represents the highest risk level of this detection, and `sensitiveFields` represents the set of identified sensitive fields. Result authentication dynamically adjusts the user's final access permissions to the data output based on the detection results. Define the data access permission function. ,Result);

[0032] in, This indicates full access permission. This indicates partial access permission. This indicates that access has been blocked. This is represented as the user's risk threshold. Represented as a set of user-accessible fields; If the highest risk level A in the detection results is lower than the user's acceptable risk threshold, and all identified sensitive fields belong to the set of fields the user is authorized to access, then full access is granted. If the risk level meets the standard but the sensitive fields exceed the permission range, then the field-level control mechanism is triggered, and the field-level data permission control module intervenes to perform de-identification processing. If the risk level exceeds the user's permission threshold, then access is directly blocked, and an alarm message is pushed to the security administrator. Through the three-level authentication linkage mechanism of identity-task-result, permission control for each data access is achieved, ensuring that even after the detection engine discovers high-risk content, the system can still make differentiated responses based on user permissions and risk levels, fundamentally eliminating the risk of data leakage due to "detection passing but exceeding permissions".

[0033] The field-level data access control module is used to identify fields in the data and mark their sensitivity levels. Based on the preset "user role - field level - operation permission" mapping relationship and combined with the verification results of the multi-level authentication module, it performs field-level access control or de-identification processing on sensitive fields that hit security words.

[0034] The field-level data access control module consists of three parts in its architecture: a sensitive field intelligent identification engine, a field-role permission mapping matrix, and a dynamic desensitization executor. These parts work together to achieve precise and automated control of sensitive data. The sensitive field intelligent identification engine adopts a dual-track identification strategy, combining user-initiated labeling with automatic system identification to build a comprehensive and dynamically updated list of sensitive fields. At the manual labeling level, the module provides a visual data asset sorting interface. Data administrators can browse the table structure of various data sources like operating a spreadsheet. Through simple checkboxes and level settings, they can label fields with sensitivity levels, marking ID numbers, bank account numbers, and core technical parameters as "core fields," customer mobile phone numbers, home addresses, and order amounts as important fields, and product names and publicly disclosed policy terms as "ordinary fields." At the automatic identification level, the module and the form detection agent form a closed-loop linkage: when the form detection agent finds content that matches the sensitive data pattern in an unlabeled field during scanning, such as 18 consecutive digits resembling an ID number or technical code in a specific format resembling core technical parameters, the engine will trigger an automatic identification algorithm to calculate the sensitivity confidence level of that field. Set the field The sensitivity confidence is based on its content feature vector. Matching degree calculation with the pre-trained sensitive pattern library:

[0035] in, For feature extraction function, This is the weight matrix. For bias terms, The sigmoid function maps the result to the interval [0,1]; when Exceeding the preset threshold At that time, the engine automatically suggests marking the segment as having the corresponding sensitivity level and pushes it to the data administrator for confirmation, forming a closed-loop optimization mechanism of "detection and discovery - intelligent suggestion - manual confirmation"; Let the user role set be... The field level set is {Core, Important, Ordinary} The set of operation permissions is No permission required. View anonymized text, view plaintext, edit. Mapping matrix Define a from arrive Mapping function:

[0036] For example, for the role of a regular employee (Core) = No permission (Important) = View desensitized content. (Ordinary) = View in plain text; for the role of department manager (Core) = De-identified viewing, (Important) = View in plain text (Ordinary) = Plain text view; for the data security administrator role View in plaintext; this mapping matrix supports dynamic adjustment, and security administrators can update it online at any time according to changes in enterprise security policies, and generate version records simultaneously to ensure traceability; The dynamic data masking executor applies corresponding access control or data masking processing to specific data fields based on the output of the aforementioned mapping matrix. When a user initiates a data access request and passes identity authentication and task authentication, the field-level control module intervenes to process the dataset to be returned. For each field in the dataset... and its sensitivity level The module first queries the current user's role. Corresponding operation permissions ;like If permissions are not granted, the field will be removed from the returned result set or set to null; if... To view the de-identified data, the de-identification algorithm library is called to process the original value of the field; if... If viewed in plaintext, the original value is returned. The de-identification algorithm library supports dynamic configuration and combination of various de-identification strategies, including: for fixed-length identifiers such as ID card numbers, a strategy of retaining the last few digits of the prefix and masking the middle digits is adopted, such as 110**********5678; for mobile phone numbers, a strategy of masking the middle four digits is adopted, such as $139****1234; for numerical data such as core technical parameters, range fuzzification can be used, such as converting the precise value 3.14159 into the range 3.14-3.15 or retaining the unit but hiding the specific value; for text-based sensitive words, a replacement strategy can be used, such as replacing the core technical parameter X100 with "[Core Confidential]". The choice of de-identification strategy is not fixed, but can be finely configured according to field level, user role, and business scenario. For example, for the same core field, internal auditors receive a de-identified version that retains more information, while external partners receive a completely fuzzy version.

[0037] In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A dynamic prohibited and safe word detection system, characterized in that, include: Multi-agent scheduling engine module: used to receive data detection tasks, identify the data types and business scenarios in the tasks, and dynamically schedule specialized detection agents to perform concurrent data detection according to the preset "data type - business scenario - agent" mapping relationship; the specialized detection agents include dedicated detection units encapsulated for different data formats and detection logic; The system switching adaptive matching module includes a standardized adaptation interface layer and a rule adaptive unit. The standardized adaptation interface layer is used to interface with different external data source systems and parse their data formats. The rule adaptive unit is used to automatically load and apply the corresponding rule subset from the dynamic rule base according to the type of the currently connected external data source system. The dynamic rule base visual editing module provides a visual operation interface, allowing users to add, delete, modify, and query dynamic rule bases that store prohibited and / or safe words online, and record version information for each rule change; Multi-level authentication module: Integrated with the enterprise identity authentication system, it is used to perform identity authentication, task authentication, and result authentication before, during, and after the data detection task is initiated, so as to realize the linkage between the detection process and the permission verification. Field-level data access control module: It is used to identify fields in the data and mark their sensitivity levels. Based on the preset "user role - field level - operation permission" mapping relationship and combined with the verification results of the multi-level authentication module, it performs field-level access control or de-identification processing on sensitive fields that hit security words.

2. The dynamic prohibited and safe word detection system according to claim 1, characterized in that: In the multi-agent scheduling engine module, the scheduling engine intelligently parses task data, automatically identifies data types and business scenarios by analyzing the format characteristics, metadata information, and business tags of data files; and dynamically matches the optimal combination of detection agents based on a preset multi-dimensional mapping relationship table of "data type - business scenario - agent".

3. The dynamic prohibited and safe word detection system according to claim 1, characterized in that: In the system switching adaptive matching module, the standardized adaptation interface layer adopts a microkernel architecture and has built-in adapters that support multiple mainstream protocols. New data sources can be connected through a visual configuration interface. The rule adaptive unit loads the corresponding rule subset from the dynamic rule base in real time according to the identified data source type and adjusts the working mode of the detection agent in sync.

4. The dynamic prohibited and safe word detection system according to claim 1, characterized in that: The dynamic rule base visual editing module provides a term management function area, as well as user-configurable matching modes and risk levels; It provides a visual logic arrangement canvas, allowing users to create compound rules by dragging and dropping to set logical relationships between terms; each rule change automatically generates a version record.

5. The dynamic prohibited and safe word detection system according to claim 1, characterized in that: The multi-level authentication module adopts a plug-in architecture and is integrated with the enterprise identity authentication system; identity authentication constructs a user identity vector and verifies it based on the access control matrix; Task authentication is determined by comparing the task risk value with the user's permission threshold; result authentication dynamically adjusts the user's final access permissions to data output based on the risk level and sensitive fields in the detection results.

6. The dynamic prohibited and safe word detection system according to claim 1, characterized in that: In the field-level data permission control module, the sensitive field intelligent recognition engine adopts a dual-track strategy that combines manual annotation and automatic recognition. Automatic recognition is based on sensitivity confidence calculation. The field-role permission mapping matrix defines the mapping relationship from user role and field level to operation permission. Based on the mapping results, the dynamic de-identification executor calls the de-identification algorithm library to perform operations such as viewing without permission, viewing with de-identification, or viewing in plaintext on the fields.

7. The dynamic prohibited and safe word detection system according to claim 1, characterized in that: The specialized detection agents include document detection agents, form detection agents, and corpus detection agents, which are encapsulated for different data formats and detection logics. Each agent has built-in adaptive learning capabilities and can iteratively optimize its internal detection model based on feedback data from historical detection results.

8. The dynamic prohibited and safe word detection system according to claim 1, characterized in that: The matching modes include exact matching, fuzzy matching, and semantic matching; the risk levels correspond to different handling strategies, including direct interception, manual review, and log recording.

9. The dynamic prohibited and safe word detection system according to claim 1, characterized in that: In the task authentication process, the task risk value R(task) is calculated based on the task type, the sensitivity level of the target data, and the scope of operation, while the user permission threshold T(u) is dynamically calculated based on identity characteristics and historical behavior. In the result authentication process, if the risk level meets the standard but the sensitive field exceeds the permission range, the field-level data permission control module is triggered to perform desensitization processing.

Images