Use sensitive data protection to check for data risks in buckets

Enable and authorize the service (Asset Center). On the Asset Center tab, you can view the Data Volume of each bucket in the selected region and whether Data Identification is enabled. You can also search by bucket name or filter by Identification Status. Click Asset Synchronization to start an OSS asset synchronization in all regions, and then click Refresh to view the latest assets. Select the buckets for which you want to enable sensitive data protection and click Bulk Authorize, or directly turn on the switch in the Data Identification column for a target bucket. Then, in the Configure Identification Task dialog box, complete the configuration based on the preceding parameter descriptions and click OK to enable the service.

Adjust the detection configuration (Detection Configuration). On the Detection Configuration tab, view the data types in the New National Standard Template. You can search for a data type by name. Click a data type to view its Rule Category and sensitivity level in Rule Details, and view the Built-in Policy and Minimum Hits (Unstructured Data) of the rule in Rule Policy. Rule Details also provides two switches: Model Status and Large Model Invocation. When you turn on Large Model Invocation, the large model detection engine is used, which significantly improves detection accuracy compared with the traditional engine. If you turn off Model Status for a rule, Large Model Invocation does not take effect.

Manage detection jobs (Identification Tasks). On the Identification Tasks tab, view and configure detection jobs. The Task Name in the list is the name of the corresponding bucket. Click Edit in the Actions column and modify the settings in the Configure Identification Task dialog box. You can also turn off the switch in the Scan Status column to pause a task.

View scan results and usage (Dashboard). On the Dashboard tab, you can view the OSS detection usage for the current account in the selected region, including the month-to-date Text Detection Size, AI Text Credit Usage, and AI image credit consumption, as well as the Data Trend, Sensitivity Level, Sensitive Information Statistics, and File Type charts. Note:

• AI Text Credit Usage: After you turn on Model Status for the corresponding model and turn on Large Model Invocation on the Detection Configuration tab, each matched sensitive sample consumes about 0.15 credits, and a single model can match a maximum of 10 sensitive samples per object. These detections are billed on a pay-as-you-go basis in credits at CNY 1 per 100 credits, and the exact number of credits consumed is subject to your bills.

• AI image credit consumption: Each detected image consumes about 0.3 credits, each image contained in an archive file also consumes about 0.3 credits, and each page of a PDF document is counted as one image. These detections are billed on a pay-as-you-go basis in credits according to the same rates.

At the bottom of the tab, a list displays the scan summary of each bucket, including Bucket Name, Region, Files, Sensitivity Level, Number of Sensitive Files, and Last Scanned At. You can filter the list by region, bucket, and sensitivity level.

View the sensitive data details of a single bucket and object. In the Actions column of the bucket summary list, click File details to view the bucket's Sensitivity Level Statistics, Data Identification Rate, Top 5 Hit Models, and object list in the panel that appears. Then, click Hit details in the Actions column of the object list to view the sensitive data details of a single object.

Enable and authorize the service. The first time you use it, you must authorize and enable the service.

1. Log on to the OSS console.

2. Click Buckets, and then click the name of the target bucket.

3. In the left-side navigation pane, choose Content Detection > Sensitive Data Discovery and Protection (SDDP).

4. Click Authorize and Activate.

   Note

   If the current account is already authorized, for example, because you enabled sensitive data protection for another bucket, this button is no longer displayed for buckets for which the feature is not enabled. Instead, Configure Scan Task is displayed. Click it to proceed to the next step.

5. In the Configure Identification Task dialog box, configure the scan parameters described in the following table, and then click OK.

   Parameter	Description
   Scan Scope	The scope of objects to scan in the bucket. Valid values: Global Scan (default): scans all objects in the bucket. Specify Scan Scope: In Scan Scope, select a condition type (Directory, Prefix, or Suffix), enter a value and press Enter to save it. Separate multiple values with commas (,). Then click Add as Include Condition or Add as does not contain conditions. A directory condition matches the prefix of the object key, and prefix and suffix conditions match the prefix and the suffix of the object name. For example, if the object key is dir1/dir2/file1.txt and the object name is file1.txt, the prefix file and the suffix txt match all objects whose names start with file and end with txt, and the directory dir1 matches all objects in the dir1 directory. Multiple match rules are combined by union: objects that meet an exclude condition are not scanned, and objects that meet an include condition are scanned. If no condition is specified, all objects in the bucket are scanned.
   Scan Concurrency	The number of objects that a single task scans at the same time. Valid values: 4 to 20. Default value: 4.
   Sampling Scan	Valid values: Full Scan (default) and Specify Sampling Ratio. If you select Specify Sampling Ratio, select 1/10, 1/100, 1/1000, or 1/10000 for Sampling Ratio.
   Scan Depth	Valid values: Full Scan (default) and Specify Scan Depth. If you select Specify Scan Depth, select a value from 1 to 10 for Specify Bucket Path Depth to limit the directory levels that are scanned from the root path of the bucket.
   Scan Period	The interval at which automatic scans are performed. Valid values: Daily, Weekly, and Monthly. If you select a weekly or monthly scan, you must also specify the day on which the scan is performed.
   Start Time	The time range in which the scan task starts. Valid values: 00:00-06:00, 06:00-12:00, 12:00-18:00, and 18:00-24:00.

   Important

   Scan Once Now is selected by default. This means that a scan is triggered immediately after you save the configuration, and you are charged for the scan. If you do not want to scan immediately, clear this option.

   After the configuration is complete, OSS scans the data in the bucket based on the preceding scan scope and charges a fee for the scan. The duration of the initial scan depends on the amount of data. For an empty bucket, approximately 5 minutes elapse between the creation of the task and the end of the task. Allow some time before checking the results.

View the scan results for the bucket. After the scan is complete, on the Sensitive Data Discovery and Protection (SDDP) page, you can view the bucket's Sensitivity Level Statistics, Data Identification Rate, and Top 5 Hit Models, as well as the OSS Detection Usage for Current Bucket card, which displays the month-to-date Scan File Size, AI Text Credit Usage, and AI image credit consumption.

A list of the scanned objects in the bucket is displayed at the bottom of the page. The list displays the File name, File size (Byte), Type, Number of Hits, Hit Models, and Last Scanned At of each object. Objects in which no sensitive content was detected are also displayed in the list. For these objects, Number of Hits is 0 and Hit Models is displayed as Missed. You can filter the list by Hit Model and Sensitivity Level, or search the list by object name keyword.

View the sensitive data details of an object. Click Hit details to the right of the target object to view the Hit Model, Sensitivity Level, Number of Hits, Data sampling result, and Tag of each piece of sensitive data detected in the object.

Manage the detection job. In the upper-right corner of the Sensitive Data Discovery and Protection (SDDP) page, click Identification Configuration to modify the detection job configuration, or click Disable Sensitive Data Protection to disable sensitive data protection for the bucket. Suspend Task is not in the upper-right corner. It is displayed to the right of the Bucket Identification Task status in the upper-left corner of the page, and is used to suspend the running detection job.

• If you suspend the task, the current scan stops and subsequent scheduled scans are not created, but the bucket remains authorized. After the task is suspended, the task status changes to paused, and Suspend Task changes to Start Task. Click it to resume scanning.

• If you disable sensitive data protection, the detection job of the bucket is deleted. The job is no longer displayed on the Identification Tasks tab, the Data Identification switch of the bucket on the Asset Center tab is turned off, and the Sensitive Data Discovery and Protection (SDDP) page of the bucket returns to the state in which the feature is not enabled. To enable the feature again, configure a detection job again.