Enterprise digital asset monitoring method and device, storage medium, terminal

Abstract

The present invention discloses a monitoring method and device, storage medium, and terminal for enterprise digital assets, which relates to the field of information security technology. The main purpose is to solve the problem of poor enterprise digital asset monitoring performance caused by the existing audit of enterprise data through a sandbox method. It includes: obtaining the data to be monitored in the enterprise, the data to be monitored is the application data in the enterprise mobile terminal device, and the data to be monitored is collected and uploaded by a data collection device preset in the enterprise mobile terminal device; detecting whether the data to be monitored contains preset sensitive characters; if so, outputting an alarm message. It is mainly used for monitoring enterprise digital assets.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method and device for monitoring enterprise digital assets, a storage medium, and a terminal. Background Art

[0002] With the gradual development of the Internet, digital life and office work are becoming more and more popular and convenient, but the resulting network security issues are also increasing. Especially for enterprises, in order to avoid corporate business data leakage, enterprises usually need to monitor the data on internally purchased assets and equipment to ensure the security of corporate digital assets.

[0003] At present, the existing monitoring of mobile terminal data purchased within the enterprise usually adopts the mobile sandbox method, that is, by encapsulating the application in the mobile terminal, the business data generated by the application will be stored in the mobile sandbox. In other words, the enterprise data generated in the unencapsulated application cannot be obtained and monitored, which makes the monitoring data not comprehensive and leads to poor data monitoring performance. Summary of the invention

[0004] In view of this, the present invention provides a method and device, storage medium, and terminal for monitoring enterprise digital assets, the main purpose of which is to solve the problem of poor enterprise digital asset monitoring performance caused by the existing audit of application data in enterprise mobile terminal devices based on mobile sandbox technology.

[0005] According to one aspect of the present invention, a method for monitoring digital assets of an enterprise is provided, comprising:

[0006] Acquire the data to be monitored in the enterprise, wherein the data to be monitored is application data in the enterprise mobile terminal device, and the data to be monitored is collected and uploaded by a data collection device preset in the enterprise mobile terminal device;

[0007] Detecting whether the data to be monitored contains preset sensitive characters;

[0008] If so, output a warning message.

[0009] Furthermore, the data to be monitored also includes a user identity, and the detecting whether the data to be monitored includes preset sensitive characters includes:

[0010] Extracting a preset sensitive character library corresponding to the user identity identifier, wherein the preset sensitive character library stores all characters that require an alarm;

[0011] Detect whether the data to be monitored contains sensitive characters in the preset sensitive character library.

[0012] Furthermore, the method further comprises:

[0013] If it is detected that the data to be monitored contains sensitive characters in the preset sensitive character library, an alarm message is output.

[0014] Furthermore, before obtaining the data to be monitored in the enterprise, the method further includes:

[0015] Acquire a list of mobile terminal devices to be monitored, wherein the list of mobile terminal devices to be monitored includes device identifiers of mobile terminal devices in the enterprise and collection device identifiers of built-in data collection devices corresponding to each of the mobile terminal devices;

[0016] Acquire a first mapping relationship between a user identity and a data collection strategy;

[0017] A data collection strategy is configured for the data collection device according to the user identity, the first mapping relationship and the collection device identifier, so that the data collection device collects the data to be monitored according to the data collection strategy.

[0018] Further, configuring the data collection strategy for the data collection device according to the user identity, the first mapping relationship and the collection device identifier includes:

[0019] Establishing a second mapping relationship between the user identity and the device identity;

[0020] When there is a newly added mobile terminal device to be monitored, extracting a first collection device identifier corresponding to the newly added mobile terminal device to be monitored from the list of mobile terminal devices to be monitored according to the first device identifier of the newly added mobile terminal device to be monitored;

[0021] Determine a first user identity corresponding to the newly added mobile terminal device to be monitored according to the first device identifier and the second mapping relationship;

[0022] Extracting a first data collection strategy corresponding to the first user identity from the first mapping relationship;

[0023] The data collection device corresponding to the first collection device identifier is configured using the first data collection strategy.

[0024] Further,

[0025] The data to be monitored also includes an application identifier. After obtaining the data to be monitored in the enterprise, the method further includes:

[0026] Classifying the data to be monitored according to the application identifier to obtain multiple sets of data to be monitored;

[0027] Extracting the decryption algorithms corresponding to the respective data sets to be monitored according to the mapping relationship between the preset application identifiers and the decryption algorithms;

[0028] The data in each of the to-be-monitored data sets are decrypted using a decryption algorithm corresponding to each of the to-be-monitored data sets.

[0029] Furthermore, the method further comprises:

[0030] Extracting behavior data corresponding to the preset sensitive characters, wherein the behavior data is used to identify user operations containing the preset sensitive characters;

[0031] Furthermore, the output warning information includes:

[0032] Generate and output warning information corresponding to the behavior data.

[0033] Furthermore, the method further comprises:

[0034] Receive false alarm data, wherein the false alarm data carries false alarm sensitive characters and context information corresponding to the false alarm sensitive characters;

[0035] The data collection strategy is optimized according to the above text information.

[0036] According to another aspect of the present invention, there is provided a monitoring device for enterprise digital assets, comprising:

[0037] An acquisition module, used to acquire the data to be monitored in the enterprise, wherein the data to be monitored is application data in the enterprise mobile terminal device, and the data to be monitored is collected and uploaded by a data acquisition device preset in the enterprise mobile terminal device;

[0038] A detection module, used to detect whether the data to be monitored contains preset sensitive characters;

[0039] The output module is used to output an alarm message if the detection module detects that the data to be monitored contains preset sensitive characters.

[0040] Furthermore, the detection module includes:

[0041] A first extraction unit, used to extract a preset sensitive character library corresponding to the user identity identifier, wherein the preset sensitive character library stores all characters that need to be alerted;

[0042] The detection unit is used to detect whether the data to be monitored contains sensitive characters in the preset sensitive character library.

[0043] Further,

[0044] The output module is specifically used to output warning information if the preset sensitive character exists in the preset sensitive character library.

[0045] Furthermore, the device further comprises: a configuration module,

[0046] The acquisition module is further used to acquire a list of mobile terminal devices to be monitored, wherein the list of mobile terminal devices to be monitored includes device identifiers of mobile terminal devices within the enterprise and collection device identifiers of built-in data collection devices corresponding to each of the mobile terminal devices;

[0047] The acquisition module is further used to acquire a first mapping relationship between a user identity identifier and a data collection strategy;

[0048] The configuration module is used to configure a data collection strategy for the data collection device according to the user identity, the first mapping relationship and the collection device identifier, so that the data collection device collects the data to be monitored according to the data collection strategy.

[0049] Furthermore, the configuration module includes:

[0050] An establishing unit, configured to establish a second mapping relationship between the user identity and the device identity;

[0051] A second extraction unit is used to extract, when there is a newly added mobile terminal device to be monitored, a first collection device identifier corresponding to the newly added mobile terminal device to be monitored from the list of mobile terminal devices to be monitored according to the first device identifier of the newly added mobile terminal device to be monitored;

[0052] A determining unit, configured to determine a first user identity corresponding to the newly added mobile terminal device to be monitored according to the first device identifier and the second mapping relationship;

[0053] The second extraction unit is further configured to extract a first data collection strategy corresponding to the first user identity from the first mapping relationship;

[0054] A configuration unit is used to configure the data collection device corresponding to the first collection device identifier by using the first data collection strategy.

[0055] Furthermore, the device also includes:

[0056] A classification module, used for classifying the data to be monitored according to the application identifier to obtain multiple sets of data to be monitored;

[0057] An extraction module, used for extracting the decryption algorithms corresponding to each of the to-be-monitored data sets according to the mapping relationship between the preset application identifiers and the decryption algorithms;

[0058] The decryption module is used to decrypt the data in each of the data sets to be monitored by using a decryption algorithm corresponding to each of the data sets to be monitored.

[0059] Further,

[0060] The extraction module is further used to extract behavior data corresponding to the preset sensitive characters, and the behavior data is used to identify user operations containing the preset sensitive characters.

[0061] Furthermore, the device further comprises: a generating module,

[0062] The generating module is used to generate warning information corresponding to the behavior data;

[0063] The output module is specifically used to output the alarm information generated by the generation module.

[0064] Furthermore, the device also includes:

[0065] A receiving module, used for receiving false alarm data, wherein the false alarm data carries false alarm sensitive characters and context information corresponding to the false alarm sensitive characters;

[0066] An optimization module is used to optimize the data collection strategy according to the above text information.

[0067] According to another aspect of the present invention, there is provided a storage medium storing at least one executable instruction, wherein the executable instruction enables a processor to execute operations corresponding to the above-mentioned enterprise digital asset monitoring method.

[0068] According to another aspect of the present invention, there is provided a terminal, comprising: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus;

[0069] The memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute operations corresponding to the above-mentioned enterprise digital asset monitoring method.

[0070] By means of the above technical solution, the technical solution provided by the embodiment of the present invention has at least the following advantages:

[0071] The present invention provides a monitoring method and device, storage medium, and terminal for enterprise digital assets. Compared with the prior art, the embodiments of the present invention obtain data to be monitored in the enterprise, wherein the data to be monitored is application data in an enterprise mobile terminal device, and the data to be monitored is collected and uploaded by a data collection device preset in the enterprise mobile terminal device; detects whether the data to be monitored contains preset sensitive characters; if so, outputs an alarm message, thereby realizing the collection of the full amount of application data generated by the enterprise mobile terminal device, and outputs an alarm message when it is detected that the application data contains preset sensitive characters, thereby realizing the monitoring of the full amount of data generated in the enterprise mobile terminal device, avoiding the problem of poor data monitoring performance caused by the prior art of collecting application data by using a mobile sandbox method, making it impossible to obtain and monitor enterprise data generated in unpackaged applications.

[0072] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0073] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0074] Figure 1 A flow chart of a method for monitoring enterprise digital assets provided by an embodiment of the present invention is shown;

[0075] Figure 2 A flow chart of another method for monitoring digital assets of an enterprise provided by an embodiment of the present invention is shown;

[0076] Figure 3 A block diagram of a monitoring device for enterprise digital assets provided by an embodiment of the present invention is shown;

[0077] Figure 4 Another monitoring component block diagram of enterprise digital assets provided by an embodiment of the present invention is shown;

[0078] Figure 5 A schematic diagram of the structure of a terminal provided by an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0079] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0080] In the existing monitoring of mobile terminal data purchased within an enterprise, a mobile sandbox method is usually used, that is, by encapsulating the application in the mobile terminal, so that the business data generated by the application will be stored in the mobile sandbox. In other words, the enterprise data generated in the unencapsulated application cannot be obtained and monitored, resulting in the problem of incomplete monitoring data and poor data monitoring performance. The embodiment of the present invention provides a monitoring method for enterprise digital assets, such as Figure 1 As shown, the method includes:

[0081] 101. Obtain the data to be monitored within the enterprise.

[0082] The data to be monitored is application data in the enterprise mobile terminal device, and the data to be monitored is collected and uploaded by a data collection device pre-installed in the enterprise mobile terminal device. Furthermore, the application data can be enterprise business application data, such as enterprise social applications, enterprise platform applications, etc. The specific implementation method of pre-installing the data collection device can be that before the enterprise mobile terminal device is shipped, the manufacturer pre-installs the data collection device in the ROM (Read-Only Memory) of the mobile terminal device, but is not limited to this.

[0083] It should be noted that the solution provided in the embodiment of the present application is for company assets and equipment purchased within the enterprise, and does not involve personal privacy data. By configuring a data collection device that users cannot uninstall on their own in the mobile terminal devices purchased by the enterprise, users can collect the full amount of application data generated in the mobile terminal devices within the enterprise after receiving the distributed mobile terminal devices without affecting the user's freedom to install, uninstall, upgrade and use applications, so as to facilitate the monitoring of the enterprise's digital assets.

[0084] 102. Detect whether the data to be monitored contains preset sensitive characters.

[0085] Among them, the preset sensitive characters can be any one or more data forms, such as Chinese characters, English, pinyin, degree codes, etc., and the preset sensitive characters can be set according to different application scenarios. For example, the preset sensitive characters for the financial industry can be "transfer", "remittance", etc., and the preset sensitive characters for the education industry can be "abuse", "school violence", etc. The embodiment of the present application does not make specific limitations on this.

[0086] 103. If it is detected that the monitored data contains preset sensitive characters, an alarm message is output.

[0087] Among them, the warning information can be text information, picture information, audio and video information, highlight display, etc., and the embodiment of the present application does not make specific limitations on this.

[0088] In addition, in the embodiment of the present application, a method for determining whether there are preset sensitive characters can be to pre-set a sensitive character library, so that after obtaining the data to be monitored, all the characters contained in the data to be monitored are parsed, and then each character is queried in turn to see if it is a character in the preset sensitive character library, and when a character in the preset sensitive character library is queried, an alarm message is output to enable the administrator to monitor the security of the enterprise's digital assets.

[0089] The present invention provides a monitoring method and device, storage medium, and terminal for enterprise digital assets. Compared with the prior art, the embodiments of the present invention obtain data to be monitored in the enterprise, wherein the data to be monitored is application data in an enterprise mobile terminal device, and the data to be monitored is collected and uploaded by a data collection device preset in the enterprise mobile terminal device; detects whether the data to be monitored contains preset sensitive characters; if so, outputs an alarm message, thereby realizing the collection of the full amount of application data generated by the enterprise mobile terminal device, and outputs an alarm message when it is detected that the application data contains preset sensitive characters, thereby realizing the monitoring of the full amount of data generated in the enterprise mobile terminal device, avoiding the problem of poor data monitoring performance caused by the prior art of collecting application data by using a mobile sandbox method, making it impossible to obtain and monitor enterprise data generated in unpackaged applications.

[0090] Further, as a refinement and extension of the specific implementation of the above embodiment, in order to fully illustrate the specific implementation process of this embodiment, another method for monitoring enterprise digital assets is provided, such as Figure 2 As shown, the method includes:

[0091] 201. Obtain a list of mobile terminal devices to be monitored.

[0092] The list of mobile terminal devices to be monitored includes device identifiers of mobile terminal devices in the enterprise and data collection device identifiers of built-in data collection devices corresponding to each of the mobile terminal devices.

[0093] It should be noted that the solution provided in the embodiment of the present application is for company asset equipment purchased within the enterprise and does not involve personal privacy data. Before the enterprise mobile terminal equipment leaves the factory, the manufacturer pre-installs the data acquisition device in the ROM (Read-Only Memory) of the mobile terminal equipment, and the mobile terminal equipment and the data acquisition device are one-to-one corresponding, so the correspondence between the device identification and the data acquisition device identification can be established when the mobile terminal equipment leaves the factory, so that in this step, the device identification of the mobile terminal equipment purchased within the enterprise and the corresponding data acquisition device identification can be directly obtained, so that the business application data generated by the terminal equipment within the enterprise can be monitored according to the list later.

[0094] For the embodiment of the present application, by configuring a data collection device that cannot be uninstalled by users on their own in the mobile terminal devices purchased by the enterprise, the users can collect the full amount of business application data generated in the mobile terminal devices within the enterprise after receiving the distributed mobile terminal devices, without affecting the users' freedom to install, uninstall, upgrade and use applications, thereby more comprehensively monitoring the enterprise's digital assets.

[0095] 202. Obtain a first mapping relationship between a user identity and a data collection strategy.

[0096] Among them, the data collection strategy can be the application program that needs to collect application data, the collection time and collection cycle, etc., and the user identity can be the account information of the user logging into the enterprise mobile terminal device, the account information of the user logging into the business application, and the user's department information and position information in the enterprise, etc. The embodiments of this application do not make specific limitations on this.

[0097] In actual application, it is not necessary to monitor the data generated by all business applications used by all users in the enterprise. Usually, the data is targeted, that is, the applications and collection cycles that need to be paid attention to by users in different positions and identities are different. Therefore, in the embodiment of the present application, corresponding data collection strategies are set in advance for user identity, business type, etc., and a mapping relationship between user identity identification and collection strategy is established to enable more accurate collection of business application data to be monitored, thereby avoiding the problems of data redundancy and invalid monitoring caused by collecting full business application data for all users, thereby improving the performance of enterprise digital asset monitoring.

[0098] 203. Configure a data collection strategy for the data collection device according to the user identity, the first mapping relationship, and the collection device identifier.

[0099] Furthermore, the data collection device collects the data to be monitored according to the data collection strategy. According to the above content, there is a one-to-one correspondence between the collection device identifier and the terminal device identifier, so after the connection between the user and the terminal device is established, the data collection strategy corresponding to the user identity can be configured in the data collection device preset in the terminal device used by the user.

[0100] Exemplarily, for an embodiment of the present application, step 203 may specifically include: establishing a second mapping relationship between the user identity and the device identity; when there is a newly added mobile terminal device to be monitored, extracting a first acquisition device identifier corresponding to the newly added mobile terminal device to be monitored from the list of mobile terminal devices to be monitored according to the first device identifier of the newly added mobile terminal device to be monitored; determining the first user identity corresponding to the newly added mobile terminal device to be monitored according to the first device identifier and the second mapping relationship; extracting a first data acquisition strategy corresponding to the first user identity from the first mapping relationship; and configuring the data acquisition device corresponding to the first acquisition device identifier using the first data acquisition strategy.

[0101] Specifically, the implementation method of establishing the second mapping relationship between the user identity identifier and the device identifier in this step can be to identify the user identity identifier corresponding to the terminal device based on the historical application data generated in the terminal device, or to confirm it based on the enterprise's device distribution plan, but is not limited to this. For example, if the enterprise distributes the purchased mobile terminal devices with device identifiers "OC1", "OC2" and "OC3" to the financial department of the enterprise, and the three user positions in the financial department are a supervisor and two financial specialists, and the device identifier of the terminal device used by the supervisor is "OC1", the second mapping relationship established according to this distribution method is as follows:

[0102] User Identification Equipment identification Financial SupervisorLMY OC1 Financial Specialist XH OC2 Financial Specialist SH OC3

[0103] Furthermore, when there is a newly added mobile terminal device to be monitored, the collection device identifier corresponding to the data collection device in the newly added device to be monitored is determined based on the device identifier of the newly added device, the one-to-one correspondence between the device identifier and the collection device identifier of the data collection device built into the device, and the user identity identifier corresponding to the newly added device to be monitored is determined in combination with the above-mentioned second mapping relationship, thereby establishing a correspondence between the user identity identifier and the data collection device identifier; and since there is a first mapping relationship between users of different identities and data collection strategies, the data collection strategy for configuring the newly added data collection device can be determined based on the first mapping relationship, thereby realizing automatic configuration of the data collection strategy for the data collection device built into the newly added device to be monitored.

[0104] For the embodiments of the present application, by obtaining and establishing an association relationship between the device identification of a mobile terminal device within the enterprise, the collection device identification of a data collection device built into the mobile terminal device, the user identity identification, and the data collection strategy, and when there is a newly added mobile terminal device to be monitored, based on the newly added device identification and the multi-layer association relationship, the data collection strategy corresponding to the data collection device in the newly added mobile terminal device is automatically confirmed and configured, so that the data collection device can collect and upload the data to be monitored according to the preset data collection strategy, and can accurately collect the data to be monitored according to the security requirements of the enterprise, thereby improving the performance of the enterprise's digital asset monitoring.

[0105] 204. Obtain the data to be monitored within the enterprise.

[0106] The data to be monitored is application data in the enterprise mobile terminal device, and the data to be monitored is collected and uploaded by a data collection device pre-installed in the enterprise mobile terminal device. The conceptual explanation and specific implementation of this step can refer to the corresponding description in step 101, and the embodiment of this application will not be repeated here.

[0107] Furthermore, after step 204, the embodiment of the present application may also include: classifying the data to be monitored according to the application identifier to obtain multiple data sets to be monitored; extracting the decryption algorithms corresponding to each of the data sets to be monitored according to the mapping relationship between the preset application identifier and the decryption algorithm; and decrypting the data in each of the data sets to be monitored using the decryption algorithms corresponding to each of the data sets to be monitored.

[0108] It should be noted that, in actual application, since the application data generated by applications on the market are usually encrypted and output, the data acquisition device collects the encrypted application data. In order to monitor the application data, the encrypted data needs to be decrypted, and the encryption algorithms used for different applications are different. Therefore, in the embodiment of the present application, the monitored data is first classified according to the application identifier, and each application data is decrypted according to the encryption algorithm corresponding to the application, so as to monitor the decrypted data. The specific decryption algorithm is not limited in the embodiment of the present application.

[0109] 205. Extract a preset sensitive character library corresponding to the user identity.

[0110] The preset sensitive character library stores all characters that require an alarm.

[0111] As described in the above step 202, the business applications that need to be monitored for users in different positions within the enterprise are different, and the preset sensitive characters for different business applications are also different. Therefore, in the actual application process, a preset sensitive character library corresponding to each business application is first constructed, and all sensitive characters that pose a threat to the enterprise's digital assets are stored in the sensitive character library, so that the corresponding preset sensitive character library can be extracted according to the user identity and combined with the preset sensitive character library to compare and detect the monitored data. The specific method of establishing the preset sensitive character library can be machine learning and / or manual addition, etc., which is not specifically limited in the embodiments of the present application.

[0112] 206. Detect whether the data to be monitored contains sensitive characters in the preset sensitive character library.

[0113] In an embodiment of the present application, after obtaining the data to be monitored collected and uploaded by the data acquisition device, the data to be monitored can be parsed to obtain all the characters in the data, and the preset sensitive character library determined in the above step 205 can be queried and confirmed according to each character in turn to see if the character is a sensitive character, so as to execute the detection described in this step to see whether the data to be monitored contains sensitive characters in the preset sensitive word library, but the specific implementation method is not limited to this.

[0114] 207. If the preset sensitive character exists in the preset sensitive character library, output warning information.

[0115] If there are no preset sensitive characters in the data to be monitored, the above detection steps 204 to 206 can be executed cyclically according to the corresponding data collection strategy, and this step is executed when the presence of preset sensitive characters is detected.

[0116] Furthermore, in order to optimize the monitoring and alarm function, the embodiment of the present application also includes: extracting the behavior data corresponding to the preset sensitive characters. Then the step 207 specifically includes: generating and outputting the alarm information corresponding to the behavior data. Among them, the behavior data is used to identify the user operation containing the preset sensitive characters. The user operation can be, for example, "User A" sends a message "The system password is: ***" to his "friend Mary" through the business application "Social Application A", or "User B" with the position of "Collector" performs the collection business 5 times in a week, etc., and the alarm information corresponding to the behavior data can be the alarm information containing the user operation, and can also be the alarm information that determines the alarm level according to the user operation and outputs the corresponding level of alarm information, etc., but is not limited to this.

[0117] In an embodiment of the present application, when the presence of preset sensitive characters is detected, the user's behavioral data is further obtained to confirm the user's actual operations containing the sensitive characters, and more specific alarm information is generated based on the behavioral operations, so that management personnel can quickly judge and take corresponding measures based on the alarm information, thereby further improving the performance of enterprise digital asset monitoring.

[0118] Furthermore, the embodiment of the present application also includes: receiving alarm false alarm data; optimizing the data collection strategy according to the above written text information. Wherein, the alarm false alarm data carries false alarm sensitive characters and context information corresponding to the false alarm sensitive characters. It should be noted that in the monitoring process, as long as the preset sensitive characters are detected, the alarm information will be output, but there are application scenarios that contain preset sensitive characters but do not threaten the security of the enterprise. For example, the user whose user identity is "head of the financial department" is parsed in the collected data to be monitored, and the preset sensitive characters are output as "transferred to you" through the business application, but after the administrator's review, it is found that the alarm information is a false alarm, because the data is marked as alarm false alarm data and uploaded to the enterprise digital asset monitoring server. After receiving the alarm false alarm data, the server combines the preset sensitive characters with its context information "I will transfer the operation guide to you", and optimizes the collection strategy according to this data, such as setting a whitelist in the data collection strategy, etc., but the embodiment of the present application does not limit the specific implementation method of the optimization strategy.

[0119] The present invention provides a monitoring method and device, storage medium, and terminal for enterprise digital assets. Compared with the prior art, the embodiments of the present invention obtain data to be monitored in the enterprise, wherein the data to be monitored is application data in an enterprise mobile terminal device, and the data to be monitored is collected and uploaded by a data collection device preset in the enterprise mobile terminal device; detects whether the data to be monitored contains preset sensitive characters; if so, outputs an alarm message, thereby realizing the collection of the full amount of application data generated by the enterprise mobile terminal device, and outputs an alarm message when it is detected that the application data contains preset sensitive characters, thereby realizing the monitoring of the full amount of data generated in the enterprise mobile terminal device, avoiding the problem of poor data monitoring performance caused by the prior art of collecting application data by using a mobile sandbox method, making it impossible to obtain and monitor enterprise data generated in unpackaged applications.

[0120] Furthermore, as a response to the above Figure 1 The implementation of the method shown in the embodiment of the present application provides a monitoring device for enterprise digital assets, such as Figure 3 As shown, the device includes: an acquisition module 31, a detection module 32, and an output module 33.

[0121] The acquisition module 31 is used to acquire the data to be monitored in the enterprise, wherein the data to be monitored is application data in the enterprise mobile terminal device, and the data to be monitored is collected and uploaded by a data collection device preset in the enterprise mobile terminal device;

[0122] The detection module 32 is used to detect whether the data to be monitored obtained by the acquisition module 31 contains preset sensitive characters;

[0123] The output module 33 is used to output an alarm message if the detection module 32 detects that the data to be monitored contains preset sensitive characters.

[0124] Furthermore, if Figure 4 As shown, the detection module 32 includes:

[0125] The first extraction unit 321 is used to extract a preset sensitive character library corresponding to the user identity, wherein the preset sensitive character library stores all characters that need to be alerted;

[0126] The detection unit 322 is used to detect whether the data to be monitored contains sensitive characters in the preset sensitive character library.

[0127] Further,

[0128] The output module 33 is specifically configured to output warning information if the preset sensitive character exists in the preset sensitive character library.

[0129] Furthermore, the device further comprises: a configuration module 34,

[0130] The acquisition module 31 is further used to acquire a list of mobile terminal devices to be monitored, wherein the list of mobile terminal devices to be monitored includes device identifiers of mobile terminal devices within the enterprise and collection device identifiers of built-in data collection devices corresponding to each of the mobile terminal devices;

[0131] The acquisition module 31 is further used to acquire a first mapping relationship between a user identity and a data collection strategy;

[0132] The configuration module 34 is used to configure a data collection strategy for the data collection device according to the user identity, the first mapping relationship and the collection device identifier, so that the data collection device collects the data to be monitored according to the data collection strategy.

[0133] Furthermore, the configuration module 34 includes:

[0134] An establishing unit 341 is used to establish a second mapping relationship between the user identity and the device identity;

[0135] The second extraction unit 342 is used for extracting the first collection device identifier corresponding to the newly added mobile terminal device to be monitored from the list of mobile terminal devices to be monitored according to the first device identifier of the newly added mobile terminal device to be monitored when there is a newly added mobile terminal device to be monitored;

[0136] A determining unit 343 is configured to determine a first user identity corresponding to the newly added mobile terminal device to be monitored according to the first device identifier and the second mapping relationship;

[0137] The second extraction unit 342 is further configured to extract a first data collection strategy corresponding to the first user identity from the first mapping relationship;

[0138] The configuration unit 344 is configured to configure the data collection device corresponding to the first collection device identifier by using the first data collection strategy.

[0139] Furthermore, the device also includes:

[0140] A classification module 35, configured to classify the data to be monitored according to the application identifier to obtain multiple sets of data to be monitored;

[0141] An extraction module 36, configured to extract the decryption algorithms corresponding to the respective data sets to be monitored according to the mapping relationship between the preset application identifiers and the decryption algorithms;

[0142] The decryption module 37 is used to decrypt the data in each of the data sets to be monitored using a decryption algorithm corresponding to each of the data sets to be monitored.

[0143] Further,

[0144] The extraction module 36 is further used to extract behavior data corresponding to the preset sensitive characters, where the behavior data is used to identify user operations containing the preset sensitive characters.

[0145] Furthermore, the device further comprises: a generating module 38,

[0146] The generating module 38 is used to generate warning information corresponding to the behavior data;

[0147] The output module 33 is specifically used to output the alarm information generated by the generation module.

[0148] Furthermore, the device also includes:

[0149] A receiving module 39, configured to receive false alarm data, wherein the false alarm data carries false alarm sensitive characters and context information corresponding to the false alarm sensitive characters;

[0150] The optimization module 310 is used to optimize the data collection strategy according to the above-mentioned text information.

[0151] The present application provides a monitoring method and device, storage medium, and terminal for enterprise digital assets. Compared with the prior art, the embodiments of the present invention obtain the data to be monitored in the enterprise, wherein the data to be monitored is application data in the enterprise mobile terminal device, and the data to be monitored is collected and uploaded by a data collection device preset in the enterprise mobile terminal device; detects whether the data to be monitored contains preset sensitive characters; if so, outputs an alarm message, thereby realizing the collection of the full amount of application data generated by the enterprise mobile terminal device, and outputs an alarm message when it is detected that the application data contains preset sensitive characters, thereby realizing the monitoring of the full amount of data generated in the enterprise mobile terminal device, avoiding the problem of poor data monitoring performance caused by the prior art of collecting application data by using a mobile sandbox method, making it impossible to obtain and monitor enterprise data generated in unpackaged applications.

[0152] According to an embodiment of the present invention, a storage medium is provided, wherein the storage medium stores at least one executable instruction, and the computer executable instruction can execute the enterprise digital asset monitoring method in any of the above method embodiments.

[0153] Figure 5A schematic diagram of the structure of a terminal provided according to an embodiment of the present invention is shown. The specific embodiment of the present invention does not limit the specific implementation of the terminal.

[0154] like Figure 5 As shown, the terminal may include: a processor (processor) 402 , a communication interface (CommunicationsInterface) 404 , a memory (memory) 404 , and a communication bus 408 .

[0155] The processor 402 , the communication interface 404 , and the memory 406 communicate with each other via a communication bus 408 .

[0156] The communication interface 404 is used to communicate with other devices such as clients or other servers.

[0157] The processor 402 is used to execute the program 410, and specifically can execute the relevant steps in the above-mentioned enterprise digital asset monitoring method embodiment.

[0158] Specifically, the program 410 may include program codes, which include computer operation instructions.

[0159] The processor 402 may be a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiment of the present invention. The one or more processors included in the terminal may be processors of the same type, such as one or more CPUs; or processors of different types, such as one or more CPUs and one or more ASICs.

[0160] The memory 406 is used to store the program 410. The memory 406 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0161] The program 410 may be specifically configured to enable the processor 402 to perform the following operations:

[0162] Acquire the data to be monitored in the enterprise, wherein the data to be monitored is application data in the enterprise mobile terminal device, and the data to be monitored is collected and uploaded by a data collection device preset in the enterprise mobile terminal device;

[0163] Detecting whether the data to be monitored contains preset sensitive characters;

[0164] If so, output a warning message.

[0165] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, and optionally, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0166] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for monitoring enterprise digital assets, characterized in that: include: Acquire the data to be monitored in the enterprise, wherein the data to be monitored is application data in the enterprise mobile terminal device, and the data to be monitored is collected and uploaded by a data collection device preset in the enterprise mobile terminal device; Detecting whether the data to be monitored contains preset sensitive characters; If yes, then output warning information; Before obtaining the data to be monitored in the enterprise, the method further includes: Acquire a list of mobile terminal devices to be monitored, wherein the list of mobile terminal devices to be monitored includes device identifiers of mobile terminal devices in the enterprise and collection device identifiers of built-in data collection devices corresponding to each of the mobile terminal devices; Acquire a first mapping relationship between a user identity and a data collection strategy; A data collection strategy is configured for the data collection device according to the user identity, the first mapping relationship and the collection device identifier, so that the data collection device collects the monitored data according to the data collection strategy, wherein the data collection strategy includes an application program for which application data needs to be collected.

2. The method according to claim 1, characterized in that The data to be monitored also includes a user identity identifier, and the detecting whether the data to be monitored includes preset sensitive characters includes: Extracting a preset sensitive character library corresponding to the user identity identifier, wherein the preset sensitive character library stores all characters that require an alarm; Detecting whether the data to be monitored contains sensitive characters in the preset sensitive character library; The method further comprises: If the data to be monitored contains sensitive characters in the preset sensitive character library, an alarm message is output.

3. The method according to claim 1, characterized in that The configuring the data collection strategy for the data collection device according to the user identity, the first mapping relationship and the collection device identifier comprises: Establishing a second mapping relationship between the user identity and the device identity; When there is a newly added mobile terminal device to be monitored, extracting a first collection device identifier corresponding to the newly added mobile terminal device to be monitored from the list of mobile terminal devices to be monitored according to the first device identifier of the newly added mobile terminal device to be monitored; Determine a first user identity corresponding to the newly added mobile terminal device to be monitored according to the first device identifier and the second mapping relationship; Extracting a first data collection strategy corresponding to the first user identity from the first mapping relationship; The data collection device corresponding to the first collection device identifier is configured using the first data collection strategy.

4. The method according to claim 1, characterized in that: The data to be monitored also includes an application identifier. After obtaining the data to be monitored in the enterprise, the method further includes: Classifying the data to be monitored according to the application identifier to obtain multiple sets of data to be monitored; Extracting the decryption algorithms corresponding to the respective data sets to be monitored according to the mapping relationship between the preset application identifiers and the decryption algorithms; The data in each of the to-be-monitored data sets are decrypted using a decryption algorithm corresponding to each of the to-be-monitored data sets.

5. The method according to claim 1, characterized in that The method further comprises: Extracting behavior data corresponding to the preset sensitive characters, wherein the behavior data is used to identify user operations containing the preset sensitive characters; The output alarm information includes: Generate and output warning information corresponding to the behavior data.

6. The method according to claim 1 or 3, characterized in that: The method further comprises: Receive false alarm data, wherein the false alarm data carries false alarm sensitive characters and context information corresponding to the false alarm sensitive characters; The data collection strategy is optimized according to the context information.

7. A monitoring device for enterprise digital assets, characterized in that: include: An acquisition module, used to acquire the data to be monitored in the enterprise, wherein the data to be monitored is application data in the enterprise mobile terminal device, and the data to be monitored is collected and uploaded by a data acquisition device preset in the enterprise mobile terminal device; A detection module, used to detect whether the data to be monitored contains preset sensitive characters; An output module, configured to output an alarm message if the detection module detects that the data to be monitored contains preset sensitive characters; The acquisition module is further used to acquire a list of mobile terminal devices to be monitored, wherein the list of mobile terminal devices to be monitored includes device identifiers of mobile terminal devices within the enterprise and collection device identifiers of built-in data collection devices corresponding to each of the mobile terminal devices; The acquisition module is further used to acquire a first mapping relationship between a user identity identifier and a data collection strategy; A configuration module is used to configure a data collection strategy for the data collection device according to the user identity, the first mapping relationship and the collection device identifier, so that the data collection device collects the data to be monitored according to the data collection strategy, wherein the data collection strategy includes an application program that needs to collect application data.

8. A storage medium, wherein at least one executable instruction is stored in the storage medium, and the executable instruction enables a processor to execute an operation corresponding to the enterprise digital asset monitoring method as described in any one of claims 1-6.

9. A terminal, comprising: A processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute operations corresponding to the enterprise digital asset monitoring method as described in any one of claims 1-6.

Images