CN113488127B - Sensitivity processing method and system for population health data set - Google Patents

Abstract

The invention discloses a sensitivity processing method and a sensitivity processing system for population health data sets, wherein the sensitivity processing method comprises the following steps: acquiring a population health data set to be evaluated; carrying out sensitive information identification on each feature of the population health data set to obtain a sensitive feature corresponding to each feature, wherein the features comprise metadata features, data item features and data value features; analyzing each sensitive feature to obtain an analysis result corresponding to each sensitive feature; calculating based on the analysis result corresponding to each sensitive feature to obtain a sensitivity comprehensive evaluation result of the population health data set; and generating a sensitivity evaluation report of the population health data set based on the sensitivity comprehensive evaluation result. The invention realizes the discovery, identification, analysis and processing of the sensitive information, meets the application requirements of the sensitivity evaluation of the population health data set through multidimensional analysis, and improves the efficiency and the safety of the subsequent population health data application.

Description

A population health data set sensitivity processing method and system

Technical field

The present invention relates to the field of data processing technology, and in particular to a population health data set sensitivity processing method and system.

Background technique

Population health data sharing plays an important role in improving the quality and effectiveness of medical care, assisting medical management decision-making, improving the level and transparency of medical research, and controlling medical costs. However, population health data involves a large number of identity information and health information of individuals or groups. , genetic information and other highly sensitive information, if leaked during the data sharing process, it will bring varying degrees of security risks and property losses to the country, society or individuals. It can be seen that data sensitivity processing is an important foundation and prerequisite for population health data desensitization processing and data collection and sharing.

Existing research focuses on technologies and solutions for identifying and removing sensitivity information in population health data. There is currently insufficient research on data sensitivity assessment methods. There is no effective assessment method system and a more comprehensive data sensitivity assessment process, and there is a lack of induction and formation system. , comprehensive range of sensitive information on population health data. Moreover, most of the existing sensitivity assessment research focuses on measuring sensitive information at the data record, attribute class, attribute, and attribute value levels, and there is less research on the overall sensitivity assessment at the data set level. Furthermore, most of the existing research methods only calculate the sensitivity level or risk score. The calculation process and results are not interpretable and easy to understand, and lack a form that is understandable by humans and machines. It can be seen that the existing population health data sensitivity processing cannot meet the actual population health data sensitivity assessment needs, and reduces the security of subsequent population health data sharing and data processing efficiency.

Contents of the invention

In response to the above problems, the present invention provides a population health data set sensitivity processing method and system, which can meet the actual population health data assessment needs and improve the efficiency and security of data application.

In order to achieve the above objects, the present invention provides the following technical solutions:

A method for sensitivity processing of population health data sets, including:

Obtain the population health data set to be assessed;

Perform sensitive information identification on each feature of the population health data set to obtain the sensitive features corresponding to each feature, where the features include metadata features, data item features and data value features;

Analyze each of the sensitive features and obtain the analysis results corresponding to each sensitive feature;

Calculate based on the analysis results corresponding to each sensitive feature to obtain a comprehensive sensitivity assessment result of the population health data set;

Based on the comprehensive sensitivity assessment result, a sensitivity assessment report of the population health data set is generated.

Optionally, the step of identifying sensitive information on each feature of the population health data set and obtaining the sensitive feature corresponding to each feature includes:

Obtain each feature dimension of the population health data, where the feature dimensions include: metadata features, data item features and data value features;

Perform sensitive information identification on the metadata features based on target determination rules to obtain the metadata sensitive features, and the target determination rules are determined based on the annotated metadata;

Based on the sensitive information type dictionary, determine whether the data item characteristics include sensitive information type item words, and if so, obtain the data item sensitive characteristics;

The data value of the sensitive feature of the data item is identified. If the data value obtained by the identification meets the identification condition corresponding to the sensitive information value, the sensitive feature of the data value is obtained.

Optionally, analyzing each sensitive feature to obtain analysis results corresponding to each sensitive feature includes:

Analyze the data quantity, time span, object characteristics, subject type and number of subjects of the metadata sensitive features, and obtain metadata sensitive feature analysis results;

Analyze the sensitive information type characteristics and sensitive information quantity characteristics of the data item sensitive characteristics, and obtain the data item sensitive characteristics analysis results;

Analyze the value quantity characteristics, value distribution characteristics and value accuracy characteristics of the data value sensitive characteristics to obtain the data value sensitive characteristics analysis results.

Optionally, the calculation is performed based on the analysis results corresponding to each sensitive feature to obtain a comprehensive sensitivity assessment result of the population health data set, including:

Based on the metadata sensitive feature analysis results, calculate and obtain the leakage loss degree value;

Based on the data item sensitive feature analysis results and the data value sensitive feature analysis results, calculate the identification degree value;

Based on the leakage loss degree value and the identification degree value, a comprehensive sensitivity assessment result of the population health data set is calculated.

Optionally, generating a sensitivity assessment report of the population health data set based on the comprehensive sensitivity assessment result includes:

determining basic information of said population health data set;

Based on the comprehensive sensitivity assessment results, determine the information to be displayed of the sensitivity assessment results, where the displayed information includes the degree of data set expression, the degree of data set leakage loss, the data set sensitivity reference value and sensitive feature data;

Based on the comprehensive sensitivity assessment results, determine sensitive feature marking information;

Generate a sensitivity assessment report of the population health data set based on the basic information, the information to be displayed, and the sensitive feature mark information.

A population health data set sensitivity processing system, including:

The acquisition unit is used to acquire the population health data set to be evaluated;

An identification unit, used to identify sensitive information for each feature of the population health data set, and obtain the sensitive features corresponding to each feature, where the features include metadata features, data item features and data value features;

An analysis unit is used to analyze each of the sensitive features and obtain analysis results corresponding to each sensitive feature;

A computing unit configured to perform calculations based on the analysis results corresponding to each sensitive feature to obtain a comprehensive sensitivity assessment result of the population health data set;

A generating unit, configured to generate a sensitivity assessment report of the population health data set based on the comprehensive sensitivity assessment result.

Optionally, the identification unit includes:

The first acquisition subunit is used to acquire each feature dimension of the population health data, where the feature dimensions include: metadata features, data item features and data value features;

The first identification subunit is used to identify sensitive information of the metadata features based on target determination rules to obtain the metadata sensitive features. The target determination rules are determined based on the annotated metadata;

The first determination subunit is used to determine whether the data item characteristics include sensitive information type item words based on the sensitive information type dictionary, and if so, obtain the data item sensitive characteristics;

The second identification subunit is used to identify the data value of the sensitive feature of the data item. If the data value obtained by identification meets the identification condition corresponding to the sensitive information value, the sensitive feature of the data value is obtained.

Optionally, the analysis unit includes:

The first analysis subunit is used to analyze the data quantity, time span, object characteristics, subject type and number of subjects of the metadata sensitive features, and obtain metadata sensitive feature analysis results;

The second analysis subunit is used to analyze the sensitive information type characteristics and sensitive information quantity characteristics of the data item sensitive characteristics, and obtain the data item sensitive characteristics analysis results;

The third analysis subunit is used to analyze the value quantity characteristics, value distribution characteristics and value accuracy characteristics of the data value sensitive characteristics, and obtain the data value sensitive characteristics analysis results.

Optionally, the computing unit includes:

The first calculation subunit is used to calculate and obtain the leakage loss degree value based on the metadata sensitive feature analysis results;

The second calculation subunit is used to calculate the identification degree value based on the data item sensitive feature analysis result and the data value sensitive feature analysis result;

The third calculation subunit is used to calculate the comprehensive sensitivity assessment result of the population health data set based on the leakage loss degree value and the identification degree value.

Optionally, the generating unit includes:

The second determination subunit is used to determine the basic information of the population health data set;

The third determination subunit is used to determine the information to be displayed of the sensitivity evaluation result based on the comprehensive sensitivity evaluation result. The display information includes the degree of data set expression, the degree of data set leakage loss, the data set sensitivity reference value and Sensitive characteristic data;

The fourth determination subunit is used to determine sensitive feature mark information based on the comprehensive sensitivity assessment result;

Generating a subunit, configured to generate a sensitivity assessment report of the population health data set based on the basic information, the information to be displayed, and the sensitive feature mark information.

Compared with the existing technology, the present invention provides a population health data set sensitivity processing method and system, which includes: obtaining a population health data set to be evaluated; identifying sensitive information on each feature of the population health data set, Obtain the sensitive features corresponding to each feature, which include metadata features, data item features and data value features; analyze each of the sensitive features to obtain the analysis results corresponding to each sensitive feature; based on each sensitive feature The corresponding analysis results are calculated to obtain a comprehensive sensitivity assessment result of the population health data set; based on the comprehensive sensitivity assessment result, a sensitivity assessment report of the population health data set is generated. The invention realizes the discovery, identification, analysis and processing of sensitive information, meets the application requirements of sensitivity assessment of population health data sets through multi-dimensional analysis, and improves the efficiency and security of subsequent population health data applications.

Description of the drawings

In order to explain the embodiments of the present invention or the technical solutions in the prior art more clearly, the drawings needed to be used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings in the following description are only These are embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on the provided drawings without exerting creative efforts.

Figure 1 is a schematic flow chart of a population health data set sensitivity processing method provided by an embodiment of the present invention;

Figure 2 is an architecture diagram of a population health data sensitivity assessment method provided by an embodiment of the present invention;

Figure 3 is a schematic diagram of metadata feature information provided by an embodiment of the present invention;

Figure 4 is a schematic diagram of a data sensitivity assessment dimension provided by an embodiment of the present invention;

Figure 5 is a schematic diagram of a sensitive data degree calculation process provided by an embodiment of the present invention;

Figure 6(a)-Figure 6(c) are schematic diagrams of a data sensitivity assessment report provided by an embodiment of the present invention;

Figure 7 is a schematic structural diagram of a population health data set sensitivity processing system provided by an embodiment of the present invention.

Detailed ways

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts fall within the scope of protection of the present invention.

The terms “first” and “second” in the description and claims of the present invention and the above-mentioned drawings are used to distinguish different objects, rather than describing a specific sequence. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units is not configured with the listed steps or units, but may include steps or units that are not listed.

In the embodiment of the present invention, a population health data set sensitivity processing method is provided, which is a data set sensitivity assessment method oriented to population health data sharing needs, and is used for the discovery, identification, analysis and analysis of sensitive information shared by population health data. Provide support for processing and effectively implement hierarchical management and secure sharing of population health data through computer assistance.

Refer to Figure 1, which is a schematic flow chart of a method for processing sensitivity of a population health data set according to an embodiment of the present invention. The method includes:

S101. Obtain the population health data set to be evaluated.

The population health data set to be evaluated refers to the original population health data set, which has not undergone any processing. Since population health data involves a large number of highly sensitive information such as identity information, health information, and genetic information of individuals or groups, if it is leaked during the data sharing process, it will bring varying degrees of security risks and property losses to the country, society, or individuals. . Therefore, sensitivity processing needs to be performed in the embodiment of the present invention to ensure the security of the population health data set in subsequent applications such as data sharing.

S102. Identify sensitive information on each feature of the population health data set, and obtain the sensitive features corresponding to each feature.

S103. Analyze each sensitive feature and obtain the analysis results corresponding to each sensitive feature.

In the embodiment of the present invention, sensitive information is identified and analyzed from multiple dimensions of the population health data set. The corresponding multiple dimensions are reflected in various features of the population health data set. The features include metadata features, data items Features and data value features.

The identification of sensitive information in population health data sets is mainly based on the organizational structure of the data set. The data set includes metadata describing the data, data items and data values, and identification of sensitive information features at different levels. In the embodiment of the present invention, based on the defined categories of sensitive information in population health data, it is detected whether the data set contains sensitive information, what types it contains, what sensitive characteristics it has, and the location of the sensitive information. Different sensitive information identification processes are used for different data set metadata, data items and data values.

In one embodiment of the present invention, 12 metadata features to be identified are determined; the identification of data item features refers to detecting which data items in the table data set corresponding to the population health data set belong to the sensitive information types determined by the present invention. , that is, it mainly detects relational data tables, that is, table types where large sections of text do not appear in a cell; identification of data value characteristics, on the one hand, determines the data columns in which "sensitive information types" have been identified in the relational data table , the number of non-null values of data values, distribution characteristics, and the accuracy of certain special data types, etc. On the other hand, for non-relational data tables, the table may contain unstructured text information, and it is necessary to include in this text information Identify specific sensitive information and conduct subsequent statistical analysis. It should be noted that the specific types and types of metadata features as well as the identification of data items and data values need to be determined based on actual needs, and the present invention does not limit this.

The sensitive characteristics of the present invention refer to a collection of a series of interrelated indicators that scientifically, concretely and refine the factors that affect data sensitivity, laying the foundation for data sensitivity assessment, and using them to describe and reveal the characteristics in the data set. Sensitive information status, so as to facilitate data submitters, data managers and data users to understand the sensitivity level of population health data sets more objectively and impartially. The sensitive feature analysis of the present invention starts from three dimensions: metadata, data items, and data values, including sensitive information type, sensitive information value, data subject (subject type, subject volume), and overall description information (data amount, data time, data Main body type, etc.) 4 major factors, the specific processing methods will be explained in subsequent embodiments of the present invention.

S104. Calculate based on the analysis results corresponding to each sensitive feature to obtain a comprehensive sensitivity assessment result of the population health data set.

The sensitivity of a data set is determined by two main factors, namely the degree of identification and the degree of leakage loss, where the degree of leakage loss is determined by the type of data subject and the amount of data. Both the degree of identification and the degree of leakage loss are positively related to data sensitivity. Data sensitivity calculation is based on the results of sensitive information identification and feature analysis. It is mainly divided into three links: identification degree assessment (determining the identification degree value), leakage loss assessment (determining the leakage loss degree value), and sensitivity comprehensive calculation, and finally obtains the characterization data. The sensitivity reference value of the set's sensitive information content level is the result of the comprehensive sensitivity assessment of the population health data set.

S105. Based on the comprehensive sensitivity assessment result, generate a sensitivity assessment report of the population health data set.

The sensitivity assessment report usually needs to include a unique detection number so that the authenticity of the sensitivity assessment report can be determined. In addition, it also needs to include the sensitivity detection time. The specific content can include the basic information of the population health data set and the data sensitivity. The specific contents of evaluation results, data set sensitive feature analysis, sensitive information location marking, etc. can be determined based on actual needs, and the present invention does not limit this.

Embodiments of the present invention provide a method for processing the sensitivity of a population health data set, which includes: obtaining a population health data set to be evaluated; identifying sensitive information for each feature of the population health data set, and obtaining the sensitive information corresponding to each feature. Features, the features include metadata features, data item features and data value features; analyze each of the sensitive features to obtain the analysis results corresponding to each sensitive feature; perform calculations based on the analysis results corresponding to each sensitive feature, A comprehensive sensitivity assessment result of the population health data set is obtained; and a sensitivity assessment report of the population health data set is generated based on the comprehensive sensitivity assessment result. The invention realizes the discovery, identification, analysis and processing of sensitive information, meets the application requirements of sensitivity assessment of population health data sets through multi-dimensional analysis, and improves the efficiency and security of subsequent population health data applications.

Refer to Figure 2, which is an architecture diagram of a population health data sensitivity assessment method provided by an embodiment of the present invention. This architecture mainly includes data sensitive information identification, multi-dimensional sensitive feature analysis, sensitivity assessment calculation and assessment report generation. That is, the input to the architecture is the population health data set to be assessed, and the output is the sensitive data set of the data set. degree evaluation report.

The identification of sensitive information in population health data sets is mainly based on the organizational structure of the data set. The data set includes metadata that describes the data, data items and data values that identify sensitive information features at different levels. Based on the defined categories of sensitive information in population health data, the present invention detects whether the data set contains sensitive information, what types it contains, what sensitive characteristics it has, and the location of the sensitive information. Use different sensitive information identification methods for different data set metadata, data items and data values.

Correspondingly, in one embodiment of the present invention, the step of identifying sensitive information on each feature of the population health data set to obtain the sensitive features corresponding to each feature includes:

Obtain each feature dimension of the population health data, where the feature dimensions include: metadata features, data item features and data value features;

Perform sensitive information identification on the metadata features based on target determination rules to obtain the metadata sensitive features, and the target determination rules are determined based on the annotated metadata;

Based on the sensitive information type dictionary, determine whether the data item characteristics include sensitive information type item words, and if so, obtain the data item sensitive characteristics;

The data value of the sensitive feature of the data item is identified. If the data value obtained by the identification meets the identification condition corresponding to the sensitive information value, the sensitive feature of the data value is obtained.

Different methods are used to identify metadata characteristics, data item characteristics and data value characteristics. Specifically, metadata characteristics are identified through target determination rules, that is, rules that need to be set; data item characteristics can be identified through sensitive information type dictionaries. Identification: After obtaining the identified sensitive characteristics of the data item, identify its corresponding data value and determine whether the corresponding data value belongs to leaked sensitive information.

Specifically, in the embodiment of the present invention, 12 items of metadata feature information to be identified are determined. Refer to Figure 3, which is a schematic diagram showing the metadata feature information provided by the embodiment of the present invention. Metadata feature identification is divided into two parts. Dataset-based metadata annotation. The four metadata characteristics, such as the number of records, time span, time novelty, and whether it is a human heritage resource, are respectively obtained from the "number of data records", "time range", and "whether it involves human heritage resources" in the "Basic Information" of the population health data set. Resources".

Another part of the metadata feature identification includes "data subject age characteristics", "aggregated type and individual type data", "whether it contains biometric data", "whether it involves clinical records", "whether it involves sensitive clinical records", "whether Eight characteristics, including "financial-related data", "number of entities", and "number of sensitive information types", need to be set for determination. The basis for rule judgment mainly comes from "data set name", "keywords", "data description" and other related information. Among them, the number of data subjects, the number of sensitive information types, etc. need to be identified before the relevant content of data items and data values is synthesized. calculate.

The identification of data item characteristics refers to detecting which data items in the tabular data set belong to the type of sensitive information framed in this study, mainly to detect which data items in the tabular data set corresponding to the population health data set belong to the type of sensitive information framed in this study. Relational data table, that is, a table type that does not contain large sections of text in one cell. This study is oriented to the characteristics of population health data sets and temporarily selects 44 types of sensitive information for identification.

For relational tabular data, two factors, data item characteristics and data value characteristics, are considered when identifying sensitive items, based on top-down and bottom-up methods. Specifically, top-down means to first detect information such as data item (field/variable) name, meaning/annotation, and data dictionary, and based on the "sensitive information type dictionary", determine whether a sensitive information type item word appears. The entry word determines the type of sensitive information corresponding to the column. For example, the sensitive information type "name", the entry word includes "my name, patient's name, name of immediate family member, name of family member, name of unit contact person, person who stated medical history , name, patient, participant, XM, The characteristics of the value, if they match, continue, if not, mark it as "pending status". The bottom-up approach means that if the corresponding item word does not appear in the field name and its annotation, the first 50 instances will be read and based on the "sensitive information value dictionary" or "regular expression rule base" to determine whether the instance is It is the value under the sensitive information type, and what sensitive information value it is. Based on this, it is summarized upward to what type of sensitive information the column belongs to, and the field name of the column is included in the "sensitive information type dictionary" to complete the sensitive information. Extension of type dictionary. For example, if the sensitive information type dictionary includes sensitive words A, B, and C, you can identify that A, B, and C are sensitive words. Based on the regular expression rule base, it is found that D is also a sensitive word, and D can also be added to the sensitive information. In the type dictionary, the dictionary is further expanded, and then through the expanded sensitive information type dictionary, it can be recognized that D is also a sensitive word.

Identification of data value characteristics, on the one hand, determines the number of non-null values, distribution characteristics, and accuracy of certain special data types in data columns that have been identified as "sensitive information types" in the relational data table. To determine how accurate the time information is to the year, month, day, etc.; whether the location information is accurate to the province, city, county (district), street, etc.; whether the age information is accurate to a specific age such as 14 years old or just The age range is 10-20 years old; the disease information is to determine whether it is a sensitive disease and which sensitive disease category it belongs to: mental disorders, sex and fertility, genetics, and socially sensitive infectious diseases. On the other hand, for non-relational data tables, the table may contain unstructured text information. Specific sensitive information values must be identified in this text information and subsequent statistical analysis must be performed.

Sensitive information can be divided into three categories according to data type, including numeric types such as ID number, phone number, and postal code; date types such as date of birth, medical action date, and named entity types such as name, address, and medical institution. This article uses regular expression rules to identify sensitive information of numeric types and date types. See Table 1 for rule examples. In addition, although information such as ID number can be easily identified based on the above regular expression, it is easily confused with the image encoding of the electrocardiogram. In order to ensure the accuracy of identifying digital type sensitive information, this article uses regular expressions to filter out the candidate set, and then further filters out digital type protected health information through contextual semantic judgment and removes it. If images, medicines appear in the field description, , it will be deleted from the candidate result set. In addition, relative time may also appear in population health data, such as last month, last winter, etc. Since attackers cannot obtain specific dates through relative time, this type of information will not be processed in this study.

Table 1 Example of regular expression for sensitive information identification

For data of named entity types such as addresses and medical institution names, this article uses a dictionary-based method to identify and optimize based on an AC automaton (Aho-Corasick automaton). For the identification of disease-sensitive information, this article builds a sensitive information dictionary by reusing the Chinese version of the International Classification of Diseases (ICD) and Chinese Medical Subject Headings (CMesh), including mental disorders, sexual There are four categories of sensitive diseases related to fertility, genetic diseases, and socially sensitive infectious diseases. Currently, it contains 405 subject headings and their corresponding headings, and the application can be expanded in the future; for the identification of the name of the data subject, the " "Table of Common Chinese Surnames"; for the identification of ethnic sensitive information types, a Chinese ethnic list and abbreviation dictionary were constructed; for marital status, occupation, religious belief, and education, dictionaries were constructed to represent the corresponding states; for the identification of addresses, " "National Five-Level Administrative Region Division Table", which contains 747,748 records; for the identification of medical institution names, the Chinese Medical and Health Institutions Dictionary was used, including 49,582 medical and health institutions of various levels across the country.

In one embodiment of the present invention, the analysis of each sensitive feature to obtain the analysis results corresponding to each sensitive feature includes:

Analyze the data quantity, time span, object characteristics, subject type and number of subjects of the metadata sensitive features, and obtain metadata sensitive feature analysis results;

Analyze the sensitive information type characteristics and sensitive information quantity characteristics of the data item sensitive characteristics, and obtain the data item sensitive characteristics analysis results;

Analyze the value quantity characteristics, value distribution characteristics and value accuracy characteristics of the data value sensitive characteristics to obtain the data value sensitive characteristics analysis results.

In the present invention, sensitive features refer to a collection of a series of interrelated indicators that scientifically, concretely and refine the factors that affect data sensitivity, laying the foundation for data sensitivity assessment, and using them to describe and reveal data. Concentrate sensitive information to facilitate data submitters, data managers and data users to understand the sensitivity level of population health data sets more objectively and impartially. Refer to Figure 4, which is a schematic diagram of data sensitivity assessment dimensions provided by an embodiment of the present invention. The sensitive feature analysis in the present invention starts from three dimensions: metadata, data items, and data values, and includes sensitive information types, sensitive information values, and data. There are four main factors: subject (subject type, subject volume) and overall description information (data volume, data time, data subject type, etc.).

The metadata dimension analyzes 12 metadata characteristics, including the number of data set records, time span, time novelty, age characteristics of data subjects, aggregate type and individual type data, whether human genetic resources are involved, whether biometric data is involved, whether Involves clinical records, whether sensitive clinical records are involved, whether financial-related data is involved, the number of data subjects involved, and the number of sensitive information types. Data sensitivity is a measure of the content of sensitive information in a data set, and quantity is an intuitive reflection of the "content." Quantitative factors include the number of data records and the number of data subjects involved. The time factor is one of the factors that affects data sensitivity, including time span and time novelty. The time span is similar to the number of records. The former is in the quantity dimension, while the latter reflects the content of sensitive information in the time dimension. Data is time-sensitive, and the data sensitivity in different aging periods is different. Generally speaking, the longer the time, the lower the data sensitivity, and the closer the time, the higher the data sensitivity. For example, some data sets have to wait two or more years. Disclosure of data will be allowed after years when sensitivity is reduced. The most recent year involved in the data set is used as the temporal novelty. The higher the temporal novelty, the higher the temporal novelty is positively correlated with the data sensitivity. In addition, whether sensitivity is related to people, the data subjects involved in the data set are an important factor affecting the sensitivity of the data. Data Subject refers to a natural person whose personal information is disclosed as personal data on the Internet, either explicitly or implicitly. The objects of data include individual objects such as data subjects (individual type data), and group objects (aggregated data). Individual-oriented data is more sensitive than group-type data; in addition, the sensitivity of different types of data subjects The degree is different. For example, my country's "Personal Information Protection Law" requires strengthening the protection of minors' information. Other special data subject types include the elderly, pregnant women, etc. For example, MIMIC transforms the age of the elderly to reduce data sensitivity.

The data item dimension analyzes 9 data item characteristics, including the number of direct identification information types, the number of indirect identification information types, the number of network identity identification information types, the number of communication information types, the number of location information types, the number of time information types, and the types of sensitive diseases. Number, number of medical insurance payment information types, number of health medical record identification information types, etc. The dimensional characteristics of data items are mainly "the number of certain sensitive information types". For example, "the number of directly identified information types" refers to how many of the "name, ID number, birth certificate number, social security number, passport number, etc." appear in the data set. A specific direct identification information, a list of sensitive information types.

The data item dimension reflects the content framework of the data set, that is, it reflects what types of sensitive information the data set contains from the content level. The sensitive information involved in population health data can be divided into identity information (direct identity information, indirect identity information, network identity information), biometric information, communication information, location information, time information, health and medical information, etc. according to the content. Whether a data set contains a certain type of sensitive information and which specific types of sensitive information it contains is an important factor in measuring the sensitivity of a data set. Among them, identity information is highly identifiable and can associate various information in the data set with its data subject; biometric information includes genetic data, facial recognition features, fingerprints, palm prints, iris information, etc., such as With the widespread application of next-generation sequencing technology in medical research and the rapid development of clinical genomics, it has become possible to infer a person's appearance characteristics through genome sequencing results. The genetic information of individuals and their families has become a need in research, medical care, and data sharing. Sensitive information that is valued.

The data value dimension analyzes 14 data item characteristics, including direct identification information value, indirect identification information value, network identity identification information value, communication information value, communication information masking processing degree, location information value, location information Accuracy, birth time value, birth time accuracy, other behavior time values, other behavior time accuracy, sensitive disease values, medical insurance payment information type values, medical insurance payment information type values, etc. The "number of values of a certain information" refers to the number of specific values that appear in the type of "certain information", which can be calculated from the sensitive information identification results. The "accuracy of a certain information", such as the accuracy of birth date, refers to the accuracy to the year/month/ Days and so on.

The reason for analyzing sensitive features in the data value dimension is that sometimes even though two data sets have the same quantity, time, subject, and type characteristics at the metadata level and contain the same sensitive information type at the data item level, the two data sets The filling degree of the data set at the instance level is different, such as the degree of missing values under the same information type items, the accuracy of special information type values such as dates and addresses, and the number of data subjects involved in each sensitive information type. There are still This may result in data sets that may have different levels of sensitivity.

In another embodiment of the present invention, the calculation is performed based on the analysis results corresponding to each sensitive feature to obtain a comprehensive sensitivity assessment result of the population health data set, including:

Based on the metadata sensitive feature analysis results, calculate and obtain the leakage loss degree value;

Based on the data item sensitive feature analysis results and the data value sensitive feature analysis results, calculate the identification degree value;

Based on the leakage loss degree value and the identification degree value, a comprehensive sensitivity assessment result of the population health data set is calculated.

The sensitivity of a data set is determined by two main factors, namely the degree of identification and the degree of leakage loss, where the degree of leakage loss is determined by the type of data subject and the amount of data. Both the degree of identification and the degree of leakage loss are positively related to data sensitivity. Data sensitivity calculation is based on the results of sensitive information identification and feature analysis. It is mainly divided into three links: identification degree assessment (determining the identification degree value), leakage loss assessment (determining the leakage loss degree value), and sensitivity comprehensive calculation, and finally obtains the characterization data. Set the sensitivity reference value for the content level of sensitive information.

Refer to Figure 5, which is a schematic diagram of a sensitive data degree calculation process provided by an embodiment of the present invention. The sensitive data degree calculation process includes: calculating the identification degree and the leakage loss degree based on the received sensitive feature analysis results. Among them, the calculation of the identification degree includes: judging whether it is aggregated data through the calculation of the identification degree. If so, the identification is level 1; if not, judging whether it contains direct identification. If so, identifying level 4. If not, quantitatively calculating the risk of re-identification. , based on the calculation results, determine whether the risk is greater than the threshold. If so, it will be marked as level three. If not, it will be marked as level 2. The identification degree score will be obtained through the above identification levels. On the other hand, the calculation of the degree of leakage loss includes: judging whether it is biometric data, if so, directly calculating the comprehensive quantity, if not, judging whether it is financial-related data, if so, directly calculating the comprehensive quantity, if not, judging whether It is clinical data. If not, the comprehensive quantity calculation is performed directly. If yes, it is judged whether it is special clinical data, and then the comprehensive quantity calculation is performed. Based on the comprehensive quantity calculation result, the sensitive leakage loss degree score is obtained. Based on the identification degree score and the sensitive leakage loss degree score, the comprehensive sensitivity score of the population health data set is calculated.

In one implementation of the embodiment of the present invention, generating a sensitivity assessment report of the population health data set based on the comprehensive sensitivity assessment result includes:

determining basic information of said population health data set;

Based on the comprehensive sensitivity assessment results, determine the information to be displayed of the sensitivity assessment results, where the displayed information includes the degree of data set expression, the degree of data set leakage loss, the data set sensitivity reference value and sensitive feature data;

Based on the comprehensive sensitivity assessment results, determine sensitive feature marking information;

Generate a sensitivity assessment report of the population health data set based on the basic information, the information to be displayed, and the sensitive feature mark information.

Specifically, the data sensitivity assessment report is designed to contain a unique detection number to prevent authenticity, and to indicate the detection time. The main content mainly includes 4 parts:

(1) Detect basic information of the data set. Including the English name, scientific and technological resource identifier, data resource creation organization, and data resource creator, a brief introduction to the main content and source of the data set.

(2) Data sensitivity assessment results. The sensitivity of the data set is mainly determined by the degree of identification of the data set and the degree of data leakage loss. The report displays the identification degree of the data set and the corresponding identification degree value, and displays the subject type, data volume and corresponding identification level of the data set. The leakage loss degree value is displayed, and the complete evaluation reference table is displayed, so that the report readers can have a more intuitive and comprehensive understanding of the identification degree and leakage loss degree of the data set. Finally, the report displays the specific sensitivity reference value of the data set, and indicates that the reference value range is [0.05-1]. Report readers can have an idea of the sensitivity of the data set based on the position of the reference value in the range and combined with manual review. A mastery. In addition, the report also identifies the data submitter's original annotation of "whether the data set contains sensitive information" to verify the correctness of the annotation.

(3) Analysis of sensitive features of the data set. The sensitive characteristics of the data set include three dimensions: metadata, data items, and data values. The metadata dimensions include 12 items, such as the number of records, time span, and the number of involved subjects. The sensitivity of the data items and data value dimensions is combined and displayed, mainly including various types of data. There are 23 sensitive characteristics including the number of sensitive information types, the number of various types of sensitive information values, and the accuracy of various types of special sensitive information. The report aims to allow data submitters and data managers to understand and grasp the sensitive information in this data set through the explanation of the above characteristics.

(4) Data information location marking. This part mainly identifies the location, presentation method, identification samples and accuracy of sensitive information in the data set, in order to provide a reference for possible subsequent desensitization processing operations of the data set.

Embodiments of the present invention provide a population health data set sensitivity processing method, which is oriented to population health data sharing needs. The constructed sensitivity evaluation method can measure the type, characteristics, distribution, and content of its own sensitive information at the data set level. Use this method as a metric to guide the discovery, identification, detection, hierarchical management of data sharing sensitive information and provide support for subsequent processing. This invention includes a complete set of data set sensitivity assessment methods including four key links: sensitive information identification, sensitive feature analysis, sensitivity calculation and assessment report generation. It designs a dictionary library and rule library oriented to the needs of sensitive information identification, and automatically scans and generates data. Centralize the location marking of sensitive information and implement feature analysis. Based on the feature scanning results of sensitive information, the calculation and evaluation of sensitivity are realized, providing computer-aided support for data sensitive information detection, review, hierarchical management, etc.

The following is a specific application example to illustrate the embodiment of the present invention. The population health data set to be evaluated is the "XXX Psychiatric Case Data Set". Since this type of data is not completely public data, in the embodiment of the present invention for convenience Note that "XXX" is used in the name to represent relevant information. This data set is not a typical relational data table. Although it is in tabular form, it contains unstructured text information. This is an example to demonstrate the sensitivity of this type of data set. Evaluation Report. Because the sensitive information contained in it should not be leaked, sample data is not displayed in this data set. This data set includes the chief complaints, current history, past history, diagnosis, treatment plan and other information of 270 psychiatric patients.

The data sensitivity assessment report of the "XXX Psychiatric Case Data Set" is shown in Figure 6(a)-Figure 6(c). Some information has been obscured in the presentation of the assessment report. It does not contain direct identity identifiers, but contains quasi-identifiers such as gender, age, marital status, and nationality. The re-identification risk of this data set is less than 0.5, so the identification level of this data set is judged to be level 2, and the identification degree value is 0.3. The data subjects of this data set involve minors and the elderly, and belong to the subject of mental disorders. Combined with the data volume of 270<500 items, according to the leakage loss assessment reference table, the leakage loss reference value is assigned a value of 0.5. Finally, the identification degree value and the leakage loss degree value are added and normalized to obtain a sensitivity reference value of 0.4. The average single record in this data set contains a large amount of sensitive information, but the overall number of data records is small, so the data sensitivity reference value that characterizes the content of the entire data set is not very high.

What is special about this type of data set is the sensitive information location marking part. This data set is not a typical relational data form. A cell position determined by the number of record rows and columns may contain a large piece of text information, so sensitive information needs to be When positioning, record the number of data record rows, field names, and starting positions in the cell (such as start: 468, end: 477) of the sensitive information (such as discharge date 2019-12-14) in the data set. .

Based on the foregoing embodiments, embodiments of the present invention also provide a population health data set sensitivity processing system, see Figure 7, including:

The acquisition unit 10 is used to acquire the population health data set to be evaluated;

The identification unit 20 is used to identify sensitive information on each feature of the population health data set, and obtain the sensitive features corresponding to each feature, where the features include metadata features, data item features and data value features;

The analysis unit 30 is used to analyze each of the sensitive features and obtain the analysis results corresponding to each sensitive feature;

The calculation unit 40 is configured to perform calculations based on the analysis results corresponding to each sensitive feature to obtain a comprehensive sensitivity assessment result of the population health data set;

The generating unit 50 is configured to generate a sensitivity assessment report of the population health data set based on the comprehensive sensitivity assessment result.

Further, the identification unit includes:

The first acquisition subunit is used to acquire each feature dimension of the population health data, where the feature dimensions include: metadata features, data item features and data value features;

The first identification subunit is used to identify sensitive information of the metadata features based on target determination rules to obtain the metadata sensitive features. The target determination rules are determined based on the annotated metadata;

The first determination subunit is used to determine whether the data item characteristics include sensitive information type item words based on the sensitive information type dictionary, and if so, obtain the data item sensitive characteristics;

The second identification subunit is used to identify the data value of the sensitive feature of the data item. If the data value obtained by identification meets the identification condition corresponding to the sensitive information value, the sensitive feature of the data value is obtained.

Further, the analysis unit includes:

The first analysis subunit is used to analyze the data quantity, time span, object characteristics, subject type and number of subjects of the metadata sensitive features, and obtain metadata sensitive feature analysis results;

The second analysis subunit is used to analyze the sensitive information type characteristics and sensitive information quantity characteristics of the data item sensitive characteristics, and obtain the data item sensitive characteristics analysis results;

The third analysis subunit is used to analyze the value quantity characteristics, value distribution characteristics and value accuracy characteristics of the data value sensitive characteristics, and obtain the data value sensitive characteristics analysis results.

Further, the computing unit includes:

The first calculation subunit is used to calculate and obtain the leakage loss degree value based on the metadata sensitive feature analysis results;

The second calculation subunit is used to calculate the identification degree value based on the data item sensitive feature analysis result and the data value sensitive feature analysis result;

The third calculation subunit is used to calculate the comprehensive sensitivity assessment result of the population health data set based on the leakage loss degree value and the identification degree value.

Further, the generating unit includes:

The second determination subunit is used to determine the basic information of the population health data set;

The third determination subunit is used to determine the information to be displayed of the sensitivity evaluation result based on the comprehensive sensitivity evaluation result. The display information includes the degree of data set expression, the degree of data set leakage loss, the data set sensitivity reference value and Sensitive characteristic data;

The fourth determination subunit is used to determine sensitive feature mark information based on the comprehensive sensitivity assessment result;

Generating a subunit, configured to generate a sensitivity assessment report of the population health data set based on the basic information, the information to be displayed, and the sensitive feature mark information.

Embodiments of the present invention provide a population health data set sensitivity processing system, which includes: an acquisition unit obtains a population health data set to be evaluated; an identification unit identifies sensitive information on each feature of the population health data set, and obtains each feature of the population health data set. Sensitive features corresponding to the features, the features include metadata features, data item features and data value features; the analysis unit analyzes each of the sensitive features and obtains the analysis results corresponding to each sensitive feature; the calculation unit is based on each sensitive feature The analysis results corresponding to the features are calculated to obtain a comprehensive sensitivity assessment result of the population health data set; the generation unit generates a sensitivity assessment report of the population health data set based on the comprehensive sensitivity assessment result. The present invention realizes the discovery, identification, analysis and processing of sensitive information, improves the application requirements for sensitivity assessment of population health data sets through multi-dimensional analysis, and improves the efficiency and safety of subsequent population health data applications.

Based on the foregoing embodiments, embodiments of the present application provide a computer-readable storage medium. The computer-readable storage medium stores one or more programs. The one or more programs can be executed by one or more processors to implement Steps for sensitivity processing of population health datasets as described above.

Based on the foregoing embodiments, embodiments of the present invention also provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the population is implemented. Steps in the health dataset sensitivity approach.

Each embodiment in this specification is described in a progressive manner. Each embodiment focuses on its differences from other embodiments. The same and similar parts between the various embodiments can be referred to each other. As for the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple. For relevant details, please refer to the description in the method section.

The above description of the disclosed embodiments enables those skilled in the art to make or use the present invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the generic principles defined herein may be practiced in other embodiments without departing from the spirit or scope of the invention. Thus, the present invention is not intended to be limited to the embodiments shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims (8)

1. A method for sensitivity processing of a population health dataset, comprising:

acquiring a population health data set to be evaluated;

carrying out sensitive information identification on each feature of the population health data set to obtain a sensitive feature corresponding to each feature, wherein the features comprise metadata features, data item features and data value features;

analyzing each sensitive feature to obtain an analysis result corresponding to each sensitive feature;

calculating based on the analysis result corresponding to each sensitive feature to obtain a sensitivity comprehensive evaluation result of the population health data set;

generating a sensitivity evaluation report of the population health data set based on the sensitivity comprehensive evaluation result;

the identifying the sensitive information of each feature of the population health data set to obtain the sensitive feature corresponding to each feature includes:

acquiring each characteristic dimension of the population health data, wherein the characteristic dimensions comprise: metadata features, data item features, and data value features;

performing sensitive information identification on the metadata features based on target judgment rules to obtain metadata sensitive features, wherein the target judgment rules are determined based on marked metadata;

Based on the sensitive information type dictionary, determining whether the data item features comprise sensitive information type item words, and if so, obtaining the data item sensitive features;

and identifying the data value of the data item sensitive characteristic, and if the data value obtained by identification meets the identification condition corresponding to the sensitive information value, obtaining the data value sensitive characteristic.

2. The method of claim 1, wherein analyzing each of the sensitive features to obtain an analysis result corresponding to each of the sensitive features comprises:

analyzing the data quantity, the time span, the object characteristics, the theme type and the main body quantity of the metadata sensitive characteristics to obtain metadata sensitive characteristic analysis results;

analyzing the sensitive information type characteristics and the sensitive information quantity characteristics of the sensitive characteristics of the data items to obtain a data item sensitive characteristic analysis result;

and analyzing the value quantity characteristic, the value distribution characteristic and the value precision degree characteristic of the data value sensitive characteristic to obtain a data value sensitive characteristic analysis result.

3. The method of claim 2, wherein the calculating based on the analysis result corresponding to each sensitive feature to obtain the comprehensive sensitivity assessment result of the population health dataset comprises:

Calculating and obtaining a leakage loss degree value based on the metadata sensitive characteristic analysis result;

calculating to obtain an identification degree value based on the data item sensitive characteristic analysis result and the data value sensitive characteristic analysis result;

and calculating to obtain a sensitivity comprehensive evaluation result of the population health data set based on the leakage loss degree value and the identification degree value.

4. The method of claim 1, wherein the generating a sensitivity assessment report of the population health dataset based on the sensitivity comprehensive assessment results comprises:

determining basic information of the population health data set;

determining information to be displayed of the sensitivity evaluation result based on the sensitivity comprehensive evaluation result, wherein the display information comprises a data set expression degree, a data set leakage loss degree, a data set sensitivity reference value and sensitive characteristic data;

determining sensitive characteristic mark information based on the sensitivity comprehensive evaluation result;

and generating a sensitivity evaluation report of the population health data set according to the basic information, the information to be displayed and the sensitive characteristic mark information.

5. A population health dataset sensitivity processing system, comprising:

An acquisition unit for acquiring a population health dataset to be evaluated;

the identification unit is used for carrying out sensitive information identification on each feature of the population health data set to obtain a sensitive feature corresponding to each feature, wherein the features comprise metadata features, data item features and data value features;

the analysis unit is used for analyzing each sensitive characteristic to obtain an analysis result corresponding to each sensitive characteristic;

the computing unit is used for computing based on the analysis result corresponding to each sensitive characteristic to obtain a sensitivity comprehensive evaluation result of the population health data set;

a generating unit, configured to generate a sensitivity evaluation report of the population health data set based on the sensitivity comprehensive evaluation result;

wherein the identification unit includes:

a first obtaining subunit, configured to obtain each feature dimension of the population health data, where the feature dimensions include: metadata features, data item features, and data value features;

the first identification subunit is used for carrying out sensitive information identification on the metadata characteristics based on target judgment rules to obtain metadata sensitive characteristics, wherein the target judgment rules are determined based on marked metadata;

A first determining subunit, configured to determine, based on a sensitive information type dictionary, whether the data item feature includes a sensitive information type item word, and if so, obtain a data item sensitive feature;

and the second identification subunit is used for identifying the data value of the data item sensitive characteristic, and if the data value obtained by identification meets the identification condition corresponding to the sensitive information value, the data value sensitive characteristic is obtained.

6. The system of claim 5, wherein the analysis unit comprises:

the first analysis subunit is used for analyzing the data quantity, the time span, the object characteristics, the theme type and the main body quantity of the metadata sensitive characteristics to obtain metadata sensitive characteristic analysis results;

the second analysis subunit is used for analyzing the sensitive information type characteristics and the sensitive information quantity characteristics of the sensitive characteristics of the data items to obtain the analysis result of the sensitive characteristics of the data items;

and the third analysis subunit is used for analyzing the value quantity characteristic, the value distribution characteristic and the value precision degree characteristic of the data value sensitive characteristic to obtain a data value sensitive characteristic analysis result.

7. The system of claim 6, wherein the computing unit comprises:

The first calculating subunit is used for calculating and obtaining a leakage loss degree value based on the metadata sensitive characteristic analysis result;

the second calculating subunit is used for calculating to obtain an identification degree value based on the data item sensitive characteristic analysis result and the data value sensitive characteristic analysis result;

and the third calculation subunit is used for calculating and obtaining the comprehensive sensitivity evaluation result of the population health data set based on the leakage loss degree value and the identification degree value.

8. The system of claim 5, wherein the generating unit comprises:

a second determination subunit configured to determine basic information of the population health dataset;

the third determining subunit is used for determining information to be displayed of the sensitivity evaluation result based on the sensitivity comprehensive evaluation result, wherein the display information comprises a data set expression degree, a data set leakage loss degree, a data set sensitivity reference value and sensitive characteristic data;

a fourth determination subunit, configured to determine sensitive feature tag information based on the sensitivity comprehensive evaluation result;

and the generation subunit is used for generating a sensitivity evaluation report of the population health data set according to the basic information, the information to be displayed and the sensitive characteristic mark information.