A method, device, equipment and medium for detecting large-scale sensitive data leakage

Abstract

The present application discloses a detection method, device, equipment and medium for large-scale sensitive data leakage, which relates to the computer field and is applied to a preset detection model. The detection model detects data between different security domains, and dual one-way network gates are deployed between different security domains, including: monitoring whether the first and second logs exist; the first log corresponds to the sensitive word, and the second log is a log generated when the flow at the dual one-way network gate outlet meets the flow threshold; if the first and second logs are monitored, and the first log is generated before the second log, the protocol information returned by the IDS flow probe is obtained; the IDS flow probe is pre-deployed between different security domains; based on the protocol information and the first log, it is determined whether a large-scale sensitive data leakage occurs. Compared with the traditional single detection model based on the IDS flow probe, the present application deploys dual one-way network gates between different security domains to ensure that all data passing through the network gate is monitored, thereby improving the detection accuracy.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method, device, equipment and medium for detecting large-scale sensitive data leakage. Background Art

[0002] In today's era, Internet business is developing rapidly, but the concept of data protection governance is often underestimated. The privacy data of enterprises and individuals are often leaked, causing economic losses. In the process of data leakage, enterprises and individuals are often unable to detect it in time, and the process of tracing the source relies too much on manual analysis and lacks automation capabilities. For special industries (such as the military, banks, government and enterprises, etc.), data protection mechanisms must be strictly regulated.

[0003] Currently, most data leakage detection methods are based on IDS (Intrusion Detection Systems) traffic log analysis, which determines whether the data is likely to be stolen by parsing the messages in the return package. This detection method consumes a lot of server resources to analyze massive probe log data, which consumes too much server resources and has a high false alarm rate.

[0004] Therefore, how to improve the detection accuracy of data leakage is an urgent problem to be solved in this field. Summary of the invention

[0005] In view of this, the purpose of the present invention is to provide a method, device, equipment and medium for detecting large-scale sensitive data leakage, which can improve the detection accuracy of data leakage. The specific scheme is as follows:

[0006] In a first aspect, the present application discloses a method for detecting large-scale sensitive data leakage, which is applied to a preset detection model, wherein the detection model is used to perform large-scale sensitive data detection on data transmitted between different security domains, and dual unidirectional network gates are pre-deployed between the different security domains, including:

[0007] Monitor whether there is a first log and a second log; wherein the first log is a log corresponding to a preset sensitive keyword, and the second log is a log generated when the flow of the dual unidirectional network gate outlet meets a preset flow threshold;

[0008] If the first log and the second log are monitored, and the first log is monitored to be generated before the second log, then obtaining the protocol information in the data packet returned by the IDS flow probe; wherein the IDS flow probe is pre-deployed between the different security domains;

[0009] Based on the protocol information and the first log, it is determined whether a large-scale sensitive data leakage occurs.

[0010] Optionally, the method for detecting large-scale sensitive data leakage is characterized by further comprising:

[0011] When a data packet corresponding to the preset sensitive keyword is detected through the dual unidirectional network gate, the first log is generated;

[0012] When the flow rate at the dual unidirectional gateway exit meets the preset flow rate threshold, the second log is generated.

[0013] Optionally, the determining whether a large-scale sensitive data leakage occurs based on the protocol information and the first log includes:

[0014] The protocol information is compared with the log content of the first log. If the comparison is consistent, it is determined that a large-scale sensitive data leakage has occurred.

[0015] Optionally, if the comparison is consistent, after determining that a large-scale sensitive data leakage has occurred, the method further includes:

[0016] The first log and the second log are analyzed, and corresponding network attack behaviors are determined according to the analysis results, and then an alarm is issued.

[0017] Optionally, determining corresponding network attack behaviors according to the analysis results and then issuing an alarm prompt includes:

[0018] According to the analysis results, the corresponding network attack behavior is determined, and then the alarm information is output.

[0019] Optionally, if the first log and the second log are monitored, and the first log is monitored to be generated before the second log, obtaining protocol information in the data packet returned by the IDS traffic probe includes:

[0020] If the first log and the second log are monitored, and it is detected that the first log is generated before the second log, then within the preset unit time detection window, the protocol information in the data packet returned by the IDS traffic probe is obtained.

[0021] Optionally, the method for detecting large-scale sensitive data leakage is characterized by further comprising:

[0022] Data outside the preset unit time detection window is discarded.

[0023] In a second aspect, the present application discloses a large-scale sensitive data leakage detection device, which is applied to a preset detection model, wherein the detection model is used to perform large-scale sensitive data detection on data transmitted between different security domains, and dual unidirectional network gates are pre-deployed between the different security domains, including:

[0024] A log monitoring module, used to monitor whether a first log and a second log exist; wherein the first log is a log corresponding to a preset sensitive keyword, and the second log is a log generated when the flow of the dual unidirectional network gate outlet meets a preset flow threshold;

[0025] A protocol information acquisition module, configured to acquire the protocol information in the data packet returned by the IDS flow probe if the first log and the second log are monitored, and if the first log is monitored to be generated before the second log; wherein the IDS flow probe is pre-deployed between the different security domains;

[0026] A determination module is used to determine whether a large-scale sensitive data leakage occurs based on the protocol information and the first log.

[0027] In a third aspect, the present application discloses an electronic device, comprising:

[0028] Memory, used to store computer programs;

[0029] A processor is used to execute the computer program to implement the aforementioned method for detecting large-scale sensitive data leakage.

[0030] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the aforementioned method for detecting large-scale sensitive data leakage is implemented.

[0031] It can be seen that the present application proposes a method for detecting large-scale sensitive data leakage, which is applied to a preset detection model, wherein the detection model is used to perform large-scale sensitive data detection on data transmitted between different security domains, and dual one-way network gates are pre-deployed between the different security domains, including: monitoring whether there are a first log and a second log; wherein the first log is a log corresponding to a preset sensitive keyword, and the second log is a log generated when the traffic at the exit of the dual one-way network gate meets a preset traffic threshold; if the first log and the second log are monitored, and the first log is monitored to be generated before the second log, then the protocol information in the data packet returned by the IDS flow probe is obtained; wherein the IDS flow probe is pre-deployed between the different security domains; based on the protocol information and the first log, it is determined whether a large-scale sensitive data leakage occurs. In this way, compared with the traditional single detection model based on the IDS flow probe, the present application adds a dual one-way network gate between different security domains to ensure that all data passing through the network gate are monitored, thereby improving the detection accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0033] Figure 1 A flow chart of a method for detecting large-scale sensitive data leakage disclosed in this application;

[0034] Figure 2 A dual unidirectional network gate data interaction flow chart disclosed in this application;

[0035] Figure 3 A schematic diagram of a configuration detection model disclosed in this application;

[0036] Figure 4 A specific network attack scenario diagram based on detection model simulation disclosed in this application;

[0037] Figure 5 This is a schematic diagram of the structure of a large-scale sensitive data leakage detection device disclosed in this application;

[0038] Figure 6 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0039] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0040] Currently, most data leakage detection methods are based on IDS traffic log analysis, which determines whether the data is likely to be stolen by parsing the messages in the return package. This detection method consumes a lot of server resources to analyze the massive amount of probe log data, which consumes too much server resources and has a high false alarm rate.

[0041] To this end, an embodiment of the present application proposes a large-scale sensitive data leakage detection solution, which can improve the detection accuracy of data leakage.

[0042] The present application embodiment discloses a method for detecting large-scale sensitive data leakage, which is applied to a preset detection model, wherein the detection model is used to perform large-scale sensitive data detection on data transmitted between different security domains, wherein dual unidirectional network gates are pre-deployed between the different security domains, see Figure 1 As shown, the method includes:

[0043] Step S11: monitor whether there are a first log and a second log; wherein the first log is a log corresponding to a preset sensitive keyword, and the second log is a log generated when the traffic at the dual unidirectional gateway exit meets a preset traffic threshold.

[0044] It should be noted that when a data packet corresponding to the preset sensitive keyword is monitored through the dual unidirectional network gate, the first log is generated; when the traffic at the dual unidirectional network gate outlet meets the preset traffic threshold, the second log is generated.

[0045] In this embodiment, firstly, the presence of a first log and a second log is detected by the preset detection model; wherein the first log is a log corresponding to a preset sensitive keyword, and the second log is a log generated when the flow of the dual unidirectional network gate outlet meets a preset flow threshold. The preset sensitive keyword and the preset flow threshold can be customized according to actual needs.

[0046] Step S12: If the first log and the second log are monitored, and it is monitored that the first log is generated before the second log, then obtain the protocol information in the data packet returned by the IDS traffic probe; wherein the IDS traffic probe is pre-deployed between the different security domains.

[0047] In this embodiment, if the first log and the second log are monitored, and the first log is generated before the second log, it means that the data transmitted between different security domains contains sensitive keywords and reaches a certain traffic threshold. At this time, within the preset unit time detection window, the protocol information in the data packet returned by the IDS traffic probe is obtained, and the data outside the preset unit time detection window is discarded. It should be pointed out that the unit time detection window can be customized according to actual needs.

[0048] Step S13: determining whether a large-scale sensitive data leakage occurs based on the protocol information and the first log.

[0049] In this embodiment, after the protocol information is determined, it is determined whether a large-scale sensitive data leakage occurs based on the protocol information and the first log. Specifically, the protocol information is compared with the log content of the first log. If the comparison is consistent, it is determined that a large-scale sensitive data leakage occurs.

[0050] In this embodiment, when a large-scale sensitive data leakage occurs, the first log and the second log are analyzed, and the corresponding network attack behavior is determined based on the analysis results, and then an alarm is issued, that is, an alarm information is output, and the alarm information includes but is not limited to source IP (Internet Protocol), target IP, occurrence time, protocol, file name, file path and other information.

[0051] It can be seen that the present application proposes a method for detecting large-scale sensitive data leakage, which is applied to a preset detection model, wherein the detection model is used to perform large-scale sensitive data detection on data transmitted between different security domains, and dual one-way network gates are pre-deployed between the different security domains, including: monitoring whether there are a first log and a second log; wherein the first log is a log corresponding to a preset sensitive keyword, and the second log is a log generated when the traffic at the exit of the dual one-way network gate meets a preset traffic threshold; if the first log and the second log are monitored, and the first log is monitored to be generated before the second log, then the protocol information in the data packet returned by the IDS flow probe is obtained; wherein the IDS flow probe is pre-deployed between the different security domains; based on the protocol information and the first log, it is determined whether a large-scale sensitive data leakage occurs. In this way, compared with the traditional single detection model based on the IDS flow probe, the present application adds a dual one-way network gate between different security domains to ensure that all data passing through the network gate are monitored, thereby improving the detection accuracy.

[0052] Figure 2 This is a dual unidirectional network gate data interaction flow chart disclosed in this application, see Figure 2 As shown, the present application deploys dual unidirectional network gates between the low-level security domain and the high-level security domain. Through the dual unidirectional network gates, data monitoring can be performed when data is transmitted between the sending process in the low-level security domain and the receiving process between the high-level security domain, and data monitoring can be performed when data is transmitted between the receiving process in the low-level security domain and the sending process between the high-level security domain.

[0053] Figure 3 This is a schematic diagram of a configuration detection model disclosed in this application.

[0054] First of all, it should be pointed out that when the network gate API (Application Program Interface) detects a data packet corresponding to a preset sensitive keyword, the first log is generated, that is, situation 1 occurs. When the traffic at the network gate API outlet meets the preset traffic threshold, the second log is generated, that is, situation 2 occurs. When both situation 1 and situation 2 occur, and situation 1 occurs before situation 2, the protocol information in the log returned by the IDS traffic probe is obtained. If the protocol information is consistent with the content in the first log, it is determined that a large-scale sensitive data leak has occurred, and an alarm for large-scale sensitive data is issued at this time.

[0055] Figure 4 This is a specific network attack scenario diagram based on detection model simulation disclosed in this application, see Figure 4 shown.

[0056] After detecting and scouting the area, an attack organization in the Internet zone infiltrated into the intranet through the core router; it used the weaknesses obtained through scanning to attack Terminal 1 in the low-security domain; it established a long connection channel, used Terminal 1 in the low-security domain as a target, and launched scanning, reconnaissance, and penetration attacks on terminals in the high-security domain; it obtained that there was a large amount of valuable data in Terminal 6 in the high-security domain, and initiated frequent data requests to it (such as ftp / http protocols, etc.); Terminal 6 responded to the data request and sent valuable data to Terminal 1; Terminal 1 obtained the target data and made a profit.

[0057] Through the large-scale sensitive data leakage detection method in the present application, when the dual one-way network gate detects that the data sent by terminal 6 to terminal 1 contains sensitive words, a first log is generated. If the traffic at the dual one-way network gate outlet reaches a preset traffic threshold, a second log is generated. Furthermore, when both the first log and the second log are generated, and the first log is generated before the second log, the protocol information in the data packet returned by the network abnormal behavior detection system (IDS) is obtained. If the protocol information is consistent with the content in the first log, it is determined that a large-scale sensitive data leakage has occurred, and an alarm for large-scale sensitive data is issued at this time.

[0058] Correspondingly, the embodiment of the present application also discloses a large-scale sensitive data leakage detection device, which is applied to a preset detection model, wherein the detection model is used to perform large-scale sensitive data detection on data transmitted between different security domains, and dual unidirectional network gates are pre-deployed between the different security domains, see Figure 5 As shown, the device comprises:

[0059] The log monitoring module 11 is used to monitor whether there is a first log and a second log; wherein the first log is a log corresponding to a preset sensitive keyword, and the second log is a log generated when the flow of the dual unidirectional network gate outlet meets a preset flow threshold;

[0060] The protocol information acquisition module 12 is used to acquire the protocol information in the data packet returned by the IDS flow probe if the first log and the second log are monitored, and the first log is monitored to be generated before the second log; wherein the IDS flow probe is pre-deployed between the different security domains;

[0061] The determination module 13 is used to determine whether a large-scale sensitive data leakage occurs based on the protocol information and the first log.

[0062] Among them, for more specific working processes of the above-mentioned modules, please refer to the corresponding contents disclosed in the aforementioned embodiments, which will not be repeated here.

[0063] It can be seen that the present application proposes a method for detecting large-scale sensitive data leakage, which is applied to a preset detection model, wherein the detection model is used to perform large-scale sensitive data detection on data transmitted between different security domains, and dual one-way network gates are pre-deployed between the different security domains, including: monitoring whether there are a first log and a second log; wherein the first log is a log corresponding to a preset sensitive keyword, and the second log is a log generated when the traffic at the exit of the dual one-way network gate meets a preset traffic threshold; if the first log and the second log are monitored, and the first log is monitored to be generated before the second log, then the protocol information in the data packet returned by the IDS flow probe is obtained; wherein the IDS flow probe is pre-deployed between the different security domains; based on the protocol information and the first log, it is determined whether a large-scale sensitive data leakage occurs. In this way, compared with the traditional single detection model based on the IDS flow probe, the present application adds a dual one-way network gate between different security domains to ensure that all data passing through the network gate are monitored, thereby improving the detection accuracy.

[0064] In some specific embodiments, the large-scale sensitive data leakage detection device further includes:

[0065] A first log generating module, configured to generate the first log when a data packet corresponding to the preset sensitive keyword is detected through the dual unidirectional network gate;

[0066] The second log generating module is used to generate the second log when the flow rate of the dual unidirectional network gate outlet meets a preset flow rate threshold.

[0067] In some specific embodiments, the determination module 13 may specifically include:

[0068] The determination unit is used to compare the protocol information with the log content of the first log, and if the comparison is consistent, determine that a large-scale sensitive data leakage occurs.

[0069] In some specific embodiments, after the determination unit, the following may further be included:

[0070] The alarm unit is used to analyze the first log and the second log, determine the corresponding network attack behavior according to the analysis result, and then issue an alarm prompt.

[0071] In some specific embodiments, the alarm unit may be used to:

[0072] According to the analysis results, the corresponding network attack behavior is determined, and then the alarm information is output.

[0073] In some specific embodiments, the protocol information acquisition module 12 may specifically include:

[0074] A protocol information acquisition unit is used to acquire the protocol information in the data packet returned by the IDS flow probe within the preset unit time detection window if the first log and the second log are monitored and the first log is detected to be generated before the second log.

[0075] In some specific embodiments, the large-scale sensitive data leakage detection device may further include:

[0076] The data discarding unit is used to discard the data outside the preset unit time detection window.

[0077] Furthermore, an embodiment of the present application also provides an electronic device. Figure 6 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram cannot be regarded as any limitation on the scope of use of the present application.

[0078] Figure 6 The present invention provides a schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may include: at least one processor 21, at least one memory 22, a display screen 23, an input / output interface 24, a communication interface 25, a power supply 26, and a communication bus 27. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the following steps:

[0079] Monitor whether there is a first log and a second log; wherein the first log is a log corresponding to a preset sensitive keyword, and the second log is a log generated when the flow of the dual unidirectional network gate outlet meets a preset flow threshold;

[0080] If the first log and the second log are monitored, and the first log is monitored to be generated before the second log, then obtaining the protocol information in the data packet returned by the IDS flow probe; wherein the IDS flow probe is pre-deployed between the different security domains;

[0081] Based on the protocol information and the first log, it is determined whether a large-scale sensitive data leakage occurs.

[0082] In some specific implementations, the processor may further implement the following steps by executing the computer program stored in the memory:

[0083] When a data packet corresponding to the preset sensitive keyword is detected through the dual unidirectional network gate, the first log is generated;

[0084] When the flow rate at the dual unidirectional gateway exit meets the preset flow rate threshold, the second log is generated.

[0085] In some specific implementations, the processor can implement the following steps by executing the computer program stored in the memory:

[0086] The protocol information is compared with the log content of the first log. If the comparison is consistent, it is determined that a large-scale sensitive data leakage has occurred.

[0087] In some specific implementations, the processor may further implement the following steps by executing the computer program stored in the memory:

[0088] The first log and the second log are analyzed, and corresponding network attack behaviors are determined according to the analysis results, and then an alarm is issued.

[0089] In some specific implementations, the processor can implement the following steps by executing the computer program stored in the memory:

[0090] According to the analysis results, the corresponding network attack behavior is determined, and then the alarm information is output.

[0091] In some specific implementations, the processor can implement the following steps by executing the computer program stored in the memory:

[0092] If the first log and the second log are monitored, and it is detected that the first log is generated before the second log, then within the preset unit time detection window, the protocol information in the data packet returned by the IDS traffic probe is obtained.

[0093] In some specific implementations, the processor may further implement the following steps by executing the computer program stored in the memory:

[0094] Data outside the preset unit time detection window is discarded.

[0095] In this embodiment, the power supply 26 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 25 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 24 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0096] In addition, the memory 22, as a carrier for storing resources, may be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon may include a computer program 221, and the storage method may be temporary storage or permanent storage. In addition to including a computer program that can be used to complete the large-scale sensitive data leakage detection method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 221 may further include a computer program that can be used to complete other specific tasks.

[0097] Furthermore, an embodiment of the present application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the aforementioned method for detecting large-scale sensitive data leakage is implemented.

[0098] For the specific steps of the method, reference may be made to the corresponding contents disclosed in the aforementioned embodiments, which will not be described in detail here.

[0099] The various embodiments in this application are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0100] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0101] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0102] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0103] The above is a detailed introduction to the large-scale sensitive data leakage detection method, device, equipment, and storage medium provided by the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A method for detecting large-scale sensitive data leakage, characterized in that: Applied to a preset detection model, the detection model is used to perform large-scale sensitive data detection on data transmitted between different security domains, and dual unidirectional network gates are pre-deployed between the different security domains, including: Monitor whether there is a first log and a second log; wherein the first log is a log corresponding to a preset sensitive keyword, and the second log is a log generated when the flow of the dual unidirectional network gate outlet meets a preset flow threshold; If the first log and the second log are monitored, and the first log is monitored to be generated before the second log, then obtaining the protocol information in the data packet returned by the IDS flow probe; wherein the IDS flow probe is pre-deployed between the different security domains; Based on the protocol information and the first log, it is determined whether a large-scale sensitive data leakage occurs.

2. The method for detecting large-scale sensitive data leakage according to claim 1, characterized in that: Also includes: When a data packet corresponding to the preset sensitive keyword is detected through the dual unidirectional network gate, the first log is generated; When the flow rate at the dual unidirectional gateway exit meets the preset flow rate threshold, the second log is generated.

3. The method for detecting large-scale sensitive data leakage according to claim 1, characterized in that: The determining whether a large-scale sensitive data leakage occurs based on the protocol information and the first log includes: The protocol information is compared with the log content of the first log. If the comparison is consistent, it is determined that a large-scale sensitive data leakage has occurred.

4. The method for detecting large-scale sensitive data leakage according to claim 3, characterized in that: If the comparison is consistent, it is determined that a large-scale sensitive data leakage has occurred, and the following further includes: The first log and the second log are analyzed, and corresponding network attack behaviors are determined according to the analysis results, and then an alarm is issued.

5. The method for detecting large-scale sensitive data leakage according to claim 4, characterized in that: Determining the corresponding network attack behavior based on the analysis results and then issuing an alarm prompt includes: According to the analysis results, the corresponding network attack behavior is determined, and then the alarm information is output.

6. The method for detecting large-scale sensitive data leakage according to any one of claims 1 to 5, characterized in that: If the first log and the second log are monitored, and the first log is monitored to be generated before the second log, obtaining protocol information in the data packet returned by the IDS traffic probe includes: If the first log and the second log are monitored, and it is detected that the first log is generated before the second log, then within a preset unit time detection window, the protocol information in the data packet returned by the IDS traffic probe is obtained.

7. The method for detecting large-scale sensitive data leakage according to claim 6, characterized in that: Also includes: Data outside the preset unit time detection window is discarded.

8. A device for detecting large-scale sensitive data leakage, characterized in that: Applied to a preset detection model, the detection model is used to perform large-scale sensitive data detection on data transmitted between different security domains, and dual unidirectional network gates are pre-deployed between the different security domains, including: A log monitoring module, used to monitor whether a first log and a second log exist; wherein the first log is a log corresponding to a preset sensitive keyword, and the second log is a log generated when the flow of the dual unidirectional network gate outlet meets a preset flow threshold; A protocol information acquisition module, configured to acquire the protocol information in the data packet returned by the IDS flow probe if the first log and the second log are monitored, and if the first log is monitored to be generated before the second log; wherein the IDS flow probe is pre-deployed between the different security domains; A determination module is used to determine whether a large-scale sensitive data leakage occurs based on the protocol information and the first log.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the method for detecting large-scale sensitive data leakage as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store a computer program; wherein, when the computer program is executed by a processor, the method for detecting large-scale sensitive data leakage as described in any one of claims 1 to 7 is implemented.

Images