File copy monitoring method and system

Abstract

The invention provides a file copying monitoring method and system. The method comprises the steps of firstly, starting file copying monitoring; then monitoring a file opening operation and a file creating operation, and respectively creating a stream context for a file object of the opening operation and a file object of the creating operation; monitoring a file reading operation, judging whetherthe end of the file is read or not according to file reading information and the flow context of a file object of the reading operation, and if so, storing a reading record into a reading file linkedlist read List; monitoring file writing operation, judging whether a reading record exists or not by combining the reading file linked list according to file writing information, and if the reading record exists, storing the copying record into a file copying record linked list copyList; monitoring file closing operation, if yes, judging whether a file object of reading operation and a file object of writing operation in the file copy record linked list copyList are in a monitoring list of an application layer or not, and if yes, reporting a corresponding copy record to monitoring software ofthe application layer; and meanwhile, clearing the copy record in the file copy record linked list copyList.

Description

technical field [0001] The invention relates to the technical field of data security, in particular to a method and system for monitoring file copy. Background technique [0002] In the information society, ensuring data security has become a consensus. Whether it is individuals, enterprises, or governments, more and more investments are made in data security. As one of the data carriers, the file on the computer is undoubtedly an important protection object for data security. Numerous DLP (Data Leak Protection) products also perform eighteen martial arts in file protection, but they are all monitoring based on the application layer, which is easy to be forced to end, and cannot realize the copy process mapped to the local network disk; in addition , the monitoring based on the application layer can only monitor the activities of a single folder, and cannot further monitor the copying activities of files. SUMMARY OF THE INVENTION [0003] In order to solve the above pro...

AI Technical Summary

Problems solved by technology

Numerous DLP (Data Leak Protection) products also display 18 skills in file protection, but they are all based on the monitoring of the application layer, which is easy to be forced to end, and cannot realize the copying process mapped to the local network disk; in addition , the monitoring based on the application layer can only monitor the activities of a single folder, and cannot further monitor the copying activities of files

Images