Information leakage detection method, device and computer readable medium

Abstract

An information leakage detection method, device and computer-readable medium can effectively detect information leakage and occupy little computer resources. The information leakage detection method comprises: obtaining a data packet (30) sent outward from a protected system (100); identifying a signature from the data packet (30), wherein a signature uniquely corresponds to a host (1000) in the protected system (100) and is stored in one or more files in the corresponding host (1000); if the signature is identified, it is determined that the information in the host (1000) corresponding to the identified signature is leaked.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of network security technology, and in particular, to an information leakage detection method, device, and computer-readable medium. Background Art

[0002] Network security is becoming increasingly important. Information leakage detection systems, as a type of security solution, can be used to detect unexpected information leakage, monitor permissions, access status, and unauthorized access identities.

[0003] At present, the common working methods of information leakage detection systems include: using encryption methods to protect data, using software installed on the operating system to monitor access to files, etc. The implementation mechanism of these information leakage detection systems is relatively complex, and the software implementation involves the operating system, and most of them need to be implemented through processes running on the backend.

[0004] For example: the patent document with publication number CN101971186B and invention name "Information leakage prevention device and method and program thereof" adopts encryption method to protect data; and the patent document with publication number CN1300654C and invention name "Method and device for preventing information leakage" discloses a solution that uses software installed on the operating system to monitor access to files.

[0005] Currently, most information leakage detection systems need to be implemented through software running on the protected system, which consumes a lot of computer resources and may cause the protected system to fail to operate normally. Summary of the invention

[0006] Embodiments of the present invention provide an information leakage detection method, device and computer-readable medium, which can effectively detect information leakage and occupy less computer resources.

[0007] In a first aspect, a method for detecting information leakage is provided. The method may include: obtaining a data packet sent outward from a protected system; identifying a signature from the data packet, wherein a signature uniquely corresponds to a host in the protected system and is stored in one or more files in the corresponding host; if the signature is identified, determining that information in the host corresponding to the identified signature is leaked.

[0008] In a second aspect, an information leakage detection device is provided, which may include: a data packet acquisition module, configured to acquire data packets sent outward from a protected system; a signature recognition module, configured to identify a signature from the data packet, wherein a signature uniquely corresponds to a host in the protected system and is stored in one or more files in the corresponding host; and a judgment module, configured to determine that information in the host corresponding to the identified signature has been leaked if the signature is identified.

[0009] In a third aspect, an information leakage detection device is provided, comprising: at least one memory configured to store computer-readable code; and at least one processor configured to call the computer-readable code to execute the steps provided in the first aspect.

[0010] According to a fourth aspect, a computer-readable medium is provided, wherein computer-readable instructions are stored on the computer-readable medium, and when the computer-readable instructions are executed by a processor, the processor is caused to execute the steps provided in the first aspect.

[0011] Among them, files containing signatures are pre-stored in the host of the protected system. Since the signatures in these files are recognizable, when an attacker attempts to steal information from the protected system, it is possible to transmit these files together, and the signatures contained in these files will appear in the data packets sent out by the protected system. Since the signature is uniquely corresponding to a host in the protected system, it is possible to determine from which host the information is leaked. The solution has the advantages of simple implementation and little impact on the protected system. It can be deployed on devices or systems with limited resources, can effectively detect information leakage, and can trace the specific information of the information leakage, such as: the location of the leaked information in the protected system, etc.

[0012] For any of the above aspects, optionally, when identifying a signature from the data packet, each pre-stored encoded signature may be used to match the data packet to identify the signature. Optionally, when identifying a signature from the data packet, each pre-stored compressed signature may be used to match the data packet to identify the signature. Since the attacker may encode, compress, and process the information when stealing it, each signature may be processed in advance according to different encoding and compression methods, and the processed signatures may be stored. In this way, after obtaining the data packet, the processed signature may be directly used for matching, which can be easily and quickly matched. Once successful, the decoding and decompression method used by the attacker may also be determined. Based on this, the information stolen by the attacker may be further decoded and decompressed to determine which host, where, and when the attacker stole what content.

[0013] For any of the above aspects, optionally, the one or more files are preceded and ended with the signature corresponding to the host. Such a special position facilitates the extraction of the signature. And the signature is used as the beginning and the end to delimit the content in the middle of the file, making it easier to extract the content in the middle of the file.

[0014] For any of the above aspects, optionally, the one or more files include at least one of the following information: file description information; information of the host where the file is located. Such information can be used to analyze the attacker's behavior and to determine from which host, from which location, and at what time the attacker stole information. Such information can provide a basis for taking further emergency measures and obtaining evidence.

[0015] For any of the above aspects, optionally, a signature is stored in a plurality of files of the corresponding host, and the plurality of files are located at different locations of the host. Multiple files at different locations can further increase the probability of detecting information leakage.

[0016] For any of the above aspects, optionally, each of the plurality of files includes storage location information of the file in the host. The acquired storage location information can be used to analyze the behavior of the attacker.

[0017] For any of the above aspects, optionally, the signature is generated based on an identifier of the corresponding host. Alternatively, the signature is generated based on multiple identifiers of the corresponding host, which has the advantage of avoiding collision of signatures of different hosts after using a certain algorithm to generate signatures.

[0018] For any of the above aspects, optionally, the signature is calculated based on a hash algorithm, and the signature lengths corresponding to different hosts are the same, so that the signature lengths of different hosts can be the same, which facilitates the subsequent identification of the signature from the data group.

[0019] For any of the above aspects, optionally, the file names of the one or more files include signatures corresponding to the host. The more times the signature appears, the greater the possibility that it can be identified after being packaged into data packets.

[0020] For any of the above aspects, optionally, the one or more files are hidden files and / or static files. Placing static files in a protected system is safer and usually does not bring additional risks. Setting a file as a hidden file can reduce the probability of an attacker discovering the file and make it easier to detect information leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 A schematic diagram of the structure of an information leakage detection device provided by an embodiment of the present invention.

[0022] Figure 2 The present invention provides a flowchart of an information leakage detection method.

[0023] List of reference numerals:

[0024] DETAILED DESCRIPTION

[0025] The subject matter described herein will now be discussed with reference to example implementations. It should be understood that the discussion of these implementations is only to enable those skilled in the art to better understand and implement the subject matter described herein, and is not a limitation of the scope of protection, applicability or examples set forth in the claims. The function and arrangement of the elements discussed can be changed without departing from the scope of protection of the embodiments of the present invention. Each example can omit, replace or add various processes or components as needed. For example, the described method can be performed in an order different from the described order, and each step can be added, omitted or combined. In addition, the features described relative to some examples can also be combined in other examples.

[0026] As used herein, the term "including" and its variations represent open terms, meaning "including but not limited to". The term "based on" means "based at least in part on". The terms "one embodiment" and "an embodiment" mean "at least one embodiment". The term "another embodiment" means "at least one other embodiment". The terms "first", "second", etc. may refer to different or the same objects. Other definitions may be included below, whether explicit or implicit. Unless the context clearly indicates otherwise, the definition of a term is consistent throughout the specification.

[0027] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0028] Figure 1 The structure of the information leakage detection device 10 provided by the embodiment of the present invention and the connection relationship between the device and the protected system 100 are shown.

[0029] The protected system 100 includes at least one host 1000 (in one case, the protected system 100 is only one host 1000 connected to the network). At least one file (only one file or multiple files) is pre-stored in each of some or all hosts 1000 in the protected system 100. The at least one file is different from an ordinary file and includes a pre-set signature 40. The signature 40 uniquely corresponds to the host where it is located. That is, the signatures included in the at least one file pre-stored on different hosts are different from each other.

[0030] The pre-set signature 40 may be stored in a signature library, which may be stored in at least one memory 101 of the information leakage detection device 10, or may be stored in a separate computer, such as a remote server. The information leakage detection device 10 may obtain the data packet 30 sent outward by the protected system 100 through its communication module 103, and identify from the data packet 30 whether there is a signature 40 pre-stored in the signature library, or if there is a signature 40, it is determined that the information in the host 1000 uniquely corresponding to the signature 40 has been leaked.

[0031] The information leakage detection device 10 may have multiple optional methods when acquiring the data packet 30. For example, the protected system 100 is connected to a network traffic distributor, which is used to copy or forward the data packet 30 sent out by the protected system 100. In practice, the network traffic distributor may be a switch, a router, a firewall, or a gateway. The device may be a part of the protected system 100 or a part of the information leakage detection device 10. The information leakage detection device 10 acquires the data packet 30 through the device.

[0032] As mentioned above, traditional information leakage detection methods require running software on the protected system, which consumes the processing resources and storage resources of the protected system. Traditional methods cannot be applied to systems with limited processing resources and storage resources. For example, for the host computer in an industrial control system, its design purpose is to be used for industrial control, and the processing resources and storage resources are often limited, so traditional information leakage detection methods cannot be applied.

[0033] In the embodiment of the present invention, files containing signatures are pre-stored in the host 1000 of the protected system 100, for example, placed in some folders storing key information. Since the signatures in these files are recognizable, when an attacker attempts to steal information from the protected system 100, it is possible to transmit these files together, and the signatures contained in these files will appear in the data packets 30 sent out by the protected system 100. It should be noted that the data packets 30 can be packets that comply with any network protocol, and the information leakage detection device 10 can obtain these data packets 30, and parse them according to the corresponding network protocol, obtain the payload transmitted in the data packets 30, and use the pre-stored signatures 40 to match the contents in these payloads to determine whether the data packets 30 include the pre-set signatures 40. Since the signature 40 is uniquely corresponding to a host 1000 in the protected system 100, it can be determined from which host 1000 the information is leaked.

[0034] Optionally, the file can be marked with the corresponding signature 40 as the beginning and the end, and such a special position facilitates the extraction of the signature 40. And using the signature 40 as the beginning and the end can delimit the content in the middle of the file, making it easier to extract the content in the middle of the file. Optionally, the signature 40 can also be included in the file name. The more times the signature 40 appears, the greater the possibility that it can be recognized after being packaged into a data group 30. In addition to the signatures at the beginning and the end, the file can also include the following information:

[0035] 1)Description of the file

[0036] For example: file creation time, file modification time, file creator, file processor, file storage location, etc.

[0037] 2) Information of host 1000

[0038] For example: the name of host 1000, the IP address of host 1000, etc.

[0039] This information can be used to analyze the attacker's behavior and determine from which host, where, and when the attacker stole information. This information can provide a basis for taking further emergency measures and collecting evidence.

[0040] Optionally, a host 1000 may store a plurality of such files, and these files may be located at different locations of the host 1000. Optionally, the file content may include storage location information of the file in the host 1000. On the one hand, multiple files at different locations can further increase the probability of detecting information leakage, and on the other hand, the obtained storage location information can also be used to analyze the behavior of attackers.

[0041] Optionally, the signature 40 may be generated based on an identifier of the host 1000, such as the ID of the host 1000 or the name of the host 1000. Alternatively, the signature 40 may be generated based on multiple identifiers of the host 1000. The advantage of this is that it can avoid collisions between signatures of different hosts 1000 after a certain algorithm is used to generate the signature 40.

[0042] Optionally, the signature 40 may be generated based on a hash algorithm. This allows the signatures 40 of different hosts 1000 to have the same length, making it easier to subsequently identify the signature 40 from the data packet 30. The hash algorithm may be a message digest algorithm (MD5), a secure hash algorithm (SHA-1), or the like.

[0043] When stealing information, the attacker may encode and compress the information, such as Base64 processing, uniform resource locator (URL) encoding, tar packaging processing, etc. Therefore, the information leakage detection device 10 can process each signature 40 in advance according to different encoding methods and compression methods, and store the processed signatures 40. In this way, after obtaining the data group 30, the processed signature 40 can be directly used for matching, which can be easily and quickly matched. Once successful, the decoding and decompression method used by the attacker can also be determined. Based on this, the information stolen by the attacker can be further decoded and decompressed to determine which host, what location, and when the attacker stole what content.

[0044] Optionally, these files can be set to be hidden files, for example, by adding a dot in front of the file name. This reduces the chances of an attacker discovering the file and makes it easier to detect information leakage.

[0045] Optionally, these files can be static files, such as .txt files. Compared with dynamic files, such as executable files such as .exe, it is safer to place these files in the protected system 100 without bringing additional risks.

[0046] Next, combine Figure 1 The implementation of the information leakage detection device 10 is described. For example, it can be implemented as a network of computer processors to execute the information leakage detection method 200 in the embodiment of the present invention. The information leakage detection device 10 can also be as follows: Figure 1 The single computer shown includes at least one memory 101, which includes a computer-readable medium, such as a random access memory (RAM). The device 10 also includes at least one processor 102 coupled to the at least one memory 101. Computer executable instructions are stored in the at least one memory 101, and when executed by the at least one processor 102, the at least one processor 102 can be caused to perform the steps described herein. At least one processor 102 may include a microprocessor, an application-specific integrated circuit (ASIC), a digital signal processor (DSP), a central processing unit (CPU), a graphics processing unit (GPU), a state machine, etc. Embodiments of computer-readable media include, but are not limited to, floppy disks, CD-ROMs, disks, memory chips, ROMs, RAMs, ASICs, configured processors, all-optical media, all tapes or other magnetic media, or any other medium from which a computer processor can read instructions. In addition, various other forms of computer-readable media can send or carry instructions to a computer, including routers, private or public networks, or other wired and wireless transmission devices or channels. Instructions may include codes in any computer programming language, including C, C++, C language, Visual Basic, java, and JavaScript.

[0047] When executed by at least one processor 102, Figure 1 The at least one memory 101 shown in the figure may include an information leakage detection program 20, so that at least one processor 102 executes the information leakage detection method 200 described in the embodiment of the present invention. The information leakage detection program 20 may include:

[0048] - A data packet acquisition module 201, configured to acquire the data packet 30 sent outward from the protected system 100;

[0049] - a signature recognition module 202 configured to recognize a signature 40 from a data packet 30;

[0050] - The judgment module 203 is configured to: if the signature 40 is identified, determine that the information in the host 1000 corresponding to the identified signature 40 is leaked.

[0051] It should be mentioned that embodiments of the present invention may include devices having different Figure 1 The above architecture is merely exemplary and is used to explain the method 200 provided in the embodiment of the present invention.

[0052] In addition, the above modules can also be regarded as various functional modules implemented by hardware, which are used to realize various functions involved in the information leakage detection device 10 when executing the information leakage detection method, such as pre-burning the control logic of each process involved in the method into a field programmable gate array (Field-Programmable Gate Array, FPGA) chip or a complex programmable logic device (Complex Programmable Logic Device, CPLD), and these chips or devices execute the functions of the above modules. The specific implementation method can be determined according to engineering practice.

[0053] like Figure 2 As shown, an exemplary method 200 according to an embodiment of the present invention includes the following steps:

[0054] - S201: Acquire the data packet 30 sent outward from the protected system 100;

[0055] - S202: Identify a signature from the data group 30, wherein a signature uniquely corresponds to a host 1000 in the protected system 100 and is stored in one or more files in the corresponding host 1000;

[0056] - S203: If the signature is identified, it is determined that the information in the host 1000 corresponding to the identified signature is leaked.

[0057] Other optional implementations of this method can refer to the previous description and will not be repeated here.

[0058] In addition, an embodiment of the present invention also provides a computer-readable medium, on which computer-readable instructions are stored. When the computer-readable instructions are executed by the processor, the processor executes the aforementioned information leakage detection method. Embodiments of computer-readable media include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), magnetic tapes, non-volatile memory cards, and ROMs. Optionally, the computer-readable instructions can be downloaded from a server computer or a cloud via a communication network.

[0059] In summary, the embodiments of the present invention provide an information leakage detection method, device and computer-readable medium. The methods have the advantages of simple implementation and little impact on the protected system, can be deployed on a resource-constrained device or system, can effectively detect information leakage, and can trace the specific information of the information leakage, such as the location of the leaked information in the protected system.

[0060] It should be noted that not all steps and modules in the above-mentioned processes and system structure diagrams are necessary, and some steps or modules can be ignored according to actual needs. The execution order of each step is not fixed and can be adjusted as needed. The system structure described in the above-mentioned embodiments can be a physical structure or a logical structure, that is, some modules may be implemented by the same physical entity, or some modules may be implemented by multiple physical entities, or some components in multiple independent devices may be implemented together.

Claims

1. A method for detecting information leakage, characterized in that: include: - Capture data packets sent out from the protected system; - identifying a signature from the data packet, wherein a signature uniquely corresponds to a host in the protected system and is stored in one or more files in the corresponding host; - If the signature is identified, it is determined that the information in the host corresponding to the identified signature is leaked.

2. The method according to claim 1, characterized in that Identifying a signature from the data packet comprises: - using pre-stored encoded signatures to match the data packets to identify the signatures; and / or - Using pre-stored compressed signatures to match the data packets to identify the signatures.

3. The method according to claim 1 or 2, characterized in that The one or more files begin and end with the signature corresponding to the host.

4. The method according to claim 1 or 2, characterized in that: The one or more files include at least one of the following information: - File description information; - Information about the host where the file is located.

5. The method according to claim 1 or 2, characterized in that: One signature is stored in a plurality of files of the corresponding host, and the plurality of files are located at different locations of the host.

6. The method according to claim 5, characterized in that Each of the plurality of files includes storage location information of the file in the host.

7. The method according to claim 1 or 2, characterized in that: - the signature is generated based on an identity of the corresponding host; or - The signature is generated based on multiple identifiers of the corresponding host.

8. The method according to claim 1 or 2, characterized in that: The signature is calculated based on a hash algorithm, and the signature lengths corresponding to different hosts are the same.

9. The method according to claim 1 or 2, characterized in that: The file names of the one or more files include signatures corresponding to the host computers where the files are located.

10. The method according to claim 1 or 2, characterized in that: The one or more files are hidden files and / or static files.

11. An information leakage detection device, characterized in that: include: - a data packet acquisition module, configured to acquire data packets sent outward from the protected system; - a signature recognition module, configured to recognize a signature from the data packet, wherein a signature uniquely corresponds to a host in the protected system and is stored in one or more files in the corresponding host; - A judgment module is configured to determine that information in a host corresponding to the identified signature is leaked if the signature is identified.

12. The device according to claim 11, characterized in that The data packet acquisition module is specifically configured as follows: - using pre-stored encoded signatures to match the data packets to identify the signatures; and / or - Using pre-stored compressed signatures to match the data packets to identify the signatures.

13. An information leakage detection device, characterized in that: include: at least one memory configured to store computer readable code; At least one processor is configured to call the computer readable code to execute the method according to any one of claims 1 to 10.

14. A computer readable medium, characterized in that The computer-readable medium stores computer-readable instructions, and when the computer-readable instructions are executed by a processor, the processor executes the method according to any one of claims 1 to 10.

Images