CN116881974A

CN116881974A - Data processing method and device based on data acquisition request and electronic equipment

Info

Publication number: CN116881974A
Application number: CN202311141060.0A
Authority: CN
Inventors: 李成强; 隋宗宾; 黄秋香; 张凤梅; 陈智兴; 吴旭; 张江伟
Original assignee: Zhongguancun Smart City Co Ltd
Current assignee: Zhongguancun Smart City Co Ltd
Priority date: 2023-09-06
Filing date: 2023-09-06
Publication date: 2023-10-13
Anticipated expiration: 2043-09-06
Also published as: CN116881974B

Abstract

The embodiment of the invention discloses a data processing method, a device and electronic equipment based on a data acquisition request. One embodiment of the method comprises the following steps: carrying out request analysis on the data acquisition request; respectively determining access record information corresponding to the request object identification information and the request terminal identification information; generating a historical request link diagram; generating request risk degree information for a data acquisition request; in response to determining that the request hazard level information characterizes the hazard level of the data acquisition request as a first-level hazard level, masking the data acquisition request; reading field data information corresponding to the request field information in response to determining that the request risk level information characterizes the risk level of the data acquisition request as a secondary risk level; sensitive information shielding is carried out on each field data information in the field data information set; and transmitting the shielded field data information set to a data terminal corresponding to the request terminal identification information. This embodiment reduces the risk of disclosure of private data.

Description

Data processing method and device based on data acquisition request and electronic equipment

Technical Field

The embodiment of the disclosure relates to the technical field of computers, in particular to a data processing method, a data processing device and electronic equipment based on a data acquisition request.

Background

With the development of internet related technologies, user data electronization has gradually become a trend. Research into problems such as user privacy data leakage becomes particularly important. Currently, for access to user privacy data, an access permission setting manner is generally adopted to realize hierarchical access to the user privacy data.

However, the inventors found that when the above manner is adopted, there are often the following technical problems:

firstly, by adopting a permission setting mode, abnormal data acquisition requests cannot be effectively identified from an access record angle, so that the leakage risk of private data is increased;

secondly, in the common information shielding modes such as fixed character shielding, the possibility of information restoration may exist, and the leakage of private data cannot be effectively avoided;

third, in the transmission process of the data acquisition request, there may be a situation of request infection, so that unauthorized data access may be performed through the infected request, and the risk of disclosure of private data is increased.

The above information disclosed in this background section is only for enhancement of understanding of the background of the inventive concept and, therefore, may contain information that does not form the prior art that is already known to those of ordinary skill in the art in this country.

Disclosure of Invention

The disclosure is in part intended to introduce concepts in a simplified form that are further described below in the detailed description. The disclosure is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.

Some embodiments of the present disclosure propose a data processing method, apparatus and electronic device based on a data acquisition request to solve one or more of the technical problems mentioned in the background section above.

In a first aspect, some embodiments of the present disclosure provide a data processing method based on a data acquisition request, the method comprising: in response to detecting a data acquisition request, performing request analysis on the data acquisition request to obtain request content information, wherein the data acquisition request is a request for user related information, and the request content information comprises: a request field information set, request object identification information and request terminal identification information; respectively determining access record information corresponding to the request object identification information and the request terminal identification information to obtain first access record information and second access record information; generating a history request link map according to the first access record information and the second access record information; generating request risk degree information for the data acquisition request according to the history request link diagram; shielding the data acquisition request in response to determining that the request hazard level information characterizes the hazard level of the data acquisition request as a first-level hazard level; responding to the fact that the dangerous level of the request dangerous level information represents the dangerous level of the data acquisition request as a secondary dangerous level, and reading field data information corresponding to the request field information in the request field information set to obtain a field data information set; performing sensitive information shielding on each field data information in the field data information set to generate shielded field data information, and obtaining a shielded field data information set; and transmitting the shielded field data information set to the data terminal corresponding to the request terminal identification information.

In a second aspect, some embodiments of the present disclosure provide a data processing apparatus based on a data acquisition request, the apparatus comprising: a request parsing unit configured to parse a data acquisition request in response to detecting the data acquisition request, to obtain request content information, where the data acquisition request is a request for user related information, and the request content information includes: a request field information set, request object identification information and request terminal identification information; a determining unit configured to determine access record information corresponding to the request object identification information and the request terminal identification information, respectively, to obtain first access record information and second access record information; a first generation unit configured to generate a history request link map based on the first access record information and the second access record information; a second generation unit configured to generate request risk degree information for the data acquisition request based on the history request link map; a masking unit configured to mask the data acquisition request in response to determining that the request risk level information characterizes the risk level of the data acquisition request as a first-level risk level; a reading unit configured to read field data information corresponding to the request field information in the request field information set to obtain a field data information set in response to determining that the request risk level information characterizes the risk level of the data acquisition request as a secondary risk level; the sensitive information shielding unit is configured to shield the sensitive information of each field data information in the field data information set so as to generate shielded field data information and obtain a shielded field data information set; and the transmitting unit is configured to transmit the masked field data information set to the data terminal corresponding to the request terminal identification information.

In a third aspect, some embodiments of the present disclosure provide an electronic device comprising: one or more processors; a storage device having one or more programs stored thereon, which when executed by one or more processors causes the one or more processors to implement the method described in any of the implementations of the first aspect above.

In a fourth aspect, some embodiments of the present disclosure provide a computer readable medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the method described in any of the implementations of the first aspect above.

The above embodiments of the present disclosure have the following advantageous effects: by the data processing method based on the data acquisition request of some embodiments of the present disclosure, the risk of leakage of private data is reduced. Specifically, the reason why the risk of disclosure of private data is high is that: by adopting the permission setting mode, the abnormal data acquisition request cannot be effectively identified from the access record angle. Based on this, in some embodiments of the present disclosure, a data processing method based on a data acquisition request, first, in response to detecting the data acquisition request, performs request parsing on the data acquisition request to obtain request content information, where the data acquisition request is a request for user related information, and the request content information includes: request field information set, request object identification information, and request terminal identification information. And secondly, respectively determining the access record information corresponding to the request object identification information and the request terminal identification information to obtain first access record information and second access record information. In this way, the request risk level information of the data acquisition request can be determined from the access record perspective. Then, a history request link map is generated based on the first access record information and the second access record information. Further, request risk degree information for the data acquisition request is generated based on the history request link map. Therefore, the request change condition of the history access record can be determined according to the history request link diagram so as to determine whether the data acquisition request belongs to a dangerous request. In addition, the data acquisition request is masked in response to determining that the request hazard level information characterizes the hazard level of the data acquisition request as a first-level hazard level. When the risk level is a first-level risk level, the data acquisition request is characterized in that abnormal access to sensitive data possibly exists, and the data acquisition request is shielded to avoid data reading. Then, in response to determining that the request risk level information characterizes the risk level of the data acquisition request as a secondary risk level, reading field data information corresponding to the request field information in the request field information set to obtain a field data information set; and carrying out sensitive information shielding on each field data information in the field data information set to generate shielded field data information, and obtaining a shielded field data information set. In the case of a secondary hazard level, the token data acquisition request allows access to sensitive data, but requires leak-proof processing of the sensitive data. And finally, the shielded field data information set is sent to the data terminal corresponding to the request terminal identification information. In this way, from the data acquisition request angle, whether the data acquisition request belongs to a dangerous request is determined, and the corresponding processing is carried out on the field data information set of the data acquisition request according to the corresponding request dangerous degree information, so that the leakage risk of the privacy data is reduced.

Drawings

The above and other features, advantages, and aspects of embodiments of the present disclosure will become more apparent by reference to the following detailed description when taken in conjunction with the accompanying drawings. The same or similar reference numbers will be used throughout the drawings to refer to the same or like elements. It should be understood that the figures are schematic and that elements and components are not necessarily drawn to scale.

FIG. 1 is a flow chart of some embodiments of a data processing method based on a data acquisition request according to the present disclosure;

FIG. 2 is a schematic diagram of the architecture of some embodiments of a data processing apparatus based on a data acquisition request according to the present disclosure;

fig. 3 is a schematic structural diagram of an electronic device suitable for use in implementing some embodiments of the present disclosure.

Detailed Description

Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While certain embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete. It should be understood that the drawings and embodiments of the present disclosure are for illustration purposes only and are not intended to limit the scope of the present disclosure.

It should be noted that, for convenience of description, only the portions related to the present invention are shown in the drawings. Embodiments of the present disclosure and features of embodiments may be combined with each other without conflict.

It should be noted that the terms "first," "second," and the like in this disclosure are merely used to distinguish between different devices, modules, or units and are not used to define an order or interdependence of functions performed by the devices, modules, or units.

It should be noted that references to "one", "a plurality" and "a plurality" in this disclosure are intended to be illustrative rather than limiting, and those of ordinary skill in the art will appreciate that "one or more" is intended to be understood as "one or more" unless the context clearly indicates otherwise.

The names of messages or information interacted between the various devices in the embodiments of the present disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

The present disclosure will be described in detail below with reference to the accompanying drawings in conjunction with embodiments.

Referring to fig. 1, a flow 100 of some embodiments of a data processing method based on a data acquisition request according to the present disclosure is shown. The data processing method based on the data acquisition request comprises the following steps:

And step 101, responding to the detection of the data acquisition request, and carrying out request analysis on the data acquisition request to obtain the request content information.

In some embodiments, in response to detecting a data acquisition request, an executing body (e.g., computing device) of a data processing method based on the data acquisition request may parse the data acquisition request to obtain the requested content information. Wherein the data acquisition request is a request for user related information. In practice, user-related information may include, but is not limited to: user basic information, user browsing record information and user operation record information. For example, the user base information may include, but is not limited to: user name, user gender, user age, user home address, user identification number. The user browsing record information may characterize the user's internet browsing record. The user operation record information may characterize the user's internet operation record. Requesting content information may include: request field information set, request object identification information, and request terminal identification information. The request field information may characterize a database field name corresponding to the data of the data acquisition request. For example, the request field information may be "UserName," which may be a database field name to which the user name corresponds. The request object identification information may characterize an object identification of the object that originated the data acquisition request. For example, the request object identification information may be an account identification. The request terminal identification information may be a terminal identification of the terminal that initiated the data acquisition request. For example, the requesting terminal identification information may be a MAC (Media Access Control Address ) address. In practice, the execution body may perform message decapsulation on the data acquisition request to obtain the request content information.

The computing device may be hardware or software. When the computing device is hardware, the computing device may be implemented as a distributed cluster formed by a plurality of servers or terminal devices, or may be implemented as a single server or a single terminal device. When the computing device is embodied as software, it may be installed in the hardware devices listed above. It may be implemented as a plurality of software or software modules, for example, for providing distributed services, or as a single software or software module. The present invention is not particularly limited herein. It should be appreciated that the number of computing devices may have any number, as desired for implementation.

Step 102, access record information corresponding to the request object identification information and the request terminal identification information is respectively determined, and first access record information and second access record information are obtained.

In some embodiments, the executing body may determine access record information corresponding to the request object identification information and the request terminal identification information, respectively, to obtain the first access record information and the second access record information. The first access record information may characterize a historical access record initiated by an object corresponding to the request object identification information for the user-related information. The second access record information may characterize a historical access record initiated by the terminal corresponding to the requesting terminal identification information for the user-related information. In practice, the executing body may perform history access record search with the request object identification information and the request terminal identification information search term, respectively, to obtain the first access record information and the second access record information.

Optionally, the first access record information includes: the first access record is a sub-information set. The second access record information includes: the second access record is a subset of information. The first access record sub-information in the first access record sub-information set may be a historical access record corresponding to different access times. The second access record sub-information in the second access record sub-information set may be a historical access record corresponding to a different access time.

In some optional implementations of some embodiments, the executing body determines access record information corresponding to the request object identification information and the request terminal identification information, to obtain first access record information and second access record information, where the steps may include:

and determining a history access record matched with the request object identification information in the history access record pool as first candidate access record sub-information to obtain a first candidate access record sub-information set.

Wherein the history access record pool is a data pool for storing history access records. For example, the historical access record pool may be implemented by a database. In practice, the executing body may use the request object identification information as a keyword, and perform matched historical access record retrieval in the historical access record pool to obtain the first candidate access record sub-information set.

And a second step of determining a history access record matched with the request terminal identification information in the history access record pool as second candidate access record sub-information to obtain a second candidate access record sub-information set.

In practice, the executing body may use the request terminal identification information as a keyword, and perform matched historical access record retrieval in the historical access record pool to obtain the second candidate access record sub-information set.

And thirdly, taking a source address and a destination address corresponding to the first candidate access record sub-information as clustering items, and clustering the access record of the first candidate access record sub-information in the first candidate access record sub-information set to generate a first candidate access record sub-information cluster set.

The first candidate access record sub-information in the first candidate access record sub-information cluster is the first candidate access record sub-information corresponding to the same source address and destination address. The source address is an address of an access request corresponding to the first candidate access record sub-information. The destination address is an address of an access request corresponding to the received first candidate access record sub-information.

And fourthly, taking a source address and a destination address corresponding to the second candidate access record sub-information as clustering items, and clustering the access records of the second candidate access record sub-information in the second candidate access record sub-information set to generate a second candidate access record sub-information cluster set.

The second candidate access record sub-information in the second candidate access record sub-information cluster is the second candidate access record sub-information corresponding to the same source address and destination address.

And fifthly, extracting first access record sub-information from each first candidate access record sub-information cluster in the first candidate access record sub-information cluster set to serve as first access record sub-information, and obtaining the first access record sub-information set.

In practice, the executing body may extract a target number of first access record sub-information from the first candidate access record sub-information cluster, to obtain the first access record sub-information set. Specifically, the target number may be 1.

And sixthly, extracting second access record sub-information from each second candidate access record sub-information cluster in the second candidate access record sub-information cluster set to serve as second access record sub-information, and obtaining the second access record sub-information set.

In practice, the executing body may extract a target number of second access record sub-information from the second candidate access record sub-information cluster, to obtain the second access record sub-information set. Specifically, the target number may be 1.

And step 103, generating a history request link map according to the first access record information and the second access record information.

In some embodiments, the executing entity may generate the history request link map according to the first access record information and the second access record information. Wherein the history request link map characterizes router nodes through which requests pass in the request forwarding process, and request forwarding directions between the router nodes. Specifically, the execution body may generate the history request link map according to the first access record information and the second access record information by using a directed graph generation manner.

Optionally, the first access record sub-information in the first access record sub-information set includes: the first route records information. The second access record sub-information in the second access record sub-information set includes: the second route records information. The first route record information characterizes a router node and a request forwarding direction, which are passed by a request corresponding to the first access record sub-information in a request forwarding process. The second route record information characterizes a router node and a request forwarding direction, which are passed by a request corresponding to the second access record sub-information in the request forwarding process. For example, the second route record information may be [ ROUTER1, ROUTER2, ROUTER3, ROUTER4], and the request corresponding to the second access record sub-information may be characterized as forwarded by ROUTER1 to ROUTER2, by ROUTER2 to ROUTER3, and by ROUTER3 to ROUTER4.

In some optional implementations of some embodiments, the executing entity may generate the history request link map according to the first access record information and the second access record information, and may include the following steps:

the first step, for each first access record sub-information in the first access record sub-information set includes first route record information, determining at least one route node corresponding to the first route record information, and obtaining a first route node information group.

The first routing node information characterizes the routing node identification of the routing node corresponding to the first routing record information.

And a second step of determining at least two routing nodes corresponding to the second routing record information to obtain a second routing node information group for each second access record sub-information in the second access record sub-information set, wherein the second access record sub-information comprises the second routing record information.

The second routing node information characterizes the routing node identification of the routing node corresponding to the second routing record information.

And thirdly, performing information deduplication on the obtained first routing node information set and the obtained second routing node information set to obtain a deduplicated routing node information set.

And step four, taking the route node information after de-duplication in the route node information set after de-duplication as a graph node to generate an initial link graph.

In practice, since the history request link map is a directed map, the history request link map may be stored in a contiguous matrix. Thus, the execution body may generate an empty adjacency matrix as the initial link map based on the de-duplicated routing node information set.

And fifthly, updating the graph nodes corresponding to the initial link graph according to the routing sequence corresponding to the first routing record information included in the first access record sub-information and the routing sequence corresponding to the second routing record information included in the second access record sub-information to generate a historical request link graph.

In practice, the executing body may add a directed edge to a corresponding graph node in the initial link graph according to the routing sequence corresponding to the first access record sub-information including the first routing record information and the routing sequence corresponding to the second access record sub-information including the second routing record information, so as to generate the history request link graph.

Step 104, according to the historical request link diagram, request risk degree information for the data acquisition request is generated.

In some embodiments, the execution entity may generate the request risk level information for the data acquisition request according to the historical request link map in various manners.

In some optional implementations of some implementations, the executing entity may generate the request risk level information for the data acquisition request according to the historical request link map, and may include the following steps:

determining a routing node for forwarding the data acquisition request, and obtaining a target routing node information set.

The target routing node information characterizes a routing node for forwarding the data acquisition request. In practice, the target routing node information may be characterized by routing node identification.

And secondly, performing graph traversal on the historical request link graph to generate candidate route path information, and obtaining a candidate route path information set.

The route path corresponding to the candidate route path information comprises route nodes corresponding to the target route node information in the target route node information set. In practice, the execution body may perform graph traversal on the historical request link graph through a depth traversal algorithm to generate candidate route path information, so as to generate the candidate route path information set.

Third, for each candidate route path information in the candidate route path information set, the following second processing step is performed:

and a first sub-step of determining a routing table corresponding to each routing node in at least one routing node included in the candidate routing path information, and obtaining a routing table sequence.

The execution body may remotely access each routing node of the at least one routing node included in the candidate routing path information, so as to obtain a routing table corresponding to the routing node. Wherein the routing table may be an address table for request forwarding.

And a second sub-step of determining the pollution degree of the routing node corresponding to the target routing node according to the pollution degree of the routing table corresponding to the routing table in the routing table sequence, the node distance between the routing node corresponding to the routing table and the target routing node, and the node communication direction between the routing node corresponding to the routing table and the target routing node.

The target routing node is a routing node corresponding to the target routing node information contained in the routing path corresponding to the candidate routing path information. The route node pollution degree characterizes the probability of the target route node being polluted by the node. The route table pollution level characterizes the proportion of the tampered route paths in the route table to all the route paths in the route table. A routing path is an address pair containing a source address and a destination address for forwarding a request. The node distance characterizes the number of routing nodes between the routing node corresponding to the routing table and the target routing node. The node distance represents the number of routing nodes between the routing node corresponding to the routing table and the target routing node after standardization. Wherein the route node pollution level is equal to the average value of each intermediate value in the intermediate value set. The intermediate values in the intermediate value set are object to object with the routing tables in the sequence of routing tables. Intermediate value = a x B x C, where a represents the degree of routing table contamination. B represents the node distance. C represents a node communication direction, wherein the value of the node communication direction is 1 or 0.

And step four, determining the request risk degree information according to the obtained route node pollution degree set.

In practice, the executing entity may determine an average value of the route node pollution degree set as the request risk degree information.

As an invention point of the present disclosure, the above-mentioned "in some optional implementations of some implementations" solves the third technical problem mentioned in the background art, that is, "a situation that a request for data acquisition may be infected during a transmission process, which results in that unauthorized data access may be performed through a request after the infection, thereby increasing a risk of disclosure of private data. In practice, the method and the device consider the problem that the data acquisition request is hijacked and tampered and the like due to the fact that the router node is infected in the process of forwarding the data acquisition request through the router node, so that unauthorized data access is caused. Based on the above, the disclosure determines the pollution degree of the routing node corresponding to the target routing node by determining the pollution degree of the routing table, the node distance between the routing node corresponding to the routing table and the target routing node, and the node communication direction between the routing node corresponding to the routing table and the target routing node, thereby measuring the request danger degree information of the data acquisition request. By the method, the infected data acquisition request can be effectively identified, and the risk of revealing private data caused by the infected data acquisition request is avoided.

In step 105, the data acquisition request is masked in response to determining that the request hazard level information characterizes the hazard level of the data acquisition request as a first level hazard level.

In some embodiments, the executing entity may mask the data acquisition request in response to determining that the request risk level information characterizes the risk level of the data acquisition request as a first level risk level. The first-level hazard level characterization data acquisition request is an abnormal request. The execution body may mask the masked data acquisition request from accessing a database corresponding to the set of storage field data information to implement the masked data acquisition request.

And step 106, in response to determining that the risk level of the request risk level information representation data acquisition request is a secondary risk level, reading field data information corresponding to the request field information in the request field information set to obtain the field data information set.

The second-level danger level represents that the field data information set requested by the data acquisition request has sensitive data, and sensitive information shielding is needed. In practice, the executing body may request the field information as a search field, and search the database corresponding to the stored field data information set to obtain the field data information set.

Step 107, performing sensitive information masking on each field data information in the field data information set to generate masked field data information, thereby obtaining a masked field data information set.

In some embodiments, the executing entity may mask each field data information in the field data information set by various manners to generate masked field data information, so as to obtain a masked field data information set.

In some optional implementations of some embodiments, the executing body performs sensitive information masking on each field data information in the field data information set to generate masked field data information, and may include the steps of:

first, determining the field type corresponding to the field data information.

Wherein the field type characterizes a data type of the field data information.

And secondly, performing text segmentation on the field data information to obtain a segmented field data information set in response to determining that the field type characterizes the field data information as a text string type.

The segmented field data information represents the data segment corresponding to the field data information.

As an example, the field data information may be "ABCD". The set of partitioned field data information may be [ "A", "AB", "ABC", "ABCD", "B", "BC", "BCD", "C", "CD", "D" ].

And thirdly, carrying out data shielding on the corresponding positions of the segmented field data information in the field data information for each segmented field data information in the segmented field data information set to obtain shielded field data information.

The execution main body can conduct data shielding on the corresponding positions of the segmented field data information in the field data information through a preset cover symbol, and the shielded field data information is obtained. For example, the preset MASK may be "MASK".

And step four, performing word embedding coding on each piece of shielded field data information in the obtained shielded field data information set to generate coded field data information, and obtaining a coded field data information set.

The execution subject can perform Word embedding encoding on the shielded field data information through a Word2Vec model to generate encoded field data information.

Fifth, for each encoded field data information in the set of encoded field data information, performing the following first processing step:

and a first sub-step of determining the data reversibility corresponding to the encoded field data information.

The data reversibility characterizes the probability that the corresponding position of the preset covering character in the field data information after predictive coding is the segmented field data information. In practice, the execution subject can determine the data reversibility corresponding to the encoded field data information through the BERT model.

And a second sub-step of determining the information sensitivity of the segmented field data information corresponding to the encoded field data information.

The execution body may determine a matching degree of the segmented field data information corresponding to the encoded field data information and the sensitive word of the sensitive word in the sensitive word list, as the information sensitivity. In practice, the matching degree of the sensitive word may be cosine similarity between the segmented field data information corresponding to the encoded field data information and the sensitive word in the sensitive word list.

And sixthly, information shielding is carried out on the segmented field data information, of which the corresponding data reversibility and the corresponding information sensitivity meet the screening conditions, in the field data information, so that shielded field data information corresponding to the field data information is obtained.

Wherein, the screening conditions are as follows: the corresponding data reversibility is the maximum data reversibility, and the information sensitivity is the maximum data reversibility.

And seventhly, in response to determining that the field type represents the field data information as a numerical value type, information shielding is carried out on the field data information through a preset shielding character, and shielded field data information corresponding to the field data information is obtained.

The predetermined mask may be "#.

And eighth, in response to determining that the field type characterizes the field data information as a numeric string type, shielding the field data information by a preset number of random characters to obtain shielded field data information corresponding to the field data information.

The above-mentioned "in some optional implementations of some embodiments" is an invention point of the present disclosure, and solves the second technical problem mentioned in the background art, that is, "a common information shielding manner such as fixed character shielding may have a possibility of information recovery, and cannot effectively avoid private data leakage. Based on this, this disclosure contemplates that common data types include: numerical value type, numerical value string type, and text string type. Firstly, aiming at a numerical value type, a single numerical value is usually corresponding, therefore, in response to determining that the field type characterizes the field data information as the numerical value type, information shielding is carried out on the field data information through a preset shielding symbol, so that shielded field data information corresponding to the field data information is obtained, namely, data leakage is avoided in a full shielding mode. Secondly, aiming at the numerical value character string type, the numerical value is often contained and the numerical value is irregular, so that the method and the device respond to the determination that the field type represents the field data information to be the numerical value character string type, and perform the shielding of the preset number of random characters on the field data information to obtain the shielded field data information corresponding to the field data information. The probability of information recovery is increased by randomness, thereby avoiding data leakage. Then, for the text string type, the probability of restoring the field data information of the type is larger due to the existence of semantic features, and based on the probability, the position of information shielding is determined by determining the reversibility and the information sensitivity of the data, and the restoring resistance of the shielded field data information obtained in the mode is stronger. In this way, private data leakage can be effectively avoided.

And step 108, transmitting the shielded field data information set to the data terminal corresponding to the request terminal identification information.

In some embodiments, the executing body may send the masked field data information set to a data terminal corresponding to the request terminal identification information.

Optionally, the method further comprises:

in the first step, in response to determining that the risk level of the request risk level information represents the risk level of the data acquisition request not the primary risk level or the secondary risk level, field data information corresponding to the request field information in the request field information set is read, and a field data information set is obtained.

In practice, the executing body may request the field information as a search field, and search the database corresponding to the stored field data information set to obtain the field data information set.

And step two, the field data information set is sent to the data terminal corresponding to the request terminal identification information.

Optionally, the method further comprises:

in a first step, data retrieval record information for the data acquisition request is generated in response to determining that the request risk level information characterizes the risk level of the data acquisition request as the primary risk level or the secondary risk level.

Wherein the data retrieval record information may be a database record for the data acquisition request.

And step two, storing the data retrieval record information into an early warning information database.

The early warning information database may be a database for storing data retrieval record information.

With further reference to fig. 2, as an implementation of the method shown in the above figures, the present disclosure provides some embodiments of a data processing apparatus based on a data acquisition request, which correspond to those method embodiments shown in fig. 1, and which may be applied in particular in various electronic devices.

As shown in fig. 2, a data processing apparatus 200 according to some embodiments includes: a request parsing unit 201, a determining unit 202, a first generating unit 203, a second generating unit 204, a masking unit 205, a reading unit 206, a sensitive information masking unit 207, and a transmitting unit 208. Wherein, the request parsing unit 201 is configured to parse a request for obtaining request content information in response to detecting a data acquisition request, where the data acquisition request is a request for user related information, and the request content information includes: a request field information set, request object identification information and request terminal identification information; a determining unit 202 configured to determine access record information corresponding to the request object identification information and the request terminal identification information, respectively, to obtain first access record information and second access record information; a first generation unit 203 configured to generate a history request link map based on the first access record information and the second access record information; a second generation unit 204 configured to generate request risk degree information for the data acquisition request based on the history request link map; a masking unit 205 configured to mask the data acquisition request in response to determining that the request risk level information characterizes the risk level of the data acquisition request as a first-level risk level; a reading unit 206, configured to read field data information corresponding to the request field information in the request field information set to obtain a field data information set in response to determining that the request risk level information characterizes the risk level of the data acquisition request as a secondary risk level; a sensitive information masking unit 207 configured to mask sensitive information for each field data information in the set of field data information to generate masked field data information, to obtain a set of masked field data information; and a transmitting unit 208 configured to transmit the masked field data information set to the data terminal corresponding to the request terminal identification information.

It will be appreciated that the elements described in the data processing apparatus 200 based on the data acquisition request correspond to the respective steps in the method described with reference to fig. 1. Thus, the operations, features and advantages described above with respect to the method are equally applicable to the data processing apparatus 200 based on the data acquisition request and the units contained therein, and are not described here again.

Referring now to fig. 3, a schematic diagram of an electronic device (e.g., computing device) 300 suitable for use in implementing some embodiments of the present disclosure is shown. The electronic device shown in fig. 3 is merely an example and should not impose any limitations on the functionality and scope of use of embodiments of the present disclosure.

As shown in fig. 3, the electronic device 300 may include a processing means (e.g., a central processing unit, a graphics processor, etc.) 301 that may perform various suitable actions and processes in accordance with programs stored in a read-only memory 302 or programs loaded from a storage 308 into a random access memory 303. In the random access memory 303, various programs and data necessary for the operation of the electronic device 300 are also stored. The processing means 301, the read only memory 302 and the random access memory 303 are connected to each other by a bus 304. An input/output interface 305 is also connected to the bus 304.

In general, the following devices may be connected to the I/O interface 305: input devices 306 including, for example, a touch screen, touchpad, keyboard, mouse, camera, microphone, accelerometer, gyroscope, etc.; an output device 307 including, for example, a Liquid Crystal Display (LCD), a speaker, a vibrator, and the like; storage 308 including, for example, magnetic tape, hard disk, etc.; and communication means 309. The communication means 309 may allow the electronic device 300 to communicate with other devices wirelessly or by wire to exchange data. While fig. 3 shows an electronic device 300 having various means, it is to be understood that not all of the illustrated means are required to be implemented or provided. More or fewer devices may be implemented or provided instead. Each block shown in fig. 3 may represent one device or a plurality of devices as needed.

In particular, according to some embodiments of the present disclosure, the processes described above with reference to flowcharts may be implemented as computer software programs. For example, some embodiments of the present disclosure include a computer program product comprising a computer program embodied on a computer readable medium, the computer program comprising program code for performing the method shown in the flow chart. In such embodiments, the computer program may be downloaded and installed from a network via communications device 309, or from storage device 308, or from read only memory 302. The above-described functions defined in the methods of some embodiments of the present disclosure are performed when the computer program is executed by the processing means 301.

It should be noted that, the computer readable medium described in some embodiments of the present disclosure may be a computer readable signal medium or a computer readable storage medium, or any combination of the two. The computer readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or a combination of any of the foregoing. More specific examples of the computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In some embodiments of the present disclosure, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. In some embodiments of the present disclosure, however, the computer-readable signal medium may comprise a data signal propagated in baseband or as part of a carrier wave, with the computer-readable program code embodied therein. Such a propagated data signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination of the foregoing. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to: electrical wires, fiber optic cables, RF (radio frequency), and the like, or any suitable combination of the foregoing.

In some implementations, the clients, servers may communicate using any currently known or future developed network protocol, such as HTTP (Hyper Text Transfer Protocol ), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), the internet (e.g., the internet), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any currently known or future developed networks.

The computer readable medium may be contained in the electronic device; or may exist alone without being incorporated into the electronic device. The computer readable medium carries one or more programs which, when executed by the electronic device, cause the electronic device to: in response to detecting a data acquisition request, performing request analysis on the data acquisition request to obtain request content information, wherein the data acquisition request is a request for user related information, and the request content information comprises: a request field information set, request object identification information and request terminal identification information; respectively determining access record information corresponding to the request object identification information and the request terminal identification information to obtain first access record information and second access record information; generating a history request link map according to the first access record information and the second access record information; generating request risk degree information for the data acquisition request according to the history request link diagram; shielding the data acquisition request in response to determining that the request hazard level information characterizes the hazard level of the data acquisition request as a first-level hazard level; responding to the fact that the dangerous level of the request dangerous level information represents the dangerous level of the data acquisition request as a secondary dangerous level, and reading field data information corresponding to the request field information in the request field information set to obtain a field data information set; performing sensitive information shielding on each field data information in the field data information set to generate shielded field data information, and obtaining a shielded field data information set; and transmitting the shielded field data information set to the data terminal corresponding to the request terminal identification information.

Computer program code for carrying out operations for some embodiments of the present disclosure may be written in one or more programming languages, including an object oriented programming language such as Java, smalltalk, C ++ and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to an external computer (for example, through the Internet using an Internet service provider).

The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

The units described in some embodiments of the present disclosure may be implemented by means of software, or may be implemented by means of hardware. The described units may also be provided in a processor, for example, described as: a processor includes a request parsing unit, a determining unit, a first generating unit, a second generating unit, a masking unit, a reading unit, a sensitive information masking unit, and a transmitting unit. The names of these units do not limit the unit itself in some cases, and for example, the transmitting unit may be described as "a unit that transmits the above-described masked field data information set to the data terminal corresponding to the above-described request terminal identification information".

The functions described above herein may be performed, at least in part, by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: a Field Programmable Gate Array (FPGA), an Application Specific Integrated Circuit (ASIC), an Application Specific Standard Product (ASSP), a system on a chip (SOC), a Complex Programmable Logic Device (CPLD), and the like.

The foregoing description is only of the preferred embodiments of the present disclosure and description of the principles of the technology being employed. It will be appreciated by those skilled in the art that the scope of the invention in the embodiments of the present disclosure is not limited to the specific combination of the above technical features, but encompasses other technical features formed by any combination of the above technical features or their equivalents without departing from the spirit of the invention. Such as the above-described features, are mutually substituted with (but not limited to) the features having similar functions disclosed in the embodiments of the present disclosure.

Claims

1. A data processing method based on a data acquisition request, comprising:

in response to detecting a data acquisition request, carrying out request analysis on the data acquisition request to obtain request content information, wherein the data acquisition request is a request for user related information, and the request content information comprises: a request field information set, request object identification information and request terminal identification information;

respectively determining access record information corresponding to the request object identification information and the request terminal identification information to obtain first access record information and second access record information;

generating a history request link diagram according to the first access record information and the second access record information;

generating request risk degree information for the data acquisition request according to the historical request link diagram;

masking the data acquisition request in response to determining that the request hazard level information characterizes the data acquisition request as a first level hazard level;

responding to the fact that the dangerous level of the request dangerous level information represents the dangerous level of the data acquisition request as a secondary dangerous level, and reading field data information corresponding to the request field information in the request field information set to obtain a field data information set;

Sensitive information shielding is carried out on each field data information in the field data information set so as to generate shielded field data information, and a shielded field data information set is obtained;

and sending the shielded field data information set to a data terminal corresponding to the request terminal identification information.

2. The method of claim 1, wherein the method further comprises:

reading field data information corresponding to the request field information in the request field information set to obtain a field data information set in response to determining that the request risk degree information characterizes the risk level of the data acquisition request as not being the primary risk level or the secondary risk level;

and sending the field data information set to a data terminal corresponding to the request terminal identification information.

3. The method of claim 2, wherein the method further comprises:

generating data retrieval record information for the data acquisition request in response to determining that the request hazard level information characterizes the hazard level of the data acquisition request as the primary hazard level or the secondary hazard level;

and storing the data retrieval record information into an early warning information database.

4. The method of claim 3, wherein the first access record information comprises: a first set of access record sub-information, the second access record information comprising: a second access record sub-information set; and

the step of respectively determining the access record information corresponding to the request object identification information and the request terminal identification information to obtain first access record information and second access record information, including:

determining a history access record matched with the request object identification information in a history access record pool as first candidate access record sub-information to obtain a first candidate access record sub-information set;

determining a history access record matched with the request terminal identification information in the history access record pool as second candidate access record sub-information to obtain a second candidate access record sub-information set;

taking a source address and a destination address corresponding to the first candidate access record sub-information as clustering items, and clustering access records of the first candidate access record sub-information in the first candidate access record sub-information set to generate a first candidate access record sub-information cluster set;

taking a source address and a destination address corresponding to the second candidate access record sub-information as clustering items, and clustering access records of the second candidate access record sub-information in the second candidate access record sub-information set to generate a second candidate access record sub-information cluster set;

Extracting first access record sub-information from each first candidate access record sub-information cluster in the first candidate access record sub-information cluster set as first access record sub-information to obtain the first access record sub-information set;

and extracting second access record sub-information from each second candidate access record sub-information cluster in the second candidate access record sub-information cluster set as second access record sub-information to obtain the second access record sub-information set.

5. The method of claim 4, wherein a first access record sub-information in the first access record sub-information set comprises: the first route record information, the second access record sub-information in the second access record sub-information set includes: second route record information; and

the generating a history request link map according to the first access record information and the second access record information includes:

for each first access record sub-information in the first access record sub-information set, including first route record information, determining at least one route node corresponding to the first route record information, and obtaining a first route node information group;

For each piece of second access record sub-information in the second access record sub-information set, second route record information is included, at least two route nodes corresponding to the second route record information are determined, and a second route node information group is obtained;

performing information deduplication on the obtained first routing node information set and the obtained second routing node information set to obtain a deduplicated routing node information set;

the route node information after the duplication removal in the route node information set is used as a graph node to generate an initial link graph;

and updating the graph correlation edges of the corresponding graph nodes in the initial link graph according to the routing sequence corresponding to the first routing record information included in the first access record sub-information and the routing sequence corresponding to the second routing record information included in the second access record sub-information so as to generate a historical request link graph.

6. The method of claim 5, wherein the sensitive information masking each field data information in the set of field data information to generate masked field data information comprises:

determining a field type corresponding to the field data information;

responding to the fact that the field type represents the field data information as a text character string type, and performing text segmentation on the field data information to obtain a segmented field data information set, wherein the segmented field data information represents a data segment corresponding to the field data information;

For each segmented field data information in the segmented field data information set, carrying out data shielding on the corresponding position of the segmented field data information in the field data information to obtain shielded field data information;

word embedding encoding is carried out on each piece of shielded field data information in the obtained shielded field data information set so as to generate encoded field data information, and an encoded field data information set is obtained;

for each encoded field data information in the set of encoded field data information, performing the following first processing step:

determining the data reversibility corresponding to the encoded field data information;

determining the information sensitivity of the segmented field data information corresponding to the encoded field data information;

information shielding is carried out on the segmented field data information, of which the corresponding data reversibility and the corresponding information sensitivity meet the screening conditions, in the field data information, so that shielded field data information corresponding to the field data information is obtained;

responding to the fact that the field type represents the field data information as a numerical value type, and performing information masking on the field data information through a preset mask to obtain masked field data information corresponding to the field data information;

And responding to the fact that the field type represents the field data information as a numerical character string type, and shielding the field data information by a preset number of random characters to obtain shielded field data information corresponding to the field data information.

7. The method of claim 6, wherein the generating request hazard level information for the data acquisition request from the historical request link map comprises:

determining a routing node for forwarding the data acquisition request to obtain a target routing node information set;

performing graph traversal on the historical request link graph to generate candidate route path information to obtain a candidate route path information set, wherein a route path corresponding to the candidate route path information comprises a route node corresponding to target route node information in a target route node information set;

for each candidate route path information in the set of candidate route path information, performing the following second processing step:

determining a routing table corresponding to each routing node in at least one routing node included in the candidate routing path information to obtain a routing table sequence;

determining the pollution degree of the routing node corresponding to the target routing node according to the pollution degree of the routing table corresponding to the routing table in the routing table sequence, the node distance between the routing node corresponding to the routing table and the target routing node, and the node communication direction between the routing node corresponding to the routing table and the target routing node, wherein the target routing node is the routing node corresponding to the target routing node information contained in the routing path corresponding to the candidate routing path information;

And determining the request risk degree information according to the obtained route node pollution degree set.

8. A data processing apparatus based on a data acquisition request, comprising:

a request parsing unit configured to parse a data acquisition request in response to detecting the data acquisition request, to obtain request content information, where the data acquisition request is a request for user related information, and the request content information includes: a request field information set, request object identification information and request terminal identification information;

a determining unit configured to determine access record information corresponding to the request object identification information and the request terminal identification information, respectively, to obtain first access record information and second access record information;

a first generation unit configured to generate a history request link map based on the first access record information and the second access record information;

a second generation unit configured to generate request risk degree information for the data acquisition request according to the history request link map;

a masking unit configured to mask the data acquisition request in response to determining that the request hazard level information characterizes the data acquisition request as a first-level hazard level;

The reading unit is configured to read field data information corresponding to the request field information in the request field information set to obtain a field data information set in response to determining that the request risk degree information characterizes the risk level of the data acquisition request as a secondary risk level;

the sensitive information shielding unit is configured to shield the sensitive information of each field data information in the field data information set so as to generate shielded field data information and obtain a shielded field data information set;

and the sending unit is configured to send the masked field data information set to the data terminal corresponding to the request terminal identification information.

9. An electronic device, comprising:

one or more processors;

a storage device having one or more programs stored thereon;

when executed by the one or more processors, causes the one or more processors to implement the method of any of claims 1 to 7.

10. A computer readable medium having stored thereon a computer program, wherein the computer program, when executed by a processor, implements the method of any of claims 1 to 7.