Document leak protecting and tracking system

Abstract

The invention discloses a document leak protecting and tracking system which comprises a management module, a sensitive word matching module, a monitoring module, a behavior analysis module, a Trojansandbox module and an early warning analysis module, wherein the management module is used for setting sensitive word configuration information of the protecting and tracking system and user-defined rules as well as issuing planning tasks of document scanning and matching sensitive words for each host operating system; the sensitive word matching module is used for matching documents accessed by all processes for each host operating system as well as recognizing whether configuration key words exist in the documents or not; the monitoring module is used for monitoring local directories and files in real time and controlling access process behaviors of the local directories and files; the behavior analysis module is used for analyzing various behaviors of file access processes; the Trojan sandbox module is used for simulating and backtracking process behavior events with leak behaviors so as to recognize Trojan leak and Trojan outbreak; and the early warning analysis module is used forintercepting and early-warning all host clients when Trojan stealing behaviors are found. The system disclosed by the invention can be used for backtracking leaked and stolen sensitive files in computers as well as recognizing leaking and stealing modes.

Description

technical field [0001] The invention relates to the field of computer information security, in particular to a document leakage protection and tracking system. Background technique [0002] Whether the prior art has a method for stealing and leaking secrets can be roughly as follows: identify whether the keyword of setting is contained in the target computer document by active scanning mode (mainly scan the computer file with queue scanning and recursive scanning mode, judge Whether it is a document file, analyze and match the set keywords); according to the keywords, whether there is any information leaked or stolen in the document information from the identification (in the identified document information, the manager can check the content information of the document) check to determine whether the document is a stolen document or a leaked document). [0003] There are following disadvantages in the prior art methods for whether a document has been stolen or leaked: it ca...

AI Technical Summary

Problems solved by technology

[0003] The prior art has the following disadvantages in the method of checking whether a document has been stolen or leaked: it cannot detect and prevent the leakage and theft of sensitive documents in time; it cannot identify whether sensitive documents have been leaked to the Internet; it cannot identify the transmission mode of leaked or stolen documents ;Unable to identify the operating behavior of the program on the document, the source information of the theft and leakage; unable to identify and prevent the leakage and theft of the Trojan horse program; unable to identify and prevent the large-scale explosive leakage and theft; Identify the stealing methods of controlled Trojans and unknown Trojans

Images