A sensitive personal information access behavior real-time analysis and early warning system

Abstract

The application discloses a sensitive personal information access behavior real-time analysis and early warning system, relates to the technical field of data security, and first captures all access requests of sensitive personal information, extracts and records a generation behavior context; the behavior context is mapped to a concept relation graph, a consent state is obtained, and a state determination result is obtained according to the consent state; the behavior context and the state determination result are evaluated, and a rule violation early warning event is output; finally, a control action corresponding to the rule violation early warning event is executed, terminal user interaction feedback behaviors are collected, and a comprehensive performance score is calculated; based on the comprehensive performance score, a parameter fine-tuning and update are performed on a warning strategy pool, multi-level control such as a pop-up window, silent interception and silent release is realized, and the application can be applied to personal information protection compliance review, sensitive data access control and other scenes.

Description

Technical Field

[0001] This invention relates to the field of data security technology, and in particular to a real-time analysis and early warning system for access to sensitive personal information. Background Technology

[0002] Real-time monitoring, compliance review, and risk warning of access to sensitive personal information have become core requirements in the field of data security. Traditional access control methods are usually based on role permissions or static rules for one-dimensional comparison, which makes it difficult to identify complex scenarios such as ambiguous access purposes and inconsistencies between purpose and behavior, and is prone to problems such as misjudgment, missed judgment, or frequent disturbance to users.

[0003] Currently, CN122310329A discloses a hierarchical risk detection method and system for large-scale generative model output. This scheme receives candidate outputs and context, extracts multi-dimensional structured feature sets, performs multi-dimensional risk detection using a parallel detector cluster, maps the results to risk levels and normalizes them, and weights and aggregates them to obtain the overall risk representation value and level contribution ratio. Based on this, combined with policy rules, the execution action is determined, and parameters can be dynamically optimized based on manual review feedback. The system includes modules such as input processing, feature extraction, and a parallel detector cluster, realizing a closed loop of detection, decision-making, feedback, and optimization. It achieves unified quantification of multi-dimensional risks, improves detection accuracy, ensures traceability of risk sources, adapts to highly compliant scenarios, and features a modular and configurable architecture that supports flexible deployment in multiple scenarios, effectively solving the pain points of traditional risk control solutions such as high false positive and false negative rates and lack of adaptive capabilities.

[0004] The above-mentioned solution is mainly aimed at risk detection of the output content of large-scale generated models. Its detection objects, feature dimensions, decision logic and feedback mechanism are quite different from those of real-time analysis and early warning scenarios for access to sensitive personal information. Summary of the Invention

[0005] The technical problem solved by this invention is that existing technologies have difficulty in semantically anchoring the purpose declaration in access requests, lack purpose semantic review, and cannot dynamically compare rules for warning of access behavior of sensitive personal information.

[0006] To address the aforementioned technical problems, the present invention provides the following technical solution: a real-time analysis and early warning system for access to sensitive personal information, comprising: The interception and parsing module is used to capture all access requests for sensitive personal information, extract and record the context of the generated behavior; The state determination module is used to map the behavioral context to a concept relationship graph to obtain the agreement state, and to obtain the state determination result based on the agreement state. The early warning triggering module is used to evaluate the behavior context and state determination results through the early warning strategy pool and output a violation early warning event; The response processing module is used to execute control actions corresponding to violation warning events, collect terminal user interaction feedback behavior and calculate comprehensive performance score, and fine-tune and update the parameters of the warning strategy pool based on the comprehensive performance score.

[0007] Preferably, the interception and parsing module includes a real-time capture unit and a behavior recording unit; The real-time capture unit is used to capture all access requests for sensitive personal information; Sensitive personal information data access links are deployed in the bypass mirror to capture inbound access traffic in real time, obtain raw access events, and perform deep analysis on the raw access events to obtain structured request objects. The structured request objects include user ID, requester role, access purpose, access resource identifier, and operation action type. The access purpose includes purpose name and target data type, and the operation action type includes read, write, and delete. The access purpose is subjected to purpose graph anchoring processing. The purpose declaration carried by the access purpose is matched and mapped with the purpose nodes in the pre-built purpose graph to obtain the purpose graph anchoring status. The purpose graph includes a summary relation edge set and a premise relation edge set. The purpose graph anchoring status includes anchoring success, anchoring failure, and anchoring ambiguity. Access requests that fail to anchor are marked as purpose unknown events, a high-level warning is generated, and a rejection command is sent to the underlying access controller to stop the flow. For successfully anchored access requests, query the sensitive database using the access resource identifier to obtain the data subject ID corresponding to the access purpose, and write the data subject ID into the structured request object.

[0008] Preferably, the behavior recording unit is used to obtain the behavior context through a structured request object; Collect environmental information of the original access event, including request timestamp, access frequency, access source and API interface; The structured request object is assembled with the environment information and written into an intermediate state field to generate a behavior context. The intermediate state field includes a request purpose declaration and a purpose graph anchoring state.

[0009] Preferably, the state determination module includes a graph mapping unit, a consensus reasoning unit, and a boundary output unit; The graph mapping unit is used to map behavioral contexts to target relation graphs: Construct a target graph, which includes a target node set E, a general relation edge G, and a premise relation edge F. Extract the data subject ID and the target nodes anchored in the target graph from the behavior context. Query the sensitive database using the data subject ID as an index to obtain a first set and a second set. The sensitive database is used to store the permitted and prohibited targets of each data subject. The first set is the set of data processing targets permitted by the data subject, and the second set is the set of data processing targets prohibited by the data subject. The target node is located in the target graph along with the first set and the second set to obtain a graph mapping result. The graph mapping result includes the position of the target node in the target graph, the position of each node in the first set in the target graph, and the position of each node in the second set in the target graph.

[0010] Preferably, the consent reasoning unit is used to calculate the graph mapping result based on graph reachability analysis to obtain the consent state; Using each destination node in the first set as the source node, the destination graph is expanded along the directed edges of the general relation edge set and the premise relation edge set to obtain the set of allowed reachable destinations. Using each destination node in the second set as a blocking node, reachability expansion is performed in the destination graph along the reverse directed edges of the general relation edge set and the premise relation edge set, respectively, to obtain the set of prohibited reachable destinations; The prohibited destination set is removed from the allowed destination set to obtain the agreed destination set; Determine whether the target node in the behavioral context belongs to the set of agreed targets. If it does, the agreed state is "agree"; otherwise, the agreed state is "reject".

[0011] Preferably, the boundary output unit is used to calculate the legal boundary based on the consent status and the requester role and output the status determination result; The role permission database is queried, and the set of accessible destinations is obtained based on the hierarchical relationship between the requester role and the superior role. The intersection operation of the set of agreed destinations and the set of accessible destinations is performed to obtain the legal access boundary. Based on the consent status and the current legal access boundaries, an access decision is made to obtain an access result, which includes permission or denial. The processing logic for the access decision is as follows: If the consent status is "agree" and the destination node is within the legal access boundary, access is allowed; if the consent status is "reject" or the destination node is not within the legal access boundary, access is denied. The reasons for rejection are marked according to the access results, including user non-consent, insufficient role permissions, and inconsistency between consent and permission scope. The access result, legal access boundary, and denial reason are encapsulated into a status determination result.

[0012] Preferably, the early warning triggering module includes a strategy encoding unit, a risk determination unit, and an action mapping unit; The strategy encoding unit is used to initialize the early warning strategy pool, which includes several candidate strategy configuration instances. The behavioral context and state determination result are extracted as early warning input. Each candidate strategy configuration instance in the early warning strategy pool is vectorized and encoded to obtain a strategy vector. The strategy vector includes a risk trigger threshold, a cognitive load threshold, a response action mapping matrix, and an alarm feature vector. The early warning strategy pool is divided into a first strategy cluster and a second strategy cluster according to the risk trigger threshold and the cognitive load threshold.

[0013] Preferably, the risk determination unit is used to calculate the quantitative score of the current request and compare it with the strategy vector in the early warning strategy pool to make a determination; Calculate the objective risk score for this request based on the reasons for failure in the status determination result; Based on the environmental information in the behavioral context, the access frequency and historical interception count within the time window are statistically analyzed to calculate the cognitive load score currently imposed on the user. The strategy vector with the highest overall evaluation is selected from the early warning strategy pool as the optimal strategy vector. The risk trigger threshold and cognitive load threshold are extracted from the optimal strategy vector and compared with the objective risk score and cognitive load score respectively to obtain the trigger instruction. If the objective risk score Risk trigger threshold, and the cognitive load score Cognitive load threshold, generate pop-up trigger command; If the objective risk score Risk trigger threshold, and the cognitive load score Cognitive load threshold, generate silent interception command; If the objective risk score Risk trigger threshold, generate silent release command.

[0014] Preferably, the action mapping unit is used to generate the final warning event based on the trigger command; Receive the trigger command and extract the response action mapping matrix and alarm feature vector from the optimal strategy vector; By comparing the response action mapping matrix, the triggering command is converted into a low-level control action, which includes permission, proxy degradation, and physical blocking; If the triggering command is a pop-up triggering command, the corresponding pop-up UI display template is matched according to the alarm feature vector; Save the aforementioned control actions, pop-up UI display templates, behavioral contexts, and objective risk scores as violation warning events.

[0015] Preferably, the response processing module includes: Upon receiving the violation warning event, the system issues control actions to the underlying access controller. When the control action has an explicit pop-up window, the system collects the interactive feedback behavior of the end user, including decision response latency and authorization regret reset behavior. The objective risk score of this action is extracted as the security protection benefit. The disturbance cost and the interactive feedback behavior are obtained, and a weighted calculation is performed based on a multi-objective balance mechanism to obtain a comprehensive effectiveness score. This score is then written back to the early warning strategy pool, and local parameters are fine-tuned to complete the parameter update. The beneficial effects of this invention are as follows: Sensitive personal information access requests are captured via bypass mirroring without intruding on the original business system. Deep analysis of the original access events generates structured request objects, ensuring that the high concurrency throughput of the original business system is not affected by the performance of security components. A destination graph anchoring mechanism is introduced at the traffic entry point, performing whitelist verification and semantic anchoring on the access destination. Access requests that fail to anchor are marked as having an unclear destination and directly rejected, thus blocking excessive collection behavior with malicious or ambiguous purposes from the source. By constructing a destination graph containing general relationship edges and premise relationship edges, the behavioral context is mapped to the graph, and graph reachability analysis is performed, enabling forward expansion of allowed destinations and blocking reverse expansion of allowed destinations. By tracing the source, the system deduces the user's consent status for associated or implicit purposes, solving the problem that traditional string lookup methods cannot handle conflicts between associated purposes and consent, and reducing frequent pop-up authorizations. It performs an intersection operation between the set of consented purposes and the set of roles-accessible purposes to obtain the legal access boundary, ensuring that data access simultaneously satisfies both user authorization and business role permissions, preventing legitimate applications from abusing data beyond their scope and internal unauthorized calls. Employing an early warning strategy pool and a vectorized clustering mechanism, the system digitizes early warning strategies into strategy vectors, comparing them with objective risk scores and cognitive load scores. This allows for dynamic selection of different control actions, such as pop-ups, silent blocking, or silent access, based on the current risk level and the degree of user disruption. Attached Figure Description

[0016] Figure 1 A basic flowchart of a real-time analysis and early warning system for accessing sensitive personal information provided in one embodiment of the present invention; Figure 2 This is a schematic diagram of the processing flow for the target relationship graph. Detailed Implementation

[0017] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0018] Example, refer to Figures 1-2 This provides a real-time analysis and early warning system for access to sensitive personal information, including: The interception and parsing module is used to capture all access requests for sensitive personal information, extract and record the context of the generated behavior; The state determination module is used to map the behavioral context to a concept relationship graph to obtain the agreement state, and to obtain the state determination result based on the agreement state. The early warning triggering module is used to evaluate the behavior context and state determination results through the early warning strategy pool and output a violation early warning event; The response processing module is used to execute control actions corresponding to violation warning events, collect terminal user interaction feedback behavior and calculate comprehensive performance score, and fine-tune and update the parameters of the warning strategy pool based on the comprehensive performance score.

[0019] This embodiment primarily demonstrates how to transform a monotonous, static data access check into a dynamic assessment of privacy protection. When an application attempts to obtain a user's sensitive personal information, the interception and parsing module captures the request in real time at the underlying network stack or API gateway, extracting basic attributes such as subject ID, role, and declared purpose. Simultaneously, it collects environmental parameters such as the current timestamp, the number of recent pop-up notifications on the device, and the frequency of interface calls, uniformly encapsulating these parameters to generate a behavioral context. After receiving the behavioral context, the state determination module abandons the traditional one-dimensional comparison method and substitutes it into a conceptual relationship graph. This graph contains generalizations and preconditions between purpose nodes. Combining the user's initial allowed and prohibited sets in the privacy database, graph reachability analysis is used to deduce the user's consent status for the current unknown or related purpose. This is then intersected with the role permission database to obtain the state determination result. For example, if it is deduced that the user has not even consented to basic location services, the role is deemed to have exceeded its authority, resulting in a rejection. After obtaining the rejection result, the warning triggering module calculates the objective risk score of this request based on the reason for the violation and, combined with the behavioral context, calculates the cognitive load score currently faced by the user. Subsequently, the system matches the highest-rated optimal strategy from the built-in warning strategy pool. If the assessment indicates a high risk and the user is in a period of high disturbance, the optimal strategy will decide not to pop up a warning message to disturb the user, but instead output a silent blocking command as a violation warning event. The response processing module receives the warning event and sends network blocking or data degradation commands to the underlying controller. Simultaneously, if the strategy triggers an explicit pop-up, the system implicitly collects user interaction feedback, weights the security benefits with the disturbance costs and user regret rate, calculates the overall performance score of the strategy, and writes it back to the warning strategy pool. This allows for fine-tuning and iterative evolution of the strategy parameters, adaptively evolving into a security strategy that best suits the current user habits, strictly prevents privacy leaks, and reduces disturbance, thus achieving a balance between security and usability.

[0020] The interception and parsing module includes a real-time capture unit and a behavior recording unit; The real-time capture unit is used to capture all access requests for sensitive personal information; Sensitive personal information data access links are deployed in the bypass mirror to capture inbound access traffic in real time, obtain raw access events, and perform deep analysis on the raw access events to obtain structured request objects. The structured request objects include user ID, requester role, access purpose, access resource identifier, and operation action type. The access purpose includes purpose name and target data type, and the operation action type includes read, write, and delete. The access purpose is subjected to purpose graph anchoring processing. The purpose declaration carried by the access purpose is matched and mapped with the purpose nodes in the pre-built purpose graph to obtain the purpose graph anchoring status. The purpose graph includes a summary relation edge set and a premise relation edge set. The purpose graph anchoring status includes anchoring success, anchoring failure, and anchoring ambiguity. Access requests that fail to anchor are marked as purpose unknown events, a high-level warning is generated, and a rejection command is sent to the underlying access controller to stop the flow. For successfully anchored access requests, query the sensitive database using the access resource identifier to obtain the data subject ID corresponding to the access purpose, and write the data subject ID into the structured request object.

[0021] In this embodiment, bypass traffic mirroring technology is used to copy and parse real-time network data packets. Through regular expression matching or protocol decoding, the underlying messy TCP / HTTP messages are transformed into standardized structured request object tuples, ensuring that the high concurrency throughput of the original business system is not affected by the performance of security components. Developers typically declare their purpose using natural language strings when requesting data. The system needs to perform feature matching of this string with a pre-built purpose graph in the backend. This purpose graph anchoring process serves as the core semantic firewall in this embodiment. In reality, many malicious applications excessively collect privacy by fabricating ambiguous terms, for example, to optimize user experience or for security risk control. The essence of anchoring is to perform purpose whitelist verification, forcing the requester to provide a specific and registered access purpose, eliminating semantic ambiguity. Then, by extracting the access resource identifier, the unique identifier of the user to which the data belongs is mapped back to the underlying database.

[0022] This embodiment uses an app requesting to read mobile phone sensor data as an example to illustrate the processing chain in three different scenarios: The first scenario involves a legitimate request for successful anchoring. The app initiates a request to access the location interface (resource identifier: api / location / gps), with the operation type being read and the declared purpose being motion trajectory recording. After real-time capture unit parsing, the corresponding destination node is accurately searched in the pre-built destination graph. This node is a prerequisite node for the basic core service in the graph, at which point the system determines that the destination graph anchoring status is successful. Subsequently, the system uses the resource identifier / api / location / gps to find that the current device owner is User_8848. Finally, User_8848 is written into a structured object, packaged, and sent to subsequent consent status deduction. The second scenario involves a malicious evasion request due to anchoring failure. This app also requests to read GPS location data, but the declared target string in the code is: "Improve the accuracy of the underlying big data algorithm." The real-time capture unit traverses and matches the target graph, finding that this target is not registered in the graph and belongs to a term unknown to the system. In this case, the system determines the target graph anchoring status as anchoring failure, directly marks it as an event with an unknown target, generates a high-level warning, and immediately sends a connection reset command to the underlying access controller, cutting off the data transmission, stopping the flow, and no longer wasting computing power to check the user's privacy preferences. The third scenario involves a request for an edge-grayscale image with ambiguous anchoring. The app requests to read album data, declaring its purpose solely as an image service. The real-time capture unit detects in the graph that the image service might correspond to avatar uploads (a valid node in the graph) or image ad feature extraction (a valid node in the graph), making it impossible to uniquely determine its true intent. In this case, the state is determined to be ambiguous anchoring, and this state will be written into the intermediate state field and passed to subsequent modules.

[0023] Traditional data leakage prevention or access control systems typically only offer role-based blocking, which fails to prevent legitimate apps from abusing data beyond their scope. This embodiment innovatively introduces a purpose graph anchoring mechanism at the traffic entry point, placing the compliance review of the purpose at the forefront of network communication. This not only directly blocks most illegal collection activities but also saves computational resources for the subsequent inference engine. It also forces business parties to ensure that their data access actions are absolutely semantically consistent with their declared purposes, complying with the compliance requirements of the Personal Information Protection Law that the processing of personal information must have a clear and reasonable purpose.

[0024] The behavior recording unit is used to obtain the behavior context through a structured request object; Collect environmental information of the original access event, including request timestamp, access frequency, access source and API interface; The structured request object is assembled with the environment information and written into an intermediate state field to generate a behavior context. The intermediate state field includes a request purpose declaration and a purpose graph anchoring state.

[0025] In this embodiment, the behavior recording unit needs to extract additional environmental information of the request from the original network data packet and underlying counter, including the precise timestamp of the request, the frequency of interface calls within the sliding time window, the device fingerprint of the request initiating the request, the IP address, and the API interface called; the structured request object is then structurally concatenated with the extracted environmental information; at the same time, the request purpose declaration and purpose graph anchoring status of the developer's original request are used as intermediate state fields and pushed into the data packet to generate the final behavior context.

[0026] The state determination module includes a graph mapping unit, a consensus reasoning unit, and a boundary output unit; The graph mapping unit is used to map behavioral contexts to target relation graphs: Construct a target graph, which includes a target node set E, a general relation edge G, and a premise relation edge F. Extract the data subject ID and the target nodes anchored in the target graph from the behavior context. Query the sensitive database using the data subject ID as an index to obtain a first set and a second set. The sensitive database is used to store the permitted and prohibited targets of each data subject. The first set is the set of data processing targets permitted by the data subject, and the second set is the set of data processing targets prohibited by the data subject. The target node is located in the target graph along with the first set and the second set to obtain a graph mapping result. The graph mapping result includes the position of the target node in the target graph, the position of each node in the first set in the target graph, and the position of each node in the second set in the target graph.

[0027] In this embodiment, a destination graph containing general relation edges G and premise relation edges F is constructed to digitize the complex business data flow dependency logic in reality into a directed acyclic graph (DAG). The data subject ID in the behavior context is extracted and the first set and the second set are obtained by querying the sensitive database. The first set represents allowed processing and the second set represents prohibited processing. Finally, the location is located and the current request point and the user's intention boundary are projected onto the topology sandbox.

[0028] This embodiment uses abstracted nodes and topological relationships to illustrate the specific process of graph mapping, referring to... Figure 2 Pre-instantiate a generic target relationship graph in memory. Define the target node set Define relation edges This includes a general relation edge G and a prerequisite relation edge F. The general relation edge indicates that completing node 1 requires the completion of node 2, but not only node 2. The prerequisite relation edge indicates that executing node 2 requires the completion of node 3 first. When the action context is received, the currently anchored target request node is parsed as follows: Simultaneously, the data subject identifier is extracted, and a concurrent database query is performed using the data subject identifier as the primary key to obtain the historical permission status of the data subject, resulting in two sets, including the first set. This indicates that the data subject had explicitly authorized destination node 3; the second set This indicates that the data subject explicitly rejected destination node 4, thus rejecting the target request node. First set Second set In the target relationship map The topological coordinates are assigned and labeled to generate a structured map mapping result matrix. An example of the mapping and positioning matrix data is shown in Table 1 below: Table 1 - Mapping and Positioning Matrix Data: ; The table above shows a structured mapping matrix generated and persisted in memory by the graph mapping unit. It transforms discrete user configurations into state feature values ​​of nodes in a graph structure, serving as standard input and output to downstream modules. A 1 indicates a hit, and a 0 indicates a miss. In this embodiment, the data subject does not directly access the currently requested... Authorization has been granted; there are no [illegible characters] in the first set. If the traditional string lookup method is used, the system will directly intercept and report an error due to dictionary matching failure, requiring the terminal to re-authorize via a pop-up window. However, through the graph projection and matrix calibration in this embodiment, It was precisely located within the topology, and the system identified it as being in the logical downstream position. The system has an allowed identifier; traditional access control architectures lack contextual purpose association, which means that a long list of permissions must be displayed to the user when compliance is required. The graph mapping mechanism introduced in this embodiment lays the foundation for subsequent implicit authorization inference; by mapping allowed purposes to positively connected source points on the graph and prohibited purposes to absolute blocking breakpoints on the topology graph, the privacy compliance review process of the system becomes transparent and rigorous, improving the reliability of industrial deployments.

[0029] The consent reasoning unit is used to calculate the graph mapping result based on graph reachability analysis to obtain the consent state; Using each destination node in the first set as the source node, the destination graph is expanded along the directed edges of the general relation edge set and the premise relation edge set to obtain the set of allowed reachable destinations. Specifically, each destination node in the first set is a source node. In the destination graph, a breadth-first traversal is performed along the positive direction of the directed edges of the general relation edge set and the premise relation edge set to expand the graph and add all reachable nodes to the set of allowed reachable destinations. In this context, positive extension along the generalization relation edge indicates that the user's agreement to a certain purpose implicitly agrees to the sub-purposes it encompasses, while positive extension along the premise relation edge indicates that the user's agreement to a certain purpose implicitly agrees to the prerequisite purpose upon which that purpose depends.

[0030] Using each destination node in the second set as a blocking node, reachability expansion is performed in the destination graph along the reverse directed edges of the general relation edge set and the premise relation edge set, respectively, to obtain the set of prohibited reachable destinations; The prohibited destination set is removed from the allowed destination set to obtain the agreed destination set; Determine whether the target node in the behavioral context belongs to the set of agreed targets. If it does, the agreed state is "agree"; otherwise, the agreed state is "reject".

[0031] In this embodiment, the first set is used as the source node and the forward expansion along the directed edge represents consent to derivation, that is, it is inferred that after a user agrees to a certain basic operation, it implicitly agrees to its naturally extended downstream links; the second set is used as the blocking node and the reverse expansion along the reverse edge represents rejection of propagation, that is, it is inferred that after a user rejects a certain underlying prerequisite purpose, all upper-level data processing behaviors that depend on that purpose will be prohibited.

[0032] The final set removal operation resolves the intent conflict problem in complex authorization environments; this embodiment illustrates the specific links of reachability extension and state computation through the topological relationship of the graph mapping matrix; Extract the nodes marked as the source point of the first set from the mapping results. ,by Starting from the topological out-degree directed edges, a graph traversal search is performed. According to the aforementioned matrix relationship, there exists a directed edge... Based on the forward expansion rule, it is reasonable to deduce that the user agrees. At the same time, it implicitly allows for its natural expansion. After the search is completed, the set of allowed reachable destinations is obtained. ; Extract the nodes marked as the source point of the second set from the mapping results. .by To block the starting point, a reverse traversal is performed along the relation edges, that is, searching back along the in-degree edges. According to the aforementioned matrix relationship, the reverse tracing path is as follows: The system uses reverse reachability extension to accurately trace back to All belong to the ultimate goal The preceding dependency steps blacklist all nodes on this link, and after the search is complete, the set of prohibited reachable destinations is obtained. At this time, node and Simultaneously appearing in both the allowed and prohibited reachable sets, a logical conflict arises: a prerequisite service is allowed, but its final result is rejected. The system performs a set difference operation (allowing set removes prohibited set), prioritizing the prohibited logic and forcibly eliminating the conflicting node. The calculated set of agreed-upon destinations is empty. Finally, the target request node in the current behavior context is compared. ,Discover (Empty set), and finally determine the consent status of this request as rejection.

[0033] The boundary output unit is used to calculate the legal boundary based on the consent status and the requester role, and output the status determination result. The role permission database is queried, and the set of accessible destinations is obtained based on the hierarchical relationship between the requester role and the superior role. The intersection operation of the set of agreed destinations and the set of accessible destinations is performed to obtain the legal access boundary. Based on the consent status and the current legal access boundaries, an access decision is made to obtain an access result, which includes permission or denial. The processing logic for the access decision is as follows: If the consent status is "agree" and the destination node is within the legal access boundary, access is allowed; if the consent status is "reject" or the destination node is not within the legal access boundary, access is denied. The reasons for rejection are marked according to the access results, including user non-consent, insufficient role permissions, and inconsistency between consent and permission scope. The access result, legal access boundary, and denial reason are encapsulated into a status determination result.

[0034] In this embodiment, in a complex real-world environment, data security not only faces the challenge of external applications demanding access but also the risk of unauthorized access by various positions within the enterprise. Simply relying on the set of agreed-upon purposes can only constrain whether the flow of data conforms to the user's subjective intentions. Introducing the set of accessible purposes from the perspective of the enterprise's internal roles and taking the intersection of these sets aims to find the greatest common denominator between user privacy preferences and enterprise internal control compliance standards, ensuring that any data access action must simultaneously hold both user authorization and business position authorization. This embodiment illustrates the specific logical chain of boundary calculation and state determination through different role request scenarios: Target request node The system calculates the set of agreed purposes as follows: (Empty set), the agreement status is denied. At this point, assuming the system role initiating the request is the Advanced Data Analysis Engine, querying the role permission database reveals that this role has extremely high business permissions, and its accessible destination set includes... The result of performing the intersection operation on the set of consented purposes and the set of accessible purposes indicates that the legal access boundary is an empty set. Although the role has the highest authority, because the consent status is denied, the system outputs denial according to the judgment logic and marks the reason for denial as the user has not consented. This situation proves that the user's privacy intention has an absolute veto power over the system's internal permissions. Suppose that in a separate access request, the data subject explicitly consents to the purpose. The target node was calculated. The consent status is "agree," and the current set of consent purposes is... At this point, the role initiating the request is a junior outsourced customer service representative. A look at the role hierarchy reveals that this role is at a low level, and its accessible target set is limited to... For example, viewing only basic de-identified logs; performing an intersection operation on the agreed-upon destination set and the accessible destination set yields an empty set, triggering the judgment logic: although the agreement status is "agree," the target node... The access is not within the legal boundaries, so the system outputs "denied," indicating the reason for the denial as insufficient role permissions. Assume the target node is The calculated consent status is "agree," and the set of consent purposes is: The role initiating the request is a core business microservice, and its accessible destination set is... , Performing an intersection operation on the set of shared destinations and the set of accessible destinations yields... This generates the current legal access boundaries; the judgment logic is triggered: the agreement status is "agree," and the target node... Existing at the legal access boundary In the end, the output will be allowed. If neither of the two sets contains the target node, the reason will be marked as inconsistent between the consent and permission scope.

[0035] Finally, the access results, legal access boundaries, and quantified reasons for rejection are packaged together and the status determination results are encapsulated.

[0036] The early warning triggering module includes a strategy encoding unit, a risk determination unit, and an action mapping unit; The strategy encoding unit is used to initialize the early warning strategy pool, which includes several candidate strategy configuration instances. The behavioral context and state determination result are extracted as early warning input. Each candidate strategy configuration instance in the early warning strategy pool is vectorized and encoded to obtain a strategy vector. The strategy vector includes a risk trigger threshold, a cognitive load threshold, a response action mapping matrix, and an alarm feature vector. The early warning strategy pool is divided into a first strategy cluster and a second strategy cluster according to the risk trigger threshold and the cognitive load threshold.

[0037] In this embodiment, the received behavior context and state determination result serve as the underlying input to the early warning engine. Simultaneously, in the system memory space, N candidate policy configuration instances (e.g., N=50) are initialized based on baseline rules to construct an early warning policy pool; each policy instance is digitized into a policy vector. , with strategy instance For example, the specific coding parameters are explained as follows: The risk trigger threshold... Set to 70, this strategy will only be activated when the assessed objective violation risk score for this request reaches 70 or above; cognitive load threshold. Set to 60, when the user's current cognitive load (e.g., recently being frequently disturbed by pop-ups) exceeds 60 points, this strategy will abandon explicit pop-ups and force them to be processed in the background; Response Action Mapping Matrix The specific machine actions corresponding to different risk ranges and alarm feature vectors are defined. It defines the UI feature structure of the terminal pop-up, such as the vector value: [red warning indicator, 10-second forced wait countdown, simplified disclaimer]; Iterate through all encoded policy vectors in the early warning policy pool, based on... The two core thresholds are spatially clustered to form a first strategy cluster and a second strategy cluster. The first strategy cluster includes vectors with high-risk trigger thresholds and low cognitive load thresholds. This type of strategy tends to intercept only high risks, and immediately stops pop-ups if the user feels even slightly disturbed. The second strategy cluster includes vectors with low-risk trigger thresholds and high cognitive load thresholds. This type of strategy tends to intercept even minor risks, and even if the user feels annoyed by frequent disturbances, it still forces an explicit pop-up warning. This embodiment innovatively transforms a single warning trigger into a parameterized security game sandbox by introducing a warning strategy pool and a vectorized clustering mechanism. This not only makes complex security rules tunable, but the differentiation of strategy clusters also enables the system to handle complex human-computer interaction boundary situations.

[0038] The risk assessment unit is used to calculate the quantitative score of the current request and compare it with the strategy vector in the early warning strategy pool to make a judgment. Calculate the objective risk score for this request based on the reasons for failure in the status determination result; Based on the environmental information in the behavioral context, the access frequency and historical interception count within the time window are statistically analyzed to calculate the cognitive load score currently imposed on the user. The strategy vector with the highest overall evaluation is selected from the early warning strategy pool as the optimal strategy vector. The risk trigger threshold and cognitive load threshold are extracted from the optimal strategy vector and compared with the objective risk score and cognitive load score respectively to obtain the trigger instruction. If the objective risk score Risk trigger threshold, and the cognitive load score Cognitive load threshold, generate pop-up trigger command; If the objective risk score Risk trigger threshold, and the cognitive load score Cognitive load threshold, generate silent interception command; If the objective risk score Risk trigger threshold, generate silent release command.

[0039] In this embodiment, the objective risk branch is calculated using topological semantic deviation entropy. Based on the result of the preceding graph mapping, the information entropy gain of the request destination node relative to the Yonghe legal boundary is calculated. In the destination graph, the shortest directed path hop count from the target unauthorized node to the user's legal access boundary set is calculated as the deviation depth. According to the national data classification and grading standards, data types are mapped to basic sensitivity, for example, general information is 1 and sensitive personal information is 3. The objective risk score is then calculated using the deviation entropy formula. : ; in, For node sensitivity, This is the network topology penalty amplification factor, which is set to 2 in this embodiment. To mitigate the depth of deviation, the smoothness of the logarithmic function is used to ensure that the objective risk score rises rapidly in the early stages of deviation and tends to converge when the deviation is extremely large. In this embodiment, node sensitivity is based on a mapping dictionary table according to personal information security specifications. After the interception and parsing module extracts the target data type, it obtains its legally defined sensitivity level by looking up the table and directly maps it to the calculation base: if the extracted data is ordinary application configuration information (corresponding to Level 1 of the national standard), then the mapping... =10, if the extracted data is ordinary personal information, such as a user's nickname (corresponding to Level 2 of the national standard), then the mapping is... =20, if the extracted data is sensitive personal information, such as whereabouts (corresponding to Level 3 of the national standard), then mapping =30, if the extracted data contains extremely sensitive biometric features, such as facial data (corresponding to Level 4 of the national standard), then the mapping... =40; The cognitive load score is calculated using a power-law decaying memory kernel. The calculation expression is: ; in, This is the basic environmental load, used to represent the default baseline psychological stress level when a user is undisturbed. This represents the total number of explicit alerts displayed to the user within a set time period (30 minutes in this example), where i is the explicit alert number. The initial stimulus amount for a single pop-up window. Let i be the time span between the occurrence of the i-th disturbance event and the current time. This is the time scaling factor. The power-law decay exponent ranges from 0 to 1; in this embodiment, it is taken as... =0.5, when When the value ranges from 0 to 1, the decay of this function means that recent high-frequency pop-ups will cause a sharp increase in load, while the long-standing history of pop-ups will not be completely zeroed out, but will retain the annoying background noise, simulating the fatigue memory trailing phenomenon in humans; the optimal strategy vector that currently occupies the dominant advantage in the early warning strategy pool is extracted. Assuming that the risk trigger threshold contained in this vector is 60 and the cognitive load threshold is 50, the system compares and judges the real-time score calculated by the above formula and outputs the corresponding trigger command.

[0040] The action mapping unit is used to generate the final warning event based on the trigger command; Receive the trigger command and extract the response action mapping matrix and alarm feature vector from the optimal strategy vector; By comparing the response action mapping matrix, the triggering command is converted into a low-level control action, which includes permission, proxy degradation, and physical blocking; If the triggering command is a pop-up triggering command, the corresponding pop-up UI display template is matched according to the alarm feature vector; Save the aforementioned control actions, pop-up UI display templates, behavioral contexts, and objective risk scores as violation warning events.

[0041] In this embodiment, after receiving the trigger command, the response action mapping matrix and alarm feature vector are parsed from the current optimal strategy vector. The response action mapping matrix is ​​used to define the hash matrix of the relationship between different objective risk score ranges and corresponding actions. In this embodiment, the matrix is ​​configured as follows: [0,50) -> Allow; [50,80) -> Proxy downgrade, such as latitude and longitude desensitization processing; [80,+∞) -> Physical blocking; The alarm feature vector defines the visual and interactive intensity of the UI interface. When the objective risk score Z=84.2 and the cognitive load is extremely high, triggering a silent interception command, the response action mapping matrix is ​​checked and falls within the range [80, +∞). The trigger command is then translated into a physical blocking action. Because it is a silent command, UI template generation is directly ignored. Assuming another request has an objective risk score of Z=65, and the user's current cognitive load is low, the risk assessment unit issues a pop-up trigger command. It finds that Z=65 falls within the [50, 80) range, and the corresponding action is agent downgrade. At the same time, it reads the alarm feature vector and renders a pop-up UI display template with a red warning, a 5-second countdown before clicking "agree," and a stern warning message.

[0042] The response processing module includes: Upon receiving the violation warning event, the system issues control actions to the underlying access controller. When the control action has an explicit pop-up window, the system collects the interactive feedback behavior of the end user, including decision response latency and authorization regret reset behavior. The objective risk score of this action is extracted as the security protection benefit. The disturbance cost and the interactive feedback behavior are obtained. A weighted calculation is performed based on a multi-objective balance mechanism to obtain a comprehensive performance score, which is then written back to the early warning strategy pool. Local parameters are then fine-tuned to complete the parameter update.

[0043] In this embodiment, after receiving a violation warning event, the system parses the data payload. If the control action carried in the event is proxy downgrading and does not contain a pop-up UI template, the system sends an instruction to the underlying API interception proxy layer to silently perform data desensitization interception. If the event contains a UI display template related to an explicit pop-up, assuming that the interface pops up a warning confirmation box with a 5-second countdown to the user, the system activates the tracking script while rendering the interface, collects key interaction data of the end user, and records the number of milliseconds from the end of the countdown and the button becoming clickable to the user pressing agree or refuse as the decision response latency. If the decision response latency is extremely short (e.g., less than 300ms), it indicates that the user has developed muscle memory for blindly authorizing. The system also records whether the user actively enters the system settings page to revoke the newly granted permission within a very short preset time window (e.g., 10 minutes) after clicking authorization in the pop-up. If revoked, the authorization regret reset behavior is marked as 1 (regret occurred); otherwise, it is marked as 0. The overall energy efficiency score was then calculated using an asymmetric utility assessment formula. : ; in, As an objective risk score, The basic disturbance cost constant has a value range of [0.1, 0.5]. To delay decision response, Reset the authorized regret behavior (1 if it occurs, 0 if it does not occur). This is a higher-order penalty coefficient, with a value range of [3, 5]. This is a penalty adjustment constant, with a value range of [0.8, 1.5]. The time-delay shaping factor is [0.001, 0.005]. Its dimension is the reciprocal of time, used to make the time delay term dimensionless. This is a constant for the penalty of blind authorization, with a value ranging from [0.5, 1.5], to ensure that even if the user does not regret or retract their authorization, =0, even with extremely short decision-making response delays, will still increase the denominator and thus reduce the score, reflecting the risk of blind delegation; when extremely short and When it is 1, Approaching the maximum value of 1, thus inducing an exponential increase in the denominator, thereby severely punishing the strategy of blindly authorizing high incidence rates; The calculated comprehensive performance score is written back to the historical records of the corresponding strategy vector in the early warning strategy pool. The backend drives the system's autonomous evolution by comparing the average scores of the first and second strategy clusters. For example, if an aggressive strategy is found to have triggered high-frequency revocations, leading to an explosion in the exponential denominator and a sharp drop in score, the system will trigger a local parameter fine-tuning operator to automatically increase the risk trigger threshold of the strategy, driving it to reduce the frequency of pop-up windows in the future. Finally, parameter configuration is optimized through multi-dimensional feedback.

[0044] The systems and technologies described herein can be implemented in computing systems that include back-end components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include front-end components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and technologies described herein), or any combination of such back-end, middleware, or front-end components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0045] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact via communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other. Servers can be cloud servers, servers in distributed systems, or servers incorporating blockchain technology.

[0046] It should be understood that the various forms of processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this invention can be achieved, and this is not limited herein.

[0047] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the principles of this invention should be included within the scope of protection of this invention.

Claims

1. A real-time analysis and early warning system for access to sensitive personal information, characterized in that, include: The interception and parsing module is used to capture all access requests for sensitive personal information, extract and record the context of the generated behavior; The state determination module is used to map the behavioral context to a concept relationship graph to obtain the agreement state, and to obtain the state determination result based on the agreement state. The early warning triggering module is used to evaluate the behavior context and state determination results through the early warning strategy pool and output a violation early warning event; The response processing module is used to execute control actions corresponding to violation warning events, collect terminal user interaction feedback behavior and calculate comprehensive performance score, and fine-tune and update the parameters of the warning strategy pool based on the comprehensive performance score.

2. The real-time analysis and early warning system for sensitive personal information access behavior as described in claim 1, characterized in that, The interception and parsing module includes a real-time capture unit and a behavior recording unit; The real-time capture unit is used to capture all access requests for sensitive personal information; Sensitive personal information data access links are deployed in the bypass mirror to capture inbound access traffic in real time, obtain raw access events, and perform deep analysis on the raw access events to obtain structured request objects. The structured request objects include user ID, requester role, access purpose, access resource identifier, and operation action type. The access purpose includes purpose name and target data type, and the operation action type includes read, write, and delete. The access purpose is subjected to purpose graph anchoring processing. The purpose declaration carried by the access purpose is matched and mapped with the purpose nodes in the pre-built purpose graph to obtain the purpose graph anchoring status. The purpose graph includes a summary relation edge set and a premise relation edge set. The purpose graph anchoring status includes anchoring success, anchoring failure, and anchoring ambiguity. Access requests that fail to anchor are marked as purpose unknown events, a high-level warning is generated, and a rejection command is sent to the underlying access controller to stop the flow. For successfully anchored access requests, query the sensitive database using the access resource identifier to obtain the data subject ID corresponding to the access purpose, and write the data subject ID into the structured request object.

3. The real-time analysis and early warning system for sensitive personal information access behavior as described in claim 2, characterized in that, The behavior recording unit is used to obtain the behavior context through a structured request object; Collect environmental information of the original access event, including request timestamp, access frequency, access source and API interface; The structured request object is assembled with the environment information and written into an intermediate state field to generate a behavior context. The intermediate state field includes a request purpose declaration and a purpose graph anchoring state.

4. The real-time analysis and early warning system for sensitive personal information access behavior as described in claim 3, characterized in that, The state determination module includes a graph mapping unit, a consensus reasoning unit, and a boundary output unit; The graph mapping unit is used to map behavioral contexts to target relation graphs: Construct a target graph, which includes a target node set E, a general relation edge G, and a premise relation edge F. Extract the data subject ID and the target nodes anchored in the target graph from the behavior context. Query the sensitive database using the data subject ID as an index to obtain a first set and a second set. The sensitive database is used to store the permitted and prohibited targets of each data subject. The first set is the set of data processing targets permitted by the data subject, and the second set is the set of data processing targets prohibited by the data subject. The target node is located in the target graph along with the first set and the second set to obtain a graph mapping result. The graph mapping result includes the position of the target node in the target graph, the position of each node in the first set in the target graph, and the position of each node in the second set in the target graph.

5. The real-time analysis and early warning system for sensitive personal information access behavior as described in claim 4, characterized in that, The consent reasoning unit is used to calculate the graph mapping result based on graph reachability analysis to obtain the consent state; Using each destination node in the first set as the source node, the destination graph is expanded along the directed edges of the general relation edge set and the premise relation edge set to obtain the set of allowed reachable destinations. Using each destination node in the second set as a blocking node, reachability expansion is performed in the destination graph along the reverse directed edges of the general relation edge set and the premise relation edge set, respectively, to obtain the set of prohibited reachable destinations; The prohibited destination set is removed from the allowed destination set to obtain the agreed destination set; Determine whether the target node in the behavioral context belongs to the set of agreed targets. If it does, the agreed state is "agree"; otherwise, the agreed state is "reject".

6. The real-time analysis and early warning system for sensitive personal information access behavior as described in claim 5, characterized in that, The boundary output unit is used to calculate the legal boundary based on the consent status and the requester role, and output the status determination result. The role permission database is queried, and the set of accessible destinations is obtained based on the hierarchical relationship between the requester role and the superior role. The intersection operation of the set of agreed destinations and the set of accessible destinations is performed to obtain the legal access boundary. Based on the consent status and the current legal access boundaries, an access decision is made to obtain an access result, which includes permission or denial. The processing logic for the access decision is as follows: If the consent status is "agree" and the destination node is within the legal access boundary, access is allowed; if the consent status is "reject" or the destination node is not within the legal access boundary, access is denied. The reasons for rejection are marked according to the access results, including user non-consent, insufficient role permissions, and inconsistency between consent and permission scope. The access result, legal access boundary, and denial reason are encapsulated into a status determination result.

7. The real-time analysis and early warning system for sensitive personal information access behavior as described in claim 6, characterized in that, The early warning triggering module includes a strategy encoding unit, a risk determination unit, and an action mapping unit; The strategy encoding unit is used to initialize the early warning strategy pool, which includes several candidate strategy configuration instances. The behavioral context and state determination result are extracted as early warning input. Each candidate strategy configuration instance in the early warning strategy pool is vectorized and encoded to obtain a strategy vector. The strategy vector includes a risk trigger threshold, a cognitive load threshold, a response action mapping matrix, and an alarm feature vector. The early warning strategy pool is divided into a first strategy cluster and a second strategy cluster according to the risk trigger threshold and the cognitive load threshold.

8. The real-time analysis and early warning system for sensitive personal information access behavior as described in claim 7, characterized in that, The risk assessment unit is used to calculate the quantitative score of the current request and compare it with the strategy vector in the early warning strategy pool to make a judgment. Calculate the objective risk score for this request based on the reasons for failure in the status determination result; Based on the environmental information in the behavioral context, the access frequency and historical interception count within the time window are statistically analyzed to calculate the cognitive load score currently imposed on the user. The strategy vector with the highest overall evaluation is selected from the early warning strategy pool as the optimal strategy vector. The risk trigger threshold and cognitive load threshold are extracted from the optimal strategy vector and compared with the objective risk score and cognitive load score respectively to obtain the trigger instruction. If the objective risk score Risk trigger threshold, and the cognitive load score Cognitive load threshold, generate pop-up trigger command; If the objective risk score Risk trigger threshold, and the cognitive load score Cognitive load threshold, generate silent interception command; If the objective risk score Risk trigger threshold, generate silent release command.

9. The real-time analysis and early warning system for accessing sensitive personal information as described in claim 8, characterized in that, The action mapping unit is used to generate the final warning event based on the trigger command; Receive the trigger command and extract the response action mapping matrix and alarm feature vector from the optimal strategy vector; By comparing the response action mapping matrix, the triggering command is converted into a low-level control action, which includes permission, proxy degradation, and physical blocking; If the triggering command is a pop-up triggering command, the corresponding pop-up UI display template is matched according to the alarm feature vector; Save the aforementioned control actions, pop-up UI display templates, behavioral contexts, and objective risk scores as violation warning events.

10. The real-time analysis and early warning system for accessing sensitive personal information as described in claim 9, characterized in that, The response processing module includes: Upon receiving the violation warning event, the system issues control actions to the underlying access controller. When the control action has an explicit pop-up window, the system collects the interactive feedback behavior of the end user, including decision response latency and authorization regret reset behavior. The objective risk score of this action is extracted as the security protection benefit. The disturbance cost and the interactive feedback behavior are obtained. A weighted calculation is performed based on a multi-objective balance mechanism to obtain a comprehensive performance score, which is then written back to the early warning strategy pool. Local parameters are then fine-tuned to complete the parameter update.

Images