Sensitive behavior blocking method, device, terminal and storage medium

Abstract

The present application discloses a sensitive behavior blocking method, device, terminal and storage medium, the method comprising: obtaining the sending records of multiple monitored terminal devices when sending files; generating log information based on the sending records, and sending the log information to the analysis server using a preset interface, the log information including the sending records; receiving the indication information returned by the analysis server using the preset interface, the indication information is generated based on the log information of the sensitive behavior, and the indication information is used to indicate the blocking of the sensitive behavior. The control terminal of the embodiment of the present application interacts with the analysis server through the preset interface to perform data exchange, so that the analysis server analyzes the behavior of the terminal device sending files using the sending records, so that the control terminal can use the indication information issued by the analysis server to block sensitive behaviors, thereby realizing real-time detection and blocking of sensitive behaviors.

Description

[0001] Technology Neighborhood

[0002] The present application generally relates to the field of computer technology, and specifically relates to a sensitive behavior blocking method, device, terminal and storage medium. Background Art

[0003] With the development of computer technology, enterprises in the express delivery industry usually use the network for data exchange to realize various businesses. In the process of data exchange, a large amount of data with characteristics of the logistics industry will be generated. For example, during the logistics transportation of the entire package, user privacy information in the logistics transportation and top-secret information within the enterprise will be generated.

[0004] At present, in order to prevent the leakage of user privacy and corporate privacy information, traditional detection equipment is used to audit the behavior data released to the outside later, or to detect whether it contains sensitive information through hanging equipment. Traditional detection equipment is used to detect the data generated by all terminal devices in the enterprise.

[0005] Traditional detection equipment is unable to identify sensitive behaviors in the logistics industry in real time and effectively block corresponding operational behaviors, which makes privacy information in the logistics industry easy to leak. Summary of the invention

[0006] In view of the above-mentioned defects or deficiencies in the prior art, it is desirable to provide a sensitive behavior blocking method, device, terminal and storage medium to achieve real-time blocking of sensitive behaviors.

[0007] In a first aspect, an embodiment of the present application provides a sensitive behavior blocking method, the method comprising:

[0008] Obtain the sending records of multiple monitored terminal devices when sending files out;

[0009] Generate log information based on the sending record, and send the log information to the analysis server using a preset interface, the log information including the sending record, the log information is used to instruct the analysis server to analyze the behavior of the terminal device when sending files based on the sending record, and determine the terminal device that generates sensitive behavior;

[0010] Receive indication information returned by the analysis server using the preset interface, where the indication information includes an identifier of a terminal device that generates sensitive behavior, and the indication information is used to instruct to block the terminal device that generates the sensitive behavior.

[0011] In a second aspect, an embodiment of the present application provides a sensitive behavior blocking method, the method comprising:

[0012] When sending files outward, a sending record of the outward files is generated and sent to the control terminal;

[0013] Receive a blocking instruction returned by the control terminal, the blocking instruction including parameters of the sensitive behavior to be blocked, the blocking instruction response indication information is generated by the analysis server after analyzing the behavior of the outgoing file based on the sending record and determining that the behavior of the outgoing file is a sensitive behavior;

[0014] In response to the blocking instruction, the sensitive behavior corresponding to the parameter is blocked.

[0015] In a third aspect, an embodiment of the present application provides a sensitive behavior blocking device, the device comprising:

[0016] An acquisition module is used to acquire the sending records of multiple monitored terminal devices when sending files outward;

[0017] A sending module, used to generate log information based on the sending record, and send the log information to the analysis server using a preset interface, wherein the log information includes the sending record, and the log information is used to instruct the analysis server to analyze the behavior of the terminal device when sending files based on the sending record, and determine the terminal device that generates sensitive behavior;

[0018] The receiving module is used to receive the indication information returned by the analysis server using the preset interface, wherein the indication information includes the identifier of the terminal device that generates the sensitive behavior, and the indication information is used to instruct to block the terminal device that generates the sensitive behavior.

[0019] In a fourth aspect, an embodiment of the present application provides a sensitive behavior blocking device, the device comprising:

[0020] The sending module is used to generate a sending record of the outgoing file when sending the file outgoing, and send the sending record to the control terminal;

[0021] A receiving module, used to receive a blocking instruction returned by the control terminal, the blocking instruction including parameters of the sensitive behavior to be blocked, the blocking instruction response indication information is generated by the analysis server after analyzing the behavior of the outgoing file based on the sending record and determining that the behavior of the outgoing file is a sensitive behavior;

[0022] The restriction module is used to block the sensitive behavior corresponding to the parameter in response to the blocking instruction.

[0023] In a fifth aspect, an embodiment of the present application provides a terminal, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor is configured to implement the method described in the first aspect or the second aspect when executing the program.

[0024] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program is used to implement the method as described in the first aspect or the second aspect.

[0025] In summary, the sensitive behavior blocking method, device, terminal and storage medium provided in the embodiments of the present application enable the control terminal to obtain the sending records of outbound files of the terminal device and use a preset interface to interact with the analysis server for data, so that the analysis server uses the sending records to analyze the behavior of outbound files of the terminal device, determine the terminal device that generates sensitive behavior, and return indication information to the control terminal, so that the control terminal can block the sensitive behavior of the terminal device to prevent it from happening again, thereby achieving accurate detection and real-time blocking of sensitive behaviors within the enterprise. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Other features, objects and advantages of the present application will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings:

[0027] Figure 1 A schematic diagram of the architecture of a sensitive behavior blocking system according to an embodiment of the present application;

[0028] Figure 2 A flowchart of a sensitive behavior blocking method according to an embodiment of the present application;

[0029] Figure 3 A flowchart of a sensitive behavior blocking method according to another embodiment of the present application;

[0030] Figure 4 A flowchart of a sensitive behavior blocking method according to another embodiment of the present application;

[0031] Figure 5 A schematic diagram of the structure of a sensitive behavior blocking device according to an embodiment of the present application;

[0032] Figure 6 A schematic diagram of the structure of a sensitive behavior blocking device according to an embodiment of the present application;

[0033] Figure 7 A schematic diagram of the structure of a computer system according to an embodiment of the present application. DETAILED DESCRIPTION

[0034] The present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the relevant application, rather than to limit the application. It is also necessary to explain that, for ease of description, only the parts related to the application are shown in the accompanying drawings.

[0035] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0036] It can be understood that the sensitive behavior blocking of the terminal device in the embodiment of the present application is to ensure the security of the internal data of the enterprise, such as the security of user privacy information in a logistics enterprise. The sensitive behavior of the terminal device sending files involving the leakage of internal data or privacy information can be blocked in time to prevent recurrence.

[0037] In the above scenario, such as in the logistics industry, in order to facilitate the control of the behavior of outgoing files of terminal devices in logistics enterprises, an analysis server and a control terminal are configured. The analysis server performs machine learning analysis on the massive data involved in the industry to dynamically build an analysis model to detect whether the behavior of terminal devices in sending outgoing files during the implementation of logistics industry business is a sensitive behavior of leaking secrets. The control terminal controls all terminal devices within the enterprise that may produce sensitive behaviors. Based on this, a control platform runs on the control terminal, and correspondingly, the client of the control platform is installed on the terminal devices it controls. An interface is developed on the control platform to realize data interaction with the analysis server, to upload the sending record of the behavior of outgoing files of terminal devices, to receive the instruction information issued by the analysis server, and to realize real-time blocking of sensitive behaviors of terminal devices, such as blocking the specific behavior of outgoing files or directly recovering the operation authority of terminal devices.

[0038] In the embodiment of the present application, the schematic diagram of the system architecture for implementing the above-mentioned sensitive behavior blocking can be as follows: Figure 1 As shown:

[0039] The system may include a control terminal 01 , an analysis server 02 , and a terminal device 03 of an internal employee of the enterprise controlled by the control terminal 01 .

[0040] The control terminal 01 can be a hardware device such as a computer, on which a control software is running, that is, a control platform for the outbound behavior of the terminal device, which is used to monitor and control the outbound behavior of the terminal device running a client. Specifically, by providing an interface, uploading the transmission record of the monitored terminal device, receiving the indication information obtained by the upper-level analysis server, and performing real-time behavior blocking on sensitive behaviors with security threats or terminals that generate the sensitive behaviors. The control platform can be implemented based on data leakage prevention (DLP) technology.

[0041] The control terminal stores the supporting data of the controlled terminal devices, such as the identification information of each terminal device can be entered in sequence by the administrator; the control platform can also be configured with security policies for distribution to the controlled terminal devices, so that when the terminal devices send files out, they can first use the security policy to judge sensitive information. In the logistics industry, the sensitive information can be information with logistics industry characteristics such as employee accounts, settlement order numbers and waybill information. The security policy can be generated based on basic information in the industry. For example, in the logistics industry, employee information, settlement order numbers, waybill information and other information with logistics industry characteristics can be set to configure and generate security policies, such as the security policy can be configured by manual input by the company's management personnel.

[0042] The analysis server 02 serves as an upper-level big data engine server, and is used to receive the sending records uploaded by the management and control terminal through the interface provided by the management and control platform. After analyzing the sending records, it sends instruction information to the management and control platform to instruct the management and control terminal to block sensitive behaviors.

[0043] It can be understood that the analysis server has a dynamic analysis model pre-built in it to analyze the sending records of the outgoing files reported by the control terminal to determine whether the outgoing behavior of the corresponding terminal device involves sensitive data, that is, whether it is a sensitive behavior. Then, according to the analysis results, the application server of the control platform sends instruction information to the control terminal 01.

[0044] It can be understood that in the field of logistics industry, the analysis model can be dynamically constructed based on the sensitive information of the logistics industry and the sending records of outgoing files. For example, a discriminator can be constructed by the sending record and the type of the sent file to identify a certain sending record. The type of file can be classified according to sensitive information. The classification of sensitive information for the express delivery industry is not limited to the following types: employee information, customer information, waybill information, encrypted document information, official document information, and process system.

[0045] Terminal device 03 is an operation terminal for internal employees of the enterprise, and can be a hardware device such as a computer or a handheld terminal. It is used by employees to implement business, and can generate external file distribution, such as copying and sharing through a mobile hard disk, accessing the network or sharing a shared folder. External files include word documents, files, pictures or codes involved in the project, etc. The sensitive behavior generated by the terminal device can be the external distribution of company secret files, such as uploading company secret files including customer settlement information to the external network through the Internet.

[0046] A client corresponding to the management server on the control terminal runs on the terminal device, which stores the security policy for sensitive information identification issued by the control terminal, so that when files are sent out, a preliminary analysis can be performed on the outgoing files to determine whether they contain sensitive information.

[0047] It can be understood that the embodiment of the present application utilizes the protocol interface of the management and control platform to implement data interaction with the upper-level analysis server to report the sending records of all terminal devices it monitors, so that the analysis server can determine the sending records corresponding to sensitive behaviors by analyzing the sending records; and then receive the information sent by the analysis server to block sensitive behaviors that pose security threats or terminal devices that generate such sensitive behaviors, thereby realizing real-time blocking of sensitive behaviors of terminal devices.

[0048] For the purpose of understanding and explanation, Figures 2 to 7 The sensitive behavior blocking method, device, terminal and storage medium provided in the embodiments of the present application are explained in detail.

[0049] Figure 2 A flowchart of a sensitive behavior blocking method provided in an embodiment of the present application is shown, and the method is executed by a control terminal, such as Figure 2 As shown, the method includes:

[0050] S210, the management and control terminal obtains the sending records of the multiple monitored terminal devices when sending files outward.

[0051] S220, the management and control terminal generates log information based on the sending record, and sends the log information to the analysis server using a preset interface. The log information includes the sending record, and the log information is used to instruct the analysis server to analyze the behavior of the terminal device when sending files based on the sending record, and determine the terminal device that generates sensitive behavior.

[0052] S230, the management and control terminal receives the indication information returned by the analysis server using the preset interface, where the indication information includes the identifier of the terminal device that generates the sensitive behavior, and the indication information is used to instruct to block the terminal device that generates the sensitive behavior.

[0053] Specifically, the control terminal can monitor the sending record generated when the terminal device sends files. The sending record may include the file name, terminal device identifier, source address and target address of the file sent by the terminal device. The target address may be a file sharing address, a browser address, an instant messaging address or an FTP address.

[0054] After obtaining the sending record of the outgoing file of the terminal device, log information can be generated based on the sending record, and the log information can be uploaded to the analysis server using a pre-developed interface. For example, multiple sending records generated by multiple intercepted terminal devices can be sorted based on the SysLog protocol to generate log information. The log information includes the sending record and may also include the identification of the terminal device that generated the sending record. The log information is used to instruct the analysis server to use a pre-built analysis model to analyze the sending record in the uploaded log information to determine whether the behavior corresponding to the sending record is a sensitive behavior with a security threat.

[0055] When the analysis server finds that the behavior corresponding to the log information is a sensitive behavior, the control terminal can receive indication information, which may include the identifier of the terminal device that generates the sensitive behavior, and may also include sensitive behavior parameters, that is, the identifier of the object to be blocked and the specific behavior parameters of the blocked object, such as the parameters of the behavior of the terminal device that generates the sensitive behavior accessing the browser or accessing the shared folder.

[0056] It can be understood that sensitive behavior refers to the behavior of sending files by terminal devices, which may involve leakage of information. For example, in the logistics industry, waybill information can be shared within the enterprise, but it is not allowed to be sent to the external network, and it is not allowed to be sent to other hardware through the USB interface. When the file including the waybill information is sent externally through sharing, the outbound behavior is not a sensitive behavior; when the file including the waybill information is sent externally through the USB interface or by accessing the external network, the outbound behavior is a sensitive behavior. That is, the analysis model can determine whether the outbound behavior book corresponding to the sending record is a sensitive behavior through the fields in the file name and the target address in the received log information.

[0057] It can be understood that after the management and control terminal receives the indication information, it can block the terminal device that generates sensitive behavior based on the indication information, such as directly restricting all outbound actions of the terminal device that generates the sensitive behavior, or only restricting operations corresponding to the sensitive behavior.

[0058] The sensitive behavior blocking method provided in the embodiment of the present application is that the control terminal obtains the sending records of the outgoing files of the terminal device, and uses a preset interface to interact with the analysis server for data, so that the analysis server uses the sending records to analyze the behavior of the outgoing files of the terminal device, determines the terminal device that generates the sensitive behavior, and returns indication information to the control terminal, so that the control terminal can block the sensitive behavior of the terminal device to prevent it from happening again, thereby realizing accurate detection and real-time blocking of sensitive behaviors within the enterprise.

[0059] Figure 3FIG. 1 is a flow chart of a method for blocking behavior of a terminal device provided in another embodiment of the present application, wherein the method is executed by the terminal device, such as Figure 3 As shown, the method includes:

[0060] S310, when the terminal device sends a file externally, it generates a sending record of the sent file, and sends the sending record to the management and control terminal.

[0061] S320, the terminal device receives a blocking instruction returned by the management and control terminal, the blocking instruction includes parameters of the sensitive behavior to be blocked, and the blocking instruction response indication information is generated by the analysis server after analyzing its behavior when sending files based on the sending record and determining that the behavior when sending files is sensitive behavior.

[0062] S330: The terminal device responds to the blocking instruction and blocks the sensitive behavior corresponding to the parameter.

[0063] Specifically, the sensitive behavior blocking method provided in the embodiment of the present application can generate a record of the outgoing file, i.e., a sending record, when the terminal device sends out files. For example, when sending files through a USB interface, uploading files through a browser, or sharing files through an internal network, the running client can be used to record the source address, target address, and other information of the current outgoing file of the terminal device, such as the disk location where the source file is stored, and send it to the target address such as file sharing, browser, instant messaging, and FTP.

[0064] After obtaining the sending record, the client of the terminal device can upload the sending record to the control terminal, so that the control terminal generates log information after intercepting the sending record. Then, it is uploaded to the analysis server using the preset interface, so that the analysis server can analyze the behavior of the current outgoing file of the terminal device, so that the control terminal can receive the indication information generated based on the analysis result of the analysis server. When the analysis result of the analysis server indicates that the behavior of the outgoing file is a sensitive behavior, the indication information indicates that the terminal device that generates the sensitive behavior needs to be blocked, which may specifically include the identification of the terminal device and the parameters of the sensitive behavior. At this time, the terminal device can receive the blocking instruction generated by the control terminal based on the indication information, and the blocking instruction may include the parameters of the sensitive behavior to be blocked. The terminal device parses the blocking instruction and then responds to the blocking instruction to limit the sensitive behavior. For example, if the blocking instruction includes the parameters of the sensitive behavior, the terminal device can respond to the blocking instruction after parsing the parameter to prohibit the program corresponding to the sensitive behavior.

[0065] For example, when parsing a blocking instruction and determining that the behavior to be blocked is USB sharing, accessing an external network, or accessing file sharing, the terminal device can respond to the blocking instruction by disabling the USB interface, prohibiting access to an external network, prohibiting access to file sharing, or prohibiting outgoing emails.

[0066] It can be understood that in practice, when the control terminal determines the terminal device that has generated sensitive behavior based on the indication information returned by the analysis server, when blocking the sensitive behavior, that is, when issuing a blocking instruction to the terminal device, it can only prohibit the recurrence of the sensitive behavior, or it can completely prohibit the terminal device, such as revoking all operating permissions of the terminal device, that is, prohibiting the use of the FTP protocol. If the control terminal finds that a terminal device has generated multiple sensitive behaviors, it can completely prohibit the terminal device.

[0067] The sensitive behavior blocking method provided in the embodiment of the present application can receive a blocking instruction issued by the control terminal after the generated sending record is reported to the control terminal when sending a file externally, and then can respond to the blocking instruction to block sensitive behaviors that pose a threat, thereby realizing real-time detection and blocking of sensitive behaviors of terminal devices.

[0068] In order to better understand the sensitive behavior blocking method provided in the embodiment of the present application, Figure 4 The specific blocking process of the sensitive behavior of the terminal device is described in detail. The method is executed by the terminal device, the control terminal and the analysis server. The method includes:

[0069] S401, the terminal device analyzes the file to be sent out based on the security policy to determine whether the file contains sensitive information.

[0070] S402: When sensitive information is included, a sending record is generated.

[0071] S403: The terminal device sends the sending record to the management and control terminal.

[0072] Specifically, in an embodiment of the present application, when a terminal device sends a file externally, it can first use a pre-stored security policy to scan the file to be sent externally to identify whether the file to be sent externally includes sensitive information.

[0073] It is understood that if the security policy scan finds that the file to be sent out contains sensitive information, it means that the file to be sent out does not meet the confidentiality requirements of the enterprise, and the sending of the file to be sent out is terminated. Optionally, in one implementation, the file to be sent out can be backed up to a separately configured backup server for later viewing and evidence collection.

[0074] If the security policy scan finds that the file to be sent does not contain sensitive information, the terminal device can send the file to be sent. At this time, during the process of the terminal device sending the file, a sending record of the sending behavior can be generated, that is, the name, source address and destination address of the file to be sent can be recorded. In addition, the type of the file to be sent can be determined according to the classification in the security policy, that is, the type of the file to be sent can be added to the sending record.

[0075] It can be understood that in the present application example, the terminal device stores a security policy pre-issued by the control terminal. The security policy may include a combination of multiple sensitive information. For example, in the logistics industry, employee information, customer information, waybill information, encrypted document information, official document information, process system and other information may be configured as security policies. The file types can be classified for files in the express delivery industry, and are not limited to the following types: employee information, customer information, waybill information, encrypted document information, official document information and process system, etc.

[0076] S404, the management and control terminal receives the sending record.

[0077] S405: The management and control terminal generates log information based on the sending record.

[0078] S406: The management and control terminal sends the log information to the analysis server.

[0079] Specifically, after intercepting the sending record of the outgoing file of the terminal device, the control terminal can generate a sending record of the terminal device based on the sending record, and then use a preset interface to report the sending record of the outgoing behavior to the analysis server.

[0080] For example, after intercepting the outbound behavior record of the terminal device, the terminal device can use the SysLog protocol to organize and encapsulate the outbound behavior sending record of the terminal device based on a preset period to generate log information. The log information may include the sending records of multiple outbound files of multiple terminal devices for batch analysis by the analysis server. After generating the log information, the management and control terminal can report the log information to the analysis server.

[0081] Optionally, when the management and control terminal can report the log information to the analysis server, it can upload it using a preset API interface.

[0082] S407, the analysis server receives the log information, uses a pre-built machine learning model to analyze the sending record, and generates indication information.

[0083] S408, the analysis server sends the instruction information to the management and control terminal.

[0084] Specifically, after the analysis server receives the log information of the terminal device reported by the management and control terminal, the log information can be input into a pre-built analysis model, and the input log information can be identified using the analysis model to determine whether there is sensitive behavior in the behavior corresponding to the log information.

[0085] It can be understood that when the analysis server has completed the analysis of all the sending records in the log information, it outputs the analysis results, that is, the analysis results include the sending records indicating that a certain terminal device is a sensitive behavior. Then the analysis results can be analyzed to generate indication information. That is, the terminal device corresponding to the sending records belonging to sensitive behaviors can be analyzed. If multiple sending records are for the same terminal device, it means that the terminal device has multiple sensitive behaviors, indicating that the terminal device is in a high-risk state. The content in the indication information can be an instruction for indicating that all permissions are prohibited for the terminal device, such as parameters that may include permissions for the terminal device. If the analysis finds that a certain terminal device has only one sensitive behavior, such as the use of file sharing to send sensitive files, the content in the generated indication information can indicate that the terminal device is prohibited from using file sharing permissions, including parameters for prohibiting some permissions.

[0086] It can be understood that the indication information may include parameters of multiple sensitive behaviors of multiple terminal devices managed by the control terminal. For example, after analysis by the analysis server, it is found that multiple terminal devices have performed sensitive behaviors, and some terminal devices have performed multiple sensitive behaviors.

[0087] In practice, when the control terminal uses the API interface to obtain specific instruction information, it can first generate a URL and send it to the blocking management module of the analysis server to obtain a token to complete the identity authentication of the control terminal. After the identity authentication of the control terminal is successful, the instruction information can be returned to the control terminal. It can be understood that the instruction information may include the parameters of the sensitive behavior and the identification of the terminal device that generated the sensitive behavior.

[0088] S409: The management and control terminal receives and analyzes the instruction information.

[0089] S410, the management and control terminal generates a blocking instruction based on the instruction information.

[0090] S411, the management and control terminal sends the blocking instruction to the terminal device.

[0091] Specifically, after receiving the indication information returned by the analysis server, that is, the indication information obtained from the blocking management module through the API interface, the control terminal can parse the indication information to obtain the parameters of the sensitive behavior and the identifier of the terminal device that generated the sensitive behavior. Then, the parsed content can be used to generate a blocking instruction for each terminal device that generates sensitive behavior and send it to the corresponding terminal device. The blocking instruction can also include the user ID of the terminal device and the effective time of the blocking.

[0092] For example, after parsing and obtaining the identification of the terminal device where the sensitive behavior occurs, and the parameters of the sensitive behavior that occurs on each terminal device, the management and control terminal can use the identification of the terminal device to retrieve the terminal device where the sensitive behavior occurs, and then generate a blocking instruction corresponding to each terminal device. If the indication information indicates that a terminal device needs to be completely prohibited, that is, multiple sensitive behaviors have occurred, then the blocking instruction generated for the terminal device is used to completely prohibit the terminal, that is, prohibit all interfaces for outgoing files. If the indication information indicates that some permissions of a terminal device are prohibited, that is, the terminal device has one or two sensitive behaviors, then the blocking instruction generated for the terminal device may only include the parameters of the sensitive behavior to prohibit the interface where the sensitive behavior occurs, while other interfaces can be used normally.

[0093] S412: The terminal device receives the blocking instruction.

[0094] S413: The terminal device responds to the blocking instruction and blocks the sensitive behavior corresponding to the parameters that generate the sensitive behavior.

[0095] Specifically, after receiving the blocking instruction sent by the control terminal, the terminal device can parse the blocking instruction to obtain the content of the blocking instruction, and then respond to the blocking instruction to block the sensitive behavior corresponding to the parameters that generate sensitive behaviors, such as prohibiting the interface that generates sensitive behaviors, or prohibiting all interfaces that issue outbound behaviors.

[0096] For example, when parsing a blocking instruction and determining that the behavior to be blocked is USB sharing, accessing an external network, or accessing file sharing, the terminal device can respond to the blocking instruction by disabling the USB interface, prohibiting access to an external network, prohibiting access to file sharing, or prohibiting outgoing emails.

[0097] The sensitive behavior blocking method provided in the embodiment of the present application is that the control terminal monitors the sending records of outgoing files that do not include sensitive information through security policy scanning, and then encapsulates the monitored sending records into log information of the terminal device, and sends it to the analysis server, so that the analysis server uses a pre-built analysis model to analyze the log information to determine the log information corresponding to the sensitive behavior, and generates indication information including parameters of the sensitive behavior based on the log information corresponding to the sensitive behavior, and returns it to the control terminal. The control terminal uses the indication information to generate a blocking instruction, and sends it to the terminal device that generates the sensitive behavior, so that the terminal device performs a blocking operation on the sensitive behavior, thereby realizing real-time and effective blocking of sensitive behaviors in the logistics industry and ensuring enterprise information security.

[0098] On the other hand, Figure 5 As shown, the embodiment of the present application also provides a sensitive behavior blocking device, the device 500 includes:

[0099] The acquisition module 510 is used to obtain the sending records of the outgoing files of the multiple terminal devices monitored by it.

[0100] The sending module 520 is used to generate log information based on the sending record, and send the log information to the analysis server using a preset interface. The log information includes the sending record, and the log information is used to instruct the analysis server to analyze the behavior of the outgoing files of the terminal device based on the sending record to determine the terminal device that generates sensitive behavior.

[0101] The receiving module 530 is used to receive the indication information returned by the analysis server using the preset interface, wherein the indication information includes the identifier of the terminal device that generates the sensitive behavior, and the indication information is used to instruct to block the terminal device that generates the sensitive behavior.

[0102] Optionally, the sensitive behavior blocking device provided in the embodiment of the present application further includes:

[0103] The generation module 540 generates a blocking instruction based on the indication information, and sends the blocking instruction to the terminal device with the sensitive behavior. The blocking instruction is used to enable the terminal device with the sensitive behavior to block the sensitive behavior. The indication information and the blocking instruction include parameters of the sensitive behavior to be blocked.

[0104] Optionally, in the sensitive behavior blocking device provided in the embodiment of the present application, the first sending module is specifically used for:

[0105] Use the API interface to send the log information to the analysis server.

[0106] Optionally, the sensitive behavior blocking device provided in the embodiment of the present application further includes:

[0107] Configuration module 550 is used to generate a security policy and send the security policy to all the terminal devices. The security policy is generated based on basic information, and the basic information at least includes logistics information. When the basic information is used to instruct the terminal device to send a file, it is determined based on the security policy whether the file to be sent includes sensitive information.

[0108] On the other hand, Figure 6 As shown, a structural diagram of a sensitive behavior blocking device provided by another embodiment of the present application is as follows. Figure 6 As shown, the device 600 includes:

[0109] A generating module 610 is used to generate a sending record of an outgoing file and send the sending record to a control terminal;

[0110] The receiving module 620 is used to receive a blocking instruction returned by the control terminal, wherein the blocking instruction includes parameters of the sensitive behavior to be blocked, and the blocking instruction is generated in response to the indication information, which is generated after the analysis server analyzes the behavior of its outgoing file based on the sending record and determines that it has sensitive behavior;

[0111] The blocking module 630 is used to limit the sensitive behavior corresponding to the parameter in response to the blocking instruction.

[0112] Optionally, the sensitive behavior blocking device provided in the embodiment of the present application further includes:

[0113] The determination module 640 is used to analyze the file to be sent out based on the security policy, and generate the sending record when the file does not contain sensitive information. The security policy is generated based on basic information, and the basic information at least includes logistics information.

[0114] On the other hand, an embodiment of the present application also provides a terminal, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and when the processor executes the program, the sensitive behavior blocking method as described above is implemented.

[0115] Reference below Figure 7 , which shows a schematic diagram of the structure of a computer system 700 suitable for implementing a server or terminal of an embodiment of the present application.

[0116] like Figure 7As shown, the computer system 700 includes a central processing unit (CPU) 101, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 102 or a program loaded from a storage part 103 to a random access memory (RAM) 103. In the RAM 103, various programs and data required for the operation of the system 100 are also stored. The CPU 101, the ROM 102, and the RAM 103 are connected to each other through a bus 104. An input / output (I / O) interface 105 is also connected to the bus 104.

[0117] The following components are connected to the I / O interface 101: an input section 106 including a keyboard, a mouse, etc.; an output section 107 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 108 including a hard disk, etc.; and a communication section 109 including a network interface card such as a LAN card, a modem, etc. The communication section 109 performs communication processing via a network such as the Internet. A drive 110 is also connected to the I / O interface 105 as needed. A removable medium 111, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 110 as needed, so that a computer program read therefrom is installed into the storage section 108 as needed.

[0118] In particular, according to the embodiment of sensitive behavior blocking disclosed in this application, the above reference Figure 1 The described process may be implemented as a computer software program. For example, the embodiments of sensitive behavior blocking disclosed in the present application include a computer program product, which includes a computer program tangibly embodied on a machine-readable medium, the computer program including a computer program for executing Figure 1 In such an embodiment, the computer program may be downloaded and installed from a network via the communication section 101 , and / or installed from the removable medium 111 .

[0119] It should be noted that the computer-readable medium shown in the present invention can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media can include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system, device or device.

[0120] In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, device, or device. The program code contained on the computer-readable medium may be transmitted using any suitable medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0121] The flowchart and block diagram in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the system, method and computer program product according to various sensitive behavior blocking embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the aforementioned module, a program segment or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or the flowchart, and the combination of the boxes in the block diagram and / or the flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0122] The units or modules involved in the embodiments of the present application may be implemented in software or hardware. The units or modules described may also be provided in a processor. For example, they may be described as follows: a processor includes an acquisition module, a sending module, and a receiving module. Among them, the names of these units or modules do not constitute limitations on the units or modules themselves in certain circumstances. For example, the receiving module may also be described as "used to receive indication information returned by the analysis server using the preset interface, wherein the indication information is used to indicate blocking of the sensitive behavior".

[0123] As another aspect, the present application further provides a computer-readable storage medium, which may be the computer-readable storage medium included in the aforementioned device in the above embodiment; or may be a computer-readable storage medium that exists independently and is not assembled into the device. The computer-readable storage medium stores one or more programs, and the aforementioned programs are used by one or more processors to execute the sensitive behavior blocking method described in the present application, specifically executing:

[0124] Obtain the sending records of outgoing files from multiple monitored terminal devices;

[0125] Generate log information based on the sending record, and send the log information to the analysis server using a preset interface, wherein the log information includes the sending record, and the log information is used to instruct the analysis server to analyze the behavior of the outgoing file of the terminal device based on the sending record to determine the terminal device that generates sensitive behavior;

[0126] Receive indication information returned by the analysis server using the preset interface, wherein the indication information includes an identifier of a terminal device that generates sensitive behavior, and the indication information is used to instruct to block the terminal device that generates the sensitive behavior.

[0127] In summary, the sensitive behavior blocking method, device, terminal and storage medium provided in the embodiments of the present application enable the control terminal to obtain the sending records of outbound files of the terminal device and use a preset interface to interact with the analysis server for data, so that the analysis server uses the sending records to analyze the behavior of outbound files of the terminal device, determines the terminal device that generates sensitive behavior, and returns indication information to the control terminal, so that the control terminal can block the sensitive behavior of the terminal device to prevent it from happening again, thereby realizing accurate detection and real-time blocking of sensitive behaviors within the enterprise.

[0128] The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of application involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the concept of the application. For example, the above features are replaced with the technical features with similar functions disclosed in the present application (but not limited to) by each other to form a technical solution.

Claims

1. A sensitive behavior blocking method, characterized in that: The method is executed by a control terminal, and the method includes: Obtain the sending records of multiple monitored terminal devices when sending files out; Generate log information based on the sending record, and send the log information to the analysis server using a preset interface, wherein the log information includes the sending record, and the log information is used to instruct the analysis server to analyze the behavior of the terminal device when sending files based on the sending record, and determine the terminal device that generates sensitive behavior; wherein the analyzing the behavior of the terminal device when sending files based on the sending record includes: the analysis server inputs the log information into a pre-built analysis model, and uses the analysis model to identify the log information to determine whether there is sensitive behavior in the behavior corresponding to the log information; Receiving indication information returned by the analysis server using the preset interface, the indication information including an identifier of a terminal device that generates a sensitive behavior, and the indication information is used to instruct to block the terminal device that generates the sensitive behavior; A blocking instruction is generated based on the indication information, and the blocking instruction is sent to the terminal device that generates the sensitive behavior. The blocking instruction is used to enable the terminal device that generates the sensitive behavior to block the sensitive behavior. The indication information and the blocking instruction include parameters of the sensitive behavior to be blocked.

2. The sensitive behavior blocking method according to claim 1, characterized in that: The sending the log information to the analysis server by using a preset interface includes: The log information is sent to the analysis server using an API interface.

3. The sensitive behavior blocking method according to claim 1, characterized in that: The method further comprises: Generate a security policy and send the security policy to the monitored terminal device, the security policy is generated based on basic information, the basic information includes logistics information, and the security policy is used to instruct the terminal device to use the security policy to determine whether the file to be sent out includes sensitive information when sending a file out.

4. A sensitive behavior blocking method, characterized in that: The method is performed by a terminal device, and the method includes: When sending files outward, a sending record of the outward files is generated, and the sending record is sent to the control terminal; Receive a blocking instruction returned by the control terminal, the blocking instruction including parameters of the sensitive behavior to be blocked, the blocking instruction is generated based on indication information, the indication information is generated by the analysis server after analyzing the behavior of the outgoing file based on the sending record and determining that the behavior of the outgoing file is a sensitive behavior, the indication information includes the terminal device identifier that generates the sensitive behavior; wherein, the analysis of the behavior of the outgoing file based on the sending record includes: the analysis server inputs the log information into a pre-built analysis model, the log information is generated based on the sending record, and the log information is identified by using the analysis model to determine whether there is a sensitive behavior in the behavior corresponding to the log information; In response to the blocking instruction, the sensitive behavior corresponding to the parameter is blocked.

5. The sensitive behavior blocking method according to claim 4, characterized in that: The generating of the sending record of the outgoing file comprises: Based on the security policy, the file to be sent out is analyzed. When the file does not include sensitive information, the file is sent out and the sending record is generated. The security policy is generated based on basic information, and the basic information at least includes logistics information.

6. A sensitive behavior blocking device, characterized in that: The device includes a control terminal, and the control terminal includes: An acquisition module is used to acquire the sending records of multiple monitored terminal devices when sending files outward; A sending module, used to generate log information based on the sending record, and send the log information to an analysis server using a preset interface, wherein the log information includes the sending record, and the log information is used to instruct the analysis server to analyze the behavior of the terminal device when sending files based on the sending record, and determine the terminal device that generates sensitive behavior; wherein the analysis of the behavior of the terminal device when sending files based on the sending record includes: the analysis server inputs the log information into a pre-built analysis model, and uses the analysis model to identify the log information to determine whether there is sensitive behavior in the behavior corresponding to the log information; A receiving module, used to receive the indication information returned by the analysis server using the preset interface, wherein the indication information includes an identifier of a terminal device that generates a sensitive behavior, and the indication information is used to instruct to block the terminal device that generates the sensitive behavior; A generation module generates a blocking instruction based on the indication information, and sends the blocking instruction to the terminal device that generates the sensitive behavior. The blocking instruction is used to enable the terminal device that generates the sensitive behavior to block the sensitive behavior. The indication information and the blocking instruction include parameters of the sensitive behavior to be blocked.

7. A sensitive behavior blocking device, characterized in that: The apparatus comprises a terminal device, and the terminal device comprises: A sending module, used for generating a sending record of the outgoing file when sending the file outgoing, and sending the sending record to the control terminal; A receiving module, used for receiving a blocking instruction returned by a control terminal, wherein the blocking instruction includes parameters of sensitive behaviors to be blocked, the blocking instruction response indication information is generated, the indication information is generated by the analysis server after analyzing its behavior when sending files based on the sending record and determining that the behavior when sending files is sensitive behavior, and the indication information includes the terminal device identifier that generates the sensitive behavior; wherein, the analysis of its behavior when sending files based on the sending record includes: the analysis server inputs log information into a pre-built analysis model, the log information is generated based on the sending record, and the analysis model is used to identify the log information to determine whether there is sensitive behavior in the behavior corresponding to the log information; The restriction module is used to block the sensitive behavior corresponding to the parameter in response to the blocking instruction.

8. A terminal, characterized in that: The terminal includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor is configured to implement the sensitive behavior blocking method as described in any one of claims 1 to 3 or claims 4 or 5 when executing the program.

9. A computer-readable storage medium having a computer program stored thereon, wherein the computer program is used to implement the sensitive behavior blocking method as described in any one of claims 1 to 3 or claims 4 or 5.

Images