Computer file protection method

Abstract

The invention discloses a computer file protection method, which relates to the technical field of computer information security, and comprises the following steps of: S1, classifying files and marking security levels based on content characteristics and sensitivity; s2, dividing system user permission levels and configuring a multi-factor authentication mechanism; s3, constructing a file access control matrix and setting a fine-grained operation authority rule; s4, deploying an access behavior monitoring module, and recording a file operation behavior log in real time; s5, performing dynamic risk analysis based on behavior modeling and an anomaly recognition algorithm; s6, performing hierarchical response according to the risk level, wherein the hierarchical response comprises measures such as warning, limiting, network disconnection and locking; and S7, encrypting and storing the log information, and providing an auditing interface for behavior traceability. According to the method, static permission control and a dynamic behavior recognition mechanism are fused, full-process intelligent protection of files from creation, access, transmission to storage is achieved, and the method has the advantages of being high in safety, timely in response, capable of achieving self-adaptive evolution of strategies and the like.

Description

Technical Field

[0001] This invention relates to the field of computer security technology, and in particular to a method for protecting computer files. Background Technology

[0002] With the widespread application of computer technology and information systems, file data security has increasingly become a focus of user attention. Traditional file protection methods mainly rely on operating system permissions, encryption technology, or antivirus software, but these methods have some shortcomings: such as coarse-grained permission management, performance impact during encryption, inability to prevent internal personnel operations, or lack of dynamic response mechanisms to file operation behaviors. Therefore, there is an urgent need for a more intelligent, fine-grained, and multi-dimensional file protection mechanism to cope with diverse file threat scenarios. To this end, a computer file protection method is proposed. Summary of the Invention

[0003] To address the shortcomings of the aforementioned technologies, this invention provides a computer file protection method. Through file access level settings, real-time monitoring of access behavior, behavior pattern recognition, and a dynamic response mechanism, it achieves comprehensive protection of computer files, balancing security, flexibility, and operability. The specific steps include the following:

[0004] S1. Document classification and tagging;

[0005] S2. User permission level classification;

[0006] S3. Access rule configuration;

[0007] S4. Initialize the access behavior monitoring module;

[0008] S5. Behavioral pattern recognition and anomaly detection;

[0009] S6. Dynamic response and strategy adjustment;

[0010] S7. Log storage and auditing interface.

[0011] As a further preferred embodiment of the present invention, in step S1, the system performs a full scan of the local and network shared file directories to extract all file metadata; it performs preliminary classification based on file extensions and content recognition in conjunction with the file content sensitivity recognition module; it classifies the identified files into five categories according to their security levels: public files, internal files, restricted files, confidential files, and top-secret files; it embeds an unalterable digital tag for each category of files; and it generates a unique identifier for each classification result and binds it to a file ID for easy subsequent tracking and identification.

[0012] As a further preferred embodiment of the present invention, in step S2, the system administrator establishes a unified user management table, including user ID, username, role, department, affiliated device, login IP, and authentication status information; users are divided into permission levels: visitors, ordinary users who can access public and internal files, advanced users who can access restricted and confidential files, and security administrators who can access all files and configure policies; user authentication methods can include password and SMS verification code, biometrics, USB key, or multi-factor authentication; permission roles and default access scopes are assigned to each user, and the system sets permission validity periods and automatic expiration policies.

[0013] As a further preferred embodiment of the present invention, in step S3, a two-dimensional access control matrix based on user permission level and file security level is constructed; the granularity of access operations is set, including: read, edit, copy, paste, upload, print, rename, delete, move, encrypt, and compress; each operation is assigned an allow, deny, or controlled mode; additional conditions such as time window limit, IP limit, and device limit are set; before the user operates, the access verification engine is called to verify the rules, and if the verification fails, access is immediately blocked.

[0014] As a further preferred embodiment of the present invention, in step S4, after the system is started, the behavior monitoring module is initialized and runs in the background as a daemon process, loading the following monitoring components: a file operation interceptor that hooks the file system API; a user operation logger that records keyboard and mouse behavior, window focusing, and command execution; a network access logger that records access destination, port, and packet summary; all operation behaviors are written to a circular cache in real time, and critical operations are immediately written to the main log; the log fields include: user ID, operation type, file ID, file path, timestamp, source IP, operation result, and anomaly marker; the behavior monitoring module can remotely configure policies and monitoring granularity to adapt to different scenario requirements.

[0015] As a further preferred embodiment of the present invention, in step S5, a machine learning engine is introduced to model user behavior. Initially, a supervised learning algorithm is used to establish a user's personal behavior profile based on historical logs. Each operation is scored to generate a behavior risk factor value. If any of the following situations are detected, it is determined to be abnormal behavior: high-frequency batch access to highly sensitive files, sudden cross-permission or cross-department access behavior, frequent login operations at abnormal times, login from infrequently used IPs, terminals, or regions. Abnormal operation trigger response levels: mild abnormality; moderate abnormality, operation is restricted and reported; severe abnormality, account is frozen, files are locked, and network is forcibly disconnected.

[0016] As a further preferred embodiment of the present invention, in step S6, the dynamic response strategy is driven by the event level: low level: pop-up warning, logging; medium level: operation blocking, account logout, secondary authentication; high level: file isolation, IP blocking, network disconnection, reporting to the administrator review system; by integrating the alarm module and system tray notification, it is ensured that operators are informed of security events in a timely manner; the system supports remote policy adjustment and automatic push: the administrator can adjust the behavior recognition model parameters and access rules according to the event feedback; the system automatically collects the effect of each response for post-evaluation and feeds it back to the behavior recognition module for the next round of training.

[0017] As a further preferred embodiment of the present invention, in step S7, the logs are stored in partitions according to categories, namely user behavior logs, system response logs, and file access logs; the log files are rotated daily, compressed, encrypted, and then written to the security log area; the system provides auditors with role-based query permissions and multi-condition filtering functions, filtering by time, user, file, and behavior type; it supports exporting to audit reports and interfacing with compliance systems.

[0018] Beneficial effects

[0019] This invention provides a method for protecting computer files. It has the following beneficial effects:

[0020] This method categorizes and tags files from the moment they are generated, achieving full-process security protection from "creation-use-storage-transmission-deletion," avoiding the limitations of traditional technologies that only encrypt during transmission or storage, and improving the security level of files throughout their entire lifecycle. By constructing a cross-control matrix of user level and file level, and refining it to specific operational behaviors (such as reading, copying, deleting, printing, etc.), it achieves more granular access control than traditional operating system permissions, effectively preventing data leaks caused by coarse permission configurations. Real-time monitoring and intelligent identification enhance dynamic protection capabilities. By introducing behavior monitoring and user behavior modeling technologies, it can capture and identify abnormal operations in real time (such as large-scale copying late at night, frequent access to high-density files, etc.), possessing predictive and proactive response capabilities, and overcoming the shortcomings of traditional protection methods that can only "account for incidents afterward."

[0021] This invention sets differentiated response strategies based on behavioral risk levels, ranging from warning prompts to emergency mechanisms such as forced blocking and network isolation. This allows for the rapid severing of potential risk chains, improving the efficiency of security incident handling and system resilience. An adaptive learning mechanism continuously optimizes protection strategies. By introducing machine learning and feedback mechanisms, the system can continuously learn users' normal operational behaviors and adjust model thresholds, making protection strategies more aligned with actual business scenarios and possessing excellent adaptability and evolution capabilities. The log auditing system is reliable, facilitating compliance and accountability. All file access and behavior records are encrypted and stored using anti-tampering mechanisms, providing authoritative evidence for auditing, evidence collection, and responsibility allocation, meeting compliance requirements such as the Cybersecurity Law 2.0 and ISO 27001. This method can be deployed on personal terminals, LAN servers, or cloud computing platforms, supporting local access control, remote office terminal behavior monitoring, and multi-terminal cross-platform access management, making it suitable for various scenarios such as enterprises, governments, and finance. Detailed Implementation

[0022] The technical solutions of the present invention will be clearly and completely described below with reference to the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0023] This invention provides a technical solution: a computer file protection method, S1: Detailed breakdown of file classification and tagging:

[0024] The system performs a full scan of local and network shared file directories, extracting all file metadata (filename, extension, size, creation time, last modification time, owner, etc.).

[0025] The files are initially categorized based on their file extensions (e.g., .docx, .pdf, .xls, etc.), and then the content is identified using a file content sensitivity recognition module (e.g., whether the file contains keywords, ID numbers, contract terms, etc.).

[0026] The identified files are categorized into five classes based on their security level:

[0027] Public documents

[0028] Internal document

[0029] Restricted documents

[0030] confidential documents

[0031] Top Secret Document

[0032] Embed immutable digital tags for each type of file (such as security-level metadata bound by hashes or data streams hidden using ADS).

[0033] A unique identifier is generated for each classification result and bound to a file ID for easy tracking and identification later.

[0034] S2: User Permission Level Division

[0035] The system administrator establishes a unified user management table, which includes information such as user ID, username, role, department, affiliated device, login IP, and authentication status.

[0036] Users are categorized into the following permission levels:

[0037] Visitors (can only access public files)

[0038] Regular users (have access to both public and internal documents)

[0039] Advanced users (access to restricted and confidential files)

[0040] Security Administrator (has access to all files and can configure policies)

[0041] User authentication methods include password + SMS verification code, biometrics (fingerprint, face), USB key, or multi-factor authentication (MFA).

[0042] Assign permission roles and default access scopes to each user, and set security policies such as permission validity period and automatic expiration policy.

[0043] S3: Access Rule Configuration

[0044] Construct a two-dimensional access control matrix based on "user permission level × file security level" (RBAC model extension).

[0045] Set the granularity of access operations, including: read, edit, copy, paste, upload, print, rename, delete, move, encrypt, compress, etc.

[0046] Each operation is assigned one of three modes: "Allow," "Deny," or "Controlled." For example:

[0047] For ordinary users: Reading of confidential files is prohibited;

[0048] Advanced users can grant access to confidential files but prohibit copying.

[0049] For top-secret files: all operations are allowed, but behavior logs must be tracked.

[0050] Additional conditions can be set, such as "time window restriction" (e.g., access is allowed during working hours), "IP restriction" (e.g., access is allowed on the company's internal network), and "device restriction" (e.g., access is allowed only on authorized terminals).

[0051] Before a user performs an operation, the access verification engine is invoked to verify the rules. If the verification fails, access is immediately blocked.

[0052] S4: Access Behavior Monitoring Module Initialization

[0053] After system startup, initialize the behavior monitoring module, which runs in the background as a daemon process, and load the following monitoring components:

[0054] File operation interceptor (Hooking file system API)

[0055] User activity logger (records keyboard and mouse actions, window focus, command execution, etc.)

[0056] Network access logger (records access destination, port, and packet digest)

[0057] All operations are written to the circular cache in real time, and critical operations (such as copying confidential files) are written to the main log immediately.

[0058] Log fields include: User ID, Operation Type, File ID, File Path, Timestamp, Source IP, Operation Result (Success / Failure), and Exception Flag.

[0059] The behavior monitoring module allows for remote configuration of policies and monitoring granularity to adapt to different scenario requirements (such as office areas, laptops on business trips, cloud terminals, etc.).

[0060] S5: Behavioral Pattern Recognition and Anomaly Detection

[0061] Machine learning engines are introduced to model user behavior. Initially, supervised learning algorithms (such as decision trees and random forests) are used to build user profiles based on historical logs (such as which files are frequently accessed, time periods, and operation types).

[0062] Each action is scored (e.g., frequency, sensitivity, contextual rationality) to generate a behavioral risk factor value.

[0063] If any of the following situations are detected, it is considered abnormal behavior:

[0064] High-frequency batch access to highly sensitive files

[0065] Sudden cross-privilege or cross-department access behavior

[0066] Frequent login operations at unusual times (such as early morning)

[0067] Infrequently used IP addresses, terminals, and regions for login

[0068] Abnormal operation trigger response level:

[0069] Mild abnormality (warning)

[0070] Moderate anomaly (operation restrictions + reporting)

[0071] Serious anomalies (account frozen, files locked, forced internet disconnection)

[0072] S6: Dynamic Response and Strategy Adjustment

[0073] Dynamic response strategies are driven by "event levels":

[0074] Low level: Pop-up alerts, logging

[0075] Medium level: Operation blocking, account logout, two-factor authentication

[0076] High-level measures: File isolation, IP blocking, network disconnection, and reporting to the administrator review system.

[0077] By integrating alarm modules with system tray notifications, operators are ensured to be informed of security incidents immediately.

[0078] The system supports remote policy adjustments and automatic push notifications: Administrators can adjust behavior recognition model parameters and access rules based on event feedback.

[0079] The system automatically collects the results of each response for post-evaluation and feeds them back to the behavior recognition module for the next round of training (reinforcement learning mechanism).

[0080] S7: Log Storage and Auditing Interface

[0081] Logs are stored in partitions according to categories (user behavior logs, system response logs, and file access logs).

[0082] Log files are rotated daily, compressed, encrypted (AES-256), and then written to the secure log area (virtual disk encryption technology can be used).

[0083] The system provides auditors with role-based query permissions and multi-condition filtering functions (filtering by time, user, file, behavior type, etc.).

[0084] It supports exporting audit reports (PDF / CSV format) and interfacing with compliance systems (such as ISO27001 and Cybersecurity Classified Protection 2.0).

[0085] Optional chained hashing technology ensures that logs cannot be tampered with, enabling audit traceability and accountability.

[0086] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or basic characteristics. Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, it is intended that all variations falling within the meaning and scope of equivalents of the claims be included within the present invention.

[0087] Furthermore, it should be understood that although this specification describes embodiments, not every embodiment contains only one independent technical solution. This narrative style is merely for clarity. Those skilled in the art should consider the specification as a whole, and the technical solutions in each embodiment can also be appropriately combined to form other embodiments that can be understood by those skilled in the art.

Claims

1. A method for protecting computer files, characterized in that, The specific steps include the following: S1. Document classification and tagging; S2. User permission level classification; S3. Access rule configuration; S4. Initialize the access behavior monitoring module; S5. Behavioral pattern recognition and anomaly detection; S6. Dynamic response and strategy adjustment; S7. Log storage and auditing interface.

2. The computer file protection method according to claim 1, characterized in that, In step S1, the system performs a full scan of the local and network shared file directories to extract all file metadata; it initially classifies files based on their file extensions and performs content recognition in conjunction with the file content sensitivity recognition module; the identified files are divided into five categories according to their security level: public files, internal files, restricted files, confidential files, and top secret files. Embed unalterable digital tags for each type of file; generate a unique identifier for each classification result and bind it to the file ID for easy tracking and identification.

3. The computer file protection method according to claim 1, characterized in that, In step S2, the system administrator establishes a unified user management table, including user ID, username, role, department, associated device, login IP, and authentication status information; users are divided into permission levels: visitors, ordinary users who can access public and internal files, advanced users who can access restricted and confidential files, and security administrators who can access all files and configure policies; user authentication methods can be selected from password and SMS verification code, biometrics, USB key, or multi-factor authentication; permission roles and default access scopes are assigned to each user, and the system sets permission validity periods and automatic expiration policies.

4. The computer file protection method according to claim 1, characterized in that, In step S3, a two-dimensional access control matrix based on user permission level and file security level is constructed; Define the granularity of access operations, including: read, edit, copy, paste, upload, print, rename, delete, move, encrypt, and compress; Each operation is assigned an allow, deny, or controlled mode; additional conditions such as time window limits, IP limits, and device limits are set; the access verification engine verifies the rules before the user performs the operation, and access is immediately blocked if the verification fails.

5. A computer file protection method according to claim 4, characterized in that, In step S4, after the system starts, the behavior monitoring module is initialized and runs in the background as a daemon process, loading the following monitoring components: file operation interceptor, which hooks the file system API; user operation logger, which records keyboard and mouse behavior, window focus, and command execution. A network access logger that records the destination, port, and packet digest of access requests. All operations are written to the circular cache in real time, and critical operations are written to the main log immediately. Log fields include: user ID, operation type, file ID, file path, timestamp, source IP, operation result, and exception flag. The behavior monitoring module allows for remote configuration of policies and monitoring granularity to adapt to different scenario requirements.

6. A computer file protection method according to claim 1, characterized in that, In step S5, a machine learning engine is introduced to model user behavior. Initially, a supervised learning algorithm is used to build a user profile based on historical logs. Each operation is scored to generate a behavioral risk factor value. If any of the following situations are detected, it is judged as abnormal behavior: high-frequency batch access to highly sensitive files, sudden cross-permission or cross-department access behavior, frequent login operations at abnormal times, login from infrequently used IPs, terminals, or regions; abnormal operation trigger response level: mild abnormality; For moderate anomalies, operations are restricted and reporting is required; for severe anomalies, accounts are frozen, files are locked, and the network is forcibly disconnected.

7. A computer file protection method according to claim 1, characterized in that, In step S6, the dynamic response strategy is driven by the event level: low level: pop-up alert, logging; medium level: operation blocking, account logout, two-factor authentication; high level: file isolation, IP blocking, network disconnection, reporting to the administrator review system; by integrating the alarm module and system tray notification, it ensures that operators are informed of security events in a timely manner; the system supports remote policy adjustment and automatic push: the administrator can adjust the behavior recognition model parameters and access rules according to event feedback; the system automatically collects the effect of each response for post-evaluation and feeds it back to the behavior recognition module for the next round of training.

8. A computer file protection method according to claim 1, characterized in that, Step S7: Logs are stored in partitions according to categories: user behavior logs, system response logs, and file access logs; log files are rotated daily, compressed, encrypted, and then written to the security log area; the system provides auditors with role-based query permissions and multi-condition filtering functions, allowing filtering by time, user, file, and behavior type; It supports exporting to audit reports and integrating with compliance systems.