A method and apparatus for detecting file leakage behavior

Abstract

The embodiment of the present application provides a kind of method and device for detecting file leakage behavior, the method comprises: real-time detection log data, confirm that there is target object to the output operation of target file, wherein the output operation includes: upload, burning or copying;Confirm that there is the renaming operation of the target object to the target file in the first preset period before the output operation;When confirming that the renaming operation belongs to high-risk operation according to set similarity algorithm, then whether the output operation exists the behavior of leaking the target file according to the historical operation habit of the target object is confirmed. The method for detecting internal file leakage behavior provided by the embodiment of the present application is simple to deploy, convenient to maintain, high accuracy, can effectively detect internal file leakage problem in the scene that internal legal user executes renaming operation to file and then outputs relevant file in real time.

Description

Technical Field

[0001] This application relates to the field of document security detection, and more specifically, the embodiments of this application relate to a method and apparatus for detecting document leakage behavior. Background Technology

[0002] Existing methods for preventing file (e.g., internal documents) leaks are mostly based on access control or data encryption technologies. This not only requires significant resources to manage the mapping between internal files and user permissions, but also impacts existing business processes. Furthermore, key management for encryption technologies is extremely complex; if a key is lost or encrypted data is corrupted, the original data cannot be recovered. The deployment methods based on access control or data encryption technologies are also very complex and cannot solve the problem of intentional or unintentional file leaks by authorized internal personnel or external personnel with legitimate credentials.

[0003] Therefore, improving the detection effectiveness of internal document leaks has become an urgent technical problem to be solved. Summary of the Invention

[0004] The purpose of this application is to provide a method and apparatus for detecting file leakage. Since the detection method corresponding to the technical solution of this application does not involve file content detection, it protects user privacy as much as possible. It is also simple to deploy, easy to maintain, and highly accurate. It can detect file leakage problems in real time and effectively in scenarios where legitimate internal users rename files and then output related files. This makes it convenient for administrators to discover and stop internal file leakage operations in a timely manner, thereby protecting the data and information security of enterprises.

[0005] Firstly, some embodiments of this application provide a method for detecting file leakage behavior. The method includes: real-time detection of log data to confirm that a target object performs an output operation on a target file at a first moment, wherein the output operation includes: uploading, burning, or copying; confirming that the target object performs a renaming operation on the target file within a preset time period before the first moment; and confirming, based on the target object's historical operation habits, whether the output operation leaks the target file when the renaming operation is confirmed to be a high-risk operation according to a set similarity algorithm.

[0006] Compared with existing methods, the method for detecting internal file leakage provided in this application is simple to deploy, easy to maintain, and highly accurate. It can detect internal file leakage problems in real time and effectively in scenarios where legitimate internal users rename files and then output related files. This allows administrators to promptly discover and stop internal file leakage operations, thereby protecting the company's data and information security.

[0007] In some embodiments, confirming that the renaming operation is a high-risk operation based on a set similarity algorithm includes: obtaining the similarity value between the file names before and after the renaming operation; and confirming that the renaming operation is a high-risk operation when the similarity value is greater than a similarity threshold.

[0008] Some embodiments of this application determine the degree of danger of a renaming operation by judging the similarity between the file names before and after the renaming. This detection method does not involve file content detection, so it can protect user privacy as much as possible while confirming the danger of the renaming operation.

[0009] In some embodiments, the similarity value is obtained using the Jakar algorithm.

[0010] Some embodiments of this application use the Jakar algorithm to determine the similarity of the strings corresponding to the file names before and after renaming, which reduces the amount of computation and improves the speed of data processing.

[0011] In some embodiments, confirming whether the output operation leaks the target file based on the target object's historical operation habits includes: obtaining the operation frequency of combined operations performed by the target object on the target file within a statistical time period, wherein the combined operations include a rename operation and an output operation performed sequentially, and the statistical time period is determined based on a preset time window and the first moment; obtaining an operation frequency threshold for the combined operations based on historical log data; and confirming whether the output operation leaks the target file based on the operation frequency of the combined operations and the operation frequency threshold.

[0012] Some embodiments of this application further improve the accuracy of anomaly detection by judging whether the frequency of combined operations on the target object (i.e., file renaming and output operations performed sequentially on the target file) conforms to its operating habits.

[0013] In some embodiments, obtaining the operation frequency threshold of the combined operation based on historical log data includes: obtaining the operation frequency threshold based on a statistical anomaly detection algorithm and the historical log data.

[0014] Some embodiments of this application use statistical anomaly detection methods to determine the operation frequency threshold, which involves less computation and improves the speed of data processing.

[0015] In some embodiments, the statistical anomaly detection algorithm includes a box plot algorithm, wherein obtaining the operation frequency threshold based on the statistical anomaly detection algorithm and the historical log data includes: sampling the historical log data multiple times according to the preset time window, window movement distance, and sampling number to obtain a historical combined operation frequency sequence, wherein the number of elements included in the historical combined operation frequency sequence is the same as the number of samplings; and obtaining the operation frequency threshold based on the historical combined operation frequency sequence and the box plot algorithm.

[0016] Some embodiments of this application obtain the operation frequency threshold of combined operations (i.e., renaming before outputting the same file) by sampling historical log data multiple times, which further improves the objectivity and accuracy of operation frequency threshold estimation.

[0017] In some embodiments, the step of sampling the historical log data multiple times according to the preset time window, the window movement distance, and the number of samplings to obtain a historical combined operation count sequence includes: moving the preset time window multiple times according to the window movement distance, and obtaining the number of combined operations within the time period obtained by each movement, obtaining the value of each element in the historical combined operation count sequence, wherein the number of multiple movements is equal to the number of samplings; and obtaining the operation frequency threshold according to the value of each element and the position of the quartile.

[0018] Some embodiments of this application obtain the values ​​of each element in the sequence of historical combined operations within the corresponding time period by moving the window multiple times by moving the window a certain distance, thereby improving the accuracy and objectivity of the statistical analysis of historical operation patterns.

[0019] In some embodiments, at least one of the similarity threshold, the preset time window, the window movement distance, and the number of samplings is a configurable parameter.

[0020] Some embodiments of this application expand the application scenarios of the method for detecting internal file leakage by allowing users to configure key parameters (e.g., similarity threshold, preset time window, number of samplings, etc.) and dynamically adjust them according to actual conditions.

[0021] In some embodiments, the real-time detection of log data to confirm that there is an output operation of the target object on the target file at a first moment includes: real-time detection of the cached file operation log queue, and filtering to obtain the target object performing an output operation on the target file at the first moment according to the attention conditions, wherein the attention conditions include at least one of file name, file format and file path.

[0022] Some embodiments of this application can filter target files for security testing of key files by setting attention conditions.

[0023] In some embodiments of this application, the file name, file format, or file path are configurable parameters.

[0024] Some embodiments of this application filter files of interest or files of high importance for security testing by configuring or adjusting specific filenames and other information in the attention criteria, thereby preventing the risk of leakage of files of high importance.

[0025] Secondly, some embodiments of this application provide an apparatus for detecting file leakage behavior. The apparatus includes: an output operation acquisition module configured to detect log data in real time and confirm that a target object performs an output operation on a target file at a first moment, wherein the output operation includes uploading, burning, or copying; a renaming operation acquisition module configured to confirm that the target object performs a renaming operation on the target file within a preset time period before the first moment; and an operation risk acquisition module configured to, when the renaming operation is confirmed to be a high-risk operation based on a set similarity algorithm, confirm whether there is any behavior that leaks the target file based on the target object's historical operation habits.

[0026] Thirdly, some embodiments of this application provide a computer storage medium having a computer program stored thereon, which, when executed by a processor, can implement the method described in the first aspect above.

[0027] Fourthly, some embodiments of this application provide an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described in the first aspect above. Attached Figure Description

[0028] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0029] Figure 1 This is a schematic diagram illustrating an application scenario provided in the embodiments of this application;

[0030] Figure 2 A block diagram illustrating the composition of a log auditing server provided in an embodiment of this application;

[0031] Figure 3 One of the flowcharts for a method of detecting file leakage behavior provided in the embodiments of this application;

[0032] Figure 4 A second flowchart illustrating the method for detecting file leakage behavior provided in this application embodiment;

[0033] Figure 5 A block diagram of the apparatus for detecting document leakage behavior provided in the embodiments of this application;

[0034] Figure 6 This is a block diagram of the electronic device provided in the embodiments of this application. Detailed Implementation

[0035] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0036] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0037] The method for detecting file (e.g., internal file) leakage provided in this application is applied to a common, high-risk, and specific file leakage scenario. This scenario includes file leakage caused by legitimate internal users or external users with legitimate credentials renaming files and then outputting related files. To identify internal file leakage in such scenarios as much as possible, some embodiments of this application first determine whether the renaming operation itself is a high-risk operation (e.g., by comparing the similarity value of file names before and after the renaming operation with a set similarity threshold). Then, based on the user's (i.e., the target object's) historical operating habits, it determines whether the current operation is normal (e.g., by using a statistical anomaly detection algorithm to determine a normal operation frequency threshold to determine whether the current operation is normal). Other embodiments of this application also support configurable key parameters of the algorithm, considering user differences and further improving the accuracy of identifying leaked internal files. It should be noted that all internal enterprise files are internal files, including product documents, source code, etc., but not all internal files need to be detected; custom configurations can be made according to sensitivity or importance.

[0038] Please refer to Figure 1 , Figure 1 The illustration shows an application scenario for some embodiments of this application, which provides a method for detecting file (e.g., internal file) leakage behavior. Figure 1 The application scenarios include multiple hosts 110 and a log audit server 100.

[0039] Each host 110 includes at least one file 111 and a log sampling module 112. To enable the application of the method for detecting internal file leakage according to embodiments of this application, the log sampling module 112 of each host 110 is capable of sampling various operations performed by the user on each file in at least one file 111 (e.g., operations include uploading, downloading, renaming, deleting, etc.) to obtain file operation log data. The host 110 sends the sampled file operation log data to the log audit server 100 in real time, so that the log audit server 100 can analyze the file log data to discover various internal file leakage behaviors.

[0040] The log auditing server 100 is used to execute the method for detecting internal file leakage behavior according to embodiments of this application. As an example, such as... Figure 2 As shown, the log audit server 100 in some embodiments of this application includes a log receiving module 101, a log preprocessing module 102, a log caching module 103, a historical log storage database 104, and an anomaly detection module 105.

[0041] The log receiving module 101 can receive file operation log data from each host 110 in real time through the application programming interface (API) or the syslog protocol.

[0042] The log preprocessing module 102 can perform cleaning operations on the data received by the log receiving module 101. The cleaning operations include checking the integrity, uniqueness, authority, and legality of the file operation log data, removing irrelevant and redundant information (which can be filtered by file name, file type, and file storage path), and converting it into the target data format required for anomaly detection.

[0043] The log caching module 103 is used to cache the received cleaned file operation log data so that the anomaly detection module 105 can read from the cache queue in real time and identify the latest target object (i.e., an internal user selected according to preset conditions)'s output operation on the target file.

[0044] The historical log storage database 104 is used to store historical log data so that the anomaly detection module 105 can obtain the renaming operation of the target file by the target object within a preset time period based on the historical log data, and the anomaly detection module 105 can obtain the historical operation habits of the target object based on the historical log data, that is, obtain the normal combination operation frequency (or operation frequency threshold) of the target object.

[0045] As an example, the anomaly detection module 105 is configured to perform the following steps: real-time monitoring of file operation log data to detect output operations of files of interest (i.e., output operations of the target object on the target file); after detecting a file output operation, further detecting whether there were any duplicate name operations on the same target file before the file output operation (i.e., within a preset time period) (e.g., reading saved log data and detecting whether there were corresponding renaming operations in a certain period before the file output); when a renaming operation is detected within the preset time period, further determining the similarity of strings before and after the renaming to determine the danger of the renaming operation; when it is confirmed that the renaming operation is a high-risk operation, further using statistical learning methods to determine whether the frequency of the target object's combined operations (i.e., performing renaming and output operations on the same file in sequence) conforms to its operating habits, so as to finally confirm whether the user's current output operation (e.g., the output operation detected at the first moment) involves internal file leakage behavior.

[0046] It should be noted that, Figure 1 Host 110 and log audit server 100 belong to different entities, that is to say, Figure 1 The host 110 only has a log sampling module 112. Therefore, to determine whether there is internal file leakage on host 110 based on file operation logs, host 110 needs to send the file operation logs to log audit server 100 via wired or wireless means. Log audit server 100 then analyzes the file operation logs and provides an assessment result on each host 110 regarding whether internal file leakage occurs. However, the embodiments of this application are not limited to this one application scenario. In other embodiments, the method for detecting internal file leakage executed by log audit server 100 can be set on each host 110. That is, in some embodiments, host 110 not only has a log sampling module 112, but also other components such as... Figure 2 The log receiving module 101, log preprocessing module 102, log caching module 103, historical log storage database 104, and anomaly detection module 105 shown can be used by the host 110 to sample and analyze file operation logs to directly determine whether there is any internal file leakage behavior on the host 110.

[0047] The following is combined Figure 3 Exemplary illustration by Figure 2 The anomaly detection module 105 executes a method for detecting internal file leakage behavior.

[0048] like Figure 3As shown, some embodiments of this application provide a method for detecting file leakage behavior. The method includes: S101, real-time detection of log data to confirm that a target object performs an output operation on a target file at a first moment, wherein the output operation includes: uploading, burning, or copying; S102, confirmation that the target object performs a renaming operation on the target file within a preset time period before the first moment; S103, when the renaming operation is confirmed to be a high-risk operation based on a set similarity algorithm, confirmation is made based on the target object's historical operation habits to determine whether the output operation leaks the target file.

[0049] The steps described above are illustrated below.

[0050] In some embodiments, S101 includes: real-time detection of a cached file operation log queue, and filtering based on interest criteria to obtain the target object performing an output operation on the target file at a first moment, wherein the interest criteria include at least one of filename, file format, and file path. For example, real-time monitoring of file operation log data in a cached queue (e.g., monitoring of Kafka (Apache Kafka), an open-source stream processing platform developed by the Apache Software Foundation), filtering to obtain file output operations (including but not limited to upload, burn, copy, etc.) that meet the interest criteria (including but not limited to filename, file format, file path, etc.), that is, confirming that there is an output operation of the target object on the target file.

[0051] In some embodiments, S102 includes: reading saved historical log data (e.g., reading from historical log storage database 104), and detecting whether there is a corresponding renaming operation (with the same target file) within a certain time period before the first moment (or a preset time period before the first moment, for example, the preset time period is 1 hour long). For example, after discovering the output operation of file b (the target file of the output operation is file b), the original file name of file b is detected as file a within the preset time period (the source file of the renaming operation is a, and the target file is b). If a renaming operation exists, it is confirmed that there is a renaming operation of the target file by the target object within the preset time period before the output operation (i.e., the first moment), and S103 is continued; if no renaming operation exists, the subsequent steps are not executed, that is, S103 is not executed.

[0052] It should be noted that the string similarity algorithm of S103 includes: cosine similarity, Euclidean distance, edit distance, Dice coefficient, Jaccard coefficient, etc.

[0053] In some embodiments, S103 includes: obtaining a similarity value between the file names before and after the renaming operation; when the similarity value is greater than a similarity threshold, the renaming operation is confirmed to be a high-risk operation. For example, the similarity value can be obtained using the Jakarta algorithm.

[0054] As an example, S103 includes: detecting the similarity between the strings before and after renaming based on the Jaccard coefficient (semantics are not considered for now). If the similarity is low (e.g., below 0.5), the combined operation (file renaming and output) is saved to the database table; otherwise, the renaming operation is considered normal, and no further steps are performed. For example, the process of calculating string similarity is as follows: using a word segmenter (compatible with both Chinese and English) to split the two strings into sets (each character appears only once in the set), then calculating the lengths of the intersection and union of the two sets to obtain their Jaccard coefficients, and thus the similarity between the two strings.

[0055] In some embodiments, the action of S103 in confirming whether the output operation leaks the target file based on the historical operation habits of the target object further includes: within a statistical time period, obtaining the operation frequency of the combined operation performed by the target object on the target file, wherein the combined operation includes a renaming operation and an output operation performed sequentially, and the statistical time period is determined based on a preset time window and the first time (for example, assuming that the output operation on the target file obtained by S101 occurs at the first time t1, and the preset time window size is Δt, then the statistical time period is the time period corresponding to the duration Δt forward from time t1); obtaining the operation frequency threshold of the combined operation based on historical log data; and confirming whether the output operation occurring at the first time t1 leaks the target file based on the operation frequency of the combined operation and the operation frequency threshold. For example, the operation frequency threshold is obtained based on a statistical anomaly detection algorithm and the historical log data. It should be noted that the statistical anomaly detection algorithm includes algorithms such as Three Sigma Law, box plots, and GrubbsTest (maximum normalized residual detection).

[0056] As an example, the statistical anomaly detection algorithm includes a box plot algorithm. The process of obtaining the operation frequency threshold based on the statistical anomaly detection algorithm and the historical log data in step S103 includes: sampling the historical log data multiple times according to a preset time window, a window movement distance, and a sampling number to obtain a historical combined operation frequency sequence, wherein the number of elements in the historical combined operation frequency sequence is the same as the number of samplings; and obtaining the operation frequency threshold based on the historical combined operation frequency sequence and the box plot algorithm. It should be noted that the size of the preset time window for obtaining the operation frequency threshold is the same as the size of the preset time window for obtaining the operation frequency, therefore both are represented by the same name.

[0057] For example, the historical log data is sampled multiple times according to the preset time window, window movement distance, and sampling number to obtain a historical combined operation frequency sequence, including: moving the preset time window multiple times according to the window movement distance, and obtaining the number of combined operations within the time period obtained by each movement, to obtain the value of each element in the historical combined operation frequency sequence, wherein the number of multiple movements is equal to the sampling number; and obtaining the operation frequency threshold according to the value of each element and the position of the quartile.

[0058] Taking the box plot algorithm as an example, S103 is illustrated.

[0059] Executing S103 involves detecting whether the operation frequency of the target object is normal based on the operation frequency threshold. Here, the operation frequency threshold and the operation frequency each operation corresponds to one combined operation. The combined operation refers to the renaming operation and the output operation performed sequentially on the target file.

[0060] Specifically, the process of obtaining the operation frequency in S103 includes: reading the database table and obtaining the number of combined operations (batch_statistics) of the target object (or target user) recorded in the database table within the statistical time period. The statistical time period is the time period corresponding to the preset time window size, obtained by filtering the output operation in S101 back from the first moment of occurrence. For example, using a certain period (e.g., 30 days) as the preset time window size, assuming the first moment of occurrence of the output operation obtained in S101 is time t0, then obtaining the operation frequency in S103 means obtaining the number of combined operations that occurred within the time period "(t0-30) days to time t0" from the database table.

[0061] The process of obtaining the operation frequency threshold in S103 includes: calculating the operation frequency threshold (batch_threshold) corresponding to the normal operation of the target object using a box plot algorithm based on a preset time window, window movement distance, and sampling number. For example, the specific process of calculating the operation frequency threshold is as follows: Multiple time periods are obtained by successively moving the preset time window according to the window movement distance (e.g., the window movement distance is 1 day), the sampling number is determined (e.g., 30 times), and an operation sequence with a length equal to the number of sampling times is obtained. Then, the data of the obtained operation sequence is arranged in ascending order, and the third quartile Q3 (also known as the lower quartile), the first quartile Q1 (also known as the upper quartile), and IQR are calculated respectively, resulting in the operation frequency threshold (upper limit) = Q3 + 1.5IQR, where IQR = Q3 - Q1, Q... i The position p is i*(n+1) / 4, where n is the total number of terms or elements in the operation sequence. When the position p is not an integer, the values ​​are taken according to a uniform distribution. For example, if p = 2.25, then the 2.25th number = (the third number - the second number)25 / 100 + the second number = the second number 0.75 + the third number * 0.25.

[0062] As an example, S103 includes the following process to obtain the operation frequency threshold.

[0063] The first step, assuming a preset time window of 30 days, and the output operation obtained by S101 occurs at the first moment t0, with a sampling number of 5 set to obtain the operation frequency threshold, sampling the time periods corresponding to the five preset time windows yields an operation sequence composed of five elements (5, 3, 2, 1, 4). That is, the statistical results show that the number of combined operations corresponding to the preset time window from "(t0-30-1) days to t0-1" is 5, the number of combined operations corresponding to the preset time window from "(t0-30-2) days to (t0-2)" is 3, the number of combined operations corresponding to the preset time window from "(t0-30-3) days to (t0-3)" is 2, the number of combined operations corresponding to the preset time window from "(t0-30-4) days to (t0-4)" is 1, and the number of combined operations corresponding to the preset time window from "(t0-30-5) days to (t0-5)" is 4.

[0064] The second step is to sort the operation sequence in ascending order: 1st, 2nd, 3rd, 4th, and 5th operations. Then, determine the position of the quartiles, with n taking the value of 5 (e.g., Q). i The position is i*(n+1) / 4, where i = 1, 2, 3, and n represents the number of items or elements in the operation sequence. Based on the position, the corresponding four-part number is calculated, and the operation frequency threshold is finally determined.

[0065] Specifically, the position of Q1 = (5+1) / 4 = 1.5, Q1 = 0.5 * the first term (or the first element, i.e., the value of the first number in the sequence after sorting from smallest to largest) + 0.5 * the second term (or the second element, i.e., the value of the second number in the sequence after sorting from smallest to largest) = 1.5; the position of Q3 = (5+1)*3 / 4 = 4.5, Q3 = 0.5 * the fourth term (or the fourth element, i.e., the value of the fourth number in the sequence after sorting from smallest to largest) + 0.5 * the fourth element (or the fourth number in the sequence after sorting from smallest to largest) + 0.5 * the fourth element (or the fourth element in the sequence after sorting from smallest to largest) + 0.5 * the fourth element (or the fourth element in the sequence after sorting from smallest to largest) = 1.5; The five items (or the fifth element, i.e., the value of the fifth number in the sequence after sorting from smallest to largest) = 0.5*4 + 0.5*5 = 4.5; IQR = Q3 - Q1 = 4.5 - 1.5 = 3; then the operation frequency threshold = Q3 + 1.5IQR = 4.5 + 1.5*3 = 9. That is to say, the operation frequency threshold obtained according to the box plot algorithm is 9. If the operation frequency is determined to be greater than 9, then the output operation detected by S101 is confirmed to be abnormal behavior, and the corresponding target file is at risk of being leaked.

[0066] It should be noted that in some embodiments of this application, after S103, an abnormal event is also output. For example, the operation frequency batch_statistics obtained in S103 is compared with the operation frequency threshold batch_threshold. If batch_statistics>=batch_threshold, it indicates that there is a risk of file leakage. An abnormal event will be output and the administrator will be notified. Otherwise, it is considered normal and the detection ends.

[0067] To enhance the application scenarios of the algorithm in this application, in some embodiments of this application, at least one of the similarity threshold, the preset time window, the window movement distance, and the number of samplings is a configurable parameter. Key parameters (e.g., filename, similarity threshold, preset time window size, number of samplings, etc.) in the method for detecting internal file leakage in some embodiments of this application can be configured by the user and dynamically adjusted according to actual conditions. This detection method does not involve file content, thus protecting user privacy as much as possible.

[0068] like Figure 4 As shown below, the method for detecting internal file leakage behavior according to an embodiment of this application is illustrated with a specific example.

[0069] S401, monitors log data.

[0070] S402, is this an output operation of interest? Specifically, it involves confirming, based on real-time monitoring of log data, whether the target object performs any output operations on the target file.

[0071] Assume that the real-time log data received by the monitoring log cache queue is: zhangsan / user / local / test.txt / user / local / test.txt upload time1. This log indicates that the target object (or called the target object) zhangsan performed an output operation of upload on the target file / user / local / test.txt at the first moment of time time1. Among them, the source file and the target file are the same. Assume that the user, file, and file operation are all information that needs to be concerned about, that is, it meets the filtering conditions of the first step. For example, an audit log data should at least contain the following information:

[0072] Table 1 Information included in a log data

[0073] user user source_file Source file destination_file target file operate Operation type time Time of occurrence

[0074] S403, confirm whether there is a rename operation within a certain period of time before confirmation.

[0075] For example, according to the log data information received by S401, detect whether there is a rename operation on the target file / user / local / test.txt by the target user zhangsan within a certain period of time (assumed to be 1h) before the upload operation of the target file / user / local / test.txt, that is, whether there is a similar log: zhangsan / user / local / zhaongyao.txt / user / local / test.txt rename time2, and satisfy time2 + 1h < time1. If there is a similar log, then perform S405; otherwise, execute S404 to end this detection.

[0076] S405, confirm whether the file names before and after renaming are less similar.

[0077] For example, calculate the similarity of the file names before and after renaming based on the Jaccard coefficient. If the similarity is less than the configured similarity threshold, then execute S406; otherwise, consider this rename operation normal and do not perform subsequent steps.

[0078] S406, save the "file rename and output" operation of the target object to the database table, and perform S407. For example, save information such as the target object, source file, target file, rename time, file output method, output time, etc.

[0079] S407, confirm whether the operation frequency is normal.

[0080] For example, to check whether the frequency of "file renaming and output" operations performed by the target object within a statistical time period is normal, the file operation log information table saved in the database is read. The log is filtered according to the target object and time period to obtain the number of combined operations (i.e., sequential renaming and output operations) performed by the target user within the statistical time period (batch_statistics). Then, based on parameters such as the preset time window size (assumed to be 30), window movement distance (assumed to be 1), and sampling count (assumed to be 10), a historical sequence of combined operation counts with a length equal to the sampling count is obtained. Based on this, the operation frequency threshold (batch_threshold) is derived using a box plot algorithm. The specific calculation method can be found in the description above. To avoid repetition, it will not be elaborated further here.

[0081] S408, Output abnormal events. For example, compare the operation frequency batch_statistics and the operation frequency threshold batch_threshold in S407. If batch_statistics >= batch_threshold, it indicates a risk of file leakage, and an abnormal event will be output and the administrator will be notified. Otherwise, it is considered normal, and the detection ends.

[0082] Please refer to Figure 5 , Figure 5 The apparatus for detecting document leakage behavior as illustrated in the embodiments of this application is shown. It should be understood that this apparatus is similar to the one described above. Figure 3 or Figure 4 Corresponding to the method embodiments, it can execute the various steps involved in the above method embodiments. The specific functions of the device can be found in the description above. To avoid repetition, detailed descriptions are appropriately omitted here. The device includes at least one software function module that can be stored in the memory or embedded in the device's operating system in the form of software or firmware. This device for detecting internal file leakage behavior includes: an output operation acquisition module 401, configured to detect log data and confirm that there is an output operation of the target object on the target file at a first moment, wherein the output operation includes: uploading, burning, or copying; a renaming operation acquisition module 402, configured to confirm that there is a renaming operation of the target object on the target file within a preset period of time before the first moment; and an operation risk acquisition module 403, configured to confirm whether there is leakage of the target file based on the historical operation habits of the target user when the renaming operation is confirmed to be a high-risk operation according to the set similarity algorithm.

[0083] In some embodiments, the operation risk acquisition module 403 further includes a renaming operation risk acquisition module (not shown in the figure), configured to: acquire a similarity value between the file names before and after the renaming corresponding to the renaming operation; and when it is confirmed that the similarity value is greater than a similarity threshold, then confirm that the renaming operation belongs to the high-risk operation. For example, the similarity value is acquired using the Jakarta algorithm.

[0084] In some embodiments, the operation risk acquisition module 403 is configured to: acquire the operation frequency of the combined operations performed by the target user on the target file within a statistical time period, wherein the combined operations include a rename operation and an output operation performed sequentially, and the statistical time period is determined based on a preset time window and the first moment; acquire the operation frequency threshold of the combined operations based on historical log data; and confirm whether there is any behavior that leaks the target file based on the operation frequency of the combined operations and the operation frequency threshold.

[0085] In some embodiments, the operation risk acquisition module 403 is further configured to: obtain the operation frequency threshold based on a statistical anomaly detection algorithm and the historical log data.

[0086] In some embodiments, the statistical anomaly detection algorithm includes a box plot algorithm, wherein the operation risk acquisition module 403 is further configured to: sample the historical log data multiple times according to the preset time window, window movement distance and sampling number to obtain a historical combined operation frequency sequence, wherein the number of elements included in the historical combined operation frequency sequence is the same as the sampling number; and obtain the operation frequency threshold according to the historical combined operation frequency sequence and the box plot algorithm.

[0087] In some embodiments, the operation risk acquisition module 403 is further configured to: move the preset time window multiple times according to the window movement distance, and obtain the number of times the combined operation is performed within the time period obtained by each movement, thereby obtaining the value of each element in the historical combined operation count sequence, wherein the number of multiple movements is equal to the number of samplings; and obtain the operation frequency threshold according to the value of each element and the position of the quartile.

[0088] In some embodiments, at least one of the similarity threshold, the preset time window, the window movement distance, and the number of samplings is a configurable parameter.

[0089] In some embodiments, the output operation acquisition module 401 is configured to: detect the cached file operation log queue in real time, and filter out the target object that performs an output operation on the target file at the first moment according to the attention conditions, wherein the attention conditions include at least one of file name, file format and file path.

[0090] In some embodiments of this application, the file name, file format, or file path are configurable parameters.

[0091] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the device described above can be referred to the foregoing. Figure 3 The corresponding process of the Chinese method will not be elaborated on here.

[0092] Some embodiments of this application provide a computer storage medium having a computer program stored thereon, which, when executed by a processor, can implement the various embodiments of the above-described methods for detecting internal file leakage.

[0093] like Figure 6 As shown, some embodiments of this application provide an electronic device 500, including a memory 510, a processor 520, and a computer program stored on the memory 510 and executable on the processor 520. When the processor 520 reads the program from the memory 510 via a bus 530 and executes the program, it can implement the methods corresponding to the embodiments of the above-described methods for detecting internal file leakage.

[0094] Processor 520 can process digital signals and can include various computing architectures. For example, it can be a complex instruction set computer architecture, a reduced instruction set computer architecture, or an architecture that implements multiple instruction set combinations. In some examples, processor 520 can be a microprocessor.

[0095] The memory 510 can be used to store instructions executed by the processor 520 or data related to the execution of instructions. These instructions and / or data may include code used to implement some or all of the functions of one or more modules described in the embodiments of this application. The processor 520 of the embodiments of this disclosure can be used to execute the instructions in the memory 510 to implement… Figure 3 The method shown. Memory 510 includes dynamic random access memory, static random access memory, flash memory, optical memory, or other memory well known to those skilled in the art.

[0096] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0097] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0098] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0099] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application. It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0100] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0101] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. A method for detecting file leakage behavior, characterized in that, The method includes: Real-time monitoring of log data confirms that there is an output operation of the target object on the target file at the first moment, wherein the output operation includes: uploading, burning or copying; It is confirmed that within a preset time period prior to the first moment, there was a renaming operation of the target file by the target object; If the renaming operation is confirmed to be a high-risk operation based on the set similarity algorithm, then the output operation is confirmed to have leaked the target file based on the target object's historical operation habits. The step of determining that the renaming operation is a high-risk operation based on a set similarity algorithm includes: Obtain the similarity value between the file names before and after the renaming operation; When the similarity value is greater than the similarity threshold, the renaming operation is confirmed to be a high-risk operation. The step of confirming whether the output operation leaks the target file based on the target object's historical operation habits includes: Within a statistical time period, the frequency of combined operations performed by the target object on the target file is obtained, wherein the combined operations include renaming operations and output operations performed sequentially, and the statistical time period is determined based on a preset time window and the first moment. The operation frequency threshold of the combined operation is obtained based on historical log data; Based on the operation frequency of the combined operation and the operation frequency threshold, it is determined whether the output operation leaks the target file.

2. The method as described in claim 1, characterized in that, The similarity value is obtained using the Jakar algorithm.

3. The method as described in claim 1, characterized in that, The step of obtaining the operation frequency threshold of the combined operation based on historical log data includes: obtaining the operation frequency threshold based on a statistical anomaly detection algorithm and the historical log data.

4. The method as described in claim 3, characterized in that, The statistical anomaly detection algorithm includes a box plot algorithm, wherein, The step of obtaining the operation frequency threshold based on the statistical anomaly detection algorithm and the historical log data includes: The historical log data is sampled multiple times according to the preset time window, window movement distance and sampling number to obtain a historical combined operation count sequence, wherein the number of elements included in the historical combined operation count sequence is the same as the sampling number; The operation frequency threshold is obtained based on the historical combination operation count sequence and the box plot algorithm.

5. The method as described in claim 4, characterized in that, The step of sampling the historical log data multiple times according to the preset time window, window movement distance, and sampling number to obtain a historical combined operation count sequence includes: The preset time window is moved multiple times according to the window movement distance, and the number of times the combined operation is obtained within the time period obtained by each movement, so as to obtain the value of each element in the historical combined operation count sequence, wherein the number of multiple movements is equal to the number of samplings; The operation frequency threshold is obtained based on the values ​​of each element and the position of the quartiles.

6. The method as described in claim 4, characterized in that, At least one of the similarity threshold, the preset time window, the window movement distance, and the number of samplings is a configurable parameter.

7. The method as described in claim 1, characterized in that, The real-time detection log data confirms that there is an output operation of the target object on the target file at the first moment, including: real-time detection of the cached file operation log queue, and filtering to obtain the target object's output operation on the target file at the first moment according to the attention conditions, wherein the attention conditions include at least one of the file name, file format and file path.

8. The method as described in claim 7, characterized in that, The file name, file format, or file path are configurable parameters.

9. A device for detecting document leakage behavior, characterized in that, The device includes: The output operation acquisition module is configured to detect log data in real time and confirm that there is an output operation of the target object on the target file at the first moment. The output operation includes: uploading, burning or copying. The renaming operation acquisition module is configured to confirm that within a preset time period prior to the first moment, there is a renaming operation of the target file by the target object; The operation risk acquisition module is configured to, when the renaming operation is confirmed to be a high-risk operation based on the set similarity algorithm, determine whether there is any behavior that leaks the target file based on the historical operation habits of the target object. The operation risk acquisition module is configured to acquire the similarity value between the file names before and after the renaming operation; when the similarity value is greater than the similarity threshold, the renaming operation is confirmed to be a high-risk operation. The operation risk acquisition module is configured to acquire the frequency of combined operations performed by the target object on the target file within a statistical time period, wherein the combined operations include a rename operation and an output operation performed sequentially, and the statistical time period is determined based on a preset time window and the first moment; acquire the operation frequency threshold of the combined operations based on historical log data; and confirm whether the output operation leaks the target file based on the operation frequency of the combined operations and the operation frequency threshold.

10. A computer storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it can implement the method described in any one of claims 1-8.

11. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein, When the processor executes the program, it can implement the method described in any one of claims 1-8.

Images