A data exposure surface silent monitoring method and system
By using cross-session clipboard tracing and a two-factor network traffic conviction mechanism, combined with a dynamic feature fingerprint database, the blind spot problem of sensitive data feeding behavior in scenarios with large language models and AI programming assistants has been solved, achieving accurate monitoring and efficient auditing, and reducing system burden and false alarm rate.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- BEIJING AEROSPACE QIXING TECH CO LTD
- Filing Date
- 2026-06-08
- Publication Date
- 2026-07-10
AI Technical Summary
Existing technologies cannot accurately capture and locate the feeding of sensitive data to external public AI models in scenarios involving large language models and AI programming assistants. Especially without cracking the terminal's HTTPS encrypted traffic, there are huge blind spots and monitoring and isolation obstacles, rendering security audits ineffective.
By employing a cross-session clipboard tracing mechanism and a two-factor network traffic conviction mechanism, combined with a dynamic feature fingerprint database, and through source process identification and behavioral scenario analysis, the system can accurately screen and identify abnormal events, generate high-risk warning labels, and execute corresponding strategies.
Without decrypting HTTPS traffic, it achieves accurate capture of sensitive data feeding behavior, reduces CPU and memory overhead, avoids privacy violations and false alarms, and has high scalability and dynamic countermeasure capabilities.
Smart Images
Figure CN122372336A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of artificial intelligence compliance application technology, and in particular to a method and system for silent monitoring of data exposure surfaces. Background Technology
[0002] With the widespread adoption of Large Language Models (LLMs) and AI programming assistants (such as Cursor and OpenClaw), employees often copy and share core code, financial data, or confidential documents from within their companies with external AI vendors in an effort to improve work efficiency. Traditional cybersecurity auditing methods face significant blind spots in this scenario. 1. False positives and blind spots in the network layer's "one-size-fits-all" approach: Traditional firewalls or DLPs, based on IP / domain blacklists, cannot distinguish whether an employee is "normally browsing AI information websites" or "uploading confidential data." If HTTPS man-in-the-middle (MITM) decryption is used, it not only seriously infringes on privacy and consumes a lot of system computing power, but also becomes ineffective when encountering AI client tools with SSL pinning enabled.
[0003] 2. Operating system-level "Session Isolation" barrier: In modern operating systems such as Windows, security audit services typically run as daemons in the high-privilege and invisible Session 0 isolation zone, while users' daily operations (including switching foreground windows and copying and pasting from the clipboard) occur in the user-mode zone with Session 1 or higher privileges. The main probe of Session 0 cannot directly obtain a real-time snapshot of the system clipboard of Session 1, resulting in complete blindness to the behavior of "manually copying confidential text and pasting it into the web-based AI".
[0004] 3. "Noise overload" caused by high-frequency background requests: Modern applications frequently send heartbeat keep-alive packets and telemetry data in the background. If the security engine records all outgoing network packets indiscriminately, the actual "feeding" behavior will be overwhelmed by massive amounts of regular network noise, rendering the audit ineffective.
[0005] Therefore, how to provide a cross-session collaborative method to accurately capture and locate the feeding behavior of sensitive data to external public AI models (such as web-based large language models and AI programming IDE tools) without cracking the terminal's HTTPS encrypted traffic is an urgent problem to be solved. Summary of the Invention
[0006] This invention provides a method and system for silent monitoring of data exposure surfaces to address the problems mentioned above in the prior art.
[0007] According to a first aspect of the present invention, a method for silent monitoring of data exposure surfaces is provided.
[0008] In one embodiment, the data exposure surface silent monitoring method includes: The event type is determined based on the end user's behavior scenario, and the source process identifier that triggered the event is extracted from the terminal operating system. The event types include network sending events and clipboard operation events. Based on the source process identifier, combined with a pre-defined memory taint process library, abnormal events are identified to achieve preliminary screening of abnormal behavior and event triggering. By using a two-factor network traffic conviction mechanism or a cross-session clipboard tracing mechanism, combined with the source process identifier, the behavior of the corresponding abnormal event is determined. Specifically, when the abnormal event type is a network sending event, the behavior is determined using the two-factor network traffic conviction mechanism, and when the abnormal event type is a clipboard operation event, the behavior is determined using the cross-session clipboard tracing mechanism. After the rights are confirmed, the network and process-level fingerprints or interface window-level fingerprints of abnormal events are compared with the dynamically distributed feature fingerprint database. Based on the comparison results, audit logs containing high-risk warning labels for AI exposure surfaces are generated, and corresponding audit or blocking strategies are executed.
[0009] In one embodiment, when the abnormal event type is a network transmission event, a two-factor network traffic sentencing mechanism is used to determine the nature of the behavior, including: The process checks whether the source process identifier of the abnormal event exists in the preset memory tainted process library. If not, it is determined to be an external source and allowed directly. If it is, it is determined to be a suspicious network sending event and the next step is executed. The preset memory tainted process library records all processes that have read sensitive assets. The payload of the instantaneous uplink network data packets of the network transmission event is calculated by accumulating the outbound bytes of the source process identifier of the suspicious network transmission event within a preset time window. Determine whether the payload of the instantaneous uplink network data packet exceeds the preset payload burst threshold. If not, it is determined to be a regular heartbeat keep-alive packet and an application telemetry packet, and is allowed to pass directly without alarm. If it is, the network burst process is triggered and the next step is executed. By utilizing the focus events of the terminal operating system, it detects whether the process that triggered the network outbreak is in an active or highly interactive state in the user's foreground. If so, it is determined to be a network escape event; otherwise, it is determined to be a meaningless concurrent request for static resources in the browser background or a regular background synchronization, and is filtered and allowed.
[0010] In one embodiment, when the abnormal event type is a clipboard operation event, a cross-session clipboard tracing mechanism is used to determine the responsibility for the behavior, including: A helper process is spawned in the current user's interactive session area, and the helper process is used to subscribe to the clipboard serial number of the terminal operating system in real time. When the clipboard serial number is updated, the source process identifier and the hash value of the clipboard text block of the currently active foreground window are extracted by the auxiliary process. Then, the extracted source process identifier and the hash value of the clipboard text block are transmitted through the isolation zone to the main probe running in the high-privilege isolation zone using the one-way named pipe of the terminal operating system. The main probe receives the source process identifier and the hash value of the clipboard text block. Based on the received source process identifier, it retrieves and calls the corresponding attribute in the memory tainted process library to confirm that the clipboard operation was initiated by a controlled source. It then writes the associated clipboard text block hash value into the tainted clipboard slot to generate a high-tightness clip cache.
[0011] In one embodiment, spawning an auxiliary process in the current user's interactive session area includes: By utilizing the main probe service residing in the zero-isolation session area of the terminal operating system, a very lightweight auxiliary process is derived with reduced privileges and then resides in the current user's interactive session area.
[0012] In one embodiment, the step of comparing the network and process-level fingerprint or interface window-level fingerprint of the abnormal event after confirmation with the dynamically distributed feature fingerprint database, generating an audit log containing a high-risk warning label for AI exposure surface based on the comparison result, and executing corresponding audit or blocking strategies includes: The target domain name SNI suffix or process name of the abnormal event after confirmation of rights is compared with the domain name SNI suffix of the public AI model or the process name of the AI client tool recorded in the feature fingerprint database to complete the fingerprint comparison at the network and process levels. When clipboard pasting or network sending occurs, the title feature keywords of the current foreground window are compared with the title feature keywords of the web version AI assistant recorded in the feature fingerprint database to complete the fingerprint comparison at the interface window level. When either network-level or process-level fingerprint comparison or interface window-level fingerprint comparison is satisfied, an audit log containing a high-risk warning label for AI exposure surface is generated locally, and a strategy of blocking and cutting off network connection or writing to trace audit log is executed.
[0013] In one embodiment, the feature fingerprint database is distributed from the cloud and can be hot-updated. The feature fingerprint database records the domain name suffix SNI of public AI models, the process name of AI client tools, and the feature keywords of the front-end window title of web-based AI assistants.
[0014] In one embodiment, if either network-level or process-level fingerprint comparison or interface window-level fingerprint comparison is not satisfied, it is recorded as a normal network outbound event without attaching a high-risk AI exposure warning label.
[0015] In one embodiment, the audit log includes a chain of evidence across three core dimensions: the source process, associated sensitive files, and the target AI model vendor.
[0016] In one embodiment, when a conviction network sends an event, the main probe is located in a low-level bypass of the terminal operating system and does not perform man-in-the-middle certificate decryption or payload content restoration operations for HTTPS encrypted network traffic.
[0017] According to a second aspect of the present invention, a silent monitoring system for data exposure surfaces is provided.
[0018] In one embodiment, the data exposure surface silent monitoring system includes: The source process identifier extraction module is used to determine the event type based on the terminal user's behavior scenario and extract the source process identifier that triggered the event in the terminal operating system. The event types include network sending events and clipboard operation events. The abnormal behavior preliminary screening module is used to identify abnormal events based on the source process identifier and in combination with a preset memory taint process library, so as to achieve preliminary screening of abnormal behavior and event triggering. The event authorization module is used to authorize the behavior of corresponding abnormal events by combining the source process identifier with the two-factor network traffic conviction mechanism or the cross-session clipboard tracing mechanism. Specifically, when the abnormal event type is a network sending event, the two-factor network traffic conviction mechanism is used to authorize the behavior, and when the abnormal event type is a clipboard operation event, the cross-session clipboard tracing mechanism is used to authorize the behavior. The feature fingerprint comparison module is used to compare the network and process-level fingerprints or interface window-level fingerprints of abnormal events after rights confirmation with the dynamically distributed feature fingerprint database. Based on the comparison results, it generates audit logs containing high-risk warning labels for AI exposure surfaces and executes corresponding audit or blocking strategies.
[0019] According to a third aspect of the present invention, a computer device is provided.
[0020] In some embodiments, the computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the steps of the method described above.
[0021] According to a fourth aspect of the present invention, a computer-readable storage medium is provided.
[0022] In one embodiment, a computer program is stored on the computer-readable storage medium, which, when executed by a processor, implements the steps of the above method.
[0023] The technical solutions provided by the embodiments of the present invention may include the following beneficial effects: 1) Minimizes decryption challenges while balancing privacy and performance: When determining network outbound events, this invention relies solely on bypass statistics of transport layer payload size and process-level context, eliminating the need for HTTPS traffic man-in-the-middle (MITM) certificate decryption or payload content reconstruction. This not only perfectly solves the pain point of probe failure caused by enabling certificate pinning in some AI tools, but also significantly reduces CPU and memory overhead, while avoiding the legal and privacy risks of spying on employees' normal private communications.
[0024] 2) Breaking down the monitoring barriers of the operating system and eliminating audit blind spots: In response to the shortcomings of traditional main probes (running in Session 0) that cannot directly obtain user-mode (Session 1) UI behavior, this invention pioneers a cross-session collaborative architecture of "lower privilege auxiliary process + one-way named pipe", which can accurately and in real time capture the "hidden feeding" behavior of manual copying and pasting on the web page, thus completing the security puzzle of data leakage prevention.
[0025] 3) Extremely high accuracy and extremely low false alarm rate: By introducing a funnel-shaped two-factor conviction model of "pre-taint filtering - load burst judgment - foreground activity judgment", this invention can effectively filter out a large number of heartbeat keep-alive packets and meaningless telemetry noise generated in the background by the operating system or conventional software, ensuring that every alarm reported to the security administrator is a real high-risk leakage behavior.
[0026] 4) High scalability and dynamic countermeasure capabilities: It adopts a design that decouples the "lightweight public AI service fingerprint library" from the core probe logic. Faced with the endless stream of new large models and AI assistants on the market, security operations personnel only need to download and hot-update the dictionary from the cloud (such as adding domain names or feature keywords) to instantly have the ability to monitor new threats, without recompiling or restarting the underlying endpoint security driver.
[0027] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit the invention. Attached Figure Description
[0028] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.
[0029] Figure 1This is a flowchart illustrating a method for silent monitoring of data exposure surfaces according to an exemplary embodiment; Figure 2 This is a structural block diagram illustrating a silent monitoring system for data exposure surfaces according to an exemplary embodiment; Figure 3 This is a schematic diagram of the structure of a computer device according to an exemplary embodiment. Detailed Implementation
[0030] The following description and accompanying drawings fully illustrate specific embodiments described herein to enable those skilled in the art to practice them. Some portions and features of certain embodiments may be included in or replace portions and features of other embodiments. The scope of the embodiments herein includes the entire scope of the claims and all available equivalents thereof. The various embodiments described herein are presented in a progressive manner, with each embodiment focusing on its differences from other embodiments; similar or identical parts between embodiments can be referred to interchangeably.
[0031] The modules in the apparatus or system of this application can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device in hardware form, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.
[0032] Where there is no conflict, the embodiments and features in the embodiments of the present invention can be combined with each other.
[0033] Figure 1 An embodiment of a data exposure surface silent monitoring method of the present invention is shown.
[0034] In this optional embodiment, the data exposure surface silent monitoring method includes: Step S101: Determine the event type based on the terminal user's behavior scenario, and extract the source process identifier that triggered the event from the terminal operating system. The event type includes network sending events and clipboard operation events. Step 102: Based on the source process identifier, combined with the preset memory taint process library, identify abnormal events to achieve preliminary screening of abnormal behavior and event triggering; Step S103: Use the two-factor network traffic conviction mechanism or the cross-session clipboard tracing mechanism to determine the behavior of the corresponding abnormal event in combination with the source process identifier. When the abnormal event type is a network sending event, the two-factor network traffic conviction mechanism is used to determine the behavior. When the abnormal event type is a clipboard operation event, the cross-session clipboard tracing mechanism is used to determine the behavior. Step S104: Compare the network and process-level fingerprints or interface window-level fingerprints of abnormal events after confirmation of rights with the dynamically distributed feature fingerprint database, generate audit logs containing high-risk warning labels for AI exposure surfaces based on the comparison results, and execute corresponding audit or blocking strategies.
[0035] In this optional embodiment, when the abnormal event type is a network transmission event, a two-factor network traffic sentencing mechanism is used to determine the rights of the behavior, including: The process checks whether the source process identifier of the abnormal event exists in the preset memory tainted process library. If not, it is determined to be an external source and allowed directly. If it is, it is determined to be a suspicious network sending event and the next step is executed. The preset memory tainted process library records all processes that have read sensitive assets. The payload of the instantaneous uplink network data packets of the network transmission event is calculated by accumulating the outbound bytes of the source process identifier of the suspicious network transmission event within a preset time window. Determine whether the payload of the instantaneous uplink network data packet exceeds the preset payload burst threshold. If not, it is determined to be a regular heartbeat keep-alive packet and an application telemetry packet, and is allowed to pass directly without alarm. If it is, the network burst process is triggered and the next step is executed. By utilizing the focus events of the terminal operating system, it detects whether the process that triggered the network outbreak is in an active or highly interactive state in the user's foreground. If so, it is determined to be a network escape event; otherwise, it is determined to be a meaningless concurrent request for static resources in the browser background or a regular background synchronization, and is filtered and allowed.
[0036] In this optional embodiment, when the abnormal event type is a clipboard operation event, a cross-session clipboard tracing mechanism is used to determine the behavior's authority, including: A helper process is spawned in the current user's interactive session area, and the helper process is used to subscribe to the clipboard serial number of the terminal operating system in real time. When the clipboard serial number is updated, the source process identifier and the hash value of the clipboard text block of the currently active foreground window are extracted by the auxiliary process. Then, the extracted source process identifier and the hash value of the clipboard text block are transmitted through the isolation zone to the main probe running in the high-privilege isolation zone using the one-way named pipe of the terminal operating system. The main probe receives the source process identifier and the hash value of the clipboard text block. Based on the received source process identifier, it retrieves and calls the corresponding attribute in the memory tainted process library to confirm that the clipboard operation was initiated by a controlled source. It then writes the associated clipboard text block hash value into the tainted clipboard slot to generate a high-tightness clip cache.
[0037] In this optional embodiment, spawning an auxiliary process in the current user's interaction session area includes: By utilizing the main probe service residing in the zero-isolation session area of the terminal operating system, a very lightweight auxiliary process is derived with reduced privileges and then resides in the current user's interactive session area.
[0038] In this optional embodiment, the step of comparing the network and process-level fingerprint or interface window-level fingerprint of the abnormal event after rights confirmation with the dynamically issued feature fingerprint database, generating an audit log containing a high-risk warning label for AI exposure surface based on the comparison result, and executing corresponding audit or blocking strategies includes: The target domain name SNI suffix or process name of the abnormal event after confirmation of rights is compared with the domain name SNI suffix of the public AI model or the process name of the AI client tool recorded in the feature fingerprint database to complete the fingerprint comparison at the network and process levels. When clipboard pasting or network sending occurs, the title feature keywords of the current foreground window are compared with the title feature keywords of the web version AI assistant recorded in the feature fingerprint database to complete the fingerprint comparison at the interface window level. When either network-level or process-level fingerprint comparison or interface window-level fingerprint comparison is satisfied, an audit log containing a high-risk warning label for AI exposure surface is generated locally, and a strategy of blocking and cutting off network connection or writing to trace audit log is executed.
[0039] In this optional embodiment, the feature fingerprint database is distributed from the cloud and can be hot-updated. The feature fingerprint database records the domain name suffix SNI of public AI models, the process name of AI client tools, and the feature keywords of the front-end window title of the web-based AI assistant.
[0040] In this optional embodiment, if either network-level or process-level fingerprint comparison or interface window-level fingerprint comparison is not satisfied, it is recorded as a normal network outbound event and no high-risk AI exposure warning label is attached.
[0041] In this optional embodiment, the audit log includes a chain of evidence in three core dimensions: the source process, associated sensitive files, and the target AI model vendor.
[0042] In this optional embodiment, when a conviction network sends an event, the main probe is located in a bypass at the terminal operating system level and does not perform man-in-the-middle certificate decryption or payload content restoration operations for HTTPS encrypted network traffic.
[0043] Figure 2 An embodiment of a silent monitoring system for data exposure surfaces according to the present invention is shown.
[0044] In this optional embodiment, the data exposure surface silent monitoring system includes: The source process identifier extraction module 201 is used to determine the event type based on the terminal user's behavior scenario and extract the source process identifier that triggered the event in the terminal operating system. The event types include network sending events and clipboard operation events. The abnormal behavior preliminary screening module 202 is used to identify abnormal events based on the source process identifier and in combination with a preset memory taint process library, so as to achieve preliminary screening of abnormal behavior and event triggering. Event authorization module 203 is used to perform behavior authorization on the corresponding abnormal events by using a two-factor network traffic conviction mechanism or a cross-session clipboard tracing mechanism, combined with the source process identifier. Specifically, when the abnormal event type is a network sending event, the behavior authorization is performed using the two-factor network traffic conviction mechanism, and when the abnormal event type is a clipboard operation event, the behavior authorization is performed using the cross-session clipboard tracing mechanism. The feature fingerprint comparison module 204 is used to compare the network and process-level fingerprints or interface window-level fingerprints of abnormal events after rights confirmation with the dynamically distributed feature fingerprint database, generate audit logs containing high-risk warning labels for AI exposure surfaces based on the comparison results, and execute corresponding audit or blocking strategies.
[0045] To facilitate understanding of the above technical solutions of the present invention, the following further explains the above technical solutions of the present invention from the perspective of architecture and principle, as follows: The purpose of this invention is to provide a silent monitoring architecture specifically tailored for large-scale model application scenarios. By breaking down the operating system's barriers through a pioneering "cross-Session clipboard pollution tracking mechanism" and combining it with a "two-factor network traffic conviction mechanism," it achieves accurate capture and highlighting alerts for both "automatic code-level API feeding" and "manual copy-and-paste feeding from web pages" exposures without decrypting the HTTPS traffic payload content.
[0046] In the implementation steps of this invention, the cross-session clipboard pollution tracking mechanism and the two-factor network traffic conviction mechanism are parallel and complementary steps, triggered according to the specific end-user behavior scenario, and there is no strict order between them. Specifically: when a clipboard update event of the terminal operating system is detected, the "cross-session clipboard pollution tracking mechanism" is triggered to deal with the scenario of "manual copy and paste feeding" by the user on the web page; when a low-level network transmission event of the terminal operating system is detected, the "two-factor network traffic conviction mechanism" is triggered to deal with the scenario of "silent automatic feeding" by the AI programming assistant in the background.
[0047] Before triggering the two mechanisms mentioned above, it is necessary to identify abnormal events by comparing the source process identifier with a preset memory taint process library. This allows for preliminary screening of abnormal behavior and event triggering, ensuring that the system only monitors high-risk processes for resource consumption. In the cross-session clipboard tracing mechanism, after cross-session data is returned, the main probe performs a closed-loop authorization process. By re-verifying the process identifier, it forcibly associates fragmented user behavior data (hash values) with the system-level security status (taint library), thus providing a reliable data foundation for subsequent "high-risk clipboard caching." The two mechanisms are mutually causal and together constitute the complete link from behavior discovery to evidence consolidation in the "silent monitoring" of this invention.
[0048] I. Cross-Session Clipboard Pollution Tracking Mechanism (referred to as Cross-Session Clipboard Source Tracing Mechanism, to address manual clipboard feeding on the web page) For scenarios where employees manually copy confidential documents and paste them into a large web-based model, this invention employs a master-slave collaborative architecture to break Session 0 isolation: 1) Pre-emptive monitoring with reduced privileges: The main probe service, which resides in the Session 0 isolation zone (i.e., the terminal operating system's zero isolation session zone), spawns a very lightweight auxiliary process (User-Mode Helper) with reduced privileges, which resides in the current user's interactive session zone (Session 1).
[0049] 2) Action Capture and IPC Penetration: The auxiliary process subscribes to the system clipboard sequence number in real time. When the sequence number is updated (i.e., a copy action occurs), the auxiliary process immediately extracts the source process identifier (PID) of the currently active foreground window and the hash value of the clipboard text block, and pushes it to the main probe of Session 0 through the one-way named pipe of the terminal operating system to penetrate the firewall.
[0050] 3) Tainted Clipboard Confirmation and Clipboard Caching: After receiving the PID, the main probe queries the "Tainted Process Database (Tainted_PIDs)" in memory (this database records all processes that have read confidential files, i.e., all processes that have read sensitive assets)". If the PID extracted and transmitted by the auxiliary process matches the tainted PID recorded in Tainted_PIDs, it proves that the clipboard content originates from a classified document. The main probe immediately places the text hash into a specific tainted clipboard slot (Tainted_Clipboard), forming a highly sensitive clipboard cache with short-term validity.
[0051] II. Two-Factor Network Traffic Sentencing Mechanism (Addressing Silent Background Feeding of AI Tools) For scenarios where AI programming assistants automatically upload data in the background, this invention performs funnel-style filtering and determination of the underlying network sending events (NET_SEND) without decrypting the traffic. In this mechanism, "pre-filtering," "factor one," and "factor two" constitute a strict sequential logical relationship. Only after pre-filtering is successful does the flow proceed to factor one; only after factor one exceeds the limit does the flow proceed to factor two, progressing layer by layer to achieve funnel-style noise reduction. 1) Pre-filtering: Extract the source process identifier that initiates the network transmission and verify whether it belongs to the Tainted_PIDs library. If not, the outgoing source is safe and can be allowed directly without consuming subsequent computing resources; if it is, it is regarded as a suspicious outgoing source and the network transmission event is transferred down to Factor 1 for load determination.
[0052] 2) Factor 1 (Payload Burst): For suspicious network transmission events that have passed through the pre-filter, the bypass network capture component hooks at the transport layer based on the terminal operating system's network filtering framework (such as WFP). It calculates the instantaneous uplink network packet payload size by accumulating the outbound bytes of the target PID within a specific time window. If the payload size does not exceed the preset high-risk threshold (e.g., greater than 2KB), it is regarded as a regular TCP heartbeat keep-alive packet and application telemetry packet, and is allowed to pass directly without alarm; only when the payload size exceeds the preset high-risk threshold is it transferred down to Factor 2.
[0053] 3) Factor Two (Foreground Activity Determination): Combining the terminal operating system's focus events, detect whether the process that triggered the network outbreak is in a user-initiated foreground active or highly interactive state. If it does, it indicates that the business request was actively triggered by the user, thus completing the final determination (i.e., it is determined to be a network escape event); if it does not, it indicates that it is a meaningless concurrent request for static resources in the browser background or a regular background synchronization, which is filtered and allowed.
[0054] Specifically, the core logic of network escape event determination lies in using the factor of "active foreground / strong interaction" as a "calibrator" for the authenticity of behavior. If the condition is met, it indicates that the network outbreak was triggered by the user's current explicit intent (such as clicking to send, AI dialogue, code completion), which meets the characteristics of a network escape event. The system will capture its process-level fingerprint and generate an alert. If the condition is not met, it is regarded as background noise and allowed to proceed. Through this mapping relationship, the present invention can transform complex system behaviors into standardized security events, ensuring the accuracy of the "high-risk AI exposure warning" label in the audit log.
[0055] III. Dynamic AI Feature Fingerprint Database (hereinafter referred to as Feature Fingerprint Database) and Highlight Interceptor Once a security incident is identified as a high-risk outbound event through the aforementioned clipboard contamination mechanism or two-factor network funnel, the system performs a final "AI-driven" fingerprint comparison: 1) Dynamic dictionary loading: The monitoring system (main probe service) of this invention maintains a lightweight "public AI service fingerprint database" in local memory, which is distributed from the cloud and can be hot-updated. This fingerprint database specifically includes the domain name suffix SNI of public AI models, the process name of AI client tools, and the characteristic keywords of the front-end window title of the web-based AI assistant.
[0056] 2) Dual-modal comparison: First, network and process-level fingerprinting: compare the target domain name SNI suffix (e.g., api.openai.com) or process name (e.g., Cursor.exe or openclaw.exe) of the network escape event. Second, UI window (interface window)-level fingerprinting: compare the title keyword of the current foreground window when clipboard pasting or network transmission occurs (e.g., containing "-ChatGPT" or "Kimi Smart Assistant").
[0057] 3) Alert Escalation: If any of the above fingerprints are matched, the system will no longer record it as a regular network escape when generating local SQLite audit logs. Instead, it will directly escalate the alert severity level and add a unique "[High-Risk AI Exposure Surface Warning]" tag. The log content will be required to include a chain of evidence from three core dimensions: the source process, associated sensitive files, and the target AI model vendor. If no fingerprint is matched, it will be recorded as a normal network outbound event without the "High-Risk AI Exposure Surface Warning" tag.
[0058] Furthermore, to make the objectives, technical solutions, and advantages of this invention clearer, the method of this invention will be further described in detail below with reference to a specific enterprise data breach prevention (DLP) application scenario.
[0059] [Application Scenario Setting] To prevent the leakage of core source code and financial data, a high-tech company deployed the monitoring system of this invention on its employees' terminals (operating system Windows 11). The system has a preset high-risk network load burst threshold of 2KB. The dynamically distributed "public AI service fingerprint database" includes: domain name suffixes api.openai.com and api.cursor.sh, and the window title feature "- ChatGPT".
[0060] [Step 1: Accessing and Marking Classified Assets (Preparatory Steps)] 1) An employee opened a core confidential file named Core_Algorithm.cpp in the session area (Session 1).
[0061] 2) The monitoring module at the terminal operating system level detected the reading behavior and extracted the source process currently performing the reading operation as Cursor.exe, with a process ID (PID) of 8024.
[0062] 3) The main probe dynamically adds PID 8024 to the "Tainted PIDs" library in memory.
[0063] [Step 2: Exposure Surface Event Triggering and Source Tracing (Core Workflow)] Scenario A: Cross-session clipboard tracing (to deal with human webpage feeding) 1) An employee selects a confidential text file and presses Ctrl+C in another document editor, Notepad.exe (assuming PID 9011, which has read confidential financial statements and is marked as a tainted process).
[0064] 2) The ultra-lightweight helper process residing in Session 1 detects the auto-incrementing system clipboard serial number, immediately extracts the source process identifier PID 9011 of the currently active foreground window, and calculates the hash value of the clipboard text (such as 0xA1B2C3...).
[0065] 3) The auxiliary process transmits PID 9011 and hash value through the isolation zone to the main probe of Session 0 via a one-way named pipe mechanism.
[0066] 4) The main probe verification found that PID 9011 exists in the Tainted_PIDs tainted process library, so the hash value was written to the Tainted_Clipboard tainted slot to generate a slice cache.
[0067] 5) Subsequently, the employee opened a browser (actively in the foreground), accessed the web version of ChatGPT, and pasted the clipboard content into the dialog box. The main probe detected an outbound network event and the foreground window title containing "- ChatGPT" (hitting the second type of fingerprint in the database), and the current clipboard status was "contaminated," which was determined to be a high-risk behavior and triggered an alarm.
[0068] Scenario B: Two-factor network traffic conviction (automatic feed of responses in the background) 1) An employee is writing code using Cursor.exe (PID 8024). The AI assistant function of this IDE tool attempts to automatically upload the current context code to the cloud for logic completion, which triggers a network send event (NET_SEND).
[0069] 2) Pre-filtering: The main probe extracts the source identifier of the network sending as PID 8024. Verification shows that it exists in the Tainted_PIDs library, and proceeds to the next step.
[0070] 3) Factor 1 (Load Burst): The bypass network capture component detected at the transport layer that the outbound byte count of this PID reached 45KB within 1 second. Since 45KB > 2KB (preset high-risk threshold), regular heartbeat packets were successfully filtered out, and the process proceeded to the next step.
[0071] 3) Factor Two (Foreground Active): Based on system focus events, Cursor.exe is detected to be in a foreground active state where the user is typing on the keyboard. If both Factor One and Factor Two are satisfied simultaneously, it is confirmed as a network escape event.
[0072] 4) Fingerprint Comparison and Alerts: Target network characteristics are extracted, revealing that the destination domain SNI of the traffic is api.cursor.sh (matching the first type of fingerprint feature). The system immediately blocks the TCP connection and generates an audit log with the tag "[AI Exposure Surface High-Risk Warning]" in the local SQLite, recording the evidence chain (source process Cursor.exe + associated file Core_Algorithm.cpp + target vendor Cursor).
[0073] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 3 As shown, the computer device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database stores static and dynamic information data. The network interface communicates with external terminals via a network connection. When the computer program is executed by the processor, it implements the steps in the above method embodiments.
[0074] Those skilled in the art will understand that Figure 3 The structure shown is merely a block diagram of a portion of the structure related to the present invention and does not constitute a limitation on the computer device to which the present invention is applied. A specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.
[0075] In addition, the present invention also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.
[0076] In addition, the present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps in the above method embodiments.
[0077] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. Any references to memory, storage, databases, or other media used in the embodiments provided by this invention can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, or optical storage, etc. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.
[0078] This invention is not limited to the structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this invention is limited only by the appended claims.
Claims
1. A method for silent monitoring of data exposure surfaces, characterized in that, include: The event type is determined based on the end user's behavior scenario, and the source process identifier that triggered the event is extracted from the terminal operating system. The event types include network sending events and clipboard operation events. Based on the source process identifier, combined with a pre-defined memory taint process library, abnormal events are identified to achieve preliminary screening of abnormal behavior and event triggering. By using a two-factor network traffic conviction mechanism or a cross-session clipboard tracing mechanism, combined with the source process identifier, the behavior of the corresponding abnormal event is determined. Specifically, when the abnormal event type is a network sending event, the behavior is determined using the two-factor network traffic conviction mechanism, and when the abnormal event type is a clipboard operation event, the behavior is determined using the cross-session clipboard tracing mechanism. After the rights are confirmed, the network and process-level fingerprints or interface window-level fingerprints of abnormal events are compared with the dynamically distributed feature fingerprint database. Based on the comparison results, audit logs containing high-risk warning labels for AI exposure surfaces are generated, and corresponding audit or blocking strategies are executed.
2. The data exposure surface silent monitoring method according to claim 1, characterized in that, When the abnormal event type is a network transmission event, a two-factor network traffic sentencing mechanism is used to determine the rights of the behavior, including: The process checks whether the source process identifier of the abnormal event exists in the preset memory tainted process library. If not, it is determined to be an external source and allowed directly. If it is, it is determined to be a suspicious network sending event and the next step is executed. The preset memory tainted process library records all processes that have read sensitive assets. The payload of the instantaneous uplink network data packets of the network transmission event is calculated by accumulating the outbound bytes of the source process identifier of the suspicious network transmission event within a preset time window. Determine whether the payload of the instantaneous uplink network data packet exceeds the preset payload burst threshold. If not, it is determined to be a regular heartbeat keep-alive packet and an application telemetry packet, and is allowed to pass directly without alarm. If it is, the network burst process is triggered and the next step is executed. By utilizing the focus events of the terminal operating system, it detects whether the process that triggered the network outbreak is in an active or highly interactive state in the user's foreground. If so, it is determined to be a network escape event; otherwise, it is determined to be a meaningless concurrent request for static resources in the browser background or a regular background synchronization, and is filtered and allowed.
3. The data exposure surface silent monitoring method according to claim 1, characterized in that, When the abnormal event type is a clipboard operation event, the behavior is identified using a cross-session clipboard sourcing mechanism, including: A helper process is spawned in the current user's interactive session area, and the helper process is used to subscribe to the clipboard serial number of the terminal operating system in real time. When the clipboard serial number is updated, the source process identifier and the hash value of the clipboard text block of the currently active foreground window are extracted by the auxiliary process. Then, the extracted source process identifier and the hash value of the clipboard text block are transmitted through the isolation zone to the main probe running in the high-privilege isolation zone using the one-way named pipe of the terminal operating system. The main probe receives the source process identifier and the hash value of the clipboard text block. Based on the received source process identifier, it retrieves and calls the corresponding attribute in the memory tainted process library to confirm that the clipboard operation was initiated by a controlled source. It then writes the associated clipboard text block hash value into the tainted clipboard slot to generate a high-tightness clip cache.
4. The data exposure surface silent monitoring method according to claim 3, characterized in that, Derive helper processes from the current user's interactive session area, including: By utilizing the main probe service residing in the zero-isolation session area of the terminal operating system, a secondary process is spawned with reduced privileges and then resided in the current user's interactive session area.
5. The data exposure surface silent monitoring method according to claim 1, characterized in that, The process involves comparing the network and process-level fingerprints or interface window-level fingerprints of abnormal events after rights confirmation with a dynamically distributed feature fingerprint database. Based on the comparison results, an audit log containing a high-risk warning label for AI exposure is generated, and corresponding audit or blocking strategies are executed, including: The target domain name SNI suffix or process name of the abnormal event after confirmation of rights is compared with the domain name SNI suffix of the public AI model or the process name of the AI client tool recorded in the feature fingerprint database to complete the fingerprint comparison at the network and process levels. When clipboard pasting or network sending occurs, the title feature keywords of the current foreground window are compared with the title feature keywords of the web version AI assistant recorded in the feature fingerprint database to complete the fingerprint comparison at the interface window level. When either network-level or process-level fingerprint comparison or interface window-level fingerprint comparison is satisfied, an audit log containing a high-risk warning label for AI exposure surface is generated locally, and a strategy of blocking and cutting off network connection or writing to trace audit log is executed.
6. The data exposure surface silent monitoring method according to claim 5, characterized in that, The feature fingerprint database is distributed from the cloud and can be hot-updated. The feature fingerprint database records the domain name suffix SNI of public AI models, the process name of AI client tools, and the feature keywords of the front-end window title of the web version AI assistant.
7. The data exposure surface silent monitoring method according to claim 5, characterized in that, If either network-level or process-level fingerprint comparison or interface window-level fingerprint comparison is not met, it will be recorded as a normal network outbound event without attaching a high-risk AI exposure warning label.
8. The data exposure surface silent monitoring method according to claim 5, characterized in that, The audit log includes a chain of evidence across three core dimensions: the source process, associated sensitive documents, and the target AI model vendor.
9. The data exposure surface silent monitoring method according to claim 1, characterized in that, When a conviction network sends an event, the main probe is located in a low-level bypass of the terminal operating system and does not perform man-in-the-middle certificate decryption or payload content restoration operations for HTTPS encrypted network traffic.
10. A silent monitoring system for data exposure surfaces, characterized in that, include: The source process identifier extraction module is used to determine the event type based on the terminal user's behavior scenario and extract the source process identifier that triggered the event in the terminal operating system. The event types include network sending events and clipboard operation events. The abnormal behavior preliminary screening module is used to identify abnormal events based on the source process identifier and in combination with a preset memory taint process library, so as to achieve preliminary screening of abnormal behavior and event triggering. The event authorization module is used to authorize the behavior of corresponding abnormal events by combining the source process identifier with the two-factor network traffic conviction mechanism or the cross-session clipboard tracing mechanism. Specifically, when the abnormal event type is a network sending event, the two-factor network traffic conviction mechanism is used to authorize the behavior, and when the abnormal event type is a clipboard operation event, the cross-session clipboard tracing mechanism is used to authorize the behavior. The feature fingerprint comparison module is used to compare the network and process-level fingerprints or interface window-level fingerprints of abnormal events after rights confirmation with the dynamically distributed feature fingerprint database. Based on the comparison results, it generates audit logs containing high-risk warning labels for AI exposure surfaces and executes corresponding audit or blocking strategies.